From 4e100ccec1251ced52904217b56ad39ef7a221ec Mon Sep 17 00:00:00 2001 From: Mohan Boddu Date: Thu, 10 Jul 2025 19:10:39 -0400 Subject: [PATCH] Adding versioned docs with search Also includes syncing of docs from podman repo Signed-off-by: Mohan Boddu --- .github/workflows/sync-podman-docs.yml | 91 + docs/checkpoint.md | 75 - docs/documentation.md | 5 - docs/index.md | 228 - docs/installation.md | 723 - docusaurus.config.js | 62 +- package-lock.json | 19546 ++++++++++++++++ package.json | 33 +- podman-versions.json | 60 + scripts/fix-markdown-directives.js | 400 + scripts/sync-podman-docs.js | 1119 + sidebars-podman.js | 41 + sidebars.js | 4 +- src/css/docs-version-selector.css | 101 + src/css/main.css | 104 + static/js/docs-version-selector.js | 228 + .../version-5.4.1/MANPAGE_SYNTAX.md | 147 + versioned_docs/version-5.4.1/index.md | 42 + .../version-5.4.1/kubernetes_support.md | 208 + .../source/markdown/options/README.md | 68 + .../source/markdown/options/add-host.md | 44 + .../markdown/options/annotation.container.md | 12 + .../markdown/options/annotation.image.md | 16 + .../markdown/options/annotation.manifest.md | 12 + .../source/markdown/options/arch.md | 12 + .../source/markdown/options/attach.md | 19 + .../source/markdown/options/authfile.md | 15 + .../markdown/options/blkio-weight-device.md | 12 + .../source/markdown/options/blkio-weight.md | 14 + .../source/markdown/options/build-arg-file.md | 27 + .../source/markdown/options/build-arg.md | 13 + .../source/markdown/options/build-context.md | 35 + .../source/markdown/options/cache-from.md | 26 + .../source/markdown/options/cache-to.md | 24 + .../source/markdown/options/cache-ttl.md | 17 + .../source/markdown/options/cap-add.image.md | 15 + .../source/markdown/options/cap-add.md | 12 + .../source/markdown/options/cap-drop.image.md | 21 + .../source/markdown/options/cap-drop.md | 12 + .../source/markdown/options/cert-dir.md | 14 + .../source/markdown/options/cgroup-conf.md | 12 + .../source/markdown/options/cgroup-parent.md | 14 + .../source/markdown/options/cgroupns.image.md | 15 + .../source/markdown/options/cgroupns.md | 19 + .../source/markdown/options/cgroups.md | 19 + .../source/markdown/options/chrootdirs.md | 14 + .../source/markdown/options/cidfile.read.md | 13 + .../source/markdown/options/cidfile.write.md | 13 + .../source/markdown/options/color.md | 12 + .../markdown/options/compat-auth-file.md | 12 + .../source/markdown/options/compat-volumes.md | 16 + .../markdown/options/compression-format.md | 13 + .../markdown/options/compression-level.md | 12 + .../source/markdown/options/conmon-pidfile.md | 13 + .../source/markdown/options/cpp-flag.md | 12 + .../source/markdown/options/cpu-period.md | 21 + .../source/markdown/options/cpu-quota.md | 23 + .../source/markdown/options/cpu-rt-period.md | 16 + .../source/markdown/options/cpu-rt-runtime.md | 19 + .../source/markdown/options/cpu-shares.md | 50 + .../source/markdown/options/cpus.container.md | 20 + .../source/markdown/options/cpuset-cpus.md | 20 + .../source/markdown/options/cpuset-mems.md | 23 + .../source/markdown/options/creds.md | 19 + .../source/markdown/options/decryption-key.md | 12 + .../source/markdown/options/destroy.md | 12 + .../source/markdown/options/detach-keys.md | 14 + .../markdown/options/device-cgroup-rule.md | 17 + .../markdown/options/device-read-bps.md | 18 + .../markdown/options/device-read-iops.md | 18 + .../markdown/options/device-write-bps.md | 18 + .../markdown/options/device-write-iops.md | 18 + .../source/markdown/options/device.md | 31 + .../source/markdown/options/digestfile.md | 12 + .../source/markdown/options/dir-compress.md | 12 + .../markdown/options/disable-compression.md | 17 + .../markdown/options/disable-content-trust.md | 14 + .../markdown/options/dns-option.container.md | 12 + .../markdown/options/dns-option.image.md | 12 + .../markdown/options/dns-search.container.md | 13 + .../markdown/options/dns-search.image.md | 12 + .../source/markdown/options/dns.md | 20 + .../source/markdown/options/entrypoint.md | 23 + .../source/markdown/options/env-file.md | 12 + .../source/markdown/options/env-host.md | 12 + .../source/markdown/options/env-merge.md | 18 + .../source/markdown/options/env.image.md | 16 + .../source/markdown/options/env.md | 14 + .../source/markdown/options/expose.md | 17 + .../source/markdown/options/farm.md | 12 + .../source/markdown/options/features.md | 13 + .../source/markdown/options/file.md | 21 + .../source/markdown/options/follow.md | 16 + .../markdown/options/force-compression.md | 13 + .../source/markdown/options/force-rm.md | 12 + .../source/markdown/options/format.md | 17 + .../source/markdown/options/from.md | 18 + .../markdown/options/gidmap.container.md | 17 + .../source/markdown/options/gidmap.pod.md | 13 + .../source/markdown/options/gpus.md | 13 + .../source/markdown/options/group-add.md | 20 + .../source/markdown/options/group-entry.md | 14 + .../source/markdown/options/health-cmd.md | 17 + .../markdown/options/health-interval.md | 12 + .../options/health-log-destination.md | 16 + .../markdown/options/health-max-log-count.md | 12 + .../markdown/options/health-max-log-size.md | 12 + .../markdown/options/health-on-failure.md | 17 + .../source/markdown/options/health-retries.md | 12 + .../markdown/options/health-start-period.md | 19 + .../markdown/options/health-startup-cmd.md | 16 + .../options/health-startup-interval.md | 12 + .../options/health-startup-retries.md | 12 + .../options/health-startup-success.md | 13 + .../options/health-startup-timeout.md | 13 + .../source/markdown/options/health-timeout.md | 13 + .../source/markdown/options/help.md | 12 + .../source/markdown/options/hooks-dir.md | 20 + .../markdown/options/hostname.container.md | 18 + .../source/markdown/options/hostname.pod.md | 15 + .../source/markdown/options/hosts-file.md | 17 + .../source/markdown/options/hostuser.md | 13 + .../source/markdown/options/http-proxy.md | 25 + .../source/markdown/options/identity-label.md | 12 + .../source/markdown/options/ignore.md | 14 + .../source/markdown/options/ignorefile.md | 12 + .../source/markdown/options/iidfile.md | 12 + .../source/markdown/options/image-volume.md | 17 + .../source/markdown/options/infra-command.md | 12 + .../markdown/options/infra-conmon-pidfile.md | 12 + .../source/markdown/options/infra-name.md | 12 + .../source/markdown/options/init-path.md | 12 + .../source/markdown/options/init.md | 14 + .../source/markdown/options/interactive.md | 16 + .../source/markdown/options/ip.md | 17 + .../source/markdown/options/ip6.md | 17 + .../source/markdown/options/ipc.image.md | 17 + .../source/markdown/options/ipc.md | 21 + .../source/markdown/options/isolation.md | 22 + .../source/markdown/options/jobs.md | 14 + .../source/markdown/options/label-file.md | 12 + .../source/markdown/options/label.image.md | 23 + .../source/markdown/options/label.md | 12 + .../source/markdown/options/latest.md | 15 + .../source/markdown/options/layer-label.md | 16 + .../source/markdown/options/layers.md | 15 + .../source/markdown/options/link-local-ip.md | 12 + .../source/markdown/options/log-driver.md | 23 + .../source/markdown/options/log-opt.md | 25 + .../source/markdown/options/logfile.md | 14 + .../source/markdown/options/mac-address.md | 20 + .../source/markdown/options/manifest.md | 12 + .../markdown/options/memory-reservation.md | 20 + .../source/markdown/options/memory-swap.md | 22 + .../markdown/options/memory-swappiness.md | 14 + .../source/markdown/options/memory.md | 20 + .../source/markdown/options/mount.md | 112 + .../source/markdown/options/name.container.md | 25 + .../source/markdown/options/names.md | 12 + .../source/markdown/options/network-alias.md | 17 + .../source/markdown/options/network.image.md | 68 + .../source/markdown/options/network.md | 92 + .../source/markdown/options/no-cache.md | 12 + .../source/markdown/options/no-healthcheck.md | 12 + .../source/markdown/options/no-hostname.md | 14 + .../source/markdown/options/no-hosts.md | 21 + .../source/markdown/options/no-reset.md | 12 + .../source/markdown/options/no-stream.md | 12 + .../source/markdown/options/no-trunc.md | 12 + .../source/markdown/options/noheading.md | 12 + .../source/markdown/options/omit-history.md | 17 + .../markdown/options/oom-kill-disable.md | 14 + .../source/markdown/options/oom-score-adj.md | 16 + .../source/markdown/options/os-feature.md | 14 + .../markdown/options/os-version.image.md | 12 + .../source/markdown/options/os-version.md | 13 + .../source/markdown/options/os.md | 12 + .../source/markdown/options/os.pull.md | 13 + .../source/markdown/options/passwd-entry.md | 14 + .../source/markdown/options/personality.md | 12 + .../source/markdown/options/pid.container.md | 18 + .../source/markdown/options/pid.image.md | 14 + .../source/markdown/options/pid.pod.md | 16 + .../source/markdown/options/pidfile.md | 18 + .../source/markdown/options/pids-limit.md | 12 + .../source/markdown/options/platform.md | 14 + .../markdown/options/pod-id-file.container.md | 13 + .../markdown/options/pod-id-file.pod.md | 12 + .../source/markdown/options/pod.run.md | 14 + .../source/markdown/options/preserve-fd.md | 15 + .../source/markdown/options/preserve-fds.md | 14 + .../source/markdown/options/privileged.md | 28 + .../source/markdown/options/publish-all.md | 21 + .../source/markdown/options/publish.md | 31 + .../source/markdown/options/pull.image.md | 17 + .../source/markdown/options/pull.md | 17 + .../source/markdown/options/quiet.md | 12 + .../source/markdown/options/rdt-class.md | 12 + .../markdown/options/read-only-tmpfs.md | 31 + .../source/markdown/options/read-only.md | 15 + .../source/markdown/options/replace.md | 12 + .../source/markdown/options/requires.md | 14 + .../source/markdown/options/restart.md | 27 + .../source/markdown/options/retry-delay.md | 13 + .../source/markdown/options/retry.md | 13 + .../source/markdown/options/rm.md | 12 + .../source/markdown/options/rootfs.md | 39 + .../source/markdown/options/runtime-flag.md | 14 + .../source/markdown/options/runtime.md | 15 + .../markdown/options/sbom-image-output.md | 13 + .../options/sbom-image-purl-output.md | 15 + .../markdown/options/sbom-merge-strategy.md | 29 + .../source/markdown/options/sbom-output.md | 13 + .../markdown/options/sbom-purl-output.md | 15 + .../markdown/options/sbom-scanner-command.md | 20 + .../markdown/options/sbom-scanner-image.md | 12 + .../source/markdown/options/sbom.md | 38 + .../source/markdown/options/sdnotify.md | 21 + .../source/markdown/options/seccomp-policy.md | 14 + .../source/markdown/options/secret.image.md | 28 + .../source/markdown/options/secret.md | 59 + .../markdown/options/security-opt.image.md | 27 + .../source/markdown/options/security-opt.md | 41 + .../markdown/options/shm-size-systemd.md | 15 + .../source/markdown/options/shm-size.md | 15 + .../source/markdown/options/sig-proxy.md | 12 + .../markdown/options/sign-by-sigstore.md | 13 + .../markdown/options/sign-passphrase-file.md | 12 + .../source/markdown/options/signal.md | 13 + .../source/markdown/options/since.md | 15 + .../markdown/options/skip-unused-stages.md | 12 + .../source/markdown/options/squash-all.md | 12 + .../source/markdown/options/squash.md | 12 + .../source/markdown/options/ssh.md | 17 + .../source/markdown/options/stop-signal.md | 12 + .../source/markdown/options/stop-timeout.md | 13 + .../source/markdown/options/subgidname.md | 14 + .../source/markdown/options/subuidname.md | 14 + .../source/markdown/options/sysctl.md | 30 + .../source/markdown/options/systemd.md | 42 + .../source/markdown/options/tag.md | 13 + .../source/markdown/options/tail.md | 13 + .../source/markdown/options/target.md | 12 + .../source/markdown/options/time.md | 13 + .../source/markdown/options/timeout.md | 14 + .../source/markdown/options/timestamp.md | 15 + .../source/markdown/options/timestamps.md | 12 + .../source/markdown/options/tls-verify.md | 16 + .../source/markdown/options/tmpfs.md | 23 + .../source/markdown/options/tty.md | 18 + .../source/markdown/options/tz.md | 13 + .../markdown/options/uidmap.container.md | 201 + .../source/markdown/options/uidmap.pod.md | 15 + .../source/markdown/options/ulimit.image.md | 27 + .../source/markdown/options/ulimit.md | 33 + .../source/markdown/options/umask.md | 13 + .../source/markdown/options/unsetenv-all.md | 14 + .../source/markdown/options/unsetenv.image.md | 12 + .../source/markdown/options/unsetenv.md | 14 + .../source/markdown/options/unsetlabel.md | 12 + .../source/markdown/options/until.md | 15 + .../markdown/options/user-mode-networking.md | 26 + .../source/markdown/options/user.md | 16 + .../markdown/options/userns-gid-map-group.md | 19 + .../source/markdown/options/userns-gid-map.md | 24 + .../markdown/options/userns-uid-map-user.md | 19 + .../source/markdown/options/userns-uid-map.md | 24 + .../markdown/options/userns.container.md | 74 + .../source/markdown/options/userns.image.md | 13 + .../source/markdown/options/userns.pod.md | 38 + .../source/markdown/options/uts.container.md | 17 + .../source/markdown/options/uts.md | 13 + .../source/markdown/options/uts.pod.md | 16 + .../markdown/options/variant.container.md | 12 + .../markdown/options/variant.manifest.md | 14 + .../source/markdown/options/volume.image.md | 125 + .../source/markdown/options/volume.md | 214 + .../source/markdown/options/volumes-from.md | 41 + .../source/markdown/options/workdir.md | 16 + .../source/markdown/podman-artifact-add.1.md | 68 + .../markdown/podman-artifact-inspect.1.md | 43 + .../source/markdown/podman-artifact-ls.1.md | 90 + .../source/markdown/podman-artifact-pull.1.md | 140 + .../source/markdown/podman-artifact-push.1.md | 149 + .../source/markdown/podman-artifact-rm.1.md | 51 + .../source/markdown/podman-artifact.1.md | 41 + .../source/markdown/podman-attach.1.md | 78 + .../source/markdown/podman-auto-update.1.md | 146 + .../source/markdown/podman-build.1.md | 1943 ++ .../source/markdown/podman-commit.1.md | 139 + .../source/markdown/podman-completion.1.md | 83 + .../source/markdown/podman-compose.1.md | 28 + .../markdown/podman-container-checkpoint.1.md | 231 + .../markdown/podman-container-cleanup.1.md | 61 + .../markdown/podman-container-clone.1.md | 362 + .../markdown/podman-container-diff.1.md | 65 + .../markdown/podman-container-exists.1.md | 56 + .../markdown/podman-container-inspect.1.md | 349 + .../markdown/podman-container-prune.1.md | 83 + .../markdown/podman-container-restore.1.md | 198 + .../markdown/podman-container-runlabel.1.md | 128 + .../source/markdown/podman-container.1.md | 58 + .../source/markdown/podman-cp.1.md | 140 + .../source/markdown/podman-create.1.md | 2849 +++ .../source/markdown/podman-diff.1.md | 75 + .../source/markdown/podman-events.1.md | 222 + .../source/markdown/podman-exec.1.md | 208 + .../source/markdown/podman-export.1.md | 56 + .../source/markdown/podman-farm-build.1.md | 1564 ++ .../source/markdown/podman-farm-create.1.md | 39 + .../source/markdown/podman-farm-list.1.md | 47 + .../source/markdown/podman-farm-remove.1.md | 41 + .../source/markdown/podman-farm-update.1.md | 53 + .../source/markdown/podman-farm.1.md | 46 + .../source/markdown/podman-generate-spec.1.md | 31 + .../markdown/podman-generate-systemd.1.md | 326 + .../source/markdown/podman-generate.1.md | 27 + .../markdown/podman-healthcheck-run.1.md | 45 + .../source/markdown/podman-healthcheck.1.md | 27 + .../source/markdown/podman-history.1.md | 110 + .../source/markdown/podman-image-diff.1.md | 61 + .../source/markdown/podman-image-exists.1.md | 46 + .../source/markdown/podman-image-inspect.1.md | 139 + .../source/markdown/podman-image-mount.1.md | 82 + .../source/markdown/podman-image-prune.1.md | 121 + .../source/markdown/podman-image-scp.1.md | 107 + .../source/markdown/podman-image-sign.1.md | 94 + .../source/markdown/podman-image-tree.1.md | 91 + .../source/markdown/podman-image-trust.1.md | 211 + .../source/markdown/podman-image-unmount.1.md | 55 + .../source/markdown/podman-image.1.md | 45 + .../source/markdown/podman-images.1.md | 268 + .../source/markdown/podman-import.1.md | 121 + .../source/markdown/podman-info.1.md | 409 + .../source/markdown/podman-init.1.md | 61 + .../source/markdown/podman-inspect.1.md | 185 + .../source/markdown/podman-kill.1.md | 91 + .../source/markdown/podman-kube-apply.1.md | 79 + .../source/markdown/podman-kube-down.1.md | 76 + .../source/markdown/podman-kube-generate.1.md | 254 + .../source/markdown/podman-kube-play.1.md | 813 + .../source/markdown/podman-kube.1.md | 35 + .../source/markdown/podman-load.1.md | 92 + .../source/markdown/podman-login.1.md | 188 + .../source/markdown/podman-logout.1.md | 77 + .../source/markdown/podman-logs.1.md | 173 + .../source/markdown/podman-machine-info.1.md | 107 + .../source/markdown/podman-machine-init.1.md | 250 + .../markdown/podman-machine-inspect.1.md | 60 + .../source/markdown/podman-machine-list.1.md | 117 + .../markdown/podman-machine-os-apply.1.md | 54 + .../source/markdown/podman-machine-os.1.md | 27 + .../source/markdown/podman-machine-reset.1.md | 52 + .../source/markdown/podman-machine-rm.1.md | 71 + .../source/markdown/podman-machine-set.1.md | 126 + .../source/markdown/podman-machine-ssh.1.md | 91 + .../source/markdown/podman-machine-start.1.md | 58 + .../source/markdown/podman-machine-stop.1.md | 47 + .../source/markdown/podman-machine.1.md | 55 + .../source/markdown/podman-manifest-add.1.md | 235 + .../markdown/podman-manifest-annotate.1.md | 95 + .../markdown/podman-manifest-create.1.md | 79 + .../markdown/podman-manifest-exists.1.md | 47 + .../markdown/podman-manifest-inspect.1.md | 54 + .../source/markdown/podman-manifest-push.1.md | 173 + .../markdown/podman-manifest-remove.1.md | 29 + .../source/markdown/podman-manifest-rm.1.md | 36 + .../source/markdown/podman-manifest.1.md | 76 + .../source/markdown/podman-mount.1.md | 86 + .../markdown/podman-network-connect.1.md | 55 + .../markdown/podman-network-create.1.md | 220 + .../markdown/podman-network-disconnect.1.md | 37 + .../markdown/podman-network-exists.1.md | 47 + .../markdown/podman-network-inspect.1.md | 83 + .../source/markdown/podman-network-ls.1.md | 124 + .../source/markdown/podman-network-prune.1.md | 58 + .../markdown/podman-network-reload.1.md | 67 + .../source/markdown/podman-network-rm.1.md | 54 + .../markdown/podman-network-update.1.md | 41 + .../source/markdown/podman-network.1.md | 61 + .../source/markdown/podman-pause.1.md | 102 + .../source/markdown/podman-pod-clone.1.md | 794 + .../source/markdown/podman-pod-create.1.md | 1130 + .../source/markdown/podman-pod-exists.1.md | 38 + .../source/markdown/podman-pod-inspect.1.md | 113 + .../source/markdown/podman-pod-kill.1.md | 73 + .../source/markdown/podman-pod-logs.1.md | 136 + .../source/markdown/podman-pod-pause.1.md | 43 + .../source/markdown/podman-pod-prune.1.md | 38 + .../source/markdown/podman-pod-ps.1.md | 206 + .../source/markdown/podman-pod-restart.1.md | 64 + .../source/markdown/podman-pod-rm.1.md | 109 + .../source/markdown/podman-pod-start.1.md | 74 + .../source/markdown/podman-pod-stats.1.md | 116 + .../source/markdown/podman-pod-stop.1.md | 111 + .../source/markdown/podman-pod-top.1.md | 65 + .../source/markdown/podman-pod-unpause.1.md | 43 + .../source/markdown/podman-pod.1.md | 42 + .../source/markdown/podman-port.1.md | 71 + .../source/markdown/podman-ps.1.md | 228 + .../source/markdown/podman-pull.1.md | 327 + .../source/markdown/podman-push.1.md | 276 + .../source/markdown/podman-remote.1.md | 206 + .../source/markdown/podman-rename.1.md | 43 + .../source/markdown/podman-restart.1.md | 120 + .../source/markdown/podman-rm.1.md | 162 + .../source/markdown/podman-rmi.1.md | 81 + .../source/markdown/podman-rootless.7.md | 54 + .../source/markdown/podman-run.1.md | 3258 +++ .../source/markdown/podman-save.1.md | 107 + .../source/markdown/podman-search.1.md | 191 + .../source/markdown/podman-secret-create.1.md | 112 + .../source/markdown/podman-secret-exists.1.md | 48 + .../markdown/podman-secret-inspect.1.md | 73 + .../source/markdown/podman-secret-ls.1.md | 84 + .../source/markdown/podman-secret-rm.1.md | 48 + .../source/markdown/podman-secret.1.md | 31 + .../source/markdown/podman-start.1.md | 127 + .../source/markdown/podman-stats.1.md | 164 + .../source/markdown/podman-stop.1.md | 141 + .../source/markdown/podman-system-check.1.md | 64 + .../podman-system-connection-add.1.md | 69 + .../podman-system-connection-default.1.md | 27 + .../podman-system-connection-list.1.md | 51 + .../podman-system-connection-remove.1.md | 33 + .../podman-system-connection-rename.1.md | 27 + .../markdown/podman-system-connection.1.md | 52 + .../source/markdown/podman-system-df.1.md | 80 + .../markdown/podman-system-migrate.1.md | 44 + .../source/markdown/podman-system-prune.1.md | 76 + .../markdown/podman-system-renumber.1.md | 31 + .../source/markdown/podman-system-reset.1.md | 72 + .../markdown/podman-system-service.1.md | 146 + .../source/markdown/podman-system.1.md | 33 + .../source/markdown/podman-systemd.unit.5.md | 2105 ++ .../source/markdown/podman-tag.1.md | 51 + .../source/markdown/podman-top.1.md | 125 + .../markdown/podman-troubleshooting.7.md | 1552 ++ .../source/markdown/podman-unmount.1.md | 75 + .../source/markdown/podman-unpause.1.md | 102 + .../source/markdown/podman-unshare.1.md | 114 + .../source/markdown/podman-untag.1.md | 46 + .../source/markdown/podman-update.1.md | 523 + .../source/markdown/podman-version.1.md | 60 + .../source/markdown/podman-volume-create.1.md | 213 + .../source/markdown/podman-volume-exists.1.md | 48 + .../source/markdown/podman-volume-export.1.md | 43 + .../source/markdown/podman-volume-import.1.md | 46 + .../markdown/podman-volume-inspect.1.md | 109 + .../source/markdown/podman-volume-ls.1.md | 117 + .../source/markdown/podman-volume-mount.1.md | 41 + .../source/markdown/podman-volume-prune.1.md | 77 + .../source/markdown/podman-volume-reload.1.md | 35 + .../source/markdown/podman-volume-rm.1.md | 70 + .../markdown/podman-volume-unmount.1.md | 37 + .../source/markdown/podman-volume.1.md | 37 + .../source/markdown/podman-wait.1.md | 103 + .../version-5.4.1/source/markdown/podman.1.md | 487 + .../source/markdown/podmansh.1.md | 138 + .../version-5.4.1/tutorials/README.md | 46 + .../tutorials/basic_networking.md | 336 + .../version-5.4.1/tutorials/image_signing.md | 199 + .../version-5.4.1/tutorials/mac_client.md | 7 + .../version-5.4.1/tutorials/mac_win_client.md | 120 + .../version-5.4.1/tutorials/performance.md | 249 + .../tutorials/podman-derivative-api.md | 60 + .../tutorials/podman-for-windows.md | 426 + .../podman-install-certificate-authority.md | 114 + .../tutorials/podman_tutorial.md | 149 + .../tutorials/podman_tutorial_cn.md | 175 + .../tutorials/qemu-remote-tutorial.md | 137 + .../version-5.4.1/tutorials/remote_client.md | 124 + .../tutorials/rootless_tutorial.md | 221 + .../tutorials/socket_activation.md | 289 + .../version-5.4.2/MANPAGE_SYNTAX.md | 147 + versioned_docs/version-5.4.2/index.md | 42 + .../version-5.4.2/kubernetes_support.md | 208 + .../source/markdown/options/README.md | 68 + .../source/markdown/options/add-host.md | 44 + .../markdown/options/annotation.container.md | 12 + .../markdown/options/annotation.image.md | 16 + .../markdown/options/annotation.manifest.md | 12 + .../source/markdown/options/arch.md | 12 + .../source/markdown/options/attach.md | 19 + .../source/markdown/options/authfile.md | 15 + .../markdown/options/blkio-weight-device.md | 12 + .../source/markdown/options/blkio-weight.md | 14 + .../source/markdown/options/build-arg-file.md | 27 + .../source/markdown/options/build-arg.md | 13 + .../source/markdown/options/build-context.md | 35 + .../source/markdown/options/cache-from.md | 26 + .../source/markdown/options/cache-to.md | 24 + .../source/markdown/options/cache-ttl.md | 17 + .../source/markdown/options/cap-add.image.md | 15 + .../source/markdown/options/cap-add.md | 12 + .../source/markdown/options/cap-drop.image.md | 21 + .../source/markdown/options/cap-drop.md | 12 + .../source/markdown/options/cert-dir.md | 14 + .../source/markdown/options/cgroup-conf.md | 12 + .../source/markdown/options/cgroup-parent.md | 14 + .../source/markdown/options/cgroupns.image.md | 15 + .../source/markdown/options/cgroupns.md | 19 + .../source/markdown/options/cgroups.md | 19 + .../source/markdown/options/chrootdirs.md | 14 + .../source/markdown/options/cidfile.read.md | 13 + .../source/markdown/options/cidfile.write.md | 13 + .../source/markdown/options/color.md | 12 + .../markdown/options/compat-auth-file.md | 12 + .../source/markdown/options/compat-volumes.md | 16 + .../markdown/options/compression-format.md | 13 + .../markdown/options/compression-level.md | 12 + .../source/markdown/options/conmon-pidfile.md | 13 + .../source/markdown/options/cpp-flag.md | 12 + .../source/markdown/options/cpu-period.md | 21 + .../source/markdown/options/cpu-quota.md | 23 + .../source/markdown/options/cpu-rt-period.md | 16 + .../source/markdown/options/cpu-rt-runtime.md | 19 + .../source/markdown/options/cpu-shares.md | 50 + .../source/markdown/options/cpus.container.md | 20 + .../source/markdown/options/cpuset-cpus.md | 20 + .../source/markdown/options/cpuset-mems.md | 23 + .../source/markdown/options/creds.md | 19 + .../source/markdown/options/decryption-key.md | 12 + .../source/markdown/options/destroy.md | 12 + .../source/markdown/options/detach-keys.md | 14 + .../markdown/options/device-cgroup-rule.md | 17 + .../markdown/options/device-read-bps.md | 18 + .../markdown/options/device-read-iops.md | 18 + .../markdown/options/device-write-bps.md | 18 + .../markdown/options/device-write-iops.md | 18 + .../source/markdown/options/device.md | 31 + .../source/markdown/options/digestfile.md | 12 + .../source/markdown/options/dir-compress.md | 12 + .../markdown/options/disable-compression.md | 17 + .../markdown/options/disable-content-trust.md | 14 + .../markdown/options/dns-option.container.md | 12 + .../markdown/options/dns-option.image.md | 12 + .../markdown/options/dns-search.container.md | 13 + .../markdown/options/dns-search.image.md | 12 + .../source/markdown/options/dns.md | 20 + .../source/markdown/options/entrypoint.md | 23 + .../source/markdown/options/env-file.md | 12 + .../source/markdown/options/env-host.md | 12 + .../source/markdown/options/env-merge.md | 18 + .../source/markdown/options/env.image.md | 16 + .../source/markdown/options/env.md | 14 + .../source/markdown/options/expose.md | 17 + .../source/markdown/options/farm.md | 12 + .../source/markdown/options/features.md | 13 + .../source/markdown/options/file.md | 21 + .../source/markdown/options/follow.md | 16 + .../markdown/options/force-compression.md | 13 + .../source/markdown/options/force-rm.md | 12 + .../source/markdown/options/format.md | 17 + .../source/markdown/options/from.md | 18 + .../markdown/options/gidmap.container.md | 17 + .../source/markdown/options/gidmap.pod.md | 13 + .../source/markdown/options/gpus.md | 13 + .../source/markdown/options/group-add.md | 20 + .../source/markdown/options/group-entry.md | 14 + .../source/markdown/options/health-cmd.md | 17 + .../markdown/options/health-interval.md | 12 + .../options/health-log-destination.md | 16 + .../markdown/options/health-max-log-count.md | 12 + .../markdown/options/health-max-log-size.md | 12 + .../markdown/options/health-on-failure.md | 17 + .../source/markdown/options/health-retries.md | 12 + .../markdown/options/health-start-period.md | 19 + .../markdown/options/health-startup-cmd.md | 16 + .../options/health-startup-interval.md | 12 + .../options/health-startup-retries.md | 12 + .../options/health-startup-success.md | 13 + .../options/health-startup-timeout.md | 13 + .../source/markdown/options/health-timeout.md | 13 + .../source/markdown/options/help.md | 12 + .../source/markdown/options/hooks-dir.md | 20 + .../markdown/options/hostname.container.md | 18 + .../source/markdown/options/hostname.pod.md | 15 + .../source/markdown/options/hosts-file.md | 17 + .../source/markdown/options/hostuser.md | 13 + .../source/markdown/options/http-proxy.md | 25 + .../source/markdown/options/identity-label.md | 12 + .../source/markdown/options/ignore.md | 14 + .../source/markdown/options/ignorefile.md | 12 + .../source/markdown/options/iidfile.md | 12 + .../source/markdown/options/image-volume.md | 17 + .../source/markdown/options/infra-command.md | 12 + .../markdown/options/infra-conmon-pidfile.md | 12 + .../source/markdown/options/infra-name.md | 12 + .../source/markdown/options/init-path.md | 12 + .../source/markdown/options/init.md | 14 + .../source/markdown/options/interactive.md | 16 + .../source/markdown/options/ip.md | 17 + .../source/markdown/options/ip6.md | 17 + .../source/markdown/options/ipc.image.md | 17 + .../source/markdown/options/ipc.md | 21 + .../source/markdown/options/isolation.md | 22 + .../source/markdown/options/jobs.md | 14 + .../source/markdown/options/label-file.md | 12 + .../source/markdown/options/label.image.md | 23 + .../source/markdown/options/label.md | 12 + .../source/markdown/options/latest.md | 15 + .../source/markdown/options/layer-label.md | 16 + .../source/markdown/options/layers.md | 15 + .../source/markdown/options/link-local-ip.md | 12 + .../source/markdown/options/log-driver.md | 23 + .../source/markdown/options/log-opt.md | 25 + .../source/markdown/options/logfile.md | 14 + .../source/markdown/options/mac-address.md | 20 + .../source/markdown/options/manifest.md | 12 + .../markdown/options/memory-reservation.md | 20 + .../source/markdown/options/memory-swap.md | 22 + .../markdown/options/memory-swappiness.md | 14 + .../source/markdown/options/memory.md | 20 + .../source/markdown/options/mount.md | 112 + .../source/markdown/options/name.container.md | 25 + .../source/markdown/options/names.md | 12 + .../source/markdown/options/network-alias.md | 17 + .../source/markdown/options/network.image.md | 68 + .../source/markdown/options/network.md | 92 + .../source/markdown/options/no-cache.md | 12 + .../source/markdown/options/no-healthcheck.md | 12 + .../source/markdown/options/no-hostname.md | 14 + .../source/markdown/options/no-hosts.md | 21 + .../source/markdown/options/no-reset.md | 12 + .../source/markdown/options/no-stream.md | 12 + .../source/markdown/options/no-trunc.md | 12 + .../source/markdown/options/noheading.md | 12 + .../source/markdown/options/omit-history.md | 17 + .../markdown/options/oom-kill-disable.md | 14 + .../source/markdown/options/oom-score-adj.md | 16 + .../source/markdown/options/os-feature.md | 14 + .../markdown/options/os-version.image.md | 12 + .../source/markdown/options/os-version.md | 13 + .../source/markdown/options/os.md | 12 + .../source/markdown/options/os.pull.md | 13 + .../source/markdown/options/passwd-entry.md | 14 + .../source/markdown/options/personality.md | 12 + .../source/markdown/options/pid.container.md | 18 + .../source/markdown/options/pid.image.md | 14 + .../source/markdown/options/pid.pod.md | 16 + .../source/markdown/options/pidfile.md | 18 + .../source/markdown/options/pids-limit.md | 12 + .../source/markdown/options/platform.md | 14 + .../markdown/options/pod-id-file.container.md | 13 + .../markdown/options/pod-id-file.pod.md | 12 + .../source/markdown/options/pod.run.md | 14 + .../source/markdown/options/preserve-fd.md | 15 + .../source/markdown/options/preserve-fds.md | 14 + .../source/markdown/options/privileged.md | 28 + .../source/markdown/options/publish-all.md | 21 + .../source/markdown/options/publish.md | 31 + .../source/markdown/options/pull.image.md | 17 + .../source/markdown/options/pull.md | 17 + .../source/markdown/options/quiet.md | 12 + .../source/markdown/options/rdt-class.md | 12 + .../markdown/options/read-only-tmpfs.md | 31 + .../source/markdown/options/read-only.md | 15 + .../source/markdown/options/replace.md | 12 + .../source/markdown/options/requires.md | 14 + .../source/markdown/options/restart.md | 27 + .../source/markdown/options/retry-delay.md | 13 + .../source/markdown/options/retry.md | 13 + .../source/markdown/options/rm.md | 12 + .../source/markdown/options/rootfs.md | 39 + .../source/markdown/options/runtime-flag.md | 14 + .../source/markdown/options/runtime.md | 15 + .../markdown/options/sbom-image-output.md | 13 + .../options/sbom-image-purl-output.md | 15 + .../markdown/options/sbom-merge-strategy.md | 29 + .../source/markdown/options/sbom-output.md | 13 + .../markdown/options/sbom-purl-output.md | 15 + .../markdown/options/sbom-scanner-command.md | 20 + .../markdown/options/sbom-scanner-image.md | 12 + .../source/markdown/options/sbom.md | 38 + .../source/markdown/options/sdnotify.md | 21 + .../source/markdown/options/seccomp-policy.md | 14 + .../source/markdown/options/secret.image.md | 28 + .../source/markdown/options/secret.md | 59 + .../markdown/options/security-opt.image.md | 27 + .../source/markdown/options/security-opt.md | 41 + .../markdown/options/shm-size-systemd.md | 15 + .../source/markdown/options/shm-size.md | 15 + .../source/markdown/options/sig-proxy.md | 12 + .../markdown/options/sign-by-sigstore.md | 13 + .../markdown/options/sign-passphrase-file.md | 12 + .../source/markdown/options/signal.md | 13 + .../source/markdown/options/since.md | 15 + .../markdown/options/skip-unused-stages.md | 12 + .../source/markdown/options/squash-all.md | 12 + .../source/markdown/options/squash.md | 12 + .../source/markdown/options/ssh.md | 17 + .../source/markdown/options/stop-signal.md | 12 + .../source/markdown/options/stop-timeout.md | 13 + .../source/markdown/options/subgidname.md | 14 + .../source/markdown/options/subuidname.md | 14 + .../source/markdown/options/sysctl.md | 30 + .../source/markdown/options/systemd.md | 42 + .../source/markdown/options/tag.md | 13 + .../source/markdown/options/tail.md | 13 + .../source/markdown/options/target.md | 12 + .../source/markdown/options/time.md | 13 + .../source/markdown/options/timeout.md | 14 + .../source/markdown/options/timestamp.md | 15 + .../source/markdown/options/timestamps.md | 12 + .../source/markdown/options/tls-verify.md | 16 + .../source/markdown/options/tmpfs.md | 23 + .../source/markdown/options/tty.md | 18 + .../source/markdown/options/tz.md | 13 + .../markdown/options/uidmap.container.md | 201 + .../source/markdown/options/uidmap.pod.md | 15 + .../source/markdown/options/ulimit.image.md | 27 + .../source/markdown/options/ulimit.md | 33 + .../source/markdown/options/umask.md | 13 + .../source/markdown/options/unsetenv-all.md | 14 + .../source/markdown/options/unsetenv.image.md | 12 + .../source/markdown/options/unsetenv.md | 14 + .../source/markdown/options/unsetlabel.md | 12 + .../source/markdown/options/until.md | 15 + .../markdown/options/user-mode-networking.md | 26 + .../source/markdown/options/user.md | 16 + .../markdown/options/userns-gid-map-group.md | 19 + .../source/markdown/options/userns-gid-map.md | 24 + .../markdown/options/userns-uid-map-user.md | 19 + .../source/markdown/options/userns-uid-map.md | 24 + .../markdown/options/userns.container.md | 74 + .../source/markdown/options/userns.image.md | 13 + .../source/markdown/options/userns.pod.md | 38 + .../source/markdown/options/uts.container.md | 17 + .../source/markdown/options/uts.md | 13 + .../source/markdown/options/uts.pod.md | 16 + .../markdown/options/variant.container.md | 12 + .../markdown/options/variant.manifest.md | 14 + .../source/markdown/options/volume.image.md | 125 + .../source/markdown/options/volume.md | 214 + .../source/markdown/options/volumes-from.md | 41 + .../source/markdown/options/workdir.md | 16 + .../source/markdown/podman-artifact-add.1.md | 68 + .../markdown/podman-artifact-inspect.1.md | 43 + .../source/markdown/podman-artifact-ls.1.md | 90 + .../source/markdown/podman-artifact-pull.1.md | 140 + .../source/markdown/podman-artifact-push.1.md | 149 + .../source/markdown/podman-artifact-rm.1.md | 51 + .../source/markdown/podman-artifact.1.md | 41 + .../source/markdown/podman-attach.1.md | 78 + .../source/markdown/podman-auto-update.1.md | 146 + .../source/markdown/podman-build.1.md | 1943 ++ .../source/markdown/podman-commit.1.md | 139 + .../source/markdown/podman-completion.1.md | 83 + .../source/markdown/podman-compose.1.md | 28 + .../markdown/podman-container-checkpoint.1.md | 231 + .../markdown/podman-container-cleanup.1.md | 61 + .../markdown/podman-container-clone.1.md | 362 + .../markdown/podman-container-diff.1.md | 65 + .../markdown/podman-container-exists.1.md | 56 + .../markdown/podman-container-inspect.1.md | 349 + .../markdown/podman-container-prune.1.md | 83 + .../markdown/podman-container-restore.1.md | 198 + .../markdown/podman-container-runlabel.1.md | 128 + .../source/markdown/podman-container.1.md | 58 + .../source/markdown/podman-cp.1.md | 140 + .../source/markdown/podman-create.1.md | 2849 +++ .../source/markdown/podman-diff.1.md | 75 + .../source/markdown/podman-events.1.md | 222 + .../source/markdown/podman-exec.1.md | 208 + .../source/markdown/podman-export.1.md | 56 + .../source/markdown/podman-farm-build.1.md | 1564 ++ .../source/markdown/podman-farm-create.1.md | 39 + .../source/markdown/podman-farm-list.1.md | 47 + .../source/markdown/podman-farm-remove.1.md | 41 + .../source/markdown/podman-farm-update.1.md | 53 + .../source/markdown/podman-farm.1.md | 46 + .../source/markdown/podman-generate-spec.1.md | 31 + .../markdown/podman-generate-systemd.1.md | 326 + .../source/markdown/podman-generate.1.md | 27 + .../markdown/podman-healthcheck-run.1.md | 45 + .../source/markdown/podman-healthcheck.1.md | 27 + .../source/markdown/podman-history.1.md | 110 + .../source/markdown/podman-image-diff.1.md | 61 + .../source/markdown/podman-image-exists.1.md | 46 + .../source/markdown/podman-image-inspect.1.md | 139 + .../source/markdown/podman-image-mount.1.md | 82 + .../source/markdown/podman-image-prune.1.md | 121 + .../source/markdown/podman-image-scp.1.md | 107 + .../source/markdown/podman-image-sign.1.md | 94 + .../source/markdown/podman-image-tree.1.md | 91 + .../source/markdown/podman-image-trust.1.md | 211 + .../source/markdown/podman-image-unmount.1.md | 55 + .../source/markdown/podman-image.1.md | 45 + .../source/markdown/podman-images.1.md | 268 + .../source/markdown/podman-import.1.md | 121 + .../source/markdown/podman-info.1.md | 409 + .../source/markdown/podman-init.1.md | 61 + .../source/markdown/podman-inspect.1.md | 185 + .../source/markdown/podman-kill.1.md | 91 + .../source/markdown/podman-kube-apply.1.md | 79 + .../source/markdown/podman-kube-down.1.md | 76 + .../source/markdown/podman-kube-generate.1.md | 254 + .../source/markdown/podman-kube-play.1.md | 813 + .../source/markdown/podman-kube.1.md | 35 + .../source/markdown/podman-load.1.md | 92 + .../source/markdown/podman-login.1.md | 188 + .../source/markdown/podman-logout.1.md | 77 + .../source/markdown/podman-logs.1.md | 173 + .../source/markdown/podman-machine-info.1.md | 107 + .../source/markdown/podman-machine-init.1.md | 250 + .../markdown/podman-machine-inspect.1.md | 60 + .../source/markdown/podman-machine-list.1.md | 117 + .../markdown/podman-machine-os-apply.1.md | 54 + .../source/markdown/podman-machine-os.1.md | 27 + .../source/markdown/podman-machine-reset.1.md | 52 + .../source/markdown/podman-machine-rm.1.md | 71 + .../source/markdown/podman-machine-set.1.md | 126 + .../source/markdown/podman-machine-ssh.1.md | 91 + .../source/markdown/podman-machine-start.1.md | 58 + .../source/markdown/podman-machine-stop.1.md | 47 + .../source/markdown/podman-machine.1.md | 55 + .../source/markdown/podman-manifest-add.1.md | 235 + .../markdown/podman-manifest-annotate.1.md | 95 + .../markdown/podman-manifest-create.1.md | 79 + .../markdown/podman-manifest-exists.1.md | 47 + .../markdown/podman-manifest-inspect.1.md | 54 + .../source/markdown/podman-manifest-push.1.md | 173 + .../markdown/podman-manifest-remove.1.md | 29 + .../source/markdown/podman-manifest-rm.1.md | 36 + .../source/markdown/podman-manifest.1.md | 76 + .../source/markdown/podman-mount.1.md | 86 + .../markdown/podman-network-connect.1.md | 55 + .../markdown/podman-network-create.1.md | 220 + .../markdown/podman-network-disconnect.1.md | 37 + .../markdown/podman-network-exists.1.md | 47 + .../markdown/podman-network-inspect.1.md | 83 + .../source/markdown/podman-network-ls.1.md | 124 + .../source/markdown/podman-network-prune.1.md | 58 + .../markdown/podman-network-reload.1.md | 67 + .../source/markdown/podman-network-rm.1.md | 54 + .../markdown/podman-network-update.1.md | 41 + .../source/markdown/podman-network.1.md | 61 + .../source/markdown/podman-pause.1.md | 102 + .../source/markdown/podman-pod-clone.1.md | 794 + .../source/markdown/podman-pod-create.1.md | 1130 + .../source/markdown/podman-pod-exists.1.md | 38 + .../source/markdown/podman-pod-inspect.1.md | 113 + .../source/markdown/podman-pod-kill.1.md | 73 + .../source/markdown/podman-pod-logs.1.md | 136 + .../source/markdown/podman-pod-pause.1.md | 43 + .../source/markdown/podman-pod-prune.1.md | 38 + .../source/markdown/podman-pod-ps.1.md | 206 + .../source/markdown/podman-pod-restart.1.md | 64 + .../source/markdown/podman-pod-rm.1.md | 109 + .../source/markdown/podman-pod-start.1.md | 74 + .../source/markdown/podman-pod-stats.1.md | 116 + .../source/markdown/podman-pod-stop.1.md | 111 + .../source/markdown/podman-pod-top.1.md | 65 + .../source/markdown/podman-pod-unpause.1.md | 43 + .../source/markdown/podman-pod.1.md | 42 + .../source/markdown/podman-port.1.md | 71 + .../source/markdown/podman-ps.1.md | 228 + .../source/markdown/podman-pull.1.md | 327 + .../source/markdown/podman-push.1.md | 276 + .../source/markdown/podman-remote.1.md | 206 + .../source/markdown/podman-rename.1.md | 43 + .../source/markdown/podman-restart.1.md | 120 + .../source/markdown/podman-rm.1.md | 162 + .../source/markdown/podman-rmi.1.md | 81 + .../source/markdown/podman-rootless.7.md | 54 + .../source/markdown/podman-run.1.md | 3258 +++ .../source/markdown/podman-save.1.md | 107 + .../source/markdown/podman-search.1.md | 191 + .../source/markdown/podman-secret-create.1.md | 112 + .../source/markdown/podman-secret-exists.1.md | 48 + .../markdown/podman-secret-inspect.1.md | 73 + .../source/markdown/podman-secret-ls.1.md | 84 + .../source/markdown/podman-secret-rm.1.md | 48 + .../source/markdown/podman-secret.1.md | 31 + .../source/markdown/podman-start.1.md | 127 + .../source/markdown/podman-stats.1.md | 164 + .../source/markdown/podman-stop.1.md | 141 + .../source/markdown/podman-system-check.1.md | 64 + .../podman-system-connection-add.1.md | 69 + .../podman-system-connection-default.1.md | 27 + .../podman-system-connection-list.1.md | 51 + .../podman-system-connection-remove.1.md | 33 + .../podman-system-connection-rename.1.md | 27 + .../markdown/podman-system-connection.1.md | 52 + .../source/markdown/podman-system-df.1.md | 80 + .../markdown/podman-system-migrate.1.md | 44 + .../source/markdown/podman-system-prune.1.md | 76 + .../markdown/podman-system-renumber.1.md | 31 + .../source/markdown/podman-system-reset.1.md | 72 + .../markdown/podman-system-service.1.md | 146 + .../source/markdown/podman-system.1.md | 33 + .../source/markdown/podman-systemd.unit.5.md | 2105 ++ .../source/markdown/podman-tag.1.md | 51 + .../source/markdown/podman-top.1.md | 125 + .../markdown/podman-troubleshooting.7.md | 1552 ++ .../source/markdown/podman-unmount.1.md | 75 + .../source/markdown/podman-unpause.1.md | 102 + .../source/markdown/podman-unshare.1.md | 114 + .../source/markdown/podman-untag.1.md | 46 + .../source/markdown/podman-update.1.md | 523 + .../source/markdown/podman-version.1.md | 60 + .../source/markdown/podman-volume-create.1.md | 213 + .../source/markdown/podman-volume-exists.1.md | 48 + .../source/markdown/podman-volume-export.1.md | 43 + .../source/markdown/podman-volume-import.1.md | 46 + .../markdown/podman-volume-inspect.1.md | 109 + .../source/markdown/podman-volume-ls.1.md | 117 + .../source/markdown/podman-volume-mount.1.md | 41 + .../source/markdown/podman-volume-prune.1.md | 77 + .../source/markdown/podman-volume-reload.1.md | 35 + .../source/markdown/podman-volume-rm.1.md | 70 + .../markdown/podman-volume-unmount.1.md | 37 + .../source/markdown/podman-volume.1.md | 37 + .../source/markdown/podman-wait.1.md | 103 + .../version-5.4.2/source/markdown/podman.1.md | 487 + .../source/markdown/podmansh.1.md | 138 + .../version-5.4.2/tutorials/README.md | 46 + .../tutorials/basic_networking.md | 336 + .../version-5.4.2/tutorials/image_signing.md | 199 + .../version-5.4.2/tutorials/mac_client.md | 7 + .../version-5.4.2/tutorials/mac_win_client.md | 120 + .../version-5.4.2/tutorials/performance.md | 249 + .../tutorials/podman-derivative-api.md | 60 + .../tutorials/podman-for-windows.md | 426 + .../podman-install-certificate-authority.md | 114 + .../tutorials/podman_tutorial.md | 149 + .../tutorials/podman_tutorial_cn.md | 175 + .../tutorials/qemu-remote-tutorial.md | 137 + .../version-5.4.2/tutorials/remote_client.md | 124 + .../tutorials/rootless_tutorial.md | 221 + .../tutorials/socket_activation.md | 289 + .../version-5.5.0/MANPAGE_SYNTAX.md | 147 + versioned_docs/version-5.5.0/index.md | 42 + .../version-5.5.0/kubernetes_support.md | 208 + .../source/markdown/options/README.md | 68 + .../source/markdown/options/add-host.md | 44 + .../markdown/options/annotation.container.md | 12 + .../markdown/options/annotation.image.md | 16 + .../markdown/options/annotation.manifest.md | 12 + .../source/markdown/options/arch.md | 12 + .../source/markdown/options/attach.md | 19 + .../source/markdown/options/authfile.md | 15 + .../markdown/options/blkio-weight-device.md | 12 + .../source/markdown/options/blkio-weight.md | 14 + .../source/markdown/options/build-arg-file.md | 27 + .../source/markdown/options/build-arg.md | 13 + .../source/markdown/options/build-context.md | 35 + .../source/markdown/options/cache-from.md | 26 + .../source/markdown/options/cache-to.md | 24 + .../source/markdown/options/cache-ttl.md | 17 + .../source/markdown/options/cap-add.image.md | 15 + .../source/markdown/options/cap-add.md | 24 + .../source/markdown/options/cap-drop.image.md | 21 + .../source/markdown/options/cap-drop.md | 12 + .../source/markdown/options/cert-dir.md | 14 + .../source/markdown/options/cgroup-conf.md | 12 + .../source/markdown/options/cgroup-parent.md | 14 + .../source/markdown/options/cgroupns.image.md | 15 + .../source/markdown/options/cgroupns.md | 19 + .../source/markdown/options/cgroups.md | 19 + .../source/markdown/options/chrootdirs.md | 14 + .../source/markdown/options/cidfile.read.md | 13 + .../source/markdown/options/cidfile.write.md | 13 + .../source/markdown/options/color.md | 12 + .../markdown/options/compat-auth-file.md | 12 + .../source/markdown/options/compat-volumes.md | 16 + .../markdown/options/compression-format.md | 13 + .../markdown/options/compression-level.md | 12 + .../source/markdown/options/conmon-pidfile.md | 13 + .../source/markdown/options/cpp-flag.md | 12 + .../source/markdown/options/cpu-period.md | 21 + .../source/markdown/options/cpu-quota.md | 23 + .../source/markdown/options/cpu-rt-period.md | 16 + .../source/markdown/options/cpu-rt-runtime.md | 19 + .../source/markdown/options/cpu-shares.md | 50 + .../source/markdown/options/cpus.container.md | 20 + .../source/markdown/options/cpuset-cpus.md | 20 + .../source/markdown/options/cpuset-mems.md | 23 + .../source/markdown/options/creds.md | 19 + .../source/markdown/options/decryption-key.md | 12 + .../source/markdown/options/destroy.md | 12 + .../source/markdown/options/detach-keys.md | 14 + .../markdown/options/device-cgroup-rule.md | 17 + .../markdown/options/device-read-bps.md | 18 + .../markdown/options/device-read-iops.md | 18 + .../markdown/options/device-write-bps.md | 18 + .../markdown/options/device-write-iops.md | 18 + .../source/markdown/options/device.md | 31 + .../source/markdown/options/digestfile.md | 12 + .../source/markdown/options/dir-compress.md | 12 + .../markdown/options/disable-compression.md | 17 + .../markdown/options/disable-content-trust.md | 14 + .../markdown/options/dns-option.container.md | 12 + .../markdown/options/dns-option.image.md | 12 + .../markdown/options/dns-search.container.md | 13 + .../markdown/options/dns-search.image.md | 12 + .../source/markdown/options/dns.md | 20 + .../source/markdown/options/entrypoint.md | 23 + .../source/markdown/options/env-file.md | 12 + .../source/markdown/options/env-host.md | 12 + .../source/markdown/options/env-merge.md | 18 + .../source/markdown/options/env.image.md | 16 + .../source/markdown/options/env.md | 14 + .../source/markdown/options/env.update.md | 18 + .../source/markdown/options/expose.md | 17 + .../source/markdown/options/farm.md | 12 + .../source/markdown/options/features.md | 13 + .../source/markdown/options/file.md | 21 + .../source/markdown/options/follow.md | 16 + .../markdown/options/force-compression.md | 13 + .../source/markdown/options/force-rm.md | 12 + .../source/markdown/options/format.md | 17 + .../source/markdown/options/from.md | 18 + .../markdown/options/gidmap.container.md | 17 + .../source/markdown/options/gidmap.pod.md | 13 + .../source/markdown/options/gpus.md | 13 + .../source/markdown/options/group-add.md | 20 + .../source/markdown/options/group-entry.md | 14 + .../source/markdown/options/health-cmd.md | 19 + .../markdown/options/health-interval.md | 14 + .../options/health-log-destination.md | 16 + .../markdown/options/health-max-log-count.md | 12 + .../markdown/options/health-max-log-size.md | 12 + .../markdown/options/health-on-failure.md | 17 + .../source/markdown/options/health-retries.md | 14 + .../markdown/options/health-start-period.md | 21 + .../markdown/options/health-startup-cmd.md | 16 + .../options/health-startup-interval.md | 12 + .../options/health-startup-retries.md | 12 + .../options/health-startup-success.md | 13 + .../options/health-startup-timeout.md | 13 + .../source/markdown/options/health-timeout.md | 19 + .../source/markdown/options/help.md | 12 + .../source/markdown/options/hooks-dir.md | 20 + .../markdown/options/hostname.container.md | 18 + .../source/markdown/options/hostname.pod.md | 15 + .../source/markdown/options/hosts-file.md | 17 + .../source/markdown/options/hostuser.md | 13 + .../source/markdown/options/http-proxy.md | 25 + .../source/markdown/options/identity-label.md | 12 + .../source/markdown/options/ignore.md | 14 + .../source/markdown/options/ignorefile.md | 12 + .../source/markdown/options/iidfile.md | 12 + .../source/markdown/options/image-volume.md | 17 + .../source/markdown/options/infra-command.md | 12 + .../markdown/options/infra-conmon-pidfile.md | 12 + .../source/markdown/options/infra-name.md | 12 + .../source/markdown/options/inherit-labels.md | 12 + .../source/markdown/options/init-path.md | 12 + .../source/markdown/options/init.md | 14 + .../source/markdown/options/interactive.md | 16 + .../source/markdown/options/ip.md | 17 + .../source/markdown/options/ip6.md | 17 + .../source/markdown/options/ipc.image.md | 17 + .../source/markdown/options/ipc.md | 21 + .../source/markdown/options/isolation.md | 22 + .../source/markdown/options/jobs.md | 14 + .../source/markdown/options/label-file.md | 12 + .../source/markdown/options/label.image.md | 23 + .../source/markdown/options/label.md | 12 + .../source/markdown/options/latest.md | 15 + .../source/markdown/options/layer-label.md | 16 + .../source/markdown/options/layers.md | 15 + .../source/markdown/options/link-local-ip.md | 12 + .../source/markdown/options/log-driver.md | 23 + .../source/markdown/options/log-opt.md | 25 + .../source/markdown/options/logfile.md | 14 + .../source/markdown/options/mac-address.md | 20 + .../source/markdown/options/manifest.md | 12 + .../markdown/options/memory-reservation.md | 20 + .../source/markdown/options/memory-swap.md | 22 + .../markdown/options/memory-swappiness.md | 14 + .../source/markdown/options/memory.md | 20 + .../source/markdown/options/mount.md | 133 + .../source/markdown/options/name.container.md | 25 + .../source/markdown/options/names.md | 12 + .../source/markdown/options/network-alias.md | 17 + .../source/markdown/options/network.image.md | 68 + .../source/markdown/options/network.md | 99 + .../source/markdown/options/no-cache.md | 12 + .../source/markdown/options/no-healthcheck.md | 12 + .../source/markdown/options/no-hostname.md | 14 + .../source/markdown/options/no-hosts.md | 21 + .../source/markdown/options/no-reset.md | 12 + .../source/markdown/options/no-stream.md | 12 + .../source/markdown/options/no-trunc.md | 12 + .../source/markdown/options/noheading.md | 12 + .../source/markdown/options/omit-history.md | 17 + .../markdown/options/oom-kill-disable.md | 14 + .../source/markdown/options/oom-score-adj.md | 16 + .../source/markdown/options/os-feature.md | 14 + .../markdown/options/os-version.image.md | 12 + .../source/markdown/options/os-version.md | 13 + .../source/markdown/options/os.md | 12 + .../source/markdown/options/os.pull.md | 13 + .../source/markdown/options/passwd-entry.md | 14 + .../source/markdown/options/personality.md | 12 + .../source/markdown/options/pid.container.md | 18 + .../source/markdown/options/pid.image.md | 14 + .../source/markdown/options/pid.pod.md | 16 + .../source/markdown/options/pidfile.md | 18 + .../source/markdown/options/pids-limit.md | 12 + .../source/markdown/options/platform.md | 14 + .../markdown/options/pod-id-file.container.md | 13 + .../markdown/options/pod-id-file.pod.md | 12 + .../source/markdown/options/pod.run.md | 14 + .../source/markdown/options/preserve-fd.md | 15 + .../source/markdown/options/preserve-fds.md | 14 + .../source/markdown/options/privileged.md | 28 + .../source/markdown/options/publish-all.md | 21 + .../source/markdown/options/publish.md | 31 + .../source/markdown/options/pull.image.md | 17 + .../source/markdown/options/pull.md | 17 + .../source/markdown/options/quiet.md | 12 + .../source/markdown/options/rdt-class.md | 12 + .../markdown/options/read-only-tmpfs.md | 31 + .../source/markdown/options/read-only.md | 15 + .../source/markdown/options/replace.md | 12 + .../source/markdown/options/requires.md | 14 + .../source/markdown/options/restart.md | 27 + .../source/markdown/options/retry-delay.md | 13 + .../source/markdown/options/retry.md | 13 + .../source/markdown/options/rm.md | 12 + .../source/markdown/options/rootfs.md | 39 + .../source/markdown/options/runtime-flag.md | 14 + .../source/markdown/options/runtime.md | 15 + .../markdown/options/sbom-image-output.md | 13 + .../options/sbom-image-purl-output.md | 15 + .../markdown/options/sbom-merge-strategy.md | 29 + .../source/markdown/options/sbom-output.md | 13 + .../markdown/options/sbom-purl-output.md | 15 + .../markdown/options/sbom-scanner-command.md | 20 + .../markdown/options/sbom-scanner-image.md | 12 + .../source/markdown/options/sbom.md | 38 + .../source/markdown/options/sdnotify.md | 21 + .../source/markdown/options/seccomp-policy.md | 14 + .../source/markdown/options/secret.image.md | 28 + .../source/markdown/options/secret.md | 59 + .../markdown/options/security-opt.image.md | 27 + .../source/markdown/options/security-opt.md | 41 + .../markdown/options/shm-size-systemd.md | 15 + .../source/markdown/options/shm-size.md | 15 + .../source/markdown/options/sig-proxy.md | 12 + .../markdown/options/sign-by-sigstore.md | 13 + .../markdown/options/sign-passphrase-file.md | 12 + .../source/markdown/options/signal.md | 13 + .../source/markdown/options/since.md | 15 + .../markdown/options/skip-unused-stages.md | 12 + .../source/markdown/options/squash-all.md | 12 + .../source/markdown/options/squash.md | 12 + .../source/markdown/options/ssh.md | 17 + .../source/markdown/options/stop-signal.md | 12 + .../source/markdown/options/stop-timeout.md | 13 + .../source/markdown/options/subgidname.md | 14 + .../source/markdown/options/subuidname.md | 14 + .../source/markdown/options/sysctl.md | 30 + .../source/markdown/options/systemd.md | 42 + .../source/markdown/options/tag.md | 13 + .../source/markdown/options/tail.md | 13 + .../source/markdown/options/target.md | 12 + .../source/markdown/options/time.md | 13 + .../source/markdown/options/timeout.md | 14 + .../source/markdown/options/timestamp.md | 15 + .../source/markdown/options/timestamps.md | 12 + .../source/markdown/options/tls-verify.md | 16 + .../source/markdown/options/tmpfs.md | 23 + .../source/markdown/options/tty.md | 18 + .../source/markdown/options/tz.md | 13 + .../markdown/options/uidmap.container.md | 201 + .../source/markdown/options/uidmap.pod.md | 15 + .../source/markdown/options/ulimit.image.md | 27 + .../source/markdown/options/ulimit.md | 33 + .../source/markdown/options/umask.md | 13 + .../source/markdown/options/unsetenv-all.md | 14 + .../source/markdown/options/unsetenv.image.md | 12 + .../source/markdown/options/unsetenv.md | 14 + .../markdown/options/unsetenv.update.md | 15 + .../source/markdown/options/unsetlabel.md | 12 + .../source/markdown/options/until.md | 15 + .../markdown/options/user-mode-networking.md | 26 + .../source/markdown/options/user.md | 16 + .../markdown/options/userns-gid-map-group.md | 19 + .../source/markdown/options/userns-gid-map.md | 24 + .../markdown/options/userns-uid-map-user.md | 19 + .../source/markdown/options/userns-uid-map.md | 24 + .../markdown/options/userns.container.md | 74 + .../source/markdown/options/userns.image.md | 13 + .../source/markdown/options/userns.pod.md | 38 + .../source/markdown/options/uts.container.md | 17 + .../source/markdown/options/uts.md | 13 + .../source/markdown/options/uts.pod.md | 16 + .../markdown/options/variant.container.md | 12 + .../markdown/options/variant.manifest.md | 14 + .../source/markdown/options/volume.image.md | 125 + .../source/markdown/options/volume.md | 216 + .../source/markdown/options/volumes-from.md | 41 + .../source/markdown/options/workdir.md | 16 + .../source/markdown/podman-artifact-add.1.md | 88 + .../markdown/podman-artifact-extract.1.md | 88 + .../markdown/podman-artifact-inspect.1.md | 43 + .../source/markdown/podman-artifact-ls.1.md | 90 + .../source/markdown/podman-artifact-pull.1.md | 140 + .../source/markdown/podman-artifact-push.1.md | 149 + .../source/markdown/podman-artifact-rm.1.md | 63 + .../source/markdown/podman-artifact.1.md | 42 + .../source/markdown/podman-attach.1.md | 78 + .../source/markdown/podman-auto-update.1.md | 146 + .../source/markdown/podman-build.1.md | 1951 ++ .../source/markdown/podman-commit.1.md | 139 + .../source/markdown/podman-completion.1.md | 83 + .../source/markdown/podman-compose.1.md | 28 + .../markdown/podman-container-checkpoint.1.md | 231 + .../markdown/podman-container-cleanup.1.md | 61 + .../markdown/podman-container-clone.1.md | 362 + .../markdown/podman-container-diff.1.md | 65 + .../markdown/podman-container-exists.1.md | 56 + .../markdown/podman-container-inspect.1.md | 349 + .../markdown/podman-container-prune.1.md | 83 + .../markdown/podman-container-restore.1.md | 198 + .../markdown/podman-container-runlabel.1.md | 128 + .../source/markdown/podman-container.1.md | 58 + .../source/markdown/podman-cp.1.md | 140 + .../source/markdown/podman-create.1.md | 2905 +++ .../source/markdown/podman-diff.1.md | 75 + .../source/markdown/podman-events.1.md | 226 + .../source/markdown/podman-exec.1.md | 212 + .../source/markdown/podman-export.1.md | 56 + .../source/markdown/podman-farm-build.1.md | 1572 ++ .../source/markdown/podman-farm-create.1.md | 39 + .../source/markdown/podman-farm-list.1.md | 47 + .../source/markdown/podman-farm-remove.1.md | 41 + .../source/markdown/podman-farm-update.1.md | 53 + .../source/markdown/podman-farm.1.md | 46 + .../source/markdown/podman-generate-spec.1.md | 31 + .../markdown/podman-generate-systemd.1.md | 326 + .../source/markdown/podman-generate.1.md | 27 + .../markdown/podman-healthcheck-run.1.md | 45 + .../source/markdown/podman-healthcheck.1.md | 27 + .../source/markdown/podman-history.1.md | 110 + .../source/markdown/podman-image-diff.1.md | 61 + .../source/markdown/podman-image-exists.1.md | 46 + .../source/markdown/podman-image-inspect.1.md | 139 + .../source/markdown/podman-image-mount.1.md | 82 + .../source/markdown/podman-image-prune.1.md | 121 + .../source/markdown/podman-image-scp.1.md | 107 + .../source/markdown/podman-image-sign.1.md | 94 + .../source/markdown/podman-image-tree.1.md | 91 + .../source/markdown/podman-image-trust.1.md | 211 + .../source/markdown/podman-image-unmount.1.md | 55 + .../source/markdown/podman-image.1.md | 45 + .../source/markdown/podman-images.1.md | 268 + .../source/markdown/podman-import.1.md | 121 + .../source/markdown/podman-info.1.md | 409 + .../source/markdown/podman-init.1.md | 61 + .../source/markdown/podman-inspect.1.md | 185 + .../source/markdown/podman-kill.1.md | 91 + .../source/markdown/podman-kube-apply.1.md | 79 + .../source/markdown/podman-kube-down.1.md | 76 + .../source/markdown/podman-kube-generate.1.md | 254 + .../source/markdown/podman-kube-play.1.md | 823 + .../source/markdown/podman-kube.1.md | 35 + .../source/markdown/podman-load.1.md | 92 + .../source/markdown/podman-login.1.md | 188 + .../source/markdown/podman-logout.1.md | 77 + .../source/markdown/podman-logs.1.md | 173 + .../source/markdown/podman-machine-cp.1.md | 68 + .../source/markdown/podman-machine-info.1.md | 107 + .../source/markdown/podman-machine-init.1.md | 255 + .../markdown/podman-machine-inspect.1.md | 60 + .../source/markdown/podman-machine-list.1.md | 117 + .../markdown/podman-machine-os-apply.1.md | 70 + .../source/markdown/podman-machine-os.1.md | 27 + .../source/markdown/podman-machine-reset.1.md | 52 + .../source/markdown/podman-machine-rm.1.md | 71 + .../source/markdown/podman-machine-set.1.md | 126 + .../source/markdown/podman-machine-ssh.1.md | 91 + .../source/markdown/podman-machine-start.1.md | 58 + .../source/markdown/podman-machine-stop.1.md | 47 + .../source/markdown/podman-machine.1.md | 56 + .../source/markdown/podman-manifest-add.1.md | 235 + .../markdown/podman-manifest-annotate.1.md | 95 + .../markdown/podman-manifest-create.1.md | 79 + .../markdown/podman-manifest-exists.1.md | 47 + .../markdown/podman-manifest-inspect.1.md | 54 + .../source/markdown/podman-manifest-push.1.md | 173 + .../markdown/podman-manifest-remove.1.md | 29 + .../source/markdown/podman-manifest-rm.1.md | 36 + .../source/markdown/podman-manifest.1.md | 76 + .../source/markdown/podman-mount.1.md | 86 + .../markdown/podman-network-connect.1.md | 55 + .../markdown/podman-network-create.1.md | 220 + .../markdown/podman-network-disconnect.1.md | 37 + .../markdown/podman-network-exists.1.md | 47 + .../markdown/podman-network-inspect.1.md | 83 + .../source/markdown/podman-network-ls.1.md | 124 + .../source/markdown/podman-network-prune.1.md | 58 + .../markdown/podman-network-reload.1.md | 67 + .../source/markdown/podman-network-rm.1.md | 54 + .../markdown/podman-network-update.1.md | 41 + .../source/markdown/podman-network.1.md | 61 + .../source/markdown/podman-pause.1.md | 103 + .../source/markdown/podman-pod-clone.1.md | 796 + .../source/markdown/podman-pod-create.1.md | 1139 + .../source/markdown/podman-pod-exists.1.md | 38 + .../source/markdown/podman-pod-inspect.1.md | 113 + .../source/markdown/podman-pod-kill.1.md | 73 + .../source/markdown/podman-pod-logs.1.md | 136 + .../source/markdown/podman-pod-pause.1.md | 43 + .../source/markdown/podman-pod-prune.1.md | 38 + .../source/markdown/podman-pod-ps.1.md | 206 + .../source/markdown/podman-pod-restart.1.md | 64 + .../source/markdown/podman-pod-rm.1.md | 109 + .../source/markdown/podman-pod-start.1.md | 74 + .../source/markdown/podman-pod-stats.1.md | 116 + .../source/markdown/podman-pod-stop.1.md | 111 + .../source/markdown/podman-pod-top.1.md | 65 + .../source/markdown/podman-pod-unpause.1.md | 43 + .../source/markdown/podman-pod.1.md | 42 + .../source/markdown/podman-port.1.md | 71 + .../source/markdown/podman-ps.1.md | 228 + .../source/markdown/podman-pull.1.md | 327 + .../source/markdown/podman-push.1.md | 276 + .../source/markdown/podman-remote.1.md | 206 + .../source/markdown/podman-rename.1.md | 43 + .../source/markdown/podman-restart.1.md | 121 + .../source/markdown/podman-rm.1.md | 163 + .../source/markdown/podman-rmi.1.md | 81 + .../source/markdown/podman-rootless.7.md | 54 + .../source/markdown/podman-run.1.md | 3314 +++ .../source/markdown/podman-save.1.md | 107 + .../source/markdown/podman-search.1.md | 191 + .../source/markdown/podman-secret-create.1.md | 112 + .../source/markdown/podman-secret-exists.1.md | 48 + .../markdown/podman-secret-inspect.1.md | 73 + .../source/markdown/podman-secret-ls.1.md | 84 + .../source/markdown/podman-secret-rm.1.md | 48 + .../source/markdown/podman-secret.1.md | 31 + .../source/markdown/podman-start.1.md | 128 + .../source/markdown/podman-stats.1.md | 164 + .../source/markdown/podman-stop.1.md | 142 + .../source/markdown/podman-system-check.1.md | 64 + .../podman-system-connection-add.1.md | 69 + .../podman-system-connection-default.1.md | 27 + .../podman-system-connection-list.1.md | 51 + .../podman-system-connection-remove.1.md | 33 + .../podman-system-connection-rename.1.md | 27 + .../markdown/podman-system-connection.1.md | 52 + .../source/markdown/podman-system-df.1.md | 84 + .../markdown/podman-system-migrate.1.md | 44 + .../source/markdown/podman-system-prune.1.md | 76 + .../markdown/podman-system-renumber.1.md | 31 + .../source/markdown/podman-system-reset.1.md | 74 + .../markdown/podman-system-service.1.md | 146 + .../source/markdown/podman-system.1.md | 33 + .../source/markdown/podman-systemd.unit.5.md | 2193 ++ .../source/markdown/podman-tag.1.md | 51 + .../source/markdown/podman-top.1.md | 125 + .../markdown/podman-troubleshooting.7.md | 1552 ++ .../source/markdown/podman-unmount.1.md | 75 + .../source/markdown/podman-unpause.1.md | 103 + .../source/markdown/podman-unshare.1.md | 114 + .../source/markdown/podman-untag.1.md | 46 + .../source/markdown/podman-update.1.md | 562 + .../source/markdown/podman-version.1.md | 60 + .../source/markdown/podman-volume-create.1.md | 213 + .../source/markdown/podman-volume-exists.1.md | 48 + .../source/markdown/podman-volume-export.1.md | 43 + .../source/markdown/podman-volume-import.1.md | 46 + .../markdown/podman-volume-inspect.1.md | 109 + .../source/markdown/podman-volume-ls.1.md | 117 + .../source/markdown/podman-volume-mount.1.md | 41 + .../source/markdown/podman-volume-prune.1.md | 77 + .../source/markdown/podman-volume-reload.1.md | 35 + .../source/markdown/podman-volume-rm.1.md | 70 + .../markdown/podman-volume-unmount.1.md | 37 + .../source/markdown/podman-volume.1.md | 37 + .../source/markdown/podman-wait.1.md | 103 + .../version-5.5.0/source/markdown/podman.1.md | 491 + .../source/markdown/podmansh.1.md | 138 + .../version-5.5.0/tutorials/README.md | 46 + .../tutorials/basic_networking.md | 336 + .../version-5.5.0/tutorials/image_signing.md | 199 + .../version-5.5.0/tutorials/mac_client.md | 7 + .../version-5.5.0/tutorials/mac_win_client.md | 120 + .../version-5.5.0/tutorials/performance.md | 249 + .../tutorials/podman-derivative-api.md | 60 + .../tutorials/podman-for-windows.md | 426 + .../podman-install-certificate-authority.md | 114 + .../tutorials/podman_tutorial.md | 149 + .../tutorials/podman_tutorial_cn.md | 175 + .../tutorials/qemu-remote-tutorial.md | 137 + .../version-5.5.0/tutorials/remote_client.md | 124 + .../tutorials/rootless_tutorial.md | 221 + .../tutorials/socket_activation.md | 289 + .../version-5.5.1/MANPAGE_SYNTAX.md | 147 + versioned_docs/version-5.5.1/index.md | 42 + .../version-5.5.1/kubernetes_support.md | 208 + .../source/markdown/options/README.md | 68 + .../source/markdown/options/add-host.md | 44 + .../markdown/options/annotation.container.md | 12 + .../markdown/options/annotation.image.md | 16 + .../markdown/options/annotation.manifest.md | 12 + .../source/markdown/options/arch.md | 12 + .../source/markdown/options/attach.md | 19 + .../source/markdown/options/authfile.md | 15 + .../markdown/options/blkio-weight-device.md | 12 + .../source/markdown/options/blkio-weight.md | 14 + .../source/markdown/options/build-arg-file.md | 27 + .../source/markdown/options/build-arg.md | 13 + .../source/markdown/options/build-context.md | 35 + .../source/markdown/options/cache-from.md | 26 + .../source/markdown/options/cache-to.md | 24 + .../source/markdown/options/cache-ttl.md | 17 + .../source/markdown/options/cap-add.image.md | 15 + .../source/markdown/options/cap-add.md | 24 + .../source/markdown/options/cap-drop.image.md | 21 + .../source/markdown/options/cap-drop.md | 12 + .../source/markdown/options/cert-dir.md | 14 + .../source/markdown/options/cgroup-conf.md | 12 + .../source/markdown/options/cgroup-parent.md | 14 + .../source/markdown/options/cgroupns.image.md | 15 + .../source/markdown/options/cgroupns.md | 19 + .../source/markdown/options/cgroups.md | 19 + .../source/markdown/options/chrootdirs.md | 14 + .../source/markdown/options/cidfile.read.md | 13 + .../source/markdown/options/cidfile.write.md | 13 + .../source/markdown/options/color.md | 12 + .../markdown/options/compat-auth-file.md | 12 + .../source/markdown/options/compat-volumes.md | 16 + .../markdown/options/compression-format.md | 13 + .../markdown/options/compression-level.md | 12 + .../source/markdown/options/conmon-pidfile.md | 13 + .../source/markdown/options/cpp-flag.md | 12 + .../source/markdown/options/cpu-period.md | 21 + .../source/markdown/options/cpu-quota.md | 23 + .../source/markdown/options/cpu-rt-period.md | 16 + .../source/markdown/options/cpu-rt-runtime.md | 19 + .../source/markdown/options/cpu-shares.md | 50 + .../source/markdown/options/cpus.container.md | 20 + .../source/markdown/options/cpuset-cpus.md | 20 + .../source/markdown/options/cpuset-mems.md | 23 + .../source/markdown/options/creds.md | 19 + .../source/markdown/options/decryption-key.md | 12 + .../source/markdown/options/destroy.md | 12 + .../source/markdown/options/detach-keys.md | 14 + .../markdown/options/device-cgroup-rule.md | 17 + .../markdown/options/device-read-bps.md | 18 + .../markdown/options/device-read-iops.md | 18 + .../markdown/options/device-write-bps.md | 18 + .../markdown/options/device-write-iops.md | 18 + .../source/markdown/options/device.md | 31 + .../source/markdown/options/digestfile.md | 12 + .../source/markdown/options/dir-compress.md | 12 + .../markdown/options/disable-compression.md | 17 + .../markdown/options/disable-content-trust.md | 14 + .../markdown/options/dns-option.container.md | 12 + .../markdown/options/dns-option.image.md | 12 + .../markdown/options/dns-search.container.md | 13 + .../markdown/options/dns-search.image.md | 12 + .../source/markdown/options/dns.md | 20 + .../source/markdown/options/entrypoint.md | 23 + .../source/markdown/options/env-file.md | 12 + .../source/markdown/options/env-host.md | 12 + .../source/markdown/options/env-merge.md | 18 + .../source/markdown/options/env.image.md | 16 + .../source/markdown/options/env.md | 14 + .../source/markdown/options/env.update.md | 18 + .../source/markdown/options/expose.md | 17 + .../source/markdown/options/farm.md | 12 + .../source/markdown/options/features.md | 13 + .../source/markdown/options/file.md | 21 + .../source/markdown/options/follow.md | 16 + .../markdown/options/force-compression.md | 13 + .../source/markdown/options/force-rm.md | 12 + .../source/markdown/options/format.md | 17 + .../source/markdown/options/from.md | 18 + .../markdown/options/gidmap.container.md | 17 + .../source/markdown/options/gidmap.pod.md | 13 + .../source/markdown/options/gpus.md | 13 + .../source/markdown/options/group-add.md | 20 + .../source/markdown/options/group-entry.md | 14 + .../source/markdown/options/health-cmd.md | 19 + .../markdown/options/health-interval.md | 14 + .../options/health-log-destination.md | 16 + .../markdown/options/health-max-log-count.md | 12 + .../markdown/options/health-max-log-size.md | 12 + .../markdown/options/health-on-failure.md | 17 + .../source/markdown/options/health-retries.md | 14 + .../markdown/options/health-start-period.md | 21 + .../markdown/options/health-startup-cmd.md | 16 + .../options/health-startup-interval.md | 12 + .../options/health-startup-retries.md | 12 + .../options/health-startup-success.md | 13 + .../options/health-startup-timeout.md | 13 + .../source/markdown/options/health-timeout.md | 19 + .../source/markdown/options/help.md | 12 + .../source/markdown/options/hooks-dir.md | 20 + .../markdown/options/hostname.container.md | 18 + .../source/markdown/options/hostname.pod.md | 15 + .../source/markdown/options/hosts-file.md | 17 + .../source/markdown/options/hostuser.md | 13 + .../source/markdown/options/http-proxy.md | 25 + .../source/markdown/options/identity-label.md | 12 + .../source/markdown/options/ignore.md | 14 + .../source/markdown/options/ignorefile.md | 12 + .../source/markdown/options/iidfile.md | 12 + .../source/markdown/options/image-volume.md | 17 + .../source/markdown/options/infra-command.md | 12 + .../markdown/options/infra-conmon-pidfile.md | 12 + .../source/markdown/options/infra-name.md | 12 + .../source/markdown/options/inherit-labels.md | 12 + .../source/markdown/options/init-path.md | 12 + .../source/markdown/options/init.md | 14 + .../source/markdown/options/interactive.md | 16 + .../source/markdown/options/ip.md | 17 + .../source/markdown/options/ip6.md | 17 + .../source/markdown/options/ipc.image.md | 17 + .../source/markdown/options/ipc.md | 21 + .../source/markdown/options/isolation.md | 22 + .../source/markdown/options/jobs.md | 14 + .../source/markdown/options/label-file.md | 12 + .../source/markdown/options/label.image.md | 23 + .../source/markdown/options/label.md | 12 + .../source/markdown/options/latest.md | 15 + .../source/markdown/options/layer-label.md | 16 + .../source/markdown/options/layers.md | 15 + .../source/markdown/options/link-local-ip.md | 12 + .../source/markdown/options/log-driver.md | 23 + .../source/markdown/options/log-opt.md | 25 + .../source/markdown/options/logfile.md | 14 + .../source/markdown/options/mac-address.md | 20 + .../source/markdown/options/manifest.md | 12 + .../markdown/options/memory-reservation.md | 20 + .../source/markdown/options/memory-swap.md | 22 + .../markdown/options/memory-swappiness.md | 14 + .../source/markdown/options/memory.md | 20 + .../source/markdown/options/mount.md | 133 + .../source/markdown/options/name.container.md | 25 + .../source/markdown/options/names.md | 12 + .../source/markdown/options/network-alias.md | 17 + .../source/markdown/options/network.image.md | 68 + .../source/markdown/options/network.md | 99 + .../source/markdown/options/no-cache.md | 12 + .../source/markdown/options/no-healthcheck.md | 12 + .../source/markdown/options/no-hostname.md | 14 + .../source/markdown/options/no-hosts.md | 21 + .../source/markdown/options/no-reset.md | 12 + .../source/markdown/options/no-stream.md | 12 + .../source/markdown/options/no-trunc.md | 12 + .../source/markdown/options/noheading.md | 12 + .../source/markdown/options/omit-history.md | 17 + .../markdown/options/oom-kill-disable.md | 14 + .../source/markdown/options/oom-score-adj.md | 16 + .../source/markdown/options/os-feature.md | 14 + .../markdown/options/os-version.image.md | 12 + .../source/markdown/options/os-version.md | 13 + .../source/markdown/options/os.md | 12 + .../source/markdown/options/os.pull.md | 13 + .../source/markdown/options/passwd-entry.md | 14 + .../source/markdown/options/personality.md | 12 + .../source/markdown/options/pid.container.md | 18 + .../source/markdown/options/pid.image.md | 14 + .../source/markdown/options/pid.pod.md | 16 + .../source/markdown/options/pidfile.md | 18 + .../source/markdown/options/pids-limit.md | 12 + .../source/markdown/options/platform.md | 14 + .../markdown/options/pod-id-file.container.md | 13 + .../markdown/options/pod-id-file.pod.md | 12 + .../source/markdown/options/pod.run.md | 14 + .../source/markdown/options/preserve-fd.md | 15 + .../source/markdown/options/preserve-fds.md | 14 + .../source/markdown/options/privileged.md | 28 + .../source/markdown/options/publish-all.md | 21 + .../source/markdown/options/publish.md | 31 + .../source/markdown/options/pull.image.md | 17 + .../source/markdown/options/pull.md | 17 + .../source/markdown/options/quiet.md | 12 + .../source/markdown/options/rdt-class.md | 12 + .../markdown/options/read-only-tmpfs.md | 31 + .../source/markdown/options/read-only.md | 15 + .../source/markdown/options/replace.md | 12 + .../source/markdown/options/requires.md | 14 + .../source/markdown/options/restart.md | 27 + .../source/markdown/options/retry-delay.md | 13 + .../source/markdown/options/retry.md | 13 + .../source/markdown/options/rm.md | 12 + .../source/markdown/options/rootfs.md | 39 + .../source/markdown/options/runtime-flag.md | 14 + .../source/markdown/options/runtime.md | 15 + .../markdown/options/sbom-image-output.md | 13 + .../options/sbom-image-purl-output.md | 15 + .../markdown/options/sbom-merge-strategy.md | 29 + .../source/markdown/options/sbom-output.md | 13 + .../markdown/options/sbom-purl-output.md | 15 + .../markdown/options/sbom-scanner-command.md | 20 + .../markdown/options/sbom-scanner-image.md | 12 + .../source/markdown/options/sbom.md | 38 + .../source/markdown/options/sdnotify.md | 21 + .../source/markdown/options/seccomp-policy.md | 14 + .../source/markdown/options/secret.image.md | 28 + .../source/markdown/options/secret.md | 59 + .../markdown/options/security-opt.image.md | 27 + .../source/markdown/options/security-opt.md | 41 + .../markdown/options/shm-size-systemd.md | 15 + .../source/markdown/options/shm-size.md | 15 + .../source/markdown/options/sig-proxy.md | 12 + .../markdown/options/sign-by-sigstore.md | 13 + .../markdown/options/sign-passphrase-file.md | 12 + .../source/markdown/options/signal.md | 13 + .../source/markdown/options/since.md | 15 + .../markdown/options/skip-unused-stages.md | 12 + .../source/markdown/options/squash-all.md | 12 + .../source/markdown/options/squash.md | 12 + .../source/markdown/options/ssh.md | 17 + .../source/markdown/options/stop-signal.md | 12 + .../source/markdown/options/stop-timeout.md | 13 + .../source/markdown/options/subgidname.md | 14 + .../source/markdown/options/subuidname.md | 14 + .../source/markdown/options/sysctl.md | 30 + .../source/markdown/options/systemd.md | 42 + .../source/markdown/options/tag.md | 13 + .../source/markdown/options/tail.md | 13 + .../source/markdown/options/target.md | 12 + .../source/markdown/options/time.md | 13 + .../source/markdown/options/timeout.md | 14 + .../source/markdown/options/timestamp.md | 15 + .../source/markdown/options/timestamps.md | 12 + .../source/markdown/options/tls-verify.md | 16 + .../source/markdown/options/tmpfs.md | 23 + .../source/markdown/options/tty.md | 18 + .../source/markdown/options/tz.md | 13 + .../markdown/options/uidmap.container.md | 201 + .../source/markdown/options/uidmap.pod.md | 15 + .../source/markdown/options/ulimit.image.md | 27 + .../source/markdown/options/ulimit.md | 33 + .../source/markdown/options/umask.md | 13 + .../source/markdown/options/unsetenv-all.md | 14 + .../source/markdown/options/unsetenv.image.md | 12 + .../source/markdown/options/unsetenv.md | 14 + .../markdown/options/unsetenv.update.md | 15 + .../source/markdown/options/unsetlabel.md | 12 + .../source/markdown/options/until.md | 15 + .../markdown/options/user-mode-networking.md | 26 + .../source/markdown/options/user.md | 16 + .../markdown/options/userns-gid-map-group.md | 19 + .../source/markdown/options/userns-gid-map.md | 24 + .../markdown/options/userns-uid-map-user.md | 19 + .../source/markdown/options/userns-uid-map.md | 24 + .../markdown/options/userns.container.md | 74 + .../source/markdown/options/userns.image.md | 13 + .../source/markdown/options/userns.pod.md | 38 + .../source/markdown/options/uts.container.md | 17 + .../source/markdown/options/uts.md | 13 + .../source/markdown/options/uts.pod.md | 16 + .../markdown/options/variant.container.md | 12 + .../markdown/options/variant.manifest.md | 14 + .../source/markdown/options/volume.image.md | 125 + .../source/markdown/options/volume.md | 216 + .../source/markdown/options/volumes-from.md | 41 + .../source/markdown/options/workdir.md | 16 + .../source/markdown/podman-artifact-add.1.md | 88 + .../markdown/podman-artifact-extract.1.md | 88 + .../markdown/podman-artifact-inspect.1.md | 43 + .../source/markdown/podman-artifact-ls.1.md | 90 + .../source/markdown/podman-artifact-pull.1.md | 140 + .../source/markdown/podman-artifact-push.1.md | 149 + .../source/markdown/podman-artifact-rm.1.md | 63 + .../source/markdown/podman-artifact.1.md | 42 + .../source/markdown/podman-attach.1.md | 78 + .../source/markdown/podman-auto-update.1.md | 146 + .../source/markdown/podman-build.1.md | 1951 ++ .../source/markdown/podman-commit.1.md | 139 + .../source/markdown/podman-completion.1.md | 83 + .../source/markdown/podman-compose.1.md | 28 + .../markdown/podman-container-checkpoint.1.md | 231 + .../markdown/podman-container-cleanup.1.md | 61 + .../markdown/podman-container-clone.1.md | 362 + .../markdown/podman-container-diff.1.md | 65 + .../markdown/podman-container-exists.1.md | 56 + .../markdown/podman-container-inspect.1.md | 349 + .../markdown/podman-container-prune.1.md | 83 + .../markdown/podman-container-restore.1.md | 198 + .../markdown/podman-container-runlabel.1.md | 128 + .../source/markdown/podman-container.1.md | 58 + .../source/markdown/podman-cp.1.md | 140 + .../source/markdown/podman-create.1.md | 2905 +++ .../source/markdown/podman-diff.1.md | 75 + .../source/markdown/podman-events.1.md | 226 + .../source/markdown/podman-exec.1.md | 212 + .../source/markdown/podman-export.1.md | 56 + .../source/markdown/podman-farm-build.1.md | 1572 ++ .../source/markdown/podman-farm-create.1.md | 39 + .../source/markdown/podman-farm-list.1.md | 47 + .../source/markdown/podman-farm-remove.1.md | 41 + .../source/markdown/podman-farm-update.1.md | 53 + .../source/markdown/podman-farm.1.md | 46 + .../source/markdown/podman-generate-spec.1.md | 31 + .../markdown/podman-generate-systemd.1.md | 326 + .../source/markdown/podman-generate.1.md | 27 + .../markdown/podman-healthcheck-run.1.md | 45 + .../source/markdown/podman-healthcheck.1.md | 27 + .../source/markdown/podman-history.1.md | 110 + .../source/markdown/podman-image-diff.1.md | 61 + .../source/markdown/podman-image-exists.1.md | 46 + .../source/markdown/podman-image-inspect.1.md | 139 + .../source/markdown/podman-image-mount.1.md | 82 + .../source/markdown/podman-image-prune.1.md | 121 + .../source/markdown/podman-image-scp.1.md | 107 + .../source/markdown/podman-image-sign.1.md | 94 + .../source/markdown/podman-image-tree.1.md | 91 + .../source/markdown/podman-image-trust.1.md | 211 + .../source/markdown/podman-image-unmount.1.md | 55 + .../source/markdown/podman-image.1.md | 45 + .../source/markdown/podman-images.1.md | 268 + .../source/markdown/podman-import.1.md | 121 + .../source/markdown/podman-info.1.md | 409 + .../source/markdown/podman-init.1.md | 61 + .../source/markdown/podman-inspect.1.md | 185 + .../source/markdown/podman-kill.1.md | 91 + .../source/markdown/podman-kube-apply.1.md | 79 + .../source/markdown/podman-kube-down.1.md | 76 + .../source/markdown/podman-kube-generate.1.md | 254 + .../source/markdown/podman-kube-play.1.md | 823 + .../source/markdown/podman-kube.1.md | 35 + .../source/markdown/podman-load.1.md | 92 + .../source/markdown/podman-login.1.md | 188 + .../source/markdown/podman-logout.1.md | 77 + .../source/markdown/podman-logs.1.md | 173 + .../source/markdown/podman-machine-cp.1.md | 68 + .../source/markdown/podman-machine-info.1.md | 107 + .../source/markdown/podman-machine-init.1.md | 255 + .../markdown/podman-machine-inspect.1.md | 60 + .../source/markdown/podman-machine-list.1.md | 117 + .../markdown/podman-machine-os-apply.1.md | 70 + .../source/markdown/podman-machine-os.1.md | 27 + .../source/markdown/podman-machine-reset.1.md | 52 + .../source/markdown/podman-machine-rm.1.md | 71 + .../source/markdown/podman-machine-set.1.md | 126 + .../source/markdown/podman-machine-ssh.1.md | 91 + .../source/markdown/podman-machine-start.1.md | 58 + .../source/markdown/podman-machine-stop.1.md | 47 + .../source/markdown/podman-machine.1.md | 56 + .../source/markdown/podman-manifest-add.1.md | 235 + .../markdown/podman-manifest-annotate.1.md | 95 + .../markdown/podman-manifest-create.1.md | 79 + .../markdown/podman-manifest-exists.1.md | 47 + .../markdown/podman-manifest-inspect.1.md | 54 + .../source/markdown/podman-manifest-push.1.md | 173 + .../markdown/podman-manifest-remove.1.md | 29 + .../source/markdown/podman-manifest-rm.1.md | 36 + .../source/markdown/podman-manifest.1.md | 76 + .../source/markdown/podman-mount.1.md | 86 + .../markdown/podman-network-connect.1.md | 55 + .../markdown/podman-network-create.1.md | 220 + .../markdown/podman-network-disconnect.1.md | 37 + .../markdown/podman-network-exists.1.md | 47 + .../markdown/podman-network-inspect.1.md | 83 + .../source/markdown/podman-network-ls.1.md | 124 + .../source/markdown/podman-network-prune.1.md | 58 + .../markdown/podman-network-reload.1.md | 67 + .../source/markdown/podman-network-rm.1.md | 54 + .../markdown/podman-network-update.1.md | 41 + .../source/markdown/podman-network.1.md | 61 + .../source/markdown/podman-pause.1.md | 103 + .../source/markdown/podman-pod-clone.1.md | 796 + .../source/markdown/podman-pod-create.1.md | 1139 + .../source/markdown/podman-pod-exists.1.md | 38 + .../source/markdown/podman-pod-inspect.1.md | 113 + .../source/markdown/podman-pod-kill.1.md | 73 + .../source/markdown/podman-pod-logs.1.md | 136 + .../source/markdown/podman-pod-pause.1.md | 43 + .../source/markdown/podman-pod-prune.1.md | 38 + .../source/markdown/podman-pod-ps.1.md | 206 + .../source/markdown/podman-pod-restart.1.md | 64 + .../source/markdown/podman-pod-rm.1.md | 109 + .../source/markdown/podman-pod-start.1.md | 74 + .../source/markdown/podman-pod-stats.1.md | 116 + .../source/markdown/podman-pod-stop.1.md | 111 + .../source/markdown/podman-pod-top.1.md | 65 + .../source/markdown/podman-pod-unpause.1.md | 43 + .../source/markdown/podman-pod.1.md | 42 + .../source/markdown/podman-port.1.md | 71 + .../source/markdown/podman-ps.1.md | 228 + .../source/markdown/podman-pull.1.md | 327 + .../source/markdown/podman-push.1.md | 276 + .../source/markdown/podman-remote.1.md | 206 + .../source/markdown/podman-rename.1.md | 43 + .../source/markdown/podman-restart.1.md | 121 + .../source/markdown/podman-rm.1.md | 163 + .../source/markdown/podman-rmi.1.md | 81 + .../source/markdown/podman-rootless.7.md | 54 + .../source/markdown/podman-run.1.md | 3314 +++ .../source/markdown/podman-save.1.md | 107 + .../source/markdown/podman-search.1.md | 191 + .../source/markdown/podman-secret-create.1.md | 112 + .../source/markdown/podman-secret-exists.1.md | 48 + .../markdown/podman-secret-inspect.1.md | 73 + .../source/markdown/podman-secret-ls.1.md | 84 + .../source/markdown/podman-secret-rm.1.md | 48 + .../source/markdown/podman-secret.1.md | 31 + .../source/markdown/podman-start.1.md | 128 + .../source/markdown/podman-stats.1.md | 164 + .../source/markdown/podman-stop.1.md | 142 + .../source/markdown/podman-system-check.1.md | 64 + .../podman-system-connection-add.1.md | 69 + .../podman-system-connection-default.1.md | 27 + .../podman-system-connection-list.1.md | 51 + .../podman-system-connection-remove.1.md | 33 + .../podman-system-connection-rename.1.md | 27 + .../markdown/podman-system-connection.1.md | 52 + .../source/markdown/podman-system-df.1.md | 84 + .../markdown/podman-system-migrate.1.md | 44 + .../source/markdown/podman-system-prune.1.md | 76 + .../markdown/podman-system-renumber.1.md | 31 + .../source/markdown/podman-system-reset.1.md | 74 + .../markdown/podman-system-service.1.md | 146 + .../source/markdown/podman-system.1.md | 33 + .../source/markdown/podman-systemd.unit.5.md | 2188 ++ .../source/markdown/podman-tag.1.md | 51 + .../source/markdown/podman-top.1.md | 125 + .../markdown/podman-troubleshooting.7.md | 1552 ++ .../source/markdown/podman-unmount.1.md | 75 + .../source/markdown/podman-unpause.1.md | 103 + .../source/markdown/podman-unshare.1.md | 114 + .../source/markdown/podman-untag.1.md | 46 + .../source/markdown/podman-update.1.md | 562 + .../source/markdown/podman-version.1.md | 60 + .../source/markdown/podman-volume-create.1.md | 213 + .../source/markdown/podman-volume-exists.1.md | 48 + .../source/markdown/podman-volume-export.1.md | 43 + .../source/markdown/podman-volume-import.1.md | 46 + .../markdown/podman-volume-inspect.1.md | 109 + .../source/markdown/podman-volume-ls.1.md | 117 + .../source/markdown/podman-volume-mount.1.md | 41 + .../source/markdown/podman-volume-prune.1.md | 77 + .../source/markdown/podman-volume-reload.1.md | 35 + .../source/markdown/podman-volume-rm.1.md | 70 + .../markdown/podman-volume-unmount.1.md | 37 + .../source/markdown/podman-volume.1.md | 37 + .../source/markdown/podman-wait.1.md | 103 + .../version-5.5.1/source/markdown/podman.1.md | 491 + .../source/markdown/podmansh.1.md | 138 + .../version-5.5.1/tutorials/README.md | 46 + .../tutorials/basic_networking.md | 336 + .../version-5.5.1/tutorials/image_signing.md | 199 + .../version-5.5.1/tutorials/mac_client.md | 7 + .../version-5.5.1/tutorials/mac_win_client.md | 120 + .../version-5.5.1/tutorials/performance.md | 249 + .../tutorials/podman-derivative-api.md | 60 + .../tutorials/podman-for-windows.md | 426 + .../podman-install-certificate-authority.md | 114 + .../tutorials/podman_tutorial.md | 149 + .../tutorials/podman_tutorial_cn.md | 175 + .../tutorials/qemu-remote-tutorial.md | 137 + .../version-5.5.1/tutorials/remote_client.md | 124 + .../tutorials/rootless_tutorial.md | 221 + .../tutorials/socket_activation.md | 289 + .../version-5.5.2/MANPAGE_SYNTAX.md | 147 + versioned_docs/version-5.5.2/index.md | 42 + .../version-5.5.2/kubernetes_support.md | 208 + .../source/markdown/options/README.md | 68 + .../source/markdown/options/add-host.md | 44 + .../markdown/options/annotation.container.md | 12 + .../markdown/options/annotation.image.md | 16 + .../markdown/options/annotation.manifest.md | 12 + .../source/markdown/options/arch.md | 12 + .../source/markdown/options/attach.md | 19 + .../source/markdown/options/authfile.md | 15 + .../markdown/options/blkio-weight-device.md | 12 + .../source/markdown/options/blkio-weight.md | 14 + .../source/markdown/options/build-arg-file.md | 27 + .../source/markdown/options/build-arg.md | 13 + .../source/markdown/options/build-context.md | 35 + .../source/markdown/options/cache-from.md | 26 + .../source/markdown/options/cache-to.md | 24 + .../source/markdown/options/cache-ttl.md | 17 + .../source/markdown/options/cap-add.image.md | 15 + .../source/markdown/options/cap-add.md | 24 + .../source/markdown/options/cap-drop.image.md | 21 + .../source/markdown/options/cap-drop.md | 12 + .../source/markdown/options/cert-dir.md | 14 + .../source/markdown/options/cgroup-conf.md | 12 + .../source/markdown/options/cgroup-parent.md | 14 + .../source/markdown/options/cgroupns.image.md | 15 + .../source/markdown/options/cgroupns.md | 19 + .../source/markdown/options/cgroups.md | 19 + .../source/markdown/options/chrootdirs.md | 14 + .../source/markdown/options/cidfile.read.md | 13 + .../source/markdown/options/cidfile.write.md | 13 + .../source/markdown/options/color.md | 12 + .../markdown/options/compat-auth-file.md | 12 + .../source/markdown/options/compat-volumes.md | 16 + .../markdown/options/compression-format.md | 13 + .../markdown/options/compression-level.md | 12 + .../source/markdown/options/conmon-pidfile.md | 13 + .../source/markdown/options/cpp-flag.md | 12 + .../source/markdown/options/cpu-period.md | 21 + .../source/markdown/options/cpu-quota.md | 23 + .../source/markdown/options/cpu-rt-period.md | 16 + .../source/markdown/options/cpu-rt-runtime.md | 19 + .../source/markdown/options/cpu-shares.md | 50 + .../source/markdown/options/cpus.container.md | 20 + .../source/markdown/options/cpuset-cpus.md | 20 + .../source/markdown/options/cpuset-mems.md | 23 + .../source/markdown/options/creds.md | 19 + .../source/markdown/options/decryption-key.md | 12 + .../source/markdown/options/destroy.md | 12 + .../source/markdown/options/detach-keys.md | 14 + .../markdown/options/device-cgroup-rule.md | 17 + .../markdown/options/device-read-bps.md | 18 + .../markdown/options/device-read-iops.md | 18 + .../markdown/options/device-write-bps.md | 18 + .../markdown/options/device-write-iops.md | 18 + .../source/markdown/options/device.md | 31 + .../source/markdown/options/digestfile.md | 12 + .../source/markdown/options/dir-compress.md | 12 + .../markdown/options/disable-compression.md | 17 + .../markdown/options/disable-content-trust.md | 14 + .../markdown/options/dns-option.container.md | 12 + .../markdown/options/dns-option.image.md | 12 + .../markdown/options/dns-search.container.md | 13 + .../markdown/options/dns-search.image.md | 12 + .../source/markdown/options/dns.md | 20 + .../source/markdown/options/entrypoint.md | 23 + .../source/markdown/options/env-file.md | 12 + .../source/markdown/options/env-host.md | 12 + .../source/markdown/options/env-merge.md | 18 + .../source/markdown/options/env.image.md | 16 + .../source/markdown/options/env.md | 14 + .../source/markdown/options/env.update.md | 18 + .../source/markdown/options/expose.md | 17 + .../source/markdown/options/farm.md | 12 + .../source/markdown/options/features.md | 13 + .../source/markdown/options/file.md | 21 + .../source/markdown/options/follow.md | 16 + .../markdown/options/force-compression.md | 13 + .../source/markdown/options/force-rm.md | 12 + .../source/markdown/options/format.md | 17 + .../source/markdown/options/from.md | 18 + .../markdown/options/gidmap.container.md | 17 + .../source/markdown/options/gidmap.pod.md | 13 + .../source/markdown/options/gpus.md | 13 + .../source/markdown/options/group-add.md | 20 + .../source/markdown/options/group-entry.md | 14 + .../source/markdown/options/health-cmd.md | 19 + .../markdown/options/health-interval.md | 14 + .../options/health-log-destination.md | 16 + .../markdown/options/health-max-log-count.md | 12 + .../markdown/options/health-max-log-size.md | 12 + .../markdown/options/health-on-failure.md | 17 + .../source/markdown/options/health-retries.md | 14 + .../markdown/options/health-start-period.md | 21 + .../markdown/options/health-startup-cmd.md | 16 + .../options/health-startup-interval.md | 12 + .../options/health-startup-retries.md | 12 + .../options/health-startup-success.md | 13 + .../options/health-startup-timeout.md | 13 + .../source/markdown/options/health-timeout.md | 19 + .../source/markdown/options/help.md | 12 + .../source/markdown/options/hooks-dir.md | 20 + .../markdown/options/hostname.container.md | 18 + .../source/markdown/options/hostname.pod.md | 15 + .../source/markdown/options/hosts-file.md | 17 + .../source/markdown/options/hostuser.md | 13 + .../source/markdown/options/http-proxy.md | 25 + .../source/markdown/options/identity-label.md | 12 + .../source/markdown/options/ignore.md | 14 + .../source/markdown/options/ignorefile.md | 12 + .../source/markdown/options/iidfile.md | 12 + .../source/markdown/options/image-volume.md | 17 + .../source/markdown/options/infra-command.md | 12 + .../markdown/options/infra-conmon-pidfile.md | 12 + .../source/markdown/options/infra-name.md | 12 + .../source/markdown/options/inherit-labels.md | 12 + .../source/markdown/options/init-path.md | 12 + .../source/markdown/options/init.md | 14 + .../source/markdown/options/interactive.md | 16 + .../source/markdown/options/ip.md | 17 + .../source/markdown/options/ip6.md | 17 + .../source/markdown/options/ipc.image.md | 17 + .../source/markdown/options/ipc.md | 21 + .../source/markdown/options/isolation.md | 22 + .../source/markdown/options/jobs.md | 14 + .../source/markdown/options/label-file.md | 12 + .../source/markdown/options/label.image.md | 23 + .../source/markdown/options/label.md | 12 + .../source/markdown/options/latest.md | 15 + .../source/markdown/options/layer-label.md | 16 + .../source/markdown/options/layers.md | 15 + .../source/markdown/options/link-local-ip.md | 12 + .../source/markdown/options/log-driver.md | 23 + .../source/markdown/options/log-opt.md | 25 + .../source/markdown/options/logfile.md | 14 + .../source/markdown/options/mac-address.md | 20 + .../source/markdown/options/manifest.md | 12 + .../markdown/options/memory-reservation.md | 20 + .../source/markdown/options/memory-swap.md | 22 + .../markdown/options/memory-swappiness.md | 14 + .../source/markdown/options/memory.md | 20 + .../source/markdown/options/mount.md | 133 + .../source/markdown/options/name.container.md | 25 + .../source/markdown/options/names.md | 12 + .../source/markdown/options/network-alias.md | 17 + .../source/markdown/options/network.image.md | 68 + .../source/markdown/options/network.md | 99 + .../source/markdown/options/no-cache.md | 12 + .../source/markdown/options/no-healthcheck.md | 12 + .../source/markdown/options/no-hostname.md | 14 + .../source/markdown/options/no-hosts.md | 21 + .../source/markdown/options/no-reset.md | 12 + .../source/markdown/options/no-stream.md | 12 + .../source/markdown/options/no-trunc.md | 12 + .../source/markdown/options/noheading.md | 12 + .../source/markdown/options/omit-history.md | 17 + .../markdown/options/oom-kill-disable.md | 14 + .../source/markdown/options/oom-score-adj.md | 16 + .../source/markdown/options/os-feature.md | 14 + .../markdown/options/os-version.image.md | 12 + .../source/markdown/options/os-version.md | 13 + .../source/markdown/options/os.md | 12 + .../source/markdown/options/os.pull.md | 13 + .../source/markdown/options/passwd-entry.md | 14 + .../source/markdown/options/personality.md | 12 + .../source/markdown/options/pid.container.md | 18 + .../source/markdown/options/pid.image.md | 14 + .../source/markdown/options/pid.pod.md | 16 + .../source/markdown/options/pidfile.md | 18 + .../source/markdown/options/pids-limit.md | 12 + .../source/markdown/options/platform.md | 14 + .../markdown/options/pod-id-file.container.md | 13 + .../markdown/options/pod-id-file.pod.md | 12 + .../source/markdown/options/pod.run.md | 14 + .../source/markdown/options/preserve-fd.md | 15 + .../source/markdown/options/preserve-fds.md | 14 + .../source/markdown/options/privileged.md | 28 + .../source/markdown/options/publish-all.md | 21 + .../source/markdown/options/publish.md | 31 + .../source/markdown/options/pull.image.md | 17 + .../source/markdown/options/pull.md | 17 + .../source/markdown/options/quiet.md | 12 + .../source/markdown/options/rdt-class.md | 12 + .../markdown/options/read-only-tmpfs.md | 31 + .../source/markdown/options/read-only.md | 15 + .../source/markdown/options/replace.md | 12 + .../source/markdown/options/requires.md | 14 + .../source/markdown/options/restart.md | 27 + .../source/markdown/options/retry-delay.md | 13 + .../source/markdown/options/retry.md | 13 + .../source/markdown/options/rm.md | 12 + .../source/markdown/options/rootfs.md | 39 + .../source/markdown/options/runtime-flag.md | 14 + .../source/markdown/options/runtime.md | 15 + .../markdown/options/sbom-image-output.md | 13 + .../options/sbom-image-purl-output.md | 15 + .../markdown/options/sbom-merge-strategy.md | 29 + .../source/markdown/options/sbom-output.md | 13 + .../markdown/options/sbom-purl-output.md | 15 + .../markdown/options/sbom-scanner-command.md | 20 + .../markdown/options/sbom-scanner-image.md | 12 + .../source/markdown/options/sbom.md | 38 + .../source/markdown/options/sdnotify.md | 21 + .../source/markdown/options/seccomp-policy.md | 14 + .../source/markdown/options/secret.image.md | 28 + .../source/markdown/options/secret.md | 59 + .../markdown/options/security-opt.image.md | 27 + .../source/markdown/options/security-opt.md | 41 + .../markdown/options/shm-size-systemd.md | 15 + .../source/markdown/options/shm-size.md | 15 + .../source/markdown/options/sig-proxy.md | 12 + .../markdown/options/sign-by-sigstore.md | 13 + .../markdown/options/sign-passphrase-file.md | 12 + .../source/markdown/options/signal.md | 13 + .../source/markdown/options/since.md | 15 + .../markdown/options/skip-unused-stages.md | 12 + .../source/markdown/options/squash-all.md | 12 + .../source/markdown/options/squash.md | 12 + .../source/markdown/options/ssh.md | 17 + .../source/markdown/options/stop-signal.md | 12 + .../source/markdown/options/stop-timeout.md | 13 + .../source/markdown/options/subgidname.md | 14 + .../source/markdown/options/subuidname.md | 14 + .../source/markdown/options/sysctl.md | 30 + .../source/markdown/options/systemd.md | 42 + .../source/markdown/options/tag.md | 13 + .../source/markdown/options/tail.md | 13 + .../source/markdown/options/target.md | 12 + .../source/markdown/options/time.md | 13 + .../source/markdown/options/timeout.md | 14 + .../source/markdown/options/timestamp.md | 15 + .../source/markdown/options/timestamps.md | 12 + .../source/markdown/options/tls-verify.md | 16 + .../source/markdown/options/tmpfs.md | 23 + .../source/markdown/options/tty.md | 18 + .../source/markdown/options/tz.md | 13 + .../markdown/options/uidmap.container.md | 201 + .../source/markdown/options/uidmap.pod.md | 15 + .../source/markdown/options/ulimit.image.md | 27 + .../source/markdown/options/ulimit.md | 33 + .../source/markdown/options/umask.md | 13 + .../source/markdown/options/unsetenv-all.md | 14 + .../source/markdown/options/unsetenv.image.md | 12 + .../source/markdown/options/unsetenv.md | 14 + .../markdown/options/unsetenv.update.md | 15 + .../source/markdown/options/unsetlabel.md | 12 + .../source/markdown/options/until.md | 15 + .../markdown/options/user-mode-networking.md | 26 + .../source/markdown/options/user.md | 16 + .../markdown/options/userns-gid-map-group.md | 19 + .../source/markdown/options/userns-gid-map.md | 24 + .../markdown/options/userns-uid-map-user.md | 19 + .../source/markdown/options/userns-uid-map.md | 24 + .../markdown/options/userns.container.md | 74 + .../source/markdown/options/userns.image.md | 13 + .../source/markdown/options/userns.pod.md | 38 + .../source/markdown/options/uts.container.md | 17 + .../source/markdown/options/uts.md | 13 + .../source/markdown/options/uts.pod.md | 16 + .../markdown/options/variant.container.md | 12 + .../markdown/options/variant.manifest.md | 14 + .../source/markdown/options/volume.image.md | 125 + .../source/markdown/options/volume.md | 216 + .../source/markdown/options/volumes-from.md | 41 + .../source/markdown/options/workdir.md | 16 + .../source/markdown/podman-artifact-add.1.md | 88 + .../markdown/podman-artifact-extract.1.md | 88 + .../markdown/podman-artifact-inspect.1.md | 43 + .../source/markdown/podman-artifact-ls.1.md | 90 + .../source/markdown/podman-artifact-pull.1.md | 140 + .../source/markdown/podman-artifact-push.1.md | 149 + .../source/markdown/podman-artifact-rm.1.md | 63 + .../source/markdown/podman-artifact.1.md | 42 + .../source/markdown/podman-attach.1.md | 78 + .../source/markdown/podman-auto-update.1.md | 146 + .../source/markdown/podman-build.1.md | 1951 ++ .../source/markdown/podman-commit.1.md | 139 + .../source/markdown/podman-completion.1.md | 83 + .../source/markdown/podman-compose.1.md | 28 + .../markdown/podman-container-checkpoint.1.md | 231 + .../markdown/podman-container-cleanup.1.md | 61 + .../markdown/podman-container-clone.1.md | 362 + .../markdown/podman-container-diff.1.md | 65 + .../markdown/podman-container-exists.1.md | 56 + .../markdown/podman-container-inspect.1.md | 349 + .../markdown/podman-container-prune.1.md | 83 + .../markdown/podman-container-restore.1.md | 198 + .../markdown/podman-container-runlabel.1.md | 128 + .../source/markdown/podman-container.1.md | 58 + .../source/markdown/podman-cp.1.md | 140 + .../source/markdown/podman-create.1.md | 2905 +++ .../source/markdown/podman-diff.1.md | 75 + .../source/markdown/podman-events.1.md | 226 + .../source/markdown/podman-exec.1.md | 212 + .../source/markdown/podman-export.1.md | 56 + .../source/markdown/podman-farm-build.1.md | 1572 ++ .../source/markdown/podman-farm-create.1.md | 39 + .../source/markdown/podman-farm-list.1.md | 47 + .../source/markdown/podman-farm-remove.1.md | 41 + .../source/markdown/podman-farm-update.1.md | 53 + .../source/markdown/podman-farm.1.md | 46 + .../source/markdown/podman-generate-spec.1.md | 31 + .../markdown/podman-generate-systemd.1.md | 326 + .../source/markdown/podman-generate.1.md | 27 + .../markdown/podman-healthcheck-run.1.md | 45 + .../source/markdown/podman-healthcheck.1.md | 27 + .../source/markdown/podman-history.1.md | 110 + .../source/markdown/podman-image-diff.1.md | 61 + .../source/markdown/podman-image-exists.1.md | 46 + .../source/markdown/podman-image-inspect.1.md | 139 + .../source/markdown/podman-image-mount.1.md | 82 + .../source/markdown/podman-image-prune.1.md | 121 + .../source/markdown/podman-image-scp.1.md | 107 + .../source/markdown/podman-image-sign.1.md | 94 + .../source/markdown/podman-image-tree.1.md | 91 + .../source/markdown/podman-image-trust.1.md | 211 + .../source/markdown/podman-image-unmount.1.md | 55 + .../source/markdown/podman-image.1.md | 45 + .../source/markdown/podman-images.1.md | 268 + .../source/markdown/podman-import.1.md | 121 + .../source/markdown/podman-info.1.md | 409 + .../source/markdown/podman-init.1.md | 61 + .../source/markdown/podman-inspect.1.md | 185 + .../source/markdown/podman-kill.1.md | 91 + .../source/markdown/podman-kube-apply.1.md | 79 + .../source/markdown/podman-kube-down.1.md | 76 + .../source/markdown/podman-kube-generate.1.md | 254 + .../source/markdown/podman-kube-play.1.md | 823 + .../source/markdown/podman-kube.1.md | 35 + .../source/markdown/podman-load.1.md | 92 + .../source/markdown/podman-login.1.md | 188 + .../source/markdown/podman-logout.1.md | 77 + .../source/markdown/podman-logs.1.md | 173 + .../source/markdown/podman-machine-cp.1.md | 68 + .../source/markdown/podman-machine-info.1.md | 107 + .../source/markdown/podman-machine-init.1.md | 255 + .../markdown/podman-machine-inspect.1.md | 60 + .../source/markdown/podman-machine-list.1.md | 117 + .../markdown/podman-machine-os-apply.1.md | 70 + .../source/markdown/podman-machine-os.1.md | 27 + .../source/markdown/podman-machine-reset.1.md | 52 + .../source/markdown/podman-machine-rm.1.md | 71 + .../source/markdown/podman-machine-set.1.md | 126 + .../source/markdown/podman-machine-ssh.1.md | 91 + .../source/markdown/podman-machine-start.1.md | 58 + .../source/markdown/podman-machine-stop.1.md | 47 + .../source/markdown/podman-machine.1.md | 56 + .../source/markdown/podman-manifest-add.1.md | 235 + .../markdown/podman-manifest-annotate.1.md | 95 + .../markdown/podman-manifest-create.1.md | 79 + .../markdown/podman-manifest-exists.1.md | 47 + .../markdown/podman-manifest-inspect.1.md | 54 + .../source/markdown/podman-manifest-push.1.md | 173 + .../markdown/podman-manifest-remove.1.md | 29 + .../source/markdown/podman-manifest-rm.1.md | 36 + .../source/markdown/podman-manifest.1.md | 76 + .../source/markdown/podman-mount.1.md | 86 + .../markdown/podman-network-connect.1.md | 55 + .../markdown/podman-network-create.1.md | 220 + .../markdown/podman-network-disconnect.1.md | 37 + .../markdown/podman-network-exists.1.md | 47 + .../markdown/podman-network-inspect.1.md | 83 + .../source/markdown/podman-network-ls.1.md | 124 + .../source/markdown/podman-network-prune.1.md | 58 + .../markdown/podman-network-reload.1.md | 67 + .../source/markdown/podman-network-rm.1.md | 54 + .../markdown/podman-network-update.1.md | 41 + .../source/markdown/podman-network.1.md | 61 + .../source/markdown/podman-pause.1.md | 103 + .../source/markdown/podman-pod-clone.1.md | 796 + .../source/markdown/podman-pod-create.1.md | 1139 + .../source/markdown/podman-pod-exists.1.md | 38 + .../source/markdown/podman-pod-inspect.1.md | 113 + .../source/markdown/podman-pod-kill.1.md | 73 + .../source/markdown/podman-pod-logs.1.md | 136 + .../source/markdown/podman-pod-pause.1.md | 43 + .../source/markdown/podman-pod-prune.1.md | 38 + .../source/markdown/podman-pod-ps.1.md | 206 + .../source/markdown/podman-pod-restart.1.md | 64 + .../source/markdown/podman-pod-rm.1.md | 109 + .../source/markdown/podman-pod-start.1.md | 74 + .../source/markdown/podman-pod-stats.1.md | 116 + .../source/markdown/podman-pod-stop.1.md | 111 + .../source/markdown/podman-pod-top.1.md | 65 + .../source/markdown/podman-pod-unpause.1.md | 43 + .../source/markdown/podman-pod.1.md | 42 + .../source/markdown/podman-port.1.md | 71 + .../source/markdown/podman-ps.1.md | 228 + .../source/markdown/podman-pull.1.md | 327 + .../source/markdown/podman-push.1.md | 276 + .../source/markdown/podman-remote.1.md | 206 + .../source/markdown/podman-rename.1.md | 43 + .../source/markdown/podman-restart.1.md | 121 + .../source/markdown/podman-rm.1.md | 163 + .../source/markdown/podman-rmi.1.md | 81 + .../source/markdown/podman-rootless.7.md | 54 + .../source/markdown/podman-run.1.md | 3314 +++ .../source/markdown/podman-save.1.md | 107 + .../source/markdown/podman-search.1.md | 191 + .../source/markdown/podman-secret-create.1.md | 112 + .../source/markdown/podman-secret-exists.1.md | 48 + .../markdown/podman-secret-inspect.1.md | 73 + .../source/markdown/podman-secret-ls.1.md | 84 + .../source/markdown/podman-secret-rm.1.md | 48 + .../source/markdown/podman-secret.1.md | 31 + .../source/markdown/podman-start.1.md | 128 + .../source/markdown/podman-stats.1.md | 164 + .../source/markdown/podman-stop.1.md | 142 + .../source/markdown/podman-system-check.1.md | 64 + .../podman-system-connection-add.1.md | 69 + .../podman-system-connection-default.1.md | 27 + .../podman-system-connection-list.1.md | 51 + .../podman-system-connection-remove.1.md | 33 + .../podman-system-connection-rename.1.md | 27 + .../markdown/podman-system-connection.1.md | 52 + .../source/markdown/podman-system-df.1.md | 84 + .../markdown/podman-system-migrate.1.md | 44 + .../source/markdown/podman-system-prune.1.md | 76 + .../markdown/podman-system-renumber.1.md | 31 + .../source/markdown/podman-system-reset.1.md | 74 + .../markdown/podman-system-service.1.md | 146 + .../source/markdown/podman-system.1.md | 33 + .../source/markdown/podman-systemd.unit.5.md | 2188 ++ .../source/markdown/podman-tag.1.md | 51 + .../source/markdown/podman-top.1.md | 125 + .../markdown/podman-troubleshooting.7.md | 1552 ++ .../source/markdown/podman-unmount.1.md | 75 + .../source/markdown/podman-unpause.1.md | 103 + .../source/markdown/podman-unshare.1.md | 114 + .../source/markdown/podman-untag.1.md | 46 + .../source/markdown/podman-update.1.md | 562 + .../source/markdown/podman-version.1.md | 60 + .../source/markdown/podman-volume-create.1.md | 213 + .../source/markdown/podman-volume-exists.1.md | 48 + .../source/markdown/podman-volume-export.1.md | 43 + .../source/markdown/podman-volume-import.1.md | 46 + .../markdown/podman-volume-inspect.1.md | 109 + .../source/markdown/podman-volume-ls.1.md | 117 + .../source/markdown/podman-volume-mount.1.md | 41 + .../source/markdown/podman-volume-prune.1.md | 77 + .../source/markdown/podman-volume-reload.1.md | 35 + .../source/markdown/podman-volume-rm.1.md | 70 + .../markdown/podman-volume-unmount.1.md | 37 + .../source/markdown/podman-volume.1.md | 37 + .../source/markdown/podman-wait.1.md | 103 + .../version-5.5.2/source/markdown/podman.1.md | 491 + .../source/markdown/podmansh.1.md | 138 + .../version-5.5.2/tutorials/README.md | 46 + .../tutorials/basic_networking.md | 336 + .../version-5.5.2/tutorials/image_signing.md | 199 + .../version-5.5.2/tutorials/mac_client.md | 7 + .../version-5.5.2/tutorials/mac_win_client.md | 120 + .../version-5.5.2/tutorials/performance.md | 249 + .../tutorials/podman-derivative-api.md | 60 + .../tutorials/podman-for-windows.md | 426 + .../podman-install-certificate-authority.md | 114 + .../tutorials/podman_tutorial.md | 149 + .../tutorials/podman_tutorial_cn.md | 175 + .../tutorials/qemu-remote-tutorial.md | 137 + .../version-5.5.2/tutorials/remote_client.md | 124 + .../tutorials/rootless_tutorial.md | 221 + .../tutorials/socket_activation.md | 289 + .../version-5.4.1-sidebars.json | 45 + .../version-5.4.2-sidebars.json | 45 + .../version-5.5.0-sidebars.json | 45 + .../version-5.5.1-sidebars.json | 45 + .../version-5.5.2-sidebars.json | 45 + versions.json | 7 + yarn.lock | 11515 +++++---- 2328 files changed, 240388 insertions(+), 6135 deletions(-) create mode 100644 .github/workflows/sync-podman-docs.yml delete mode 100644 docs/checkpoint.md delete mode 100644 docs/documentation.md delete mode 100644 docs/index.md delete mode 100644 docs/installation.md create mode 100644 package-lock.json create mode 100644 podman-versions.json create mode 100644 scripts/fix-markdown-directives.js create mode 100755 scripts/sync-podman-docs.js create mode 100644 sidebars-podman.js create mode 100644 src/css/docs-version-selector.css create mode 100644 static/js/docs-version-selector.js create mode 100644 versioned_docs/version-5.4.1/MANPAGE_SYNTAX.md create mode 100644 versioned_docs/version-5.4.1/index.md create mode 100644 versioned_docs/version-5.4.1/kubernetes_support.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/README.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/add-host.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/annotation.container.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/annotation.image.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/annotation.manifest.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/arch.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/attach.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/authfile.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/blkio-weight-device.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/blkio-weight.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/build-arg-file.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/build-arg.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/build-context.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cache-from.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cache-to.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cache-ttl.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cap-add.image.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cap-add.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cap-drop.image.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cap-drop.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cert-dir.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cgroup-conf.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cgroup-parent.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cgroupns.image.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cgroupns.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cgroups.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/chrootdirs.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cidfile.read.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cidfile.write.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/color.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/compat-auth-file.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/compat-volumes.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/compression-format.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/compression-level.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/conmon-pidfile.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cpp-flag.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cpu-period.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cpu-quota.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cpu-rt-period.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cpu-rt-runtime.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cpu-shares.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cpus.container.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cpuset-cpus.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/cpuset-mems.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/creds.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/decryption-key.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/destroy.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/detach-keys.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/device-cgroup-rule.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/device-read-bps.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/device-read-iops.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/device-write-bps.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/device-write-iops.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/device.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/digestfile.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/dir-compress.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/disable-compression.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/disable-content-trust.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/dns-option.container.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/dns-option.image.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/dns-search.container.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/dns-search.image.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/dns.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/entrypoint.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/env-file.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/env-host.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/env-merge.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/env.image.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/env.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/expose.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/farm.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/features.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/file.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/follow.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/force-compression.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/force-rm.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/format.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/from.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/gidmap.container.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/gidmap.pod.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/gpus.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/group-add.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/group-entry.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/health-cmd.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/health-interval.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/health-log-destination.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/health-max-log-count.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/health-max-log-size.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/health-on-failure.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/health-retries.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/health-start-period.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/health-startup-cmd.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/health-startup-interval.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/health-startup-retries.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/health-startup-success.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/health-startup-timeout.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/health-timeout.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/help.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/hooks-dir.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/hostname.container.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/hostname.pod.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/hosts-file.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/hostuser.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/http-proxy.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/identity-label.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/ignore.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/ignorefile.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/iidfile.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/image-volume.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/infra-command.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/infra-conmon-pidfile.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/infra-name.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/init-path.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/init.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/interactive.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/ip.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/ip6.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/ipc.image.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/ipc.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/isolation.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/jobs.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/label-file.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/label.image.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/label.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/latest.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/layer-label.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/layers.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/link-local-ip.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/log-driver.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/log-opt.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/logfile.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/mac-address.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/manifest.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/memory-reservation.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/memory-swap.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/memory-swappiness.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/memory.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/mount.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/name.container.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/names.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/network-alias.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/network.image.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/network.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/no-cache.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/no-healthcheck.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/no-hostname.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/no-hosts.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/no-reset.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/no-stream.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/no-trunc.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/noheading.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/omit-history.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/oom-kill-disable.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/oom-score-adj.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/os-feature.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/os-version.image.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/os-version.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/os.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/os.pull.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/passwd-entry.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/personality.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/pid.container.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/pid.image.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/pid.pod.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/pidfile.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/pids-limit.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/platform.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/pod-id-file.container.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/pod-id-file.pod.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/pod.run.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/preserve-fd.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/preserve-fds.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/privileged.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/publish-all.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/publish.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/pull.image.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/pull.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/quiet.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/rdt-class.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/read-only-tmpfs.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/read-only.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/replace.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/requires.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/restart.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/retry-delay.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/retry.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/rm.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/rootfs.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/runtime-flag.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/runtime.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/sbom-image-output.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/sbom-image-purl-output.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/sbom-merge-strategy.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/sbom-output.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/sbom-purl-output.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/sbom-scanner-command.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/sbom-scanner-image.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/sbom.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/sdnotify.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/seccomp-policy.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/secret.image.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/secret.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/security-opt.image.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/security-opt.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/shm-size-systemd.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/shm-size.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/sig-proxy.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/sign-by-sigstore.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/sign-passphrase-file.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/signal.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/since.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/skip-unused-stages.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/squash-all.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/squash.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/ssh.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/stop-signal.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/stop-timeout.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/subgidname.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/subuidname.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/sysctl.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/systemd.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/tag.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/tail.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/target.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/time.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/timeout.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/timestamp.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/timestamps.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/tls-verify.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/tmpfs.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/tty.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/tz.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/uidmap.container.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/uidmap.pod.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/ulimit.image.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/ulimit.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/umask.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/unsetenv-all.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/unsetenv.image.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/unsetenv.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/unsetlabel.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/until.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/user-mode-networking.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/user.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/userns-gid-map-group.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/userns-gid-map.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/userns-uid-map-user.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/userns-uid-map.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/userns.container.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/userns.image.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/userns.pod.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/uts.container.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/uts.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/uts.pod.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/variant.container.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/variant.manifest.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/volume.image.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/volume.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/volumes-from.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/options/workdir.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-artifact-add.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-artifact-inspect.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-artifact-ls.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-artifact-pull.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-artifact-push.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-artifact-rm.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-artifact.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-attach.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-auto-update.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-build.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-commit.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-completion.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-compose.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-container-checkpoint.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-container-cleanup.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-container-clone.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-container-diff.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-container-exists.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-container-inspect.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-container-prune.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-container-restore.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-container-runlabel.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-container.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-cp.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-create.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-diff.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-events.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-exec.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-export.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-farm-build.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-farm-create.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-farm-list.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-farm-remove.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-farm-update.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-farm.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-generate-spec.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-generate-systemd.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-generate.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-healthcheck-run.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-healthcheck.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-history.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-image-diff.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-image-exists.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-image-inspect.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-image-mount.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-image-prune.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-image-scp.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-image-sign.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-image-tree.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-image-trust.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-image-unmount.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-image.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-images.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-import.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-info.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-init.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-inspect.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-kill.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-kube-apply.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-kube-down.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-kube-generate.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-kube-play.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-kube.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-load.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-login.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-logout.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-logs.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-machine-info.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-machine-init.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-machine-inspect.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-machine-list.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-machine-os-apply.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-machine-os.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-machine-reset.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-machine-rm.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-machine-set.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-machine-ssh.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-machine-start.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-machine-stop.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-machine.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-manifest-add.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-manifest-annotate.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-manifest-create.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-manifest-exists.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-manifest-inspect.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-manifest-push.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-manifest-remove.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-manifest-rm.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-manifest.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-mount.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-network-connect.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-network-create.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-network-disconnect.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-network-exists.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-network-inspect.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-network-ls.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-network-prune.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-network-reload.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-network-rm.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-network-update.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-network.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-pause.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-pod-clone.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-pod-create.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-pod-exists.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-pod-inspect.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-pod-kill.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-pod-logs.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-pod-pause.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-pod-prune.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-pod-ps.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-pod-restart.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-pod-rm.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-pod-start.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-pod-stats.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-pod-stop.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-pod-top.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-pod-unpause.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-pod.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-port.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-ps.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-pull.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-push.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-remote.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-rename.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-restart.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-rm.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-rmi.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-rootless.7.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-run.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-save.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-search.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-secret-create.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-secret-exists.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-secret-inspect.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-secret-ls.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-secret-rm.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-secret.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-start.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-stats.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-stop.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-system-check.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-system-connection-add.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-system-connection-default.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-system-connection-list.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-system-connection-remove.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-system-connection-rename.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-system-connection.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-system-df.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-system-migrate.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-system-prune.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-system-renumber.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-system-reset.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-system-service.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-system.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-systemd.unit.5.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-tag.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-top.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-troubleshooting.7.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-unmount.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-unpause.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-unshare.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-untag.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-update.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-version.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-volume-create.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-volume-exists.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-volume-export.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-volume-import.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-volume-inspect.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-volume-ls.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-volume-mount.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-volume-prune.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-volume-reload.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-volume-rm.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-volume-unmount.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-volume.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman-wait.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podman.1.md create mode 100644 versioned_docs/version-5.4.1/source/markdown/podmansh.1.md create mode 100644 versioned_docs/version-5.4.1/tutorials/README.md create mode 100644 versioned_docs/version-5.4.1/tutorials/basic_networking.md create mode 100644 versioned_docs/version-5.4.1/tutorials/image_signing.md create mode 100644 versioned_docs/version-5.4.1/tutorials/mac_client.md create mode 100644 versioned_docs/version-5.4.1/tutorials/mac_win_client.md create mode 100644 versioned_docs/version-5.4.1/tutorials/performance.md create mode 100644 versioned_docs/version-5.4.1/tutorials/podman-derivative-api.md create mode 100644 versioned_docs/version-5.4.1/tutorials/podman-for-windows.md create mode 100644 versioned_docs/version-5.4.1/tutorials/podman-install-certificate-authority.md create mode 100644 versioned_docs/version-5.4.1/tutorials/podman_tutorial.md create mode 100644 versioned_docs/version-5.4.1/tutorials/podman_tutorial_cn.md create mode 100644 versioned_docs/version-5.4.1/tutorials/qemu-remote-tutorial.md create mode 100644 versioned_docs/version-5.4.1/tutorials/remote_client.md create mode 100644 versioned_docs/version-5.4.1/tutorials/rootless_tutorial.md create mode 100644 versioned_docs/version-5.4.1/tutorials/socket_activation.md create mode 100644 versioned_docs/version-5.4.2/MANPAGE_SYNTAX.md create mode 100644 versioned_docs/version-5.4.2/index.md create mode 100644 versioned_docs/version-5.4.2/kubernetes_support.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/README.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/add-host.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/annotation.container.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/annotation.image.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/annotation.manifest.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/arch.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/attach.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/authfile.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/blkio-weight-device.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/blkio-weight.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/build-arg-file.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/build-arg.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/build-context.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cache-from.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cache-to.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cache-ttl.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cap-add.image.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cap-add.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cap-drop.image.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cap-drop.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cert-dir.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cgroup-conf.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cgroup-parent.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cgroupns.image.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cgroupns.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cgroups.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/chrootdirs.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cidfile.read.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cidfile.write.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/color.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/compat-auth-file.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/compat-volumes.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/compression-format.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/compression-level.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/conmon-pidfile.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cpp-flag.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cpu-period.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cpu-quota.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cpu-rt-period.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cpu-rt-runtime.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cpu-shares.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cpus.container.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cpuset-cpus.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/cpuset-mems.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/creds.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/decryption-key.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/destroy.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/detach-keys.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/device-cgroup-rule.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/device-read-bps.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/device-read-iops.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/device-write-bps.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/device-write-iops.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/device.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/digestfile.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/dir-compress.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/disable-compression.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/disable-content-trust.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/dns-option.container.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/dns-option.image.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/dns-search.container.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/dns-search.image.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/dns.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/entrypoint.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/env-file.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/env-host.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/env-merge.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/env.image.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/env.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/expose.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/farm.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/features.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/file.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/follow.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/force-compression.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/force-rm.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/format.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/from.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/gidmap.container.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/gidmap.pod.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/gpus.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/group-add.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/group-entry.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/health-cmd.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/health-interval.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/health-log-destination.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/health-max-log-count.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/health-max-log-size.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/health-on-failure.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/health-retries.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/health-start-period.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/health-startup-cmd.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/health-startup-interval.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/health-startup-retries.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/health-startup-success.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/health-startup-timeout.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/health-timeout.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/help.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/hooks-dir.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/hostname.container.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/hostname.pod.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/hosts-file.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/hostuser.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/http-proxy.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/identity-label.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/ignore.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/ignorefile.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/iidfile.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/image-volume.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/infra-command.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/infra-conmon-pidfile.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/infra-name.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/init-path.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/init.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/interactive.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/ip.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/ip6.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/ipc.image.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/ipc.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/isolation.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/jobs.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/label-file.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/label.image.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/label.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/latest.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/layer-label.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/layers.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/link-local-ip.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/log-driver.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/log-opt.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/logfile.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/mac-address.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/manifest.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/memory-reservation.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/memory-swap.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/memory-swappiness.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/memory.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/mount.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/name.container.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/names.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/network-alias.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/network.image.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/network.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/no-cache.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/no-healthcheck.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/no-hostname.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/no-hosts.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/no-reset.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/no-stream.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/no-trunc.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/noheading.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/omit-history.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/oom-kill-disable.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/oom-score-adj.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/os-feature.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/os-version.image.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/os-version.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/os.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/os.pull.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/passwd-entry.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/personality.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/pid.container.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/pid.image.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/pid.pod.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/pidfile.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/pids-limit.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/platform.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/pod-id-file.container.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/pod-id-file.pod.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/pod.run.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/preserve-fd.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/preserve-fds.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/privileged.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/publish-all.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/publish.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/pull.image.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/pull.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/quiet.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/rdt-class.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/read-only-tmpfs.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/read-only.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/replace.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/requires.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/restart.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/retry-delay.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/retry.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/rm.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/rootfs.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/runtime-flag.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/runtime.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/sbom-image-output.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/sbom-image-purl-output.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/sbom-merge-strategy.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/sbom-output.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/sbom-purl-output.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/sbom-scanner-command.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/sbom-scanner-image.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/sbom.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/sdnotify.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/seccomp-policy.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/secret.image.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/secret.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/security-opt.image.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/security-opt.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/shm-size-systemd.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/shm-size.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/sig-proxy.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/sign-by-sigstore.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/sign-passphrase-file.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/signal.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/since.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/skip-unused-stages.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/squash-all.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/squash.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/ssh.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/stop-signal.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/stop-timeout.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/subgidname.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/subuidname.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/sysctl.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/systemd.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/tag.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/tail.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/target.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/time.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/timeout.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/timestamp.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/timestamps.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/tls-verify.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/tmpfs.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/tty.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/tz.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/uidmap.container.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/uidmap.pod.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/ulimit.image.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/ulimit.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/umask.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/unsetenv-all.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/unsetenv.image.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/unsetenv.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/unsetlabel.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/until.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/user-mode-networking.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/user.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/userns-gid-map-group.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/userns-gid-map.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/userns-uid-map-user.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/userns-uid-map.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/userns.container.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/userns.image.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/userns.pod.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/uts.container.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/uts.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/uts.pod.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/variant.container.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/variant.manifest.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/volume.image.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/volume.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/volumes-from.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/options/workdir.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-artifact-add.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-artifact-inspect.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-artifact-ls.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-artifact-pull.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-artifact-push.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-artifact-rm.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-artifact.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-attach.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-auto-update.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-build.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-commit.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-completion.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-compose.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-container-checkpoint.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-container-cleanup.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-container-clone.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-container-diff.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-container-exists.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-container-inspect.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-container-prune.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-container-restore.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-container-runlabel.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-container.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-cp.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-create.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-diff.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-events.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-exec.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-export.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-farm-build.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-farm-create.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-farm-list.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-farm-remove.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-farm-update.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-farm.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-generate-spec.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-generate-systemd.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-generate.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-healthcheck-run.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-healthcheck.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-history.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-image-diff.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-image-exists.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-image-inspect.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-image-mount.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-image-prune.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-image-scp.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-image-sign.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-image-tree.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-image-trust.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-image-unmount.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-image.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-images.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-import.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-info.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-init.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-inspect.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-kill.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-kube-apply.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-kube-down.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-kube-generate.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-kube-play.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-kube.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-load.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-login.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-logout.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-logs.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-machine-info.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-machine-init.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-machine-inspect.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-machine-list.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-machine-os-apply.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-machine-os.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-machine-reset.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-machine-rm.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-machine-set.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-machine-ssh.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-machine-start.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-machine-stop.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-machine.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-manifest-add.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-manifest-annotate.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-manifest-create.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-manifest-exists.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-manifest-inspect.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-manifest-push.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-manifest-remove.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-manifest-rm.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-manifest.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-mount.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-network-connect.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-network-create.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-network-disconnect.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-network-exists.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-network-inspect.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-network-ls.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-network-prune.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-network-reload.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-network-rm.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-network-update.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-network.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-pause.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-pod-clone.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-pod-create.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-pod-exists.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-pod-inspect.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-pod-kill.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-pod-logs.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-pod-pause.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-pod-prune.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-pod-ps.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-pod-restart.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-pod-rm.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-pod-start.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-pod-stats.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-pod-stop.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-pod-top.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-pod-unpause.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-pod.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-port.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-ps.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-pull.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-push.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-remote.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-rename.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-restart.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-rm.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-rmi.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-rootless.7.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-run.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-save.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-search.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-secret-create.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-secret-exists.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-secret-inspect.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-secret-ls.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-secret-rm.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-secret.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-start.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-stats.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-stop.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-system-check.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-system-connection-add.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-system-connection-default.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-system-connection-list.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-system-connection-remove.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-system-connection-rename.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-system-connection.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-system-df.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-system-migrate.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-system-prune.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-system-renumber.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-system-reset.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-system-service.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-system.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-systemd.unit.5.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-tag.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-top.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-troubleshooting.7.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-unmount.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-unpause.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-unshare.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-untag.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-update.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-version.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-volume-create.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-volume-exists.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-volume-export.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-volume-import.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-volume-inspect.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-volume-ls.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-volume-mount.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-volume-prune.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-volume-reload.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-volume-rm.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-volume-unmount.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-volume.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman-wait.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podman.1.md create mode 100644 versioned_docs/version-5.4.2/source/markdown/podmansh.1.md create mode 100644 versioned_docs/version-5.4.2/tutorials/README.md create mode 100644 versioned_docs/version-5.4.2/tutorials/basic_networking.md create mode 100644 versioned_docs/version-5.4.2/tutorials/image_signing.md create mode 100644 versioned_docs/version-5.4.2/tutorials/mac_client.md create mode 100644 versioned_docs/version-5.4.2/tutorials/mac_win_client.md create mode 100644 versioned_docs/version-5.4.2/tutorials/performance.md create mode 100644 versioned_docs/version-5.4.2/tutorials/podman-derivative-api.md create mode 100644 versioned_docs/version-5.4.2/tutorials/podman-for-windows.md create mode 100644 versioned_docs/version-5.4.2/tutorials/podman-install-certificate-authority.md create mode 100644 versioned_docs/version-5.4.2/tutorials/podman_tutorial.md create mode 100644 versioned_docs/version-5.4.2/tutorials/podman_tutorial_cn.md create mode 100644 versioned_docs/version-5.4.2/tutorials/qemu-remote-tutorial.md create mode 100644 versioned_docs/version-5.4.2/tutorials/remote_client.md create mode 100644 versioned_docs/version-5.4.2/tutorials/rootless_tutorial.md create mode 100644 versioned_docs/version-5.4.2/tutorials/socket_activation.md create mode 100644 versioned_docs/version-5.5.0/MANPAGE_SYNTAX.md create mode 100644 versioned_docs/version-5.5.0/index.md create mode 100644 versioned_docs/version-5.5.0/kubernetes_support.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/README.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/add-host.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/annotation.container.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/annotation.image.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/annotation.manifest.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/arch.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/attach.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/authfile.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/blkio-weight-device.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/blkio-weight.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/build-arg-file.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/build-arg.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/build-context.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cache-from.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cache-to.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cache-ttl.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cap-add.image.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cap-add.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cap-drop.image.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cap-drop.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cert-dir.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cgroup-conf.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cgroup-parent.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cgroupns.image.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cgroupns.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cgroups.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/chrootdirs.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cidfile.read.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cidfile.write.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/color.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/compat-auth-file.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/compat-volumes.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/compression-format.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/compression-level.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/conmon-pidfile.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cpp-flag.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cpu-period.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cpu-quota.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cpu-rt-period.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cpu-rt-runtime.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cpu-shares.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cpus.container.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cpuset-cpus.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/cpuset-mems.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/creds.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/decryption-key.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/destroy.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/detach-keys.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/device-cgroup-rule.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/device-read-bps.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/device-read-iops.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/device-write-bps.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/device-write-iops.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/device.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/digestfile.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/dir-compress.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/disable-compression.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/disable-content-trust.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/dns-option.container.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/dns-option.image.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/dns-search.container.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/dns-search.image.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/dns.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/entrypoint.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/env-file.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/env-host.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/env-merge.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/env.image.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/env.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/env.update.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/expose.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/farm.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/features.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/file.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/follow.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/force-compression.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/force-rm.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/format.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/from.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/gidmap.container.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/gidmap.pod.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/gpus.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/group-add.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/group-entry.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/health-cmd.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/health-interval.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/health-log-destination.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/health-max-log-count.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/health-max-log-size.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/health-on-failure.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/health-retries.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/health-start-period.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/health-startup-cmd.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/health-startup-interval.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/health-startup-retries.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/health-startup-success.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/health-startup-timeout.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/health-timeout.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/help.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/hooks-dir.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/hostname.container.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/hostname.pod.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/hosts-file.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/hostuser.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/http-proxy.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/identity-label.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/ignore.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/ignorefile.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/iidfile.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/image-volume.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/infra-command.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/infra-conmon-pidfile.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/infra-name.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/inherit-labels.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/init-path.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/init.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/interactive.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/ip.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/ip6.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/ipc.image.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/ipc.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/isolation.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/jobs.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/label-file.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/label.image.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/label.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/latest.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/layer-label.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/layers.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/link-local-ip.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/log-driver.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/log-opt.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/logfile.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/mac-address.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/manifest.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/memory-reservation.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/memory-swap.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/memory-swappiness.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/memory.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/mount.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/name.container.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/names.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/network-alias.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/network.image.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/network.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/no-cache.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/no-healthcheck.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/no-hostname.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/no-hosts.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/no-reset.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/no-stream.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/no-trunc.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/noheading.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/omit-history.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/oom-kill-disable.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/oom-score-adj.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/os-feature.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/os-version.image.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/os-version.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/os.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/os.pull.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/passwd-entry.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/personality.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/pid.container.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/pid.image.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/pid.pod.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/pidfile.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/pids-limit.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/platform.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/pod-id-file.container.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/pod-id-file.pod.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/pod.run.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/preserve-fd.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/preserve-fds.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/privileged.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/publish-all.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/publish.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/pull.image.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/pull.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/quiet.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/rdt-class.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/read-only-tmpfs.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/read-only.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/replace.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/requires.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/restart.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/retry-delay.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/retry.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/rm.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/rootfs.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/runtime-flag.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/runtime.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/sbom-image-output.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/sbom-image-purl-output.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/sbom-merge-strategy.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/sbom-output.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/sbom-purl-output.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/sbom-scanner-command.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/sbom-scanner-image.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/sbom.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/sdnotify.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/seccomp-policy.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/secret.image.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/secret.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/security-opt.image.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/security-opt.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/shm-size-systemd.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/shm-size.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/sig-proxy.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/sign-by-sigstore.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/sign-passphrase-file.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/signal.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/since.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/skip-unused-stages.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/squash-all.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/squash.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/ssh.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/stop-signal.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/stop-timeout.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/subgidname.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/subuidname.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/sysctl.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/systemd.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/tag.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/tail.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/target.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/time.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/timeout.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/timestamp.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/timestamps.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/tls-verify.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/tmpfs.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/tty.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/tz.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/uidmap.container.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/uidmap.pod.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/ulimit.image.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/ulimit.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/umask.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/unsetenv-all.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/unsetenv.image.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/unsetenv.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/unsetenv.update.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/unsetlabel.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/until.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/user-mode-networking.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/user.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/userns-gid-map-group.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/userns-gid-map.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/userns-uid-map-user.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/userns-uid-map.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/userns.container.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/userns.image.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/userns.pod.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/uts.container.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/uts.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/uts.pod.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/variant.container.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/variant.manifest.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/volume.image.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/volume.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/volumes-from.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/options/workdir.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-artifact-add.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-artifact-extract.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-artifact-inspect.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-artifact-ls.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-artifact-pull.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-artifact-push.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-artifact-rm.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-artifact.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-attach.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-auto-update.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-build.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-commit.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-completion.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-compose.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-container-checkpoint.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-container-cleanup.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-container-clone.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-container-diff.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-container-exists.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-container-inspect.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-container-prune.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-container-restore.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-container-runlabel.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-container.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-cp.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-create.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-diff.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-events.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-exec.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-export.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-farm-build.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-farm-create.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-farm-list.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-farm-remove.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-farm-update.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-farm.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-generate-spec.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-generate-systemd.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-generate.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-healthcheck-run.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-healthcheck.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-history.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-image-diff.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-image-exists.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-image-inspect.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-image-mount.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-image-prune.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-image-scp.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-image-sign.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-image-tree.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-image-trust.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-image-unmount.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-image.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-images.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-import.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-info.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-init.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-inspect.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-kill.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-kube-apply.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-kube-down.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-kube-generate.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-kube-play.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-kube.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-load.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-login.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-logout.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-logs.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-machine-cp.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-machine-info.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-machine-init.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-machine-inspect.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-machine-list.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-machine-os-apply.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-machine-os.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-machine-reset.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-machine-rm.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-machine-set.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-machine-ssh.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-machine-start.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-machine-stop.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-machine.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-manifest-add.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-manifest-annotate.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-manifest-create.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-manifest-exists.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-manifest-inspect.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-manifest-push.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-manifest-remove.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-manifest-rm.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-manifest.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-mount.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-network-connect.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-network-create.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-network-disconnect.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-network-exists.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-network-inspect.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-network-ls.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-network-prune.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-network-reload.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-network-rm.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-network-update.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-network.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-pause.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-pod-clone.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-pod-create.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-pod-exists.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-pod-inspect.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-pod-kill.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-pod-logs.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-pod-pause.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-pod-prune.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-pod-ps.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-pod-restart.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-pod-rm.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-pod-start.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-pod-stats.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-pod-stop.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-pod-top.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-pod-unpause.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-pod.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-port.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-ps.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-pull.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-push.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-remote.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-rename.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-restart.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-rm.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-rmi.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-rootless.7.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-run.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-save.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-search.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-secret-create.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-secret-exists.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-secret-inspect.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-secret-ls.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-secret-rm.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-secret.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-start.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-stats.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-stop.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-system-check.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-system-connection-add.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-system-connection-default.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-system-connection-list.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-system-connection-remove.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-system-connection-rename.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-system-connection.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-system-df.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-system-migrate.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-system-prune.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-system-renumber.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-system-reset.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-system-service.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-system.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-systemd.unit.5.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-tag.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-top.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-troubleshooting.7.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-unmount.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-unpause.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-unshare.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-untag.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-update.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-version.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-volume-create.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-volume-exists.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-volume-export.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-volume-import.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-volume-inspect.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-volume-ls.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-volume-mount.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-volume-prune.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-volume-reload.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-volume-rm.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-volume-unmount.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-volume.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman-wait.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podman.1.md create mode 100644 versioned_docs/version-5.5.0/source/markdown/podmansh.1.md create mode 100644 versioned_docs/version-5.5.0/tutorials/README.md create mode 100644 versioned_docs/version-5.5.0/tutorials/basic_networking.md create mode 100644 versioned_docs/version-5.5.0/tutorials/image_signing.md create mode 100644 versioned_docs/version-5.5.0/tutorials/mac_client.md create mode 100644 versioned_docs/version-5.5.0/tutorials/mac_win_client.md create mode 100644 versioned_docs/version-5.5.0/tutorials/performance.md create mode 100644 versioned_docs/version-5.5.0/tutorials/podman-derivative-api.md create mode 100644 versioned_docs/version-5.5.0/tutorials/podman-for-windows.md create mode 100644 versioned_docs/version-5.5.0/tutorials/podman-install-certificate-authority.md create mode 100644 versioned_docs/version-5.5.0/tutorials/podman_tutorial.md create mode 100644 versioned_docs/version-5.5.0/tutorials/podman_tutorial_cn.md create mode 100644 versioned_docs/version-5.5.0/tutorials/qemu-remote-tutorial.md create mode 100644 versioned_docs/version-5.5.0/tutorials/remote_client.md create mode 100644 versioned_docs/version-5.5.0/tutorials/rootless_tutorial.md create mode 100644 versioned_docs/version-5.5.0/tutorials/socket_activation.md create mode 100644 versioned_docs/version-5.5.1/MANPAGE_SYNTAX.md create mode 100644 versioned_docs/version-5.5.1/index.md create mode 100644 versioned_docs/version-5.5.1/kubernetes_support.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/README.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/add-host.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/annotation.container.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/annotation.image.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/annotation.manifest.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/arch.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/attach.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/authfile.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/blkio-weight-device.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/blkio-weight.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/build-arg-file.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/build-arg.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/build-context.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cache-from.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cache-to.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cache-ttl.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cap-add.image.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cap-add.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cap-drop.image.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cap-drop.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cert-dir.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cgroup-conf.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cgroup-parent.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cgroupns.image.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cgroupns.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cgroups.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/chrootdirs.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cidfile.read.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cidfile.write.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/color.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/compat-auth-file.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/compat-volumes.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/compression-format.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/compression-level.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/conmon-pidfile.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cpp-flag.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cpu-period.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cpu-quota.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cpu-rt-period.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cpu-rt-runtime.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cpu-shares.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cpus.container.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cpuset-cpus.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/cpuset-mems.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/creds.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/decryption-key.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/destroy.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/detach-keys.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/device-cgroup-rule.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/device-read-bps.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/device-read-iops.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/device-write-bps.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/device-write-iops.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/device.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/digestfile.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/dir-compress.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/disable-compression.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/disable-content-trust.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/dns-option.container.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/dns-option.image.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/dns-search.container.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/dns-search.image.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/dns.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/entrypoint.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/env-file.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/env-host.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/env-merge.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/env.image.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/env.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/env.update.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/expose.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/farm.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/features.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/file.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/follow.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/force-compression.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/force-rm.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/format.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/from.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/gidmap.container.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/gidmap.pod.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/gpus.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/group-add.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/group-entry.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/health-cmd.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/health-interval.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/health-log-destination.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/health-max-log-count.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/health-max-log-size.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/health-on-failure.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/health-retries.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/health-start-period.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/health-startup-cmd.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/health-startup-interval.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/health-startup-retries.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/health-startup-success.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/health-startup-timeout.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/health-timeout.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/help.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/hooks-dir.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/hostname.container.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/hostname.pod.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/hosts-file.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/hostuser.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/http-proxy.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/identity-label.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/ignore.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/ignorefile.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/iidfile.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/image-volume.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/infra-command.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/infra-conmon-pidfile.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/infra-name.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/inherit-labels.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/init-path.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/init.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/interactive.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/ip.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/ip6.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/ipc.image.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/ipc.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/isolation.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/jobs.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/label-file.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/label.image.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/label.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/latest.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/layer-label.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/layers.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/link-local-ip.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/log-driver.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/log-opt.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/logfile.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/mac-address.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/manifest.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/memory-reservation.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/memory-swap.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/memory-swappiness.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/memory.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/mount.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/name.container.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/names.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/network-alias.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/network.image.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/network.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/no-cache.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/no-healthcheck.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/no-hostname.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/no-hosts.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/no-reset.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/no-stream.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/no-trunc.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/noheading.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/omit-history.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/oom-kill-disable.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/oom-score-adj.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/os-feature.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/os-version.image.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/os-version.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/os.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/os.pull.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/passwd-entry.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/personality.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/pid.container.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/pid.image.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/pid.pod.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/pidfile.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/pids-limit.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/platform.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/pod-id-file.container.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/pod-id-file.pod.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/pod.run.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/preserve-fd.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/preserve-fds.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/privileged.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/publish-all.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/publish.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/pull.image.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/pull.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/quiet.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/rdt-class.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/read-only-tmpfs.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/read-only.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/replace.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/requires.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/restart.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/retry-delay.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/retry.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/rm.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/rootfs.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/runtime-flag.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/runtime.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/sbom-image-output.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/sbom-image-purl-output.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/sbom-merge-strategy.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/sbom-output.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/sbom-purl-output.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/sbom-scanner-command.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/sbom-scanner-image.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/sbom.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/sdnotify.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/seccomp-policy.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/secret.image.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/secret.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/security-opt.image.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/security-opt.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/shm-size-systemd.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/shm-size.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/sig-proxy.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/sign-by-sigstore.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/sign-passphrase-file.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/signal.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/since.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/skip-unused-stages.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/squash-all.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/squash.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/ssh.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/stop-signal.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/stop-timeout.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/subgidname.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/subuidname.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/sysctl.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/systemd.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/tag.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/tail.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/target.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/time.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/timeout.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/timestamp.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/timestamps.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/tls-verify.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/tmpfs.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/tty.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/tz.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/uidmap.container.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/uidmap.pod.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/ulimit.image.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/ulimit.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/umask.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/unsetenv-all.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/unsetenv.image.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/unsetenv.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/unsetenv.update.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/unsetlabel.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/until.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/user-mode-networking.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/user.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/userns-gid-map-group.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/userns-gid-map.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/userns-uid-map-user.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/userns-uid-map.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/userns.container.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/userns.image.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/userns.pod.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/uts.container.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/uts.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/uts.pod.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/variant.container.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/variant.manifest.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/volume.image.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/volume.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/volumes-from.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/options/workdir.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-artifact-add.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-artifact-extract.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-artifact-inspect.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-artifact-ls.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-artifact-pull.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-artifact-push.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-artifact-rm.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-artifact.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-attach.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-auto-update.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-build.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-commit.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-completion.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-compose.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-container-checkpoint.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-container-cleanup.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-container-clone.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-container-diff.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-container-exists.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-container-inspect.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-container-prune.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-container-restore.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-container-runlabel.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-container.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-cp.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-create.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-diff.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-events.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-exec.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-export.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-farm-build.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-farm-create.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-farm-list.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-farm-remove.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-farm-update.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-farm.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-generate-spec.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-generate-systemd.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-generate.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-healthcheck-run.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-healthcheck.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-history.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-image-diff.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-image-exists.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-image-inspect.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-image-mount.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-image-prune.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-image-scp.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-image-sign.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-image-tree.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-image-trust.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-image-unmount.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-image.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-images.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-import.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-info.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-init.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-inspect.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-kill.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-kube-apply.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-kube-down.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-kube-generate.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-kube-play.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-kube.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-load.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-login.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-logout.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-logs.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-machine-cp.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-machine-info.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-machine-init.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-machine-inspect.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-machine-list.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-machine-os-apply.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-machine-os.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-machine-reset.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-machine-rm.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-machine-set.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-machine-ssh.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-machine-start.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-machine-stop.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-machine.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-manifest-add.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-manifest-annotate.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-manifest-create.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-manifest-exists.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-manifest-inspect.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-manifest-push.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-manifest-remove.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-manifest-rm.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-manifest.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-mount.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-network-connect.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-network-create.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-network-disconnect.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-network-exists.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-network-inspect.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-network-ls.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-network-prune.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-network-reload.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-network-rm.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-network-update.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-network.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-pause.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-pod-clone.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-pod-create.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-pod-exists.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-pod-inspect.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-pod-kill.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-pod-logs.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-pod-pause.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-pod-prune.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-pod-ps.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-pod-restart.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-pod-rm.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-pod-start.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-pod-stats.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-pod-stop.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-pod-top.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-pod-unpause.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-pod.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-port.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-ps.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-pull.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-push.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-remote.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-rename.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-restart.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-rm.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-rmi.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-rootless.7.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-run.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-save.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-search.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-secret-create.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-secret-exists.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-secret-inspect.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-secret-ls.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-secret-rm.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-secret.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-start.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-stats.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-stop.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-system-check.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-system-connection-add.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-system-connection-default.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-system-connection-list.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-system-connection-remove.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-system-connection-rename.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-system-connection.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-system-df.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-system-migrate.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-system-prune.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-system-renumber.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-system-reset.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-system-service.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-system.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-systemd.unit.5.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-tag.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-top.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-troubleshooting.7.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-unmount.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-unpause.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-unshare.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-untag.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-update.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-version.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-volume-create.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-volume-exists.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-volume-export.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-volume-import.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-volume-inspect.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-volume-ls.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-volume-mount.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-volume-prune.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-volume-reload.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-volume-rm.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-volume-unmount.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-volume.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman-wait.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podman.1.md create mode 100644 versioned_docs/version-5.5.1/source/markdown/podmansh.1.md create mode 100644 versioned_docs/version-5.5.1/tutorials/README.md create mode 100644 versioned_docs/version-5.5.1/tutorials/basic_networking.md create mode 100644 versioned_docs/version-5.5.1/tutorials/image_signing.md create mode 100644 versioned_docs/version-5.5.1/tutorials/mac_client.md create mode 100644 versioned_docs/version-5.5.1/tutorials/mac_win_client.md create mode 100644 versioned_docs/version-5.5.1/tutorials/performance.md create mode 100644 versioned_docs/version-5.5.1/tutorials/podman-derivative-api.md create mode 100644 versioned_docs/version-5.5.1/tutorials/podman-for-windows.md create mode 100644 versioned_docs/version-5.5.1/tutorials/podman-install-certificate-authority.md create mode 100644 versioned_docs/version-5.5.1/tutorials/podman_tutorial.md create mode 100644 versioned_docs/version-5.5.1/tutorials/podman_tutorial_cn.md create mode 100644 versioned_docs/version-5.5.1/tutorials/qemu-remote-tutorial.md create mode 100644 versioned_docs/version-5.5.1/tutorials/remote_client.md create mode 100644 versioned_docs/version-5.5.1/tutorials/rootless_tutorial.md create mode 100644 versioned_docs/version-5.5.1/tutorials/socket_activation.md create mode 100644 versioned_docs/version-5.5.2/MANPAGE_SYNTAX.md create mode 100644 versioned_docs/version-5.5.2/index.md create mode 100644 versioned_docs/version-5.5.2/kubernetes_support.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/README.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/add-host.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/annotation.container.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/annotation.image.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/annotation.manifest.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/arch.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/attach.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/authfile.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/blkio-weight-device.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/blkio-weight.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/build-arg-file.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/build-arg.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/build-context.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cache-from.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cache-to.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cache-ttl.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cap-add.image.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cap-add.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cap-drop.image.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cap-drop.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cert-dir.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cgroup-conf.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cgroup-parent.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cgroupns.image.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cgroupns.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cgroups.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/chrootdirs.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cidfile.read.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cidfile.write.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/color.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/compat-auth-file.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/compat-volumes.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/compression-format.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/compression-level.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/conmon-pidfile.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cpp-flag.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cpu-period.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cpu-quota.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cpu-rt-period.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cpu-rt-runtime.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cpu-shares.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cpus.container.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cpuset-cpus.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/cpuset-mems.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/creds.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/decryption-key.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/destroy.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/detach-keys.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/device-cgroup-rule.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/device-read-bps.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/device-read-iops.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/device-write-bps.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/device-write-iops.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/device.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/digestfile.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/dir-compress.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/disable-compression.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/disable-content-trust.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/dns-option.container.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/dns-option.image.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/dns-search.container.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/dns-search.image.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/dns.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/entrypoint.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/env-file.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/env-host.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/env-merge.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/env.image.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/env.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/env.update.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/expose.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/farm.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/features.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/file.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/follow.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/force-compression.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/force-rm.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/format.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/from.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/gidmap.container.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/gidmap.pod.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/gpus.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/group-add.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/group-entry.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/health-cmd.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/health-interval.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/health-log-destination.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/health-max-log-count.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/health-max-log-size.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/health-on-failure.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/health-retries.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/health-start-period.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/health-startup-cmd.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/health-startup-interval.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/health-startup-retries.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/health-startup-success.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/health-startup-timeout.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/health-timeout.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/help.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/hooks-dir.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/hostname.container.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/hostname.pod.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/hosts-file.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/hostuser.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/http-proxy.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/identity-label.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/ignore.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/ignorefile.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/iidfile.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/image-volume.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/infra-command.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/infra-conmon-pidfile.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/infra-name.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/inherit-labels.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/init-path.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/init.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/interactive.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/ip.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/ip6.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/ipc.image.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/ipc.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/isolation.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/jobs.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/label-file.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/label.image.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/label.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/latest.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/layer-label.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/layers.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/link-local-ip.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/log-driver.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/log-opt.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/logfile.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/mac-address.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/manifest.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/memory-reservation.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/memory-swap.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/memory-swappiness.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/memory.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/mount.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/name.container.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/names.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/network-alias.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/network.image.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/network.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/no-cache.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/no-healthcheck.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/no-hostname.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/no-hosts.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/no-reset.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/no-stream.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/no-trunc.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/noheading.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/omit-history.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/oom-kill-disable.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/oom-score-adj.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/os-feature.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/os-version.image.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/os-version.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/os.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/os.pull.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/passwd-entry.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/personality.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/pid.container.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/pid.image.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/pid.pod.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/pidfile.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/pids-limit.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/platform.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/pod-id-file.container.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/pod-id-file.pod.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/pod.run.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/preserve-fd.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/preserve-fds.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/privileged.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/publish-all.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/publish.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/pull.image.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/pull.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/quiet.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/rdt-class.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/read-only-tmpfs.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/read-only.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/replace.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/requires.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/restart.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/retry-delay.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/retry.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/rm.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/rootfs.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/runtime-flag.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/runtime.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/sbom-image-output.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/sbom-image-purl-output.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/sbom-merge-strategy.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/sbom-output.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/sbom-purl-output.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/sbom-scanner-command.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/sbom-scanner-image.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/sbom.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/sdnotify.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/seccomp-policy.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/secret.image.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/secret.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/security-opt.image.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/security-opt.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/shm-size-systemd.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/shm-size.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/sig-proxy.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/sign-by-sigstore.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/sign-passphrase-file.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/signal.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/since.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/skip-unused-stages.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/squash-all.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/squash.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/ssh.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/stop-signal.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/stop-timeout.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/subgidname.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/subuidname.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/sysctl.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/systemd.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/tag.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/tail.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/target.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/time.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/timeout.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/timestamp.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/timestamps.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/tls-verify.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/tmpfs.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/tty.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/tz.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/uidmap.container.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/uidmap.pod.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/ulimit.image.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/ulimit.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/umask.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/unsetenv-all.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/unsetenv.image.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/unsetenv.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/unsetenv.update.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/unsetlabel.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/until.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/user-mode-networking.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/user.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/userns-gid-map-group.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/userns-gid-map.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/userns-uid-map-user.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/userns-uid-map.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/userns.container.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/userns.image.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/userns.pod.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/uts.container.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/uts.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/uts.pod.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/variant.container.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/variant.manifest.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/volume.image.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/volume.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/volumes-from.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/options/workdir.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-artifact-add.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-artifact-extract.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-artifact-inspect.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-artifact-ls.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-artifact-pull.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-artifact-push.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-artifact-rm.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-artifact.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-attach.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-auto-update.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-build.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-commit.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-completion.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-compose.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-container-checkpoint.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-container-cleanup.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-container-clone.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-container-diff.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-container-exists.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-container-inspect.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-container-prune.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-container-restore.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-container-runlabel.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-container.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-cp.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-create.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-diff.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-events.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-exec.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-export.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-farm-build.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-farm-create.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-farm-list.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-farm-remove.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-farm-update.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-farm.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-generate-spec.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-generate-systemd.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-generate.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-healthcheck-run.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-healthcheck.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-history.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-image-diff.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-image-exists.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-image-inspect.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-image-mount.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-image-prune.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-image-scp.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-image-sign.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-image-tree.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-image-trust.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-image-unmount.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-image.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-images.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-import.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-info.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-init.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-inspect.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-kill.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-kube-apply.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-kube-down.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-kube-generate.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-kube-play.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-kube.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-load.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-login.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-logout.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-logs.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-machine-cp.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-machine-info.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-machine-init.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-machine-inspect.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-machine-list.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-machine-os-apply.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-machine-os.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-machine-reset.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-machine-rm.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-machine-set.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-machine-ssh.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-machine-start.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-machine-stop.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-machine.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-manifest-add.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-manifest-annotate.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-manifest-create.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-manifest-exists.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-manifest-inspect.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-manifest-push.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-manifest-remove.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-manifest-rm.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-manifest.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-mount.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-network-connect.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-network-create.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-network-disconnect.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-network-exists.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-network-inspect.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-network-ls.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-network-prune.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-network-reload.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-network-rm.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-network-update.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-network.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-pause.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-pod-clone.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-pod-create.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-pod-exists.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-pod-inspect.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-pod-kill.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-pod-logs.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-pod-pause.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-pod-prune.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-pod-ps.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-pod-restart.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-pod-rm.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-pod-start.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-pod-stats.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-pod-stop.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-pod-top.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-pod-unpause.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-pod.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-port.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-ps.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-pull.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-push.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-remote.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-rename.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-restart.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-rm.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-rmi.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-rootless.7.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-run.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-save.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-search.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-secret-create.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-secret-exists.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-secret-inspect.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-secret-ls.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-secret-rm.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-secret.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-start.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-stats.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-stop.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-system-check.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-system-connection-add.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-system-connection-default.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-system-connection-list.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-system-connection-remove.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-system-connection-rename.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-system-connection.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-system-df.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-system-migrate.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-system-prune.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-system-renumber.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-system-reset.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-system-service.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-system.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-systemd.unit.5.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-tag.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-top.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-troubleshooting.7.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-unmount.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-unpause.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-unshare.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-untag.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-update.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-version.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-volume-create.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-volume-exists.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-volume-export.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-volume-import.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-volume-inspect.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-volume-ls.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-volume-mount.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-volume-prune.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-volume-reload.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-volume-rm.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-volume-unmount.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-volume.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman-wait.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podman.1.md create mode 100644 versioned_docs/version-5.5.2/source/markdown/podmansh.1.md create mode 100644 versioned_docs/version-5.5.2/tutorials/README.md create mode 100644 versioned_docs/version-5.5.2/tutorials/basic_networking.md create mode 100644 versioned_docs/version-5.5.2/tutorials/image_signing.md create mode 100644 versioned_docs/version-5.5.2/tutorials/mac_client.md create mode 100644 versioned_docs/version-5.5.2/tutorials/mac_win_client.md create mode 100644 versioned_docs/version-5.5.2/tutorials/performance.md create mode 100644 versioned_docs/version-5.5.2/tutorials/podman-derivative-api.md create mode 100644 versioned_docs/version-5.5.2/tutorials/podman-for-windows.md create mode 100644 versioned_docs/version-5.5.2/tutorials/podman-install-certificate-authority.md create mode 100644 versioned_docs/version-5.5.2/tutorials/podman_tutorial.md create mode 100644 versioned_docs/version-5.5.2/tutorials/podman_tutorial_cn.md create mode 100644 versioned_docs/version-5.5.2/tutorials/qemu-remote-tutorial.md create mode 100644 versioned_docs/version-5.5.2/tutorials/remote_client.md create mode 100644 versioned_docs/version-5.5.2/tutorials/rootless_tutorial.md create mode 100644 versioned_docs/version-5.5.2/tutorials/socket_activation.md create mode 100644 versioned_sidebars/version-5.4.1-sidebars.json create mode 100644 versioned_sidebars/version-5.4.2-sidebars.json create mode 100644 versioned_sidebars/version-5.5.0-sidebars.json create mode 100644 versioned_sidebars/version-5.5.1-sidebars.json create mode 100644 versioned_sidebars/version-5.5.2-sidebars.json create mode 100644 versions.json diff --git a/.github/workflows/sync-podman-docs.yml b/.github/workflows/sync-podman-docs.yml new file mode 100644 index 000000000..fb95fd30d --- /dev/null +++ b/.github/workflows/sync-podman-docs.yml @@ -0,0 +1,91 @@ +name: Sync Podman Documentation + +on: + schedule: + # Run daily at 2 AM UTC to check for new releases + - cron: '0 2 * * *' + + workflow_dispatch: + inputs: + force_sync: + description: 'Force sync even if no new releases' + required: false + default: false + type: boolean + +permissions: + contents: write + +jobs: + sync-docs: + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + token: ${{ secrets.GITHUB_TOKEN }} + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: '18' + cache: 'yarn' + + - name: Install dependencies + run: yarn install --frozen-lockfile + + - name: Run documentation sync + run: | + chmod +x scripts/sync-podman-docs.js + node scripts/sync-podman-docs.js + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Update version management + run: | + node scripts/sync-podman-docs.js sync-versions + + - name: Check for changes + id: changes + run: | + git config --local user.email "action@github.com" + git config --local user.name "GitHub Action" + + # Check if there are any changes + if [[ -n $(git status --porcelain) ]]; then + echo "changes=true" >> $GITHUB_OUTPUT + echo "Found changes in documentation" + else + echo "changes=false" >> $GITHUB_OUTPUT + echo "No changes detected" + fi + + - name: Commit and push changes + if: steps.changes.outputs.changes == 'true' || github.event.inputs.force_sync == 'true' + run: | + git add . + git commit -m "chore: sync Podman documentation with latest releases + + - Updated documentation from containers/podman repository + - Synced with latest stable releases + - Updated version management files + + Auto-generated by sync-podman-docs workflow" + + git push origin main + + - name: Create summary + if: always() + run: | + echo "## Documentation Sync Summary" >> $GITHUB_STEP_SUMMARY + echo "- **Triggered by**: ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY + echo "- **Changes detected**: ${{ steps.changes.outputs.changes }}" >> $GITHUB_STEP_SUMMARY + echo "- **Force sync**: ${{ github.event.inputs.force_sync }}" >> $GITHUB_STEP_SUMMARY + echo "- **Status**: ${{ job.status }}" >> $GITHUB_STEP_SUMMARY + + if [[ -f "versions.json" ]]; then + echo "### Current Versions" >> $GITHUB_STEP_SUMMARY + echo '```json' >> $GITHUB_STEP_SUMMARY + head -20 versions.json >> $GITHUB_STEP_SUMMARY + echo '```' >> $GITHUB_STEP_SUMMARY + fi \ No newline at end of file diff --git a/docs/checkpoint.md b/docs/checkpoint.md deleted file mode 100644 index 774fa231d..000000000 --- a/docs/checkpoint.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: Podman Checkpoint ---- - -# Checkpointing - -Checkpoints currently work with root containers only. Therefore, you have to -run the example container as root. Instead of prefixing each command with -`sudo`, you can also switch to the root user beforehand via `sudo -i`. - -```bash -sudo podman run -dt -p 8080:80/tcp docker.io/library/httpd -sudo podman ps -``` - -## Checkpointing the container - -Checkpointing a container stops the container while writing the state of all -processes in the container to disk. With this a container can later be restored -and continue running at exactly the same point in time as the checkpoint. -This capability requires [CRIU 3.11](https://www.criu.org/) or later installed -on the system. - -To checkpoint the container use: - -```bash -sudo podman container checkpoint -``` - -## Restoring the container - -Restoring a container is only possible from a previously checkpointed container. -The restored container will continue to run at exactly the same point in time it -was checkpointed. - -To restore the container use: - -```bash -sudo podman container restore -``` - -After being restored, the container will answer requests again as it did before -checkpointing. - -```bash -curl http://:8080 -``` - -## Migrating the container - -To live migrate a container from one host to another the container is -checkpointed on the source system of the migration, transferred to the -destination system and then restored on the destination system. When -transferring the checkpoint, it is possible to specify an output-file. - -On the source system: - -```bash -sudo podman container checkpoint -e /tmp/checkpoint.tar.zst -scp /tmp/checkpoint.tar.zst :/tmp -``` - -On the destination system: - -```bash -sudo podman container restore -i /tmp/checkpoint.tar.zst -``` - -After being restored, the container will answer requests again as it did before -checkpointing. This time the container will continue to run on the destination -system. - -```bash -curl http://:8080 -``` diff --git a/docs/documentation.md b/docs/documentation.md deleted file mode 100644 index 2fcadec9b..000000000 --- a/docs/documentation.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Visit The Official Podman Documentation ---- - -View the [official Podman Documentation here](https://docs.podman.io). diff --git a/docs/index.md b/docs/index.md deleted file mode 100644 index 0f09d7fc6..000000000 --- a/docs/index.md +++ /dev/null @@ -1,228 +0,0 @@ ---- -id: podman -title: Getting Started with Podman ---- - -![Podman logo](/logos/raw/podman-logo-orig.png#gh-light-mode-only)![Podman logo](/logos/raw/podman-logo-dark.png#gh-dark-mode-only) - -# Getting Started with Podman - -Podman is a utility provided as part of the libpod library. It can be used to -create and maintain containers. The following tutorial will teach you how to set -up Podman and perform some basic commands. - -## Podman Documentation - -The documentation for Podman is located -[here](https://docs.podman.io). - -## Installing Podman - -For installing or building Podman, please see the -[installation instructions](docs/installation). - -## Familiarizing yourself with Podman - -The code samples are intended to be run as a non-root user, and use -`sudo` where root escalation is required. - -### Getting help - -To get some help and find out how Podman is working, you can use the _help_: - -```bash -podman --help -podman --help -``` - -For more details, you can review the manpages: - -```bash -man podman -man podman- -``` - -Please also reference the [Podman Troubleshooting Guide](https://github.com/containers/podman/blob/main/troubleshooting.md) -to find known issues and tips on how to solve common configuration mistakes. - -### Searching, pulling & listing images - -Podman can search for images on remote registries with some simple keywords. - -```bash -podman search -``` - -You can also enhance your search with filters: - -```bash -podman search httpd --filter=is-official -``` - -Downloading (Pulling) an image is easy, too. - -```bash -podman pull docker.io/library/httpd -``` - -After pulling some images, you can list all images, present on your machine. - -```bash -podman images -``` - -**Note**: Podman searches in different registries. Therefore it is recommend -to use the full image name (_docker.io/library/httpd_ instead of -_httpd_) to ensure, that you are using the correct image. - -### Running a container - -This sample container will run a very basic httpd server that serves only its -index page. - -```bash -podman run -dt -p 8080:80/tcp docker.io/library/httpd -``` - -**Note**: Because the container is being run in detached mode, represented by -the `-d` in the `podman run` command, Podman will print the container ID after -it has executed the command. The `-t` also adds a pseudo-tty to run arbitrary -commands in an interactive shell. - -**Note**: We use port forwarding to be able to access the HTTP server. For -successful running at least slirp4netns v0.3.0 is needed. - -### Listing running containers - -The `podman ps` command is used to list created and running containers. - -```bash -podman ps -``` - -**Note**: If you add `-a` to the `podman ps` command, Podman will show all -containers (created, exited, running, etc.). - -### Testing the httpd container - -As you are able to see, the container does not have an IP Address assigned. The -container is reachable via it's published port on your local machine. - -```bash -curl http://localhost:8080 -``` - -From another machine, you need to use the IP Address of the host, running the -container. - -```bash -curl http://:8080 -``` - -**Note**: Instead of using curl, you can also point a browser to -`http://localhost:8080`. - -### Inspecting a running container - -You can "inspect" a running container for metadata and details about itself. -`podman inspect` will provide lots of useful information like environment -variables, network settings or allocated resources. - -Since, the container is running in **rootless** mode, no IP Address is assigned -to the container. - -```bash -podman inspect -l | grep IPAddress - "IPAddress": "", -``` - -**Note**: The `-l` is a convenience argument for **latest container**. You can -also use the container's ID or name instead of `-l` or the long argument -`--latest`. - -**Note**: If you are running remote Podman client, including Mac and Windows -(excluding WSL2) machines, `-l` option is not available. - -### Viewing the container's logs - -You can view the container's logs with Podman as well: - -```bash -podman logs -l - -127.0.0.1 - - [04/May/2020:08:33:48 +0000] "GET / HTTP/1.1" 200 45 -127.0.0.1 - - [04/May/2020:08:33:50 +0000] "GET / HTTP/1.1" 200 45 -127.0.0.1 - - [04/May/2020:08:33:51 +0000] "GET / HTTP/1.1" 200 45 -127.0.0.1 - - [04/May/2020:08:33:51 +0000] "GET / HTTP/1.1" 200 45 -127.0.0.1 - - [04/May/2020:08:33:52 +0000] "GET / HTTP/1.1" 200 45 -127.0.0.1 - - [04/May/2020:08:33:52 +0000] "GET / HTTP/1.1" 200 45 -``` - -### Viewing the container's pids - -You can observe the httpd pid in the container with `podman top`. - -```bash -podman top -l - -USER PID PPID %CPU ELAPSED TTY TIME COMMAND -root 1 0 0.000 22m13.33281018s pts/0 0s httpd -DFOREGROUND -daemon 3 1 0.000 22m13.333132179s pts/0 0s httpd -DFOREGROUND -daemon 4 1 0.000 22m13.333276305s pts/0 0s httpd -DFOREGROUND -daemon 5 1 0.000 22m13.333818476s pts/0 0s httpd -DFOREGROUND -``` - -### Stopping the container - -You may stop the container: - -```bash -podman stop -l -``` - -You can check the status of one or more containers using the `podman ps` -command. In this case, you should use the `-a` argument to list all containers. - -```bash -podman ps -a -``` - -### Removing the container - -Finally, you can remove the container: - -```bash -podman rm -l -``` - -You can verify the deletion of the container by running `podman ps -a`. - -## Network - -For a more detailed guide about Networking and DNS in containers, please see the -[network guide](https://github.com/containers/podman/blob/main/docs/tutorials/basic_networking.md). - -## Checkpoint, Migration and Restoring containers - -Checkpointing a container stops the container while writing the state of all -processes in the container to disk. With this, a container can later be -migrated and restored, running at exactly the same point in time as the -checkpoint. For more details, see the -[checkpoint instructions](docs/checkpoint). - -## Integration Tests - -For more information on how to setup and run the integration tests in your -environment, checkout the Integration Tests -[README.md](https://github.com/containers/podman/blob/main/test/README.md). - -## Podman Python Documentation - -The documentation for the Podman Python SDK is located -[here](https://podman-py.readthedocs.io/en/latest/index.html). - -## More information - -For more information on Podman and its subcommands, checkout the asciiart demos -on the [README.md](https://github.com/containers/podman/blob/main/commands-demo.md) -page. diff --git a/docs/installation.md b/docs/installation.md deleted file mode 100644 index 1d780f4a0..000000000 --- a/docs/installation.md +++ /dev/null @@ -1,723 +0,0 @@ ---- -title: Podman Installation ---- - -# Podman Installation Instructions - -Looking for a GUI? You can find Podman Desktop [here](https://podman-desktop.io/downloads). - -## Installing on Mac & Windows - -While "containers are Linux," Podman also runs on Mac and Windows, where it -provides a native podman CLI and embeds a guest Linux system to launch your -containers. This guest is referred to as a Podman machine and is managed with -the `podman machine` command. Podman on Mac and Windows also listens for -Docker API clients, supporting direct usage of Docker-based tools and -programmatic access from your language of choice. - -### macOS - -On Mac, each Podman machine is backed by a virtual machine. -Once installed, the podman command can be run directly from -the Unix shell in `Terminal`, where it remotely communicates with the podman -service running in the Machine VM. - -
-Download Podman Installer (Recommended) - -Podman can be downloaded from the [Podman.io](https://podman.io) website. - -We also upload the installers and other binaries on our [GitHub release page](https://github.com/containers/podman/releases). - -
- -Though not recommended, Podman can also be obtained through Homebrew, -the package manager. -
-Install via Brew - -Since Brew is a community-maintained package manager, we cannot guarantee stability -of Brew installs of Podman. Thus, installing via Brew is not recommended. - -However, if you do wish to use Brew, you must first install [Homebrew](https://brew.sh/). Once you -have set up brew, you can use the `brew install` command to install Podman: - -```bash -brew install podman -``` - -
- -After installing, you need to create and start your first Podman machine: - -```bash -podman machine init -podman machine start -``` - -You can then verify the installation information using: - -```bash -podman info -``` - -We also provide binaries and a pkginstaller on our [GitHub release page](https://github.com/containers/podman/releases) - -### Windows - -On Windows, each Podman machine is backed by a virtualized Windows Subsystem for -Linux (WSLv2) distribution. Once installed, the podman command can be run -directly from your Windows PowerShell (or CMD) prompt, where it remotely -communicates with the podman service running in the WSL environment. -Alternatively, you can access Podman directly from the WSL instance if you -prefer a Linux prompt and Linux tooling. - -See the [Podman for Windows guide](https://github.com/containers/podman/blob/main/docs/tutorials/podman-for-windows.md) for setup and usage instructions. - -## Installing on Linux - -### Linux Distributions - -#### [Arch Linux](https://www.archlinux.org) & [Manjaro Linux](https://manjaro.org) - -```bash -sudo pacman -S podman -``` - -If you have problems when running Podman in [rootless](https://github.com/containers/podman/blob/main/README.md#rootless) mode follow the instructions [here]() - -For more information on Podman on ArchLinux [click here](https://wiki.archlinux.org/title/Podman) - -#### [Alpine Linux](https://alpinelinux.org) - -```bash -sudo apk add podman -``` - -For further details, please refer to the instructions on the [Alpine Linux wiki](https://wiki.alpinelinux.org/wiki/Podman). - -#### [CentOS Stream](https://www.centos.org) - -Podman is available in the default in the AppStream repo for CentOS Stream 9+. - -```bash -sudo dnf -y install podman -``` - -#### [Debian](https://debian.org) - -The podman package is available in the Debian 11 (Bullseye) repositories and later. - -```bash -sudo apt-get -y install podman -``` - -#### [Fedora](https://getfedora.org) - -```bash -sudo dnf -y install podman -``` - -To run `podman machine ...` commands - -```bash -sudo dnf -y install podman-machine -``` - -slirp4netns is no longer the default for rootless networking on new podman installations, obsoleted in favor -of [passt](https://passt.top/passt/about/). If you have containers using slirp4netns, make sure slirp4netns is -installed: - -```bash -sudo dnf -y install slirp4netns -``` - -#### [Fedora CoreOS](https://coreos.fedoraproject.org), [Fedora Silverblue](https://silverblue.fedoraproject.org) - -Built-in, no need to install - -#### [Gentoo](https://www.gentoo.org) - -```bash -sudo emerge app-containers/podman -``` - -#### [OpenEmbedded](https://www.openembedded.org) - -Bitbake recipes for Podman and its dependencies are available in the -[meta-virtualization layer](https://git.yoctoproject.org/cgit/cgit.cgi/meta-virtualization/). -Add the layer to your OpenEmbedded build environment and build Podman using: - -```bash -bitbake podman -``` - -#### [openSUSE](https://www.opensuse.org) - -```bash -sudo zypper install podman -``` - -#### [openSUSE Kubic](https://kubic.opensuse.org) - -Built-in, no need to install - -#### [Raspberry Pi OS arm64 (beta)](https://downloads.raspberrypi.org/raspios_arm64/images/) - -Raspberry Pi OS use the standard Debian repositories, -so it is fully compatible with Debian's arm64 repository. -You can simply follow the [steps for Debian](#debian) to install Podman. - -#### [RHEL](https://www.redhat.com/en/technologies/linux-platforms/enterprise-linux) - -Follow the [official docs](https://access.redhat.com/solutions/3650231). - -#### [Ubuntu](https://www.ubuntu.com) - -The podman package is available in the official repositories for Ubuntu 20.10 -and newer. - -```bash -# Ubuntu 20.10 and newer -sudo apt-get update -sudo apt-get -y install podman -``` - -#### [Linux Mint](https://linuxmint.com) - -Follow the steps for Ubuntu (or Debian if you use LMDE). - -### Installing development versions of Podman - -#### [Fedora](https://getfedora.org) - -You can test the very latest Podman in Fedora's `updates-testing` -repository before it goes out to all Fedora users. - -```bash -sudo dnf update --refresh --enablerepo=updates-testing podman -``` - -If you use a newer Podman package from Fedora's `updates-testing`, we would -appreciate your `+1` feedback in [Bodhi, Fedora's update management -system](https://bodhi.fedoraproject.org/updates/?packages=podman). - -### Installing bleeding-edge versions of Podman - -If you like danger and are interested in testing the latest -unreleased bits of Podman on Fedora, CentOS Stream 9+ and RHEL9+, we have a [Copr repository](https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/). - -CAUTION: This repository contains rpm builds generated using the `main` branch -of upstream container tools repositories, and simply CANNOT be recommended for -any production use. - -Enable the Copr and install podman. - -```bash -sudo dnf copr enable rhcontainerbot/podman-next -y -sudo dnf install podman -``` - -## Installing on [FreeBSD](https://freebsd.org) 14.0 - ->[!WARNING] ->The FreeBSD port of the Podman container engine is experimental and should be used for evaluation and testing purposes only. - -You can install Podman on FreeBSD using `pkg`: - -```bash -pkg install podman -``` - -There's also a `podman-suite` meta package that will pull additional packages for you (buildah, skopeo). - -#### Initial configuration -To properly support Podman's container restart policy, conmon needs `fdescfs(5)` to be mounted on `/dev/fd`. - -If `/dev/fd` is not already mounted: - -```bash -mount -t fdescfs fdesc /dev/fd -``` - -To make it permanent, add the following line to `/etc/fstab`: -``` -fdesc /dev/fd fdescfs rw 0 0 -``` - -To start Podman after reboot: -```bash -service podman enable -``` - -##### Networking -Container networking relies on NAT to allow container network packets out to the host's network. This requires a PF firewall to perform the translation. A simple example is included - to use it: - -```bash -cp /usr/local/etc/containers/pf.conf.sample /etc/pf.conf -``` - -Edit `/etc/pf.conf` and set `v4egress_if`, `v6egress_if` variables to your network interface(s)s - -Enable and start `pf`: -``` -service pf enable -service pf start -``` - -The sample PF configuration includes support for port redirections. These are implemented as redirect rules in anchors nested under cni-rdr. - -Support for redirecting connections from the container host to services running inside a container is included for FreeBSD 13.3 and later. To enable this, first load the pf kernel module and enable PF support for these redirections using sysctl: - -```bash -echo 'pf_load="YES"' >> /boot/loader.conf -kldload pf -sysctl net.pf.filter_local=1 -echo 'net.pf.filter_local=1' >> /etc/sysctl.conf.local -service pf restart -``` - -Redirect rules will work if the destination address is localhost (e.g. 127.0.0.1 or ::1) - to enable this, the following line must be included in your `/etc/pf.conf`: - -``` -nat-anchor "cni-rdr/*" -``` - -if upgrading from an older version, this needs to be added to `/etc/pf.conf`. - -For example if host port 1234 is redirected to an http service running in a -container, you could connect to it using: - -```bash -fetch -o- http://$(hostname):1234 -``` - -or - -```bash -fetch -o- http://localhost:1234 -``` -##### Storage - -Container images and related state is stored in `/var/db/containers`. It is recommended to use ZFS for this: - -```bash -zfs create -o mountpoint=/var/db/containers zroot/containers -``` - -If your system cannot use ZFS, change `storage.conf` to use the `vfs` storage driver: - -```bash -sed -I .bak -e 's/driver = "zfs"/driver = "vfs"/' /usr/local/etc/containers/storage.conf -``` - -##### Verification - -After following these steps you should be able to run native images: - -```bash -podman run --rm docker.io/dougrabson/hello -``` - -##### Linux Emulation - -It is possible to run many Linux container images using FreeBSD's Linux emulation: - -```bash -sudo sysrc linux_enable=YES -sudo service linux start -sudo podman run --rm --os=linux docker.io/library/alpine cat /etc/os-release | head -1 -NAME="Alpine Linux" -``` - -## Building from Source - -### Build and Run Dependencies - -**Required** - -On Fedora: - -```bash -# Install build dependencies -sudo dnf -y builddep rpm/podman.spec - -# Install runtime dependencies -sudo dnf -y install catatonit conmon containers-common-extra -``` - -On all RHEL and CentOS Stream, first install `dnf-builddep`: -```bash -sudo dnf -y install 'dnf-command(builddep)' -``` - -Install build dependencies: - -```bash -# CentOS Stream 9+ -sudo dnf -y builddep rpm/podman.spec --enablerepo=crb - -# RHEL 9+ -sudo dnf -y builddep rpm/podman.spec --enablerepo=codeready-builder-for-rhel-$(rpm --eval %{?rhel})-$(uname -m)-rpms -``` - -Install runtime dependencies: -```bash -sudo dnf -y install \ - conmon \ - containers-common \ - crun \ - iptables \ - netavark \ - nftables \ - slirp4netns -``` - -Debian, Ubuntu, and related distributions: - -```bash -sudo apt-get install \ - btrfs-progs \ - gcc \ - git \ - golang-go \ - go-md2man \ - iptables \ - libassuan-dev \ - libbtrfs-dev \ - libc6-dev \ - libdevmapper-dev \ - libglib2.0-dev \ - libgpgme-dev \ - libgpg-error-dev \ - libprotobuf-dev \ - libprotobuf-c-dev \ - libseccomp-dev \ - libselinux1-dev \ - libsystemd-dev \ - make \ - netavark \ - passt \ - pkg-config \ - runc \ - uidmap -``` - -The `netavark` package may not be available on older Debian / Ubuntu -versions. Install the `containernetworking-plugins` package instead. - -On openSUSE Leap 15.x and Tumbleweed: - -```bash -sudo zypper -n in libseccomp-devel libgpgme-devel -``` - -On Manjaro (and maybe other Linux distributions): - -Make sure that the Linux kernel supports user namespaces: - -``` -> zgrep CONFIG_USER_NS /proc/config.gz -CONFIG_USER_NS=y - -``` - -If not, please update the kernel. -For Manjaro Linux the instructions can be found here: -https://wiki.manjaro.org/index.php/Manjaro_Kernels - -After that enable user namespaces: - -``` -sudo sysctl kernel.unprivileged_userns_clone=1 -``` - -To enable the user namespaces permanently: - -``` -echo 'kernel.unprivileged_userns_clone=1' > /etc/sysctl.d/userns.conf -``` - -### Building missing dependencies - -If any dependencies cannot be installed or are not sufficiently current, they have to be built from source. -This will mainly affect Debian, Ubuntu, and related distributions, or RHEL where no subscription is active (e.g. Cloud VMs). - -#### golang - -Be careful to double-check that the version of golang is new enough (i.e. `go version`), as of January 2022 version is 1.16.x or higher is required. -The current minimum required version can always be found in the [go.mod](https://github.com/containers/podman/blob/main/go.mod) file. -If needed, golang kits are available at https://golang.org/dl/. Alternatively, go can be built from source as follows -(it's helpful to leave the system-go installed, to avoid having to [bootstrap go](https://golang.org/doc/install/source): - -```bash -export GOPATH=~/go -git clone https://go.googlesource.com/go $GOPATH -cd $GOPATH -cd src -./all.bash -export PATH=$GOPATH/bin:$PATH -``` - -#### conmon - -The latest version of `conmon` is expected to be installed on the system. Conmon is used to monitor OCI Runtimes. -To build from source, use the following: - -```bash -git clone https://github.com/containers/conmon -cd conmon -export GOCACHE="$(mktemp -d)" -make -sudo make podman -``` - -#### crun / runc - -The latest version of at least one container runtime is expected to be installed on the system. `crun` or `runc` are some of the possibilities, and one is picked up as the default runtime by Podman (crun has priority over runc). -Supported versions of `crun` or `runc` are available for example on Ubuntu 22.04. -`runc` version 1.0.0-rc4 is the minimal requirement, which is available since Ubuntu 18.04. - -To double-check, `runc --version` should produce at least `spec: 1.0.1`, otherwise build your own: - -```bash -git clone https://github.com/opencontainers/runc.git $GOPATH/src/github.com/opencontainers/runc -cd $GOPATH/src/github.com/opencontainers/runc -make BUILDTAGS="selinux seccomp" -sudo cp runc /usr/bin/runc -``` - -#### Add configuration - -```bash -sudo mkdir -p /etc/containers -sudo curl -L -o /etc/containers/registries.conf https://raw.githubusercontent.com/containers/image/main/registries.conf -sudo curl -L -o /etc/containers/policy.json https://raw.githubusercontent.com/containers/image/main/default-policy.json -``` - -#### Optional packages - -Fedora, CentOS, RHEL, and related distributions: - -(no optional packages) - -Debian, Ubuntu, and related distributions: - -```bash -apt-get install -y \ - libapparmor-dev -``` - -### Get Source Code - -First, ensure that the `go version` that is found first on the $PATH is 1.16.x or higher. Instruction [above](#golang) will help you compile newer version of Go if needed. Then we can build Podman: - -```bash -git clone https://github.com/containers/podman/ -cd podman -make BUILDTAGS="selinux seccomp" PREFIX=/usr -sudo env PATH=$PATH make install PREFIX=/usr -``` - -#### Build Tags - -Otherwise, if you do not want to build Podman with seccomp or selinux support you can add `BUILDTAGS=""` when running make. - -```bash -make BUILDTAGS="" -sudo make install -``` - -Podman supports optional build tags for compiling support of various features. -To add build tags to the make option the `BUILDTAGS` variable must be set, for example: - -```bash -make BUILDTAGS='seccomp apparmor' -``` - -If you are building on RHEL8 you'll need to build without btrfs support due to [it being removed](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/considerations_in_adopting_rhel_8/file-systems-and-storage_considerations-in-adopting-rhel-8#btrfs-has-been-removed_file-systems-and-storage): -``` -make BUILDTAGS="btrfs_noversion exclude_graphdriver_btrfs" -``` - -| Build Tag | Feature | Dependency | -| -------------------------------- | ---------------------------------- | ----------- | -| apparmor | apparmor support | libapparmor | -| cni | CNI networking | | -| exclude_graphdriver_btrfs | exclude btrfs | libbtrfs | -| exclude_graphdriver_devicemapper | exclude device-mapper | libdm | -| libdm_no_deferred_remove | exclude deferred removal in libdm | libdm | -| seccomp | syscall filtering | libseccomp | -| selinux | selinux process and mount labeling | | -| systemd | journald logging | libsystemd | - -Note that Podman does not officially support device-mapper. Thus, the `exclude_graphdriver_devicemapper` tag is mandatory. - -### Vendoring - Dependency Management - -This project is using [go modules](https://github.com/golang/go/wiki/Modules) for dependency management. If the CI is complaining about a pull request leaving behind an unclean state, it is very likely right about it. After changing dependencies, make sure to run `make vendor` to synchronize the code with the go module and repopulate the `./vendor` directory. - -#### Ansible - -An [Ansible Role](https://github.com/alvistack/ansible-role-podman) is -also available to automate the installation of the above statically -linked binary on its supported OS: - -```bash -sudo su - -mkdir -p ~/.ansible/roles -cd ~/.ansible/roles -git clone https://github.com/alvistack/ansible-role-podman.git podman -cd ~/.ansible/roles/podman -pip3 install --upgrade --ignore-installed --requirement requirements.txt -molecule converge -molecule verify -``` - -## Configuration files - -### [registries.conf](https://raw.githubusercontent.com/containers/image/main/registries.conf) - -#### Man Page: [registries.conf.5](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md) - -`/etc/containers/registries.conf` - -registries.conf is the configuration file which specifies which container registries should be consulted when completing image names which do not include a registry or domain portion. - -NOTE: On macOS or Windows, please run the command `podman machine ssh` to enter the machine VM and edit the `/etc/containers/registries.conf` file with the same configuration content. If you encounter permission issues, run `podman machine set --rootful` and try again. - -#### Example from the Fedora `containers-common` package - -``` -$ cat /etc/containers/registries.conf -# For more information on this configuration file, see containers-registries.conf(5). -# -# NOTE: RISK OF USING UNQUALIFIED IMAGE NAMES -# We recommend always using fully qualified image names including the registry -# server (full dns name), namespace, image name, and tag -# (e.g., registry.redhat.io/ubi8/ubi:latest). Pulling by digest (i.e., -# quay.io/repository/name@digest) further eliminates the ambiguity of tags. -# When using short names, there is always an inherent risk that the image being -# pulled could be spoofed. For example, a user wants to pull an image named -# `foobar` from a registry and expects it to come from myregistry.com. If -# myregistry.com is not first in the search list, an attacker could place a -# different `foobar` image at a registry earlier in the search list. The user -# would accidentally pull and run the attacker's image and code rather than the -# intended content. We recommend only adding registries which are completely -# trusted (i.e., registries which don't allow unknown or anonymous users to -# create accounts with arbitrary names). This will prevent an image from being -# spoofed, squatted or otherwise made insecure. If it is necessary to use one -# of these registries, it should be added at the end of the list. -# -# # An array of host[:port] registries to try when pulling an unqualified image, in order. -unqualified-search-registries = ["registry.fedoraproject.org", "registry.access.redhat.com", "docker.io"] -# -# [[registry]] -# # The "prefix" field is used to choose the relevant [[registry]] TOML table; -# # (only) the TOML table with the longest match for the input image name -# # (taking into account namespace/repo/tag/digest separators) is used. -# # -# # If the prefix field is missing, it defaults to be the same as the "location" field. -# prefix = "example.com/foo" -# -# # If true, unencrypted HTTP as well as TLS connections with untrusted -# # certificates are allowed. -# insecure = false -# -# # If true, pulling images with matching names is forbidden. -# blocked = false -# -# # The physical location of the "prefix"-rooted namespace. -# # -# # By default, this equal to "prefix" (in which case "prefix" can be omitted -# # and the [[registry]] TOML table can only specify "location"). -# # -# # Example: Given -# # prefix = "example.com/foo" -# # location = "internal-registry-for-example.net/bar" -# # requests for the image example.com/foo/myimage:latest will actually work with the -# # internal-registry-for-example.net/bar/myimage:latest image. -# location = "internal-registry-for-example.com/bar" -# -# # (Possibly-partial) mirrors for the "prefix"-rooted namespace. -# # -# # The mirrors are attempted in the specified order; the first one that can be -# # contacted and contains the image will be used (and if none of the mirrors contains the image, -# # the primary location specified by the "registry.location" field, or using the unmodified -# # user-specified reference, is tried last). -# # -# # Each TOML table in the "mirror" array can contain the following fields, with the same semantics -# # as if specified in the [[registry]] TOML table directly: -# # - location -# # - insecure -# [[registry.mirror]] -# location = "example-mirror-0.local/mirror-for-foo" -# [[registry.mirror]] -# location = "example-mirror-1.local/mirrors/foo" -# insecure = true -# # Given the above, a pull of example.com/foo/image:latest will try: -# # 1. example-mirror-0.local/mirror-for-foo/image:latest -# # 2. example-mirror-1.local/mirrors/foo/image:latest -# # 3. internal-registry-for-example.net/bar/image:latest -# # in order, and use the first one that exists. -# -# short-name-mode="enforcing" - -[[registry]] -location="localhost:5000" -insecure=true -``` - -### [mounts.conf](https://raw.githubusercontent.com/containers/common/main/pkg/subscriptions/mounts.conf) - -`/usr/share/containers/mounts.conf` and optionally `/etc/containers/mounts.conf` - -The mounts.conf files specify volume mount directories that are automatically mounted inside containers when executing the `podman run` or `podman build` commands. Container process can then use this content. The volume mount content does not get committed to the final image. - -Usually these directories are used for passing secrets or credentials required by the package software to access remote package repositories. - -For example, a mounts.conf with the line "`/usr/share/rhel/secrets:/run/secrets`", the content of `/usr/share/rhel/secrets` directory is mounted on `/run/secrets` inside the container. This mountpoint allows Red Hat Enterprise Linux subscriptions from the host to be used within the container. - -Note this is not a volume mount. The content of the volumes is copied into container storage, not bind mounted directly from the host. - -#### Example from the Fedora `containers-common` package: - -``` -cat /usr/share/containers/mounts.conf -/usr/share/rhel/secrets:/run/secrets -``` - -### [seccomp.json](https://raw.githubusercontent.com/containers/common/main/pkg/seccomp/seccomp.json) - -`/usr/share/containers/seccomp.json` - -seccomp.json contains the whitelist of seccomp rules to be allowed inside of -containers. This file is usually provided by the containers-common package. - -The link above takes you to the seccomp.json - -### [policy.json](https://raw.githubusercontent.com/containers/image/main/default-policy.json) - -`/etc/containers/policy.json` - -#### Man Page: [policy.json.5](https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md) - -#### Example from the Fedora `containers-common` package: - -``` -cat /etc/containers/policy.json -{ - "default": [ - { - "type": "insecureAcceptAnything" - } - ], - "transports": - { - "docker-daemon": - { - "": [{"type":"insecureAcceptAnything"}] - } - } -} -``` diff --git a/docusaurus.config.js b/docusaurus.config.js index 3d7c16066..c372f9628 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -10,8 +10,9 @@ const config = { 'Podman is a daemonless container engine for developing, managing, and running OCI Containers on your Linux System', url: 'https://podman.io', baseUrl: '/', - onBrokenLinks: 'throw', + onBrokenLinks: 'warn', onBrokenMarkdownLinks: 'warn', + onBrokenAnchors: 'warn', favicon: 'favicon.ico', trailingSlash: false, deploymentBranch: 'gh-pages', @@ -21,8 +22,38 @@ const config = { defaultLocale: 'en', locales: ['en'], }, + // Configure markdown processing: .md files use CommonMark, .mdx files use MDX + markdown: { + format: 'detect', + }, + // Configure static directories and asset handling + staticDirectories: ['static'], plugins: [ '@docusaurus/theme-live-codeblock', + [ + '@easyops-cn/docusaurus-search-local', + { + // Index configuration + hashed: true, + language: ['en'], + indexDocs: true, + indexBlog: true, + indexPages: false, + // Route configuration + docsRouteBasePath: '/docs', + blogRouteBasePath: '/blogs', + // Version-aware directory configuration + docsDir: 'versioned_docs', + blogDir: ['blog', 'release'], + // Search result configuration + searchResultLimits: 8, + searchResultContextMaxLength: 50, + // Search bar configuration + searchBarShortcut: true, + searchBarShortcutHint: true, + searchBarPosition: 'right', + }, + ], async function tailwindPlugin() { return { name: 'docusaurus-tailwindcss', @@ -39,8 +70,11 @@ const config = { routeBasePath: 'release', id: 'release-anouncements', path: './release', + authorsMapPath: '../blog/authors.yml', + onInlineAuthors: 'ignore', }, ], + ], presets: [ [ @@ -48,13 +82,16 @@ const config = { /** @type {import('@docusaurus/preset-classic').Options} */ ({ docs: { - sidebarPath: require.resolve('./sidebars.js'), - path: 'docs', - editUrl: 'https://github.com/containers/podman.io/tree/main', + sidebarPath: require.resolve('./sidebars-podman.js'), + routeBasePath: 'docs', + disableVersioning: false, + includeCurrentVersion: false, }, blog: { showReadingTime: true, routeBasePath: 'blogs', + authorsMapPath: 'blog/authors.yml', + onInlineAuthors: 'ignore', }, theme: { customCss: require.resolve('./src/css/main.css'), @@ -88,11 +125,15 @@ const config = { }, { type: 'doc', - docId: 'podman', + docId: 'index', label: 'Documentation', position: 'right', }, - + { + type: 'docsVersionDropdown', + position: 'right', + dropdownActiveClassDisabled: true, + }, { to: 'https://github.com/containers/', target: '_self', @@ -109,16 +150,19 @@ const config = { items: [ { label: 'Installation Instructions', - to: 'docs/installation', + to: 'get-started', }, { label: 'Documentation', to: 'docs/', }, - { label: 'Podman CLI Commands', - href: 'https://docs.podman.io/en/latest/Commands.html', + to: 'docs/source/markdown/podman.1', + }, + { + label: 'Tutorials', + to: 'docs/tutorials/podman_tutorial', }, ], }, diff --git a/package-lock.json b/package-lock.json new file mode 100644 index 000000000..7b77fdf66 --- /dev/null +++ b/package-lock.json @@ -0,0 +1,19546 @@ +{ + "name": "podman", + "version": "0.0.0", + "lockfileVersion": 3, + "requires": true, + "packages": { + "": { + "name": "podman", + "version": "0.0.0", + "dependencies": { + "@docusaurus/core": "latest", + "@docusaurus/plugin-content-blog": "latest", + "@docusaurus/preset-classic": "latest", + "@docusaurus/theme-live-codeblock": "latest", + "@easyops-cn/docusaurus-search-local": "^0.52.0", + "@iconify/react": "^4.0.1", + "autoprefixer": "^10.4.13", + "clsx": "^1.2.1", + "html-react-parser": "^3.0.16", + "papaparse": "^5.4.1", + "postcss": "^8.4.21", + "prism-react-renderer": "^1.3.5", + "react": "^18.0.0", + "react-dom": "^18.0.0", + "react-markdown": "^8.0.5", + "tailwindcss": "^3.2.4" + }, + "devDependencies": { + "@docusaurus/eslint-plugin": "latest", + "@docusaurus/module-type-aliases": "latest", + "@tsconfig/docusaurus": "^1.0.5", + "@typescript-eslint/eslint-plugin": "^5.48.2", + "@typescript-eslint/parser": "^5.48.2", + "eslint": "^8.32.0", + "eslint-config-prettier": "^8.6.0", + "husky": "^8.0.3", + "lint-staged": "^13.1.0", + "prettier": "2.8.8", + "prettier-plugin-tailwindcss": "^0.6.0", + "tailwind-scrollbar": "^3.0.0", + "typescript": "^4.9.4" + }, + "engines": { + "node": "22" + } + }, + "node_modules/@aashutoshrathi/word-wrap": { + "version": "1.2.6", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/@algolia/autocomplete-core": { + "version": "1.17.9", + "license": "MIT", + "dependencies": { + "@algolia/autocomplete-plugin-algolia-insights": "1.17.9", + "@algolia/autocomplete-shared": "1.17.9" + } + }, + "node_modules/@algolia/autocomplete-plugin-algolia-insights": { + "version": "1.17.9", + "license": "MIT", + "dependencies": { + "@algolia/autocomplete-shared": "1.17.9" + }, + "peerDependencies": { + "search-insights": ">= 1 < 3" + } + }, + "node_modules/@algolia/autocomplete-preset-algolia": { + "version": "1.17.9", + "license": "MIT", + "dependencies": { + "@algolia/autocomplete-shared": "1.17.9" + }, + "peerDependencies": { + "@algolia/client-search": ">= 4.9.1 < 6", + "algoliasearch": ">= 4.9.1 < 6" + } + }, + "node_modules/@algolia/autocomplete-shared": { + "version": "1.17.9", + "license": "MIT", + "peerDependencies": { + "@algolia/client-search": ">= 4.9.1 < 6", + "algoliasearch": ">= 4.9.1 < 6" + } + }, + "node_modules/@algolia/client-abtesting": { + "version": "5.32.0", + "license": "MIT", + "dependencies": { + "@algolia/client-common": "5.32.0", + "@algolia/requester-browser-xhr": "5.32.0", + "@algolia/requester-fetch": "5.32.0", + "@algolia/requester-node-http": "5.32.0" + }, + "engines": { + "node": ">= 14.0.0" + } + }, + "node_modules/@algolia/client-analytics": { + "version": "5.32.0", + "license": "MIT", + "dependencies": { + "@algolia/client-common": "5.32.0", + "@algolia/requester-browser-xhr": "5.32.0", + "@algolia/requester-fetch": "5.32.0", + "@algolia/requester-node-http": "5.32.0" + }, + "engines": { + "node": ">= 14.0.0" + } + }, + "node_modules/@algolia/client-common": { + "version": "5.32.0", + "license": "MIT", + "engines": { + "node": ">= 14.0.0" + } + }, + "node_modules/@algolia/client-insights": { + "version": "5.32.0", + "license": "MIT", + "dependencies": { + "@algolia/client-common": "5.32.0", + "@algolia/requester-browser-xhr": "5.32.0", + "@algolia/requester-fetch": "5.32.0", + "@algolia/requester-node-http": "5.32.0" + }, + "engines": { + "node": ">= 14.0.0" + } + }, + "node_modules/@algolia/client-personalization": { + "version": "5.32.0", + "license": "MIT", + "dependencies": { + "@algolia/client-common": "5.32.0", + "@algolia/requester-browser-xhr": "5.32.0", + "@algolia/requester-fetch": "5.32.0", + "@algolia/requester-node-http": "5.32.0" + }, + "engines": { + "node": ">= 14.0.0" + } + }, + "node_modules/@algolia/client-query-suggestions": { + "version": "5.32.0", + "license": "MIT", + "dependencies": { + "@algolia/client-common": "5.32.0", + "@algolia/requester-browser-xhr": "5.32.0", + "@algolia/requester-fetch": "5.32.0", + "@algolia/requester-node-http": "5.32.0" + }, + "engines": { + "node": ">= 14.0.0" + } + }, + "node_modules/@algolia/client-search": { + "version": "5.32.0", + "license": "MIT", + "dependencies": { + "@algolia/client-common": "5.32.0", + "@algolia/requester-browser-xhr": "5.32.0", + "@algolia/requester-fetch": "5.32.0", + "@algolia/requester-node-http": "5.32.0" + }, + "engines": { + "node": ">= 14.0.0" + } + }, + "node_modules/@algolia/events": { + "version": "4.0.1", + "license": "MIT" + }, + "node_modules/@algolia/ingestion": { + "version": "1.32.0", + "license": "MIT", + "dependencies": { + "@algolia/client-common": "5.32.0", + "@algolia/requester-browser-xhr": "5.32.0", + "@algolia/requester-fetch": "5.32.0", + "@algolia/requester-node-http": "5.32.0" + }, + "engines": { + "node": ">= 14.0.0" + } + }, + "node_modules/@algolia/monitoring": { + "version": "1.32.0", + "license": "MIT", + "dependencies": { + "@algolia/client-common": "5.32.0", + "@algolia/requester-browser-xhr": "5.32.0", + "@algolia/requester-fetch": "5.32.0", + "@algolia/requester-node-http": "5.32.0" + }, + "engines": { + "node": ">= 14.0.0" + } + }, + "node_modules/@algolia/recommend": { + "version": "5.32.0", + "license": "MIT", + "dependencies": { + "@algolia/client-common": "5.32.0", + "@algolia/requester-browser-xhr": "5.32.0", + "@algolia/requester-fetch": "5.32.0", + "@algolia/requester-node-http": "5.32.0" + }, + "engines": { + "node": ">= 14.0.0" + } + }, + "node_modules/@algolia/requester-browser-xhr": { + "version": "5.32.0", + "license": "MIT", + "dependencies": { + "@algolia/client-common": "5.32.0" + }, + "engines": { + "node": ">= 14.0.0" + } + }, + "node_modules/@algolia/requester-fetch": { + "version": "5.32.0", + "license": "MIT", + "dependencies": { + "@algolia/client-common": "5.32.0" + }, + "engines": { + "node": ">= 14.0.0" + } + }, + "node_modules/@algolia/requester-node-http": { + "version": "5.32.0", + "license": "MIT", + "dependencies": { + "@algolia/client-common": "5.32.0" + }, + "engines": { + "node": ">= 14.0.0" + } + }, + "node_modules/@alloc/quick-lru": { + "version": "5.2.0", + "license": "MIT", + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/@ampproject/remapping": { + "version": "2.2.1", + "license": "Apache-2.0", + "dependencies": { + "@jridgewell/gen-mapping": "^0.3.0", + "@jridgewell/trace-mapping": "^0.3.9" + }, + "engines": { + "node": ">=6.0.0" + } + }, + "node_modules/@ampproject/remapping/node_modules/@jridgewell/trace-mapping": { + "version": "0.3.19", + "license": "MIT", + "dependencies": { + "@jridgewell/resolve-uri": "^3.1.0", + "@jridgewell/sourcemap-codec": "^1.4.14" + } + }, + "node_modules/@babel/code-frame": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-validator-identifier": "^7.27.1", + "js-tokens": "^4.0.0", + "picocolors": "^1.1.1" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/compat-data": { + "version": "7.28.0", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/core": { + "version": "7.28.0", + "license": "MIT", + "dependencies": { + "@ampproject/remapping": "^2.2.0", + "@babel/code-frame": "^7.27.1", + "@babel/generator": "^7.28.0", + "@babel/helper-compilation-targets": "^7.27.2", + "@babel/helper-module-transforms": "^7.27.3", + "@babel/helpers": "^7.27.6", + "@babel/parser": "^7.28.0", + "@babel/template": "^7.27.2", + "@babel/traverse": "^7.28.0", + "@babel/types": "^7.28.0", + "convert-source-map": "^2.0.0", + "debug": "^4.1.0", + "gensync": "^1.0.0-beta.2", + "json5": "^2.2.3", + "semver": "^6.3.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/babel" + } + }, + "node_modules/@babel/generator": { + "version": "7.28.0", + "license": "MIT", + "dependencies": { + "@babel/parser": "^7.28.0", + "@babel/types": "^7.28.0", + "@jridgewell/gen-mapping": "^0.3.12", + "@jridgewell/trace-mapping": "^0.3.28", + "jsesc": "^3.0.2" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/generator/node_modules/@jridgewell/gen-mapping": { + "version": "0.3.12", + "license": "MIT", + "dependencies": { + "@jridgewell/sourcemap-codec": "^1.5.0", + "@jridgewell/trace-mapping": "^0.3.24" + } + }, + "node_modules/@babel/generator/node_modules/@jridgewell/sourcemap-codec": { + "version": "1.5.4", + "license": "MIT" + }, + "node_modules/@babel/generator/node_modules/jsesc": { + "version": "3.1.0", + "license": "MIT", + "bin": { + "jsesc": "bin/jsesc" + }, + "engines": { + "node": ">=6" + } + }, + "node_modules/@babel/helper-annotate-as-pure": { + "version": "7.27.3", + "license": "MIT", + "dependencies": { + "@babel/types": "^7.27.3" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/helper-compilation-targets": { + "version": "7.27.2", + "license": "MIT", + "dependencies": { + "@babel/compat-data": "^7.27.2", + "@babel/helper-validator-option": "^7.27.1", + "browserslist": "^4.24.0", + "lru-cache": "^5.1.1", + "semver": "^6.3.1" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/helper-compilation-targets/node_modules/lru-cache": { + "version": "5.1.1", + "license": "ISC", + "dependencies": { + "yallist": "^3.0.2" + } + }, + "node_modules/@babel/helper-create-class-features-plugin": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-annotate-as-pure": "^7.27.1", + "@babel/helper-member-expression-to-functions": "^7.27.1", + "@babel/helper-optimise-call-expression": "^7.27.1", + "@babel/helper-replace-supers": "^7.27.1", + "@babel/helper-skip-transparent-expression-wrappers": "^7.27.1", + "@babel/traverse": "^7.27.1", + "semver": "^6.3.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0" + } + }, + "node_modules/@babel/helper-create-regexp-features-plugin": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-annotate-as-pure": "^7.27.1", + "regexpu-core": "^6.2.0", + "semver": "^6.3.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0" + } + }, + "node_modules/@babel/helper-create-regexp-features-plugin/node_modules/jsesc": { + "version": "3.0.2", + "license": "MIT", + "bin": { + "jsesc": "bin/jsesc" + }, + "engines": { + "node": ">=6" + } + }, + "node_modules/@babel/helper-create-regexp-features-plugin/node_modules/regenerate-unicode-properties": { + "version": "10.2.0", + "license": "MIT", + "dependencies": { + "regenerate": "^1.4.2" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/@babel/helper-create-regexp-features-plugin/node_modules/regexpu-core": { + "version": "6.2.0", + "license": "MIT", + "dependencies": { + "regenerate": "^1.4.2", + "regenerate-unicode-properties": "^10.2.0", + "regjsgen": "^0.8.0", + "regjsparser": "^0.12.0", + "unicode-match-property-ecmascript": "^2.0.0", + "unicode-match-property-value-ecmascript": "^2.1.0" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/@babel/helper-create-regexp-features-plugin/node_modules/regjsparser": { + "version": "0.12.0", + "license": "BSD-2-Clause", + "dependencies": { + "jsesc": "~3.0.2" + }, + "bin": { + "regjsparser": "bin/parser" + } + }, + "node_modules/@babel/helper-define-polyfill-provider": { + "version": "0.6.5", + "license": "MIT", + "dependencies": { + "@babel/helper-compilation-targets": "^7.27.2", + "@babel/helper-plugin-utils": "^7.27.1", + "debug": "^4.4.1", + "lodash.debounce": "^4.0.8", + "resolve": "^1.22.10" + }, + "peerDependencies": { + "@babel/core": "^7.4.0 || ^8.0.0-0 <8.0.0" + } + }, + "node_modules/@babel/helper-define-polyfill-provider/node_modules/debug": { + "version": "4.4.1", + "license": "MIT", + "dependencies": { + "ms": "^2.1.3" + }, + "engines": { + "node": ">=6.0" + }, + "peerDependenciesMeta": { + "supports-color": { + "optional": true + } + } + }, + "node_modules/@babel/helper-globals": { + "version": "7.28.0", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/helper-member-expression-to-functions": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/traverse": "^7.27.1", + "@babel/types": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/helper-module-imports": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/traverse": "^7.27.1", + "@babel/types": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/helper-module-transforms": { + "version": "7.27.3", + "license": "MIT", + "dependencies": { + "@babel/helper-module-imports": "^7.27.1", + "@babel/helper-validator-identifier": "^7.27.1", + "@babel/traverse": "^7.27.3" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0" + } + }, + "node_modules/@babel/helper-optimise-call-expression": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/types": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/helper-plugin-utils": { + "version": "7.27.1", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/helper-remap-async-to-generator": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-annotate-as-pure": "^7.27.1", + "@babel/helper-wrap-function": "^7.27.1", + "@babel/traverse": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0" + } + }, + "node_modules/@babel/helper-replace-supers": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-member-expression-to-functions": "^7.27.1", + "@babel/helper-optimise-call-expression": "^7.27.1", + "@babel/traverse": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0" + } + }, + "node_modules/@babel/helper-skip-transparent-expression-wrappers": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/traverse": "^7.27.1", + "@babel/types": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/helper-string-parser": { + "version": "7.27.1", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/helper-validator-identifier": { + "version": "7.27.1", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/helper-validator-option": { + "version": "7.27.1", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/helper-wrap-function": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/template": "^7.27.1", + "@babel/traverse": "^7.27.1", + "@babel/types": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/helpers": { + "version": "7.27.6", + "license": "MIT", + "dependencies": { + "@babel/template": "^7.27.2", + "@babel/types": "^7.27.6" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/highlight": { + "version": "7.22.20", + "license": "MIT", + "dependencies": { + "@babel/helper-validator-identifier": "^7.22.20", + "chalk": "^2.4.2", + "js-tokens": "^4.0.0" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/highlight/node_modules/@babel/helper-validator-identifier": { + "version": "7.22.20", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/highlight/node_modules/ansi-styles": { + "version": "3.2.1", + "license": "MIT", + "dependencies": { + "color-convert": "^1.9.0" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/@babel/highlight/node_modules/chalk": { + "version": "2.4.2", + "license": "MIT", + "dependencies": { + "ansi-styles": "^3.2.1", + "escape-string-regexp": "^1.0.5", + "supports-color": "^5.3.0" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/@babel/highlight/node_modules/color-convert": { + "version": "1.9.3", + "license": "MIT", + "dependencies": { + "color-name": "1.1.3" + } + }, + "node_modules/@babel/highlight/node_modules/color-name": { + "version": "1.1.3", + "license": "MIT" + }, + "node_modules/@babel/highlight/node_modules/escape-string-regexp": { + "version": "1.0.5", + "license": "MIT", + "engines": { + "node": ">=0.8.0" + } + }, + "node_modules/@babel/highlight/node_modules/has-flag": { + "version": "3.0.0", + "license": "MIT", + "engines": { + "node": ">=4" + } + }, + "node_modules/@babel/highlight/node_modules/supports-color": { + "version": "5.5.0", + "license": "MIT", + "dependencies": { + "has-flag": "^3.0.0" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/@babel/parser": { + "version": "7.28.0", + "license": "MIT", + "dependencies": { + "@babel/types": "^7.28.0" + }, + "bin": { + "parser": "bin/babel-parser.js" + }, + "engines": { + "node": ">=6.0.0" + } + }, + "node_modules/@babel/plugin-bugfix-firefox-class-in-computed-class-key": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/traverse": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0" + } + }, + "node_modules/@babel/plugin-bugfix-safari-class-field-initializer-scope": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0" + } + }, + "node_modules/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0" + } + }, + "node_modules/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/helper-skip-transparent-expression-wrappers": "^7.27.1", + "@babel/plugin-transform-optional-chaining": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.13.0" + } + }, + "node_modules/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/traverse": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0" + } + }, + "node_modules/@babel/plugin-proposal-private-property-in-object": { + "version": "7.21.0-placeholder-for-preset-env.2", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-syntax-dynamic-import": { + "version": "7.8.3", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.8.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-syntax-dynamic-import/node_modules/@babel/helper-plugin-utils": { + "version": "7.22.5", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/plugin-syntax-import-assertions": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-syntax-import-attributes": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-syntax-jsx": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-syntax-typescript": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-syntax-unicode-sets-regex": { + "version": "7.18.6", + "license": "MIT", + "dependencies": { + "@babel/helper-create-regexp-features-plugin": "^7.18.6", + "@babel/helper-plugin-utils": "^7.18.6" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0" + } + }, + "node_modules/@babel/plugin-syntax-unicode-sets-regex/node_modules/@babel/helper-annotate-as-pure": { + "version": "7.22.5", + "license": "MIT", + "dependencies": { + "@babel/types": "^7.22.5" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/plugin-syntax-unicode-sets-regex/node_modules/@babel/helper-create-regexp-features-plugin": { + "version": "7.22.15", + "license": "MIT", + "dependencies": { + "@babel/helper-annotate-as-pure": "^7.22.5", + "regexpu-core": "^5.3.1", + "semver": "^6.3.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0" + } + }, + "node_modules/@babel/plugin-syntax-unicode-sets-regex/node_modules/@babel/helper-plugin-utils": { + "version": "7.22.5", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/plugin-syntax-unicode-sets-regex/node_modules/@babel/helper-string-parser": { + "version": "7.22.5", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/plugin-syntax-unicode-sets-regex/node_modules/@babel/helper-validator-identifier": { + "version": "7.22.20", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/plugin-syntax-unicode-sets-regex/node_modules/@babel/types": { + "version": "7.23.0", + "license": "MIT", + "dependencies": { + "@babel/helper-string-parser": "^7.22.5", + "@babel/helper-validator-identifier": "^7.22.20", + "to-fast-properties": "^2.0.0" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/plugin-transform-arrow-functions": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-async-generator-functions": { + "version": "7.28.0", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/helper-remap-async-to-generator": "^7.27.1", + "@babel/traverse": "^7.28.0" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-async-to-generator": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-module-imports": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/helper-remap-async-to-generator": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-block-scoped-functions": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-block-scoping": { + "version": "7.28.0", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-class-properties": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-create-class-features-plugin": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-class-static-block": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-create-class-features-plugin": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.12.0" + } + }, + "node_modules/@babel/plugin-transform-classes": { + "version": "7.28.0", + "license": "MIT", + "dependencies": { + "@babel/helper-annotate-as-pure": "^7.27.3", + "@babel/helper-compilation-targets": "^7.27.2", + "@babel/helper-globals": "^7.28.0", + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/helper-replace-supers": "^7.27.1", + "@babel/traverse": "^7.28.0" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-computed-properties": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/template": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-destructuring": { + "version": "7.28.0", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/traverse": "^7.28.0" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-dotall-regex": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-create-regexp-features-plugin": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-duplicate-keys": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-duplicate-named-capturing-groups-regex": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-create-regexp-features-plugin": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0" + } + }, + "node_modules/@babel/plugin-transform-dynamic-import": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-explicit-resource-management": { + "version": "7.28.0", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/plugin-transform-destructuring": "^7.28.0" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-exponentiation-operator": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-export-namespace-from": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-for-of": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/helper-skip-transparent-expression-wrappers": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-function-name": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-compilation-targets": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/traverse": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-json-strings": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-literals": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-logical-assignment-operators": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-member-expression-literals": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-modules-amd": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-module-transforms": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-modules-commonjs": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-module-transforms": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-modules-systemjs": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-module-transforms": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/helper-validator-identifier": "^7.27.1", + "@babel/traverse": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-modules-umd": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-module-transforms": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-named-capturing-groups-regex": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-create-regexp-features-plugin": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0" + } + }, + "node_modules/@babel/plugin-transform-new-target": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-nullish-coalescing-operator": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-numeric-separator": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-object-rest-spread": { + "version": "7.28.0", + "license": "MIT", + "dependencies": { + "@babel/helper-compilation-targets": "^7.27.2", + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/plugin-transform-destructuring": "^7.28.0", + "@babel/plugin-transform-parameters": "^7.27.7", + "@babel/traverse": "^7.28.0" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-object-super": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/helper-replace-supers": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-optional-catch-binding": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-optional-chaining": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/helper-skip-transparent-expression-wrappers": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-parameters": { + "version": "7.27.7", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-private-methods": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-create-class-features-plugin": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-private-property-in-object": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-annotate-as-pure": "^7.27.1", + "@babel/helper-create-class-features-plugin": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-property-literals": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-react-constant-elements": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-react-display-name": { + "version": "7.28.0", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-react-jsx": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-annotate-as-pure": "^7.27.1", + "@babel/helper-module-imports": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/plugin-syntax-jsx": "^7.27.1", + "@babel/types": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-react-jsx-development": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/plugin-transform-react-jsx": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-react-pure-annotations": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-annotate-as-pure": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-regenerator": { + "version": "7.28.0", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-regexp-modifiers": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-create-regexp-features-plugin": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0" + } + }, + "node_modules/@babel/plugin-transform-reserved-words": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-runtime": { + "version": "7.28.0", + "license": "MIT", + "dependencies": { + "@babel/helper-module-imports": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1", + "babel-plugin-polyfill-corejs2": "^0.4.14", + "babel-plugin-polyfill-corejs3": "^0.13.0", + "babel-plugin-polyfill-regenerator": "^0.6.5", + "semver": "^6.3.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-shorthand-properties": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-spread": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/helper-skip-transparent-expression-wrappers": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-sticky-regex": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-template-literals": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-typeof-symbol": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-typescript": { + "version": "7.28.0", + "license": "MIT", + "dependencies": { + "@babel/helper-annotate-as-pure": "^7.27.3", + "@babel/helper-create-class-features-plugin": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/helper-skip-transparent-expression-wrappers": "^7.27.1", + "@babel/plugin-syntax-typescript": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-unicode-escapes": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-unicode-property-regex": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-create-regexp-features-plugin": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-unicode-regex": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-create-regexp-features-plugin": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/plugin-transform-unicode-sets-regex": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-create-regexp-features-plugin": "^7.27.1", + "@babel/helper-plugin-utils": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0" + } + }, + "node_modules/@babel/preset-env": { + "version": "7.28.0", + "license": "MIT", + "dependencies": { + "@babel/compat-data": "^7.28.0", + "@babel/helper-compilation-targets": "^7.27.2", + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/helper-validator-option": "^7.27.1", + "@babel/plugin-bugfix-firefox-class-in-computed-class-key": "^7.27.1", + "@babel/plugin-bugfix-safari-class-field-initializer-scope": "^7.27.1", + "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": "^7.27.1", + "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": "^7.27.1", + "@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly": "^7.27.1", + "@babel/plugin-proposal-private-property-in-object": "7.21.0-placeholder-for-preset-env.2", + "@babel/plugin-syntax-import-assertions": "^7.27.1", + "@babel/plugin-syntax-import-attributes": "^7.27.1", + "@babel/plugin-syntax-unicode-sets-regex": "^7.18.6", + "@babel/plugin-transform-arrow-functions": "^7.27.1", + "@babel/plugin-transform-async-generator-functions": "^7.28.0", + "@babel/plugin-transform-async-to-generator": "^7.27.1", + "@babel/plugin-transform-block-scoped-functions": "^7.27.1", + "@babel/plugin-transform-block-scoping": "^7.28.0", + "@babel/plugin-transform-class-properties": "^7.27.1", + "@babel/plugin-transform-class-static-block": "^7.27.1", + "@babel/plugin-transform-classes": "^7.28.0", + "@babel/plugin-transform-computed-properties": "^7.27.1", + "@babel/plugin-transform-destructuring": "^7.28.0", + "@babel/plugin-transform-dotall-regex": "^7.27.1", + "@babel/plugin-transform-duplicate-keys": "^7.27.1", + "@babel/plugin-transform-duplicate-named-capturing-groups-regex": "^7.27.1", + "@babel/plugin-transform-dynamic-import": "^7.27.1", + "@babel/plugin-transform-explicit-resource-management": "^7.28.0", + "@babel/plugin-transform-exponentiation-operator": "^7.27.1", + "@babel/plugin-transform-export-namespace-from": "^7.27.1", + "@babel/plugin-transform-for-of": "^7.27.1", + "@babel/plugin-transform-function-name": "^7.27.1", + "@babel/plugin-transform-json-strings": "^7.27.1", + "@babel/plugin-transform-literals": "^7.27.1", + "@babel/plugin-transform-logical-assignment-operators": "^7.27.1", + "@babel/plugin-transform-member-expression-literals": "^7.27.1", + "@babel/plugin-transform-modules-amd": "^7.27.1", + "@babel/plugin-transform-modules-commonjs": "^7.27.1", + "@babel/plugin-transform-modules-systemjs": "^7.27.1", + "@babel/plugin-transform-modules-umd": "^7.27.1", + "@babel/plugin-transform-named-capturing-groups-regex": "^7.27.1", + "@babel/plugin-transform-new-target": "^7.27.1", + "@babel/plugin-transform-nullish-coalescing-operator": "^7.27.1", + "@babel/plugin-transform-numeric-separator": "^7.27.1", + "@babel/plugin-transform-object-rest-spread": "^7.28.0", + "@babel/plugin-transform-object-super": "^7.27.1", + "@babel/plugin-transform-optional-catch-binding": "^7.27.1", + "@babel/plugin-transform-optional-chaining": "^7.27.1", + "@babel/plugin-transform-parameters": "^7.27.7", + "@babel/plugin-transform-private-methods": "^7.27.1", + "@babel/plugin-transform-private-property-in-object": "^7.27.1", + "@babel/plugin-transform-property-literals": "^7.27.1", + "@babel/plugin-transform-regenerator": "^7.28.0", + "@babel/plugin-transform-regexp-modifiers": "^7.27.1", + "@babel/plugin-transform-reserved-words": "^7.27.1", + "@babel/plugin-transform-shorthand-properties": "^7.27.1", + "@babel/plugin-transform-spread": "^7.27.1", + "@babel/plugin-transform-sticky-regex": "^7.27.1", + "@babel/plugin-transform-template-literals": "^7.27.1", + "@babel/plugin-transform-typeof-symbol": "^7.27.1", + "@babel/plugin-transform-unicode-escapes": "^7.27.1", + "@babel/plugin-transform-unicode-property-regex": "^7.27.1", + "@babel/plugin-transform-unicode-regex": "^7.27.1", + "@babel/plugin-transform-unicode-sets-regex": "^7.27.1", + "@babel/preset-modules": "0.1.6-no-external-plugins", + "babel-plugin-polyfill-corejs2": "^0.4.14", + "babel-plugin-polyfill-corejs3": "^0.13.0", + "babel-plugin-polyfill-regenerator": "^0.6.5", + "core-js-compat": "^3.43.0", + "semver": "^6.3.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/preset-modules": { + "version": "0.1.6-no-external-plugins", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.0.0", + "@babel/types": "^7.4.4", + "esutils": "^2.0.2" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0 || ^8.0.0-0 <8.0.0" + } + }, + "node_modules/@babel/preset-modules/node_modules/@babel/helper-plugin-utils": { + "version": "7.22.5", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/preset-modules/node_modules/@babel/helper-string-parser": { + "version": "7.22.5", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/preset-modules/node_modules/@babel/helper-validator-identifier": { + "version": "7.22.20", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/preset-modules/node_modules/@babel/types": { + "version": "7.23.0", + "license": "MIT", + "dependencies": { + "@babel/helper-string-parser": "^7.22.5", + "@babel/helper-validator-identifier": "^7.22.20", + "to-fast-properties": "^2.0.0" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/preset-react": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/helper-validator-option": "^7.27.1", + "@babel/plugin-transform-react-display-name": "^7.27.1", + "@babel/plugin-transform-react-jsx": "^7.27.1", + "@babel/plugin-transform-react-jsx-development": "^7.27.1", + "@babel/plugin-transform-react-pure-annotations": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/preset-typescript": { + "version": "7.27.1", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.27.1", + "@babel/helper-validator-option": "^7.27.1", + "@babel/plugin-syntax-jsx": "^7.27.1", + "@babel/plugin-transform-modules-commonjs": "^7.27.1", + "@babel/plugin-transform-typescript": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@babel/regjsgen": { + "version": "0.8.0", + "license": "MIT" + }, + "node_modules/@babel/runtime": { + "version": "7.23.1", + "license": "MIT", + "dependencies": { + "regenerator-runtime": "^0.14.0" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/runtime-corejs3": { + "version": "7.28.0", + "license": "MIT", + "dependencies": { + "core-js-pure": "^3.43.0" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/template": { + "version": "7.27.2", + "license": "MIT", + "dependencies": { + "@babel/code-frame": "^7.27.1", + "@babel/parser": "^7.27.2", + "@babel/types": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/traverse": { + "version": "7.28.0", + "license": "MIT", + "dependencies": { + "@babel/code-frame": "^7.27.1", + "@babel/generator": "^7.28.0", + "@babel/helper-globals": "^7.28.0", + "@babel/parser": "^7.28.0", + "@babel/template": "^7.27.2", + "@babel/types": "^7.28.0", + "debug": "^4.3.1" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@babel/types": { + "version": "7.28.0", + "license": "MIT", + "dependencies": { + "@babel/helper-string-parser": "^7.27.1", + "@babel/helper-validator-identifier": "^7.27.1" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@colors/colors": { + "version": "1.5.0", + "license": "MIT", + "optional": true, + "engines": { + "node": ">=0.1.90" + } + }, + "node_modules/@csstools/cascade-layer-name-parser": { + "version": "2.0.5", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT", + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4" + } + }, + "node_modules/@csstools/color-helpers": { + "version": "5.0.2", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "engines": { + "node": ">=18" + } + }, + "node_modules/@csstools/css-calc": { + "version": "2.1.4", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT", + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4" + } + }, + "node_modules/@csstools/css-color-parser": { + "version": "3.0.10", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT", + "dependencies": { + "@csstools/color-helpers": "^5.0.2", + "@csstools/css-calc": "^2.1.4" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4" + } + }, + "node_modules/@csstools/css-parser-algorithms": { + "version": "3.0.5", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT", + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "@csstools/css-tokenizer": "^3.0.4" + } + }, + "node_modules/@csstools/css-tokenizer": { + "version": "3.0.4", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT", + "engines": { + "node": ">=18" + } + }, + "node_modules/@csstools/media-query-list-parser": { + "version": "4.0.3", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT", + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4" + } + }, + "node_modules/@csstools/selector-resolve-nested": { + "version": "3.1.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss-selector-parser": "^7.0.0" + } + }, + "node_modules/@csstools/selector-specificity": { + "version": "5.0.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss-selector-parser": "^7.0.0" + } + }, + "node_modules/@discoveryjs/json-ext": { + "version": "0.5.7", + "license": "MIT", + "engines": { + "node": ">=10.0.0" + } + }, + "node_modules/@docsearch/css": { + "version": "3.9.0", + "license": "MIT" + }, + "node_modules/@docsearch/react": { + "version": "3.9.0", + "license": "MIT", + "dependencies": { + "@algolia/autocomplete-core": "1.17.9", + "@algolia/autocomplete-preset-algolia": "1.17.9", + "@docsearch/css": "3.9.0", + "algoliasearch": "^5.14.2" + }, + "peerDependencies": { + "@types/react": ">= 16.8.0 < 20.0.0", + "react": ">= 16.8.0 < 20.0.0", + "react-dom": ">= 16.8.0 < 20.0.0", + "search-insights": ">= 1 < 3" + }, + "peerDependenciesMeta": { + "@types/react": { + "optional": true + }, + "react": { + "optional": true + }, + "react-dom": { + "optional": true + }, + "search-insights": { + "optional": true + } + } + }, + "node_modules/@docusaurus/babel": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "@babel/core": "^7.25.9", + "@babel/generator": "^7.25.9", + "@babel/plugin-syntax-dynamic-import": "^7.8.3", + "@babel/plugin-transform-runtime": "^7.25.9", + "@babel/preset-env": "^7.25.9", + "@babel/preset-react": "^7.25.9", + "@babel/preset-typescript": "^7.25.9", + "@babel/runtime": "^7.25.9", + "@babel/runtime-corejs3": "^7.25.9", + "@babel/traverse": "^7.25.9", + "@docusaurus/logger": "3.8.1", + "@docusaurus/utils": "3.8.1", + "babel-plugin-dynamic-import-node": "^2.3.3", + "fs-extra": "^11.1.1", + "tslib": "^2.6.0" + }, + "engines": { + "node": ">=18.0" + } + }, + "node_modules/@docusaurus/babel/node_modules/@babel/runtime": { + "version": "7.27.6", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@docusaurus/bundler": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "@babel/core": "^7.25.9", + "@docusaurus/babel": "3.8.1", + "@docusaurus/cssnano-preset": "3.8.1", + "@docusaurus/logger": "3.8.1", + "@docusaurus/types": "3.8.1", + "@docusaurus/utils": "3.8.1", + "babel-loader": "^9.2.1", + "clean-css": "^5.3.3", + "copy-webpack-plugin": "^11.0.0", + "css-loader": "^6.11.0", + "css-minimizer-webpack-plugin": "^5.0.1", + "cssnano": "^6.1.2", + "file-loader": "^6.2.0", + "html-minifier-terser": "^7.2.0", + "mini-css-extract-plugin": "^2.9.2", + "null-loader": "^4.0.1", + "postcss": "^8.5.4", + "postcss-loader": "^7.3.4", + "postcss-preset-env": "^10.2.1", + "terser-webpack-plugin": "^5.3.9", + "tslib": "^2.6.0", + "url-loader": "^4.1.1", + "webpack": "^5.95.0", + "webpackbar": "^6.0.1" + }, + "engines": { + "node": ">=18.0" + }, + "peerDependencies": { + "@docusaurus/faster": "*" + }, + "peerDependenciesMeta": { + "@docusaurus/faster": { + "optional": true + } + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-cascade-layers": { + "version": "5.0.2", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/selector-specificity": "^5.0.0", + "postcss-selector-parser": "^7.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-color-function": { + "version": "4.0.10", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/css-color-parser": "^3.0.10", + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4", + "@csstools/postcss-progressive-custom-properties": "^4.1.0", + "@csstools/utilities": "^2.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-color-mix-function": { + "version": "3.0.10", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/css-color-parser": "^3.0.10", + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4", + "@csstools/postcss-progressive-custom-properties": "^4.1.0", + "@csstools/utilities": "^2.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-color-mix-variadic-function-arguments": { + "version": "1.0.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/css-color-parser": "^3.0.10", + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4", + "@csstools/postcss-progressive-custom-properties": "^4.1.0", + "@csstools/utilities": "^2.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-content-alt-text": { + "version": "2.0.6", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4", + "@csstools/postcss-progressive-custom-properties": "^4.1.0", + "@csstools/utilities": "^2.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-exponential-functions": { + "version": "2.0.9", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/css-calc": "^2.1.4", + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-font-format-keywords": { + "version": "4.0.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/utilities": "^2.0.0", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-gamut-mapping": { + "version": "2.0.10", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/css-color-parser": "^3.0.10", + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-gradients-interpolation-method": { + "version": "5.0.10", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/css-color-parser": "^3.0.10", + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4", + "@csstools/postcss-progressive-custom-properties": "^4.1.0", + "@csstools/utilities": "^2.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-hwb-function": { + "version": "4.0.10", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/css-color-parser": "^3.0.10", + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4", + "@csstools/postcss-progressive-custom-properties": "^4.1.0", + "@csstools/utilities": "^2.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-ic-unit": { + "version": "4.0.2", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/postcss-progressive-custom-properties": "^4.1.0", + "@csstools/utilities": "^2.0.0", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-initial": { + "version": "2.0.1", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-is-pseudo-class": { + "version": "5.0.3", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/selector-specificity": "^5.0.0", + "postcss-selector-parser": "^7.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-light-dark-function": { + "version": "2.0.9", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4", + "@csstools/postcss-progressive-custom-properties": "^4.1.0", + "@csstools/utilities": "^2.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-logical-float-and-clear": { + "version": "3.0.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-logical-overflow": { + "version": "2.0.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-logical-overscroll-behavior": { + "version": "2.0.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-logical-resize": { + "version": "3.0.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-logical-viewport-units": { + "version": "3.0.4", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/css-tokenizer": "^3.0.4", + "@csstools/utilities": "^2.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-media-minmax": { + "version": "2.0.9", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT", + "dependencies": { + "@csstools/css-calc": "^2.1.4", + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4", + "@csstools/media-query-list-parser": "^4.0.3" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-media-queries-aspect-ratio-number-values": { + "version": "3.0.5", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4", + "@csstools/media-query-list-parser": "^4.0.3" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-nested-calc": { + "version": "4.0.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/utilities": "^2.0.0", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-normalize-display-values": { + "version": "4.0.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-oklab-function": { + "version": "4.0.10", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/css-color-parser": "^3.0.10", + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4", + "@csstools/postcss-progressive-custom-properties": "^4.1.0", + "@csstools/utilities": "^2.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-progressive-custom-properties": { + "version": "4.1.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-random-function": { + "version": "2.0.1", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/css-calc": "^2.1.4", + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-relative-color-syntax": { + "version": "3.0.10", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/css-color-parser": "^3.0.10", + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4", + "@csstools/postcss-progressive-custom-properties": "^4.1.0", + "@csstools/utilities": "^2.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-scope-pseudo-class": { + "version": "4.0.1", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "postcss-selector-parser": "^7.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-sign-functions": { + "version": "1.1.4", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/css-calc": "^2.1.4", + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-stepped-value-functions": { + "version": "4.0.9", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/css-calc": "^2.1.4", + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-text-decoration-shorthand": { + "version": "4.0.2", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/color-helpers": "^5.0.2", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-trigonometric-functions": { + "version": "4.0.9", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/css-calc": "^2.1.4", + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/postcss-unset-value": { + "version": "4.0.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/@csstools/utilities": { + "version": "2.0.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/autoprefixer": { + "version": "10.4.21", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/postcss/" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/autoprefixer" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "browserslist": "^4.24.4", + "caniuse-lite": "^1.0.30001702", + "fraction.js": "^4.3.7", + "normalize-range": "^0.1.2", + "picocolors": "^1.1.1", + "postcss-value-parser": "^4.2.0" + }, + "bin": { + "autoprefixer": "bin/autoprefixer" + }, + "engines": { + "node": "^10 || ^12 || >=14" + }, + "peerDependencies": { + "postcss": "^8.1.0" + } + }, + "node_modules/@docusaurus/bundler/node_modules/autoprefixer/node_modules/browserslist": { + "version": "4.24.4", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/browserslist" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/browserslist" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "caniuse-lite": "^1.0.30001688", + "electron-to-chromium": "^1.5.73", + "node-releases": "^2.0.19", + "update-browserslist-db": "^1.1.1" + }, + "bin": { + "browserslist": "cli.js" + }, + "engines": { + "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7" + } + }, + "node_modules/@docusaurus/bundler/node_modules/autoprefixer/node_modules/update-browserslist-db": { + "version": "1.1.3", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/browserslist" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/browserslist" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "escalade": "^3.2.0", + "picocolors": "^1.1.1" + }, + "bin": { + "update-browserslist-db": "cli.js" + }, + "peerDependencies": { + "browserslist": ">= 4.21.0" + } + }, + "node_modules/@docusaurus/bundler/node_modules/css-blank-pseudo": { + "version": "7.0.1", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "postcss-selector-parser": "^7.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/css-declaration-sorter": { + "version": "7.2.0", + "license": "ISC", + "engines": { + "node": "^14 || ^16 || >=18" + }, + "peerDependencies": { + "postcss": "^8.0.9" + } + }, + "node_modules/@docusaurus/bundler/node_modules/css-has-pseudo": { + "version": "7.0.2", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/selector-specificity": "^5.0.0", + "postcss-selector-parser": "^7.0.0", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/css-prefers-color-scheme": { + "version": "10.0.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/cssnano": { + "version": "6.1.2", + "license": "MIT", + "dependencies": { + "cssnano-preset-default": "^6.1.2", + "lilconfig": "^3.1.1" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/cssnano" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/cssnano-preset-default": { + "version": "6.1.2", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "css-declaration-sorter": "^7.2.0", + "cssnano-utils": "^4.0.2", + "postcss-calc": "^9.0.1", + "postcss-colormin": "^6.1.0", + "postcss-convert-values": "^6.1.0", + "postcss-discard-comments": "^6.0.2", + "postcss-discard-duplicates": "^6.0.3", + "postcss-discard-empty": "^6.0.3", + "postcss-discard-overridden": "^6.0.2", + "postcss-merge-longhand": "^6.0.5", + "postcss-merge-rules": "^6.1.1", + "postcss-minify-font-values": "^6.1.0", + "postcss-minify-gradients": "^6.0.3", + "postcss-minify-params": "^6.1.0", + "postcss-minify-selectors": "^6.0.4", + "postcss-normalize-charset": "^6.0.2", + "postcss-normalize-display-values": "^6.0.2", + "postcss-normalize-positions": "^6.0.2", + "postcss-normalize-repeat-style": "^6.0.2", + "postcss-normalize-string": "^6.0.2", + "postcss-normalize-timing-functions": "^6.0.2", + "postcss-normalize-unicode": "^6.1.0", + "postcss-normalize-url": "^6.0.2", + "postcss-normalize-whitespace": "^6.0.2", + "postcss-ordered-values": "^6.0.2", + "postcss-reduce-initial": "^6.1.0", + "postcss-reduce-transforms": "^6.0.2", + "postcss-svgo": "^6.0.3", + "postcss-unique-selectors": "^6.0.4" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/cssnano-utils": { + "version": "4.0.2", + "license": "MIT", + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/electron-to-chromium": { + "version": "1.5.129", + "license": "ISC" + }, + "node_modules/@docusaurus/bundler/node_modules/escalade": { + "version": "3.2.0", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/@docusaurus/bundler/node_modules/nanoid": { + "version": "3.3.11", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "bin": { + "nanoid": "bin/nanoid.cjs" + }, + "engines": { + "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss": { + "version": "8.5.6", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/postcss/" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/postcss" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "nanoid": "^3.3.11", + "picocolors": "^1.1.1", + "source-map-js": "^1.2.1" + }, + "engines": { + "node": "^10 || ^12 || >=14" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-attribute-case-insensitive": { + "version": "7.0.1", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT", + "dependencies": { + "postcss-selector-parser": "^7.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-calc": { + "version": "9.0.1", + "license": "MIT", + "dependencies": { + "postcss-selector-parser": "^6.0.11", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.2.2" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-calc/node_modules/postcss-selector-parser": { + "version": "6.1.2", + "license": "MIT", + "dependencies": { + "cssesc": "^3.0.0", + "util-deprecate": "^1.0.2" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-clamp": { + "version": "4.1.0", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": ">=7.6.0" + }, + "peerDependencies": { + "postcss": "^8.4.6" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-color-functional-notation": { + "version": "7.0.10", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/css-color-parser": "^3.0.10", + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4", + "@csstools/postcss-progressive-custom-properties": "^4.1.0", + "@csstools/utilities": "^2.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-color-hex-alpha": { + "version": "10.0.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT", + "dependencies": { + "@csstools/utilities": "^2.0.0", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-color-rebeccapurple": { + "version": "10.0.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/utilities": "^2.0.0", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-colormin": { + "version": "6.1.0", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "caniuse-api": "^3.0.0", + "colord": "^2.9.3", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-convert-values": { + "version": "6.1.0", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-custom-media": { + "version": "11.0.6", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT", + "dependencies": { + "@csstools/cascade-layer-name-parser": "^2.0.5", + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4", + "@csstools/media-query-list-parser": "^4.0.3" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-custom-properties": { + "version": "14.0.6", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT", + "dependencies": { + "@csstools/cascade-layer-name-parser": "^2.0.5", + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4", + "@csstools/utilities": "^2.0.0", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-custom-selectors": { + "version": "8.0.5", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT", + "dependencies": { + "@csstools/cascade-layer-name-parser": "^2.0.5", + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4", + "postcss-selector-parser": "^7.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-dir-pseudo-class": { + "version": "9.0.1", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "postcss-selector-parser": "^7.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-discard-comments": { + "version": "6.0.2", + "license": "MIT", + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-discard-duplicates": { + "version": "6.0.3", + "license": "MIT", + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-discard-empty": { + "version": "6.0.3", + "license": "MIT", + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-discard-overridden": { + "version": "6.0.2", + "license": "MIT", + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-double-position-gradients": { + "version": "6.0.2", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/postcss-progressive-custom-properties": "^4.1.0", + "@csstools/utilities": "^2.0.0", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-focus-visible": { + "version": "10.0.1", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "postcss-selector-parser": "^7.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-focus-within": { + "version": "9.0.1", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "postcss-selector-parser": "^7.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-font-variant": { + "version": "5.0.0", + "license": "MIT", + "peerDependencies": { + "postcss": "^8.1.0" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-gap-properties": { + "version": "6.0.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-image-set-function": { + "version": "7.0.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/utilities": "^2.0.0", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-lab-function": { + "version": "7.0.10", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/css-color-parser": "^3.0.10", + "@csstools/css-parser-algorithms": "^3.0.5", + "@csstools/css-tokenizer": "^3.0.4", + "@csstools/postcss-progressive-custom-properties": "^4.1.0", + "@csstools/utilities": "^2.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-loader": { + "version": "7.3.4", + "license": "MIT", + "dependencies": { + "cosmiconfig": "^8.3.5", + "jiti": "^1.20.0", + "semver": "^7.5.4" + }, + "engines": { + "node": ">= 14.15.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + }, + "peerDependencies": { + "postcss": "^7.0.0 || ^8.0.1", + "webpack": "^5.0.0" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-logical": { + "version": "8.1.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-merge-longhand": { + "version": "6.0.5", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0", + "stylehacks": "^6.1.1" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-merge-rules": { + "version": "6.1.1", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "caniuse-api": "^3.0.0", + "cssnano-utils": "^4.0.2", + "postcss-selector-parser": "^6.0.16" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-merge-rules/node_modules/postcss-selector-parser": { + "version": "6.1.2", + "license": "MIT", + "dependencies": { + "cssesc": "^3.0.0", + "util-deprecate": "^1.0.2" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-minify-font-values": { + "version": "6.1.0", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-minify-gradients": { + "version": "6.0.3", + "license": "MIT", + "dependencies": { + "colord": "^2.9.3", + "cssnano-utils": "^4.0.2", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-minify-params": { + "version": "6.1.0", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "cssnano-utils": "^4.0.2", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-minify-selectors": { + "version": "6.0.4", + "license": "MIT", + "dependencies": { + "postcss-selector-parser": "^6.0.16" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-minify-selectors/node_modules/postcss-selector-parser": { + "version": "6.1.2", + "license": "MIT", + "dependencies": { + "cssesc": "^3.0.0", + "util-deprecate": "^1.0.2" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-nesting": { + "version": "13.0.2", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/selector-resolve-nested": "^3.1.0", + "@csstools/selector-specificity": "^5.0.0", + "postcss-selector-parser": "^7.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-normalize-charset": { + "version": "6.0.2", + "license": "MIT", + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-normalize-display-values": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-normalize-positions": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-normalize-repeat-style": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-normalize-string": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-normalize-timing-functions": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-normalize-unicode": { + "version": "6.1.0", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-normalize-url": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-normalize-whitespace": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-opacity-percentage": { + "version": "3.0.0", + "funding": [ + { + "type": "kofi", + "url": "https://ko-fi.com/mrcgrtz" + }, + { + "type": "liberapay", + "url": "https://liberapay.com/mrcgrtz" + } + ], + "license": "MIT", + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-ordered-values": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "cssnano-utils": "^4.0.2", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-overflow-shorthand": { + "version": "6.0.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-page-break": { + "version": "3.0.4", + "license": "MIT", + "peerDependencies": { + "postcss": "^8" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-place": { + "version": "10.0.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-preset-env": { + "version": "10.2.4", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "@csstools/postcss-cascade-layers": "^5.0.2", + "@csstools/postcss-color-function": "^4.0.10", + "@csstools/postcss-color-mix-function": "^3.0.10", + "@csstools/postcss-color-mix-variadic-function-arguments": "^1.0.0", + "@csstools/postcss-content-alt-text": "^2.0.6", + "@csstools/postcss-exponential-functions": "^2.0.9", + "@csstools/postcss-font-format-keywords": "^4.0.0", + "@csstools/postcss-gamut-mapping": "^2.0.10", + "@csstools/postcss-gradients-interpolation-method": "^5.0.10", + "@csstools/postcss-hwb-function": "^4.0.10", + "@csstools/postcss-ic-unit": "^4.0.2", + "@csstools/postcss-initial": "^2.0.1", + "@csstools/postcss-is-pseudo-class": "^5.0.3", + "@csstools/postcss-light-dark-function": "^2.0.9", + "@csstools/postcss-logical-float-and-clear": "^3.0.0", + "@csstools/postcss-logical-overflow": "^2.0.0", + "@csstools/postcss-logical-overscroll-behavior": "^2.0.0", + "@csstools/postcss-logical-resize": "^3.0.0", + "@csstools/postcss-logical-viewport-units": "^3.0.4", + "@csstools/postcss-media-minmax": "^2.0.9", + "@csstools/postcss-media-queries-aspect-ratio-number-values": "^3.0.5", + "@csstools/postcss-nested-calc": "^4.0.0", + "@csstools/postcss-normalize-display-values": "^4.0.0", + "@csstools/postcss-oklab-function": "^4.0.10", + "@csstools/postcss-progressive-custom-properties": "^4.1.0", + "@csstools/postcss-random-function": "^2.0.1", + "@csstools/postcss-relative-color-syntax": "^3.0.10", + "@csstools/postcss-scope-pseudo-class": "^4.0.1", + "@csstools/postcss-sign-functions": "^1.1.4", + "@csstools/postcss-stepped-value-functions": "^4.0.9", + "@csstools/postcss-text-decoration-shorthand": "^4.0.2", + "@csstools/postcss-trigonometric-functions": "^4.0.9", + "@csstools/postcss-unset-value": "^4.0.0", + "autoprefixer": "^10.4.21", + "browserslist": "^4.25.0", + "css-blank-pseudo": "^7.0.1", + "css-has-pseudo": "^7.0.2", + "css-prefers-color-scheme": "^10.0.0", + "cssdb": "^8.3.0", + "postcss-attribute-case-insensitive": "^7.0.1", + "postcss-clamp": "^4.1.0", + "postcss-color-functional-notation": "^7.0.10", + "postcss-color-hex-alpha": "^10.0.0", + "postcss-color-rebeccapurple": "^10.0.0", + "postcss-custom-media": "^11.0.6", + "postcss-custom-properties": "^14.0.6", + "postcss-custom-selectors": "^8.0.5", + "postcss-dir-pseudo-class": "^9.0.1", + "postcss-double-position-gradients": "^6.0.2", + "postcss-focus-visible": "^10.0.1", + "postcss-focus-within": "^9.0.1", + "postcss-font-variant": "^5.0.0", + "postcss-gap-properties": "^6.0.0", + "postcss-image-set-function": "^7.0.0", + "postcss-lab-function": "^7.0.10", + "postcss-logical": "^8.1.0", + "postcss-nesting": "^13.0.2", + "postcss-opacity-percentage": "^3.0.0", + "postcss-overflow-shorthand": "^6.0.0", + "postcss-page-break": "^3.0.4", + "postcss-place": "^10.0.0", + "postcss-pseudo-class-any-link": "^10.0.1", + "postcss-replace-overflow-wrap": "^4.0.0", + "postcss-selector-not": "^8.0.1" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-pseudo-class-any-link": { + "version": "10.0.1", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT-0", + "dependencies": { + "postcss-selector-parser": "^7.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-reduce-initial": { + "version": "6.1.0", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "caniuse-api": "^3.0.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-reduce-transforms": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-replace-overflow-wrap": { + "version": "4.0.0", + "license": "MIT", + "peerDependencies": { + "postcss": "^8.0.3" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-selector-not": { + "version": "8.0.1", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + } + ], + "license": "MIT", + "dependencies": { + "postcss-selector-parser": "^7.0.0" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "postcss": "^8.4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-svgo": { + "version": "6.0.3", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0", + "svgo": "^3.2.0" + }, + "engines": { + "node": "^14 || ^16 || >= 18" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-unique-selectors": { + "version": "6.0.4", + "license": "MIT", + "dependencies": { + "postcss-selector-parser": "^6.0.16" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/postcss-unique-selectors/node_modules/postcss-selector-parser": { + "version": "6.1.2", + "license": "MIT", + "dependencies": { + "cssesc": "^3.0.0", + "util-deprecate": "^1.0.2" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/@docusaurus/bundler/node_modules/semver": { + "version": "7.7.2", + "license": "ISC", + "bin": { + "semver": "bin/semver.js" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/@docusaurus/bundler/node_modules/stylehacks": { + "version": "6.1.1", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "postcss-selector-parser": "^6.0.16" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/bundler/node_modules/stylehacks/node_modules/postcss-selector-parser": { + "version": "6.1.2", + "license": "MIT", + "dependencies": { + "cssesc": "^3.0.0", + "util-deprecate": "^1.0.2" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/@docusaurus/core": { + "version": "3.8.1", + "resolved": "https://registry.npmjs.org/@docusaurus/core/-/core-3.8.1.tgz", + "integrity": "sha512-ENB01IyQSqI2FLtOzqSI3qxG2B/jP4gQPahl2C3XReiLebcVh5B5cB9KYFvdoOqOWPyr5gXK4sjgTKv7peXCrA==", + "license": "MIT", + "dependencies": { + "@docusaurus/babel": "3.8.1", + "@docusaurus/bundler": "3.8.1", + "@docusaurus/logger": "3.8.1", + "@docusaurus/mdx-loader": "3.8.1", + "@docusaurus/utils": "3.8.1", + "@docusaurus/utils-common": "3.8.1", + "@docusaurus/utils-validation": "3.8.1", + "boxen": "^6.2.1", + "chalk": "^4.1.2", + "chokidar": "^3.5.3", + "cli-table3": "^0.6.3", + "combine-promises": "^1.1.0", + "commander": "^5.1.0", + "core-js": "^3.31.1", + "detect-port": "^1.5.1", + "escape-html": "^1.0.3", + "eta": "^2.2.0", + "eval": "^0.1.8", + "execa": "5.1.1", + "fs-extra": "^11.1.1", + "html-tags": "^3.3.1", + "html-webpack-plugin": "^5.6.0", + "leven": "^3.1.0", + "lodash": "^4.17.21", + "open": "^8.4.0", + "p-map": "^4.0.0", + "prompts": "^2.4.2", + "react-helmet-async": "npm:@slorber/react-helmet-async@1.3.0", + "react-loadable": "npm:@docusaurus/react-loadable@6.0.0", + "react-loadable-ssr-addon-v5-slorber": "^1.0.1", + "react-router": "^5.3.4", + "react-router-config": "^5.1.1", + "react-router-dom": "^5.3.4", + "semver": "^7.5.4", + "serve-handler": "^6.1.6", + "tinypool": "^1.0.2", + "tslib": "^2.6.0", + "update-notifier": "^6.0.2", + "webpack": "^5.95.0", + "webpack-bundle-analyzer": "^4.10.2", + "webpack-dev-server": "^4.15.2", + "webpack-merge": "^6.0.1" + }, + "bin": { + "docusaurus": "bin/docusaurus.mjs" + }, + "engines": { + "node": ">=18.0" + }, + "peerDependencies": { + "@mdx-js/react": "^3.0.0", + "react": "^18.0.0 || ^19.0.0", + "react-dom": "^18.0.0 || ^19.0.0" + } + }, + "node_modules/@docusaurus/core/node_modules/semver": { + "version": "7.7.2", + "license": "ISC", + "bin": { + "semver": "bin/semver.js" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/@docusaurus/core/node_modules/webpack-merge": { + "version": "6.0.1", + "license": "MIT", + "dependencies": { + "clone-deep": "^4.0.1", + "flat": "^5.0.2", + "wildcard": "^2.0.1" + }, + "engines": { + "node": ">=18.0.0" + } + }, + "node_modules/@docusaurus/cssnano-preset": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "cssnano-preset-advanced": "^6.1.2", + "postcss": "^8.5.4", + "postcss-sort-media-queries": "^5.2.0", + "tslib": "^2.6.0" + }, + "engines": { + "node": ">=18.0" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/autoprefixer": { + "version": "10.4.21", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/postcss/" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/autoprefixer" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "browserslist": "^4.24.4", + "caniuse-lite": "^1.0.30001702", + "fraction.js": "^4.3.7", + "normalize-range": "^0.1.2", + "picocolors": "^1.1.1", + "postcss-value-parser": "^4.2.0" + }, + "bin": { + "autoprefixer": "bin/autoprefixer" + }, + "engines": { + "node": "^10 || ^12 || >=14" + }, + "peerDependencies": { + "postcss": "^8.1.0" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/autoprefixer/node_modules/browserslist": { + "version": "4.24.4", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/browserslist" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/browserslist" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "caniuse-lite": "^1.0.30001688", + "electron-to-chromium": "^1.5.73", + "node-releases": "^2.0.19", + "update-browserslist-db": "^1.1.1" + }, + "bin": { + "browserslist": "cli.js" + }, + "engines": { + "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/autoprefixer/node_modules/update-browserslist-db": { + "version": "1.1.3", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/browserslist" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/browserslist" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "escalade": "^3.2.0", + "picocolors": "^1.1.1" + }, + "bin": { + "update-browserslist-db": "cli.js" + }, + "peerDependencies": { + "browserslist": ">= 4.21.0" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/css-declaration-sorter": { + "version": "7.2.0", + "license": "ISC", + "engines": { + "node": "^14 || ^16 || >=18" + }, + "peerDependencies": { + "postcss": "^8.0.9" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/cssnano-preset-advanced": { + "version": "6.1.2", + "license": "MIT", + "dependencies": { + "autoprefixer": "^10.4.19", + "browserslist": "^4.23.0", + "cssnano-preset-default": "^6.1.2", + "postcss-discard-unused": "^6.0.5", + "postcss-merge-idents": "^6.0.3", + "postcss-reduce-idents": "^6.0.3", + "postcss-zindex": "^6.0.2" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/cssnano-preset-default": { + "version": "6.1.2", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "css-declaration-sorter": "^7.2.0", + "cssnano-utils": "^4.0.2", + "postcss-calc": "^9.0.1", + "postcss-colormin": "^6.1.0", + "postcss-convert-values": "^6.1.0", + "postcss-discard-comments": "^6.0.2", + "postcss-discard-duplicates": "^6.0.3", + "postcss-discard-empty": "^6.0.3", + "postcss-discard-overridden": "^6.0.2", + "postcss-merge-longhand": "^6.0.5", + "postcss-merge-rules": "^6.1.1", + "postcss-minify-font-values": "^6.1.0", + "postcss-minify-gradients": "^6.0.3", + "postcss-minify-params": "^6.1.0", + "postcss-minify-selectors": "^6.0.4", + "postcss-normalize-charset": "^6.0.2", + "postcss-normalize-display-values": "^6.0.2", + "postcss-normalize-positions": "^6.0.2", + "postcss-normalize-repeat-style": "^6.0.2", + "postcss-normalize-string": "^6.0.2", + "postcss-normalize-timing-functions": "^6.0.2", + "postcss-normalize-unicode": "^6.1.0", + "postcss-normalize-url": "^6.0.2", + "postcss-normalize-whitespace": "^6.0.2", + "postcss-ordered-values": "^6.0.2", + "postcss-reduce-initial": "^6.1.0", + "postcss-reduce-transforms": "^6.0.2", + "postcss-svgo": "^6.0.3", + "postcss-unique-selectors": "^6.0.4" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/cssnano-utils": { + "version": "4.0.2", + "license": "MIT", + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/electron-to-chromium": { + "version": "1.5.129", + "license": "ISC" + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/escalade": { + "version": "3.2.0", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/nanoid": { + "version": "3.3.11", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "bin": { + "nanoid": "bin/nanoid.cjs" + }, + "engines": { + "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss": { + "version": "8.5.6", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/postcss/" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/postcss" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "nanoid": "^3.3.11", + "picocolors": "^1.1.1", + "source-map-js": "^1.2.1" + }, + "engines": { + "node": "^10 || ^12 || >=14" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-calc": { + "version": "9.0.1", + "license": "MIT", + "dependencies": { + "postcss-selector-parser": "^6.0.11", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.2.2" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-colormin": { + "version": "6.1.0", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "caniuse-api": "^3.0.0", + "colord": "^2.9.3", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-convert-values": { + "version": "6.1.0", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-discard-comments": { + "version": "6.0.2", + "license": "MIT", + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-discard-duplicates": { + "version": "6.0.3", + "license": "MIT", + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-discard-empty": { + "version": "6.0.3", + "license": "MIT", + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-discard-overridden": { + "version": "6.0.2", + "license": "MIT", + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-discard-unused": { + "version": "6.0.5", + "license": "MIT", + "dependencies": { + "postcss-selector-parser": "^6.0.16" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-merge-idents": { + "version": "6.0.3", + "license": "MIT", + "dependencies": { + "cssnano-utils": "^4.0.2", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-merge-longhand": { + "version": "6.0.5", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0", + "stylehacks": "^6.1.1" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-merge-rules": { + "version": "6.1.1", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "caniuse-api": "^3.0.0", + "cssnano-utils": "^4.0.2", + "postcss-selector-parser": "^6.0.16" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-minify-font-values": { + "version": "6.1.0", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-minify-gradients": { + "version": "6.0.3", + "license": "MIT", + "dependencies": { + "colord": "^2.9.3", + "cssnano-utils": "^4.0.2", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-minify-params": { + "version": "6.1.0", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "cssnano-utils": "^4.0.2", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-minify-selectors": { + "version": "6.0.4", + "license": "MIT", + "dependencies": { + "postcss-selector-parser": "^6.0.16" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-normalize-charset": { + "version": "6.0.2", + "license": "MIT", + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-normalize-display-values": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-normalize-positions": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-normalize-repeat-style": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-normalize-string": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-normalize-timing-functions": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-normalize-unicode": { + "version": "6.1.0", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-normalize-url": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-normalize-whitespace": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-ordered-values": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "cssnano-utils": "^4.0.2", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-reduce-idents": { + "version": "6.0.3", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-reduce-initial": { + "version": "6.1.0", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "caniuse-api": "^3.0.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-reduce-transforms": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-selector-parser": { + "version": "6.1.2", + "license": "MIT", + "dependencies": { + "cssesc": "^3.0.0", + "util-deprecate": "^1.0.2" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-sort-media-queries": { + "version": "5.2.0", + "license": "MIT", + "dependencies": { + "sort-css-media-queries": "2.2.0" + }, + "engines": { + "node": ">=14.0.0" + }, + "peerDependencies": { + "postcss": "^8.4.23" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-svgo": { + "version": "6.0.3", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0", + "svgo": "^3.2.0" + }, + "engines": { + "node": "^14 || ^16 || >= 18" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-unique-selectors": { + "version": "6.0.4", + "license": "MIT", + "dependencies": { + "postcss-selector-parser": "^6.0.16" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/postcss-zindex": { + "version": "6.0.2", + "license": "MIT", + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/cssnano-preset/node_modules/stylehacks": { + "version": "6.1.1", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "postcss-selector-parser": "^6.0.16" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/@docusaurus/eslint-plugin": { + "version": "3.8.1", + "resolved": "https://registry.npmjs.org/@docusaurus/eslint-plugin/-/eslint-plugin-3.8.1.tgz", + "integrity": "sha512-moiMzNuUpWaIcoEqZP4FzFGk4j8Gg/fYJYc9lpTWZplsy4GswGZw150rPuFcZ1lW65kuKVeGqu/E60JG37AX5Q==", + "dev": true, + "license": "MIT", + "dependencies": { + "@typescript-eslint/utils": "^5.62.0", + "tslib": "^2.6.0" + }, + "engines": { + "node": ">=18.0" + }, + "peerDependencies": { + "eslint": ">=6" + } + }, + "node_modules/@docusaurus/logger": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "chalk": "^4.1.2", + "tslib": "^2.6.0" + }, + "engines": { + "node": ">=18.0" + } + }, + "node_modules/@docusaurus/mdx-loader": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "@docusaurus/logger": "3.8.1", + "@docusaurus/utils": "3.8.1", + "@docusaurus/utils-validation": "3.8.1", + "@mdx-js/mdx": "^3.0.0", + "@slorber/remark-comment": "^1.0.0", + "escape-html": "^1.0.3", + "estree-util-value-to-estree": "^3.0.1", + "file-loader": "^6.2.0", + "fs-extra": "^11.1.1", + "image-size": "^2.0.2", + "mdast-util-mdx": "^3.0.0", + "mdast-util-to-string": "^4.0.0", + "rehype-raw": "^7.0.0", + "remark-directive": "^3.0.0", + "remark-emoji": "^4.0.0", + "remark-frontmatter": "^5.0.0", + "remark-gfm": "^4.0.0", + "stringify-object": "^3.3.0", + "tslib": "^2.6.0", + "unified": "^11.0.3", + "unist-util-visit": "^5.0.0", + "url-loader": "^4.1.1", + "vfile": "^6.0.1", + "webpack": "^5.88.1" + }, + "engines": { + "node": ">=18.0" + }, + "peerDependencies": { + "react": "^18.0.0 || ^19.0.0", + "react-dom": "^18.0.0 || ^19.0.0" + } + }, + "node_modules/@docusaurus/module-type-aliases": { + "version": "3.8.1", + "resolved": "https://registry.npmjs.org/@docusaurus/module-type-aliases/-/module-type-aliases-3.8.1.tgz", + "integrity": "sha512-6xhvAJiXzsaq3JdosS7wbRt/PwEPWHr9eM4YNYqVlbgG1hSK3uQDXTVvQktasp3VO6BmfYWPozueLWuj4gB+vg==", + "license": "MIT", + "dependencies": { + "@docusaurus/types": "3.8.1", + "@types/history": "^4.7.11", + "@types/react": "*", + "@types/react-router-config": "*", + "@types/react-router-dom": "*", + "react-helmet-async": "npm:@slorber/react-helmet-async@1.3.0", + "react-loadable": "npm:@docusaurus/react-loadable@6.0.0" + }, + "peerDependencies": { + "react": "*", + "react-dom": "*" + } + }, + "node_modules/@docusaurus/plugin-content-blog": { + "version": "3.8.1", + "resolved": "https://registry.npmjs.org/@docusaurus/plugin-content-blog/-/plugin-content-blog-3.8.1.tgz", + "integrity": "sha512-vNTpMmlvNP9n3hGEcgPaXyvTljanAKIUkuG9URQ1DeuDup0OR7Ltvoc8yrmH+iMZJbcQGhUJF+WjHLwuk8HSdw==", + "license": "MIT", + "dependencies": { + "@docusaurus/core": "3.8.1", + "@docusaurus/logger": "3.8.1", + "@docusaurus/mdx-loader": "3.8.1", + "@docusaurus/theme-common": "3.8.1", + "@docusaurus/types": "3.8.1", + "@docusaurus/utils": "3.8.1", + "@docusaurus/utils-common": "3.8.1", + "@docusaurus/utils-validation": "3.8.1", + "cheerio": "1.0.0-rc.12", + "feed": "^4.2.2", + "fs-extra": "^11.1.1", + "lodash": "^4.17.21", + "schema-dts": "^1.1.2", + "srcset": "^4.0.0", + "tslib": "^2.6.0", + "unist-util-visit": "^5.0.0", + "utility-types": "^3.10.0", + "webpack": "^5.88.1" + }, + "engines": { + "node": ">=18.0" + }, + "peerDependencies": { + "@docusaurus/plugin-content-docs": "*", + "react": "^18.0.0 || ^19.0.0", + "react-dom": "^18.0.0 || ^19.0.0" + } + }, + "node_modules/@docusaurus/plugin-content-docs": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "@docusaurus/core": "3.8.1", + "@docusaurus/logger": "3.8.1", + "@docusaurus/mdx-loader": "3.8.1", + "@docusaurus/module-type-aliases": "3.8.1", + "@docusaurus/theme-common": "3.8.1", + "@docusaurus/types": "3.8.1", + "@docusaurus/utils": "3.8.1", + "@docusaurus/utils-common": "3.8.1", + "@docusaurus/utils-validation": "3.8.1", + "@types/react-router-config": "^5.0.7", + "combine-promises": "^1.1.0", + "fs-extra": "^11.1.1", + "js-yaml": "^4.1.0", + "lodash": "^4.17.21", + "schema-dts": "^1.1.2", + "tslib": "^2.6.0", + "utility-types": "^3.10.0", + "webpack": "^5.88.1" + }, + "engines": { + "node": ">=18.0" + }, + "peerDependencies": { + "react": "^18.0.0 || ^19.0.0", + "react-dom": "^18.0.0 || ^19.0.0" + } + }, + "node_modules/@docusaurus/plugin-content-docs/node_modules/@types/react-router-config": { + "version": "5.0.11", + "license": "MIT", + "dependencies": { + "@types/history": "^4.7.11", + "@types/react": "*", + "@types/react-router": "^5.1.0" + } + }, + "node_modules/@docusaurus/plugin-content-pages": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "@docusaurus/core": "3.8.1", + "@docusaurus/mdx-loader": "3.8.1", + "@docusaurus/types": "3.8.1", + "@docusaurus/utils": "3.8.1", + "@docusaurus/utils-validation": "3.8.1", + "fs-extra": "^11.1.1", + "tslib": "^2.6.0", + "webpack": "^5.88.1" + }, + "engines": { + "node": ">=18.0" + }, + "peerDependencies": { + "react": "^18.0.0 || ^19.0.0", + "react-dom": "^18.0.0 || ^19.0.0" + } + }, + "node_modules/@docusaurus/plugin-css-cascade-layers": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "@docusaurus/core": "3.8.1", + "@docusaurus/types": "3.8.1", + "@docusaurus/utils": "3.8.1", + "@docusaurus/utils-validation": "3.8.1", + "tslib": "^2.6.0" + }, + "engines": { + "node": ">=18.0" + } + }, + "node_modules/@docusaurus/plugin-debug": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "@docusaurus/core": "3.8.1", + "@docusaurus/types": "3.8.1", + "@docusaurus/utils": "3.8.1", + "fs-extra": "^11.1.1", + "react-json-view-lite": "^2.3.0", + "tslib": "^2.6.0" + }, + "engines": { + "node": ">=18.0" + }, + "peerDependencies": { + "react": "^18.0.0 || ^19.0.0", + "react-dom": "^18.0.0 || ^19.0.0" + } + }, + "node_modules/@docusaurus/plugin-google-analytics": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "@docusaurus/core": "3.8.1", + "@docusaurus/types": "3.8.1", + "@docusaurus/utils-validation": "3.8.1", + "tslib": "^2.6.0" + }, + "engines": { + "node": ">=18.0" + }, + "peerDependencies": { + "react": "^18.0.0 || ^19.0.0", + "react-dom": "^18.0.0 || ^19.0.0" + } + }, + "node_modules/@docusaurus/plugin-google-gtag": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "@docusaurus/core": "3.8.1", + "@docusaurus/types": "3.8.1", + "@docusaurus/utils-validation": "3.8.1", + "@types/gtag.js": "^0.0.12", + "tslib": "^2.6.0" + }, + "engines": { + "node": ">=18.0" + }, + "peerDependencies": { + "react": "^18.0.0 || ^19.0.0", + "react-dom": "^18.0.0 || ^19.0.0" + } + }, + "node_modules/@docusaurus/plugin-google-tag-manager": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "@docusaurus/core": "3.8.1", + "@docusaurus/types": "3.8.1", + "@docusaurus/utils-validation": "3.8.1", + "tslib": "^2.6.0" + }, + "engines": { + "node": ">=18.0" + }, + "peerDependencies": { + "react": "^18.0.0 || ^19.0.0", + "react-dom": "^18.0.0 || ^19.0.0" + } + }, + "node_modules/@docusaurus/plugin-sitemap": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "@docusaurus/core": "3.8.1", + "@docusaurus/logger": "3.8.1", + "@docusaurus/types": "3.8.1", + "@docusaurus/utils": "3.8.1", + "@docusaurus/utils-common": "3.8.1", + "@docusaurus/utils-validation": "3.8.1", + "fs-extra": "^11.1.1", + "sitemap": "^7.1.1", + "tslib": "^2.6.0" + }, + "engines": { + "node": ">=18.0" + }, + "peerDependencies": { + "react": "^18.0.0 || ^19.0.0", + "react-dom": "^18.0.0 || ^19.0.0" + } + }, + "node_modules/@docusaurus/plugin-svgr": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "@docusaurus/core": "3.8.1", + "@docusaurus/types": "3.8.1", + "@docusaurus/utils": "3.8.1", + "@docusaurus/utils-validation": "3.8.1", + "@svgr/core": "8.1.0", + "@svgr/webpack": "^8.1.0", + "tslib": "^2.6.0", + "webpack": "^5.88.1" + }, + "engines": { + "node": ">=18.0" + }, + "peerDependencies": { + "react": "^18.0.0 || ^19.0.0", + "react-dom": "^18.0.0 || ^19.0.0" + } + }, + "node_modules/@docusaurus/preset-classic": { + "version": "3.8.1", + "resolved": "https://registry.npmjs.org/@docusaurus/preset-classic/-/preset-classic-3.8.1.tgz", + "integrity": "sha512-yJSjYNHXD8POMGc2mKQuj3ApPrN+eG0rO1UPgSx7jySpYU+n4WjBikbrA2ue5ad9A7aouEtMWUoiSRXTH/g7KQ==", + "license": "MIT", + "dependencies": { + "@docusaurus/core": "3.8.1", + "@docusaurus/plugin-content-blog": "3.8.1", + "@docusaurus/plugin-content-docs": "3.8.1", + "@docusaurus/plugin-content-pages": "3.8.1", + "@docusaurus/plugin-css-cascade-layers": "3.8.1", + "@docusaurus/plugin-debug": "3.8.1", + "@docusaurus/plugin-google-analytics": "3.8.1", + "@docusaurus/plugin-google-gtag": "3.8.1", + "@docusaurus/plugin-google-tag-manager": "3.8.1", + "@docusaurus/plugin-sitemap": "3.8.1", + "@docusaurus/plugin-svgr": "3.8.1", + "@docusaurus/theme-classic": "3.8.1", + "@docusaurus/theme-common": "3.8.1", + "@docusaurus/theme-search-algolia": "3.8.1", + "@docusaurus/types": "3.8.1" + }, + "engines": { + "node": ">=18.0" + }, + "peerDependencies": { + "react": "^18.0.0 || ^19.0.0", + "react-dom": "^18.0.0 || ^19.0.0" + } + }, + "node_modules/@docusaurus/theme-classic": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "@docusaurus/core": "3.8.1", + "@docusaurus/logger": "3.8.1", + "@docusaurus/mdx-loader": "3.8.1", + "@docusaurus/module-type-aliases": "3.8.1", + "@docusaurus/plugin-content-blog": "3.8.1", + "@docusaurus/plugin-content-docs": "3.8.1", + "@docusaurus/plugin-content-pages": "3.8.1", + "@docusaurus/theme-common": "3.8.1", + "@docusaurus/theme-translations": "3.8.1", + "@docusaurus/types": "3.8.1", + "@docusaurus/utils": "3.8.1", + "@docusaurus/utils-common": "3.8.1", + "@docusaurus/utils-validation": "3.8.1", + "@mdx-js/react": "^3.0.0", + "clsx": "^2.0.0", + "copy-text-to-clipboard": "^3.2.0", + "infima": "0.2.0-alpha.45", + "lodash": "^4.17.21", + "nprogress": "^0.2.0", + "postcss": "^8.5.4", + "prism-react-renderer": "^2.3.0", + "prismjs": "^1.29.0", + "react-router-dom": "^5.3.4", + "rtlcss": "^4.1.0", + "tslib": "^2.6.0", + "utility-types": "^3.10.0" + }, + "engines": { + "node": ">=18.0" + }, + "peerDependencies": { + "react": "^18.0.0 || ^19.0.0", + "react-dom": "^18.0.0 || ^19.0.0" + } + }, + "node_modules/@docusaurus/theme-classic/node_modules/clsx": { + "version": "2.1.1", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/@docusaurus/theme-classic/node_modules/nanoid": { + "version": "3.3.11", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "bin": { + "nanoid": "bin/nanoid.cjs" + }, + "engines": { + "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1" + } + }, + "node_modules/@docusaurus/theme-classic/node_modules/postcss": { + "version": "8.5.6", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/postcss/" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/postcss" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "nanoid": "^3.3.11", + "picocolors": "^1.1.1", + "source-map-js": "^1.2.1" + }, + "engines": { + "node": "^10 || ^12 || >=14" + } + }, + "node_modules/@docusaurus/theme-classic/node_modules/prism-react-renderer": { + "version": "2.4.1", + "license": "MIT", + "dependencies": { + "@types/prismjs": "^1.26.0", + "clsx": "^2.0.0" + }, + "peerDependencies": { + "react": ">=16.0.0" + } + }, + "node_modules/@docusaurus/theme-common": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "@docusaurus/mdx-loader": "3.8.1", + "@docusaurus/module-type-aliases": "3.8.1", + "@docusaurus/utils": "3.8.1", + "@docusaurus/utils-common": "3.8.1", + "@types/history": "^4.7.11", + "@types/react": "*", + "@types/react-router-config": "*", + "clsx": "^2.0.0", + "parse-numeric-range": "^1.3.0", + "prism-react-renderer": "^2.3.0", + "tslib": "^2.6.0", + "utility-types": "^3.10.0" + }, + "engines": { + "node": ">=18.0" + }, + "peerDependencies": { + "@docusaurus/plugin-content-docs": "*", + "react": "^18.0.0 || ^19.0.0", + "react-dom": "^18.0.0 || ^19.0.0" + } + }, + "node_modules/@docusaurus/theme-common/node_modules/clsx": { + "version": "2.1.1", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/@docusaurus/theme-common/node_modules/prism-react-renderer": { + "version": "2.4.1", + "license": "MIT", + "dependencies": { + "@types/prismjs": "^1.26.0", + "clsx": "^2.0.0" + }, + "peerDependencies": { + "react": ">=16.0.0" + } + }, + "node_modules/@docusaurus/theme-live-codeblock": { + "version": "3.8.1", + "resolved": "https://registry.npmjs.org/@docusaurus/theme-live-codeblock/-/theme-live-codeblock-3.8.1.tgz", + "integrity": "sha512-TuCdnbJdTCAR4xv/dEU9m299/+hr+DrxQnQyK1mAmxnvWM/KrfaWdKMfjJ9h4hHa54ctPGm6ykdTvZic0GWdIw==", + "license": "MIT", + "dependencies": { + "@docusaurus/core": "3.8.1", + "@docusaurus/theme-common": "3.8.1", + "@docusaurus/theme-translations": "3.8.1", + "@docusaurus/utils-validation": "3.8.1", + "@philpl/buble": "^0.19.7", + "clsx": "^2.0.0", + "fs-extra": "^11.1.1", + "react-live": "^4.1.6", + "tslib": "^2.6.0" + }, + "engines": { + "node": ">=18.0" + }, + "peerDependencies": { + "react": "^18.0.0 || ^19.0.0", + "react-dom": "^18.0.0 || ^19.0.0" + } + }, + "node_modules/@docusaurus/theme-live-codeblock/node_modules/clsx": { + "version": "2.1.1", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/@docusaurus/theme-search-algolia": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "@docsearch/react": "^3.9.0", + "@docusaurus/core": "3.8.1", + "@docusaurus/logger": "3.8.1", + "@docusaurus/plugin-content-docs": "3.8.1", + "@docusaurus/theme-common": "3.8.1", + "@docusaurus/theme-translations": "3.8.1", + "@docusaurus/utils": "3.8.1", + "@docusaurus/utils-validation": "3.8.1", + "algoliasearch": "^5.17.1", + "algoliasearch-helper": "^3.22.6", + "clsx": "^2.0.0", + "eta": "^2.2.0", + "fs-extra": "^11.1.1", + "lodash": "^4.17.21", + "tslib": "^2.6.0", + "utility-types": "^3.10.0" + }, + "engines": { + "node": ">=18.0" + }, + "peerDependencies": { + "react": "^18.0.0 || ^19.0.0", + "react-dom": "^18.0.0 || ^19.0.0" + } + }, + "node_modules/@docusaurus/theme-search-algolia/node_modules/clsx": { + "version": "2.1.1", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/@docusaurus/theme-translations": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "fs-extra": "^11.1.1", + "tslib": "^2.6.0" + }, + "engines": { + "node": ">=18.0" + } + }, + "node_modules/@docusaurus/types": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "@mdx-js/mdx": "^3.0.0", + "@types/history": "^4.7.11", + "@types/react": "*", + "commander": "^5.1.0", + "joi": "^17.9.2", + "react-helmet-async": "npm:@slorber/react-helmet-async@1.3.0", + "utility-types": "^3.10.0", + "webpack": "^5.95.0", + "webpack-merge": "^5.9.0" + }, + "peerDependencies": { + "react": "^18.0.0 || ^19.0.0", + "react-dom": "^18.0.0 || ^19.0.0" + } + }, + "node_modules/@docusaurus/utils": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "@docusaurus/logger": "3.8.1", + "@docusaurus/types": "3.8.1", + "@docusaurus/utils-common": "3.8.1", + "escape-string-regexp": "^4.0.0", + "execa": "5.1.1", + "file-loader": "^6.2.0", + "fs-extra": "^11.1.1", + "github-slugger": "^1.5.0", + "globby": "^11.1.0", + "gray-matter": "^4.0.3", + "jiti": "^1.20.0", + "js-yaml": "^4.1.0", + "lodash": "^4.17.21", + "micromatch": "^4.0.5", + "p-queue": "^6.6.2", + "prompts": "^2.4.2", + "resolve-pathname": "^3.0.0", + "tslib": "^2.6.0", + "url-loader": "^4.1.1", + "utility-types": "^3.10.0", + "webpack": "^5.88.1" + }, + "engines": { + "node": ">=18.0" + } + }, + "node_modules/@docusaurus/utils-common": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "@docusaurus/types": "3.8.1", + "tslib": "^2.6.0" + }, + "engines": { + "node": ">=18.0" + } + }, + "node_modules/@docusaurus/utils-validation": { + "version": "3.8.1", + "license": "MIT", + "dependencies": { + "@docusaurus/logger": "3.8.1", + "@docusaurus/utils": "3.8.1", + "@docusaurus/utils-common": "3.8.1", + "fs-extra": "^11.2.0", + "joi": "^17.9.2", + "js-yaml": "^4.1.0", + "lodash": "^4.17.21", + "tslib": "^2.6.0" + }, + "engines": { + "node": ">=18.0" + } + }, + "node_modules/@easyops-cn/autocomplete.js": { + "version": "0.38.1", + "resolved": "https://registry.npmjs.org/@easyops-cn/autocomplete.js/-/autocomplete.js-0.38.1.tgz", + "integrity": "sha512-drg76jS6syilOUmVNkyo1c7ZEBPcPuK+aJA7AksM5ZIIbV57DMHCywiCr+uHyv8BE5jUTU98j/H7gVrkHrWW3Q==", + "license": "MIT", + "dependencies": { + "cssesc": "^3.0.0", + "immediate": "^3.2.3" + } + }, + "node_modules/@easyops-cn/docusaurus-search-local": { + "version": "0.52.0", + "resolved": "https://registry.npmjs.org/@easyops-cn/docusaurus-search-local/-/docusaurus-search-local-0.52.0.tgz", + "integrity": "sha512-LwQ3ZFeSaK/e9O7yFJroMY7yJNLKbfzQyAQnruToi/VJhgZXGCamrkuuEwIQkgVHNE9Bjpql/xu1VKj2Aj+XGQ==", + "license": "MIT", + "dependencies": { + "@docusaurus/plugin-content-docs": "^2 || ^3", + "@docusaurus/theme-translations": "^2 || ^3", + "@docusaurus/utils": "^2 || ^3", + "@docusaurus/utils-common": "^2 || ^3", + "@docusaurus/utils-validation": "^2 || ^3", + "@easyops-cn/autocomplete.js": "^0.38.1", + "@node-rs/jieba": "^1.6.0", + "cheerio": "^1.0.0", + "clsx": "^2.1.1", + "comlink": "^4.4.2", + "debug": "^4.2.0", + "fs-extra": "^10.0.0", + "klaw-sync": "^6.0.0", + "lunr": "^2.3.9", + "lunr-languages": "^1.4.0", + "mark.js": "^8.11.1", + "tslib": "^2.4.0" + }, + "engines": { + "node": ">=12" + }, + "peerDependencies": { + "@docusaurus/theme-common": "^2 || ^3", + "react": "^16.14.0 || ^17 || ^18 || ^19", + "react-dom": "^16.14.0 || 17 || ^18 || ^19" + } + }, + "node_modules/@easyops-cn/docusaurus-search-local/node_modules/cheerio": { + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/cheerio/-/cheerio-1.1.2.tgz", + "integrity": "sha512-IkxPpb5rS/d1IiLbHMgfPuS0FgiWTtFIm/Nj+2woXDLTZ7fOT2eqzgYbdMlLweqlHbsZjxEChoVK+7iph7jyQg==", + "license": "MIT", + "dependencies": { + "cheerio-select": "^2.1.0", + "dom-serializer": "^2.0.0", + "domhandler": "^5.0.3", + "domutils": "^3.2.2", + "encoding-sniffer": "^0.2.1", + "htmlparser2": "^10.0.0", + "parse5": "^7.3.0", + "parse5-htmlparser2-tree-adapter": "^7.1.0", + "parse5-parser-stream": "^7.1.2", + "undici": "^7.12.0", + "whatwg-mimetype": "^4.0.0" + }, + "engines": { + "node": ">=20.18.1" + }, + "funding": { + "url": "https://github.com/cheeriojs/cheerio?sponsor=1" + } + }, + "node_modules/@easyops-cn/docusaurus-search-local/node_modules/clsx": { + "version": "2.1.1", + "resolved": "https://registry.npmjs.org/clsx/-/clsx-2.1.1.tgz", + "integrity": "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/@easyops-cn/docusaurus-search-local/node_modules/entities": { + "version": "6.0.1", + "resolved": "https://registry.npmjs.org/entities/-/entities-6.0.1.tgz", + "integrity": "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==", + "license": "BSD-2-Clause", + "engines": { + "node": ">=0.12" + }, + "funding": { + "url": "https://github.com/fb55/entities?sponsor=1" + } + }, + "node_modules/@easyops-cn/docusaurus-search-local/node_modules/fs-extra": { + "version": "10.1.0", + "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-10.1.0.tgz", + "integrity": "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ==", + "license": "MIT", + "dependencies": { + "graceful-fs": "^4.2.0", + "jsonfile": "^6.0.1", + "universalify": "^2.0.0" + }, + "engines": { + "node": ">=12" + } + }, + "node_modules/@easyops-cn/docusaurus-search-local/node_modules/htmlparser2": { + "version": "10.0.0", + "resolved": "https://registry.npmjs.org/htmlparser2/-/htmlparser2-10.0.0.tgz", + "integrity": "sha512-TwAZM+zE5Tq3lrEHvOlvwgj1XLWQCtaaibSN11Q+gGBAS7Y1uZSWwXXRe4iF6OXnaq1riyQAPFOBtYc77Mxq0g==", + "funding": [ + "https://github.com/fb55/htmlparser2?sponsor=1", + { + "type": "github", + "url": "https://github.com/sponsors/fb55" + } + ], + "license": "MIT", + "dependencies": { + "domelementtype": "^2.3.0", + "domhandler": "^5.0.3", + "domutils": "^3.2.1", + "entities": "^6.0.0" + } + }, + "node_modules/@emnapi/core": { + "version": "1.4.5", + "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.4.5.tgz", + "integrity": "sha512-XsLw1dEOpkSX/WucdqUhPWP7hDxSvZiY+fsUC14h+FtQ2Ifni4znbBt8punRX+Uj2JG/uDb8nEHVKvrVlvdZ5Q==", + "license": "MIT", + "optional": true, + "dependencies": { + "@emnapi/wasi-threads": "1.0.4", + "tslib": "^2.4.0" + } + }, + "node_modules/@emnapi/runtime": { + "version": "1.4.5", + "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.4.5.tgz", + "integrity": "sha512-++LApOtY0pEEz1zrd9vy1/zXVaVJJ/EbAF3u0fXIzPJEDtnITsBGbbK0EkM72amhl/R5b+5xx0Y/QhcVOpuulg==", + "license": "MIT", + "optional": true, + "dependencies": { + "tslib": "^2.4.0" + } + }, + "node_modules/@emnapi/wasi-threads": { + "version": "1.0.4", + "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.0.4.tgz", + "integrity": "sha512-PJR+bOmMOPH8AtcTGAyYNiuJ3/Fcoj2XN/gBEWzDIKh254XO+mM9XoXHk5GNEhodxeMznbg7BlRojVbKN+gC6g==", + "license": "MIT", + "optional": true, + "dependencies": { + "tslib": "^2.4.0" + } + }, + "node_modules/@eslint-community/eslint-utils": { + "version": "4.4.0", + "dev": true, + "license": "MIT", + "dependencies": { + "eslint-visitor-keys": "^3.3.0" + }, + "engines": { + "node": "^12.22.0 || ^14.17.0 || >=16.0.0" + }, + "peerDependencies": { + "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0" + } + }, + "node_modules/@eslint-community/regexpp": { + "version": "4.9.1", + "dev": true, + "license": "MIT", + "engines": { + "node": "^12.0.0 || ^14.0.0 || >=16.0.0" + } + }, + "node_modules/@eslint/eslintrc": { + "version": "2.1.4", + "dev": true, + "license": "MIT", + "dependencies": { + "ajv": "^6.12.4", + "debug": "^4.3.2", + "espree": "^9.6.0", + "globals": "^13.19.0", + "ignore": "^5.2.0", + "import-fresh": "^3.2.1", + "js-yaml": "^4.1.0", + "minimatch": "^3.1.2", + "strip-json-comments": "^3.1.1" + }, + "engines": { + "node": "^12.22.0 || ^14.17.0 || >=16.0.0" + }, + "funding": { + "url": "https://opencollective.com/eslint" + } + }, + "node_modules/@eslint/eslintrc/node_modules/ajv": { + "version": "6.12.6", + "dev": true, + "license": "MIT", + "dependencies": { + "fast-deep-equal": "^3.1.1", + "fast-json-stable-stringify": "^2.0.0", + "json-schema-traverse": "^0.4.1", + "uri-js": "^4.2.2" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/epoberezkin" + } + }, + "node_modules/@eslint/js": { + "version": "8.57.1", + "dev": true, + "license": "MIT", + "engines": { + "node": "^12.22.0 || ^14.17.0 || >=16.0.0" + } + }, + "node_modules/@hapi/hoek": { + "version": "9.3.0", + "license": "BSD-3-Clause" + }, + "node_modules/@hapi/topo": { + "version": "5.1.0", + "license": "BSD-3-Clause", + "dependencies": { + "@hapi/hoek": "^9.0.0" + } + }, + "node_modules/@humanwhocodes/config-array": { + "version": "0.13.0", + "dev": true, + "license": "Apache-2.0", + "dependencies": { + "@humanwhocodes/object-schema": "^2.0.3", + "debug": "^4.3.1", + "minimatch": "^3.0.5" + }, + "engines": { + "node": ">=10.10.0" + } + }, + "node_modules/@humanwhocodes/module-importer": { + "version": "1.0.1", + "dev": true, + "license": "Apache-2.0", + "engines": { + "node": ">=12.22" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/nzakas" + } + }, + "node_modules/@humanwhocodes/object-schema": { + "version": "2.0.3", + "dev": true, + "license": "BSD-3-Clause" + }, + "node_modules/@iconify/react": { + "version": "4.1.1", + "license": "MIT", + "dependencies": { + "@iconify/types": "^2.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/cyberalien" + }, + "peerDependencies": { + "react": ">=16" + } + }, + "node_modules/@iconify/types": { + "version": "2.0.0", + "license": "MIT" + }, + "node_modules/@isaacs/cliui": { + "version": "8.0.2", + "license": "ISC", + "dependencies": { + "string-width": "^5.1.2", + "string-width-cjs": "npm:string-width@^4.2.0", + "strip-ansi": "^7.0.1", + "strip-ansi-cjs": "npm:strip-ansi@^6.0.1", + "wrap-ansi": "^8.1.0", + "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0" + }, + "engines": { + "node": ">=12" + } + }, + "node_modules/@isaacs/cliui/node_modules/ansi-regex": { + "version": "6.0.1", + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/chalk/ansi-regex?sponsor=1" + } + }, + "node_modules/@isaacs/cliui/node_modules/strip-ansi": { + "version": "7.1.0", + "license": "MIT", + "dependencies": { + "ansi-regex": "^6.0.1" + }, + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/chalk/strip-ansi?sponsor=1" + } + }, + "node_modules/@jest/schemas": { + "version": "29.6.3", + "license": "MIT", + "dependencies": { + "@sinclair/typebox": "^0.27.8" + }, + "engines": { + "node": "^14.15.0 || ^16.10.0 || >=18.0.0" + } + }, + "node_modules/@jest/types": { + "version": "29.6.3", + "license": "MIT", + "dependencies": { + "@jest/schemas": "^29.6.3", + "@types/istanbul-lib-coverage": "^2.0.0", + "@types/istanbul-reports": "^3.0.0", + "@types/node": "*", + "@types/yargs": "^17.0.8", + "chalk": "^4.0.0" + }, + "engines": { + "node": "^14.15.0 || ^16.10.0 || >=18.0.0" + } + }, + "node_modules/@jridgewell/gen-mapping": { + "version": "0.3.3", + "license": "MIT", + "dependencies": { + "@jridgewell/set-array": "^1.0.1", + "@jridgewell/sourcemap-codec": "^1.4.10", + "@jridgewell/trace-mapping": "^0.3.9" + }, + "engines": { + "node": ">=6.0.0" + } + }, + "node_modules/@jridgewell/gen-mapping/node_modules/@jridgewell/trace-mapping": { + "version": "0.3.19", + "license": "MIT", + "dependencies": { + "@jridgewell/resolve-uri": "^3.1.0", + "@jridgewell/sourcemap-codec": "^1.4.14" + } + }, + "node_modules/@jridgewell/resolve-uri": { + "version": "3.1.1", + "license": "MIT", + "engines": { + "node": ">=6.0.0" + } + }, + "node_modules/@jridgewell/set-array": { + "version": "1.1.2", + "license": "MIT", + "engines": { + "node": ">=6.0.0" + } + }, + "node_modules/@jridgewell/source-map": { + "version": "0.3.5", + "license": "MIT", + "dependencies": { + "@jridgewell/gen-mapping": "^0.3.0", + "@jridgewell/trace-mapping": "^0.3.9" + } + }, + "node_modules/@jridgewell/source-map/node_modules/@jridgewell/trace-mapping": { + "version": "0.3.19", + "license": "MIT", + "dependencies": { + "@jridgewell/resolve-uri": "^3.1.0", + "@jridgewell/sourcemap-codec": "^1.4.14" + } + }, + "node_modules/@jridgewell/sourcemap-codec": { + "version": "1.4.15", + "license": "MIT" + }, + "node_modules/@jridgewell/trace-mapping": { + "version": "0.3.29", + "license": "MIT", + "dependencies": { + "@jridgewell/resolve-uri": "^3.1.0", + "@jridgewell/sourcemap-codec": "^1.4.14" + } + }, + "node_modules/@leichtgewicht/ip-codec": { + "version": "2.0.4", + "license": "MIT" + }, + "node_modules/@mdx-js/mdx": { + "version": "3.1.0", + "license": "MIT", + "dependencies": { + "@types/estree": "^1.0.0", + "@types/estree-jsx": "^1.0.0", + "@types/hast": "^3.0.0", + "@types/mdx": "^2.0.0", + "collapse-white-space": "^2.0.0", + "devlop": "^1.0.0", + "estree-util-is-identifier-name": "^3.0.0", + "estree-util-scope": "^1.0.0", + "estree-walker": "^3.0.0", + "hast-util-to-jsx-runtime": "^2.0.0", + "markdown-extensions": "^2.0.0", + "recma-build-jsx": "^1.0.0", + "recma-jsx": "^1.0.0", + "recma-stringify": "^1.0.0", + "rehype-recma": "^1.0.0", + "remark-mdx": "^3.0.0", + "remark-parse": "^11.0.0", + "remark-rehype": "^11.0.0", + "source-map": "^0.7.0", + "unified": "^11.0.0", + "unist-util-position-from-estree": "^2.0.0", + "unist-util-stringify-position": "^4.0.0", + "unist-util-visit": "^5.0.0", + "vfile": "^6.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/@mdx-js/mdx/node_modules/source-map": { + "version": "0.7.4", + "license": "BSD-3-Clause", + "engines": { + "node": ">= 8" + } + }, + "node_modules/@mdx-js/react": { + "version": "3.1.0", + "license": "MIT", + "dependencies": { + "@types/mdx": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + }, + "peerDependencies": { + "@types/react": ">=16", + "react": ">=16" + } + }, + "node_modules/@napi-rs/wasm-runtime": { + "version": "0.2.12", + "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-0.2.12.tgz", + "integrity": "sha512-ZVWUcfwY4E/yPitQJl481FjFo3K22D6qF0DuFH6Y/nbnE11GY5uguDxZMGXPQ8WQ0128MXQD7TnfHyK4oWoIJQ==", + "license": "MIT", + "optional": true, + "dependencies": { + "@emnapi/core": "^1.4.3", + "@emnapi/runtime": "^1.4.3", + "@tybys/wasm-util": "^0.10.0" + } + }, + "node_modules/@node-rs/jieba": { + "version": "1.10.4", + "resolved": "https://registry.npmjs.org/@node-rs/jieba/-/jieba-1.10.4.tgz", + "integrity": "sha512-GvDgi8MnBiyWd6tksojej8anIx18244NmIOc1ovEw8WKNUejcccLfyu8vj66LWSuoZuKILVtNsOy4jvg3aoxIw==", + "license": "MIT", + "engines": { + "node": ">= 10" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/Brooooooklyn" + }, + "optionalDependencies": { + "@node-rs/jieba-android-arm-eabi": "1.10.4", + "@node-rs/jieba-android-arm64": "1.10.4", + "@node-rs/jieba-darwin-arm64": "1.10.4", + "@node-rs/jieba-darwin-x64": "1.10.4", + "@node-rs/jieba-freebsd-x64": "1.10.4", + "@node-rs/jieba-linux-arm-gnueabihf": "1.10.4", + "@node-rs/jieba-linux-arm64-gnu": "1.10.4", + "@node-rs/jieba-linux-arm64-musl": "1.10.4", + "@node-rs/jieba-linux-x64-gnu": "1.10.4", + "@node-rs/jieba-linux-x64-musl": "1.10.4", + "@node-rs/jieba-wasm32-wasi": "1.10.4", + "@node-rs/jieba-win32-arm64-msvc": "1.10.4", + "@node-rs/jieba-win32-ia32-msvc": "1.10.4", + "@node-rs/jieba-win32-x64-msvc": "1.10.4" + } + }, + "node_modules/@node-rs/jieba-android-arm-eabi": { + "version": "1.10.4", + "resolved": "https://registry.npmjs.org/@node-rs/jieba-android-arm-eabi/-/jieba-android-arm-eabi-1.10.4.tgz", + "integrity": "sha512-MhyvW5N3Fwcp385d0rxbCWH42kqDBatQTyP8XbnYbju2+0BO/eTeCCLYj7Agws4pwxn2LtdldXRSKavT7WdzNA==", + "cpu": [ + "arm" + ], + "license": "MIT", + "optional": true, + "os": [ + "android" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@node-rs/jieba-android-arm64": { + "version": "1.10.4", + "resolved": "https://registry.npmjs.org/@node-rs/jieba-android-arm64/-/jieba-android-arm64-1.10.4.tgz", + "integrity": "sha512-XyDwq5+rQ+Tk55A+FGi6PtJbzf974oqnpyCcCPzwU3QVXJCa2Rr4Lci+fx8oOpU4plT3GuD+chXMYLsXipMgJA==", + "cpu": [ + "arm64" + ], + "license": "MIT", + "optional": true, + "os": [ + "android" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@node-rs/jieba-darwin-arm64": { + "version": "1.10.4", + "resolved": "https://registry.npmjs.org/@node-rs/jieba-darwin-arm64/-/jieba-darwin-arm64-1.10.4.tgz", + "integrity": "sha512-G++RYEJ2jo0rxF9626KUy90wp06TRUjAsvY/BrIzEOX/ingQYV/HjwQzNPRR1P1o32a6/U8RGo7zEBhfdybL6w==", + "cpu": [ + "arm64" + ], + "license": "MIT", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@node-rs/jieba-darwin-x64": { + "version": "1.10.4", + "resolved": "https://registry.npmjs.org/@node-rs/jieba-darwin-x64/-/jieba-darwin-x64-1.10.4.tgz", + "integrity": "sha512-MmDNeOb2TXIZCPyWCi2upQnZpPjAxw5ZGEj6R8kNsPXVFALHIKMa6ZZ15LCOkSTsKXVC17j2t4h+hSuyYb6qfQ==", + "cpu": [ + "x64" + ], + "license": "MIT", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@node-rs/jieba-freebsd-x64": { + "version": "1.10.4", + "resolved": "https://registry.npmjs.org/@node-rs/jieba-freebsd-x64/-/jieba-freebsd-x64-1.10.4.tgz", + "integrity": "sha512-/x7aVQ8nqUWhpXU92RZqd333cq639i/olNpd9Z5hdlyyV5/B65LLy+Je2B2bfs62PVVm5QXRpeBcZqaHelp/bg==", + "cpu": [ + "x64" + ], + "license": "MIT", + "optional": true, + "os": [ + "freebsd" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@node-rs/jieba-linux-arm-gnueabihf": { + "version": "1.10.4", + "resolved": "https://registry.npmjs.org/@node-rs/jieba-linux-arm-gnueabihf/-/jieba-linux-arm-gnueabihf-1.10.4.tgz", + "integrity": "sha512-crd2M35oJBRLkoESs0O6QO3BBbhpv+tqXuKsqhIG94B1d02RVxtRIvSDwO33QurxqSdvN9IeSnVpHbDGkuXm3g==", + "cpu": [ + "arm" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@node-rs/jieba-linux-arm64-gnu": { + "version": "1.10.4", + "resolved": "https://registry.npmjs.org/@node-rs/jieba-linux-arm64-gnu/-/jieba-linux-arm64-gnu-1.10.4.tgz", + "integrity": "sha512-omIzNX1psUzPcsdnUhGU6oHeOaTCuCjUgOA/v/DGkvWC1jLcnfXe4vdYbtXMh4XOCuIgS1UCcvZEc8vQLXFbXQ==", + "cpu": [ + "arm64" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@node-rs/jieba-linux-arm64-musl": { + "version": "1.10.4", + "resolved": "https://registry.npmjs.org/@node-rs/jieba-linux-arm64-musl/-/jieba-linux-arm64-musl-1.10.4.tgz", + "integrity": "sha512-Y/tiJ1+HeS5nnmLbZOE+66LbsPOHZ/PUckAYVeLlQfpygLEpLYdlh0aPpS5uiaWMjAXYZYdFkpZHhxDmSLpwpw==", + "cpu": [ + "arm64" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@node-rs/jieba-linux-x64-gnu": { + "version": "1.10.4", + "resolved": "https://registry.npmjs.org/@node-rs/jieba-linux-x64-gnu/-/jieba-linux-x64-gnu-1.10.4.tgz", + "integrity": "sha512-WZO8ykRJpWGE9MHuZpy1lu3nJluPoeB+fIJJn5CWZ9YTVhNDWoCF4i/7nxz1ntulINYGQ8VVuCU9LD86Mek97g==", + "cpu": [ + "x64" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@node-rs/jieba-linux-x64-musl": { + "version": "1.10.4", + "resolved": "https://registry.npmjs.org/@node-rs/jieba-linux-x64-musl/-/jieba-linux-x64-musl-1.10.4.tgz", + "integrity": "sha512-uBBD4S1rGKcgCyAk6VCKatEVQb6EDD5I40v/DxODi5CuZVCANi9m5oee/MQbAoaX7RydA2f0OSCE9/tcwXEwUg==", + "cpu": [ + "x64" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@node-rs/jieba-wasm32-wasi": { + "version": "1.10.4", + "resolved": "https://registry.npmjs.org/@node-rs/jieba-wasm32-wasi/-/jieba-wasm32-wasi-1.10.4.tgz", + "integrity": "sha512-Y2umiKHjuIJy0uulNDz9SDYHdfq5Hmy7jY5nORO99B4pySKkcrMjpeVrmWXJLIsEKLJwcCXHxz8tjwU5/uhz0A==", + "cpu": [ + "wasm32" + ], + "license": "MIT", + "optional": true, + "dependencies": { + "@napi-rs/wasm-runtime": "^0.2.3" + }, + "engines": { + "node": ">=14.0.0" + } + }, + "node_modules/@node-rs/jieba-win32-arm64-msvc": { + "version": "1.10.4", + "resolved": "https://registry.npmjs.org/@node-rs/jieba-win32-arm64-msvc/-/jieba-win32-arm64-msvc-1.10.4.tgz", + "integrity": "sha512-nwMtViFm4hjqhz1it/juQnxpXgqlGltCuWJ02bw70YUDMDlbyTy3grCJPpQQpueeETcALUnTxda8pZuVrLRcBA==", + "cpu": [ + "arm64" + ], + "license": "MIT", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@node-rs/jieba-win32-ia32-msvc": { + "version": "1.10.4", + "resolved": "https://registry.npmjs.org/@node-rs/jieba-win32-ia32-msvc/-/jieba-win32-ia32-msvc-1.10.4.tgz", + "integrity": "sha512-DCAvLx7Z+W4z5oKS+7vUowAJr0uw9JBw8x1Y23Xs/xMA4Em+OOSiaF5/tCJqZUCJ8uC4QeImmgDFiBqGNwxlyA==", + "cpu": [ + "ia32" + ], + "license": "MIT", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@node-rs/jieba-win32-x64-msvc": { + "version": "1.10.4", + "resolved": "https://registry.npmjs.org/@node-rs/jieba-win32-x64-msvc/-/jieba-win32-x64-msvc-1.10.4.tgz", + "integrity": "sha512-+sqemSfS1jjb+Tt7InNbNzrRh1Ua3vProVvC4BZRPg010/leCbGFFiQHpzcPRfpxAXZrzG5Y0YBTsPzN/I4yHQ==", + "cpu": [ + "x64" + ], + "license": "MIT", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@nodelib/fs.scandir": { + "version": "2.1.5", + "license": "MIT", + "dependencies": { + "@nodelib/fs.stat": "2.0.5", + "run-parallel": "^1.1.9" + }, + "engines": { + "node": ">= 8" + } + }, + "node_modules/@nodelib/fs.stat": { + "version": "2.0.5", + "license": "MIT", + "engines": { + "node": ">= 8" + } + }, + "node_modules/@nodelib/fs.walk": { + "version": "1.2.8", + "license": "MIT", + "dependencies": { + "@nodelib/fs.scandir": "2.1.5", + "fastq": "^1.6.0" + }, + "engines": { + "node": ">= 8" + } + }, + "node_modules/@philpl/buble": { + "version": "0.19.7", + "license": "MIT", + "dependencies": { + "acorn": "^6.1.1", + "acorn-class-fields": "^0.2.1", + "acorn-dynamic-import": "^4.0.0", + "acorn-jsx": "^5.0.1", + "chalk": "^2.4.2", + "magic-string": "^0.25.2", + "minimist": "^1.2.0", + "os-homedir": "^1.0.1", + "regexpu-core": "^4.5.4" + }, + "bin": { + "buble": "bin/buble" + } + }, + "node_modules/@philpl/buble/node_modules/ansi-styles": { + "version": "3.2.1", + "license": "MIT", + "dependencies": { + "color-convert": "^1.9.0" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/@philpl/buble/node_modules/chalk": { + "version": "2.4.2", + "license": "MIT", + "dependencies": { + "ansi-styles": "^3.2.1", + "escape-string-regexp": "^1.0.5", + "supports-color": "^5.3.0" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/@philpl/buble/node_modules/color-convert": { + "version": "1.9.3", + "license": "MIT", + "dependencies": { + "color-name": "1.1.3" + } + }, + "node_modules/@philpl/buble/node_modules/color-name": { + "version": "1.1.3", + "license": "MIT" + }, + "node_modules/@philpl/buble/node_modules/escape-string-regexp": { + "version": "1.0.5", + "license": "MIT", + "engines": { + "node": ">=0.8.0" + } + }, + "node_modules/@philpl/buble/node_modules/has-flag": { + "version": "3.0.0", + "license": "MIT", + "engines": { + "node": ">=4" + } + }, + "node_modules/@philpl/buble/node_modules/regenerate-unicode-properties": { + "version": "9.0.0", + "license": "MIT", + "dependencies": { + "regenerate": "^1.4.2" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/@philpl/buble/node_modules/regexpu-core": { + "version": "4.8.0", + "license": "MIT", + "dependencies": { + "regenerate": "^1.4.2", + "regenerate-unicode-properties": "^9.0.0", + "regjsgen": "^0.5.2", + "regjsparser": "^0.7.0", + "unicode-match-property-ecmascript": "^2.0.0", + "unicode-match-property-value-ecmascript": "^2.0.0" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/@philpl/buble/node_modules/regjsgen": { + "version": "0.5.2", + "license": "MIT" + }, + "node_modules/@philpl/buble/node_modules/regjsparser": { + "version": "0.7.0", + "license": "BSD-2-Clause", + "dependencies": { + "jsesc": "~0.5.0" + }, + "bin": { + "regjsparser": "bin/parser" + } + }, + "node_modules/@philpl/buble/node_modules/supports-color": { + "version": "5.5.0", + "license": "MIT", + "dependencies": { + "has-flag": "^3.0.0" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/@pkgjs/parseargs": { + "version": "0.11.0", + "license": "MIT", + "optional": true, + "engines": { + "node": ">=14" + } + }, + "node_modules/@pnpm/config.env-replace": { + "version": "1.1.0", + "license": "MIT", + "engines": { + "node": ">=12.22.0" + } + }, + "node_modules/@pnpm/network.ca-file": { + "version": "1.0.2", + "license": "MIT", + "dependencies": { + "graceful-fs": "4.2.10" + }, + "engines": { + "node": ">=12.22.0" + } + }, + "node_modules/@pnpm/network.ca-file/node_modules/graceful-fs": { + "version": "4.2.10", + "license": "ISC" + }, + "node_modules/@pnpm/npm-conf": { + "version": "2.3.1", + "license": "MIT", + "dependencies": { + "@pnpm/config.env-replace": "^1.1.0", + "@pnpm/network.ca-file": "^1.0.1", + "config-chain": "^1.1.11" + }, + "engines": { + "node": ">=12" + } + }, + "node_modules/@polka/url": { + "version": "1.0.0-next.23", + "license": "MIT" + }, + "node_modules/@sideway/address": { + "version": "4.1.5", + "license": "BSD-3-Clause", + "dependencies": { + "@hapi/hoek": "^9.0.0" + } + }, + "node_modules/@sideway/formula": { + "version": "3.0.1", + "license": "BSD-3-Clause" + }, + "node_modules/@sideway/pinpoint": { + "version": "2.0.0", + "license": "BSD-3-Clause" + }, + "node_modules/@sinclair/typebox": { + "version": "0.27.8", + "license": "MIT" + }, + "node_modules/@sindresorhus/is": { + "version": "5.6.0", + "license": "MIT", + "engines": { + "node": ">=14.16" + }, + "funding": { + "url": "https://github.com/sindresorhus/is?sponsor=1" + } + }, + "node_modules/@slorber/remark-comment": { + "version": "1.0.0", + "license": "MIT", + "dependencies": { + "micromark-factory-space": "^1.0.0", + "micromark-util-character": "^1.1.0", + "micromark-util-symbol": "^1.0.1" + } + }, + "node_modules/@slorber/remark-comment/node_modules/micromark-factory-space": { + "version": "1.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-character": "^1.0.0", + "micromark-util-types": "^1.0.0" + } + }, + "node_modules/@slorber/remark-comment/node_modules/micromark-util-character": { + "version": "1.2.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-symbol": "^1.0.0", + "micromark-util-types": "^1.0.0" + } + }, + "node_modules/@slorber/remark-comment/node_modules/micromark-util-symbol": { + "version": "1.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT" + }, + "node_modules/@slorber/remark-comment/node_modules/micromark-util-types": { + "version": "1.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT" + }, + "node_modules/@svgr/babel-plugin-add-jsx-attribute": { + "version": "8.0.0", + "license": "MIT", + "engines": { + "node": ">=14" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/gregberge" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@svgr/babel-plugin-remove-jsx-attribute": { + "version": "8.0.0", + "license": "MIT", + "engines": { + "node": ">=14" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/gregberge" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@svgr/babel-plugin-remove-jsx-empty-expression": { + "version": "8.0.0", + "license": "MIT", + "engines": { + "node": ">=14" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/gregberge" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@svgr/babel-plugin-replace-jsx-attribute-value": { + "version": "8.0.0", + "license": "MIT", + "engines": { + "node": ">=14" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/gregberge" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@svgr/babel-plugin-svg-dynamic-title": { + "version": "8.0.0", + "license": "MIT", + "engines": { + "node": ">=14" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/gregberge" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@svgr/babel-plugin-svg-em-dimensions": { + "version": "8.0.0", + "license": "MIT", + "engines": { + "node": ">=14" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/gregberge" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@svgr/babel-plugin-transform-react-native-svg": { + "version": "8.1.0", + "license": "MIT", + "engines": { + "node": ">=14" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/gregberge" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@svgr/babel-plugin-transform-svg-component": { + "version": "8.0.0", + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/gregberge" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@svgr/babel-preset": { + "version": "8.1.0", + "license": "MIT", + "dependencies": { + "@svgr/babel-plugin-add-jsx-attribute": "8.0.0", + "@svgr/babel-plugin-remove-jsx-attribute": "8.0.0", + "@svgr/babel-plugin-remove-jsx-empty-expression": "8.0.0", + "@svgr/babel-plugin-replace-jsx-attribute-value": "8.0.0", + "@svgr/babel-plugin-svg-dynamic-title": "8.0.0", + "@svgr/babel-plugin-svg-em-dimensions": "8.0.0", + "@svgr/babel-plugin-transform-react-native-svg": "8.1.0", + "@svgr/babel-plugin-transform-svg-component": "8.0.0" + }, + "engines": { + "node": ">=14" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/gregberge" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@svgr/core": { + "version": "8.1.0", + "license": "MIT", + "dependencies": { + "@babel/core": "^7.21.3", + "@svgr/babel-preset": "8.1.0", + "camelcase": "^6.2.0", + "cosmiconfig": "^8.1.3", + "snake-case": "^3.0.4" + }, + "engines": { + "node": ">=14" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/gregberge" + } + }, + "node_modules/@svgr/hast-util-to-babel-ast": { + "version": "8.0.0", + "license": "MIT", + "dependencies": { + "@babel/types": "^7.21.3", + "entities": "^4.4.0" + }, + "engines": { + "node": ">=14" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/gregberge" + } + }, + "node_modules/@svgr/plugin-jsx": { + "version": "8.1.0", + "license": "MIT", + "dependencies": { + "@babel/core": "^7.21.3", + "@svgr/babel-preset": "8.1.0", + "@svgr/hast-util-to-babel-ast": "8.0.0", + "svg-parser": "^2.0.4" + }, + "engines": { + "node": ">=14" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/gregberge" + }, + "peerDependencies": { + "@svgr/core": "*" + } + }, + "node_modules/@svgr/plugin-svgo": { + "version": "8.1.0", + "license": "MIT", + "dependencies": { + "cosmiconfig": "^8.1.3", + "deepmerge": "^4.3.1", + "svgo": "^3.0.2" + }, + "engines": { + "node": ">=14" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/gregberge" + }, + "peerDependencies": { + "@svgr/core": "*" + } + }, + "node_modules/@svgr/webpack": { + "version": "8.1.0", + "license": "MIT", + "dependencies": { + "@babel/core": "^7.21.3", + "@babel/plugin-transform-react-constant-elements": "^7.21.3", + "@babel/preset-env": "^7.20.2", + "@babel/preset-react": "^7.18.6", + "@babel/preset-typescript": "^7.21.0", + "@svgr/core": "8.1.0", + "@svgr/plugin-jsx": "8.1.0", + "@svgr/plugin-svgo": "8.1.0" + }, + "engines": { + "node": ">=14" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/gregberge" + } + }, + "node_modules/@svgr/webpack/node_modules/@babel/helper-annotate-as-pure": { + "version": "7.22.5", + "license": "MIT", + "dependencies": { + "@babel/types": "^7.22.5" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@svgr/webpack/node_modules/@babel/helper-module-imports": { + "version": "7.22.15", + "license": "MIT", + "dependencies": { + "@babel/types": "^7.22.15" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@svgr/webpack/node_modules/@babel/helper-plugin-utils": { + "version": "7.22.5", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@svgr/webpack/node_modules/@babel/helper-string-parser": { + "version": "7.22.5", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@svgr/webpack/node_modules/@babel/helper-validator-identifier": { + "version": "7.22.20", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@svgr/webpack/node_modules/@babel/helper-validator-option": { + "version": "7.22.15", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@svgr/webpack/node_modules/@babel/plugin-syntax-jsx": { + "version": "7.22.5", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.22.5" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@svgr/webpack/node_modules/@babel/plugin-transform-react-display-name": { + "version": "7.22.5", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.22.5" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@svgr/webpack/node_modules/@babel/plugin-transform-react-jsx": { + "version": "7.22.15", + "license": "MIT", + "dependencies": { + "@babel/helper-annotate-as-pure": "^7.22.5", + "@babel/helper-module-imports": "^7.22.15", + "@babel/helper-plugin-utils": "^7.22.5", + "@babel/plugin-syntax-jsx": "^7.22.5", + "@babel/types": "^7.22.15" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@svgr/webpack/node_modules/@babel/plugin-transform-react-jsx-development": { + "version": "7.22.5", + "license": "MIT", + "dependencies": { + "@babel/plugin-transform-react-jsx": "^7.22.5" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@svgr/webpack/node_modules/@babel/plugin-transform-react-pure-annotations": { + "version": "7.22.5", + "license": "MIT", + "dependencies": { + "@babel/helper-annotate-as-pure": "^7.22.5", + "@babel/helper-plugin-utils": "^7.22.5" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@svgr/webpack/node_modules/@babel/preset-react": { + "version": "7.22.15", + "license": "MIT", + "dependencies": { + "@babel/helper-plugin-utils": "^7.22.5", + "@babel/helper-validator-option": "^7.22.15", + "@babel/plugin-transform-react-display-name": "^7.22.5", + "@babel/plugin-transform-react-jsx": "^7.22.15", + "@babel/plugin-transform-react-jsx-development": "^7.22.5", + "@babel/plugin-transform-react-pure-annotations": "^7.22.5" + }, + "engines": { + "node": ">=6.9.0" + }, + "peerDependencies": { + "@babel/core": "^7.0.0-0" + } + }, + "node_modules/@svgr/webpack/node_modules/@babel/types": { + "version": "7.23.0", + "license": "MIT", + "dependencies": { + "@babel/helper-string-parser": "^7.22.5", + "@babel/helper-validator-identifier": "^7.22.20", + "to-fast-properties": "^2.0.0" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/@szmarczak/http-timer": { + "version": "5.0.1", + "license": "MIT", + "dependencies": { + "defer-to-connect": "^2.0.1" + }, + "engines": { + "node": ">=14.16" + } + }, + "node_modules/@trysound/sax": { + "version": "0.2.0", + "license": "ISC", + "engines": { + "node": ">=10.13.0" + } + }, + "node_modules/@tsconfig/docusaurus": { + "version": "1.0.7", + "dev": true, + "license": "MIT" + }, + "node_modules/@tybys/wasm-util": { + "version": "0.10.0", + "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.0.tgz", + "integrity": "sha512-VyyPYFlOMNylG45GoAe0xDoLwWuowvf92F9kySqzYh8vmYm7D2u4iUJKa1tOUpS70Ku13ASrOkS4ScXFsTaCNQ==", + "license": "MIT", + "optional": true, + "dependencies": { + "tslib": "^2.4.0" + } + }, + "node_modules/@types/body-parser": { + "version": "1.19.3", + "license": "MIT", + "dependencies": { + "@types/connect": "*", + "@types/node": "*" + } + }, + "node_modules/@types/bonjour": { + "version": "3.5.11", + "license": "MIT", + "dependencies": { + "@types/node": "*" + } + }, + "node_modules/@types/connect": { + "version": "3.4.36", + "license": "MIT", + "dependencies": { + "@types/node": "*" + } + }, + "node_modules/@types/connect-history-api-fallback": { + "version": "1.5.1", + "license": "MIT", + "dependencies": { + "@types/express-serve-static-core": "*", + "@types/node": "*" + } + }, + "node_modules/@types/debug": { + "version": "4.1.9", + "license": "MIT", + "dependencies": { + "@types/ms": "*" + } + }, + "node_modules/@types/eslint": { + "version": "8.44.3", + "license": "MIT", + "dependencies": { + "@types/estree": "*", + "@types/json-schema": "*" + } + }, + "node_modules/@types/eslint-scope": { + "version": "3.7.7", + "license": "MIT", + "dependencies": { + "@types/eslint": "*", + "@types/estree": "*" + } + }, + "node_modules/@types/estree": { + "version": "1.0.2", + "license": "MIT" + }, + "node_modules/@types/estree-jsx": { + "version": "1.0.5", + "license": "MIT", + "dependencies": { + "@types/estree": "*" + } + }, + "node_modules/@types/express": { + "version": "4.17.18", + "license": "MIT", + "dependencies": { + "@types/body-parser": "*", + "@types/express-serve-static-core": "^4.17.33", + "@types/qs": "*", + "@types/serve-static": "*" + } + }, + "node_modules/@types/express-serve-static-core": { + "version": "4.17.37", + "license": "MIT", + "dependencies": { + "@types/node": "*", + "@types/qs": "*", + "@types/range-parser": "*", + "@types/send": "*" + } + }, + "node_modules/@types/gtag.js": { + "version": "0.0.12", + "license": "MIT" + }, + "node_modules/@types/hast": { + "version": "3.0.4", + "license": "MIT", + "dependencies": { + "@types/unist": "*" + } + }, + "node_modules/@types/history": { + "version": "4.7.11", + "license": "MIT" + }, + "node_modules/@types/html-minifier-terser": { + "version": "6.1.0", + "license": "MIT" + }, + "node_modules/@types/http-cache-semantics": { + "version": "4.0.4", + "license": "MIT" + }, + "node_modules/@types/http-errors": { + "version": "2.0.2", + "license": "MIT" + }, + "node_modules/@types/http-proxy": { + "version": "1.17.12", + "license": "MIT", + "dependencies": { + "@types/node": "*" + } + }, + "node_modules/@types/istanbul-lib-coverage": { + "version": "2.0.4", + "license": "MIT" + }, + "node_modules/@types/istanbul-lib-report": { + "version": "3.0.1", + "license": "MIT", + "dependencies": { + "@types/istanbul-lib-coverage": "*" + } + }, + "node_modules/@types/istanbul-reports": { + "version": "3.0.2", + "license": "MIT", + "dependencies": { + "@types/istanbul-lib-report": "*" + } + }, + "node_modules/@types/json-schema": { + "version": "7.0.13", + "license": "MIT" + }, + "node_modules/@types/mdast": { + "version": "4.0.4", + "license": "MIT", + "dependencies": { + "@types/unist": "*" + } + }, + "node_modules/@types/mdx": { + "version": "2.0.13", + "license": "MIT" + }, + "node_modules/@types/mime": { + "version": "1.3.3", + "license": "MIT" + }, + "node_modules/@types/ms": { + "version": "0.7.32", + "license": "MIT" + }, + "node_modules/@types/node": { + "version": "20.8.3", + "license": "MIT" + }, + "node_modules/@types/prismjs": { + "version": "1.26.5", + "license": "MIT" + }, + "node_modules/@types/prop-types": { + "version": "15.7.8", + "license": "MIT" + }, + "node_modules/@types/qs": { + "version": "6.9.8", + "license": "MIT" + }, + "node_modules/@types/range-parser": { + "version": "1.2.5", + "license": "MIT" + }, + "node_modules/@types/react": { + "version": "18.2.25", + "license": "MIT", + "dependencies": { + "@types/prop-types": "*", + "@types/scheduler": "*", + "csstype": "^3.0.2" + } + }, + "node_modules/@types/react-router": { + "version": "5.1.20", + "license": "MIT", + "dependencies": { + "@types/history": "^4.7.11", + "@types/react": "*" + } + }, + "node_modules/@types/react-router-config": { + "version": "5.0.8", + "license": "MIT", + "dependencies": { + "@types/history": "^4.7.11", + "@types/react": "*", + "@types/react-router": "^5.1.0" + } + }, + "node_modules/@types/react-router-dom": { + "version": "5.3.3", + "license": "MIT", + "dependencies": { + "@types/history": "^4.7.11", + "@types/react": "*", + "@types/react-router": "*" + } + }, + "node_modules/@types/retry": { + "version": "0.12.0", + "license": "MIT" + }, + "node_modules/@types/sax": { + "version": "1.2.5", + "license": "MIT", + "dependencies": { + "@types/node": "*" + } + }, + "node_modules/@types/scheduler": { + "version": "0.16.4", + "license": "MIT" + }, + "node_modules/@types/semver": { + "version": "7.5.3", + "dev": true, + "license": "MIT" + }, + "node_modules/@types/send": { + "version": "0.17.2", + "license": "MIT", + "dependencies": { + "@types/mime": "^1", + "@types/node": "*" + } + }, + "node_modules/@types/serve-index": { + "version": "1.9.2", + "license": "MIT", + "dependencies": { + "@types/express": "*" + } + }, + "node_modules/@types/serve-static": { + "version": "1.15.3", + "license": "MIT", + "dependencies": { + "@types/http-errors": "*", + "@types/mime": "*", + "@types/node": "*" + } + }, + "node_modules/@types/serve-static/node_modules/@types/mime": { + "version": "3.0.2", + "license": "MIT" + }, + "node_modules/@types/sockjs": { + "version": "0.3.34", + "license": "MIT", + "dependencies": { + "@types/node": "*" + } + }, + "node_modules/@types/unist": { + "version": "3.0.3", + "license": "MIT" + }, + "node_modules/@types/ws": { + "version": "8.5.6", + "license": "MIT", + "dependencies": { + "@types/node": "*" + } + }, + "node_modules/@types/yargs": { + "version": "17.0.28", + "license": "MIT", + "dependencies": { + "@types/yargs-parser": "*" + } + }, + "node_modules/@types/yargs-parser": { + "version": "21.0.1", + "license": "MIT" + }, + "node_modules/@typescript-eslint/eslint-plugin": { + "version": "5.62.0", + "dev": true, + "license": "MIT", + "dependencies": { + "@eslint-community/regexpp": "^4.4.0", + "@typescript-eslint/scope-manager": "5.62.0", + "@typescript-eslint/type-utils": "5.62.0", + "@typescript-eslint/utils": "5.62.0", + "debug": "^4.3.4", + "graphemer": "^1.4.0", + "ignore": "^5.2.0", + "natural-compare-lite": "^1.4.0", + "semver": "^7.3.7", + "tsutils": "^3.21.0" + }, + "engines": { + "node": "^12.22.0 || ^14.17.0 || >=16.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/typescript-eslint" + }, + "peerDependencies": { + "@typescript-eslint/parser": "^5.0.0", + "eslint": "^6.0.0 || ^7.0.0 || ^8.0.0" + }, + "peerDependenciesMeta": { + "typescript": { + "optional": true + } + } + }, + "node_modules/@typescript-eslint/eslint-plugin/node_modules/lru-cache": { + "version": "6.0.0", + "dev": true, + "license": "ISC", + "dependencies": { + "yallist": "^4.0.0" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/@typescript-eslint/eslint-plugin/node_modules/semver": { + "version": "7.5.4", + "dev": true, + "license": "ISC", + "dependencies": { + "lru-cache": "^6.0.0" + }, + "bin": { + "semver": "bin/semver.js" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/@typescript-eslint/eslint-plugin/node_modules/yallist": { + "version": "4.0.0", + "dev": true, + "license": "ISC" + }, + "node_modules/@typescript-eslint/parser": { + "version": "5.62.0", + "dev": true, + "license": "BSD-2-Clause", + "dependencies": { + "@typescript-eslint/scope-manager": "5.62.0", + "@typescript-eslint/types": "5.62.0", + "@typescript-eslint/typescript-estree": "5.62.0", + "debug": "^4.3.4" + }, + "engines": { + "node": "^12.22.0 || ^14.17.0 || >=16.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/typescript-eslint" + }, + "peerDependencies": { + "eslint": "^6.0.0 || ^7.0.0 || ^8.0.0" + }, + "peerDependenciesMeta": { + "typescript": { + "optional": true + } + } + }, + "node_modules/@typescript-eslint/scope-manager": { + "version": "5.62.0", + "dev": true, + "license": "MIT", + "dependencies": { + "@typescript-eslint/types": "5.62.0", + "@typescript-eslint/visitor-keys": "5.62.0" + }, + "engines": { + "node": "^12.22.0 || ^14.17.0 || >=16.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/typescript-eslint" + } + }, + "node_modules/@typescript-eslint/type-utils": { + "version": "5.62.0", + "dev": true, + "license": "MIT", + "dependencies": { + "@typescript-eslint/typescript-estree": "5.62.0", + "@typescript-eslint/utils": "5.62.0", + "debug": "^4.3.4", + "tsutils": "^3.21.0" + }, + "engines": { + "node": "^12.22.0 || ^14.17.0 || >=16.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/typescript-eslint" + }, + "peerDependencies": { + "eslint": "*" + }, + "peerDependenciesMeta": { + "typescript": { + "optional": true + } + } + }, + "node_modules/@typescript-eslint/types": { + "version": "5.62.0", + "dev": true, + "license": "MIT", + "engines": { + "node": "^12.22.0 || ^14.17.0 || >=16.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/typescript-eslint" + } + }, + "node_modules/@typescript-eslint/typescript-estree": { + "version": "5.62.0", + "dev": true, + "license": "BSD-2-Clause", + "dependencies": { + "@typescript-eslint/types": "5.62.0", + "@typescript-eslint/visitor-keys": "5.62.0", + "debug": "^4.3.4", + "globby": "^11.1.0", + "is-glob": "^4.0.3", + "semver": "^7.3.7", + "tsutils": "^3.21.0" + }, + "engines": { + "node": "^12.22.0 || ^14.17.0 || >=16.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/typescript-eslint" + }, + "peerDependenciesMeta": { + "typescript": { + "optional": true + } + } + }, + "node_modules/@typescript-eslint/typescript-estree/node_modules/lru-cache": { + "version": "6.0.0", + "dev": true, + "license": "ISC", + "dependencies": { + "yallist": "^4.0.0" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/@typescript-eslint/typescript-estree/node_modules/semver": { + "version": "7.5.4", + "dev": true, + "license": "ISC", + "dependencies": { + "lru-cache": "^6.0.0" + }, + "bin": { + "semver": "bin/semver.js" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/@typescript-eslint/typescript-estree/node_modules/yallist": { + "version": "4.0.0", + "dev": true, + "license": "ISC" + }, + "node_modules/@typescript-eslint/utils": { + "version": "5.62.0", + "dev": true, + "license": "MIT", + "dependencies": { + "@eslint-community/eslint-utils": "^4.2.0", + "@types/json-schema": "^7.0.9", + "@types/semver": "^7.3.12", + "@typescript-eslint/scope-manager": "5.62.0", + "@typescript-eslint/types": "5.62.0", + "@typescript-eslint/typescript-estree": "5.62.0", + "eslint-scope": "^5.1.1", + "semver": "^7.3.7" + }, + "engines": { + "node": "^12.22.0 || ^14.17.0 || >=16.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/typescript-eslint" + }, + "peerDependencies": { + "eslint": "^6.0.0 || ^7.0.0 || ^8.0.0" + } + }, + "node_modules/@typescript-eslint/utils/node_modules/lru-cache": { + "version": "6.0.0", + "dev": true, + "license": "ISC", + "dependencies": { + "yallist": "^4.0.0" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/@typescript-eslint/utils/node_modules/semver": { + "version": "7.5.4", + "dev": true, + "license": "ISC", + "dependencies": { + "lru-cache": "^6.0.0" + }, + "bin": { + "semver": "bin/semver.js" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/@typescript-eslint/utils/node_modules/yallist": { + "version": "4.0.0", + "dev": true, + "license": "ISC" + }, + "node_modules/@typescript-eslint/visitor-keys": { + "version": "5.62.0", + "dev": true, + "license": "MIT", + "dependencies": { + "@typescript-eslint/types": "5.62.0", + "eslint-visitor-keys": "^3.3.0" + }, + "engines": { + "node": "^12.22.0 || ^14.17.0 || >=16.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/typescript-eslint" + } + }, + "node_modules/@ungap/structured-clone": { + "version": "1.3.0", + "license": "ISC" + }, + "node_modules/@webassemblyjs/ast": { + "version": "1.14.1", + "license": "MIT", + "dependencies": { + "@webassemblyjs/helper-numbers": "1.13.2", + "@webassemblyjs/helper-wasm-bytecode": "1.13.2" + } + }, + "node_modules/@webassemblyjs/floating-point-hex-parser": { + "version": "1.13.2", + "license": "MIT" + }, + "node_modules/@webassemblyjs/helper-api-error": { + "version": "1.13.2", + "license": "MIT" + }, + "node_modules/@webassemblyjs/helper-buffer": { + "version": "1.14.1", + "license": "MIT" + }, + "node_modules/@webassemblyjs/helper-numbers": { + "version": "1.13.2", + "license": "MIT", + "dependencies": { + "@webassemblyjs/floating-point-hex-parser": "1.13.2", + "@webassemblyjs/helper-api-error": "1.13.2", + "@xtuc/long": "4.2.2" + } + }, + "node_modules/@webassemblyjs/helper-wasm-bytecode": { + "version": "1.13.2", + "license": "MIT" + }, + "node_modules/@webassemblyjs/helper-wasm-section": { + "version": "1.14.1", + "license": "MIT", + "dependencies": { + "@webassemblyjs/ast": "1.14.1", + "@webassemblyjs/helper-buffer": "1.14.1", + "@webassemblyjs/helper-wasm-bytecode": "1.13.2", + "@webassemblyjs/wasm-gen": "1.14.1" + } + }, + "node_modules/@webassemblyjs/ieee754": { + "version": "1.13.2", + "license": "MIT", + "dependencies": { + "@xtuc/ieee754": "^1.2.0" + } + }, + "node_modules/@webassemblyjs/leb128": { + "version": "1.13.2", + "license": "Apache-2.0", + "dependencies": { + "@xtuc/long": "4.2.2" + } + }, + "node_modules/@webassemblyjs/utf8": { + "version": "1.13.2", + "license": "MIT" + }, + "node_modules/@webassemblyjs/wasm-edit": { + "version": "1.14.1", + "license": "MIT", + "dependencies": { + "@webassemblyjs/ast": "1.14.1", + "@webassemblyjs/helper-buffer": "1.14.1", + "@webassemblyjs/helper-wasm-bytecode": "1.13.2", + "@webassemblyjs/helper-wasm-section": "1.14.1", + "@webassemblyjs/wasm-gen": "1.14.1", + "@webassemblyjs/wasm-opt": "1.14.1", + "@webassemblyjs/wasm-parser": "1.14.1", + "@webassemblyjs/wast-printer": "1.14.1" + } + }, + "node_modules/@webassemblyjs/wasm-gen": { + "version": "1.14.1", + "license": "MIT", + "dependencies": { + "@webassemblyjs/ast": "1.14.1", + "@webassemblyjs/helper-wasm-bytecode": "1.13.2", + "@webassemblyjs/ieee754": "1.13.2", + "@webassemblyjs/leb128": "1.13.2", + "@webassemblyjs/utf8": "1.13.2" + } + }, + "node_modules/@webassemblyjs/wasm-opt": { + "version": "1.14.1", + "license": "MIT", + "dependencies": { + "@webassemblyjs/ast": "1.14.1", + "@webassemblyjs/helper-buffer": "1.14.1", + "@webassemblyjs/wasm-gen": "1.14.1", + "@webassemblyjs/wasm-parser": "1.14.1" + } + }, + "node_modules/@webassemblyjs/wasm-parser": { + "version": "1.14.1", + "license": "MIT", + "dependencies": { + "@webassemblyjs/ast": "1.14.1", + "@webassemblyjs/helper-api-error": "1.13.2", + "@webassemblyjs/helper-wasm-bytecode": "1.13.2", + "@webassemblyjs/ieee754": "1.13.2", + "@webassemblyjs/leb128": "1.13.2", + "@webassemblyjs/utf8": "1.13.2" + } + }, + "node_modules/@webassemblyjs/wast-printer": { + "version": "1.14.1", + "license": "MIT", + "dependencies": { + "@webassemblyjs/ast": "1.14.1", + "@xtuc/long": "4.2.2" + } + }, + "node_modules/@xtuc/ieee754": { + "version": "1.2.0", + "license": "BSD-3-Clause" + }, + "node_modules/@xtuc/long": { + "version": "4.2.2", + "license": "Apache-2.0" + }, + "node_modules/accepts": { + "version": "1.3.8", + "license": "MIT", + "dependencies": { + "mime-types": "~2.1.34", + "negotiator": "0.6.3" + }, + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/acorn": { + "version": "6.4.2", + "license": "MIT", + "bin": { + "acorn": "bin/acorn" + }, + "engines": { + "node": ">=0.4.0" + } + }, + "node_modules/acorn-class-fields": { + "version": "0.2.1", + "license": "MIT", + "engines": { + "node": ">=4.8.2" + }, + "peerDependencies": { + "acorn": "^6.0.0" + } + }, + "node_modules/acorn-dynamic-import": { + "version": "4.0.0", + "license": "MIT", + "peerDependencies": { + "acorn": "^6.0.0" + } + }, + "node_modules/acorn-jsx": { + "version": "5.3.2", + "license": "MIT", + "peerDependencies": { + "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0" + } + }, + "node_modules/acorn-walk": { + "version": "8.2.0", + "license": "MIT", + "engines": { + "node": ">=0.4.0" + } + }, + "node_modules/address": { + "version": "1.2.2", + "license": "MIT", + "engines": { + "node": ">= 10.0.0" + } + }, + "node_modules/aggregate-error": { + "version": "3.1.0", + "license": "MIT", + "dependencies": { + "clean-stack": "^2.0.0", + "indent-string": "^4.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/ajv": { + "version": "8.12.0", + "license": "MIT", + "dependencies": { + "fast-deep-equal": "^3.1.1", + "json-schema-traverse": "^1.0.0", + "require-from-string": "^2.0.2", + "uri-js": "^4.2.2" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/epoberezkin" + } + }, + "node_modules/ajv-formats": { + "version": "2.1.1", + "license": "MIT", + "dependencies": { + "ajv": "^8.0.0" + }, + "peerDependencies": { + "ajv": "^8.0.0" + }, + "peerDependenciesMeta": { + "ajv": { + "optional": true + } + } + }, + "node_modules/ajv-keywords": { + "version": "5.1.0", + "license": "MIT", + "dependencies": { + "fast-deep-equal": "^3.1.3" + }, + "peerDependencies": { + "ajv": "^8.8.2" + } + }, + "node_modules/ajv/node_modules/json-schema-traverse": { + "version": "1.0.0", + "license": "MIT" + }, + "node_modules/algoliasearch": { + "version": "5.32.0", + "license": "MIT", + "dependencies": { + "@algolia/client-abtesting": "5.32.0", + "@algolia/client-analytics": "5.32.0", + "@algolia/client-common": "5.32.0", + "@algolia/client-insights": "5.32.0", + "@algolia/client-personalization": "5.32.0", + "@algolia/client-query-suggestions": "5.32.0", + "@algolia/client-search": "5.32.0", + "@algolia/ingestion": "1.32.0", + "@algolia/monitoring": "1.32.0", + "@algolia/recommend": "5.32.0", + "@algolia/requester-browser-xhr": "5.32.0", + "@algolia/requester-fetch": "5.32.0", + "@algolia/requester-node-http": "5.32.0" + }, + "engines": { + "node": ">= 14.0.0" + } + }, + "node_modules/algoliasearch-helper": { + "version": "3.26.0", + "license": "MIT", + "dependencies": { + "@algolia/events": "^4.0.1" + }, + "peerDependencies": { + "algoliasearch": ">= 3.1 < 6" + } + }, + "node_modules/ansi-align": { + "version": "3.0.1", + "license": "ISC", + "dependencies": { + "string-width": "^4.1.0" + } + }, + "node_modules/ansi-align/node_modules/emoji-regex": { + "version": "8.0.0", + "license": "MIT" + }, + "node_modules/ansi-align/node_modules/is-fullwidth-code-point": { + "version": "3.0.0", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/ansi-align/node_modules/string-width": { + "version": "4.2.3", + "license": "MIT", + "dependencies": { + "emoji-regex": "^8.0.0", + "is-fullwidth-code-point": "^3.0.0", + "strip-ansi": "^6.0.1" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/ansi-escapes": { + "version": "5.0.0", + "dev": true, + "license": "MIT", + "dependencies": { + "type-fest": "^1.0.2" + }, + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/ansi-html-community": { + "version": "0.0.8", + "engines": [ + "node >= 0.8.0" + ], + "license": "Apache-2.0", + "bin": { + "ansi-html": "bin/ansi-html" + } + }, + "node_modules/ansi-regex": { + "version": "5.0.1", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/ansi-styles": { + "version": "4.3.0", + "license": "MIT", + "dependencies": { + "color-convert": "^2.0.1" + }, + "engines": { + "node": ">=8" + }, + "funding": { + "url": "https://github.com/chalk/ansi-styles?sponsor=1" + } + }, + "node_modules/any-promise": { + "version": "1.3.0", + "license": "MIT" + }, + "node_modules/anymatch": { + "version": "3.1.3", + "license": "ISC", + "dependencies": { + "normalize-path": "^3.0.0", + "picomatch": "^2.0.4" + }, + "engines": { + "node": ">= 8" + } + }, + "node_modules/arg": { + "version": "5.0.2", + "license": "MIT" + }, + "node_modules/argparse": { + "version": "2.0.1", + "license": "Python-2.0" + }, + "node_modules/array-flatten": { + "version": "2.1.2", + "license": "MIT" + }, + "node_modules/array-union": { + "version": "2.1.0", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/astring": { + "version": "1.9.0", + "license": "MIT", + "bin": { + "astring": "bin/astring" + } + }, + "node_modules/autoprefixer": { + "version": "10.4.21", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/postcss/" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/autoprefixer" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "browserslist": "^4.24.4", + "caniuse-lite": "^1.0.30001702", + "fraction.js": "^4.3.7", + "normalize-range": "^0.1.2", + "picocolors": "^1.1.1", + "postcss-value-parser": "^4.2.0" + }, + "bin": { + "autoprefixer": "bin/autoprefixer" + }, + "engines": { + "node": "^10 || ^12 || >=14" + }, + "peerDependencies": { + "postcss": "^8.1.0" + } + }, + "node_modules/autoprefixer/node_modules/browserslist": { + "version": "4.24.4", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/browserslist" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/browserslist" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "caniuse-lite": "^1.0.30001688", + "electron-to-chromium": "^1.5.73", + "node-releases": "^2.0.19", + "update-browserslist-db": "^1.1.1" + }, + "bin": { + "browserslist": "cli.js" + }, + "engines": { + "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7" + } + }, + "node_modules/autoprefixer/node_modules/electron-to-chromium": { + "version": "1.5.129", + "license": "ISC" + }, + "node_modules/autoprefixer/node_modules/escalade": { + "version": "3.2.0", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/autoprefixer/node_modules/update-browserslist-db": { + "version": "1.1.3", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/browserslist" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/browserslist" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "escalade": "^3.2.0", + "picocolors": "^1.1.1" + }, + "bin": { + "update-browserslist-db": "cli.js" + }, + "peerDependencies": { + "browserslist": ">= 4.21.0" + } + }, + "node_modules/babel-loader": { + "version": "9.2.1", + "license": "MIT", + "dependencies": { + "find-cache-dir": "^4.0.0", + "schema-utils": "^4.0.0" + }, + "engines": { + "node": ">= 14.15.0" + }, + "peerDependencies": { + "@babel/core": "^7.12.0", + "webpack": ">=5" + } + }, + "node_modules/babel-plugin-dynamic-import-node": { + "version": "2.3.3", + "license": "MIT", + "dependencies": { + "object.assign": "^4.1.0" + } + }, + "node_modules/babel-plugin-polyfill-corejs2": { + "version": "0.4.14", + "license": "MIT", + "dependencies": { + "@babel/compat-data": "^7.27.7", + "@babel/helper-define-polyfill-provider": "^0.6.5", + "semver": "^6.3.1" + }, + "peerDependencies": { + "@babel/core": "^7.4.0 || ^8.0.0-0 <8.0.0" + } + }, + "node_modules/babel-plugin-polyfill-corejs3": { + "version": "0.13.0", + "license": "MIT", + "dependencies": { + "@babel/helper-define-polyfill-provider": "^0.6.5", + "core-js-compat": "^3.43.0" + }, + "peerDependencies": { + "@babel/core": "^7.4.0 || ^8.0.0-0 <8.0.0" + } + }, + "node_modules/babel-plugin-polyfill-regenerator": { + "version": "0.6.5", + "license": "MIT", + "dependencies": { + "@babel/helper-define-polyfill-provider": "^0.6.5" + }, + "peerDependencies": { + "@babel/core": "^7.4.0 || ^8.0.0-0 <8.0.0" + } + }, + "node_modules/bail": { + "version": "2.0.2", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/balanced-match": { + "version": "1.0.2", + "license": "MIT" + }, + "node_modules/batch": { + "version": "0.6.1", + "license": "MIT" + }, + "node_modules/big.js": { + "version": "5.2.2", + "license": "MIT", + "engines": { + "node": "*" + } + }, + "node_modules/binary-extensions": { + "version": "2.2.0", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/body-parser": { + "version": "1.20.1", + "license": "MIT", + "dependencies": { + "bytes": "3.1.2", + "content-type": "~1.0.4", + "debug": "2.6.9", + "depd": "2.0.0", + "destroy": "1.2.0", + "http-errors": "2.0.0", + "iconv-lite": "0.4.24", + "on-finished": "2.4.1", + "qs": "6.11.0", + "raw-body": "2.5.1", + "type-is": "~1.6.18", + "unpipe": "1.0.0" + }, + "engines": { + "node": ">= 0.8", + "npm": "1.2.8000 || >= 1.4.16" + } + }, + "node_modules/body-parser/node_modules/bytes": { + "version": "3.1.2", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/body-parser/node_modules/debug": { + "version": "2.6.9", + "license": "MIT", + "dependencies": { + "ms": "2.0.0" + } + }, + "node_modules/body-parser/node_modules/ms": { + "version": "2.0.0", + "license": "MIT" + }, + "node_modules/bonjour-service": { + "version": "1.1.1", + "license": "MIT", + "dependencies": { + "array-flatten": "^2.1.2", + "dns-equal": "^1.0.0", + "fast-deep-equal": "^3.1.3", + "multicast-dns": "^7.2.5" + } + }, + "node_modules/boolbase": { + "version": "1.0.0", + "license": "ISC" + }, + "node_modules/boxen": { + "version": "6.2.1", + "license": "MIT", + "dependencies": { + "ansi-align": "^3.0.1", + "camelcase": "^6.2.0", + "chalk": "^4.1.2", + "cli-boxes": "^3.0.0", + "string-width": "^5.0.1", + "type-fest": "^2.5.0", + "widest-line": "^4.0.1", + "wrap-ansi": "^8.0.1" + }, + "engines": { + "node": "^12.20.0 || ^14.13.1 || >=16.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/boxen/node_modules/type-fest": { + "version": "2.19.0", + "license": "(MIT OR CC0-1.0)", + "engines": { + "node": ">=12.20" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/brace-expansion": { + "version": "1.1.11", + "license": "MIT", + "dependencies": { + "balanced-match": "^1.0.0", + "concat-map": "0.0.1" + } + }, + "node_modules/braces": { + "version": "3.0.2", + "license": "MIT", + "dependencies": { + "fill-range": "^7.0.1" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/browserslist": { + "version": "4.25.1", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/browserslist" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/browserslist" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "caniuse-lite": "^1.0.30001726", + "electron-to-chromium": "^1.5.173", + "node-releases": "^2.0.19", + "update-browserslist-db": "^1.1.3" + }, + "bin": { + "browserslist": "cli.js" + }, + "engines": { + "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7" + } + }, + "node_modules/browserslist/node_modules/caniuse-lite": { + "version": "1.0.30001727", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/browserslist" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/caniuse-lite" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "CC-BY-4.0" + }, + "node_modules/buffer-from": { + "version": "1.1.2", + "license": "MIT" + }, + "node_modules/bytes": { + "version": "3.0.0", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/cacheable-lookup": { + "version": "7.0.0", + "license": "MIT", + "engines": { + "node": ">=14.16" + } + }, + "node_modules/cacheable-request": { + "version": "10.2.14", + "license": "MIT", + "dependencies": { + "@types/http-cache-semantics": "^4.0.2", + "get-stream": "^6.0.1", + "http-cache-semantics": "^4.1.1", + "keyv": "^4.5.3", + "mimic-response": "^4.0.0", + "normalize-url": "^8.0.0", + "responselike": "^3.0.0" + }, + "engines": { + "node": ">=14.16" + } + }, + "node_modules/call-bind": { + "version": "1.0.2", + "license": "MIT", + "dependencies": { + "function-bind": "^1.1.1", + "get-intrinsic": "^1.0.2" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/callsites": { + "version": "3.1.0", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/camel-case": { + "version": "4.1.2", + "license": "MIT", + "dependencies": { + "pascal-case": "^3.1.2", + "tslib": "^2.0.3" + } + }, + "node_modules/camel-case/node_modules/tslib": { + "version": "2.6.2", + "license": "0BSD" + }, + "node_modules/camelcase": { + "version": "6.3.0", + "license": "MIT", + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/camelcase-css": { + "version": "2.0.1", + "license": "MIT", + "engines": { + "node": ">= 6" + } + }, + "node_modules/caniuse-api": { + "version": "3.0.0", + "license": "MIT", + "dependencies": { + "browserslist": "^4.0.0", + "caniuse-lite": "^1.0.0", + "lodash.memoize": "^4.1.2", + "lodash.uniq": "^4.5.0" + } + }, + "node_modules/caniuse-api/node_modules/browserslist": { + "version": "4.22.1", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/browserslist" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/browserslist" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "caniuse-lite": "^1.0.30001541", + "electron-to-chromium": "^1.4.535", + "node-releases": "^2.0.13", + "update-browserslist-db": "^1.0.13" + }, + "bin": { + "browserslist": "cli.js" + }, + "engines": { + "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7" + } + }, + "node_modules/caniuse-api/node_modules/caniuse-lite": { + "version": "1.0.30001546", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/browserslist" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/caniuse-lite" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "CC-BY-4.0" + }, + "node_modules/caniuse-api/node_modules/electron-to-chromium": { + "version": "1.4.544", + "license": "ISC" + }, + "node_modules/caniuse-api/node_modules/node-releases": { + "version": "2.0.13", + "license": "MIT" + }, + "node_modules/caniuse-api/node_modules/picocolors": { + "version": "1.0.0", + "license": "ISC" + }, + "node_modules/caniuse-api/node_modules/update-browserslist-db": { + "version": "1.0.13", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/browserslist" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/browserslist" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "escalade": "^3.1.1", + "picocolors": "^1.0.0" + }, + "bin": { + "update-browserslist-db": "cli.js" + }, + "peerDependencies": { + "browserslist": ">= 4.21.0" + } + }, + "node_modules/caniuse-lite": { + "version": "1.0.30001707", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/browserslist" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/caniuse-lite" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "CC-BY-4.0" + }, + "node_modules/ccount": { + "version": "2.0.1", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/chalk": { + "version": "4.1.2", + "license": "MIT", + "dependencies": { + "ansi-styles": "^4.1.0", + "supports-color": "^7.1.0" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/chalk/chalk?sponsor=1" + } + }, + "node_modules/chalk/node_modules/supports-color": { + "version": "7.2.0", + "license": "MIT", + "dependencies": { + "has-flag": "^4.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/char-regex": { + "version": "1.0.2", + "license": "MIT", + "engines": { + "node": ">=10" + } + }, + "node_modules/character-entities": { + "version": "2.0.2", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/character-entities-html4": { + "version": "2.1.0", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/character-entities-legacy": { + "version": "3.0.0", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/character-reference-invalid": { + "version": "2.0.1", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/cheerio": { + "version": "1.0.0-rc.12", + "license": "MIT", + "dependencies": { + "cheerio-select": "^2.1.0", + "dom-serializer": "^2.0.0", + "domhandler": "^5.0.3", + "domutils": "^3.0.1", + "htmlparser2": "^8.0.1", + "parse5": "^7.0.0", + "parse5-htmlparser2-tree-adapter": "^7.0.0" + }, + "engines": { + "node": ">= 6" + }, + "funding": { + "url": "https://github.com/cheeriojs/cheerio?sponsor=1" + } + }, + "node_modules/cheerio-select": { + "version": "2.1.0", + "license": "BSD-2-Clause", + "dependencies": { + "boolbase": "^1.0.0", + "css-select": "^5.1.0", + "css-what": "^6.1.0", + "domelementtype": "^2.3.0", + "domhandler": "^5.0.3", + "domutils": "^3.0.1" + }, + "funding": { + "url": "https://github.com/sponsors/fb55" + } + }, + "node_modules/chokidar": { + "version": "3.5.3", + "funding": [ + { + "type": "individual", + "url": "https://paulmillr.com/funding/" + } + ], + "license": "MIT", + "dependencies": { + "anymatch": "~3.1.2", + "braces": "~3.0.2", + "glob-parent": "~5.1.2", + "is-binary-path": "~2.1.0", + "is-glob": "~4.0.1", + "normalize-path": "~3.0.0", + "readdirp": "~3.6.0" + }, + "engines": { + "node": ">= 8.10.0" + }, + "optionalDependencies": { + "fsevents": "~2.3.2" + } + }, + "node_modules/chrome-trace-event": { + "version": "1.0.3", + "license": "MIT", + "engines": { + "node": ">=6.0" + } + }, + "node_modules/ci-info": { + "version": "3.9.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/sibiraj-s" + } + ], + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/clean-css": { + "version": "5.3.3", + "license": "MIT", + "dependencies": { + "source-map": "~0.6.0" + }, + "engines": { + "node": ">= 10.0" + } + }, + "node_modules/clean-stack": { + "version": "2.2.0", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/cli-boxes": { + "version": "3.0.0", + "license": "MIT", + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/cli-cursor": { + "version": "4.0.0", + "dev": true, + "license": "MIT", + "dependencies": { + "restore-cursor": "^4.0.0" + }, + "engines": { + "node": "^12.20.0 || ^14.13.1 || >=16.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/cli-table3": { + "version": "0.6.5", + "license": "MIT", + "dependencies": { + "string-width": "^4.2.0" + }, + "engines": { + "node": "10.* || >= 12.*" + }, + "optionalDependencies": { + "@colors/colors": "1.5.0" + } + }, + "node_modules/cli-table3/node_modules/emoji-regex": { + "version": "8.0.0", + "license": "MIT" + }, + "node_modules/cli-table3/node_modules/is-fullwidth-code-point": { + "version": "3.0.0", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/cli-table3/node_modules/string-width": { + "version": "4.2.3", + "license": "MIT", + "dependencies": { + "emoji-regex": "^8.0.0", + "is-fullwidth-code-point": "^3.0.0", + "strip-ansi": "^6.0.1" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/cli-truncate": { + "version": "3.1.0", + "dev": true, + "license": "MIT", + "dependencies": { + "slice-ansi": "^5.0.0", + "string-width": "^5.0.0" + }, + "engines": { + "node": "^12.20.0 || ^14.13.1 || >=16.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/clone-deep": { + "version": "4.0.1", + "license": "MIT", + "dependencies": { + "is-plain-object": "^2.0.4", + "kind-of": "^6.0.2", + "shallow-clone": "^3.0.0" + }, + "engines": { + "node": ">=6" + } + }, + "node_modules/clsx": { + "version": "1.2.1", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/collapse-white-space": { + "version": "2.1.0", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/color-convert": { + "version": "2.0.1", + "license": "MIT", + "dependencies": { + "color-name": "~1.1.4" + }, + "engines": { + "node": ">=7.0.0" + } + }, + "node_modules/color-name": { + "version": "1.1.4", + "license": "MIT" + }, + "node_modules/colord": { + "version": "2.9.3", + "license": "MIT" + }, + "node_modules/colorette": { + "version": "2.0.20", + "license": "MIT" + }, + "node_modules/combine-promises": { + "version": "1.2.0", + "license": "MIT", + "engines": { + "node": ">=10" + } + }, + "node_modules/comlink": { + "version": "4.4.2", + "resolved": "https://registry.npmjs.org/comlink/-/comlink-4.4.2.tgz", + "integrity": "sha512-OxGdvBmJuNKSCMO4NTl1L47VRp6xn2wG4F/2hYzB6tiCb709otOxtEYCSvK80PtjODfXXZu8ds+Nw5kVCjqd2g==", + "license": "Apache-2.0" + }, + "node_modules/comma-separated-tokens": { + "version": "2.0.3", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/commander": { + "version": "5.1.0", + "license": "MIT", + "engines": { + "node": ">= 6" + } + }, + "node_modules/common-path-prefix": { + "version": "3.0.0", + "license": "ISC" + }, + "node_modules/compressible": { + "version": "2.0.18", + "license": "MIT", + "dependencies": { + "mime-db": ">= 1.43.0 < 2" + }, + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/compression": { + "version": "1.7.4", + "license": "MIT", + "dependencies": { + "accepts": "~1.3.5", + "bytes": "3.0.0", + "compressible": "~2.0.16", + "debug": "2.6.9", + "on-headers": "~1.0.2", + "safe-buffer": "5.1.2", + "vary": "~1.1.2" + }, + "engines": { + "node": ">= 0.8.0" + } + }, + "node_modules/compression/node_modules/debug": { + "version": "2.6.9", + "license": "MIT", + "dependencies": { + "ms": "2.0.0" + } + }, + "node_modules/compression/node_modules/ms": { + "version": "2.0.0", + "license": "MIT" + }, + "node_modules/compression/node_modules/safe-buffer": { + "version": "5.1.2", + "license": "MIT" + }, + "node_modules/concat-map": { + "version": "0.0.1", + "license": "MIT" + }, + "node_modules/config-chain": { + "version": "1.1.13", + "license": "MIT", + "dependencies": { + "ini": "^1.3.4", + "proto-list": "~1.2.1" + } + }, + "node_modules/configstore": { + "version": "6.0.0", + "license": "BSD-2-Clause", + "dependencies": { + "dot-prop": "^6.0.1", + "graceful-fs": "^4.2.6", + "unique-string": "^3.0.0", + "write-file-atomic": "^3.0.3", + "xdg-basedir": "^5.0.1" + }, + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/yeoman/configstore?sponsor=1" + } + }, + "node_modules/connect-history-api-fallback": { + "version": "2.0.0", + "license": "MIT", + "engines": { + "node": ">=0.8" + } + }, + "node_modules/consola": { + "version": "3.4.2", + "license": "MIT", + "engines": { + "node": "^14.18.0 || >=16.10.0" + } + }, + "node_modules/content-disposition": { + "version": "0.5.2", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/content-type": { + "version": "1.0.5", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/convert-source-map": { + "version": "2.0.0", + "license": "MIT" + }, + "node_modules/cookie": { + "version": "0.5.0", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/cookie-signature": { + "version": "1.0.6", + "license": "MIT" + }, + "node_modules/copy-text-to-clipboard": { + "version": "3.2.0", + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/copy-webpack-plugin": { + "version": "11.0.0", + "license": "MIT", + "dependencies": { + "fast-glob": "^3.2.11", + "glob-parent": "^6.0.1", + "globby": "^13.1.1", + "normalize-path": "^3.0.0", + "schema-utils": "^4.0.0", + "serialize-javascript": "^6.0.0" + }, + "engines": { + "node": ">= 14.15.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + }, + "peerDependencies": { + "webpack": "^5.1.0" + } + }, + "node_modules/copy-webpack-plugin/node_modules/glob-parent": { + "version": "6.0.2", + "license": "ISC", + "dependencies": { + "is-glob": "^4.0.3" + }, + "engines": { + "node": ">=10.13.0" + } + }, + "node_modules/copy-webpack-plugin/node_modules/globby": { + "version": "13.2.2", + "license": "MIT", + "dependencies": { + "dir-glob": "^3.0.1", + "fast-glob": "^3.3.0", + "ignore": "^5.2.4", + "merge2": "^1.4.1", + "slash": "^4.0.0" + }, + "engines": { + "node": "^12.20.0 || ^14.13.1 || >=16.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/copy-webpack-plugin/node_modules/slash": { + "version": "4.0.0", + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/core-js": { + "version": "3.44.0", + "hasInstallScript": true, + "license": "MIT", + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/core-js" + } + }, + "node_modules/core-js-compat": { + "version": "3.44.0", + "license": "MIT", + "dependencies": { + "browserslist": "^4.25.1" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/core-js" + } + }, + "node_modules/core-js-pure": { + "version": "3.44.0", + "hasInstallScript": true, + "license": "MIT", + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/core-js" + } + }, + "node_modules/core-util-is": { + "version": "1.0.3", + "license": "MIT" + }, + "node_modules/cosmiconfig": { + "version": "8.3.6", + "license": "MIT", + "dependencies": { + "import-fresh": "^3.3.0", + "js-yaml": "^4.1.0", + "parse-json": "^5.2.0", + "path-type": "^4.0.0" + }, + "engines": { + "node": ">=14" + }, + "funding": { + "url": "https://github.com/sponsors/d-fischer" + }, + "peerDependencies": { + "typescript": ">=4.9.5" + }, + "peerDependenciesMeta": { + "typescript": { + "optional": true + } + } + }, + "node_modules/cross-spawn": { + "version": "7.0.3", + "license": "MIT", + "dependencies": { + "path-key": "^3.1.0", + "shebang-command": "^2.0.0", + "which": "^2.0.1" + }, + "engines": { + "node": ">= 8" + } + }, + "node_modules/crypto-random-string": { + "version": "4.0.0", + "license": "MIT", + "dependencies": { + "type-fest": "^1.0.1" + }, + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/css-loader": { + "version": "6.11.0", + "license": "MIT", + "dependencies": { + "icss-utils": "^5.1.0", + "postcss": "^8.4.33", + "postcss-modules-extract-imports": "^3.1.0", + "postcss-modules-local-by-default": "^4.0.5", + "postcss-modules-scope": "^3.2.0", + "postcss-modules-values": "^4.0.0", + "postcss-value-parser": "^4.2.0", + "semver": "^7.5.4" + }, + "engines": { + "node": ">= 12.13.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + }, + "peerDependencies": { + "@rspack/core": "0.x || 1.x", + "webpack": "^5.0.0" + }, + "peerDependenciesMeta": { + "@rspack/core": { + "optional": true + }, + "webpack": { + "optional": true + } + } + }, + "node_modules/css-loader/node_modules/icss-utils": { + "version": "5.1.0", + "license": "ISC", + "engines": { + "node": "^10 || ^12 || >= 14" + }, + "peerDependencies": { + "postcss": "^8.1.0" + } + }, + "node_modules/css-loader/node_modules/nanoid": { + "version": "3.3.11", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "bin": { + "nanoid": "bin/nanoid.cjs" + }, + "engines": { + "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1" + } + }, + "node_modules/css-loader/node_modules/postcss": { + "version": "8.5.6", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/postcss/" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/postcss" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "nanoid": "^3.3.11", + "picocolors": "^1.1.1", + "source-map-js": "^1.2.1" + }, + "engines": { + "node": "^10 || ^12 || >=14" + } + }, + "node_modules/css-loader/node_modules/postcss-modules-extract-imports": { + "version": "3.1.0", + "license": "ISC", + "engines": { + "node": "^10 || ^12 || >= 14" + }, + "peerDependencies": { + "postcss": "^8.1.0" + } + }, + "node_modules/css-loader/node_modules/postcss-modules-local-by-default": { + "version": "4.2.0", + "license": "MIT", + "dependencies": { + "icss-utils": "^5.0.0", + "postcss-selector-parser": "^7.0.0", + "postcss-value-parser": "^4.1.0" + }, + "engines": { + "node": "^10 || ^12 || >= 14" + }, + "peerDependencies": { + "postcss": "^8.1.0" + } + }, + "node_modules/css-loader/node_modules/postcss-modules-scope": { + "version": "3.2.1", + "license": "ISC", + "dependencies": { + "postcss-selector-parser": "^7.0.0" + }, + "engines": { + "node": "^10 || ^12 || >= 14" + }, + "peerDependencies": { + "postcss": "^8.1.0" + } + }, + "node_modules/css-loader/node_modules/postcss-modules-values": { + "version": "4.0.0", + "license": "ISC", + "dependencies": { + "icss-utils": "^5.0.0" + }, + "engines": { + "node": "^10 || ^12 || >= 14" + }, + "peerDependencies": { + "postcss": "^8.1.0" + } + }, + "node_modules/css-loader/node_modules/semver": { + "version": "7.7.2", + "license": "ISC", + "bin": { + "semver": "bin/semver.js" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/css-minimizer-webpack-plugin": { + "version": "5.0.1", + "license": "MIT", + "dependencies": { + "@jridgewell/trace-mapping": "^0.3.18", + "cssnano": "^6.0.1", + "jest-worker": "^29.4.3", + "postcss": "^8.4.24", + "schema-utils": "^4.0.1", + "serialize-javascript": "^6.0.1" + }, + "engines": { + "node": ">= 14.15.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + }, + "peerDependencies": { + "webpack": "^5.0.0" + }, + "peerDependenciesMeta": { + "@parcel/css": { + "optional": true + }, + "@swc/css": { + "optional": true + }, + "clean-css": { + "optional": true + }, + "csso": { + "optional": true + }, + "esbuild": { + "optional": true + }, + "lightningcss": { + "optional": true + } + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/css-declaration-sorter": { + "version": "7.2.0", + "license": "ISC", + "engines": { + "node": "^14 || ^16 || >=18" + }, + "peerDependencies": { + "postcss": "^8.0.9" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/cssnano": { + "version": "6.1.2", + "license": "MIT", + "dependencies": { + "cssnano-preset-default": "^6.1.2", + "lilconfig": "^3.1.1" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/cssnano" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/cssnano-preset-default": { + "version": "6.1.2", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "css-declaration-sorter": "^7.2.0", + "cssnano-utils": "^4.0.2", + "postcss-calc": "^9.0.1", + "postcss-colormin": "^6.1.0", + "postcss-convert-values": "^6.1.0", + "postcss-discard-comments": "^6.0.2", + "postcss-discard-duplicates": "^6.0.3", + "postcss-discard-empty": "^6.0.3", + "postcss-discard-overridden": "^6.0.2", + "postcss-merge-longhand": "^6.0.5", + "postcss-merge-rules": "^6.1.1", + "postcss-minify-font-values": "^6.1.0", + "postcss-minify-gradients": "^6.0.3", + "postcss-minify-params": "^6.1.0", + "postcss-minify-selectors": "^6.0.4", + "postcss-normalize-charset": "^6.0.2", + "postcss-normalize-display-values": "^6.0.2", + "postcss-normalize-positions": "^6.0.2", + "postcss-normalize-repeat-style": "^6.0.2", + "postcss-normalize-string": "^6.0.2", + "postcss-normalize-timing-functions": "^6.0.2", + "postcss-normalize-unicode": "^6.1.0", + "postcss-normalize-url": "^6.0.2", + "postcss-normalize-whitespace": "^6.0.2", + "postcss-ordered-values": "^6.0.2", + "postcss-reduce-initial": "^6.1.0", + "postcss-reduce-transforms": "^6.0.2", + "postcss-svgo": "^6.0.3", + "postcss-unique-selectors": "^6.0.4" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/cssnano-utils": { + "version": "4.0.2", + "license": "MIT", + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/jest-worker": { + "version": "29.7.0", + "license": "MIT", + "dependencies": { + "@types/node": "*", + "jest-util": "^29.7.0", + "merge-stream": "^2.0.0", + "supports-color": "^8.0.0" + }, + "engines": { + "node": "^14.15.0 || ^16.10.0 || >=18.0.0" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/nanoid": { + "version": "3.3.11", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "bin": { + "nanoid": "bin/nanoid.cjs" + }, + "engines": { + "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss": { + "version": "8.5.6", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/postcss/" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/postcss" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "nanoid": "^3.3.11", + "picocolors": "^1.1.1", + "source-map-js": "^1.2.1" + }, + "engines": { + "node": "^10 || ^12 || >=14" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-calc": { + "version": "9.0.1", + "license": "MIT", + "dependencies": { + "postcss-selector-parser": "^6.0.11", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.2.2" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-colormin": { + "version": "6.1.0", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "caniuse-api": "^3.0.0", + "colord": "^2.9.3", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-convert-values": { + "version": "6.1.0", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-discard-comments": { + "version": "6.0.2", + "license": "MIT", + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-discard-duplicates": { + "version": "6.0.3", + "license": "MIT", + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-discard-empty": { + "version": "6.0.3", + "license": "MIT", + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-discard-overridden": { + "version": "6.0.2", + "license": "MIT", + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-merge-longhand": { + "version": "6.0.5", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0", + "stylehacks": "^6.1.1" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-merge-rules": { + "version": "6.1.1", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "caniuse-api": "^3.0.0", + "cssnano-utils": "^4.0.2", + "postcss-selector-parser": "^6.0.16" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-minify-font-values": { + "version": "6.1.0", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-minify-gradients": { + "version": "6.0.3", + "license": "MIT", + "dependencies": { + "colord": "^2.9.3", + "cssnano-utils": "^4.0.2", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-minify-params": { + "version": "6.1.0", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "cssnano-utils": "^4.0.2", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-minify-selectors": { + "version": "6.0.4", + "license": "MIT", + "dependencies": { + "postcss-selector-parser": "^6.0.16" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-normalize-charset": { + "version": "6.0.2", + "license": "MIT", + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-normalize-display-values": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-normalize-positions": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-normalize-repeat-style": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-normalize-string": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-normalize-timing-functions": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-normalize-unicode": { + "version": "6.1.0", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-normalize-url": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-normalize-whitespace": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-ordered-values": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "cssnano-utils": "^4.0.2", + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-reduce-initial": { + "version": "6.1.0", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "caniuse-api": "^3.0.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-reduce-transforms": { + "version": "6.0.2", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-selector-parser": { + "version": "6.1.2", + "license": "MIT", + "dependencies": { + "cssesc": "^3.0.0", + "util-deprecate": "^1.0.2" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-svgo": { + "version": "6.0.3", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.2.0", + "svgo": "^3.2.0" + }, + "engines": { + "node": "^14 || ^16 || >= 18" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/postcss-unique-selectors": { + "version": "6.0.4", + "license": "MIT", + "dependencies": { + "postcss-selector-parser": "^6.0.16" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/schema-utils": { + "version": "4.3.2", + "license": "MIT", + "dependencies": { + "@types/json-schema": "^7.0.9", + "ajv": "^8.9.0", + "ajv-formats": "^2.1.1", + "ajv-keywords": "^5.1.0" + }, + "engines": { + "node": ">= 10.13.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + } + }, + "node_modules/css-minimizer-webpack-plugin/node_modules/stylehacks": { + "version": "6.1.1", + "license": "MIT", + "dependencies": { + "browserslist": "^4.23.0", + "postcss-selector-parser": "^6.0.16" + }, + "engines": { + "node": "^14 || ^16 || >=18.0" + }, + "peerDependencies": { + "postcss": "^8.4.31" + } + }, + "node_modules/css-select": { + "version": "5.1.0", + "license": "BSD-2-Clause", + "dependencies": { + "boolbase": "^1.0.0", + "css-what": "^6.1.0", + "domhandler": "^5.0.2", + "domutils": "^3.0.1", + "nth-check": "^2.0.1" + }, + "funding": { + "url": "https://github.com/sponsors/fb55" + } + }, + "node_modules/css-tree": { + "version": "2.3.1", + "license": "MIT", + "dependencies": { + "mdn-data": "2.0.30", + "source-map-js": "^1.0.1" + }, + "engines": { + "node": "^10 || ^12.20.0 || ^14.13.0 || >=15.0.0" + } + }, + "node_modules/css-what": { + "version": "6.1.0", + "license": "BSD-2-Clause", + "engines": { + "node": ">= 6" + }, + "funding": { + "url": "https://github.com/sponsors/fb55" + } + }, + "node_modules/cssdb": { + "version": "8.3.1", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/csstools" + }, + { + "type": "github", + "url": "https://github.com/sponsors/csstools" + } + ], + "license": "MIT-0" + }, + "node_modules/cssesc": { + "version": "3.0.0", + "license": "MIT", + "bin": { + "cssesc": "bin/cssesc" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/csso": { + "version": "5.0.5", + "license": "MIT", + "dependencies": { + "css-tree": "~2.2.0" + }, + "engines": { + "node": "^10 || ^12.20.0 || ^14.13.0 || >=15.0.0", + "npm": ">=7.0.0" + } + }, + "node_modules/csso/node_modules/css-tree": { + "version": "2.2.1", + "license": "MIT", + "dependencies": { + "mdn-data": "2.0.28", + "source-map-js": "^1.0.1" + }, + "engines": { + "node": "^10 || ^12.20.0 || ^14.13.0 || >=15.0.0", + "npm": ">=7.0.0" + } + }, + "node_modules/csso/node_modules/mdn-data": { + "version": "2.0.28", + "license": "CC0-1.0" + }, + "node_modules/csstype": { + "version": "3.1.2", + "license": "MIT" + }, + "node_modules/debounce": { + "version": "1.2.1", + "license": "MIT" + }, + "node_modules/debug": { + "version": "4.3.4", + "license": "MIT", + "dependencies": { + "ms": "2.1.2" + }, + "engines": { + "node": ">=6.0" + }, + "peerDependenciesMeta": { + "supports-color": { + "optional": true + } + } + }, + "node_modules/debug/node_modules/ms": { + "version": "2.1.2", + "license": "MIT" + }, + "node_modules/decode-named-character-reference": { + "version": "1.0.2", + "license": "MIT", + "dependencies": { + "character-entities": "^2.0.0" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/decompress-response": { + "version": "6.0.0", + "license": "MIT", + "dependencies": { + "mimic-response": "^3.1.0" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/decompress-response/node_modules/mimic-response": { + "version": "3.1.0", + "license": "MIT", + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/deep-extend": { + "version": "0.6.0", + "license": "MIT", + "engines": { + "node": ">=4.0.0" + } + }, + "node_modules/deep-is": { + "version": "0.1.4", + "dev": true, + "license": "MIT" + }, + "node_modules/deepmerge": { + "version": "4.3.1", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/default-gateway": { + "version": "6.0.3", + "license": "BSD-2-Clause", + "dependencies": { + "execa": "^5.0.0" + }, + "engines": { + "node": ">= 10" + } + }, + "node_modules/defer-to-connect": { + "version": "2.0.1", + "license": "MIT", + "engines": { + "node": ">=10" + } + }, + "node_modules/define-data-property": { + "version": "1.1.0", + "license": "MIT", + "dependencies": { + "get-intrinsic": "^1.2.1", + "gopd": "^1.0.1", + "has-property-descriptors": "^1.0.0" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/define-lazy-prop": { + "version": "2.0.0", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/define-properties": { + "version": "1.2.1", + "license": "MIT", + "dependencies": { + "define-data-property": "^1.0.1", + "has-property-descriptors": "^1.0.0", + "object-keys": "^1.1.1" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/depd": { + "version": "2.0.0", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/dequal": { + "version": "2.0.3", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/destroy": { + "version": "1.2.0", + "license": "MIT", + "engines": { + "node": ">= 0.8", + "npm": "1.2.8000 || >= 1.4.16" + } + }, + "node_modules/detect-node": { + "version": "2.1.0", + "license": "MIT" + }, + "node_modules/detect-port": { + "version": "1.6.1", + "license": "MIT", + "dependencies": { + "address": "^1.0.1", + "debug": "4" + }, + "bin": { + "detect": "bin/detect-port.js", + "detect-port": "bin/detect-port.js" + }, + "engines": { + "node": ">= 4.0.0" + } + }, + "node_modules/devlop": { + "version": "1.1.0", + "license": "MIT", + "dependencies": { + "dequal": "^2.0.0" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/didyoumean": { + "version": "1.2.2", + "license": "Apache-2.0" + }, + "node_modules/diff": { + "version": "5.1.0", + "license": "BSD-3-Clause", + "engines": { + "node": ">=0.3.1" + } + }, + "node_modules/dir-glob": { + "version": "3.0.1", + "license": "MIT", + "dependencies": { + "path-type": "^4.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/dlv": { + "version": "1.1.3", + "license": "MIT" + }, + "node_modules/dns-equal": { + "version": "1.0.0", + "license": "MIT" + }, + "node_modules/dns-packet": { + "version": "5.6.1", + "license": "MIT", + "dependencies": { + "@leichtgewicht/ip-codec": "^2.0.1" + }, + "engines": { + "node": ">=6" + } + }, + "node_modules/doctrine": { + "version": "3.0.0", + "dev": true, + "license": "Apache-2.0", + "dependencies": { + "esutils": "^2.0.2" + }, + "engines": { + "node": ">=6.0.0" + } + }, + "node_modules/dom-converter": { + "version": "0.2.0", + "license": "MIT", + "dependencies": { + "utila": "~0.4" + } + }, + "node_modules/dom-serializer": { + "version": "2.0.0", + "license": "MIT", + "dependencies": { + "domelementtype": "^2.3.0", + "domhandler": "^5.0.2", + "entities": "^4.2.0" + }, + "funding": { + "url": "https://github.com/cheeriojs/dom-serializer?sponsor=1" + } + }, + "node_modules/domelementtype": { + "version": "2.3.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/fb55" + } + ], + "license": "BSD-2-Clause" + }, + "node_modules/domhandler": { + "version": "5.0.3", + "license": "BSD-2-Clause", + "dependencies": { + "domelementtype": "^2.3.0" + }, + "engines": { + "node": ">= 4" + }, + "funding": { + "url": "https://github.com/fb55/domhandler?sponsor=1" + } + }, + "node_modules/domutils": { + "version": "3.2.2", + "resolved": "https://registry.npmjs.org/domutils/-/domutils-3.2.2.tgz", + "integrity": "sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==", + "license": "BSD-2-Clause", + "dependencies": { + "dom-serializer": "^2.0.0", + "domelementtype": "^2.3.0", + "domhandler": "^5.0.3" + }, + "funding": { + "url": "https://github.com/fb55/domutils?sponsor=1" + } + }, + "node_modules/dot-case": { + "version": "3.0.4", + "license": "MIT", + "dependencies": { + "no-case": "^3.0.4", + "tslib": "^2.0.3" + } + }, + "node_modules/dot-case/node_modules/tslib": { + "version": "2.6.2", + "license": "0BSD" + }, + "node_modules/dot-prop": { + "version": "6.0.1", + "license": "MIT", + "dependencies": { + "is-obj": "^2.0.0" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/duplexer": { + "version": "0.1.2", + "license": "MIT" + }, + "node_modules/eastasianwidth": { + "version": "0.2.0", + "license": "MIT" + }, + "node_modules/ee-first": { + "version": "1.1.1", + "license": "MIT" + }, + "node_modules/electron-to-chromium": { + "version": "1.5.182", + "license": "ISC" + }, + "node_modules/emoji-regex": { + "version": "9.2.2", + "license": "MIT" + }, + "node_modules/emojilib": { + "version": "2.4.0", + "license": "MIT" + }, + "node_modules/emojis-list": { + "version": "3.0.0", + "license": "MIT", + "engines": { + "node": ">= 4" + } + }, + "node_modules/emoticon": { + "version": "4.1.0", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/encodeurl": { + "version": "1.0.2", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/encoding-sniffer": { + "version": "0.2.1", + "resolved": "https://registry.npmjs.org/encoding-sniffer/-/encoding-sniffer-0.2.1.tgz", + "integrity": "sha512-5gvq20T6vfpekVtqrYQsSCFZ1wEg5+wW0/QaZMWkFr6BqD3NfKs0rLCx4rrVlSWJeZb5NBJgVLswK/w2MWU+Gw==", + "license": "MIT", + "dependencies": { + "iconv-lite": "^0.6.3", + "whatwg-encoding": "^3.1.1" + }, + "funding": { + "url": "https://github.com/fb55/encoding-sniffer?sponsor=1" + } + }, + "node_modules/encoding-sniffer/node_modules/iconv-lite": { + "version": "0.6.3", + "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz", + "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==", + "license": "MIT", + "dependencies": { + "safer-buffer": ">= 2.1.2 < 3.0.0" + }, + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/enhanced-resolve": { + "version": "5.18.2", + "license": "MIT", + "dependencies": { + "graceful-fs": "^4.2.4", + "tapable": "^2.2.0" + }, + "engines": { + "node": ">=10.13.0" + } + }, + "node_modules/entities": { + "version": "4.5.0", + "license": "BSD-2-Clause", + "engines": { + "node": ">=0.12" + }, + "funding": { + "url": "https://github.com/fb55/entities?sponsor=1" + } + }, + "node_modules/error-ex": { + "version": "1.3.2", + "license": "MIT", + "dependencies": { + "is-arrayish": "^0.2.1" + } + }, + "node_modules/es-module-lexer": { + "version": "1.3.1", + "license": "MIT" + }, + "node_modules/esast-util-from-estree": { + "version": "2.0.0", + "license": "MIT", + "dependencies": { + "@types/estree-jsx": "^1.0.0", + "devlop": "^1.0.0", + "estree-util-visit": "^2.0.0", + "unist-util-position-from-estree": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/esast-util-from-js": { + "version": "2.0.1", + "license": "MIT", + "dependencies": { + "@types/estree-jsx": "^1.0.0", + "acorn": "^8.0.0", + "esast-util-from-estree": "^2.0.0", + "vfile-message": "^4.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/esast-util-from-js/node_modules/acorn": { + "version": "8.15.0", + "license": "MIT", + "bin": { + "acorn": "bin/acorn" + }, + "engines": { + "node": ">=0.4.0" + } + }, + "node_modules/escalade": { + "version": "3.1.1", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/escape-goat": { + "version": "4.0.0", + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/escape-html": { + "version": "1.0.3", + "license": "MIT" + }, + "node_modules/escape-string-regexp": { + "version": "4.0.0", + "license": "MIT", + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/eslint": { + "version": "8.57.1", + "dev": true, + "license": "MIT", + "dependencies": { + "@eslint-community/eslint-utils": "^4.2.0", + "@eslint-community/regexpp": "^4.6.1", + "@eslint/eslintrc": "^2.1.4", + "@eslint/js": "8.57.1", + "@humanwhocodes/config-array": "^0.13.0", + "@humanwhocodes/module-importer": "^1.0.1", + "@nodelib/fs.walk": "^1.2.8", + "@ungap/structured-clone": "^1.2.0", + "ajv": "^6.12.4", + "chalk": "^4.0.0", + "cross-spawn": "^7.0.2", + "debug": "^4.3.2", + "doctrine": "^3.0.0", + "escape-string-regexp": "^4.0.0", + "eslint-scope": "^7.2.2", + "eslint-visitor-keys": "^3.4.3", + "espree": "^9.6.1", + "esquery": "^1.4.2", + "esutils": "^2.0.2", + "fast-deep-equal": "^3.1.3", + "file-entry-cache": "^6.0.1", + "find-up": "^5.0.0", + "glob-parent": "^6.0.2", + "globals": "^13.19.0", + "graphemer": "^1.4.0", + "ignore": "^5.2.0", + "imurmurhash": "^0.1.4", + "is-glob": "^4.0.0", + "is-path-inside": "^3.0.3", + "js-yaml": "^4.1.0", + "json-stable-stringify-without-jsonify": "^1.0.1", + "levn": "^0.4.1", + "lodash.merge": "^4.6.2", + "minimatch": "^3.1.2", + "natural-compare": "^1.4.0", + "optionator": "^0.9.3", + "strip-ansi": "^6.0.1", + "text-table": "^0.2.0" + }, + "bin": { + "eslint": "bin/eslint.js" + }, + "engines": { + "node": "^12.22.0 || ^14.17.0 || >=16.0.0" + }, + "funding": { + "url": "https://opencollective.com/eslint" + } + }, + "node_modules/eslint-config-prettier": { + "version": "8.10.0", + "dev": true, + "license": "MIT", + "bin": { + "eslint-config-prettier": "bin/cli.js" + }, + "peerDependencies": { + "eslint": ">=7.0.0" + } + }, + "node_modules/eslint-scope": { + "version": "5.1.1", + "license": "BSD-2-Clause", + "dependencies": { + "esrecurse": "^4.3.0", + "estraverse": "^4.1.1" + }, + "engines": { + "node": ">=8.0.0" + } + }, + "node_modules/eslint-scope/node_modules/estraverse": { + "version": "4.3.0", + "license": "BSD-2-Clause", + "engines": { + "node": ">=4.0" + } + }, + "node_modules/eslint-visitor-keys": { + "version": "3.4.3", + "dev": true, + "license": "Apache-2.0", + "engines": { + "node": "^12.22.0 || ^14.17.0 || >=16.0.0" + }, + "funding": { + "url": "https://opencollective.com/eslint" + } + }, + "node_modules/eslint/node_modules/@ungap/structured-clone": { + "version": "1.2.0", + "dev": true, + "license": "ISC" + }, + "node_modules/eslint/node_modules/ajv": { + "version": "6.12.6", + "dev": true, + "license": "MIT", + "dependencies": { + "fast-deep-equal": "^3.1.1", + "fast-json-stable-stringify": "^2.0.0", + "json-schema-traverse": "^0.4.1", + "uri-js": "^4.2.2" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/epoberezkin" + } + }, + "node_modules/eslint/node_modules/eslint-scope": { + "version": "7.2.2", + "dev": true, + "license": "BSD-2-Clause", + "dependencies": { + "esrecurse": "^4.3.0", + "estraverse": "^5.2.0" + }, + "engines": { + "node": "^12.22.0 || ^14.17.0 || >=16.0.0" + }, + "funding": { + "url": "https://opencollective.com/eslint" + } + }, + "node_modules/eslint/node_modules/glob-parent": { + "version": "6.0.2", + "dev": true, + "license": "ISC", + "dependencies": { + "is-glob": "^4.0.3" + }, + "engines": { + "node": ">=10.13.0" + } + }, + "node_modules/espree": { + "version": "9.6.1", + "dev": true, + "license": "BSD-2-Clause", + "dependencies": { + "acorn": "^8.9.0", + "acorn-jsx": "^5.3.2", + "eslint-visitor-keys": "^3.4.1" + }, + "engines": { + "node": "^12.22.0 || ^14.17.0 || >=16.0.0" + }, + "funding": { + "url": "https://opencollective.com/eslint" + } + }, + "node_modules/espree/node_modules/acorn": { + "version": "8.10.0", + "dev": true, + "license": "MIT", + "bin": { + "acorn": "bin/acorn" + }, + "engines": { + "node": ">=0.4.0" + } + }, + "node_modules/espree/node_modules/acorn-jsx": { + "version": "5.3.2", + "dev": true, + "license": "MIT", + "peerDependencies": { + "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0" + } + }, + "node_modules/esprima": { + "version": "4.0.1", + "license": "BSD-2-Clause", + "bin": { + "esparse": "bin/esparse.js", + "esvalidate": "bin/esvalidate.js" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/esquery": { + "version": "1.5.0", + "dev": true, + "license": "BSD-3-Clause", + "dependencies": { + "estraverse": "^5.1.0" + }, + "engines": { + "node": ">=0.10" + } + }, + "node_modules/esrecurse": { + "version": "4.3.0", + "license": "BSD-2-Clause", + "dependencies": { + "estraverse": "^5.2.0" + }, + "engines": { + "node": ">=4.0" + } + }, + "node_modules/estraverse": { + "version": "5.3.0", + "license": "BSD-2-Clause", + "engines": { + "node": ">=4.0" + } + }, + "node_modules/estree-util-attach-comments": { + "version": "3.0.0", + "license": "MIT", + "dependencies": { + "@types/estree": "^1.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/estree-util-build-jsx": { + "version": "3.0.1", + "license": "MIT", + "dependencies": { + "@types/estree-jsx": "^1.0.0", + "devlop": "^1.0.0", + "estree-util-is-identifier-name": "^3.0.0", + "estree-walker": "^3.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/estree-util-is-identifier-name": { + "version": "3.0.0", + "license": "MIT", + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/estree-util-scope": { + "version": "1.0.0", + "license": "MIT", + "dependencies": { + "@types/estree": "^1.0.0", + "devlop": "^1.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/estree-util-to-js": { + "version": "2.0.0", + "license": "MIT", + "dependencies": { + "@types/estree-jsx": "^1.0.0", + "astring": "^1.8.0", + "source-map": "^0.7.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/estree-util-to-js/node_modules/source-map": { + "version": "0.7.4", + "license": "BSD-3-Clause", + "engines": { + "node": ">= 8" + } + }, + "node_modules/estree-util-value-to-estree": { + "version": "3.4.0", + "license": "MIT", + "dependencies": { + "@types/estree": "^1.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/remcohaszing" + } + }, + "node_modules/estree-util-visit": { + "version": "2.0.0", + "license": "MIT", + "dependencies": { + "@types/estree-jsx": "^1.0.0", + "@types/unist": "^3.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/estree-walker": { + "version": "3.0.3", + "license": "MIT", + "dependencies": { + "@types/estree": "^1.0.0" + } + }, + "node_modules/esutils": { + "version": "2.0.3", + "license": "BSD-2-Clause", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/eta": { + "version": "2.2.0", + "license": "MIT", + "engines": { + "node": ">=6.0.0" + }, + "funding": { + "url": "https://github.com/eta-dev/eta?sponsor=1" + } + }, + "node_modules/etag": { + "version": "1.8.1", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/eval": { + "version": "0.1.8", + "dependencies": { + "@types/node": "*", + "require-like": ">= 0.1.1" + }, + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/eventemitter3": { + "version": "4.0.7", + "license": "MIT" + }, + "node_modules/events": { + "version": "3.3.0", + "license": "MIT", + "engines": { + "node": ">=0.8.x" + } + }, + "node_modules/execa": { + "version": "5.1.1", + "license": "MIT", + "dependencies": { + "cross-spawn": "^7.0.3", + "get-stream": "^6.0.0", + "human-signals": "^2.1.0", + "is-stream": "^2.0.0", + "merge-stream": "^2.0.0", + "npm-run-path": "^4.0.1", + "onetime": "^5.1.2", + "signal-exit": "^3.0.3", + "strip-final-newline": "^2.0.0" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sindresorhus/execa?sponsor=1" + } + }, + "node_modules/execa/node_modules/human-signals": { + "version": "2.1.0", + "license": "Apache-2.0", + "engines": { + "node": ">=10.17.0" + } + }, + "node_modules/execa/node_modules/is-stream": { + "version": "2.0.1", + "license": "MIT", + "engines": { + "node": ">=8" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/execa/node_modules/npm-run-path": { + "version": "4.0.1", + "license": "MIT", + "dependencies": { + "path-key": "^3.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/execa/node_modules/strip-final-newline": { + "version": "2.0.0", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/express": { + "version": "4.18.2", + "license": "MIT", + "dependencies": { + "accepts": "~1.3.8", + "array-flatten": "1.1.1", + "body-parser": "1.20.1", + "content-disposition": "0.5.4", + "content-type": "~1.0.4", + "cookie": "0.5.0", + "cookie-signature": "1.0.6", + "debug": "2.6.9", + "depd": "2.0.0", + "encodeurl": "~1.0.2", + "escape-html": "~1.0.3", + "etag": "~1.8.1", + "finalhandler": "1.2.0", + "fresh": "0.5.2", + "http-errors": "2.0.0", + "merge-descriptors": "1.0.1", + "methods": "~1.1.2", + "on-finished": "2.4.1", + "parseurl": "~1.3.3", + "path-to-regexp": "0.1.7", + "proxy-addr": "~2.0.7", + "qs": "6.11.0", + "range-parser": "~1.2.1", + "safe-buffer": "5.2.1", + "send": "0.18.0", + "serve-static": "1.15.0", + "setprototypeof": "1.2.0", + "statuses": "2.0.1", + "type-is": "~1.6.18", + "utils-merge": "1.0.1", + "vary": "~1.1.2" + }, + "engines": { + "node": ">= 0.10.0" + } + }, + "node_modules/express/node_modules/array-flatten": { + "version": "1.1.1", + "license": "MIT" + }, + "node_modules/express/node_modules/content-disposition": { + "version": "0.5.4", + "license": "MIT", + "dependencies": { + "safe-buffer": "5.2.1" + }, + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/express/node_modules/debug": { + "version": "2.6.9", + "license": "MIT", + "dependencies": { + "ms": "2.0.0" + } + }, + "node_modules/express/node_modules/ms": { + "version": "2.0.0", + "license": "MIT" + }, + "node_modules/express/node_modules/path-to-regexp": { + "version": "0.1.7", + "license": "MIT" + }, + "node_modules/extend": { + "version": "3.0.2", + "license": "MIT" + }, + "node_modules/extend-shallow": { + "version": "2.0.1", + "license": "MIT", + "dependencies": { + "is-extendable": "^0.1.0" + }, + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/fast-deep-equal": { + "version": "3.1.3", + "license": "MIT" + }, + "node_modules/fast-glob": { + "version": "3.3.1", + "license": "MIT", + "dependencies": { + "@nodelib/fs.stat": "^2.0.2", + "@nodelib/fs.walk": "^1.2.3", + "glob-parent": "^5.1.2", + "merge2": "^1.3.0", + "micromatch": "^4.0.4" + }, + "engines": { + "node": ">=8.6.0" + } + }, + "node_modules/fast-json-stable-stringify": { + "version": "2.1.0", + "license": "MIT" + }, + "node_modules/fast-levenshtein": { + "version": "2.0.6", + "dev": true, + "license": "MIT" + }, + "node_modules/fastq": { + "version": "1.15.0", + "license": "ISC", + "dependencies": { + "reusify": "^1.0.4" + } + }, + "node_modules/fault": { + "version": "2.0.1", + "license": "MIT", + "dependencies": { + "format": "^0.2.0" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/faye-websocket": { + "version": "0.11.4", + "license": "Apache-2.0", + "dependencies": { + "websocket-driver": ">=0.5.1" + }, + "engines": { + "node": ">=0.8.0" + } + }, + "node_modules/feed": { + "version": "4.2.2", + "license": "MIT", + "dependencies": { + "xml-js": "^1.6.11" + }, + "engines": { + "node": ">=0.4.0" + } + }, + "node_modules/figures": { + "version": "3.2.0", + "license": "MIT", + "dependencies": { + "escape-string-regexp": "^1.0.5" + }, + "engines": { + "node": ">=8" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/figures/node_modules/escape-string-regexp": { + "version": "1.0.5", + "license": "MIT", + "engines": { + "node": ">=0.8.0" + } + }, + "node_modules/file-entry-cache": { + "version": "6.0.1", + "dev": true, + "license": "MIT", + "dependencies": { + "flat-cache": "^3.0.4" + }, + "engines": { + "node": "^10.12.0 || >=12.0.0" + } + }, + "node_modules/file-loader": { + "version": "6.2.0", + "license": "MIT", + "dependencies": { + "loader-utils": "^2.0.0", + "schema-utils": "^3.0.0" + }, + "engines": { + "node": ">= 10.13.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + }, + "peerDependencies": { + "webpack": "^4.0.0 || ^5.0.0" + } + }, + "node_modules/file-loader/node_modules/ajv": { + "version": "6.12.6", + "license": "MIT", + "dependencies": { + "fast-deep-equal": "^3.1.1", + "fast-json-stable-stringify": "^2.0.0", + "json-schema-traverse": "^0.4.1", + "uri-js": "^4.2.2" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/epoberezkin" + } + }, + "node_modules/file-loader/node_modules/ajv-keywords": { + "version": "3.5.2", + "license": "MIT", + "peerDependencies": { + "ajv": "^6.9.1" + } + }, + "node_modules/file-loader/node_modules/schema-utils": { + "version": "3.3.0", + "license": "MIT", + "dependencies": { + "@types/json-schema": "^7.0.8", + "ajv": "^6.12.5", + "ajv-keywords": "^3.5.2" + }, + "engines": { + "node": ">= 10.13.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + } + }, + "node_modules/fill-range": { + "version": "7.0.1", + "license": "MIT", + "dependencies": { + "to-regex-range": "^5.0.1" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/finalhandler": { + "version": "1.2.0", + "license": "MIT", + "dependencies": { + "debug": "2.6.9", + "encodeurl": "~1.0.2", + "escape-html": "~1.0.3", + "on-finished": "2.4.1", + "parseurl": "~1.3.3", + "statuses": "2.0.1", + "unpipe": "~1.0.0" + }, + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/finalhandler/node_modules/debug": { + "version": "2.6.9", + "license": "MIT", + "dependencies": { + "ms": "2.0.0" + } + }, + "node_modules/finalhandler/node_modules/ms": { + "version": "2.0.0", + "license": "MIT" + }, + "node_modules/find-cache-dir": { + "version": "4.0.0", + "license": "MIT", + "dependencies": { + "common-path-prefix": "^3.0.0", + "pkg-dir": "^7.0.0" + }, + "engines": { + "node": ">=14.16" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/find-up": { + "version": "5.0.0", + "dev": true, + "license": "MIT", + "dependencies": { + "locate-path": "^6.0.0", + "path-exists": "^4.0.0" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/flat": { + "version": "5.0.2", + "license": "BSD-3-Clause", + "bin": { + "flat": "cli.js" + } + }, + "node_modules/flat-cache": { + "version": "3.1.1", + "dev": true, + "license": "MIT", + "dependencies": { + "flatted": "^3.2.9", + "keyv": "^4.5.3", + "rimraf": "^3.0.2" + }, + "engines": { + "node": ">=12.0.0" + } + }, + "node_modules/flatted": { + "version": "3.2.9", + "dev": true, + "license": "ISC" + }, + "node_modules/follow-redirects": { + "version": "1.15.3", + "funding": [ + { + "type": "individual", + "url": "https://github.com/sponsors/RubenVerborgh" + } + ], + "license": "MIT", + "engines": { + "node": ">=4.0" + }, + "peerDependenciesMeta": { + "debug": { + "optional": true + } + } + }, + "node_modules/foreground-child": { + "version": "3.1.1", + "license": "ISC", + "dependencies": { + "cross-spawn": "^7.0.0", + "signal-exit": "^4.0.1" + }, + "engines": { + "node": ">=14" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, + "node_modules/foreground-child/node_modules/signal-exit": { + "version": "4.1.0", + "license": "ISC", + "engines": { + "node": ">=14" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, + "node_modules/form-data-encoder": { + "version": "2.1.4", + "license": "MIT", + "engines": { + "node": ">= 14.17" + } + }, + "node_modules/format": { + "version": "0.2.2", + "engines": { + "node": ">=0.4.x" + } + }, + "node_modules/forwarded": { + "version": "0.2.0", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/fraction.js": { + "version": "4.3.7", + "license": "MIT", + "engines": { + "node": "*" + }, + "funding": { + "type": "patreon", + "url": "https://github.com/sponsors/rawify" + } + }, + "node_modules/fresh": { + "version": "0.5.2", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/fs-extra": { + "version": "11.3.0", + "license": "MIT", + "dependencies": { + "graceful-fs": "^4.2.0", + "jsonfile": "^6.0.1", + "universalify": "^2.0.0" + }, + "engines": { + "node": ">=14.14" + } + }, + "node_modules/fs-monkey": { + "version": "1.0.5", + "license": "Unlicense" + }, + "node_modules/fs.realpath": { + "version": "1.0.0", + "license": "ISC" + }, + "node_modules/function-bind": { + "version": "1.1.1", + "license": "MIT" + }, + "node_modules/gensync": { + "version": "1.0.0-beta.2", + "license": "MIT", + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/get-intrinsic": { + "version": "1.2.1", + "license": "MIT", + "dependencies": { + "function-bind": "^1.1.1", + "has": "^1.0.3", + "has-proto": "^1.0.1", + "has-symbols": "^1.0.3" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/get-own-enumerable-property-symbols": { + "version": "3.0.2", + "license": "ISC" + }, + "node_modules/get-stream": { + "version": "6.0.1", + "license": "MIT", + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/github-slugger": { + "version": "1.5.0", + "license": "ISC" + }, + "node_modules/glob": { + "version": "7.2.3", + "license": "ISC", + "dependencies": { + "fs.realpath": "^1.0.0", + "inflight": "^1.0.4", + "inherits": "2", + "minimatch": "^3.1.1", + "once": "^1.3.0", + "path-is-absolute": "^1.0.0" + }, + "engines": { + "node": "*" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, + "node_modules/glob-parent": { + "version": "5.1.2", + "license": "ISC", + "dependencies": { + "is-glob": "^4.0.1" + }, + "engines": { + "node": ">= 6" + } + }, + "node_modules/glob-to-regexp": { + "version": "0.4.1", + "license": "BSD-2-Clause" + }, + "node_modules/global-dirs": { + "version": "3.0.1", + "license": "MIT", + "dependencies": { + "ini": "2.0.0" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/global-dirs/node_modules/ini": { + "version": "2.0.0", + "license": "ISC", + "engines": { + "node": ">=10" + } + }, + "node_modules/globals": { + "version": "13.23.0", + "dev": true, + "license": "MIT", + "dependencies": { + "type-fest": "^0.20.2" + }, + "engines": { + "node": ">=8" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/globals/node_modules/type-fest": { + "version": "0.20.2", + "dev": true, + "license": "(MIT OR CC0-1.0)", + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/globby": { + "version": "11.1.0", + "license": "MIT", + "dependencies": { + "array-union": "^2.1.0", + "dir-glob": "^3.0.1", + "fast-glob": "^3.2.9", + "ignore": "^5.2.0", + "merge2": "^1.4.1", + "slash": "^3.0.0" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/gopd": { + "version": "1.0.1", + "license": "MIT", + "dependencies": { + "get-intrinsic": "^1.1.3" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/got": { + "version": "12.6.1", + "license": "MIT", + "dependencies": { + "@sindresorhus/is": "^5.2.0", + "@szmarczak/http-timer": "^5.0.1", + "cacheable-lookup": "^7.0.0", + "cacheable-request": "^10.2.8", + "decompress-response": "^6.0.0", + "form-data-encoder": "^2.1.2", + "get-stream": "^6.0.1", + "http2-wrapper": "^2.1.10", + "lowercase-keys": "^3.0.0", + "p-cancelable": "^3.0.0", + "responselike": "^3.0.0" + }, + "engines": { + "node": ">=14.16" + }, + "funding": { + "url": "https://github.com/sindresorhus/got?sponsor=1" + } + }, + "node_modules/graceful-fs": { + "version": "4.2.11", + "license": "ISC" + }, + "node_modules/graphemer": { + "version": "1.4.0", + "dev": true, + "license": "MIT" + }, + "node_modules/gray-matter": { + "version": "4.0.3", + "license": "MIT", + "dependencies": { + "js-yaml": "^3.13.1", + "kind-of": "^6.0.2", + "section-matter": "^1.0.0", + "strip-bom-string": "^1.0.0" + }, + "engines": { + "node": ">=6.0" + } + }, + "node_modules/gray-matter/node_modules/argparse": { + "version": "1.0.10", + "license": "MIT", + "dependencies": { + "sprintf-js": "~1.0.2" + } + }, + "node_modules/gray-matter/node_modules/js-yaml": { + "version": "3.14.1", + "license": "MIT", + "dependencies": { + "argparse": "^1.0.7", + "esprima": "^4.0.0" + }, + "bin": { + "js-yaml": "bin/js-yaml.js" + } + }, + "node_modules/gzip-size": { + "version": "6.0.0", + "license": "MIT", + "dependencies": { + "duplexer": "^0.1.2" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/handle-thing": { + "version": "2.0.1", + "license": "MIT" + }, + "node_modules/has": { + "version": "1.0.4", + "license": "MIT", + "engines": { + "node": ">= 0.4.0" + } + }, + "node_modules/has-flag": { + "version": "4.0.0", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/has-property-descriptors": { + "version": "1.0.0", + "license": "MIT", + "dependencies": { + "get-intrinsic": "^1.1.1" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/has-proto": { + "version": "1.0.1", + "license": "MIT", + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/has-symbols": { + "version": "1.0.3", + "license": "MIT", + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/has-yarn": { + "version": "3.0.0", + "license": "MIT", + "engines": { + "node": "^12.20.0 || ^14.13.1 || >=16.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/hasown": { + "version": "2.0.2", + "license": "MIT", + "dependencies": { + "function-bind": "^1.1.2" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/hasown/node_modules/function-bind": { + "version": "1.1.2", + "license": "MIT", + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/hast-util-from-parse5": { + "version": "8.0.3", + "license": "MIT", + "dependencies": { + "@types/hast": "^3.0.0", + "@types/unist": "^3.0.0", + "devlop": "^1.0.0", + "hastscript": "^9.0.0", + "property-information": "^7.0.0", + "vfile": "^6.0.0", + "vfile-location": "^5.0.0", + "web-namespaces": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/hast-util-parse-selector": { + "version": "4.0.0", + "license": "MIT", + "dependencies": { + "@types/hast": "^3.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/hast-util-raw": { + "version": "9.1.0", + "license": "MIT", + "dependencies": { + "@types/hast": "^3.0.0", + "@types/unist": "^3.0.0", + "@ungap/structured-clone": "^1.0.0", + "hast-util-from-parse5": "^8.0.0", + "hast-util-to-parse5": "^8.0.0", + "html-void-elements": "^3.0.0", + "mdast-util-to-hast": "^13.0.0", + "parse5": "^7.0.0", + "unist-util-position": "^5.0.0", + "unist-util-visit": "^5.0.0", + "vfile": "^6.0.0", + "web-namespaces": "^2.0.0", + "zwitch": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/hast-util-to-estree": { + "version": "3.1.3", + "license": "MIT", + "dependencies": { + "@types/estree": "^1.0.0", + "@types/estree-jsx": "^1.0.0", + "@types/hast": "^3.0.0", + "comma-separated-tokens": "^2.0.0", + "devlop": "^1.0.0", + "estree-util-attach-comments": "^3.0.0", + "estree-util-is-identifier-name": "^3.0.0", + "hast-util-whitespace": "^3.0.0", + "mdast-util-mdx-expression": "^2.0.0", + "mdast-util-mdx-jsx": "^3.0.0", + "mdast-util-mdxjs-esm": "^2.0.0", + "property-information": "^7.0.0", + "space-separated-tokens": "^2.0.0", + "style-to-js": "^1.0.0", + "unist-util-position": "^5.0.0", + "zwitch": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/hast-util-to-jsx-runtime": { + "version": "2.3.6", + "license": "MIT", + "dependencies": { + "@types/estree": "^1.0.0", + "@types/hast": "^3.0.0", + "@types/unist": "^3.0.0", + "comma-separated-tokens": "^2.0.0", + "devlop": "^1.0.0", + "estree-util-is-identifier-name": "^3.0.0", + "hast-util-whitespace": "^3.0.0", + "mdast-util-mdx-expression": "^2.0.0", + "mdast-util-mdx-jsx": "^3.0.0", + "mdast-util-mdxjs-esm": "^2.0.0", + "property-information": "^7.0.0", + "space-separated-tokens": "^2.0.0", + "style-to-js": "^1.0.0", + "unist-util-position": "^5.0.0", + "vfile-message": "^4.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/hast-util-to-parse5": { + "version": "8.0.0", + "license": "MIT", + "dependencies": { + "@types/hast": "^3.0.0", + "comma-separated-tokens": "^2.0.0", + "devlop": "^1.0.0", + "property-information": "^6.0.0", + "space-separated-tokens": "^2.0.0", + "web-namespaces": "^2.0.0", + "zwitch": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/hast-util-to-parse5/node_modules/property-information": { + "version": "6.3.0", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/hast-util-whitespace": { + "version": "3.0.0", + "license": "MIT", + "dependencies": { + "@types/hast": "^3.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/hastscript": { + "version": "9.0.1", + "license": "MIT", + "dependencies": { + "@types/hast": "^3.0.0", + "comma-separated-tokens": "^2.0.0", + "hast-util-parse-selector": "^4.0.0", + "property-information": "^7.0.0", + "space-separated-tokens": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/he": { + "version": "1.2.0", + "license": "MIT", + "bin": { + "he": "bin/he" + } + }, + "node_modules/history": { + "version": "4.10.1", + "license": "MIT", + "dependencies": { + "@babel/runtime": "^7.1.2", + "loose-envify": "^1.2.0", + "resolve-pathname": "^3.0.0", + "tiny-invariant": "^1.0.2", + "tiny-warning": "^1.0.0", + "value-equal": "^1.0.1" + } + }, + "node_modules/hoist-non-react-statics": { + "version": "3.3.2", + "license": "BSD-3-Clause", + "dependencies": { + "react-is": "^16.7.0" + } + }, + "node_modules/hpack.js": { + "version": "2.1.6", + "license": "MIT", + "dependencies": { + "inherits": "^2.0.1", + "obuf": "^1.0.0", + "readable-stream": "^2.0.1", + "wbuf": "^1.1.0" + } + }, + "node_modules/html-dom-parser": { + "version": "3.1.7", + "license": "MIT", + "dependencies": { + "domhandler": "5.0.3", + "htmlparser2": "8.0.2" + } + }, + "node_modules/html-entities": { + "version": "2.4.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/mdevils" + }, + { + "type": "patreon", + "url": "https://patreon.com/mdevils" + } + ], + "license": "MIT" + }, + "node_modules/html-escaper": { + "version": "2.0.2", + "license": "MIT" + }, + "node_modules/html-minifier-terser": { + "version": "7.2.0", + "license": "MIT", + "dependencies": { + "camel-case": "^4.1.2", + "clean-css": "~5.3.2", + "commander": "^10.0.0", + "entities": "^4.4.0", + "param-case": "^3.0.4", + "relateurl": "^0.2.7", + "terser": "^5.15.1" + }, + "bin": { + "html-minifier-terser": "cli.js" + }, + "engines": { + "node": "^14.13.1 || >=16.0.0" + } + }, + "node_modules/html-minifier-terser/node_modules/commander": { + "version": "10.0.1", + "license": "MIT", + "engines": { + "node": ">=14" + } + }, + "node_modules/html-react-parser": { + "version": "3.0.16", + "license": "MIT", + "dependencies": { + "domhandler": "5.0.3", + "html-dom-parser": "3.1.7", + "react-property": "2.0.0", + "style-to-js": "1.1.3" + }, + "peerDependencies": { + "react": "0.14 || 15 || 16 || 17 || 18" + } + }, + "node_modules/html-react-parser/node_modules/style-to-js": { + "version": "1.1.3", + "license": "MIT", + "dependencies": { + "style-to-object": "0.4.1" + } + }, + "node_modules/html-react-parser/node_modules/style-to-object": { + "version": "0.4.1", + "license": "MIT", + "dependencies": { + "inline-style-parser": "0.1.1" + } + }, + "node_modules/html-tags": { + "version": "3.3.1", + "license": "MIT", + "engines": { + "node": ">=8" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/html-void-elements": { + "version": "3.0.0", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/html-webpack-plugin": { + "version": "5.6.3", + "license": "MIT", + "dependencies": { + "@types/html-minifier-terser": "^6.0.0", + "html-minifier-terser": "^6.0.2", + "lodash": "^4.17.21", + "pretty-error": "^4.0.0", + "tapable": "^2.0.0" + }, + "engines": { + "node": ">=10.13.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/html-webpack-plugin" + }, + "peerDependencies": { + "@rspack/core": "0.x || 1.x", + "webpack": "^5.20.0" + }, + "peerDependenciesMeta": { + "@rspack/core": { + "optional": true + }, + "webpack": { + "optional": true + } + } + }, + "node_modules/html-webpack-plugin/node_modules/acorn": { + "version": "8.10.0", + "license": "MIT", + "bin": { + "acorn": "bin/acorn" + }, + "engines": { + "node": ">=0.4.0" + } + }, + "node_modules/html-webpack-plugin/node_modules/clean-css": { + "version": "5.3.2", + "license": "MIT", + "dependencies": { + "source-map": "~0.6.0" + }, + "engines": { + "node": ">= 10.0" + } + }, + "node_modules/html-webpack-plugin/node_modules/commander": { + "version": "8.3.0", + "license": "MIT", + "engines": { + "node": ">= 12" + } + }, + "node_modules/html-webpack-plugin/node_modules/html-minifier-terser": { + "version": "6.1.0", + "license": "MIT", + "dependencies": { + "camel-case": "^4.1.2", + "clean-css": "^5.2.2", + "commander": "^8.3.0", + "he": "^1.2.0", + "param-case": "^3.0.4", + "relateurl": "^0.2.7", + "terser": "^5.10.0" + }, + "bin": { + "html-minifier-terser": "cli.js" + }, + "engines": { + "node": ">=12" + } + }, + "node_modules/html-webpack-plugin/node_modules/terser": { + "version": "5.21.0", + "license": "BSD-2-Clause", + "dependencies": { + "@jridgewell/source-map": "^0.3.3", + "acorn": "^8.8.2", + "commander": "^2.20.0", + "source-map-support": "~0.5.20" + }, + "bin": { + "terser": "bin/terser" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/html-webpack-plugin/node_modules/terser/node_modules/commander": { + "version": "2.20.3", + "license": "MIT" + }, + "node_modules/htmlparser2": { + "version": "8.0.2", + "funding": [ + "https://github.com/fb55/htmlparser2?sponsor=1", + { + "type": "github", + "url": "https://github.com/sponsors/fb55" + } + ], + "license": "MIT", + "dependencies": { + "domelementtype": "^2.3.0", + "domhandler": "^5.0.3", + "domutils": "^3.0.1", + "entities": "^4.4.0" + } + }, + "node_modules/http-cache-semantics": { + "version": "4.1.1", + "license": "BSD-2-Clause" + }, + "node_modules/http-deceiver": { + "version": "1.2.7", + "license": "MIT" + }, + "node_modules/http-errors": { + "version": "2.0.0", + "license": "MIT", + "dependencies": { + "depd": "2.0.0", + "inherits": "2.0.4", + "setprototypeof": "1.2.0", + "statuses": "2.0.1", + "toidentifier": "1.0.1" + }, + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/http-parser-js": { + "version": "0.5.8", + "license": "MIT" + }, + "node_modules/http-proxy": { + "version": "1.18.1", + "license": "MIT", + "dependencies": { + "eventemitter3": "^4.0.0", + "follow-redirects": "^1.0.0", + "requires-port": "^1.0.0" + }, + "engines": { + "node": ">=8.0.0" + } + }, + "node_modules/http-proxy-middleware": { + "version": "2.0.6", + "license": "MIT", + "dependencies": { + "@types/http-proxy": "^1.17.8", + "http-proxy": "^1.18.1", + "is-glob": "^4.0.1", + "is-plain-obj": "^3.0.0", + "micromatch": "^4.0.2" + }, + "engines": { + "node": ">=12.0.0" + }, + "peerDependencies": { + "@types/express": "^4.17.13" + }, + "peerDependenciesMeta": { + "@types/express": { + "optional": true + } + } + }, + "node_modules/http-proxy-middleware/node_modules/is-plain-obj": { + "version": "3.0.0", + "license": "MIT", + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/http2-wrapper": { + "version": "2.2.1", + "license": "MIT", + "dependencies": { + "quick-lru": "^5.1.1", + "resolve-alpn": "^1.2.0" + }, + "engines": { + "node": ">=10.19.0" + } + }, + "node_modules/human-signals": { + "version": "4.3.1", + "dev": true, + "license": "Apache-2.0", + "engines": { + "node": ">=14.18.0" + } + }, + "node_modules/husky": { + "version": "8.0.3", + "dev": true, + "license": "MIT", + "bin": { + "husky": "lib/bin.js" + }, + "engines": { + "node": ">=14" + }, + "funding": { + "url": "https://github.com/sponsors/typicode" + } + }, + "node_modules/iconv-lite": { + "version": "0.4.24", + "license": "MIT", + "dependencies": { + "safer-buffer": ">= 2.1.2 < 3" + }, + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/ignore": { + "version": "5.2.4", + "license": "MIT", + "engines": { + "node": ">= 4" + } + }, + "node_modules/image-size": { + "version": "2.0.2", + "license": "MIT", + "bin": { + "image-size": "bin/image-size.js" + }, + "engines": { + "node": ">=16.x" + } + }, + "node_modules/immediate": { + "version": "3.3.0", + "resolved": "https://registry.npmjs.org/immediate/-/immediate-3.3.0.tgz", + "integrity": "sha512-HR7EVodfFUdQCTIeySw+WDRFJlPcLOJbXfwwZ7Oom6tjsvZ3bOkCDJHehQC3nxJrv7+f9XecwazynjU8e4Vw3Q==", + "license": "MIT" + }, + "node_modules/import-fresh": { + "version": "3.3.0", + "license": "MIT", + "dependencies": { + "parent-module": "^1.0.0", + "resolve-from": "^4.0.0" + }, + "engines": { + "node": ">=6" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/import-lazy": { + "version": "4.0.0", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/imurmurhash": { + "version": "0.1.4", + "license": "MIT", + "engines": { + "node": ">=0.8.19" + } + }, + "node_modules/indent-string": { + "version": "4.0.0", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/infima": { + "version": "0.2.0-alpha.45", + "license": "MIT", + "engines": { + "node": ">=12" + } + }, + "node_modules/inflight": { + "version": "1.0.6", + "license": "ISC", + "dependencies": { + "once": "^1.3.0", + "wrappy": "1" + } + }, + "node_modules/inherits": { + "version": "2.0.4", + "license": "ISC" + }, + "node_modules/ini": { + "version": "1.3.8", + "license": "ISC" + }, + "node_modules/inline-style-parser": { + "version": "0.1.1", + "license": "MIT" + }, + "node_modules/invariant": { + "version": "2.2.4", + "license": "MIT", + "dependencies": { + "loose-envify": "^1.0.0" + } + }, + "node_modules/ipaddr.js": { + "version": "1.9.1", + "license": "MIT", + "engines": { + "node": ">= 0.10" + } + }, + "node_modules/is-alphabetical": { + "version": "2.0.1", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/is-alphanumerical": { + "version": "2.0.1", + "license": "MIT", + "dependencies": { + "is-alphabetical": "^2.0.0", + "is-decimal": "^2.0.0" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/is-arrayish": { + "version": "0.2.1", + "license": "MIT" + }, + "node_modules/is-binary-path": { + "version": "2.1.0", + "license": "MIT", + "dependencies": { + "binary-extensions": "^2.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/is-buffer": { + "version": "2.0.5", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/feross" + }, + { + "type": "patreon", + "url": "https://www.patreon.com/feross" + }, + { + "type": "consulting", + "url": "https://feross.org/support" + } + ], + "license": "MIT", + "engines": { + "node": ">=4" + } + }, + "node_modules/is-ci": { + "version": "3.0.1", + "license": "MIT", + "dependencies": { + "ci-info": "^3.2.0" + }, + "bin": { + "is-ci": "bin.js" + } + }, + "node_modules/is-core-module": { + "version": "2.16.1", + "license": "MIT", + "dependencies": { + "hasown": "^2.0.2" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/is-decimal": { + "version": "2.0.1", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/is-docker": { + "version": "2.2.1", + "license": "MIT", + "bin": { + "is-docker": "cli.js" + }, + "engines": { + "node": ">=8" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/is-extendable": { + "version": "0.1.1", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/is-extglob": { + "version": "2.1.1", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/is-fullwidth-code-point": { + "version": "4.0.0", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/is-glob": { + "version": "4.0.3", + "license": "MIT", + "dependencies": { + "is-extglob": "^2.1.1" + }, + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/is-hexadecimal": { + "version": "2.0.1", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/is-installed-globally": { + "version": "0.4.0", + "license": "MIT", + "dependencies": { + "global-dirs": "^3.0.0", + "is-path-inside": "^3.0.2" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/is-npm": { + "version": "6.0.0", + "license": "MIT", + "engines": { + "node": "^12.20.0 || ^14.13.1 || >=16.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/is-number": { + "version": "7.0.0", + "license": "MIT", + "engines": { + "node": ">=0.12.0" + } + }, + "node_modules/is-obj": { + "version": "2.0.0", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/is-path-inside": { + "version": "3.0.3", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/is-plain-obj": { + "version": "4.1.0", + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/is-plain-object": { + "version": "2.0.4", + "license": "MIT", + "dependencies": { + "isobject": "^3.0.1" + }, + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/is-regexp": { + "version": "1.0.0", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/is-stream": { + "version": "3.0.0", + "dev": true, + "license": "MIT", + "engines": { + "node": "^12.20.0 || ^14.13.1 || >=16.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/is-typedarray": { + "version": "1.0.0", + "license": "MIT" + }, + "node_modules/is-wsl": { + "version": "2.2.0", + "license": "MIT", + "dependencies": { + "is-docker": "^2.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/is-yarn-global": { + "version": "0.4.1", + "license": "MIT", + "engines": { + "node": ">=12" + } + }, + "node_modules/isarray": { + "version": "0.0.1", + "license": "MIT" + }, + "node_modules/isexe": { + "version": "2.0.0", + "license": "ISC" + }, + "node_modules/isobject": { + "version": "3.0.1", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/jackspeak": { + "version": "3.4.3", + "license": "BlueOak-1.0.0", + "dependencies": { + "@isaacs/cliui": "^8.0.2" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + }, + "optionalDependencies": { + "@pkgjs/parseargs": "^0.11.0" + } + }, + "node_modules/jest-util": { + "version": "29.7.0", + "license": "MIT", + "dependencies": { + "@jest/types": "^29.6.3", + "@types/node": "*", + "chalk": "^4.0.0", + "ci-info": "^3.2.0", + "graceful-fs": "^4.2.9", + "picomatch": "^2.2.3" + }, + "engines": { + "node": "^14.15.0 || ^16.10.0 || >=18.0.0" + } + }, + "node_modules/jest-worker": { + "version": "27.5.1", + "license": "MIT", + "dependencies": { + "@types/node": "*", + "merge-stream": "^2.0.0", + "supports-color": "^8.0.0" + }, + "engines": { + "node": ">= 10.13.0" + } + }, + "node_modules/jiti": { + "version": "1.21.7", + "license": "MIT", + "bin": { + "jiti": "bin/jiti.js" + } + }, + "node_modules/joi": { + "version": "17.13.3", + "license": "BSD-3-Clause", + "dependencies": { + "@hapi/hoek": "^9.3.0", + "@hapi/topo": "^5.1.0", + "@sideway/address": "^4.1.5", + "@sideway/formula": "^3.0.1", + "@sideway/pinpoint": "^2.0.0" + } + }, + "node_modules/js-tokens": { + "version": "4.0.0", + "license": "MIT" + }, + "node_modules/js-yaml": { + "version": "4.1.0", + "license": "MIT", + "dependencies": { + "argparse": "^2.0.1" + }, + "bin": { + "js-yaml": "bin/js-yaml.js" + } + }, + "node_modules/jsesc": { + "version": "0.5.0", + "bin": { + "jsesc": "bin/jsesc" + } + }, + "node_modules/json-buffer": { + "version": "3.0.1", + "license": "MIT" + }, + "node_modules/json-parse-even-better-errors": { + "version": "2.3.1", + "license": "MIT" + }, + "node_modules/json-schema-traverse": { + "version": "0.4.1", + "license": "MIT" + }, + "node_modules/json-stable-stringify-without-jsonify": { + "version": "1.0.1", + "dev": true, + "license": "MIT" + }, + "node_modules/json5": { + "version": "2.2.3", + "license": "MIT", + "bin": { + "json5": "lib/cli.js" + }, + "engines": { + "node": ">=6" + } + }, + "node_modules/jsonfile": { + "version": "6.1.0", + "license": "MIT", + "dependencies": { + "universalify": "^2.0.0" + }, + "optionalDependencies": { + "graceful-fs": "^4.1.6" + } + }, + "node_modules/keyv": { + "version": "4.5.4", + "license": "MIT", + "dependencies": { + "json-buffer": "3.0.1" + } + }, + "node_modules/kind-of": { + "version": "6.0.3", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/klaw-sync": { + "version": "6.0.0", + "resolved": "https://registry.npmjs.org/klaw-sync/-/klaw-sync-6.0.0.tgz", + "integrity": "sha512-nIeuVSzdCCs6TDPTqI8w1Yre34sSq7AkZ4B3sfOBbI2CgVSB4Du4aLQijFU2+lhAFCwt9+42Hel6lQNIv6AntQ==", + "license": "MIT", + "dependencies": { + "graceful-fs": "^4.1.11" + } + }, + "node_modules/kleur": { + "version": "3.0.3", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/latest-version": { + "version": "7.0.0", + "license": "MIT", + "dependencies": { + "package-json": "^8.1.0" + }, + "engines": { + "node": ">=14.16" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/launch-editor": { + "version": "2.6.1", + "license": "MIT", + "dependencies": { + "picocolors": "^1.0.0", + "shell-quote": "^1.8.1" + } + }, + "node_modules/launch-editor/node_modules/picocolors": { + "version": "1.0.0", + "license": "ISC" + }, + "node_modules/leven": { + "version": "3.1.0", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/levn": { + "version": "0.4.1", + "dev": true, + "license": "MIT", + "dependencies": { + "prelude-ls": "^1.2.1", + "type-check": "~0.4.0" + }, + "engines": { + "node": ">= 0.8.0" + } + }, + "node_modules/lilconfig": { + "version": "3.1.3", + "license": "MIT", + "engines": { + "node": ">=14" + }, + "funding": { + "url": "https://github.com/sponsors/antonk52" + } + }, + "node_modules/lines-and-columns": { + "version": "1.2.4", + "license": "MIT" + }, + "node_modules/lint-staged": { + "version": "13.3.0", + "dev": true, + "license": "MIT", + "dependencies": { + "chalk": "5.3.0", + "commander": "11.0.0", + "debug": "4.3.4", + "execa": "7.2.0", + "lilconfig": "2.1.0", + "listr2": "6.6.1", + "micromatch": "4.0.5", + "pidtree": "0.6.0", + "string-argv": "0.3.2", + "yaml": "2.3.1" + }, + "bin": { + "lint-staged": "bin/lint-staged.js" + }, + "engines": { + "node": "^16.14.0 || >=18.0.0" + }, + "funding": { + "url": "https://opencollective.com/lint-staged" + } + }, + "node_modules/lint-staged/node_modules/chalk": { + "version": "5.3.0", + "dev": true, + "license": "MIT", + "engines": { + "node": "^12.17.0 || ^14.13 || >=16.0.0" + }, + "funding": { + "url": "https://github.com/chalk/chalk?sponsor=1" + } + }, + "node_modules/lint-staged/node_modules/commander": { + "version": "11.0.0", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=16" + } + }, + "node_modules/lint-staged/node_modules/execa": { + "version": "7.2.0", + "dev": true, + "license": "MIT", + "dependencies": { + "cross-spawn": "^7.0.3", + "get-stream": "^6.0.1", + "human-signals": "^4.3.0", + "is-stream": "^3.0.0", + "merge-stream": "^2.0.0", + "npm-run-path": "^5.1.0", + "onetime": "^6.0.0", + "signal-exit": "^3.0.7", + "strip-final-newline": "^3.0.0" + }, + "engines": { + "node": "^14.18.0 || ^16.14.0 || >=18.0.0" + }, + "funding": { + "url": "https://github.com/sindresorhus/execa?sponsor=1" + } + }, + "node_modules/lint-staged/node_modules/lilconfig": { + "version": "2.1.0", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=10" + } + }, + "node_modules/lint-staged/node_modules/onetime": { + "version": "6.0.0", + "dev": true, + "license": "MIT", + "dependencies": { + "mimic-fn": "^4.0.0" + }, + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/listr2": { + "version": "6.6.1", + "dev": true, + "license": "MIT", + "dependencies": { + "cli-truncate": "^3.1.0", + "colorette": "^2.0.20", + "eventemitter3": "^5.0.1", + "log-update": "^5.0.1", + "rfdc": "^1.3.0", + "wrap-ansi": "^8.1.0" + }, + "engines": { + "node": ">=16.0.0" + }, + "peerDependencies": { + "enquirer": ">= 2.3.0 < 3" + }, + "peerDependenciesMeta": { + "enquirer": { + "optional": true + } + } + }, + "node_modules/listr2/node_modules/eventemitter3": { + "version": "5.0.1", + "dev": true, + "license": "MIT" + }, + "node_modules/loader-runner": { + "version": "4.3.0", + "license": "MIT", + "engines": { + "node": ">=6.11.5" + } + }, + "node_modules/loader-utils": { + "version": "2.0.4", + "license": "MIT", + "dependencies": { + "big.js": "^5.2.2", + "emojis-list": "^3.0.0", + "json5": "^2.1.2" + }, + "engines": { + "node": ">=8.9.0" + } + }, + "node_modules/locate-path": { + "version": "6.0.0", + "dev": true, + "license": "MIT", + "dependencies": { + "p-locate": "^5.0.0" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/lodash": { + "version": "4.17.21", + "license": "MIT" + }, + "node_modules/lodash.debounce": { + "version": "4.0.8", + "license": "MIT" + }, + "node_modules/lodash.memoize": { + "version": "4.1.2", + "license": "MIT" + }, + "node_modules/lodash.merge": { + "version": "4.6.2", + "dev": true, + "license": "MIT" + }, + "node_modules/lodash.uniq": { + "version": "4.5.0", + "license": "MIT" + }, + "node_modules/log-update": { + "version": "5.0.1", + "dev": true, + "license": "MIT", + "dependencies": { + "ansi-escapes": "^5.0.0", + "cli-cursor": "^4.0.0", + "slice-ansi": "^5.0.0", + "strip-ansi": "^7.0.1", + "wrap-ansi": "^8.0.1" + }, + "engines": { + "node": "^12.20.0 || ^14.13.1 || >=16.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/log-update/node_modules/ansi-regex": { + "version": "6.0.1", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/chalk/ansi-regex?sponsor=1" + } + }, + "node_modules/log-update/node_modules/strip-ansi": { + "version": "7.1.0", + "dev": true, + "license": "MIT", + "dependencies": { + "ansi-regex": "^6.0.1" + }, + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/chalk/strip-ansi?sponsor=1" + } + }, + "node_modules/longest-streak": { + "version": "3.1.0", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/loose-envify": { + "version": "1.4.0", + "license": "MIT", + "dependencies": { + "js-tokens": "^3.0.0 || ^4.0.0" + }, + "bin": { + "loose-envify": "cli.js" + } + }, + "node_modules/lower-case": { + "version": "2.0.2", + "license": "MIT", + "dependencies": { + "tslib": "^2.0.3" + } + }, + "node_modules/lower-case/node_modules/tslib": { + "version": "2.6.2", + "license": "0BSD" + }, + "node_modules/lowercase-keys": { + "version": "3.0.0", + "license": "MIT", + "engines": { + "node": "^12.20.0 || ^14.13.1 || >=16.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/lru-cache": { + "version": "10.4.3", + "license": "ISC" + }, + "node_modules/lunr": { + "version": "2.3.9", + "resolved": "https://registry.npmjs.org/lunr/-/lunr-2.3.9.tgz", + "integrity": "sha512-zTU3DaZaF3Rt9rhN3uBMGQD3dD2/vFQqnvZCDv4dl5iOzq2IZQqTxu90r4E5J+nP70J3ilqVCrbho2eWaeW8Ow==", + "license": "MIT" + }, + "node_modules/lunr-languages": { + "version": "1.14.0", + "resolved": "https://registry.npmjs.org/lunr-languages/-/lunr-languages-1.14.0.tgz", + "integrity": "sha512-hWUAb2KqM3L7J5bcrngszzISY4BxrXn/Xhbb9TTCJYEGqlR1nG67/M14sp09+PTIRklobrn57IAxcdcO/ZFyNA==", + "license": "MPL-1.1" + }, + "node_modules/magic-string": { + "version": "0.25.9", + "license": "MIT", + "dependencies": { + "sourcemap-codec": "^1.4.8" + } + }, + "node_modules/mark.js": { + "version": "8.11.1", + "resolved": "https://registry.npmjs.org/mark.js/-/mark.js-8.11.1.tgz", + "integrity": "sha512-1I+1qpDt4idfgLQG+BNWmrqku+7/2bi5nLf4YwF8y8zXvmfiTBY3PV3ZibfrjBueCByROpuBjLLFCajqkgYoLQ==", + "license": "MIT" + }, + "node_modules/markdown-extensions": { + "version": "2.0.0", + "license": "MIT", + "engines": { + "node": ">=16" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/markdown-table": { + "version": "2.0.0", + "license": "MIT", + "dependencies": { + "repeat-string": "^1.0.0" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/mdast-util-definitions": { + "version": "5.1.2", + "license": "MIT", + "dependencies": { + "@types/mdast": "^3.0.0", + "@types/unist": "^2.0.0", + "unist-util-visit": "^4.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-definitions/node_modules/@types/mdast": { + "version": "3.0.13", + "license": "MIT", + "dependencies": { + "@types/unist": "^2" + } + }, + "node_modules/mdast-util-definitions/node_modules/@types/unist": { + "version": "2.0.8", + "license": "MIT" + }, + "node_modules/mdast-util-definitions/node_modules/unist-util-is": { + "version": "5.2.1", + "license": "MIT", + "dependencies": { + "@types/unist": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-definitions/node_modules/unist-util-visit": { + "version": "4.1.2", + "license": "MIT", + "dependencies": { + "@types/unist": "^2.0.0", + "unist-util-is": "^5.0.0", + "unist-util-visit-parents": "^5.1.1" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-definitions/node_modules/unist-util-visit-parents": { + "version": "5.1.3", + "license": "MIT", + "dependencies": { + "@types/unist": "^2.0.0", + "unist-util-is": "^5.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-directive": { + "version": "3.1.0", + "license": "MIT", + "dependencies": { + "@types/mdast": "^4.0.0", + "@types/unist": "^3.0.0", + "ccount": "^2.0.0", + "devlop": "^1.0.0", + "mdast-util-from-markdown": "^2.0.0", + "mdast-util-to-markdown": "^2.0.0", + "parse-entities": "^4.0.0", + "stringify-entities": "^4.0.0", + "unist-util-visit-parents": "^6.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-find-and-replace": { + "version": "3.0.2", + "license": "MIT", + "dependencies": { + "@types/mdast": "^4.0.0", + "escape-string-regexp": "^5.0.0", + "unist-util-is": "^6.0.0", + "unist-util-visit-parents": "^6.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-find-and-replace/node_modules/escape-string-regexp": { + "version": "5.0.0", + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/mdast-util-from-markdown": { + "version": "2.0.2", + "license": "MIT", + "dependencies": { + "@types/mdast": "^4.0.0", + "@types/unist": "^3.0.0", + "decode-named-character-reference": "^1.0.0", + "devlop": "^1.0.0", + "mdast-util-to-string": "^4.0.0", + "micromark": "^4.0.0", + "micromark-util-decode-numeric-character-reference": "^2.0.0", + "micromark-util-decode-string": "^2.0.0", + "micromark-util-normalize-identifier": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0", + "unist-util-stringify-position": "^4.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-frontmatter": { + "version": "2.0.1", + "license": "MIT", + "dependencies": { + "@types/mdast": "^4.0.0", + "devlop": "^1.0.0", + "escape-string-regexp": "^5.0.0", + "mdast-util-from-markdown": "^2.0.0", + "mdast-util-to-markdown": "^2.0.0", + "micromark-extension-frontmatter": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-frontmatter/node_modules/escape-string-regexp": { + "version": "5.0.0", + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/mdast-util-gfm": { + "version": "3.1.0", + "license": "MIT", + "dependencies": { + "mdast-util-from-markdown": "^2.0.0", + "mdast-util-gfm-autolink-literal": "^2.0.0", + "mdast-util-gfm-footnote": "^2.0.0", + "mdast-util-gfm-strikethrough": "^2.0.0", + "mdast-util-gfm-table": "^2.0.0", + "mdast-util-gfm-task-list-item": "^2.0.0", + "mdast-util-to-markdown": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-gfm-autolink-literal": { + "version": "2.0.1", + "license": "MIT", + "dependencies": { + "@types/mdast": "^4.0.0", + "ccount": "^2.0.0", + "devlop": "^1.0.0", + "mdast-util-find-and-replace": "^3.0.0", + "micromark-util-character": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-gfm-footnote": { + "version": "2.1.0", + "license": "MIT", + "dependencies": { + "@types/mdast": "^4.0.0", + "devlop": "^1.1.0", + "mdast-util-from-markdown": "^2.0.0", + "mdast-util-to-markdown": "^2.0.0", + "micromark-util-normalize-identifier": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-gfm-strikethrough": { + "version": "2.0.0", + "license": "MIT", + "dependencies": { + "@types/mdast": "^4.0.0", + "mdast-util-from-markdown": "^2.0.0", + "mdast-util-to-markdown": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-gfm-table": { + "version": "2.0.0", + "license": "MIT", + "dependencies": { + "@types/mdast": "^4.0.0", + "devlop": "^1.0.0", + "markdown-table": "^3.0.0", + "mdast-util-from-markdown": "^2.0.0", + "mdast-util-to-markdown": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-gfm-table/node_modules/markdown-table": { + "version": "3.0.4", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/mdast-util-gfm-task-list-item": { + "version": "2.0.0", + "license": "MIT", + "dependencies": { + "@types/mdast": "^4.0.0", + "devlop": "^1.0.0", + "mdast-util-from-markdown": "^2.0.0", + "mdast-util-to-markdown": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-mdx": { + "version": "3.0.0", + "license": "MIT", + "dependencies": { + "mdast-util-from-markdown": "^2.0.0", + "mdast-util-mdx-expression": "^2.0.0", + "mdast-util-mdx-jsx": "^3.0.0", + "mdast-util-mdxjs-esm": "^2.0.0", + "mdast-util-to-markdown": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-mdx-expression": { + "version": "2.0.1", + "license": "MIT", + "dependencies": { + "@types/estree-jsx": "^1.0.0", + "@types/hast": "^3.0.0", + "@types/mdast": "^4.0.0", + "devlop": "^1.0.0", + "mdast-util-from-markdown": "^2.0.0", + "mdast-util-to-markdown": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-mdx-jsx": { + "version": "3.2.0", + "license": "MIT", + "dependencies": { + "@types/estree-jsx": "^1.0.0", + "@types/hast": "^3.0.0", + "@types/mdast": "^4.0.0", + "@types/unist": "^3.0.0", + "ccount": "^2.0.0", + "devlop": "^1.1.0", + "mdast-util-from-markdown": "^2.0.0", + "mdast-util-to-markdown": "^2.0.0", + "parse-entities": "^4.0.0", + "stringify-entities": "^4.0.0", + "unist-util-stringify-position": "^4.0.0", + "vfile-message": "^4.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-mdxjs-esm": { + "version": "2.0.1", + "license": "MIT", + "dependencies": { + "@types/estree-jsx": "^1.0.0", + "@types/hast": "^3.0.0", + "@types/mdast": "^4.0.0", + "devlop": "^1.0.0", + "mdast-util-from-markdown": "^2.0.0", + "mdast-util-to-markdown": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-phrasing": { + "version": "4.1.0", + "license": "MIT", + "dependencies": { + "@types/mdast": "^4.0.0", + "unist-util-is": "^6.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-to-hast": { + "version": "13.2.0", + "license": "MIT", + "dependencies": { + "@types/hast": "^3.0.0", + "@types/mdast": "^4.0.0", + "@ungap/structured-clone": "^1.0.0", + "devlop": "^1.0.0", + "micromark-util-sanitize-uri": "^2.0.0", + "trim-lines": "^3.0.0", + "unist-util-position": "^5.0.0", + "unist-util-visit": "^5.0.0", + "vfile": "^6.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-to-markdown": { + "version": "2.1.2", + "license": "MIT", + "dependencies": { + "@types/mdast": "^4.0.0", + "@types/unist": "^3.0.0", + "longest-streak": "^3.0.0", + "mdast-util-phrasing": "^4.0.0", + "mdast-util-to-string": "^4.0.0", + "micromark-util-classify-character": "^2.0.0", + "micromark-util-decode-string": "^2.0.0", + "unist-util-visit": "^5.0.0", + "zwitch": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdast-util-to-string": { + "version": "4.0.0", + "license": "MIT", + "dependencies": { + "@types/mdast": "^4.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/mdn-data": { + "version": "2.0.30", + "license": "CC0-1.0" + }, + "node_modules/media-typer": { + "version": "0.3.0", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/memfs": { + "version": "3.5.3", + "license": "Unlicense", + "dependencies": { + "fs-monkey": "^1.0.4" + }, + "engines": { + "node": ">= 4.0.0" + } + }, + "node_modules/merge-descriptors": { + "version": "1.0.1", + "license": "MIT" + }, + "node_modules/merge-stream": { + "version": "2.0.0", + "license": "MIT" + }, + "node_modules/merge2": { + "version": "1.4.1", + "license": "MIT", + "engines": { + "node": ">= 8" + } + }, + "node_modules/methods": { + "version": "1.1.2", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/micromark": { + "version": "4.0.2", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "@types/debug": "^4.0.0", + "debug": "^4.0.0", + "decode-named-character-reference": "^1.0.0", + "devlop": "^1.0.0", + "micromark-core-commonmark": "^2.0.0", + "micromark-factory-space": "^2.0.0", + "micromark-util-character": "^2.0.0", + "micromark-util-chunked": "^2.0.0", + "micromark-util-combine-extensions": "^2.0.0", + "micromark-util-decode-numeric-character-reference": "^2.0.0", + "micromark-util-encode": "^2.0.0", + "micromark-util-normalize-identifier": "^2.0.0", + "micromark-util-resolve-all": "^2.0.0", + "micromark-util-sanitize-uri": "^2.0.0", + "micromark-util-subtokenize": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0" + } + }, + "node_modules/micromark-core-commonmark": { + "version": "2.0.3", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "decode-named-character-reference": "^1.0.0", + "devlop": "^1.0.0", + "micromark-factory-destination": "^2.0.0", + "micromark-factory-label": "^2.0.0", + "micromark-factory-space": "^2.0.0", + "micromark-factory-title": "^2.0.0", + "micromark-factory-whitespace": "^2.0.0", + "micromark-util-character": "^2.0.0", + "micromark-util-chunked": "^2.0.0", + "micromark-util-classify-character": "^2.0.0", + "micromark-util-html-tag-name": "^2.0.0", + "micromark-util-normalize-identifier": "^2.0.0", + "micromark-util-resolve-all": "^2.0.0", + "micromark-util-subtokenize": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0" + } + }, + "node_modules/micromark-extension-directive": { + "version": "3.0.2", + "license": "MIT", + "dependencies": { + "devlop": "^1.0.0", + "micromark-factory-space": "^2.0.0", + "micromark-factory-whitespace": "^2.0.0", + "micromark-util-character": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0", + "parse-entities": "^4.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/micromark-extension-frontmatter": { + "version": "2.0.0", + "license": "MIT", + "dependencies": { + "fault": "^2.0.0", + "micromark-util-character": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/micromark-extension-gfm": { + "version": "3.0.0", + "license": "MIT", + "dependencies": { + "micromark-extension-gfm-autolink-literal": "^2.0.0", + "micromark-extension-gfm-footnote": "^2.0.0", + "micromark-extension-gfm-strikethrough": "^2.0.0", + "micromark-extension-gfm-table": "^2.0.0", + "micromark-extension-gfm-tagfilter": "^2.0.0", + "micromark-extension-gfm-task-list-item": "^2.0.0", + "micromark-util-combine-extensions": "^2.0.0", + "micromark-util-types": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/micromark-extension-gfm-autolink-literal": { + "version": "2.1.0", + "license": "MIT", + "dependencies": { + "micromark-util-character": "^2.0.0", + "micromark-util-sanitize-uri": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/micromark-extension-gfm-footnote": { + "version": "2.1.0", + "license": "MIT", + "dependencies": { + "devlop": "^1.0.0", + "micromark-core-commonmark": "^2.0.0", + "micromark-factory-space": "^2.0.0", + "micromark-util-character": "^2.0.0", + "micromark-util-normalize-identifier": "^2.0.0", + "micromark-util-sanitize-uri": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/micromark-extension-gfm-strikethrough": { + "version": "2.1.0", + "license": "MIT", + "dependencies": { + "devlop": "^1.0.0", + "micromark-util-chunked": "^2.0.0", + "micromark-util-classify-character": "^2.0.0", + "micromark-util-resolve-all": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/micromark-extension-gfm-table": { + "version": "2.1.1", + "license": "MIT", + "dependencies": { + "devlop": "^1.0.0", + "micromark-factory-space": "^2.0.0", + "micromark-util-character": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/micromark-extension-gfm-tagfilter": { + "version": "2.0.0", + "license": "MIT", + "dependencies": { + "micromark-util-types": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/micromark-extension-gfm-task-list-item": { + "version": "2.1.0", + "license": "MIT", + "dependencies": { + "devlop": "^1.0.0", + "micromark-factory-space": "^2.0.0", + "micromark-util-character": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/micromark-extension-mdx-expression": { + "version": "3.0.1", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "@types/estree": "^1.0.0", + "devlop": "^1.0.0", + "micromark-factory-mdx-expression": "^2.0.0", + "micromark-factory-space": "^2.0.0", + "micromark-util-character": "^2.0.0", + "micromark-util-events-to-acorn": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0" + } + }, + "node_modules/micromark-extension-mdx-jsx": { + "version": "3.0.2", + "license": "MIT", + "dependencies": { + "@types/estree": "^1.0.0", + "devlop": "^1.0.0", + "estree-util-is-identifier-name": "^3.0.0", + "micromark-factory-mdx-expression": "^2.0.0", + "micromark-factory-space": "^2.0.0", + "micromark-util-character": "^2.0.0", + "micromark-util-events-to-acorn": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0", + "vfile-message": "^4.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/micromark-extension-mdx-md": { + "version": "2.0.0", + "license": "MIT", + "dependencies": { + "micromark-util-types": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/micromark-extension-mdxjs": { + "version": "3.0.0", + "license": "MIT", + "dependencies": { + "acorn": "^8.0.0", + "acorn-jsx": "^5.0.0", + "micromark-extension-mdx-expression": "^3.0.0", + "micromark-extension-mdx-jsx": "^3.0.0", + "micromark-extension-mdx-md": "^2.0.0", + "micromark-extension-mdxjs-esm": "^3.0.0", + "micromark-util-combine-extensions": "^2.0.0", + "micromark-util-types": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/micromark-extension-mdxjs-esm": { + "version": "3.0.0", + "license": "MIT", + "dependencies": { + "@types/estree": "^1.0.0", + "devlop": "^1.0.0", + "micromark-core-commonmark": "^2.0.0", + "micromark-util-character": "^2.0.0", + "micromark-util-events-to-acorn": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0", + "unist-util-position-from-estree": "^2.0.0", + "vfile-message": "^4.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/micromark-extension-mdxjs/node_modules/acorn": { + "version": "8.15.0", + "license": "MIT", + "bin": { + "acorn": "bin/acorn" + }, + "engines": { + "node": ">=0.4.0" + } + }, + "node_modules/micromark-extension-mdxjs/node_modules/acorn-jsx": { + "version": "5.3.2", + "license": "MIT", + "peerDependencies": { + "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0" + } + }, + "node_modules/micromark-factory-destination": { + "version": "2.0.1", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-character": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0" + } + }, + "node_modules/micromark-factory-label": { + "version": "2.0.1", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "devlop": "^1.0.0", + "micromark-util-character": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0" + } + }, + "node_modules/micromark-factory-mdx-expression": { + "version": "2.0.3", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "@types/estree": "^1.0.0", + "devlop": "^1.0.0", + "micromark-factory-space": "^2.0.0", + "micromark-util-character": "^2.0.0", + "micromark-util-events-to-acorn": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0", + "unist-util-position-from-estree": "^2.0.0", + "vfile-message": "^4.0.0" + } + }, + "node_modules/micromark-factory-space": { + "version": "2.0.1", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-character": "^2.0.0", + "micromark-util-types": "^2.0.0" + } + }, + "node_modules/micromark-factory-title": { + "version": "2.0.1", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-factory-space": "^2.0.0", + "micromark-util-character": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0" + } + }, + "node_modules/micromark-factory-whitespace": { + "version": "2.0.1", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-factory-space": "^2.0.0", + "micromark-util-character": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0" + } + }, + "node_modules/micromark-util-character": { + "version": "2.1.1", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0" + } + }, + "node_modules/micromark-util-chunked": { + "version": "2.0.1", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-symbol": "^2.0.0" + } + }, + "node_modules/micromark-util-classify-character": { + "version": "2.0.1", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-character": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0" + } + }, + "node_modules/micromark-util-combine-extensions": { + "version": "2.0.1", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-chunked": "^2.0.0", + "micromark-util-types": "^2.0.0" + } + }, + "node_modules/micromark-util-decode-numeric-character-reference": { + "version": "2.0.2", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-symbol": "^2.0.0" + } + }, + "node_modules/micromark-util-decode-string": { + "version": "2.0.1", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "decode-named-character-reference": "^1.0.0", + "micromark-util-character": "^2.0.0", + "micromark-util-decode-numeric-character-reference": "^2.0.0", + "micromark-util-symbol": "^2.0.0" + } + }, + "node_modules/micromark-util-encode": { + "version": "2.0.1", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT" + }, + "node_modules/micromark-util-events-to-acorn": { + "version": "2.0.3", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "@types/estree": "^1.0.0", + "@types/unist": "^3.0.0", + "devlop": "^1.0.0", + "estree-util-visit": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0", + "vfile-message": "^4.0.0" + } + }, + "node_modules/micromark-util-html-tag-name": { + "version": "2.0.1", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT" + }, + "node_modules/micromark-util-normalize-identifier": { + "version": "2.0.1", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-symbol": "^2.0.0" + } + }, + "node_modules/micromark-util-resolve-all": { + "version": "2.0.1", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-types": "^2.0.0" + } + }, + "node_modules/micromark-util-sanitize-uri": { + "version": "2.0.1", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-character": "^2.0.0", + "micromark-util-encode": "^2.0.0", + "micromark-util-symbol": "^2.0.0" + } + }, + "node_modules/micromark-util-subtokenize": { + "version": "2.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "devlop": "^1.0.0", + "micromark-util-chunked": "^2.0.0", + "micromark-util-symbol": "^2.0.0", + "micromark-util-types": "^2.0.0" + } + }, + "node_modules/micromark-util-symbol": { + "version": "2.0.1", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT" + }, + "node_modules/micromark-util-types": { + "version": "2.0.2", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT" + }, + "node_modules/micromatch": { + "version": "4.0.5", + "license": "MIT", + "dependencies": { + "braces": "^3.0.2", + "picomatch": "^2.3.1" + }, + "engines": { + "node": ">=8.6" + } + }, + "node_modules/mime": { + "version": "1.6.0", + "license": "MIT", + "bin": { + "mime": "cli.js" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/mime-db": { + "version": "1.52.0", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/mime-types": { + "version": "2.1.35", + "license": "MIT", + "dependencies": { + "mime-db": "1.52.0" + }, + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/mimic-fn": { + "version": "4.0.0", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/mimic-response": { + "version": "4.0.0", + "license": "MIT", + "engines": { + "node": "^12.20.0 || ^14.13.1 || >=16.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/mini-css-extract-plugin": { + "version": "2.9.2", + "license": "MIT", + "dependencies": { + "schema-utils": "^4.0.0", + "tapable": "^2.2.1" + }, + "engines": { + "node": ">= 12.13.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + }, + "peerDependencies": { + "webpack": "^5.0.0" + } + }, + "node_modules/mini-css-extract-plugin/node_modules/tapable": { + "version": "2.2.2", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/minimalistic-assert": { + "version": "1.0.1", + "license": "ISC" + }, + "node_modules/minimatch": { + "version": "3.1.2", + "license": "ISC", + "dependencies": { + "brace-expansion": "^1.1.7" + }, + "engines": { + "node": "*" + } + }, + "node_modules/minimist": { + "version": "1.2.8", + "license": "MIT", + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/minipass": { + "version": "7.1.2", + "license": "ISC", + "engines": { + "node": ">=16 || 14 >=14.17" + } + }, + "node_modules/mri": { + "version": "1.2.0", + "license": "MIT", + "engines": { + "node": ">=4" + } + }, + "node_modules/mrmime": { + "version": "1.0.1", + "license": "MIT", + "engines": { + "node": ">=10" + } + }, + "node_modules/ms": { + "version": "2.1.3", + "license": "MIT" + }, + "node_modules/multicast-dns": { + "version": "7.2.5", + "license": "MIT", + "dependencies": { + "dns-packet": "^5.2.2", + "thunky": "^1.0.2" + }, + "bin": { + "multicast-dns": "cli.js" + } + }, + "node_modules/mz": { + "version": "2.7.0", + "license": "MIT", + "dependencies": { + "any-promise": "^1.0.0", + "object-assign": "^4.0.1", + "thenify-all": "^1.0.0" + } + }, + "node_modules/nanoid": { + "version": "3.3.8", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "bin": { + "nanoid": "bin/nanoid.cjs" + }, + "engines": { + "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1" + } + }, + "node_modules/natural-compare": { + "version": "1.4.0", + "dev": true, + "license": "MIT" + }, + "node_modules/natural-compare-lite": { + "version": "1.4.0", + "dev": true, + "license": "MIT" + }, + "node_modules/negotiator": { + "version": "0.6.3", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/neo-async": { + "version": "2.6.2", + "license": "MIT" + }, + "node_modules/no-case": { + "version": "3.0.4", + "license": "MIT", + "dependencies": { + "lower-case": "^2.0.2", + "tslib": "^2.0.3" + } + }, + "node_modules/no-case/node_modules/tslib": { + "version": "2.6.2", + "license": "0BSD" + }, + "node_modules/node-emoji": { + "version": "2.2.0", + "license": "MIT", + "dependencies": { + "@sindresorhus/is": "^4.6.0", + "char-regex": "^1.0.2", + "emojilib": "^2.4.0", + "skin-tone": "^2.0.0" + }, + "engines": { + "node": ">=18" + } + }, + "node_modules/node-emoji/node_modules/@sindresorhus/is": { + "version": "4.6.0", + "license": "MIT", + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sindresorhus/is?sponsor=1" + } + }, + "node_modules/node-forge": { + "version": "1.3.1", + "license": "(BSD-3-Clause OR GPL-2.0)", + "engines": { + "node": ">= 6.13.0" + } + }, + "node_modules/node-releases": { + "version": "2.0.19", + "license": "MIT" + }, + "node_modules/normalize-path": { + "version": "3.0.0", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/normalize-range": { + "version": "0.1.2", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/normalize-url": { + "version": "8.0.2", + "license": "MIT", + "engines": { + "node": ">=14.16" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/npm-run-path": { + "version": "5.1.0", + "dev": true, + "license": "MIT", + "dependencies": { + "path-key": "^4.0.0" + }, + "engines": { + "node": "^12.20.0 || ^14.13.1 || >=16.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/npm-run-path/node_modules/path-key": { + "version": "4.0.0", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/nprogress": { + "version": "0.2.0", + "license": "MIT" + }, + "node_modules/nth-check": { + "version": "2.1.1", + "license": "BSD-2-Clause", + "dependencies": { + "boolbase": "^1.0.0" + }, + "funding": { + "url": "https://github.com/fb55/nth-check?sponsor=1" + } + }, + "node_modules/null-loader": { + "version": "4.0.1", + "license": "MIT", + "dependencies": { + "loader-utils": "^2.0.0", + "schema-utils": "^3.0.0" + }, + "engines": { + "node": ">= 10.13.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + }, + "peerDependencies": { + "webpack": "^4.0.0 || ^5.0.0" + } + }, + "node_modules/null-loader/node_modules/ajv": { + "version": "6.12.6", + "license": "MIT", + "dependencies": { + "fast-deep-equal": "^3.1.1", + "fast-json-stable-stringify": "^2.0.0", + "json-schema-traverse": "^0.4.1", + "uri-js": "^4.2.2" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/epoberezkin" + } + }, + "node_modules/null-loader/node_modules/ajv-keywords": { + "version": "3.5.2", + "license": "MIT", + "peerDependencies": { + "ajv": "^6.9.1" + } + }, + "node_modules/null-loader/node_modules/schema-utils": { + "version": "3.3.0", + "license": "MIT", + "dependencies": { + "@types/json-schema": "^7.0.8", + "ajv": "^6.12.5", + "ajv-keywords": "^3.5.2" + }, + "engines": { + "node": ">= 10.13.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + } + }, + "node_modules/object-assign": { + "version": "4.1.1", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/object-hash": { + "version": "3.0.0", + "license": "MIT", + "engines": { + "node": ">= 6" + } + }, + "node_modules/object-inspect": { + "version": "1.12.3", + "license": "MIT", + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/object-keys": { + "version": "1.1.1", + "license": "MIT", + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/object.assign": { + "version": "4.1.4", + "license": "MIT", + "dependencies": { + "call-bind": "^1.0.2", + "define-properties": "^1.1.4", + "has-symbols": "^1.0.3", + "object-keys": "^1.1.1" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/obuf": { + "version": "1.1.2", + "license": "MIT" + }, + "node_modules/on-finished": { + "version": "2.4.1", + "license": "MIT", + "dependencies": { + "ee-first": "1.1.1" + }, + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/on-headers": { + "version": "1.0.2", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/once": { + "version": "1.4.0", + "license": "ISC", + "dependencies": { + "wrappy": "1" + } + }, + "node_modules/onetime": { + "version": "5.1.2", + "license": "MIT", + "dependencies": { + "mimic-fn": "^2.1.0" + }, + "engines": { + "node": ">=6" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/onetime/node_modules/mimic-fn": { + "version": "2.1.0", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/open": { + "version": "8.4.2", + "license": "MIT", + "dependencies": { + "define-lazy-prop": "^2.0.0", + "is-docker": "^2.1.1", + "is-wsl": "^2.2.0" + }, + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/opener": { + "version": "1.5.2", + "license": "(WTFPL OR MIT)", + "bin": { + "opener": "bin/opener-bin.js" + } + }, + "node_modules/optionator": { + "version": "0.9.3", + "dev": true, + "license": "MIT", + "dependencies": { + "@aashutoshrathi/word-wrap": "^1.2.3", + "deep-is": "^0.1.3", + "fast-levenshtein": "^2.0.6", + "levn": "^0.4.1", + "prelude-ls": "^1.2.1", + "type-check": "^0.4.0" + }, + "engines": { + "node": ">= 0.8.0" + } + }, + "node_modules/os-homedir": { + "version": "1.0.2", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/p-cancelable": { + "version": "3.0.0", + "license": "MIT", + "engines": { + "node": ">=12.20" + } + }, + "node_modules/p-finally": { + "version": "1.0.0", + "license": "MIT", + "engines": { + "node": ">=4" + } + }, + "node_modules/p-limit": { + "version": "3.1.0", + "dev": true, + "license": "MIT", + "dependencies": { + "yocto-queue": "^0.1.0" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/p-locate": { + "version": "5.0.0", + "dev": true, + "license": "MIT", + "dependencies": { + "p-limit": "^3.0.2" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/p-map": { + "version": "4.0.0", + "license": "MIT", + "dependencies": { + "aggregate-error": "^3.0.0" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/p-queue": { + "version": "6.6.2", + "license": "MIT", + "dependencies": { + "eventemitter3": "^4.0.4", + "p-timeout": "^3.2.0" + }, + "engines": { + "node": ">=8" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/p-retry": { + "version": "4.6.2", + "license": "MIT", + "dependencies": { + "@types/retry": "0.12.0", + "retry": "^0.13.1" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/p-timeout": { + "version": "3.2.0", + "license": "MIT", + "dependencies": { + "p-finally": "^1.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/package-json": { + "version": "8.1.1", + "license": "MIT", + "dependencies": { + "got": "^12.1.0", + "registry-auth-token": "^5.0.1", + "registry-url": "^6.0.0", + "semver": "^7.3.7" + }, + "engines": { + "node": ">=14.16" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/package-json-from-dist": { + "version": "1.0.1", + "license": "BlueOak-1.0.0" + }, + "node_modules/package-json/node_modules/lru-cache": { + "version": "6.0.0", + "license": "ISC", + "dependencies": { + "yallist": "^4.0.0" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/package-json/node_modules/semver": { + "version": "7.5.4", + "license": "ISC", + "dependencies": { + "lru-cache": "^6.0.0" + }, + "bin": { + "semver": "bin/semver.js" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/package-json/node_modules/yallist": { + "version": "4.0.0", + "license": "ISC" + }, + "node_modules/papaparse": { + "version": "5.5.2", + "license": "MIT" + }, + "node_modules/param-case": { + "version": "3.0.4", + "license": "MIT", + "dependencies": { + "dot-case": "^3.0.4", + "tslib": "^2.0.3" + } + }, + "node_modules/param-case/node_modules/tslib": { + "version": "2.6.2", + "license": "0BSD" + }, + "node_modules/parent-module": { + "version": "1.0.1", + "license": "MIT", + "dependencies": { + "callsites": "^3.0.0" + }, + "engines": { + "node": ">=6" + } + }, + "node_modules/parse-entities": { + "version": "4.0.2", + "license": "MIT", + "dependencies": { + "@types/unist": "^2.0.0", + "character-entities-legacy": "^3.0.0", + "character-reference-invalid": "^2.0.0", + "decode-named-character-reference": "^1.0.0", + "is-alphanumerical": "^2.0.0", + "is-decimal": "^2.0.0", + "is-hexadecimal": "^2.0.0" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/parse-entities/node_modules/@types/unist": { + "version": "2.0.8", + "license": "MIT" + }, + "node_modules/parse-json": { + "version": "5.2.0", + "license": "MIT", + "dependencies": { + "@babel/code-frame": "^7.0.0", + "error-ex": "^1.3.1", + "json-parse-even-better-errors": "^2.3.0", + "lines-and-columns": "^1.1.6" + }, + "engines": { + "node": ">=8" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/parse-json/node_modules/@babel/code-frame": { + "version": "7.22.13", + "license": "MIT", + "dependencies": { + "@babel/highlight": "^7.22.13", + "chalk": "^2.4.2" + }, + "engines": { + "node": ">=6.9.0" + } + }, + "node_modules/parse-json/node_modules/ansi-styles": { + "version": "3.2.1", + "license": "MIT", + "dependencies": { + "color-convert": "^1.9.0" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/parse-json/node_modules/chalk": { + "version": "2.4.2", + "license": "MIT", + "dependencies": { + "ansi-styles": "^3.2.1", + "escape-string-regexp": "^1.0.5", + "supports-color": "^5.3.0" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/parse-json/node_modules/color-convert": { + "version": "1.9.3", + "license": "MIT", + "dependencies": { + "color-name": "1.1.3" + } + }, + "node_modules/parse-json/node_modules/color-name": { + "version": "1.1.3", + "license": "MIT" + }, + "node_modules/parse-json/node_modules/escape-string-regexp": { + "version": "1.0.5", + "license": "MIT", + "engines": { + "node": ">=0.8.0" + } + }, + "node_modules/parse-json/node_modules/has-flag": { + "version": "3.0.0", + "license": "MIT", + "engines": { + "node": ">=4" + } + }, + "node_modules/parse-json/node_modules/supports-color": { + "version": "5.5.0", + "license": "MIT", + "dependencies": { + "has-flag": "^3.0.0" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/parse-numeric-range": { + "version": "1.3.0", + "license": "ISC" + }, + "node_modules/parse5": { + "version": "7.3.0", + "resolved": "https://registry.npmjs.org/parse5/-/parse5-7.3.0.tgz", + "integrity": "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==", + "license": "MIT", + "dependencies": { + "entities": "^6.0.0" + }, + "funding": { + "url": "https://github.com/inikulin/parse5?sponsor=1" + } + }, + "node_modules/parse5-htmlparser2-tree-adapter": { + "version": "7.1.0", + "resolved": "https://registry.npmjs.org/parse5-htmlparser2-tree-adapter/-/parse5-htmlparser2-tree-adapter-7.1.0.tgz", + "integrity": "sha512-ruw5xyKs6lrpo9x9rCZqZZnIUntICjQAd0Wsmp396Ul9lN/h+ifgVV1x1gZHi8euej6wTfpqX8j+BFQxF0NS/g==", + "license": "MIT", + "dependencies": { + "domhandler": "^5.0.3", + "parse5": "^7.0.0" + }, + "funding": { + "url": "https://github.com/inikulin/parse5?sponsor=1" + } + }, + "node_modules/parse5-parser-stream": { + "version": "7.1.2", + "resolved": "https://registry.npmjs.org/parse5-parser-stream/-/parse5-parser-stream-7.1.2.tgz", + "integrity": "sha512-JyeQc9iwFLn5TbvvqACIF/VXG6abODeB3Fwmv/TGdLk2LfbWkaySGY72at4+Ty7EkPZj854u4CrICqNk2qIbow==", + "license": "MIT", + "dependencies": { + "parse5": "^7.0.0" + }, + "funding": { + "url": "https://github.com/inikulin/parse5?sponsor=1" + } + }, + "node_modules/parse5/node_modules/entities": { + "version": "6.0.1", + "resolved": "https://registry.npmjs.org/entities/-/entities-6.0.1.tgz", + "integrity": "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==", + "license": "BSD-2-Clause", + "engines": { + "node": ">=0.12" + }, + "funding": { + "url": "https://github.com/fb55/entities?sponsor=1" + } + }, + "node_modules/parseurl": { + "version": "1.3.3", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/pascal-case": { + "version": "3.1.2", + "license": "MIT", + "dependencies": { + "no-case": "^3.0.4", + "tslib": "^2.0.3" + } + }, + "node_modules/pascal-case/node_modules/tslib": { + "version": "2.6.2", + "license": "0BSD" + }, + "node_modules/path-exists": { + "version": "4.0.0", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/path-is-absolute": { + "version": "1.0.1", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/path-is-inside": { + "version": "1.0.2", + "license": "(WTFPL OR MIT)" + }, + "node_modules/path-key": { + "version": "3.1.1", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/path-parse": { + "version": "1.0.7", + "license": "MIT" + }, + "node_modules/path-scurry": { + "version": "1.11.1", + "license": "BlueOak-1.0.0", + "dependencies": { + "lru-cache": "^10.2.0", + "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0" + }, + "engines": { + "node": ">=16 || 14 >=14.18" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, + "node_modules/path-scurry/node_modules/minipass": { + "version": "7.0.4", + "license": "ISC", + "engines": { + "node": ">=16 || 14 >=14.17" + } + }, + "node_modules/path-to-regexp": { + "version": "3.3.0", + "license": "MIT" + }, + "node_modules/path-type": { + "version": "4.0.0", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/picocolors": { + "version": "1.1.1", + "license": "ISC" + }, + "node_modules/picomatch": { + "version": "2.3.1", + "license": "MIT", + "engines": { + "node": ">=8.6" + }, + "funding": { + "url": "https://github.com/sponsors/jonschlinkert" + } + }, + "node_modules/pidtree": { + "version": "0.6.0", + "dev": true, + "license": "MIT", + "bin": { + "pidtree": "bin/pidtree.js" + }, + "engines": { + "node": ">=0.10" + } + }, + "node_modules/pify": { + "version": "2.3.0", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/pirates": { + "version": "4.0.6", + "license": "MIT", + "engines": { + "node": ">= 6" + } + }, + "node_modules/pkg-dir": { + "version": "7.0.0", + "license": "MIT", + "dependencies": { + "find-up": "^6.3.0" + }, + "engines": { + "node": ">=14.16" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/pkg-dir/node_modules/find-up": { + "version": "6.3.0", + "license": "MIT", + "dependencies": { + "locate-path": "^7.1.0", + "path-exists": "^5.0.0" + }, + "engines": { + "node": "^12.20.0 || ^14.13.1 || >=16.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/pkg-dir/node_modules/locate-path": { + "version": "7.2.0", + "license": "MIT", + "dependencies": { + "p-locate": "^6.0.0" + }, + "engines": { + "node": "^12.20.0 || ^14.13.1 || >=16.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/pkg-dir/node_modules/p-limit": { + "version": "4.0.0", + "license": "MIT", + "dependencies": { + "yocto-queue": "^1.0.0" + }, + "engines": { + "node": "^12.20.0 || ^14.13.1 || >=16.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/pkg-dir/node_modules/p-locate": { + "version": "6.0.0", + "license": "MIT", + "dependencies": { + "p-limit": "^4.0.0" + }, + "engines": { + "node": "^12.20.0 || ^14.13.1 || >=16.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/pkg-dir/node_modules/path-exists": { + "version": "5.0.0", + "license": "MIT", + "engines": { + "node": "^12.20.0 || ^14.13.1 || >=16.0.0" + } + }, + "node_modules/pkg-dir/node_modules/yocto-queue": { + "version": "1.2.1", + "license": "MIT", + "engines": { + "node": ">=12.20" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/postcss": { + "version": "8.5.3", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/postcss/" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/postcss" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "nanoid": "^3.3.8", + "picocolors": "^1.1.1", + "source-map-js": "^1.2.1" + }, + "engines": { + "node": "^10 || ^12 || >=14" + } + }, + "node_modules/postcss-import": { + "version": "15.1.0", + "license": "MIT", + "dependencies": { + "postcss-value-parser": "^4.0.0", + "read-cache": "^1.0.0", + "resolve": "^1.1.7" + }, + "engines": { + "node": ">=14.0.0" + }, + "peerDependencies": { + "postcss": "^8.0.0" + } + }, + "node_modules/postcss-import/node_modules/is-core-module": { + "version": "2.13.0", + "license": "MIT", + "dependencies": { + "has": "^1.0.3" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/postcss-import/node_modules/resolve": { + "version": "1.22.6", + "license": "MIT", + "dependencies": { + "is-core-module": "^2.13.0", + "path-parse": "^1.0.7", + "supports-preserve-symlinks-flag": "^1.0.0" + }, + "bin": { + "resolve": "bin/resolve" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/postcss-js": { + "version": "4.0.1", + "license": "MIT", + "dependencies": { + "camelcase-css": "^2.0.1" + }, + "engines": { + "node": "^12 || ^14 || >= 16" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/postcss/" + }, + "peerDependencies": { + "postcss": "^8.4.21" + } + }, + "node_modules/postcss-load-config": { + "version": "4.0.2", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/postcss/" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "lilconfig": "^3.0.0", + "yaml": "^2.3.4" + }, + "engines": { + "node": ">= 14" + }, + "peerDependencies": { + "postcss": ">=8.0.9", + "ts-node": ">=9.0.0" + }, + "peerDependenciesMeta": { + "postcss": { + "optional": true + }, + "ts-node": { + "optional": true + } + } + }, + "node_modules/postcss-load-config/node_modules/yaml": { + "version": "2.7.0", + "license": "ISC", + "bin": { + "yaml": "bin.mjs" + }, + "engines": { + "node": ">= 14" + } + }, + "node_modules/postcss-nested": { + "version": "6.2.0", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/postcss/" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "postcss-selector-parser": "^6.1.1" + }, + "engines": { + "node": ">=12.0" + }, + "peerDependencies": { + "postcss": "^8.2.14" + } + }, + "node_modules/postcss-nested/node_modules/postcss-selector-parser": { + "version": "6.1.2", + "license": "MIT", + "dependencies": { + "cssesc": "^3.0.0", + "util-deprecate": "^1.0.2" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/postcss-selector-parser": { + "version": "7.1.0", + "license": "MIT", + "dependencies": { + "cssesc": "^3.0.0", + "util-deprecate": "^1.0.2" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/postcss-value-parser": { + "version": "4.2.0", + "license": "MIT" + }, + "node_modules/prelude-ls": { + "version": "1.2.1", + "dev": true, + "license": "MIT", + "engines": { + "node": ">= 0.8.0" + } + }, + "node_modules/prettier": { + "version": "2.8.8", + "dev": true, + "license": "MIT", + "bin": { + "prettier": "bin-prettier.js" + }, + "engines": { + "node": ">=10.13.0" + }, + "funding": { + "url": "https://github.com/prettier/prettier?sponsor=1" + } + }, + "node_modules/prettier-plugin-tailwindcss": { + "version": "0.6.11", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=14.21.3" + }, + "peerDependencies": { + "@ianvs/prettier-plugin-sort-imports": "*", + "@prettier/plugin-pug": "*", + "@shopify/prettier-plugin-liquid": "*", + "@trivago/prettier-plugin-sort-imports": "*", + "@zackad/prettier-plugin-twig": "*", + "prettier": "^3.0", + "prettier-plugin-astro": "*", + "prettier-plugin-css-order": "*", + "prettier-plugin-import-sort": "*", + "prettier-plugin-jsdoc": "*", + "prettier-plugin-marko": "*", + "prettier-plugin-multiline-arrays": "*", + "prettier-plugin-organize-attributes": "*", + "prettier-plugin-organize-imports": "*", + "prettier-plugin-sort-imports": "*", + "prettier-plugin-style-order": "*", + "prettier-plugin-svelte": "*" + }, + "peerDependenciesMeta": { + "@ianvs/prettier-plugin-sort-imports": { + "optional": true + }, + "@prettier/plugin-pug": { + "optional": true + }, + "@shopify/prettier-plugin-liquid": { + "optional": true + }, + "@trivago/prettier-plugin-sort-imports": { + "optional": true + }, + "@zackad/prettier-plugin-twig": { + "optional": true + }, + "prettier-plugin-astro": { + "optional": true + }, + "prettier-plugin-css-order": { + "optional": true + }, + "prettier-plugin-import-sort": { + "optional": true + }, + "prettier-plugin-jsdoc": { + "optional": true + }, + "prettier-plugin-marko": { + "optional": true + }, + "prettier-plugin-multiline-arrays": { + "optional": true + }, + "prettier-plugin-organize-attributes": { + "optional": true + }, + "prettier-plugin-organize-imports": { + "optional": true + }, + "prettier-plugin-sort-imports": { + "optional": true + }, + "prettier-plugin-style-order": { + "optional": true + }, + "prettier-plugin-svelte": { + "optional": true + } + } + }, + "node_modules/pretty-error": { + "version": "4.0.0", + "license": "MIT", + "dependencies": { + "lodash": "^4.17.20", + "renderkid": "^3.0.0" + } + }, + "node_modules/pretty-time": { + "version": "1.1.0", + "license": "MIT", + "engines": { + "node": ">=4" + } + }, + "node_modules/prism-react-renderer": { + "version": "1.3.5", + "license": "MIT", + "peerDependencies": { + "react": ">=0.14.9" + } + }, + "node_modules/prismjs": { + "version": "1.30.0", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/process-nextick-args": { + "version": "2.0.1", + "license": "MIT" + }, + "node_modules/prompts": { + "version": "2.4.2", + "license": "MIT", + "dependencies": { + "kleur": "^3.0.3", + "sisteransi": "^1.0.5" + }, + "engines": { + "node": ">= 6" + } + }, + "node_modules/prop-types": { + "version": "15.8.1", + "license": "MIT", + "dependencies": { + "loose-envify": "^1.4.0", + "object-assign": "^4.1.1", + "react-is": "^16.13.1" + } + }, + "node_modules/property-information": { + "version": "7.1.0", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/proto-list": { + "version": "1.2.4", + "license": "ISC" + }, + "node_modules/proxy-addr": { + "version": "2.0.7", + "license": "MIT", + "dependencies": { + "forwarded": "0.2.0", + "ipaddr.js": "1.9.1" + }, + "engines": { + "node": ">= 0.10" + } + }, + "node_modules/punycode": { + "version": "2.3.0", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/pupa": { + "version": "3.1.0", + "license": "MIT", + "dependencies": { + "escape-goat": "^4.0.0" + }, + "engines": { + "node": ">=12.20" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/qs": { + "version": "6.11.0", + "license": "BSD-3-Clause", + "dependencies": { + "side-channel": "^1.0.4" + }, + "engines": { + "node": ">=0.6" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/queue-microtask": { + "version": "1.2.3", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/feross" + }, + { + "type": "patreon", + "url": "https://www.patreon.com/feross" + }, + { + "type": "consulting", + "url": "https://feross.org/support" + } + ], + "license": "MIT" + }, + "node_modules/quick-lru": { + "version": "5.1.1", + "license": "MIT", + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/randombytes": { + "version": "2.1.0", + "license": "MIT", + "dependencies": { + "safe-buffer": "^5.1.0" + } + }, + "node_modules/range-parser": { + "version": "1.2.1", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/raw-body": { + "version": "2.5.1", + "license": "MIT", + "dependencies": { + "bytes": "3.1.2", + "http-errors": "2.0.0", + "iconv-lite": "0.4.24", + "unpipe": "1.0.0" + }, + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/raw-body/node_modules/bytes": { + "version": "3.1.2", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/rc": { + "version": "1.2.8", + "license": "(BSD-2-Clause OR MIT OR Apache-2.0)", + "dependencies": { + "deep-extend": "^0.6.0", + "ini": "~1.3.0", + "minimist": "^1.2.0", + "strip-json-comments": "~2.0.1" + }, + "bin": { + "rc": "cli.js" + } + }, + "node_modules/rc/node_modules/strip-json-comments": { + "version": "2.0.1", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/react": { + "version": "18.3.1", + "license": "MIT", + "dependencies": { + "loose-envify": "^1.1.0" + }, + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/react-dom": { + "version": "18.3.1", + "license": "MIT", + "dependencies": { + "loose-envify": "^1.1.0", + "scheduler": "^0.23.2" + }, + "peerDependencies": { + "react": "^18.3.1" + } + }, + "node_modules/react-fast-compare": { + "version": "3.2.2", + "license": "MIT" + }, + "node_modules/react-helmet-async": { + "name": "@slorber/react-helmet-async", + "version": "1.3.0", + "license": "Apache-2.0", + "dependencies": { + "@babel/runtime": "^7.12.5", + "invariant": "^2.2.4", + "prop-types": "^15.7.2", + "react-fast-compare": "^3.2.0", + "shallowequal": "^1.1.0" + }, + "peerDependencies": { + "react": "^16.6.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", + "react-dom": "^16.6.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" + } + }, + "node_modules/react-is": { + "version": "16.13.1", + "license": "MIT" + }, + "node_modules/react-json-view-lite": { + "version": "2.4.1", + "license": "MIT", + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "react": "^18.0.0 || ^19.0.0" + } + }, + "node_modules/react-live": { + "version": "4.1.8", + "license": "MIT", + "dependencies": { + "prism-react-renderer": "^2.4.0", + "sucrase": "^3.35.0", + "use-editable": "^2.3.3" + }, + "engines": { + "node": ">= 0.12.0", + "npm": ">= 2.0.0" + }, + "peerDependencies": { + "react": ">=18.0.0", + "react-dom": ">=18.0.0" + } + }, + "node_modules/react-live/node_modules/clsx": { + "version": "2.1.1", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/react-live/node_modules/prism-react-renderer": { + "version": "2.4.1", + "license": "MIT", + "dependencies": { + "@types/prismjs": "^1.26.0", + "clsx": "^2.0.0" + }, + "peerDependencies": { + "react": ">=16.0.0" + } + }, + "node_modules/react-loadable": { + "name": "@docusaurus/react-loadable", + "version": "6.0.0", + "license": "MIT", + "dependencies": { + "@types/react": "*" + }, + "peerDependencies": { + "react": "*" + } + }, + "node_modules/react-loadable-ssr-addon-v5-slorber": { + "version": "1.0.1", + "license": "MIT", + "dependencies": { + "@babel/runtime": "^7.10.3" + }, + "engines": { + "node": ">=10.13.0" + }, + "peerDependencies": { + "react-loadable": "*", + "webpack": ">=4.41.1 || 5.x" + } + }, + "node_modules/react-markdown": { + "version": "8.0.7", + "license": "MIT", + "dependencies": { + "@types/hast": "^2.0.0", + "@types/prop-types": "^15.0.0", + "@types/unist": "^2.0.0", + "comma-separated-tokens": "^2.0.0", + "hast-util-whitespace": "^2.0.0", + "prop-types": "^15.0.0", + "property-information": "^6.0.0", + "react-is": "^18.0.0", + "remark-parse": "^10.0.0", + "remark-rehype": "^10.0.0", + "space-separated-tokens": "^2.0.0", + "style-to-object": "^0.4.0", + "unified": "^10.0.0", + "unist-util-visit": "^4.0.0", + "vfile": "^5.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + }, + "peerDependencies": { + "@types/react": ">=16", + "react": ">=16" + } + }, + "node_modules/react-markdown/node_modules/@types/hast": { + "version": "2.3.6", + "license": "MIT", + "dependencies": { + "@types/unist": "^2" + } + }, + "node_modules/react-markdown/node_modules/@types/mdast": { + "version": "3.0.13", + "license": "MIT", + "dependencies": { + "@types/unist": "^2" + } + }, + "node_modules/react-markdown/node_modules/@types/unist": { + "version": "2.0.8", + "license": "MIT" + }, + "node_modules/react-markdown/node_modules/hast-util-whitespace": { + "version": "2.0.1", + "license": "MIT", + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/react-markdown/node_modules/mdast-util-from-markdown": { + "version": "1.3.1", + "license": "MIT", + "dependencies": { + "@types/mdast": "^3.0.0", + "@types/unist": "^2.0.0", + "decode-named-character-reference": "^1.0.0", + "mdast-util-to-string": "^3.1.0", + "micromark": "^3.0.0", + "micromark-util-decode-numeric-character-reference": "^1.0.0", + "micromark-util-decode-string": "^1.0.0", + "micromark-util-normalize-identifier": "^1.0.0", + "micromark-util-symbol": "^1.0.0", + "micromark-util-types": "^1.0.0", + "unist-util-stringify-position": "^3.0.0", + "uvu": "^0.5.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/react-markdown/node_modules/mdast-util-to-hast": { + "version": "12.3.0", + "license": "MIT", + "dependencies": { + "@types/hast": "^2.0.0", + "@types/mdast": "^3.0.0", + "mdast-util-definitions": "^5.0.0", + "micromark-util-sanitize-uri": "^1.1.0", + "trim-lines": "^3.0.0", + "unist-util-generated": "^2.0.0", + "unist-util-position": "^4.0.0", + "unist-util-visit": "^4.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/react-markdown/node_modules/mdast-util-to-string": { + "version": "3.2.0", + "license": "MIT", + "dependencies": { + "@types/mdast": "^3.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/react-markdown/node_modules/micromark": { + "version": "3.2.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "@types/debug": "^4.0.0", + "debug": "^4.0.0", + "decode-named-character-reference": "^1.0.0", + "micromark-core-commonmark": "^1.0.1", + "micromark-factory-space": "^1.0.0", + "micromark-util-character": "^1.0.0", + "micromark-util-chunked": "^1.0.0", + "micromark-util-combine-extensions": "^1.0.0", + "micromark-util-decode-numeric-character-reference": "^1.0.0", + "micromark-util-encode": "^1.0.0", + "micromark-util-normalize-identifier": "^1.0.0", + "micromark-util-resolve-all": "^1.0.0", + "micromark-util-sanitize-uri": "^1.0.0", + "micromark-util-subtokenize": "^1.0.0", + "micromark-util-symbol": "^1.0.0", + "micromark-util-types": "^1.0.1", + "uvu": "^0.5.0" + } + }, + "node_modules/react-markdown/node_modules/micromark-core-commonmark": { + "version": "1.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "decode-named-character-reference": "^1.0.0", + "micromark-factory-destination": "^1.0.0", + "micromark-factory-label": "^1.0.0", + "micromark-factory-space": "^1.0.0", + "micromark-factory-title": "^1.0.0", + "micromark-factory-whitespace": "^1.0.0", + "micromark-util-character": "^1.0.0", + "micromark-util-chunked": "^1.0.0", + "micromark-util-classify-character": "^1.0.0", + "micromark-util-html-tag-name": "^1.0.0", + "micromark-util-normalize-identifier": "^1.0.0", + "micromark-util-resolve-all": "^1.0.0", + "micromark-util-subtokenize": "^1.0.0", + "micromark-util-symbol": "^1.0.0", + "micromark-util-types": "^1.0.1", + "uvu": "^0.5.0" + } + }, + "node_modules/react-markdown/node_modules/micromark-factory-destination": { + "version": "1.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-character": "^1.0.0", + "micromark-util-symbol": "^1.0.0", + "micromark-util-types": "^1.0.0" + } + }, + "node_modules/react-markdown/node_modules/micromark-factory-label": { + "version": "1.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-character": "^1.0.0", + "micromark-util-symbol": "^1.0.0", + "micromark-util-types": "^1.0.0", + "uvu": "^0.5.0" + } + }, + "node_modules/react-markdown/node_modules/micromark-factory-space": { + "version": "1.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-character": "^1.0.0", + "micromark-util-types": "^1.0.0" + } + }, + "node_modules/react-markdown/node_modules/micromark-factory-title": { + "version": "1.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-factory-space": "^1.0.0", + "micromark-util-character": "^1.0.0", + "micromark-util-symbol": "^1.0.0", + "micromark-util-types": "^1.0.0" + } + }, + "node_modules/react-markdown/node_modules/micromark-factory-whitespace": { + "version": "1.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-factory-space": "^1.0.0", + "micromark-util-character": "^1.0.0", + "micromark-util-symbol": "^1.0.0", + "micromark-util-types": "^1.0.0" + } + }, + "node_modules/react-markdown/node_modules/micromark-util-character": { + "version": "1.2.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-symbol": "^1.0.0", + "micromark-util-types": "^1.0.0" + } + }, + "node_modules/react-markdown/node_modules/micromark-util-chunked": { + "version": "1.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-symbol": "^1.0.0" + } + }, + "node_modules/react-markdown/node_modules/micromark-util-classify-character": { + "version": "1.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-character": "^1.0.0", + "micromark-util-symbol": "^1.0.0", + "micromark-util-types": "^1.0.0" + } + }, + "node_modules/react-markdown/node_modules/micromark-util-combine-extensions": { + "version": "1.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-chunked": "^1.0.0", + "micromark-util-types": "^1.0.0" + } + }, + "node_modules/react-markdown/node_modules/micromark-util-decode-numeric-character-reference": { + "version": "1.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-symbol": "^1.0.0" + } + }, + "node_modules/react-markdown/node_modules/micromark-util-decode-string": { + "version": "1.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "decode-named-character-reference": "^1.0.0", + "micromark-util-character": "^1.0.0", + "micromark-util-decode-numeric-character-reference": "^1.0.0", + "micromark-util-symbol": "^1.0.0" + } + }, + "node_modules/react-markdown/node_modules/micromark-util-encode": { + "version": "1.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT" + }, + "node_modules/react-markdown/node_modules/micromark-util-html-tag-name": { + "version": "1.2.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT" + }, + "node_modules/react-markdown/node_modules/micromark-util-normalize-identifier": { + "version": "1.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-symbol": "^1.0.0" + } + }, + "node_modules/react-markdown/node_modules/micromark-util-resolve-all": { + "version": "1.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-types": "^1.0.0" + } + }, + "node_modules/react-markdown/node_modules/micromark-util-sanitize-uri": { + "version": "1.2.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-character": "^1.0.0", + "micromark-util-encode": "^1.0.0", + "micromark-util-symbol": "^1.0.0" + } + }, + "node_modules/react-markdown/node_modules/micromark-util-subtokenize": { + "version": "1.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT", + "dependencies": { + "micromark-util-chunked": "^1.0.0", + "micromark-util-symbol": "^1.0.0", + "micromark-util-types": "^1.0.0", + "uvu": "^0.5.0" + } + }, + "node_modules/react-markdown/node_modules/micromark-util-symbol": { + "version": "1.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT" + }, + "node_modules/react-markdown/node_modules/micromark-util-types": { + "version": "1.1.0", + "funding": [ + { + "type": "GitHub Sponsors", + "url": "https://github.com/sponsors/unifiedjs" + }, + { + "type": "OpenCollective", + "url": "https://opencollective.com/unified" + } + ], + "license": "MIT" + }, + "node_modules/react-markdown/node_modules/property-information": { + "version": "6.3.0", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/react-markdown/node_modules/react-is": { + "version": "18.2.0", + "license": "MIT" + }, + "node_modules/react-markdown/node_modules/remark-parse": { + "version": "10.0.2", + "license": "MIT", + "dependencies": { + "@types/mdast": "^3.0.0", + "mdast-util-from-markdown": "^1.0.0", + "unified": "^10.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/react-markdown/node_modules/remark-rehype": { + "version": "10.1.0", + "license": "MIT", + "dependencies": { + "@types/hast": "^2.0.0", + "@types/mdast": "^3.0.0", + "mdast-util-to-hast": "^12.1.0", + "unified": "^10.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/react-markdown/node_modules/style-to-object": { + "version": "0.4.2", + "license": "MIT", + "dependencies": { + "inline-style-parser": "0.1.1" + } + }, + "node_modules/react-markdown/node_modules/unified": { + "version": "10.1.2", + "license": "MIT", + "dependencies": { + "@types/unist": "^2.0.0", + "bail": "^2.0.0", + "extend": "^3.0.0", + "is-buffer": "^2.0.0", + "is-plain-obj": "^4.0.0", + "trough": "^2.0.0", + "vfile": "^5.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/react-markdown/node_modules/unist-util-is": { + "version": "5.2.1", + "license": "MIT", + "dependencies": { + "@types/unist": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/react-markdown/node_modules/unist-util-position": { + "version": "4.0.4", + "license": "MIT", + "dependencies": { + "@types/unist": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/react-markdown/node_modules/unist-util-stringify-position": { + "version": "3.0.3", + "license": "MIT", + "dependencies": { + "@types/unist": "^2.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/react-markdown/node_modules/unist-util-visit": { + "version": "4.1.2", + "license": "MIT", + "dependencies": { + "@types/unist": "^2.0.0", + "unist-util-is": "^5.0.0", + "unist-util-visit-parents": "^5.1.1" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/react-markdown/node_modules/unist-util-visit-parents": { + "version": "5.1.3", + "license": "MIT", + "dependencies": { + "@types/unist": "^2.0.0", + "unist-util-is": "^5.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/react-markdown/node_modules/vfile": { + "version": "5.3.7", + "license": "MIT", + "dependencies": { + "@types/unist": "^2.0.0", + "is-buffer": "^2.0.0", + "unist-util-stringify-position": "^3.0.0", + "vfile-message": "^3.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/react-markdown/node_modules/vfile-message": { + "version": "3.1.4", + "license": "MIT", + "dependencies": { + "@types/unist": "^2.0.0", + "unist-util-stringify-position": "^3.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/react-property": { + "version": "2.0.0", + "license": "MIT" + }, + "node_modules/react-router": { + "version": "5.3.4", + "license": "MIT", + "dependencies": { + "@babel/runtime": "^7.12.13", + "history": "^4.9.0", + "hoist-non-react-statics": "^3.1.0", + "loose-envify": "^1.3.1", + "path-to-regexp": "^1.7.0", + "prop-types": "^15.6.2", + "react-is": "^16.6.0", + "tiny-invariant": "^1.0.2", + "tiny-warning": "^1.0.0" + }, + "peerDependencies": { + "react": ">=15" + } + }, + "node_modules/react-router-config": { + "version": "5.1.1", + "license": "MIT", + "dependencies": { + "@babel/runtime": "^7.1.2" + }, + "peerDependencies": { + "react": ">=15", + "react-router": ">=5" + } + }, + "node_modules/react-router-dom": { + "version": "5.3.4", + "license": "MIT", + "dependencies": { + "@babel/runtime": "^7.12.13", + "history": "^4.9.0", + "loose-envify": "^1.3.1", + "prop-types": "^15.6.2", + "react-router": "5.3.4", + "tiny-invariant": "^1.0.2", + "tiny-warning": "^1.0.0" + }, + "peerDependencies": { + "react": ">=15" + } + }, + "node_modules/react-router/node_modules/path-to-regexp": { + "version": "1.8.0", + "license": "MIT", + "dependencies": { + "isarray": "0.0.1" + } + }, + "node_modules/read-cache": { + "version": "1.0.0", + "license": "MIT", + "dependencies": { + "pify": "^2.3.0" + } + }, + "node_modules/readable-stream": { + "version": "2.3.8", + "license": "MIT", + "dependencies": { + "core-util-is": "~1.0.0", + "inherits": "~2.0.3", + "isarray": "~1.0.0", + "process-nextick-args": "~2.0.0", + "safe-buffer": "~5.1.1", + "string_decoder": "~1.1.1", + "util-deprecate": "~1.0.1" + } + }, + "node_modules/readable-stream/node_modules/isarray": { + "version": "1.0.0", + "license": "MIT" + }, + "node_modules/readable-stream/node_modules/safe-buffer": { + "version": "5.1.2", + "license": "MIT" + }, + "node_modules/readdirp": { + "version": "3.6.0", + "license": "MIT", + "dependencies": { + "picomatch": "^2.2.1" + }, + "engines": { + "node": ">=8.10.0" + } + }, + "node_modules/recma-build-jsx": { + "version": "1.0.0", + "license": "MIT", + "dependencies": { + "@types/estree": "^1.0.0", + "estree-util-build-jsx": "^3.0.0", + "vfile": "^6.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/recma-jsx": { + "version": "1.0.0", + "license": "MIT", + "dependencies": { + "acorn-jsx": "^5.0.0", + "estree-util-to-js": "^2.0.0", + "recma-parse": "^1.0.0", + "recma-stringify": "^1.0.0", + "unified": "^11.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/recma-parse": { + "version": "1.0.0", + "license": "MIT", + "dependencies": { + "@types/estree": "^1.0.0", + "esast-util-from-js": "^2.0.0", + "unified": "^11.0.0", + "vfile": "^6.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/recma-stringify": { + "version": "1.0.0", + "license": "MIT", + "dependencies": { + "@types/estree": "^1.0.0", + "estree-util-to-js": "^2.0.0", + "unified": "^11.0.0", + "vfile": "^6.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/regenerate": { + "version": "1.4.2", + "license": "MIT" + }, + "node_modules/regenerate-unicode-properties": { + "version": "10.1.1", + "license": "MIT", + "dependencies": { + "regenerate": "^1.4.2" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/regenerator-runtime": { + "version": "0.14.0", + "license": "MIT" + }, + "node_modules/regexpu-core": { + "version": "5.3.2", + "license": "MIT", + "dependencies": { + "@babel/regjsgen": "^0.8.0", + "regenerate": "^1.4.2", + "regenerate-unicode-properties": "^10.1.0", + "regjsparser": "^0.9.1", + "unicode-match-property-ecmascript": "^2.0.0", + "unicode-match-property-value-ecmascript": "^2.1.0" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/registry-auth-token": { + "version": "5.1.0", + "license": "MIT", + "dependencies": { + "@pnpm/npm-conf": "^2.1.0" + }, + "engines": { + "node": ">=14" + } + }, + "node_modules/registry-url": { + "version": "6.0.1", + "license": "MIT", + "dependencies": { + "rc": "1.2.8" + }, + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/regjsgen": { + "version": "0.8.0", + "license": "MIT" + }, + "node_modules/regjsparser": { + "version": "0.9.1", + "license": "BSD-2-Clause", + "dependencies": { + "jsesc": "~0.5.0" + }, + "bin": { + "regjsparser": "bin/parser" + } + }, + "node_modules/rehype-raw": { + "version": "7.0.0", + "license": "MIT", + "dependencies": { + "@types/hast": "^3.0.0", + "hast-util-raw": "^9.0.0", + "vfile": "^6.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/rehype-recma": { + "version": "1.0.0", + "license": "MIT", + "dependencies": { + "@types/estree": "^1.0.0", + "@types/hast": "^3.0.0", + "hast-util-to-estree": "^3.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/relateurl": { + "version": "0.2.7", + "license": "MIT", + "engines": { + "node": ">= 0.10" + } + }, + "node_modules/remark-directive": { + "version": "3.0.1", + "license": "MIT", + "dependencies": { + "@types/mdast": "^4.0.0", + "mdast-util-directive": "^3.0.0", + "micromark-extension-directive": "^3.0.0", + "unified": "^11.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/remark-emoji": { + "version": "4.0.1", + "license": "MIT", + "dependencies": { + "@types/mdast": "^4.0.2", + "emoticon": "^4.0.1", + "mdast-util-find-and-replace": "^3.0.1", + "node-emoji": "^2.1.0", + "unified": "^11.0.4" + }, + "engines": { + "node": "^12.20.0 || ^14.13.1 || >=16.0.0" + } + }, + "node_modules/remark-frontmatter": { + "version": "5.0.0", + "license": "MIT", + "dependencies": { + "@types/mdast": "^4.0.0", + "mdast-util-frontmatter": "^2.0.0", + "micromark-extension-frontmatter": "^2.0.0", + "unified": "^11.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/remark-gfm": { + "version": "4.0.1", + "license": "MIT", + "dependencies": { + "@types/mdast": "^4.0.0", + "mdast-util-gfm": "^3.0.0", + "micromark-extension-gfm": "^3.0.0", + "remark-parse": "^11.0.0", + "remark-stringify": "^11.0.0", + "unified": "^11.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/remark-mdx": { + "version": "3.1.0", + "license": "MIT", + "dependencies": { + "mdast-util-mdx": "^3.0.0", + "micromark-extension-mdxjs": "^3.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/remark-parse": { + "version": "11.0.0", + "license": "MIT", + "dependencies": { + "@types/mdast": "^4.0.0", + "mdast-util-from-markdown": "^2.0.0", + "micromark-util-types": "^2.0.0", + "unified": "^11.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/remark-rehype": { + "version": "11.1.2", + "license": "MIT", + "dependencies": { + "@types/hast": "^3.0.0", + "@types/mdast": "^4.0.0", + "mdast-util-to-hast": "^13.0.0", + "unified": "^11.0.0", + "vfile": "^6.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/remark-stringify": { + "version": "11.0.0", + "license": "MIT", + "dependencies": { + "@types/mdast": "^4.0.0", + "mdast-util-to-markdown": "^2.0.0", + "unified": "^11.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/renderkid": { + "version": "3.0.0", + "license": "MIT", + "dependencies": { + "css-select": "^4.1.3", + "dom-converter": "^0.2.0", + "htmlparser2": "^6.1.0", + "lodash": "^4.17.21", + "strip-ansi": "^6.0.1" + } + }, + "node_modules/renderkid/node_modules/css-select": { + "version": "4.3.0", + "license": "BSD-2-Clause", + "dependencies": { + "boolbase": "^1.0.0", + "css-what": "^6.0.1", + "domhandler": "^4.3.1", + "domutils": "^2.8.0", + "nth-check": "^2.0.1" + }, + "funding": { + "url": "https://github.com/sponsors/fb55" + } + }, + "node_modules/renderkid/node_modules/dom-serializer": { + "version": "1.4.1", + "license": "MIT", + "dependencies": { + "domelementtype": "^2.0.1", + "domhandler": "^4.2.0", + "entities": "^2.0.0" + }, + "funding": { + "url": "https://github.com/cheeriojs/dom-serializer?sponsor=1" + } + }, + "node_modules/renderkid/node_modules/domhandler": { + "version": "4.3.1", + "license": "BSD-2-Clause", + "dependencies": { + "domelementtype": "^2.2.0" + }, + "engines": { + "node": ">= 4" + }, + "funding": { + "url": "https://github.com/fb55/domhandler?sponsor=1" + } + }, + "node_modules/renderkid/node_modules/domutils": { + "version": "2.8.0", + "license": "BSD-2-Clause", + "dependencies": { + "dom-serializer": "^1.0.1", + "domelementtype": "^2.2.0", + "domhandler": "^4.2.0" + }, + "funding": { + "url": "https://github.com/fb55/domutils?sponsor=1" + } + }, + "node_modules/renderkid/node_modules/entities": { + "version": "2.2.0", + "license": "BSD-2-Clause", + "funding": { + "url": "https://github.com/fb55/entities?sponsor=1" + } + }, + "node_modules/renderkid/node_modules/htmlparser2": { + "version": "6.1.0", + "funding": [ + "https://github.com/fb55/htmlparser2?sponsor=1", + { + "type": "github", + "url": "https://github.com/sponsors/fb55" + } + ], + "license": "MIT", + "dependencies": { + "domelementtype": "^2.0.1", + "domhandler": "^4.0.0", + "domutils": "^2.5.2", + "entities": "^2.0.0" + } + }, + "node_modules/repeat-string": { + "version": "1.6.1", + "license": "MIT", + "engines": { + "node": ">=0.10" + } + }, + "node_modules/require-from-string": { + "version": "2.0.2", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/require-like": { + "version": "0.1.2", + "engines": { + "node": "*" + } + }, + "node_modules/requires-port": { + "version": "1.0.0", + "license": "MIT" + }, + "node_modules/resolve": { + "version": "1.22.10", + "license": "MIT", + "dependencies": { + "is-core-module": "^2.16.0", + "path-parse": "^1.0.7", + "supports-preserve-symlinks-flag": "^1.0.0" + }, + "bin": { + "resolve": "bin/resolve" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/resolve-alpn": { + "version": "1.2.1", + "license": "MIT" + }, + "node_modules/resolve-from": { + "version": "4.0.0", + "license": "MIT", + "engines": { + "node": ">=4" + } + }, + "node_modules/resolve-pathname": { + "version": "3.0.0", + "license": "MIT" + }, + "node_modules/responselike": { + "version": "3.0.0", + "license": "MIT", + "dependencies": { + "lowercase-keys": "^3.0.0" + }, + "engines": { + "node": ">=14.16" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/restore-cursor": { + "version": "4.0.0", + "dev": true, + "license": "MIT", + "dependencies": { + "onetime": "^5.1.0", + "signal-exit": "^3.0.2" + }, + "engines": { + "node": "^12.20.0 || ^14.13.1 || >=16.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/retry": { + "version": "0.13.1", + "license": "MIT", + "engines": { + "node": ">= 4" + } + }, + "node_modules/reusify": { + "version": "1.0.4", + "license": "MIT", + "engines": { + "iojs": ">=1.0.0", + "node": ">=0.10.0" + } + }, + "node_modules/rfdc": { + "version": "1.3.0", + "dev": true, + "license": "MIT" + }, + "node_modules/rimraf": { + "version": "3.0.2", + "license": "ISC", + "dependencies": { + "glob": "^7.1.3" + }, + "bin": { + "rimraf": "bin.js" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, + "node_modules/rtlcss": { + "version": "4.3.0", + "license": "MIT", + "dependencies": { + "escalade": "^3.1.1", + "picocolors": "^1.0.0", + "postcss": "^8.4.21", + "strip-json-comments": "^3.1.1" + }, + "bin": { + "rtlcss": "bin/rtlcss.js" + }, + "engines": { + "node": ">=12.0.0" + } + }, + "node_modules/rtlcss/node_modules/picocolors": { + "version": "1.0.0", + "license": "ISC" + }, + "node_modules/run-parallel": { + "version": "1.2.0", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/feross" + }, + { + "type": "patreon", + "url": "https://www.patreon.com/feross" + }, + { + "type": "consulting", + "url": "https://feross.org/support" + } + ], + "license": "MIT", + "dependencies": { + "queue-microtask": "^1.2.2" + } + }, + "node_modules/sade": { + "version": "1.8.1", + "license": "MIT", + "dependencies": { + "mri": "^1.1.0" + }, + "engines": { + "node": ">=6" + } + }, + "node_modules/safe-buffer": { + "version": "5.2.1", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/feross" + }, + { + "type": "patreon", + "url": "https://www.patreon.com/feross" + }, + { + "type": "consulting", + "url": "https://feross.org/support" + } + ], + "license": "MIT" + }, + "node_modules/safer-buffer": { + "version": "2.1.2", + "license": "MIT" + }, + "node_modules/sax": { + "version": "1.3.0", + "license": "ISC" + }, + "node_modules/scheduler": { + "version": "0.23.2", + "license": "MIT", + "dependencies": { + "loose-envify": "^1.1.0" + } + }, + "node_modules/schema-dts": { + "version": "1.1.5", + "license": "Apache-2.0" + }, + "node_modules/schema-utils": { + "version": "4.2.0", + "license": "MIT", + "dependencies": { + "@types/json-schema": "^7.0.9", + "ajv": "^8.9.0", + "ajv-formats": "^2.1.1", + "ajv-keywords": "^5.1.0" + }, + "engines": { + "node": ">= 12.13.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + } + }, + "node_modules/section-matter": { + "version": "1.0.0", + "license": "MIT", + "dependencies": { + "extend-shallow": "^2.0.1", + "kind-of": "^6.0.0" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/select-hose": { + "version": "2.0.0", + "license": "MIT" + }, + "node_modules/selfsigned": { + "version": "2.1.1", + "license": "MIT", + "dependencies": { + "node-forge": "^1" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/semver": { + "version": "6.3.1", + "license": "ISC", + "bin": { + "semver": "bin/semver.js" + } + }, + "node_modules/semver-diff": { + "version": "4.0.0", + "license": "MIT", + "dependencies": { + "semver": "^7.3.5" + }, + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/semver-diff/node_modules/lru-cache": { + "version": "6.0.0", + "license": "ISC", + "dependencies": { + "yallist": "^4.0.0" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/semver-diff/node_modules/semver": { + "version": "7.5.4", + "license": "ISC", + "dependencies": { + "lru-cache": "^6.0.0" + }, + "bin": { + "semver": "bin/semver.js" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/semver-diff/node_modules/yallist": { + "version": "4.0.0", + "license": "ISC" + }, + "node_modules/send": { + "version": "0.18.0", + "license": "MIT", + "dependencies": { + "debug": "2.6.9", + "depd": "2.0.0", + "destroy": "1.2.0", + "encodeurl": "~1.0.2", + "escape-html": "~1.0.3", + "etag": "~1.8.1", + "fresh": "0.5.2", + "http-errors": "2.0.0", + "mime": "1.6.0", + "ms": "2.1.3", + "on-finished": "2.4.1", + "range-parser": "~1.2.1", + "statuses": "2.0.1" + }, + "engines": { + "node": ">= 0.8.0" + } + }, + "node_modules/send/node_modules/debug": { + "version": "2.6.9", + "license": "MIT", + "dependencies": { + "ms": "2.0.0" + } + }, + "node_modules/send/node_modules/debug/node_modules/ms": { + "version": "2.0.0", + "license": "MIT" + }, + "node_modules/serialize-javascript": { + "version": "6.0.1", + "license": "BSD-3-Clause", + "dependencies": { + "randombytes": "^2.1.0" + } + }, + "node_modules/serve-handler": { + "version": "6.1.6", + "license": "MIT", + "dependencies": { + "bytes": "3.0.0", + "content-disposition": "0.5.2", + "mime-types": "2.1.18", + "minimatch": "3.1.2", + "path-is-inside": "1.0.2", + "path-to-regexp": "3.3.0", + "range-parser": "1.2.0" + } + }, + "node_modules/serve-handler/node_modules/mime-db": { + "version": "1.33.0", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/serve-handler/node_modules/mime-types": { + "version": "2.1.18", + "license": "MIT", + "dependencies": { + "mime-db": "~1.33.0" + }, + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/serve-handler/node_modules/range-parser": { + "version": "1.2.0", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/serve-index": { + "version": "1.9.1", + "license": "MIT", + "dependencies": { + "accepts": "~1.3.4", + "batch": "0.6.1", + "debug": "2.6.9", + "escape-html": "~1.0.3", + "http-errors": "~1.6.2", + "mime-types": "~2.1.17", + "parseurl": "~1.3.2" + }, + "engines": { + "node": ">= 0.8.0" + } + }, + "node_modules/serve-index/node_modules/debug": { + "version": "2.6.9", + "license": "MIT", + "dependencies": { + "ms": "2.0.0" + } + }, + "node_modules/serve-index/node_modules/depd": { + "version": "1.1.2", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/serve-index/node_modules/http-errors": { + "version": "1.6.3", + "license": "MIT", + "dependencies": { + "depd": "~1.1.2", + "inherits": "2.0.3", + "setprototypeof": "1.1.0", + "statuses": ">= 1.4.0 < 2" + }, + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/serve-index/node_modules/inherits": { + "version": "2.0.3", + "license": "ISC" + }, + "node_modules/serve-index/node_modules/ms": { + "version": "2.0.0", + "license": "MIT" + }, + "node_modules/serve-index/node_modules/setprototypeof": { + "version": "1.1.0", + "license": "ISC" + }, + "node_modules/serve-index/node_modules/statuses": { + "version": "1.5.0", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/serve-static": { + "version": "1.15.0", + "license": "MIT", + "dependencies": { + "encodeurl": "~1.0.2", + "escape-html": "~1.0.3", + "parseurl": "~1.3.3", + "send": "0.18.0" + }, + "engines": { + "node": ">= 0.8.0" + } + }, + "node_modules/setprototypeof": { + "version": "1.2.0", + "license": "ISC" + }, + "node_modules/shallow-clone": { + "version": "3.0.1", + "license": "MIT", + "dependencies": { + "kind-of": "^6.0.2" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/shallowequal": { + "version": "1.1.0", + "license": "MIT" + }, + "node_modules/shebang-command": { + "version": "2.0.0", + "license": "MIT", + "dependencies": { + "shebang-regex": "^3.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/shebang-regex": { + "version": "3.0.0", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/shell-quote": { + "version": "1.8.1", + "license": "MIT", + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/side-channel": { + "version": "1.0.4", + "license": "MIT", + "dependencies": { + "call-bind": "^1.0.0", + "get-intrinsic": "^1.0.2", + "object-inspect": "^1.9.0" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/signal-exit": { + "version": "3.0.7", + "license": "ISC" + }, + "node_modules/sirv": { + "version": "2.0.3", + "license": "MIT", + "dependencies": { + "@polka/url": "^1.0.0-next.20", + "mrmime": "^1.0.0", + "totalist": "^3.0.0" + }, + "engines": { + "node": ">= 10" + } + }, + "node_modules/sisteransi": { + "version": "1.0.5", + "license": "MIT" + }, + "node_modules/sitemap": { + "version": "7.1.1", + "license": "MIT", + "dependencies": { + "@types/node": "^17.0.5", + "@types/sax": "^1.2.1", + "arg": "^5.0.0", + "sax": "^1.2.4" + }, + "bin": { + "sitemap": "dist/cli.js" + }, + "engines": { + "node": ">=12.0.0", + "npm": ">=5.6.0" + } + }, + "node_modules/sitemap/node_modules/@types/node": { + "version": "17.0.45", + "license": "MIT" + }, + "node_modules/skin-tone": { + "version": "2.0.0", + "license": "MIT", + "dependencies": { + "unicode-emoji-modifier-base": "^1.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/slash": { + "version": "3.0.0", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/slice-ansi": { + "version": "5.0.0", + "dev": true, + "license": "MIT", + "dependencies": { + "ansi-styles": "^6.0.0", + "is-fullwidth-code-point": "^4.0.0" + }, + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/chalk/slice-ansi?sponsor=1" + } + }, + "node_modules/slice-ansi/node_modules/ansi-styles": { + "version": "6.2.1", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/chalk/ansi-styles?sponsor=1" + } + }, + "node_modules/snake-case": { + "version": "3.0.4", + "license": "MIT", + "dependencies": { + "dot-case": "^3.0.4", + "tslib": "^2.0.3" + } + }, + "node_modules/snake-case/node_modules/tslib": { + "version": "2.6.2", + "license": "0BSD" + }, + "node_modules/sockjs": { + "version": "0.3.24", + "license": "MIT", + "dependencies": { + "faye-websocket": "^0.11.3", + "uuid": "^8.3.2", + "websocket-driver": "^0.7.4" + } + }, + "node_modules/sort-css-media-queries": { + "version": "2.2.0", + "license": "MIT", + "engines": { + "node": ">= 6.3.0" + } + }, + "node_modules/source-map": { + "version": "0.6.1", + "license": "BSD-3-Clause", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/source-map-js": { + "version": "1.2.1", + "license": "BSD-3-Clause", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/source-map-support": { + "version": "0.5.21", + "license": "MIT", + "dependencies": { + "buffer-from": "^1.0.0", + "source-map": "^0.6.0" + } + }, + "node_modules/sourcemap-codec": { + "version": "1.4.8", + "license": "MIT" + }, + "node_modules/space-separated-tokens": { + "version": "2.0.2", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/spdy": { + "version": "4.0.2", + "license": "MIT", + "dependencies": { + "debug": "^4.1.0", + "handle-thing": "^2.0.0", + "http-deceiver": "^1.2.7", + "select-hose": "^2.0.0", + "spdy-transport": "^3.0.0" + }, + "engines": { + "node": ">=6.0.0" + } + }, + "node_modules/spdy-transport": { + "version": "3.0.0", + "license": "MIT", + "dependencies": { + "debug": "^4.1.0", + "detect-node": "^2.0.4", + "hpack.js": "^2.1.6", + "obuf": "^1.1.2", + "readable-stream": "^3.0.6", + "wbuf": "^1.7.3" + } + }, + "node_modules/spdy-transport/node_modules/readable-stream": { + "version": "3.6.2", + "license": "MIT", + "dependencies": { + "inherits": "^2.0.3", + "string_decoder": "^1.1.1", + "util-deprecate": "^1.0.1" + }, + "engines": { + "node": ">= 6" + } + }, + "node_modules/spdy-transport/node_modules/string_decoder": { + "version": "1.3.0", + "license": "MIT", + "dependencies": { + "safe-buffer": "~5.2.0" + } + }, + "node_modules/sprintf-js": { + "version": "1.0.3", + "license": "BSD-3-Clause" + }, + "node_modules/srcset": { + "version": "4.0.0", + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/statuses": { + "version": "2.0.1", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/std-env": { + "version": "3.9.0", + "license": "MIT" + }, + "node_modules/string_decoder": { + "version": "1.1.1", + "license": "MIT", + "dependencies": { + "safe-buffer": "~5.1.0" + } + }, + "node_modules/string_decoder/node_modules/safe-buffer": { + "version": "5.1.2", + "license": "MIT" + }, + "node_modules/string-argv": { + "version": "0.3.2", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=0.6.19" + } + }, + "node_modules/string-width": { + "version": "5.1.2", + "license": "MIT", + "dependencies": { + "eastasianwidth": "^0.2.0", + "emoji-regex": "^9.2.2", + "strip-ansi": "^7.0.1" + }, + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/string-width-cjs": { + "name": "string-width", + "version": "4.2.3", + "license": "MIT", + "dependencies": { + "emoji-regex": "^8.0.0", + "is-fullwidth-code-point": "^3.0.0", + "strip-ansi": "^6.0.1" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/string-width-cjs/node_modules/emoji-regex": { + "version": "8.0.0", + "license": "MIT" + }, + "node_modules/string-width-cjs/node_modules/is-fullwidth-code-point": { + "version": "3.0.0", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/string-width/node_modules/ansi-regex": { + "version": "6.0.1", + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/chalk/ansi-regex?sponsor=1" + } + }, + "node_modules/string-width/node_modules/strip-ansi": { + "version": "7.1.0", + "license": "MIT", + "dependencies": { + "ansi-regex": "^6.0.1" + }, + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/chalk/strip-ansi?sponsor=1" + } + }, + "node_modules/stringify-entities": { + "version": "4.0.4", + "license": "MIT", + "dependencies": { + "character-entities-html4": "^2.0.0", + "character-entities-legacy": "^3.0.0" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/stringify-object": { + "version": "3.3.0", + "license": "BSD-2-Clause", + "dependencies": { + "get-own-enumerable-property-symbols": "^3.0.0", + "is-obj": "^1.0.1", + "is-regexp": "^1.0.0" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/stringify-object/node_modules/is-obj": { + "version": "1.0.1", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/strip-ansi": { + "version": "6.0.1", + "license": "MIT", + "dependencies": { + "ansi-regex": "^5.0.1" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/strip-ansi-cjs": { + "name": "strip-ansi", + "version": "6.0.1", + "license": "MIT", + "dependencies": { + "ansi-regex": "^5.0.1" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/strip-bom-string": { + "version": "1.0.0", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/strip-final-newline": { + "version": "3.0.0", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/strip-json-comments": { + "version": "3.1.1", + "license": "MIT", + "engines": { + "node": ">=8" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/style-to-js": { + "version": "1.1.17", + "license": "MIT", + "dependencies": { + "style-to-object": "1.0.9" + } + }, + "node_modules/style-to-object": { + "version": "1.0.9", + "license": "MIT", + "dependencies": { + "inline-style-parser": "0.2.4" + } + }, + "node_modules/style-to-object/node_modules/inline-style-parser": { + "version": "0.2.4", + "license": "MIT" + }, + "node_modules/sucrase": { + "version": "3.35.0", + "license": "MIT", + "dependencies": { + "@jridgewell/gen-mapping": "^0.3.2", + "commander": "^4.0.0", + "glob": "^10.3.10", + "lines-and-columns": "^1.1.6", + "mz": "^2.7.0", + "pirates": "^4.0.1", + "ts-interface-checker": "^0.1.9" + }, + "bin": { + "sucrase": "bin/sucrase", + "sucrase-node": "bin/sucrase-node" + }, + "engines": { + "node": ">=16 || 14 >=14.17" + } + }, + "node_modules/sucrase/node_modules/brace-expansion": { + "version": "2.0.1", + "license": "MIT", + "dependencies": { + "balanced-match": "^1.0.0" + } + }, + "node_modules/sucrase/node_modules/commander": { + "version": "4.1.1", + "license": "MIT", + "engines": { + "node": ">= 6" + } + }, + "node_modules/sucrase/node_modules/glob": { + "version": "10.4.5", + "license": "ISC", + "dependencies": { + "foreground-child": "^3.1.0", + "jackspeak": "^3.1.2", + "minimatch": "^9.0.4", + "minipass": "^7.1.2", + "package-json-from-dist": "^1.0.0", + "path-scurry": "^1.11.1" + }, + "bin": { + "glob": "dist/esm/bin.mjs" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, + "node_modules/sucrase/node_modules/minimatch": { + "version": "9.0.5", + "license": "ISC", + "dependencies": { + "brace-expansion": "^2.0.1" + }, + "engines": { + "node": ">=16 || 14 >=14.17" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, + "node_modules/supports-color": { + "version": "8.1.1", + "license": "MIT", + "dependencies": { + "has-flag": "^4.0.0" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/chalk/supports-color?sponsor=1" + } + }, + "node_modules/supports-preserve-symlinks-flag": { + "version": "1.0.0", + "license": "MIT", + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/svg-parser": { + "version": "2.0.4", + "license": "MIT" + }, + "node_modules/svgo": { + "version": "3.3.2", + "license": "MIT", + "dependencies": { + "@trysound/sax": "0.2.0", + "commander": "^7.2.0", + "css-select": "^5.1.0", + "css-tree": "^2.3.1", + "css-what": "^6.1.0", + "csso": "^5.0.5", + "picocolors": "^1.0.0" + }, + "bin": { + "svgo": "bin/svgo" + }, + "engines": { + "node": ">=14.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/svgo" + } + }, + "node_modules/svgo/node_modules/commander": { + "version": "7.2.0", + "license": "MIT", + "engines": { + "node": ">= 10" + } + }, + "node_modules/svgo/node_modules/picocolors": { + "version": "1.0.0", + "license": "ISC" + }, + "node_modules/tailwind-scrollbar": { + "version": "3.1.0", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12.13.0" + }, + "peerDependencies": { + "tailwindcss": "3.x" + } + }, + "node_modules/tailwindcss": { + "version": "3.4.17", + "license": "MIT", + "dependencies": { + "@alloc/quick-lru": "^5.2.0", + "arg": "^5.0.2", + "chokidar": "^3.6.0", + "didyoumean": "^1.2.2", + "dlv": "^1.1.3", + "fast-glob": "^3.3.2", + "glob-parent": "^6.0.2", + "is-glob": "^4.0.3", + "jiti": "^1.21.6", + "lilconfig": "^3.1.3", + "micromatch": "^4.0.8", + "normalize-path": "^3.0.0", + "object-hash": "^3.0.0", + "picocolors": "^1.1.1", + "postcss": "^8.4.47", + "postcss-import": "^15.1.0", + "postcss-js": "^4.0.1", + "postcss-load-config": "^4.0.2", + "postcss-nested": "^6.2.0", + "postcss-selector-parser": "^6.1.2", + "resolve": "^1.22.8", + "sucrase": "^3.35.0" + }, + "bin": { + "tailwind": "lib/cli.js", + "tailwindcss": "lib/cli.js" + }, + "engines": { + "node": ">=14.0.0" + } + }, + "node_modules/tailwindcss/node_modules/chokidar": { + "version": "3.6.0", + "license": "MIT", + "dependencies": { + "anymatch": "~3.1.2", + "braces": "~3.0.2", + "glob-parent": "~5.1.2", + "is-binary-path": "~2.1.0", + "is-glob": "~4.0.1", + "normalize-path": "~3.0.0", + "readdirp": "~3.6.0" + }, + "engines": { + "node": ">= 8.10.0" + }, + "funding": { + "url": "https://paulmillr.com/funding/" + }, + "optionalDependencies": { + "fsevents": "~2.3.2" + } + }, + "node_modules/tailwindcss/node_modules/chokidar/node_modules/glob-parent": { + "version": "5.1.2", + "license": "ISC", + "dependencies": { + "is-glob": "^4.0.1" + }, + "engines": { + "node": ">= 6" + } + }, + "node_modules/tailwindcss/node_modules/fast-glob": { + "version": "3.3.2", + "license": "MIT", + "dependencies": { + "@nodelib/fs.stat": "^2.0.2", + "@nodelib/fs.walk": "^1.2.3", + "glob-parent": "^5.1.2", + "merge2": "^1.3.0", + "micromatch": "^4.0.4" + }, + "engines": { + "node": ">=8.6.0" + } + }, + "node_modules/tailwindcss/node_modules/fast-glob/node_modules/glob-parent": { + "version": "5.1.2", + "license": "ISC", + "dependencies": { + "is-glob": "^4.0.1" + }, + "engines": { + "node": ">= 6" + } + }, + "node_modules/tailwindcss/node_modules/fast-glob/node_modules/micromatch": { + "version": "4.0.5", + "license": "MIT", + "dependencies": { + "braces": "^3.0.2", + "picomatch": "^2.3.1" + }, + "engines": { + "node": ">=8.6" + } + }, + "node_modules/tailwindcss/node_modules/fill-range": { + "version": "7.1.1", + "license": "MIT", + "dependencies": { + "to-regex-range": "^5.0.1" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/tailwindcss/node_modules/glob-parent": { + "version": "6.0.2", + "license": "ISC", + "dependencies": { + "is-glob": "^4.0.3" + }, + "engines": { + "node": ">=10.13.0" + } + }, + "node_modules/tailwindcss/node_modules/micromatch": { + "version": "4.0.8", + "license": "MIT", + "dependencies": { + "braces": "^3.0.3", + "picomatch": "^2.3.1" + }, + "engines": { + "node": ">=8.6" + } + }, + "node_modules/tailwindcss/node_modules/micromatch/node_modules/braces": { + "version": "3.0.3", + "license": "MIT", + "dependencies": { + "fill-range": "^7.1.1" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/tailwindcss/node_modules/postcss-selector-parser": { + "version": "6.1.2", + "license": "MIT", + "dependencies": { + "cssesc": "^3.0.0", + "util-deprecate": "^1.0.2" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/tapable": { + "version": "2.2.1", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/terser": { + "version": "5.43.1", + "license": "BSD-2-Clause", + "dependencies": { + "@jridgewell/source-map": "^0.3.3", + "acorn": "^8.14.0", + "commander": "^2.20.0", + "source-map-support": "~0.5.20" + }, + "bin": { + "terser": "bin/terser" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/terser-webpack-plugin": { + "version": "5.3.14", + "license": "MIT", + "dependencies": { + "@jridgewell/trace-mapping": "^0.3.25", + "jest-worker": "^27.4.5", + "schema-utils": "^4.3.0", + "serialize-javascript": "^6.0.2", + "terser": "^5.31.1" + }, + "engines": { + "node": ">= 10.13.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + }, + "peerDependencies": { + "webpack": "^5.1.0" + }, + "peerDependenciesMeta": { + "@swc/core": { + "optional": true + }, + "esbuild": { + "optional": true + }, + "uglify-js": { + "optional": true + } + } + }, + "node_modules/terser-webpack-plugin/node_modules/schema-utils": { + "version": "4.3.2", + "license": "MIT", + "dependencies": { + "@types/json-schema": "^7.0.9", + "ajv": "^8.9.0", + "ajv-formats": "^2.1.1", + "ajv-keywords": "^5.1.0" + }, + "engines": { + "node": ">= 10.13.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + } + }, + "node_modules/terser-webpack-plugin/node_modules/serialize-javascript": { + "version": "6.0.2", + "license": "BSD-3-Clause", + "dependencies": { + "randombytes": "^2.1.0" + } + }, + "node_modules/terser/node_modules/acorn": { + "version": "8.15.0", + "license": "MIT", + "bin": { + "acorn": "bin/acorn" + }, + "engines": { + "node": ">=0.4.0" + } + }, + "node_modules/terser/node_modules/commander": { + "version": "2.20.3", + "license": "MIT" + }, + "node_modules/text-table": { + "version": "0.2.0", + "dev": true, + "license": "MIT" + }, + "node_modules/thenify": { + "version": "3.3.1", + "license": "MIT", + "dependencies": { + "any-promise": "^1.0.0" + } + }, + "node_modules/thenify-all": { + "version": "1.6.0", + "license": "MIT", + "dependencies": { + "thenify": ">= 3.1.0 < 4" + }, + "engines": { + "node": ">=0.8" + } + }, + "node_modules/thunky": { + "version": "1.1.0", + "license": "MIT" + }, + "node_modules/tiny-invariant": { + "version": "1.3.1", + "license": "MIT" + }, + "node_modules/tiny-warning": { + "version": "1.0.3", + "license": "MIT" + }, + "node_modules/tinypool": { + "version": "1.1.1", + "license": "MIT", + "engines": { + "node": "^18.0.0 || >=20.0.0" + } + }, + "node_modules/to-fast-properties": { + "version": "2.0.0", + "license": "MIT", + "engines": { + "node": ">=4" + } + }, + "node_modules/to-regex-range": { + "version": "5.0.1", + "license": "MIT", + "dependencies": { + "is-number": "^7.0.0" + }, + "engines": { + "node": ">=8.0" + } + }, + "node_modules/toidentifier": { + "version": "1.0.1", + "license": "MIT", + "engines": { + "node": ">=0.6" + } + }, + "node_modules/totalist": { + "version": "3.0.1", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/trim-lines": { + "version": "3.0.1", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/trough": { + "version": "2.1.0", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/ts-interface-checker": { + "version": "0.1.13", + "license": "Apache-2.0" + }, + "node_modules/tslib": { + "version": "2.8.1", + "license": "0BSD" + }, + "node_modules/tsutils": { + "version": "3.21.0", + "dev": true, + "license": "MIT", + "dependencies": { + "tslib": "^1.8.1" + }, + "engines": { + "node": ">= 6" + }, + "peerDependencies": { + "typescript": ">=2.8.0 || >= 3.2.0-dev || >= 3.3.0-dev || >= 3.4.0-dev || >= 3.5.0-dev || >= 3.6.0-dev || >= 3.6.0-beta || >= 3.7.0-dev || >= 3.7.0-beta" + } + }, + "node_modules/tsutils/node_modules/tslib": { + "version": "1.14.1", + "dev": true, + "license": "0BSD" + }, + "node_modules/type-check": { + "version": "0.4.0", + "dev": true, + "license": "MIT", + "dependencies": { + "prelude-ls": "^1.2.1" + }, + "engines": { + "node": ">= 0.8.0" + } + }, + "node_modules/type-fest": { + "version": "1.4.0", + "license": "(MIT OR CC0-1.0)", + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/type-is": { + "version": "1.6.18", + "license": "MIT", + "dependencies": { + "media-typer": "0.3.0", + "mime-types": "~2.1.24" + }, + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/typedarray-to-buffer": { + "version": "3.1.5", + "license": "MIT", + "dependencies": { + "is-typedarray": "^1.0.0" + } + }, + "node_modules/typescript": { + "version": "4.9.5", + "dev": true, + "license": "Apache-2.0", + "bin": { + "tsc": "bin/tsc", + "tsserver": "bin/tsserver" + }, + "engines": { + "node": ">=4.2.0" + } + }, + "node_modules/undici": { + "version": "7.12.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.12.0.tgz", + "integrity": "sha512-GrKEsc3ughskmGA9jevVlIOPMiiAHJ4OFUtaAH+NhfTUSiZ1wMPIQqQvAJUrJspFXJt3EBWgpAeoHEDVT1IBug==", + "license": "MIT", + "engines": { + "node": ">=20.18.1" + } + }, + "node_modules/unicode-canonical-property-names-ecmascript": { + "version": "2.0.0", + "license": "MIT", + "engines": { + "node": ">=4" + } + }, + "node_modules/unicode-emoji-modifier-base": { + "version": "1.0.0", + "license": "MIT", + "engines": { + "node": ">=4" + } + }, + "node_modules/unicode-match-property-ecmascript": { + "version": "2.0.0", + "license": "MIT", + "dependencies": { + "unicode-canonical-property-names-ecmascript": "^2.0.0", + "unicode-property-aliases-ecmascript": "^2.0.0" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/unicode-match-property-value-ecmascript": { + "version": "2.1.0", + "license": "MIT", + "engines": { + "node": ">=4" + } + }, + "node_modules/unicode-property-aliases-ecmascript": { + "version": "2.1.0", + "license": "MIT", + "engines": { + "node": ">=4" + } + }, + "node_modules/unified": { + "version": "11.0.5", + "license": "MIT", + "dependencies": { + "@types/unist": "^3.0.0", + "bail": "^2.0.0", + "devlop": "^1.0.0", + "extend": "^3.0.0", + "is-plain-obj": "^4.0.0", + "trough": "^2.0.0", + "vfile": "^6.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/unique-string": { + "version": "3.0.0", + "license": "MIT", + "dependencies": { + "crypto-random-string": "^4.0.0" + }, + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/unist-util-generated": { + "version": "2.0.1", + "license": "MIT", + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/unist-util-is": { + "version": "6.0.0", + "license": "MIT", + "dependencies": { + "@types/unist": "^3.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/unist-util-position": { + "version": "5.0.0", + "license": "MIT", + "dependencies": { + "@types/unist": "^3.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/unist-util-position-from-estree": { + "version": "2.0.0", + "license": "MIT", + "dependencies": { + "@types/unist": "^3.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/unist-util-stringify-position": { + "version": "4.0.0", + "license": "MIT", + "dependencies": { + "@types/unist": "^3.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/unist-util-visit": { + "version": "5.0.0", + "license": "MIT", + "dependencies": { + "@types/unist": "^3.0.0", + "unist-util-is": "^6.0.0", + "unist-util-visit-parents": "^6.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/unist-util-visit-parents": { + "version": "6.0.1", + "license": "MIT", + "dependencies": { + "@types/unist": "^3.0.0", + "unist-util-is": "^6.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/universalify": { + "version": "2.0.0", + "license": "MIT", + "engines": { + "node": ">= 10.0.0" + } + }, + "node_modules/unpipe": { + "version": "1.0.0", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/update-browserslist-db": { + "version": "1.1.3", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/browserslist" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/browserslist" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "escalade": "^3.2.0", + "picocolors": "^1.1.1" + }, + "bin": { + "update-browserslist-db": "cli.js" + }, + "peerDependencies": { + "browserslist": ">= 4.21.0" + } + }, + "node_modules/update-browserslist-db/node_modules/escalade": { + "version": "3.2.0", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/update-notifier": { + "version": "6.0.2", + "license": "BSD-2-Clause", + "dependencies": { + "boxen": "^7.0.0", + "chalk": "^5.0.1", + "configstore": "^6.0.0", + "has-yarn": "^3.0.0", + "import-lazy": "^4.0.0", + "is-ci": "^3.0.1", + "is-installed-globally": "^0.4.0", + "is-npm": "^6.0.0", + "is-yarn-global": "^0.4.0", + "latest-version": "^7.0.0", + "pupa": "^3.1.0", + "semver": "^7.3.7", + "semver-diff": "^4.0.0", + "xdg-basedir": "^5.1.0" + }, + "engines": { + "node": ">=14.16" + }, + "funding": { + "url": "https://github.com/yeoman/update-notifier?sponsor=1" + } + }, + "node_modules/update-notifier/node_modules/boxen": { + "version": "7.1.1", + "license": "MIT", + "dependencies": { + "ansi-align": "^3.0.1", + "camelcase": "^7.0.1", + "chalk": "^5.2.0", + "cli-boxes": "^3.0.0", + "string-width": "^5.1.2", + "type-fest": "^2.13.0", + "widest-line": "^4.0.1", + "wrap-ansi": "^8.1.0" + }, + "engines": { + "node": ">=14.16" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/update-notifier/node_modules/camelcase": { + "version": "7.0.1", + "license": "MIT", + "engines": { + "node": ">=14.16" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/update-notifier/node_modules/chalk": { + "version": "5.4.1", + "license": "MIT", + "engines": { + "node": "^12.17.0 || ^14.13 || >=16.0.0" + }, + "funding": { + "url": "https://github.com/chalk/chalk?sponsor=1" + } + }, + "node_modules/update-notifier/node_modules/lru-cache": { + "version": "6.0.0", + "license": "ISC", + "dependencies": { + "yallist": "^4.0.0" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/update-notifier/node_modules/semver": { + "version": "7.5.4", + "license": "ISC", + "dependencies": { + "lru-cache": "^6.0.0" + }, + "bin": { + "semver": "bin/semver.js" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/update-notifier/node_modules/type-fest": { + "version": "2.19.0", + "license": "(MIT OR CC0-1.0)", + "engines": { + "node": ">=12.20" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/update-notifier/node_modules/yallist": { + "version": "4.0.0", + "license": "ISC" + }, + "node_modules/uri-js": { + "version": "4.4.1", + "license": "BSD-2-Clause", + "dependencies": { + "punycode": "^2.1.0" + } + }, + "node_modules/url-loader": { + "version": "4.1.1", + "license": "MIT", + "dependencies": { + "loader-utils": "^2.0.0", + "mime-types": "^2.1.27", + "schema-utils": "^3.0.0" + }, + "engines": { + "node": ">= 10.13.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + }, + "peerDependencies": { + "file-loader": "*", + "webpack": "^4.0.0 || ^5.0.0" + }, + "peerDependenciesMeta": { + "file-loader": { + "optional": true + } + } + }, + "node_modules/url-loader/node_modules/ajv": { + "version": "6.12.6", + "license": "MIT", + "dependencies": { + "fast-deep-equal": "^3.1.1", + "fast-json-stable-stringify": "^2.0.0", + "json-schema-traverse": "^0.4.1", + "uri-js": "^4.2.2" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/epoberezkin" + } + }, + "node_modules/url-loader/node_modules/ajv-keywords": { + "version": "3.5.2", + "license": "MIT", + "peerDependencies": { + "ajv": "^6.9.1" + } + }, + "node_modules/url-loader/node_modules/schema-utils": { + "version": "3.3.0", + "license": "MIT", + "dependencies": { + "@types/json-schema": "^7.0.8", + "ajv": "^6.12.5", + "ajv-keywords": "^3.5.2" + }, + "engines": { + "node": ">= 10.13.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + } + }, + "node_modules/use-editable": { + "version": "2.3.3", + "license": "MIT", + "peerDependencies": { + "react": ">= 16.8.0" + } + }, + "node_modules/util-deprecate": { + "version": "1.0.2", + "license": "MIT" + }, + "node_modules/utila": { + "version": "0.4.0", + "license": "MIT" + }, + "node_modules/utility-types": { + "version": "3.10.0", + "license": "MIT", + "engines": { + "node": ">= 4" + } + }, + "node_modules/utils-merge": { + "version": "1.0.1", + "license": "MIT", + "engines": { + "node": ">= 0.4.0" + } + }, + "node_modules/uuid": { + "version": "8.3.2", + "license": "MIT", + "bin": { + "uuid": "dist/bin/uuid" + } + }, + "node_modules/uvu": { + "version": "0.5.6", + "license": "MIT", + "dependencies": { + "dequal": "^2.0.0", + "diff": "^5.0.0", + "kleur": "^4.0.3", + "sade": "^1.7.3" + }, + "bin": { + "uvu": "bin.js" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/uvu/node_modules/kleur": { + "version": "4.1.5", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/value-equal": { + "version": "1.0.1", + "license": "MIT" + }, + "node_modules/vary": { + "version": "1.1.2", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/vfile": { + "version": "6.0.3", + "license": "MIT", + "dependencies": { + "@types/unist": "^3.0.0", + "vfile-message": "^4.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/vfile-location": { + "version": "5.0.3", + "license": "MIT", + "dependencies": { + "@types/unist": "^3.0.0", + "vfile": "^6.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/vfile-message": { + "version": "4.0.2", + "license": "MIT", + "dependencies": { + "@types/unist": "^3.0.0", + "unist-util-stringify-position": "^4.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/unified" + } + }, + "node_modules/watchpack": { + "version": "2.4.4", + "license": "MIT", + "dependencies": { + "glob-to-regexp": "^0.4.1", + "graceful-fs": "^4.1.2" + }, + "engines": { + "node": ">=10.13.0" + } + }, + "node_modules/wbuf": { + "version": "1.7.3", + "license": "MIT", + "dependencies": { + "minimalistic-assert": "^1.0.0" + } + }, + "node_modules/web-namespaces": { + "version": "2.0.1", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + }, + "node_modules/webpack": { + "version": "5.100.0", + "license": "MIT", + "dependencies": { + "@types/eslint-scope": "^3.7.7", + "@types/estree": "^1.0.8", + "@types/json-schema": "^7.0.15", + "@webassemblyjs/ast": "^1.14.1", + "@webassemblyjs/wasm-edit": "^1.14.1", + "@webassemblyjs/wasm-parser": "^1.14.1", + "acorn": "^8.15.0", + "acorn-import-phases": "^1.0.3", + "browserslist": "^4.24.0", + "chrome-trace-event": "^1.0.2", + "enhanced-resolve": "^5.17.2", + "es-module-lexer": "^1.2.1", + "eslint-scope": "5.1.1", + "events": "^3.2.0", + "glob-to-regexp": "^0.4.1", + "graceful-fs": "^4.2.11", + "json-parse-even-better-errors": "^2.3.1", + "loader-runner": "^4.2.0", + "mime-types": "^2.1.27", + "neo-async": "^2.6.2", + "schema-utils": "^4.3.2", + "tapable": "^2.1.1", + "terser-webpack-plugin": "^5.3.11", + "watchpack": "^2.4.1", + "webpack-sources": "^3.3.3" + }, + "bin": { + "webpack": "bin/webpack.js" + }, + "engines": { + "node": ">=10.13.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + }, + "peerDependenciesMeta": { + "webpack-cli": { + "optional": true + } + } + }, + "node_modules/webpack-bundle-analyzer": { + "version": "4.10.2", + "license": "MIT", + "dependencies": { + "@discoveryjs/json-ext": "0.5.7", + "acorn": "^8.0.4", + "acorn-walk": "^8.0.0", + "commander": "^7.2.0", + "debounce": "^1.2.1", + "escape-string-regexp": "^4.0.0", + "gzip-size": "^6.0.0", + "html-escaper": "^2.0.2", + "opener": "^1.5.2", + "picocolors": "^1.0.0", + "sirv": "^2.0.3", + "ws": "^7.3.1" + }, + "bin": { + "webpack-bundle-analyzer": "lib/bin/analyzer.js" + }, + "engines": { + "node": ">= 10.13.0" + } + }, + "node_modules/webpack-bundle-analyzer/node_modules/acorn": { + "version": "8.10.0", + "license": "MIT", + "bin": { + "acorn": "bin/acorn" + }, + "engines": { + "node": ">=0.4.0" + } + }, + "node_modules/webpack-bundle-analyzer/node_modules/commander": { + "version": "7.2.0", + "license": "MIT", + "engines": { + "node": ">= 10" + } + }, + "node_modules/webpack-bundle-analyzer/node_modules/picocolors": { + "version": "1.0.0", + "license": "ISC" + }, + "node_modules/webpack-dev-middleware": { + "version": "5.3.4", + "license": "MIT", + "dependencies": { + "colorette": "^2.0.10", + "memfs": "^3.4.3", + "mime-types": "^2.1.31", + "range-parser": "^1.2.1", + "schema-utils": "^4.0.0" + }, + "engines": { + "node": ">= 12.13.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + }, + "peerDependencies": { + "webpack": "^4.0.0 || ^5.0.0" + } + }, + "node_modules/webpack-dev-server": { + "version": "4.15.2", + "license": "MIT", + "dependencies": { + "@types/bonjour": "^3.5.9", + "@types/connect-history-api-fallback": "^1.3.5", + "@types/express": "^4.17.13", + "@types/serve-index": "^1.9.1", + "@types/serve-static": "^1.13.10", + "@types/sockjs": "^0.3.33", + "@types/ws": "^8.5.5", + "ansi-html-community": "^0.0.8", + "bonjour-service": "^1.0.11", + "chokidar": "^3.5.3", + "colorette": "^2.0.10", + "compression": "^1.7.4", + "connect-history-api-fallback": "^2.0.0", + "default-gateway": "^6.0.3", + "express": "^4.17.3", + "graceful-fs": "^4.2.6", + "html-entities": "^2.3.2", + "http-proxy-middleware": "^2.0.3", + "ipaddr.js": "^2.0.1", + "launch-editor": "^2.6.0", + "open": "^8.0.9", + "p-retry": "^4.5.0", + "rimraf": "^3.0.2", + "schema-utils": "^4.0.0", + "selfsigned": "^2.1.1", + "serve-index": "^1.9.1", + "sockjs": "^0.3.24", + "spdy": "^4.0.2", + "webpack-dev-middleware": "^5.3.4", + "ws": "^8.13.0" + }, + "bin": { + "webpack-dev-server": "bin/webpack-dev-server.js" + }, + "engines": { + "node": ">= 12.13.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + }, + "peerDependencies": { + "webpack": "^4.37.0 || ^5.0.0" + }, + "peerDependenciesMeta": { + "webpack": { + "optional": true + }, + "webpack-cli": { + "optional": true + } + } + }, + "node_modules/webpack-dev-server/node_modules/ipaddr.js": { + "version": "2.1.0", + "license": "MIT", + "engines": { + "node": ">= 10" + } + }, + "node_modules/webpack-dev-server/node_modules/ws": { + "version": "8.14.2", + "license": "MIT", + "engines": { + "node": ">=10.0.0" + }, + "peerDependencies": { + "bufferutil": "^4.0.1", + "utf-8-validate": ">=5.0.2" + }, + "peerDependenciesMeta": { + "bufferutil": { + "optional": true + }, + "utf-8-validate": { + "optional": true + } + } + }, + "node_modules/webpack-merge": { + "version": "5.10.0", + "license": "MIT", + "dependencies": { + "clone-deep": "^4.0.1", + "flat": "^5.0.2", + "wildcard": "^2.0.0" + }, + "engines": { + "node": ">=10.0.0" + } + }, + "node_modules/webpack-sources": { + "version": "3.3.3", + "license": "MIT", + "engines": { + "node": ">=10.13.0" + } + }, + "node_modules/webpack/node_modules/@types/estree": { + "version": "1.0.8", + "license": "MIT" + }, + "node_modules/webpack/node_modules/@types/json-schema": { + "version": "7.0.15", + "license": "MIT" + }, + "node_modules/webpack/node_modules/acorn": { + "version": "8.15.0", + "license": "MIT", + "bin": { + "acorn": "bin/acorn" + }, + "engines": { + "node": ">=0.4.0" + } + }, + "node_modules/webpack/node_modules/acorn-import-phases": { + "version": "1.0.3", + "license": "MIT", + "engines": { + "node": ">=10.13.0" + }, + "peerDependencies": { + "acorn": "^8.14.0" + } + }, + "node_modules/webpack/node_modules/schema-utils": { + "version": "4.3.2", + "license": "MIT", + "dependencies": { + "@types/json-schema": "^7.0.9", + "ajv": "^8.9.0", + "ajv-formats": "^2.1.1", + "ajv-keywords": "^5.1.0" + }, + "engines": { + "node": ">= 10.13.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + } + }, + "node_modules/webpack/node_modules/schema-utils/node_modules/@types/json-schema": { + "version": "7.0.13", + "license": "MIT" + }, + "node_modules/webpackbar": { + "version": "6.0.1", + "license": "MIT", + "dependencies": { + "ansi-escapes": "^4.3.2", + "chalk": "^4.1.2", + "consola": "^3.2.3", + "figures": "^3.2.0", + "markdown-table": "^2.0.0", + "pretty-time": "^1.1.0", + "std-env": "^3.7.0", + "wrap-ansi": "^7.0.0" + }, + "engines": { + "node": ">=14.21.3" + }, + "peerDependencies": { + "webpack": "3 || 4 || 5" + } + }, + "node_modules/webpackbar/node_modules/ansi-escapes": { + "version": "4.3.2", + "license": "MIT", + "dependencies": { + "type-fest": "^0.21.3" + }, + "engines": { + "node": ">=8" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/webpackbar/node_modules/emoji-regex": { + "version": "8.0.0", + "license": "MIT" + }, + "node_modules/webpackbar/node_modules/is-fullwidth-code-point": { + "version": "3.0.0", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/webpackbar/node_modules/string-width": { + "version": "4.2.3", + "license": "MIT", + "dependencies": { + "emoji-regex": "^8.0.0", + "is-fullwidth-code-point": "^3.0.0", + "strip-ansi": "^6.0.1" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/webpackbar/node_modules/type-fest": { + "version": "0.21.3", + "license": "(MIT OR CC0-1.0)", + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/webpackbar/node_modules/wrap-ansi": { + "version": "7.0.0", + "license": "MIT", + "dependencies": { + "ansi-styles": "^4.0.0", + "string-width": "^4.1.0", + "strip-ansi": "^6.0.0" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/chalk/wrap-ansi?sponsor=1" + } + }, + "node_modules/websocket-driver": { + "version": "0.7.4", + "license": "Apache-2.0", + "dependencies": { + "http-parser-js": ">=0.5.1", + "safe-buffer": ">=5.1.0", + "websocket-extensions": ">=0.1.1" + }, + "engines": { + "node": ">=0.8.0" + } + }, + "node_modules/websocket-extensions": { + "version": "0.1.4", + "license": "Apache-2.0", + "engines": { + "node": ">=0.8.0" + } + }, + "node_modules/whatwg-encoding": { + "version": "3.1.1", + "resolved": "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-3.1.1.tgz", + "integrity": "sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==", + "license": "MIT", + "dependencies": { + "iconv-lite": "0.6.3" + }, + "engines": { + "node": ">=18" + } + }, + "node_modules/whatwg-encoding/node_modules/iconv-lite": { + "version": "0.6.3", + "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz", + "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==", + "license": "MIT", + "dependencies": { + "safer-buffer": ">= 2.1.2 < 3.0.0" + }, + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/whatwg-mimetype": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-4.0.0.tgz", + "integrity": "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==", + "license": "MIT", + "engines": { + "node": ">=18" + } + }, + "node_modules/which": { + "version": "2.0.2", + "license": "ISC", + "dependencies": { + "isexe": "^2.0.0" + }, + "bin": { + "node-which": "bin/node-which" + }, + "engines": { + "node": ">= 8" + } + }, + "node_modules/widest-line": { + "version": "4.0.1", + "license": "MIT", + "dependencies": { + "string-width": "^5.0.1" + }, + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/wildcard": { + "version": "2.0.1", + "license": "MIT" + }, + "node_modules/wrap-ansi": { + "version": "8.1.0", + "license": "MIT", + "dependencies": { + "ansi-styles": "^6.1.0", + "string-width": "^5.0.1", + "strip-ansi": "^7.0.1" + }, + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/chalk/wrap-ansi?sponsor=1" + } + }, + "node_modules/wrap-ansi-cjs": { + "name": "wrap-ansi", + "version": "7.0.0", + "license": "MIT", + "dependencies": { + "ansi-styles": "^4.0.0", + "string-width": "^4.1.0", + "strip-ansi": "^6.0.0" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/chalk/wrap-ansi?sponsor=1" + } + }, + "node_modules/wrap-ansi-cjs/node_modules/emoji-regex": { + "version": "8.0.0", + "license": "MIT" + }, + "node_modules/wrap-ansi-cjs/node_modules/is-fullwidth-code-point": { + "version": "3.0.0", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/wrap-ansi-cjs/node_modules/string-width": { + "version": "4.2.3", + "license": "MIT", + "dependencies": { + "emoji-regex": "^8.0.0", + "is-fullwidth-code-point": "^3.0.0", + "strip-ansi": "^6.0.1" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/wrap-ansi/node_modules/ansi-regex": { + "version": "6.0.1", + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/chalk/ansi-regex?sponsor=1" + } + }, + "node_modules/wrap-ansi/node_modules/ansi-styles": { + "version": "6.2.1", + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/chalk/ansi-styles?sponsor=1" + } + }, + "node_modules/wrap-ansi/node_modules/strip-ansi": { + "version": "7.1.0", + "license": "MIT", + "dependencies": { + "ansi-regex": "^6.0.1" + }, + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/chalk/strip-ansi?sponsor=1" + } + }, + "node_modules/wrappy": { + "version": "1.0.2", + "license": "ISC" + }, + "node_modules/write-file-atomic": { + "version": "3.0.3", + "license": "ISC", + "dependencies": { + "imurmurhash": "^0.1.4", + "is-typedarray": "^1.0.0", + "signal-exit": "^3.0.2", + "typedarray-to-buffer": "^3.1.5" + } + }, + "node_modules/ws": { + "version": "7.5.9", + "license": "MIT", + "engines": { + "node": ">=8.3.0" + }, + "peerDependencies": { + "bufferutil": "^4.0.1", + "utf-8-validate": "^5.0.2" + }, + "peerDependenciesMeta": { + "bufferutil": { + "optional": true + }, + "utf-8-validate": { + "optional": true + } + } + }, + "node_modules/xdg-basedir": { + "version": "5.1.0", + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/xml-js": { + "version": "1.6.11", + "license": "MIT", + "dependencies": { + "sax": "^1.2.4" + }, + "bin": { + "xml-js": "bin/cli.js" + } + }, + "node_modules/yallist": { + "version": "3.1.1", + "license": "ISC" + }, + "node_modules/yaml": { + "version": "2.3.1", + "dev": true, + "license": "ISC", + "engines": { + "node": ">= 14" + } + }, + "node_modules/yocto-queue": { + "version": "0.1.0", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/zwitch": { + "version": "2.0.4", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/wooorm" + } + } + } +} diff --git a/package.json b/package.json index 5a267a1d9..dab66e843 100644 --- a/package.json +++ b/package.json @@ -14,29 +14,42 @@ "write-heading-ids": "docusaurus write-heading-ids", "typecheck": "tsc", "prepare": "husky install", - "lint": "eslint ./src --fix" + "lint": "eslint ./src --fix", + "docs:sync": "node scripts/sync-podman-docs.js", + "docs:sync-version": "node scripts/sync-podman-docs.js", + "docs:validate": "node scripts/sync-podman-docs.js validate", + "docs:fix": "node scripts/sync-podman-docs.js fix", + "docs:add": "node scripts/sync-podman-docs.js add", + "docs:fix-images": "node scripts/sync-podman-docs.js fix-images", + "docs:fix-yaml": "node scripts/sync-podman-docs.js fix-yaml", + "docs:fix-directives": "node scripts/fix-markdown-directives.js", + "docs:cleanup": "node scripts/sync-podman-docs.js cleanup", + "docs:sync-versions": "node scripts/sync-podman-docs.js sync-versions", + "docs:sidebars": "node scripts/sync-podman-docs.js sidebars", + "docs:full-sync": "npm run docs:sync && npm run docs:sync-versions", + "docs:update-version-selector": "node scripts/sync-podman-docs.js update-version-selector" }, "dependencies": { - "@docusaurus/core": "^2.4.1", - "@docusaurus/plugin-content-blog": "^2.4.1", - "@docusaurus/preset-classic": "^2.4.1", - "@docusaurus/theme-live-codeblock": "^2.4.1", + "@docusaurus/core": "latest", + "@docusaurus/plugin-content-blog": "latest", + "@docusaurus/preset-classic": "latest", + "@docusaurus/theme-live-codeblock": "latest", + "@easyops-cn/docusaurus-search-local": "^0.52.0", "@iconify/react": "^4.0.1", - "@mdx-js/react": "^1.6.22", "autoprefixer": "^10.4.13", "clsx": "^1.2.1", "html-react-parser": "^3.0.16", "papaparse": "^5.4.1", "postcss": "^8.4.21", "prism-react-renderer": "^1.3.5", - "react": "^17.0.2", - "react-dom": "^17.0.2", + "react": "^18.0.0", + "react-dom": "^18.0.0", "react-markdown": "^8.0.5", "tailwindcss": "^3.2.4" }, "devDependencies": { - "@docusaurus/eslint-plugin": "^2.4.1", - "@docusaurus/module-type-aliases": "^2.4.1", + "@docusaurus/eslint-plugin": "latest", + "@docusaurus/module-type-aliases": "latest", "@tsconfig/docusaurus": "^1.0.5", "@typescript-eslint/eslint-plugin": "^5.48.2", "@typescript-eslint/parser": "^5.48.2", diff --git a/podman-versions.json b/podman-versions.json new file mode 100644 index 000000000..2dce8e213 --- /dev/null +++ b/podman-versions.json @@ -0,0 +1,60 @@ +{ + "versions": [ + { + "version": "v5.5.2", + "label": "5.5.2 (Latest)", + "path": "current", + "isLatest": true, + "releaseDate": "2024-12-20", + "githubTag": "v5.5.2", + "deprecated": false + }, + { + "version": "v5.5.1", + "label": "5.5.1", + "path": "v5.5.1", + "isLatest": false, + "releaseDate": "2024-11-15", + "githubTag": "v5.5.1", + "deprecated": false + }, + { + "version": "v5.5.0", + "label": "5.5.0", + "path": "v5.5.0", + "isLatest": false, + "releaseDate": "2024-10-20", + "githubTag": "v5.5.0", + "deprecated": false + }, + { + "version": "v5.4.2", + "label": "5.4.2", + "path": "v5.4.2", + "isLatest": false, + "releaseDate": "2024-09-15", + "githubTag": "v5.4.2", + "deprecated": false + }, + { + "version": "v5.4.1", + "label": "5.4.1", + "path": "v5.4.1", + "isLatest": false, + "releaseDate": "2024-08-20", + "githubTag": "v5.4.1", + "deprecated": false + } + ], + "lastUpdated": "2025-01-08T10:00:00Z", + "defaultVersion": "current", + "supportedVersions": ["current", "v5.5.1", "v5.5.0", "v5.4.2", "v5.4.1"], + "deprecatedVersions": [], + "config": { + "maxVersions": 5, + "autoSync": true, + "syncInterval": "weekly", + "sourceRepository": "containers/podman", + "documentationPath": "docs" + } +} \ No newline at end of file diff --git a/scripts/fix-markdown-directives.js b/scripts/fix-markdown-directives.js new file mode 100644 index 000000000..cb3480ac6 --- /dev/null +++ b/scripts/fix-markdown-directives.js @@ -0,0 +1,400 @@ +#!/usr/bin/env node + +/** + * Fix Markdown Directive Issues + * + * This script finds and fixes problematic colon patterns in markdown files + * that could be misinterpreted as MyST directives by Docusaurus + */ + +const fs = require('fs'); +const path = require('path'); + +const VERSIONED_DOCS_DIR = path.join(__dirname, '..', 'versioned_docs'); + +// Patterns that need to be escaped to prevent directive interpretation +const PROBLEMATIC_PATTERNS = [ + // Fix :target directive warnings using HTML entities (clean approach) + { + pattern: /(\*[^*]*):target(\[?[^*]*\*)/g, + replacement: '$1:target$2', + description: 'Prevent :target directive by using HTML entity for colon' + }, + // Specific fix for podman-machine-init volume header + { + pattern: /(\*\*--volume\*\*, \*\*-v\*\*=)\*source:target\[:options\]\*/g, + replacement: '$1*source:target[:options]*', + description: 'Fix podman-machine-init volume header using HTML entities' + }, + // Specific fix for inline source:target reference + { + pattern: /(If \/host-dir:\/machine-dir is specified as the `)\*source:target(\*`,)/g, + replacement: '$1*source:target$2', + description: 'Fix inline source:target reference using HTML entity' + }, + // Cleanup any remaining double-escaped options + { + pattern: /\[\\:options\]/g, + replacement: '[:options]', + description: 'Clean up double-escaped options using HTML entity' + }, + // Uppercase parameter names in command syntax (like :CONTAINER-DIR, :OPTIONS) + { + pattern: /([:\[,\s\-]):([A-Z][A-Z0-9_-]*[A-Z0-9])/g, + replacement: '$1\\:$2', + description: 'Uppercase parameter names with colons' + }, + // Parameter names after other parameters (like HOST-DIR:CONTAINER-DIR) + { + pattern: /([A-Z0-9_-]+):([A-Z][A-Z0-9_-]*[A-Z0-9])/g, + replacement: '$1\\:$2', + description: 'Parameter names after other parameters' + }, + // Command syntax patterns in headers/options + { + pattern: /(\*\*--[a-zA-Z-]+\*\*=\*[^*]*container_uid):from_uid([^*]*\*)/g, + replacement: '$1\\:from_uid$2', + description: 'container_uid:from_uid in command syntax' + }, + { + pattern: /(\*\*--[a-zA-Z-]+\*\*=\*[^*]*):([a-zA-Z_]+[^*]*\*)/g, + replacement: '$1\\:$2', + description: 'Generic command syntax with colons' + }, + // Specific pattern for source:target in volume commands + { + pattern: /(\*[^*]*\w):([a-zA-Z][a-zA-Z0-9_]*(?:\[[^\]]*\])?[^*]*\*)/g, + replacement: '$1\\:$2', + description: 'Source:target patterns in volume commands' + }, + { + pattern: /(\*[^*]*):([a-zA-Z_][a-zA-Z0-9_]*[^*]*\*)/g, + replacement: '$1\\:$2', + description: 'Italicized text with colons' + }, + // Security label patterns + { + pattern: /(\s)label:([a-zA-Z_]+)/g, + replacement: '$1label\\:$2', + description: 'SELinux label patterns' + }, + // Compression format patterns + { + pattern: /zstd:chunked/g, + replacement: 'zstd\\:chunked', + description: 'Compression format with colon' + }, + // Network/port patterns that could be problematic + { + pattern: /(\s)([a-zA-Z]+):([0-9]+)/g, + replacement: '$1$2\\:$3', + description: 'Host:port patterns' + }, + // Fix broken relative links to root-level files with GitHub URLs + { + pattern: /\]\(\.\.\/\.\.\/README\.md(#[^)]*)?/g, + replacement: '](https://github.com/containers/podman/blob/main/README.md$1', + description: 'Replace broken relative links to README.md with GitHub URL' + }, + { + pattern: /\]\(\.\.\/\.\.\/troubleshooting\.md(#[^)]*)?/g, + replacement: '](https://github.com/containers/podman/blob/main/troubleshooting.md$1', + description: 'Replace broken relative links to troubleshooting.md with GitHub URL' + }, + { + pattern: /\]\(\.\.\/\.\.\/test\/README\.md(#[^)]*)?/g, + replacement: '](https://github.com/containers/podman/blob/main/test/README.md$1', + description: 'Replace broken relative links to test/README.md with GitHub URL' + } +]; + +// Patterns that are likely safe and shouldn't be escaped +const SAFE_PATTERNS = [ + /https?:\/\//, // URLs + /fd[0-9a-f]*::[0-9a-f]/, // IPv6 addresses + /inet6?\s+[^:]+::/, // IPv6 in network output + /\d+:\d+/, // Time or ratio patterns + /[A-Z]+::/ // Image registry patterns like RHEL:: +]; + +function isSafePattern(text) { + return SAFE_PATTERNS.some(pattern => pattern.test(text)); +} + +function fixMarkdownDirectives(content, filePath) { + let modifiedContent = content; + const changes = []; + + for (const { pattern, replacement, description } of PROBLEMATIC_PATTERNS) { + const matches = [...content.matchAll(pattern)]; + + for (const match of matches) { + // Check if this match should be skipped (safe pattern) + if (isSafePattern(match[0])) { + continue; + } + + const before = modifiedContent; + modifiedContent = modifiedContent.replace(pattern, replacement); + + if (before !== modifiedContent) { + changes.push({ + description, + match: match[0], + file: path.relative(VERSIONED_DOCS_DIR, filePath) + }); + } + } + } + + return { content: modifiedContent, changes }; +} + +function processMarkdownFiles(directory) { + const allChanges = []; + let filesProcessed = 0; + let filesModified = 0; + + function processDirectory(dir) { + const entries = fs.readdirSync(dir, { withFileTypes: true }); + + for (const entry of entries) { + const fullPath = path.join(dir, entry.name); + + if (entry.isDirectory()) { + processDirectory(fullPath); + } else if (entry.isFile() && (entry.name.endsWith('.md') || entry.name.endsWith('.md.in'))) { + filesProcessed++; + + try { + const content = fs.readFileSync(fullPath, 'utf8'); + const { content: fixedContent, changes } = fixMarkdownDirectives(content, fullPath); + + if (changes.length > 0) { + fs.writeFileSync(fullPath, fixedContent); + filesModified++; + allChanges.push(...changes); + + console.log(`✅ Fixed ${changes.length} issues in ${path.relative(VERSIONED_DOCS_DIR, fullPath)}`); + changes.forEach(change => { + console.log(` - ${change.description}: ${change.match}`); + }); + } + } catch (error) { + console.error(`❌ Error processing ${fullPath}:`, error.message); + } + } + } + } + + console.log('🔧 Fixing markdown directive issues...\n'); + processDirectory(directory); + + console.log('\n📊 Summary:'); + console.log(` Files processed: ${filesProcessed}`); + console.log(` Files modified: ${filesModified}`); + console.log(` Total fixes applied: ${allChanges.length}`); + + if (allChanges.length > 0) { + console.log('\n🔍 Changes by type:'); + const changesByType = {}; + allChanges.forEach(change => { + changesByType[change.description] = (changesByType[change.description] || 0) + 1; + }); + + Object.entries(changesByType).forEach(([type, count]) => { + console.log(` - ${type}: ${count} fixes`); + }); + } + + return allChanges.length; +} + +// Clean up over-escaped content +function cleanupOverEscapedContent(baseDir) { + let filesFixed = 0; + + // Patterns where colons should NOT be escaped and need to be fixed + const OVER_ESCAPED_PATTERNS = [ + // Documentation/man page references + { + pattern: /man\\+:([a-zA-Z0-9-_.()]+)/g, + replacement: 'man:$1', + description: 'Man page references' + }, + // Emphasis text with colons (like **_NOTE\:_**) + { + pattern: /(\*\*_[A-Z]+)\\+:(_\*\*)/g, + replacement: '$1:$2', + description: 'Emphasized text with colons' + }, + // Host:port patterns (localhost\:5000, hostname\:port) + { + pattern: /([a-zA-Z0-9.-]+)\\+:([0-9]+)/g, + replacement: '$1:$2', + description: 'Host:port patterns' + }, + // Image registry patterns (registry.io\:5000/image) + { + pattern: /([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})\\+:([0-9]+\/[a-zA-Z0-9/_-]+)/g, + replacement: '$1:$2', + description: 'Registry:port/image patterns' + }, + // Docker registry URLs with image versions (docker://registry/repo/image\:version) + { + pattern: /(docker:\/\/[a-zA-Z0-9.-\/]+)\\+:([a-zA-Z0-9._-]+)/g, + replacement: '$1:$2', + description: 'Docker registry image versions' + }, + // Italicized source:target patterns (*source\:target*) + { + pattern: /(\*[a-zA-Z0-9/_${}.-]+)\\+:([a-zA-Z0-9/_${}.-]+\*)/g, + replacement: '$1:$2', + description: 'Italicized source:target patterns' + }, + // Italicized source:target with options (*source\:target[\:options]*) + { + pattern: /(\*[a-zA-Z0-9/_${}.-]+)\\+:([a-zA-Z0-9/_${}.-]+\[)\\+:([a-zA-Z0-9/_${}.-]+\]\*)/g, + replacement: '$1:$2:$3', + description: 'Italicized source:target with options' + }, + // Mount options in examples ($HOME/git\:ro) + { + pattern: /(\$[A-Z]+\/[a-zA-Z0-9/_.-]+)\\+:([a-zA-Z0-9_,=]+)/g, + replacement: '$1:$2', + description: 'Mount options in command examples' + }, + // File paths with options in backticks (`path\:options`) + { + pattern: /(`[^`]+)\\+:([^`]+`)/g, + replacement: '$1:$2', + description: 'File paths with options in code blocks' + }, + // Compression format patterns (zstd\:chunked) + { + pattern: /(zstd|gzip|lz4)\\+:(chunked|fast|best)/g, + replacement: '$1:$2', + description: 'Compression format patterns' + }, + // SHA256 hash patterns + { + pattern: /(SHA256)\\+:([A-Za-z0-9+/=]+)/g, + replacement: '$1:$2', + description: 'SHA256 hash patterns' + }, + // IPv6 address patterns (protect against over-escaping) + { + pattern: /([0-9a-fA-F]+)\\+::([0-9a-fA-F:]+)/g, + replacement: '$1::$2', + description: 'IPv6 address patterns' + }, + // File path patterns in systemd unit examples + { + pattern: /(Documentation=man)\\+:([a-zA-Z0-9-_.()]+)/g, + replacement: '$1:$2', + description: 'Systemd documentation references' + }, + // Time patterns (HH\:MM\:SS) + { + pattern: /([0-9]{1,2})\\+:([0-9]{2})\\+:([0-9]{2})/g, + replacement: '$1:$2:$3', + description: 'Time patterns' + }, + // URLs (http:, https:, ftp:, etc.) - should never be escaped + { + pattern: /(https?|ftp|ssh|sftp|file)\\+:/g, + replacement: '$1:', + description: 'URL protocols' + }, + // Docker/container registry patterns + { + pattern: /(docker|podman|registry)\\+:\/\//g, + replacement: '$1://', + description: 'Container registry URLs' + } + ]; + + function processDirectoryForCleanup(dir) { + const entries = fs.readdirSync(dir, { withFileTypes: true }); + + for (const entry of entries) { + const fullPath = path.join(dir, entry.name); + + if (entry.isDirectory()) { + processDirectoryForCleanup(fullPath); + } else if (entry.isFile() && (entry.name.endsWith('.md') || entry.name.endsWith('.md.in'))) { + try { + let content = fs.readFileSync(fullPath, 'utf8'); + const originalContent = content; + let changesApplied = 0; + + // Apply specific over-escaped pattern fixes + for (const { pattern, replacement, description } of OVER_ESCAPED_PATTERNS) { + const before = content; + content = content.replace(pattern, replacement); + if (before !== content) { + changesApplied++; + console.log(` 🔧 Fixed ${description} in ${path.relative(baseDir, fullPath)}`); + } + } + + // Fix over-escaped colons (reduce excessive backslashes) + // Match 4 or more backslashes before a colon and reduce to single escape + const beforeMultiple = content; + content = content.replace(/\\{4,}:/g, '\\:'); + if (beforeMultiple !== content) { + changesApplied++; + console.log(` 🔧 Fixed multiple backslashes before colons in ${path.relative(baseDir, fullPath)}`); + } + + // Fix over-escaped content in code/command examples that got too many backslashes + const beforeTriple = content; + content = content.replace(/(\w)\\{3,}:(\w)/g, '$1\\:$2'); + if (beforeTriple !== content) { + changesApplied++; + console.log(` 🔧 Fixed triple+ backslashes in ${path.relative(baseDir, fullPath)}`); + } + + if (content !== originalContent) { + fs.writeFileSync(fullPath, content); + filesFixed++; + console.log(`✅ Cleaned over-escaped content in ${path.relative(baseDir, fullPath)} (${changesApplied} fixes)`); + } + } catch (error) { + console.error(`❌ Error processing ${fullPath}:`, error.message); + } + } + } + } + + processDirectoryForCleanup(baseDir); + return filesFixed; +} + +// Main execution +if (require.main === module) { + if (!fs.existsSync(VERSIONED_DOCS_DIR)) { + console.error('❌ Versioned docs directory not found:', VERSIONED_DOCS_DIR); + process.exit(1); + } + + const totalFixes = processMarkdownFiles(VERSIONED_DOCS_DIR); + + if (totalFixes > 0) { + console.log(`\n✅ Successfully fixed ${totalFixes} markdown directive issues!`); + } else { + console.log('\n✅ No markdown directive issues found.'); + } + + // Clean up any over-escaped content as the final step + console.log('\n🔧 Cleaning up over-escaped content...'); + const cleanupFixes = cleanupOverEscapedContent(VERSIONED_DOCS_DIR); + + if (cleanupFixes > 0) { + console.log(`✅ Cleaned up over-escaped content in ${cleanupFixes} files!`); + } else { + console.log('✅ No over-escaped content found.'); + } +} + +module.exports = { fixMarkdownDirectives, processMarkdownFiles, cleanupOverEscapedContent }; \ No newline at end of file diff --git a/scripts/sync-podman-docs.js b/scripts/sync-podman-docs.js new file mode 100755 index 000000000..362c40c8c --- /dev/null +++ b/scripts/sync-podman-docs.js @@ -0,0 +1,1119 @@ +#!/usr/bin/env node + +/** + * Sync Podman Documentation Script + * + * This script fetches documentation from the containers/podman repository + * and syncs it with the local Docusaurus versioned documentation structure. + */ + +const https = require('https'); +const fs = require('fs'); +const path = require('path'); +const { execSync } = require('child_process'); + +// Configuration +const PODMAN_REPO = 'containers/podman'; +const GITHUB_API_BASE = 'https://api.github.com'; +const VERSIONED_DOCS_DIR = path.join(__dirname, '..', 'versioned_docs'); +const VERSIONED_SIDEBARS_DIR = path.join(__dirname, '..', 'versioned_sidebars'); +const VERSIONS_FILE = path.join(__dirname, '..', 'versions.json'); +const TEMP_DIR = path.join(__dirname, '..', 'temp'); + +// GitHub API helper +function makeGitHubRequest(endpoint) { + return new Promise((resolve, reject) => { + const options = { + hostname: 'api.github.com', + path: endpoint, + method: 'GET', + headers: { + 'User-Agent': 'podman-website-sync', + 'Accept': 'application/vnd.github.v3+json' + } + }; + + const req = https.request(options, (res) => { + let data = ''; + res.on('data', (chunk) => { + data += chunk; + }); + res.on('end', () => { + if (res.statusCode >= 200 && res.statusCode < 300) { + resolve(JSON.parse(data)); + } else { + reject(new Error(`GitHub API error: ${res.statusCode} ${data}`)); + } + }); + }); + + req.on('error', reject); + req.end(); + }); +} + +// Get latest releases from GitHub +async function getLatestReleases() { + console.log('Fetching latest Podman releases...'); + const releases = await makeGitHubRequest(`/repos/${PODMAN_REPO}/releases?per_page=10`); + + // Filter out pre-releases and get stable versions + const stableReleases = releases + .filter(release => !release.prerelease && !release.draft) + .slice(0, 5); // Get latest 5 stable releases + + console.log(`Found ${stableReleases.length} stable releases`); + return stableReleases; +} + +// Get tags from GitHub +async function getLatestTags() { + console.log('Fetching latest Podman tags...'); + const tags = await makeGitHubRequest(`/repos/${PODMAN_REPO}/tags?per_page=20`); + + // Filter version tags (e.g., v5.2.0, v5.1.1) + const versionTags = tags.filter(tag => + tag.name.match(/^v\d+\.\d+\.\d+$/) + ).slice(0, 5); + + console.log(`Found ${versionTags.length} version tags`); + return versionTags; +} + +// Download and extract documentation for a specific version +async function downloadDocsForVersion(version) { + console.log(`Downloading docs for version ${version}...`); + + // Remove 'v' prefix for directory name + const versionNumber = version.replace(/^v/, ''); + const outputPath = path.join(VERSIONED_DOCS_DIR, `version-${versionNumber}`); + + // Create output directory + if (!fs.existsSync(outputPath)) { + fs.mkdirSync(outputPath, { recursive: true }); + } + + // Download the archive + const archiveUrl = `https://github.com/${PODMAN_REPO}/archive/refs/tags/${version}.tar.gz`; + const tempArchive = path.join(TEMP_DIR, `${version}.tar.gz`); + + if (!fs.existsSync(TEMP_DIR)) { + fs.mkdirSync(TEMP_DIR, { recursive: true }); + } + + // Download archive using curl + try { + execSync(`curl -L -o "${tempArchive}" "${archiveUrl}"`, { stdio: 'inherit' }); + + // Extract the archive + execSync(`tar -xzf "${tempArchive}" -C "${TEMP_DIR}"`, { stdio: 'inherit' }); + + // Find the extracted directory (GitHub archives have format: reponame-version) + const extractedDirs = fs.readdirSync(TEMP_DIR, { withFileTypes: true }) + .filter(dirent => dirent.isDirectory() && dirent.name.startsWith('podman-')) + .map(dirent => dirent.name); + + if (extractedDirs.length === 0) { + throw new Error(`No extracted podman directory found in ${TEMP_DIR}`); + } + + const podmanSrcDir = path.join(TEMP_DIR, extractedDirs[0]); + console.log(` 📁 Found extracted directory: ${extractedDirs[0]}`); + + // Check if Makefile exists and try to run "make docs" + const makefilePath = path.join(podmanSrcDir, 'Makefile'); + if (fs.existsSync(makefilePath)) { + console.log(` ⚙️ Running "make docs" for ${version}...`); + try { + // Use more explicit shell execution + execSync('make docs', { + cwd: podmanSrcDir, + stdio: 'inherit', + shell: '/bin/bash', + env: { + ...process.env, + PATH: process.env.PATH || '/usr/bin:/bin:/usr/local/bin' + } + }); + console.log(` ✓ Documentation built successfully for ${version}`); + } catch (makeError) { + console.warn(` ⚠️ Warning: "make docs" failed for ${version}, proceeding with existing files...`); + console.warn(` Error: ${makeError.message}`); + // Check if it's a dependency issue + if (makeError.message.includes('ENOENT') || makeError.message.includes('command not found')) { + console.warn(` This might be due to missing build dependencies (make, go, etc.)`); + } + } + } else { + console.warn(` ⚠️ No Makefile found in ${podmanSrcDir}, skipping "make docs"`); + } + + // Copy documentation files (only .md files, not .md.in) + const docsSourcePath = path.join(podmanSrcDir, 'docs'); + if (fs.existsSync(docsSourcePath)) { + await copyAndProcessDocs(docsSourcePath, outputPath, version); + } else { + console.warn(` ⚠️ No docs directory found at ${docsSourcePath}`); + } + + // Cleanup + fs.rmSync(tempArchive, { force: true }); + fs.rmSync(podmanSrcDir, { recursive: true, force: true }); + + // Remove README.md from version root to prevent route conflicts + const readmeConflict = path.join(outputPath, 'README.md'); + if (fs.existsSync(readmeConflict)) { + fs.unlinkSync(readmeConflict); + console.log(` ✓ Removed conflicting README.md from version root`); + } + + console.log(`✓ Documentation for ${version} processed successfully`); + return versionNumber; + } catch (error) { + console.error(`✗ Failed to download docs for ${version}:`, error.message); + return null; + } +} + +// Copy and process documentation files +async function copyAndProcessDocs(sourcePath, outputPath, version) { + const files = fs.readdirSync(sourcePath, { withFileTypes: true }); + + for (const file of files) { + const sourceFull = path.join(sourcePath, file.name); + const outputFull = path.join(outputPath, file.name); + + if (file.isDirectory()) { + if (!fs.existsSync(outputFull)) { + fs.mkdirSync(outputFull, { recursive: true }); + } + await copyAndProcessDocs(sourceFull, outputFull, version); + } else if (file.name.endsWith('.md')) { + // Only process .md files (skip .md.in since "make docs" generates the final .md files) + let content = fs.readFileSync(sourceFull, 'utf8'); + + // Process the markdown content + content = await processMarkdownContent(content, version); + + fs.writeFileSync(outputFull, content); + } + // Note: .md.in files are intentionally skipped since "make docs" generates .md files from them + } +} + +// Process markdown content for Docusaurus +async function processMarkdownContent(content, version) { + // Add frontmatter if not present + if (!content.startsWith('---')) { + const title = extractTitleFromContent(content); + const frontmatter = `--- +title: ${title} +version: ${version} +--- + +`; + content = frontmatter + content; + } else { + // Update existing frontmatter version + content = content.replace(/^(---[\s\S]*?)version:\s*[^\n]*\n/m, `$1version: ${version}\n`); + } + + // Fix relative links to work with Docusaurus + content = content.replace(/\]\(([^)]+\.md)\)/g, (match, link) => { + // Skip external links and absolute paths + if (link.startsWith('http') || link.startsWith('/')) { + return match; + } + + // For Docusaurus versioned docs, keep relative paths with .md extension + // but clean up any ./ prefixes + const cleanLink = link.replace(/^\.\//, ''); + return `](${cleanLink})`; + }); + + // Fix image paths + content = content.replace(/!\[([^\]]*)\]\(([^)]+)\)/g, (match, alt, src) => { + if (src.startsWith('http')) { + return match; // Keep absolute URLs as-is + } + // Convert relative image paths + const cleanSrc = src.replace(/^\.\//, ''); + return `![${alt}](${cleanSrc})`; + }); + + return content; +} + +// Extract title from markdown content +function extractTitleFromContent(content) { + const lines = content.split('\n'); + + // First try to find NAME section (common in manpages) + for (let i = 0; i < lines.length - 1; i++) { + if (lines[i].trim() === '## NAME') { + const nameLine = lines[i + 1].trim(); + if (nameLine) { + // Extract the full command name (including hyphens) before the dash and description + const commandMatch = nameLine.match(/^([^\s\\]+(?:\\?-[^\s\\]+)*)/); + if (commandMatch) { + // Remove backslash escapes for display + return commandMatch[1].replace(/\\/g, ''); + } + return nameLine; + } + } + } + + // Fallback: Look for # title + for (const line of lines) { + const match = line.match(/^#\s+(.+)$/); + if (match) { + return match[1].trim(); + } + } + + // Last fallback: try to extract from filename if it looks like a command + const filename = content.match(/% ([^\s]+)/); + if (filename) { + return filename[1]; + } + + return 'Documentation'; +} + +// Create index file for version +function createIndexFile(outputPath, version) { + const versionNumber = version.replace(/^v/, ''); + const indexContent = `--- +title: Podman Documentation +version: ${version} +--- + +# Podman Documentation (${version}) + +Welcome to the Podman documentation for version ${version}. + +## Getting Started + +- [Installation Instructions](https://podman.io/get-started) +- [Basic Tutorial](tutorials/podman_tutorial.md) +- [Rootless Containers](tutorials/rootless_tutorial.md) + +## Commands + +- [podman](source/markdown/podman.1.md) +- [podman-build](source/markdown/podman-build.1.md) +- [podman-run](source/markdown/podman-run.1.md) +- [podman-ps](source/markdown/podman-ps.1.md) + +## Tutorials + +- [Basic Networking](tutorials/basic_networking.md) +- [Rootless Tutorial](tutorials/rootless_tutorial.md) +- [Podman Tutorial](tutorials/podman_tutorial.md) +- [Performance](tutorials/performance.md) + +## System & Management + +- [System Commands](source/markdown/podman-system.1.md) +- [Machine Commands](source/markdown/podman-machine.1.md) +- [Pod Management](source/markdown/podman-pod.1.md) +- [Volume Management](source/markdown/podman-volume.1.md) + +## Advanced Features + +- [Systemd Integration](source/markdown/podman-systemd.unit.5.md) +- [Kubernetes Support](source/markdown/podman-kube.1.md) +- [Secret Management](source/markdown/podman-secret.1.md) +- [Code Generation](source/markdown/podman-generate.1.md) +`; + + fs.writeFileSync(path.join(outputPath, 'index.md'), indexContent); +} + +// Update versions.json file +function updateVersionsFile(versions) { + // Sort versions in descending order (newest first) + const sortedVersions = versions.sort((a, b) => { + const aNum = a.split('.').map(n => parseInt(n)); + const bNum = b.split('.').map(n => parseInt(n)); + + for (let i = 0; i < Math.max(aNum.length, bNum.length); i++) { + const aPart = aNum[i] || 0; + const bPart = bNum[i] || 0; + if (aPart !== bPart) { + return bPart - aPart; + } + } + return 0; + }); + + fs.writeFileSync(VERSIONS_FILE, JSON.stringify(sortedVersions, null, 2)); + console.log('✅ Updated versions.json with:', sortedVersions); +} + +// Get versions from versioned_docs directory structure (moved from update-versions.js) +function getVersionsFromDirectories() { + if (!fs.existsSync(VERSIONED_DOCS_DIR)) { + console.log('versioned_docs directory not found'); + return []; + } + + const dirs = fs.readdirSync(VERSIONED_DOCS_DIR, { withFileTypes: true }); + const versions = dirs + .filter(dir => dir.isDirectory() && dir.name.startsWith('version-')) + .map(dir => dir.name.replace('version-', '')) + .sort((a, b) => { + // Sort in descending order (newest first) + const aNum = a.split('.').map(n => parseInt(n)); + const bNum = b.split('.').map(n => parseInt(n)); + + for (let i = 0; i < Math.max(aNum.length, bNum.length); i++) { + const aPart = aNum[i] || 0; + const bPart = bNum[i] || 0; + if (aPart !== bPart) { + return bPart - aPart; + } + } + return 0; + }); + + return versions; +} + +// Generate versioned sidebar JSON files +function generateVersionedSidebars(versions) { + // Create versioned_sidebars directory if it doesn't exist + if (!fs.existsSync(VERSIONED_SIDEBARS_DIR)) { + fs.mkdirSync(VERSIONED_SIDEBARS_DIR, { recursive: true }); + } + + // Generate sidebar file for each version + for (const version of versions) { + const versionDocsPath = path.join(VERSIONED_DOCS_DIR, `version-${version}`); + const tutorialsPath = path.join(versionDocsPath, 'tutorials'); + + // Dynamically discover tutorial files + let tutorialItems = []; + if (fs.existsSync(tutorialsPath)) { + const tutorialFiles = fs.readdirSync(tutorialsPath) + .filter(file => file.endsWith('.md')) + .map(file => file.replace('.md', '')) + .sort(); // Sort alphabetically + + tutorialItems = tutorialFiles.map(filename => `tutorials/${filename}`); + console.log(`✅ Found ${tutorialItems.length} tutorial files for version ${version}:`, tutorialFiles); + } else { + console.warn(`⚠️ No tutorials directory found for version ${version}`); + } + + // Standard sidebar structure for Podman documentation with dynamic tutorials + const sidebarConfig = { + "tutorialSidebar": [ + { + "type": "doc", + "id": "index", + "label": "Overview" + }, + { + "type": "doc", + "id": "source/markdown/podman.1", + "label": "Podman Command" + }, + ...(tutorialItems.length > 0 ? [{ + "type": "category", + "label": "Tutorials", + "items": tutorialItems + }] : []), + { + "type": "doc", + "id": "kubernetes_support", + "label": "Kubernetes Support" + }, + { + "type": "doc", + "id": "MANPAGE_SYNTAX", + "label": "Manual Page Syntax" + } + ] + }; + + const sidebarFileName = `version-${version}-sidebars.json`; + const sidebarFilePath = path.join(VERSIONED_SIDEBARS_DIR, sidebarFileName); + + // Write the sidebar JSON file + fs.writeFileSync(sidebarFilePath, JSON.stringify(sidebarConfig, null, 2)); + console.log(`✅ Generated sidebar: ${sidebarFileName}`); + } + + console.log(`✅ Generated ${versions.length} versioned sidebar files`); +} + +// Validate version directory structure +function validateVersionDirectories(versions) { + const issues = []; + + for (const version of versions) { + const versionDir = path.join(VERSIONED_DOCS_DIR, `version-${version}`); + const indexFile = path.join(versionDir, 'index.md'); + + if (!fs.existsSync(versionDir)) { + issues.push(`Missing directory: versioned_docs/version-${version}`); + continue; + } + + if (!fs.existsSync(indexFile)) { + issues.push(`Missing index.md in: versioned_docs/version-${version}`); + continue; + } + + // Check if index.md has correct version in frontmatter + try { + const content = fs.readFileSync(indexFile, 'utf8'); + const versionMatch = content.match(/^---[\s\S]*?version:\s*v?([^\n]+)/m); + if (!versionMatch || versionMatch[1].trim() !== version) { + issues.push(`Version mismatch in versioned_docs/version-${version}/index.md`); + } + } catch (error) { + issues.push(`Error reading versioned_docs/version-${version}/index.md: ${error.message}`); + } + } + + return issues; +} + +// Fix YAML frontmatter syntax issues +async function fixYamlFrontmatter(versions) { + for (const version of versions) { + const versionDir = path.join(VERSIONED_DOCS_DIR, `version-${version}`); + + if (!fs.existsSync(versionDir)) { + continue; + } + + console.log(`🔧 Fixing YAML frontmatter in version ${version}...`); + + // Recursively find all markdown files + const findMarkdownFiles = (dir) => { + const files = []; + const entries = fs.readdirSync(dir, { withFileTypes: true }); + + for (const entry of entries) { + const fullPath = path.join(dir, entry.name); + if (entry.isDirectory()) { + files.push(...findMarkdownFiles(fullPath)); + } else if (entry.name.endsWith('.md') || entry.name.endsWith('.md.in')) { + files.push(fullPath); + } + } + return files; + }; + + const markdownFiles = findMarkdownFiles(versionDir); + let fixedCount = 0; + + for (const filePath of markdownFiles) { + try { + let content = fs.readFileSync(filePath, 'utf8'); + let hasChanges = false; + + // Fix frontmatter YAML issues + if (content.startsWith('---')) { + const frontmatterEnd = content.indexOf('---', 3); + if (frontmatterEnd !== -1) { + let frontmatter = content.substring(3, frontmatterEnd).trim(); + const originalFrontmatter = frontmatter; + + // Fix unquoted titles with special characters ([], (), etc.) + frontmatter = frontmatter.replace( + /^title:\s*(\[.*?\]\(.*?\).*?)$/gm, + 'title: "$1"' + ); + + // Fix unquoted strings with colons (most common YAML issue) + frontmatter = frontmatter.replace( + /^(\w+):\s*([^"'\n]*:[^"'\n]*)$/gm, + '$1: "$2"' + ); + + // Fix unquoted strings with other special characters + frontmatter = frontmatter.replace( + /^(\w+):\s*([^"'\n]*[[\](){}|>*&%@!#^]+[^"'\n]*)$/gm, + '$1: "$2"' + ); + + // Fix unquoted strings that start with special characters + frontmatter = frontmatter.replace( + /^(\w+):\s*([[\](){}|>*&%@!#^:][^"'\n]*)$/gm, + '$1: "$2"' + ); + + if (frontmatter !== originalFrontmatter) { + content = '---\n' + frontmatter + '\n---' + content.substring(frontmatterEnd + 3); + hasChanges = true; + } + } + } + + if (hasChanges) { + fs.writeFileSync(filePath, content); + fixedCount++; + console.log(` ✅ Fixed YAML in ${path.relative(versionDir, filePath)}`); + } + } catch (error) { + console.error(` ❌ Error fixing YAML in ${filePath}:`, error.message); + } + } + + if (fixedCount > 0) { + console.log(`✅ Fixed YAML frontmatter in ${fixedCount} files for version ${version}`); + } else { + console.log(`✅ No YAML issues found in version ${version}`); + } + } +} + +// Fix broken image links in markdown files +async function fixBrokenImageLinks(versions) { + const imageExtensions = ['.png', '.jpg', '.jpeg', '.gif', '.svg', '.webp']; + + for (const version of versions) { + const versionDir = path.join(VERSIONED_DOCS_DIR, `version-${version}`); + + if (!fs.existsSync(versionDir)) { + continue; + } + + console.log(`🔍 Checking broken image links in version ${version}...`); + + // Recursively find all markdown files + const findMarkdownFiles = (dir) => { + const files = []; + const entries = fs.readdirSync(dir, { withFileTypes: true }); + + for (const entry of entries) { + const fullPath = path.join(dir, entry.name); + if (entry.isDirectory()) { + files.push(...findMarkdownFiles(fullPath)); + } else if (entry.name.endsWith('.md') || entry.name.endsWith('.md.in')) { + files.push(fullPath); + } + } + return files; + }; + + const markdownFiles = findMarkdownFiles(versionDir); + let fixedCount = 0; + + for (const filePath of markdownFiles) { + try { + let content = fs.readFileSync(filePath, 'utf8'); + let hasChanges = false; + + // Find all image references: ![alt](path) or + const imageRegex = /!\[([^\]]*)\]\(([^)]+)\)|]+src=["']([^"']+)["'][^>]*>/g; + + content = content.replace(imageRegex, (match, alt1, src1, src2) => { + const alt = alt1 || ''; + const src = src1 || src2; + + // Skip external URLs (http/https) + if (src.startsWith('http://') || src.startsWith('https://')) { + return match; + } + + // Check if it's an image file + const hasImageExtension = imageExtensions.some(ext => + src.toLowerCase().includes(ext) + ); + + if (!hasImageExtension) { + return match; + } + + // Try to resolve the image path + const imagePath = path.resolve(path.dirname(filePath), src); + const staticImagePath = path.join(__dirname, '..', 'static', src); + + // Check if image exists in the docs directory or static directory + if (!fs.existsSync(imagePath) && !fs.existsSync(staticImagePath)) { + hasChanges = true; + console.log(`🔧 Removing broken image link: ${src} in ${path.relative(VERSIONED_DOCS_DIR, filePath)}`); + + // Replace with text or remove entirely + if (alt) { + return `*[Image: ${alt}]*`; + } else { + return '*[Image not available]*'; + } + } + + return match; + }); + + if (hasChanges) { + fs.writeFileSync(filePath, content); + fixedCount++; + } + } catch (error) { + console.error(`❌ Error processing ${filePath}:`, error.message); + } + } + + if (fixedCount > 0) { + console.log(`✅ Fixed broken image links in ${fixedCount} files for version ${version}`); + } + } +} + +// Clean up route conflicts by removing README.md from version roots +async function cleanupVersionRouteConflicts(versions) { + console.log('🧹 Cleaning up route conflicts...'); + let removedCount = 0; + + for (const version of versions) { + const versionDir = path.join(VERSIONED_DOCS_DIR, `version-${version}`); + const readmePath = path.join(versionDir, 'README.md'); + + if (fs.existsSync(readmePath)) { + try { + fs.unlinkSync(readmePath); + console.log(` ✓ Removed README.md from version-${version} root`); + removedCount++; + } catch (error) { + console.error(` ❌ Failed to remove README.md from version-${version}:`, error.message); + } + } + } + + if (removedCount > 0) { + console.log(`✅ Removed ${removedCount} conflicting README.md files`); + } else { + console.log('✅ No conflicting README.md files found'); + } +} + +// Clean up orphaned sidebar files +function cleanupOrphanedSidebars(versions) { + if (!fs.existsSync(VERSIONED_SIDEBARS_DIR)) { + return; + } + + const sidebarFiles = fs.readdirSync(VERSIONED_SIDEBARS_DIR) + .filter(file => file.endsWith('-sidebars.json')); + + const validSidebarFiles = versions.map(v => `version-${v}-sidebars.json`); + + for (const sidebarFile of sidebarFiles) { + if (!validSidebarFiles.includes(sidebarFile)) { + const filePath = path.join(VERSIONED_SIDEBARS_DIR, sidebarFile); + fs.rmSync(filePath, { force: true }); + console.log(`🗑️ Removed orphaned sidebar: ${sidebarFile}`); + } + } +} + +// Fix version frontmatter in index files +function fixVersionFrontmatter(versions) { + for (const version of versions) { + const indexFile = path.join(VERSIONED_DOCS_DIR, `version-${version}`, 'index.md'); + + if (fs.existsSync(indexFile)) { + try { + let content = fs.readFileSync(indexFile, 'utf8'); + + // Update version in frontmatter + content = content.replace( + /^(---[\s\S]*?)version:\s*[^\n]*/m, + `$1version: v${version}` + ); + + // Update version in title + content = content.replace( + /^# Podman Documentation \([^)]+\)/m, + `# Podman Documentation (v${version})` + ); + + // Update welcome message + content = content.replace( + /Welcome to the Podman documentation for version [^.]+\./m, + `Welcome to the Podman documentation for version v${version}.` + ); + + fs.writeFileSync(indexFile, content); + console.log(`✅ Fixed version frontmatter for ${version}`); + } catch (error) { + console.error(`❌ Error fixing version frontmatter for ${version}:`, error.message); + } + } + } +} + +// Create a new version from template +function createNewVersion(version) { + const versionDir = path.join(VERSIONED_DOCS_DIR, `version-${version}`); + + if (fs.existsSync(versionDir)) { + console.log(`Version ${version} already exists`); + return false; + } + + // Create directory + fs.mkdirSync(versionDir, { recursive: true }); + + // Create basic index.md + const indexContent = `--- +title: Podman Documentation +version: v${version} +--- + +# Podman Documentation (v${version}) + +Welcome to the Podman documentation for version v${version}. + +## Getting Started + +- [Installation Instructions](https://podman.io/get-started) +- [Basic Tutorial](tutorials/podman_tutorial.md) +- [Rootless Containers](tutorials/rootless_tutorial.md) + +## Commands + +- [podman](source/markdown/podman.1.md) +- [podman-build](source/markdown/podman-build.1.md) +- [podman-run](source/markdown/podman-run.1.md) + +## Documentation Versions + +For other versions, please use the version dropdown in the navigation bar. +`; + + fs.writeFileSync(path.join(versionDir, 'index.md'), indexContent); + console.log(`✅ Created new version directory: version-${version}`); + return true; +} + +// Generate version selector JavaScript file from versions.json +function generateVersionSelectorJS(versions) { + const versionSelectorPath = path.join(__dirname, '..', 'static', 'js', 'docs-version-selector.js'); + + if (!fs.existsSync(versionSelectorPath)) { + console.warn('⚠️ docs-version-selector.js not found, skipping version selector update'); + return; + } + + try { + let content = fs.readFileSync(versionSelectorPath, 'utf8'); + + // Generate the version array from versions.json + const versionArray = versions.map(version => + ` { name: '${version}', label: 'v${version}' }` + ).join(',\n'); + + // Replace the getAvailableVersions function + const newFunction = ` // Get available versions - automatically generated from versions.json + function getAvailableVersions() { + return [ +${versionArray} + ]; + }`; + + // Replace the existing function using regex + content = content.replace( + /\/\/ Get available versions.*?\n\s*function getAvailableVersions\(\) \{[\s\S]*?\n\s*\}/, + newFunction + ); + + fs.writeFileSync(versionSelectorPath, content); + console.log(`✅ Updated version selector with ${versions.length} versions (latest: ${versions[0]})`); + } catch (error) { + console.error('❌ Error updating version selector:', error.message); + } +} + +// Main function +async function main() { + const args = process.argv.slice(2); + const command = args[0]; + + // Handle utility commands from update-versions.js functionality + if (command === 'sync-versions') { + console.log('🔄 Syncing versions.json with directory structure...'); + const directoryVersions = getVersionsFromDirectories(); + const currentVersions = JSON.parse(fs.readFileSync(VERSIONS_FILE, 'utf8') || '[]'); + + if (JSON.stringify(directoryVersions) !== JSON.stringify(currentVersions)) { + updateVersionsFile(directoryVersions); + console.log('✅ Synced versions.json with directory structure'); + } else { + console.log('✅ versions.json is already in sync'); + } + + generateVersionedSidebars(directoryVersions); + generateVersionSelectorJS(directoryVersions); + return; + } + + if (command === 'validate') { + console.log('🔍 Validating version structure...'); + const versions = JSON.parse(fs.readFileSync(VERSIONS_FILE, 'utf8') || '[]'); + const issues = validateVersionDirectories(versions); + + if (issues.length > 0) { + console.log('❌ Found issues:'); + issues.forEach(issue => console.log(` - ${issue}`)); + process.exit(1); + } else { + console.log('✅ All version directories are valid'); + } + return; + } + + if (command === 'fix-yaml') { + console.log('🔧 Fixing YAML frontmatter...'); + const versions = JSON.parse(fs.readFileSync(VERSIONS_FILE, 'utf8') || '[]'); + await fixYamlFrontmatter(versions); + return; + } + + if (command === 'fix-images') { + console.log('🔧 Fixing broken image links...'); + const versions = JSON.parse(fs.readFileSync(VERSIONS_FILE, 'utf8') || '[]'); + await fixBrokenImageLinks(versions); + return; + } + + if (command === 'cleanup') { + console.log('🧹 Cleaning up route conflicts...'); + const versions = JSON.parse(fs.readFileSync(VERSIONS_FILE, 'utf8') || '[]'); + await cleanupVersionRouteConflicts(versions); + return; + } + + if (command === 'sidebars') { + console.log('🔧 Regenerating sidebars...'); + const versions = JSON.parse(fs.readFileSync(VERSIONS_FILE, 'utf8') || '[]'); + generateVersionedSidebars(versions); + cleanupOrphanedSidebars(versions); + return; + } + + if (command === 'update-version-selector') { + console.log('🔧 Updating version selector...'); + const versions = JSON.parse(fs.readFileSync(VERSIONS_FILE, 'utf8') || '[]'); + generateVersionSelectorJS(versions); + return; + } + + if (command === 'fix') { + console.log('🔧 Fixing version frontmatter...'); + const versions = JSON.parse(fs.readFileSync(VERSIONS_FILE, 'utf8') || '[]'); + fixVersionFrontmatter(versions); + return; + } + + if (command === 'add') { + const version = args[1]; + if (!version) { + console.error('❌ Please provide a version number: node scripts/sync-podman-docs.js add 5.6.0'); + process.exit(1); + } + + // Download and add the specific version + try { + const versionNumber = await downloadDocsForVersion(version); + console.log(`✅ Added version ${version} to documentation`); + + // Update versions.json and regenerate sidebars + const versions = getVersionsFromDirectories(); + updateVersionsFile(versions); + generateVersionedSidebars(versions); + cleanupOrphanedSidebars(versions); + generateVersionSelectorJS(versions); + + console.log(`✅ Added version ${versionNumber} and synced versions.json`); + } catch (error) { + console.error(`❌ Error adding version ${version}:`, error.message); + process.exit(1); + } + return; + } + + + + // Original sync functionality + const specificVersion = command; + + // Show help if requested + if (specificVersion === '--help' || specificVersion === '-h') { + console.log(` +Podman Documentation Management Tool + +Usage: + npm run docs:sync # Download latest 5 stable releases + npm run docs:sync-version 5.5.2 # Download specific version + npm run docs:sync-version v5.5.2 # Download specific version (with v prefix) + +Utility Commands: + node scripts/sync-podman-docs.js sync-versions # Sync versions.json with directories + node scripts/sync-podman-docs.js validate # Validate version structure + node scripts/sync-podman-docs.js fix-yaml # Fix YAML frontmatter issues + node scripts/sync-podman-docs.js fix-images # Fix broken image links + node scripts/sync-podman-docs.js cleanup # Clean up route conflicts + node scripts/sync-podman-docs.js sidebars # Regenerate all sidebars + node scripts/sync-podman-docs.js fix # Fix version frontmatter in index files + node scripts/sync-podman-docs.js add # Download and add a specific version + node scripts/sync-podman-docs.js update-version-selector # Update version selector JS from versions.json + +Examples: + npm run docs:sync-version 5.6.0 # Downloads Podman v5.6.0 docs + npm run docs:sync # Downloads latest releases + node scripts/sync-podman-docs.js validate # Validates all versions + +The script will: +- Download documentation from GitHub +- Create versioned_docs/version-X.X.X/ directory +- Update versions.json file +- Process markdown for Docusaurus compatibility +- Run various fix scripts automatically +- Generate versioned sidebars +- Update version selector in static/js/docs-version-selector.js +`); + return; + } + + console.log('🚀 Starting Podman documentation sync...'); + + try { + let versions = []; + + if (specificVersion) { + // Download specific version + console.log(`Downloading specific version: ${specificVersion}`); + + // Ensure version has 'v' prefix for GitHub API + const versionWithPrefix = specificVersion.startsWith('v') ? specificVersion : `v${specificVersion}`; + versions = [versionWithPrefix]; + + } else { + // Get latest releases and tags + const releases = await getLatestReleases(); + const tags = await getLatestTags(); + + // Use releases if available, otherwise use tags + versions = releases.length > 0 ? releases.map(r => r.tag_name) : tags.map(t => t.name); + + if (versions.length === 0) { + console.error('No versions found!'); + process.exit(1); + } + + console.log(`Processing ${versions.length} latest versions:`, versions); + } + + // Create versioned_docs directory if it doesn't exist + if (!fs.existsSync(VERSIONED_DOCS_DIR)) { + fs.mkdirSync(VERSIONED_DOCS_DIR, { recursive: true }); + } + + // Download documentation for each version + const processedVersions = []; + for (const version of versions) { + const versionNumber = await downloadDocsForVersion(version); + if (versionNumber) { + // Create index file + const outputPath = path.join(VERSIONED_DOCS_DIR, `version-${versionNumber}`); + createIndexFile(outputPath, version); + processedVersions.push(versionNumber); + } + } + + // Update versions.json (only if downloading latest versions, not specific ones) + if (processedVersions.length > 0) { + if (specificVersion) { + // For specific versions, sync with existing directory structure + const existingVersions = getVersionsFromDirectories(); + updateVersionsFile(existingVersions); + console.log(`✅ Added version ${specificVersion} and synced versions.json`); + + // Generate sidebar for the new version + generateVersionedSidebars(existingVersions); + generateVersionSelectorJS(existingVersions); + } else { + // For latest versions, replace versions.json + updateVersionsFile(processedVersions); + + // Generate sidebars for all versions + generateVersionedSidebars(processedVersions); + generateVersionSelectorJS(processedVersions); + } + } + + // Fix YAML frontmatter syntax issues automatically + console.log('🔧 Fixing YAML frontmatter syntax...'); + try { + const versions = processedVersions.length > 0 ? processedVersions : getVersionsFromDirectories(); + await fixYamlFrontmatter(versions); + console.log('✅ YAML frontmatter fixed successfully!'); + } catch (error) { + console.warn('⚠️ Warning: Failed to fix YAML frontmatter:', error.message); + } + + // Fix markdown directive issues automatically + console.log('🔧 Fixing markdown directive syntax...'); + try { + execSync('npm run docs:fix-directives', { + stdio: 'inherit', + cwd: path.join(__dirname, '..') + }); + console.log('✅ Markdown directives fixed successfully!'); + } catch (error) { + console.warn('⚠️ Warning: Failed to fix markdown directives:', error.message); + console.warn(' You can run "npm run docs:fix-directives" manually later'); + } + + // Fix broken image links automatically + console.log('🔧 Fixing broken image links...'); + try { + const versions = processedVersions.length > 0 ? processedVersions : getVersionsFromDirectories(); + await fixBrokenImageLinks(versions); + console.log('✅ Image links fixed successfully!'); + } catch (error) { + console.warn('⚠️ Warning: Failed to fix image links:', error.message); + } + + console.log('✅ Podman documentation sync completed successfully!'); + + // Clean up temp directory + if (fs.existsSync(TEMP_DIR)) { + fs.rmSync(TEMP_DIR, { recursive: true, force: true }); + } + + } catch (error) { + console.error('❌ Error syncing documentation:', error); + process.exit(1); + } +} + +// Run the script +if (require.main === module) { + main(); +} + +module.exports = { + main, + getLatestReleases, + getLatestTags, + downloadDocsForVersion, + updateVersionsFile, + getVersionsFromDirectories, + generateVersionedSidebars, + validateVersionDirectories, + fixYamlFrontmatter, + fixBrokenImageLinks, + cleanupVersionRouteConflicts, + createNewVersion, + fixVersionFrontmatter, + cleanupOrphanedSidebars, + generateVersionSelectorJS +}; \ No newline at end of file diff --git a/sidebars-podman.js b/sidebars-podman.js new file mode 100644 index 000000000..61a7a0e1c --- /dev/null +++ b/sidebars-podman.js @@ -0,0 +1,41 @@ +// @ts-check + +/** @type {import('@docusaurus/plugin-content-docs').SidebarsConfig} */ +const sidebars = { + tutorialSidebar: [ + { + type: 'doc', + id: 'index', + label: 'Overview', + }, + { + type: 'doc', + id: 'source/markdown/podman.1', + label: 'Podman Command', + }, + { + type: 'category', + label: 'Tutorials', + items: [ + 'tutorials/basic_networking', + 'tutorials/image_signing', + 'tutorials/mac_client', + 'tutorials/performance', + 'tutorials/podman_tutorial', + 'tutorials/rootless_tutorial', + ], + }, + { + type: 'doc', + id: 'kubernetes_support', + label: 'Kubernetes Support', + }, + { + type: 'doc', + id: 'MANPAGE_SYNTAX', + label: 'Manual Page Syntax', + }, + ], +}; + +module.exports = sidebars; \ No newline at end of file diff --git a/sidebars.js b/sidebars.js index cb328939e..98ab10fd9 100644 --- a/sidebars.js +++ b/sidebars.js @@ -25,8 +25,8 @@ const sidebars = { }, { type: 'link', - label: 'Documentation', - href: 'https://docs.podman.io', + label: 'Podman Documentation', + href: '/docs', }, { type: 'link', diff --git a/src/css/docs-version-selector.css b/src/css/docs-version-selector.css new file mode 100644 index 000000000..87be2d428 --- /dev/null +++ b/src/css/docs-version-selector.css @@ -0,0 +1,101 @@ +/* Move version selector from navbar into docs content area */ + +/* Hide version dropdown from navbar on docs pages */ +[data-current-docs-plugin-id] .navbar__item--docs-version-dropdown { + display: none !important; +} + +/* Create a container for the relocated version selector */ +[data-current-docs-plugin-id] .container::before { + content: ''; + display: block; + position: relative; + height: 60px; + margin-bottom: 20px; +} + +/* Add version selector inside docs content using JavaScript injection point */ +.docs-version-selector-injected { + position: sticky; + top: 80px; + background: var(--ifm-background-color); + border: 1px solid var(--ifm-border-color); + border-radius: 8px; + padding: 16px 20px; + margin: 0 0 24px 0; + display: flex; + align-items: center; + justify-content: space-between; + gap: 16px; + z-index: 10; + box-shadow: 0 2px 8px rgba(0, 0, 0, 0.08); +} + +.docs-version-selector-injected .version-info { + display: flex; + align-items: center; + gap: 12px; + flex: 1; +} + +.docs-version-selector-injected .version-icon { + font-size: 1.2rem; +} + +.docs-version-selector-injected .version-text { + font-weight: 600; + color: var(--ifm-font-color-base); + font-size: 0.95rem; +} + +.docs-version-selector-injected .version-dropdown { + position: relative; +} + +.docs-version-selector-injected select { + border: 1px solid var(--ifm-border-color); + border-radius: 6px; + padding: 8px 32px 8px 12px; + background: var(--ifm-background-color); + color: var(--ifm-font-color-base); + font-size: 0.9rem; + font-weight: 500; + cursor: pointer; + min-width: 120px; + appearance: none; + background-image: url("data:image/svg+xml;charset=UTF-8,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='currentColor' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3e%3cpolyline points='6,9 12,15 18,9'%3e%3c/polyline%3e%3c/svg%3e"); + background-repeat: no-repeat; + background-position: right 8px center; + background-size: 16px; +} + +.docs-version-selector-injected select:focus { + outline: 2px solid var(--ifm-color-primary); + outline-offset: 2px; + border-color: var(--ifm-color-primary); +} + +/* Responsive adjustments */ +@media (max-width: 768px) { + .docs-version-selector-injected { + position: static; + flex-direction: column; + align-items: flex-start; + gap: 12px; + padding: 12px 16px; + margin-bottom: 16px; + } + + .docs-version-selector-injected .version-info { + gap: 8px; + } + + .docs-version-selector-injected .version-text { + font-size: 0.9rem; + } + + .docs-version-selector-injected select { + width: 100%; + min-width: unset; + } +} \ No newline at end of file diff --git a/src/css/main.css b/src/css/main.css index 6f8826f13..a75cc72a7 100644 --- a/src/css/main.css +++ b/src/css/main.css @@ -154,4 +154,108 @@ [data-theme='light'] img[src$='#gh-dark-mode-only'], [data-theme='dark'] img[src$='#gh-light-mode-only'] { display: none; +} + +/* Fix list styling ONLY in individual documentation pages */ +/* Restore list styles for documentation content */ +.markdown ul:not(.breadcrumbs ul):not(.navbar ul):not(.pagination ul), +.theme-doc-markdown ul:not(.breadcrumbs ul):not(.navbar ul):not(.pagination ul), +article ul:not(.breadcrumbs ul):not(.navbar ul):not(.pagination ul) { + list-style-type: disc !important; + margin-left: 1.5rem !important; + margin-bottom: 1rem !important; + padding-left: 0 !important; +} + +.markdown ol:not(.breadcrumbs ol):not(.navbar ol):not(.pagination ol), +.theme-doc-markdown ol:not(.breadcrumbs ol):not(.navbar ol):not(.pagination ol), +article ol:not(.breadcrumbs ol):not(.navbar ol):not(.pagination ol) { + list-style-type: decimal !important; + margin-left: 1.5rem !important; + margin-bottom: 1rem !important; + padding-left: 0 !important; +} + +.markdown li:not(.breadcrumbs li):not(.navbar li):not(.pagination li), +.theme-doc-markdown li:not(.breadcrumbs li):not(.navbar li):not(.pagination li), +article li:not(.breadcrumbs li):not(.navbar li):not(.pagination li) { + margin-bottom: 0.5rem !important; + display: list-item !important; +} + +/* Enhanced styling for bold text in individual doc content only */ +[data-current-docs-plugin-id] .theme-doc-markdown.markdown ul li strong:not(.theme-index strong):not(.category-index strong), +[data-current-docs-plugin-id] .theme-doc-markdown.markdown ol li strong:not(.theme-index strong):not(.category-index strong) { + font-weight: 600 !important; + color: var(--ifm-heading-color) !important; +} + +/* Fix table of contents anchor spacing */ +.table-of-contents__link { + padding: 0.15rem 0.75rem !important; + margin-bottom: 0.05rem !important; + line-height: 1.3 !important; + display: block !important; +} + +.table-of-contents li { + margin-bottom: 0.05rem !important; +} + +.table-of-contents ul { + padding-left: 1rem !important; +} + +/* Nested TOC items */ +.table-of-contents .table-of-contents { + margin-top: 0.05rem !important; + padding-left: 1.25rem !important; +} + +/* Explicitly exclude ALL types of index and listing pages */ +.theme-index ul, +.theme-index ol, +.theme-index li, +.category-index ul, +.category-index ol, +.category-index li, +.docs-index ul, +.docs-index ol, +.docs-index li, +[class*="index"] ul, +[class*="index"] ol, +[class*="index"] li, +[class*="category"] ul, +[class*="category"] ol, +[class*="category"] li, +.navbar ul, +.navbar ol, +.navbar li, +.footer ul, +.footer ol, +.footer li, +.menu ul, +.menu ol, +.menu li, +.table-of-contents ul, +.table-of-contents ol, +.table-of-contents li, +.theme-doc-sidebar-container ul, +.theme-doc-sidebar-container ol, +.theme-doc-sidebar-container li, +aside ul, +aside ol, +aside li, +nav ul, +nav ol, +nav li, +.pagination ul, +.pagination ol, +.pagination li, +.breadcrumbs ul, +.breadcrumbs ol, +.breadcrumbs li { + list-style-type: none !important; + margin-left: 0 !important; + padding-left: 0 !important; } \ No newline at end of file diff --git a/static/js/docs-version-selector.js b/static/js/docs-version-selector.js new file mode 100644 index 000000000..1c7f14d54 --- /dev/null +++ b/static/js/docs-version-selector.js @@ -0,0 +1,228 @@ +/** + * Docs Version Selector Injection Script + * Moves the version selector from navbar into the docs content area + */ + + + +(function() { + 'use strict'; + + // Wait for DOM to be ready + function waitForElement(selector, callback) { + const element = document.querySelector(selector); + if (element) { + callback(element); + } else { + setTimeout(() => waitForElement(selector, callback), 100); + } + } + + // Check if we're on a docs page + function isDocsPage() { + return document.body.hasAttribute('data-current-docs-plugin-id') || + window.location.pathname.startsWith('/docs'); + } + + // Extract version information from URL and page + function getVersionInfo() { + const path = window.location.pathname; + const versionMatch = path.match(/\/docs\/([^\/]+)/); + + if (versionMatch) { + return { + current: versionMatch[1], + isVersioned: true + }; + } + + return { + current: 'latest', + isVersioned: false + }; + } + + // Get available versions - automatically generated from versions.json + function getAvailableVersions() { + return [ + { name: '5.5.2', label: 'v5.5.2' }, + { name: '5.5.1', label: 'v5.5.1' }, + { name: '5.5.0', label: 'v5.5.0' }, + { name: '5.4.2', label: 'v5.4.2' }, + { name: '5.4.1', label: 'v5.4.1' } + ]; + } + + // Create the version selector HTML + function createVersionSelector(currentVersion, versions) { + const container = document.createElement('div'); + container.className = 'docs-version-selector-injected'; + container.style.cssText = ` + background: #f0f0f0; + border: 2px solid #007acc; + border-radius: 8px; + padding: 16px; + margin: 16px 0; + display: flex; + align-items: center; + gap: 12px; + font-family: system-ui, -apple-system, sans-serif; + font-size: 14px; + color: #333; + z-index: 9999; + `; + + container.innerHTML = ` + 📚 + Documentation Version: + + (Test Version) + `; + + return container; + } + + // Handle version change + function handleVersionChange(event) { + const selectedVersion = event.target.value; + const currentPath = window.location.pathname; + + // Extract the current doc path (everything after /docs/version/) + const pathMatch = currentPath.match(/\/docs\/[^\/]+(\/.*)?$/); + const docPath = pathMatch && pathMatch[1] ? pathMatch[1] : '/'; + + // Construct new URL + const newPath = `/docs/${selectedVersion}${docPath}`; + + // Navigate to new version + window.location.href = newPath; + } + + // Inject the version selector into the docs content + function injectVersionSelector() { + console.log('injectVersionSelector called'); + console.log('Current URL:', window.location.pathname); + console.log('Is docs page?', isDocsPage()); + + if (!isDocsPage()) { + console.log('Not a docs page, skipping injection'); + return; + } + + // Remove any existing injected selector + const existing = document.querySelector('.docs-version-selector-injected'); + if (existing) { + console.log('Removing existing version selector'); + existing.remove(); + } + + const versionInfo = getVersionInfo(); + const versions = getAvailableVersions(); + + console.log('Version info:', versionInfo); + console.log('Available versions:', versions); + + if (versions.length <= 1) { + console.log('Only one version available, not showing selector'); + return; // Don't show if only one version + } + + // Try multiple possible insertion points + const possibleSelectors = [ + '.main-wrapper .container .row', + '.main-wrapper .container', + '.main-wrapper', + 'main .container', + 'main', + '.docusaurus-wrapper main' + ]; + + let injected = false; + + for (const selector of possibleSelectors) { + const targetElement = document.querySelector(selector); + if (targetElement) { + console.log('Injecting version selector into:', selector); + + const versionSelector = createVersionSelector(versionInfo.current, versions); + + // Insert at the beginning of the target element + targetElement.insertBefore(versionSelector, targetElement.firstChild); + + // Add event listener for version changes + const selectElement = versionSelector.querySelector('#docs-version-select'); + if (selectElement) { + selectElement.addEventListener('change', handleVersionChange); + } + + injected = true; + break; // Stop after successful injection + } + } + + // Fallback: inject into body if no suitable container found + if (!injected) { + console.log('No suitable container found, injecting into body as fallback'); + const versionSelector = createVersionSelector(versionInfo.current, versions); + versionSelector.style.position = 'fixed'; + versionSelector.style.top = '80px'; + versionSelector.style.right = '20px'; + versionSelector.style.zIndex = '10000'; + + document.body.appendChild(versionSelector); + + // Add event listener for version changes + const selectElement = versionSelector.querySelector('#docs-version-select'); + if (selectElement) { + selectElement.addEventListener('change', handleVersionChange); + } + } + } + + // Debug logging + console.log('Docs version selector script loaded'); + + // Initialize when DOM is ready + if (document.readyState === 'loading') { + console.log('DOM still loading, waiting for DOMContentLoaded'); + document.addEventListener('DOMContentLoaded', () => { + console.log('DOMContentLoaded fired, injecting version selector'); + injectVersionSelector(); + }); + } else { + console.log('DOM already ready, injecting version selector immediately'); + injectVersionSelector(); + } + + // Re-inject on navigation (for SPA routing) + const originalPushState = history.pushState; + const originalReplaceState = history.replaceState; + + history.pushState = function() { + originalPushState.apply(history, arguments); + setTimeout(injectVersionSelector, 100); + }; + + history.replaceState = function() { + originalReplaceState.apply(history, arguments); + setTimeout(injectVersionSelector, 100); + }; + + window.addEventListener('popstate', () => { + setTimeout(injectVersionSelector, 100); + }); + +})(); \ No newline at end of file diff --git a/versioned_docs/version-5.4.1/MANPAGE_SYNTAX.md b/versioned_docs/version-5.4.1/MANPAGE_SYNTAX.md new file mode 100644 index 000000000..631c82ca1 --- /dev/null +++ b/versioned_docs/version-5.4.1/MANPAGE_SYNTAX.md @@ -0,0 +1,147 @@ +--- +title: podman-command +version: v5.4.1 +--- + +% podman-command(1) + +## NAME +podman\-command - short description + +## SYNOPSIS +(Shows the command structure. If the command can be written in two different ways, both of them have to be shown.\ +Many manpages include the OPTIONS **--all**, **-a** and/or **--latest**, **-l**. In this case, there is no `container name` or `ID` needed after the initial command. Because most of the other OPTIONS still need the `container name` or ` ID`, it is defined that the *container* argument in the command should **not** be put in brackets. It should also be noted in the *IMPORTANT* section in the description of the OPTION with the following sentence: *IMPORTANT: This OPTION does not need a container name or ID as input argument.*.) + +**podman command** [*optional*] *mandatory value* + +**podman subcommand command** [*optional*] *mandatory value* + +(If there is the possibility to chose between two or more mandatory command values. There should also always be a space before and after a vertical bar to ensure better readability.) + +**podman command** [*optional*] *value1* | *value2* + +**podman subcommand command** [*optional*] *value1* | *value2* + +(If an optional value follows a mandatory one.) + +**podman command** [*optional*] *value1* | *value2* [*optional*] + +**podman subcommand command** [*optional*] *value1* | *value2* [*optional*] + +(If the command accepts an infinite number of values.) + +**podman command** [*optional*] *value* [*value* ...] + +**podman subcommand command** [*optional*] *value* [*value* ...] + +## DESCRIPTION +**podman command** is always the beginning of the DESCRIPTION section. Putting the command as the first part of the DESCRIPTION ensures uniformity. All commands mentioned in the text retain their appearance and form.\ +Example for the first sentence: **podman command** is an example command. + +Commands or files that are quoted from other podman manpages or podman repositories have to be linked to those. Non-podman commands are not to be linked.\ +Example sentence: Use **[podman-run](podman-run.1.md)** or **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** for the problem. + +It should also be specified if the command can only be run as root. In addition, it should be described when a command, OPTION, or other content cannot be executed with the remote client or in combination with other commands, OPTIONS, or content. In this case, the following sentence is put at the end of a command, OPTION, or content:\ +*IMPORTANT: This command/OPTION/content is not available with the command/OPTION/content/on the remote Podman client.*\ +For a command, this should be done in the DESCRIPTION section. For the OPTIONS, it should be done in the DESCRIPTION of the specified OPTION. + +Do not use pronouns in the man pages, especially the word `you`. + +There should be **no** new line after H2-headers (`##`). + +## OPTIONS +All flags are referred to as OPTIONS. The term flags should not be used. All OPTIONS are listed in this section. OPTIONS that appear in descriptions of other OPTIONS and sections retain their appearance, for example: **--exit**. + +OPTIONS that are quoted from other podman manpages or podman repositories have to be linked to those.\ +Example sentence: Use **[podman-generate-systemd --new](./source/markdown/podman-generate-systemd.1.md#--new)** for the problem. + + Each OPTION should be explained to the fullest extent below the OPTION itself. Each OPTION is behind an H4-header (`####`). If the OPTION has a default argument, it has to be explained in the description of the OPTION. If the OPTION is also not available with a command/OPTION/content/ on the remote Podman client, the sentence about the default argument should the second to last sentence. The sentence about the default argument should be in a new line as well as the *IMPORTANT* sentence. + + All OPTIONS are to be sorted in alphabetical order. + + Tables should be used when there is a different definition for multiple arguments, and these have to be explained. This is shown with the OPTION **--test**.\ + Lists should be used when arguments are used that do not need a definition for each argument and a single description explains them. An example is shown with **[podman-commit --change](./source/markdown/podman-commit.1.md#--change--cinstruction)** + + +#### **--version**, **-v** + +OPTIONS can be put after the command in two different ways. Either the long version with **--option** or as the short version **-o**. If there are two ways to write an OPTION they are separated by a comma. If there are two versions of one command the long version is always shown in front. If OPTION is boolean, *true/false* are not enumerated. The default boolean argument is shown in the same way normal default arguments are displayed.\ +Example: The default is **false**.\ +*IMPORTANT: This OPTION is not available with the remote Podman client.* + +#### **--exit** + +An example of a boolean OPTION that is only available in long form. + +#### **--answer**, **-a**=**active** | *disable* + +The **--answer** OPTION above is an example of an OPTION that accepts two possible arguments as inputs. If a default argument is selected when the OPTION is not used in the command, it is shown in **bold**. If the OPTION is used, it must include an argument afterward. It must always be ensured that the standard argument is in the first position after the OPTION. In this example, there are two different ways to execute the command. Both possible OPTIONS have to be shown with the arguments following them.\ +The default value is shown as **active**. + +#### **--status**=**good** | *better* | *best* + +This is an example of three arguments following an OPTION. If the number of arguments is greater than three, the arguments are **not** listed after the equal sign. The arguments must be shown in a table like in **--test**=**_test_**. This form should also be used if the understanding of the content is in danger of becoming incomprehensible. An example for this is **[podman-container-prune --filters](./source/markdown/podman-container-prune.1.md#--filterfilters)**.\ +The default value is shown as **good**. + +#### **--test**=**test** + +OPTIONS that are followed by an equal sign include an argument after the equal sign in **bold** or *italic*. If there is a default argument that is used if the OPTION is not specified in the command, the argument after the equal sign is displayed in **bold**. All arguments must be listed and explained in the text below the OPTION. + +| Argument | Description | +| ------------------ | --------------------------------------------------------------------------- | +| **example one** | This argument is the default argument if the OPTION is not specified. | +| *example two* | If one refers to a command, one should use **bold** marks. | +| *example three* | Example: In combination with **podman command** highly effective. | +| *example four* | Example: Can be combined with **--exit**. | +| *example five* | The fifth description | + +The table shows an example for a listing of arguments. The contents in the table should be aligned left. If the content in the table conflicts with this, it can be aligned to support the understanding of the content. If there is a default argument, it **must** be listed as the first entry in the table.\ +The default value is shown as **example one**. + +If the number of arguments is smaller than four they have to be listed behind the OPTION as seen in the OPTION **--status**. + +#### **--problem**=*problem* + +OPTIONS that are followed by an equal sign that is then followed by an unspecified argument, have no default argument. If this OPTION is written with an equal sign and the argument is left empty, there will be no error, but the OPTION will be ignored. The meaning of the argument is described preferably in `one` word after the equal sign in *italic* format. + +## SUBCHAPTER +For chapters that are made specifically as an individual SUBCHAPTER in a man page, the previous conditions regarding formatting apply. + +There are no restrictions for the use of paragraphs and tables. Within these paragraphs and tables the previous conditions regarding formatting apply. + +Strings of characters or numbers can be highlighted with `backticks`. Paths of any kind **must** be highlighted. + +IMPORTANT: Only characters that are **not** part of categories mentioned before can be highlighted. This includes headers. For example it is not advised to highlight an OPTION or a **command**. + +SUBHEADINGS are displayed as follows: +### SUBHEADING +Text for SUBHEADINGS. + +## EXAMPLES +All EXAMPLES are listed in this section. This section should be at the end of each man page. Each EXAMPLE is always in one box. The box starts and ends with the last written line, **not** with a blank line. The `$` in front of the commands indicates that it can be run as a normal user, while the commands starting with `#` can only be run as root. If there is the need for a comment in a box the comment should have `###` in front of it. + +Description of the EXAMPLE +``` +### Example comment +$ podman command +$ podman command -o +$ cat $HOME/Dockerfile | podman command --option +``` + +Description of the EXAMPLE two +``` +# podman command --status=better +``` +## SEE ALSO +All commands, including commands with OPTIONS, and config-files mentioned in the manpage have to be listed here. Podman commands, including commands with OPTIONS, and config-files have to be linked. If a command is mentioned several times with different OPTIONS it just have to be linked once. All other commands, including commands with OPTIONS, and config-files just have to be mentioned. If a command is mentioned several times with different OPTIONS it just has to be linked once. + +Example: +**[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-create(1)](podman-create.1.md)** + +## HISTORY +Normally, the dates of changes, the content of the changes and the person who provided them is listed here. Most manpages don't keep this record. + +Example:\ +December 2021, Originally compiled by Alexander Richter + +`Every manpage should end with an empty line.` diff --git a/versioned_docs/version-5.4.1/index.md b/versioned_docs/version-5.4.1/index.md new file mode 100644 index 000000000..15a3d2f53 --- /dev/null +++ b/versioned_docs/version-5.4.1/index.md @@ -0,0 +1,42 @@ +--- +title: Podman Documentation +version: v5.4.1 +--- + +# Podman Documentation (v5.4.1) + +Welcome to the Podman documentation for version v5.4.1. + +## Getting Started + +- [Installation Instructions](https://podman.io/get-started) +- [Basic Tutorial](tutorials/podman_tutorial.md) +- [Rootless Containers](tutorials/rootless_tutorial.md) + +## Commands + +- [podman](source/markdown/podman.1.md) +- [podman-build](source/markdown/podman-build.1.md) +- [podman-run](source/markdown/podman-run.1.md) +- [podman-ps](source/markdown/podman-ps.1.md) + +## Tutorials + +- [Basic Networking](tutorials/basic_networking.md) +- [Rootless Tutorial](tutorials/rootless_tutorial.md) +- [Podman Tutorial](tutorials/podman_tutorial.md) +- [Performance](tutorials/performance.md) + +## System & Management + +- [System Commands](source/markdown/podman-system.1.md) +- [Machine Commands](source/markdown/podman-machine.1.md) +- [Pod Management](source/markdown/podman-pod.1.md) +- [Volume Management](source/markdown/podman-volume.1.md) + +## Advanced Features + +- [Systemd Integration](source/markdown/podman-systemd.unit.5.md) +- [Kubernetes Support](source/markdown/podman-kube.1.md) +- [Secret Management](source/markdown/podman-secret.1.md) +- [Code Generation](source/markdown/podman-generate.1.md) diff --git a/versioned_docs/version-5.4.1/kubernetes_support.md b/versioned_docs/version-5.4.1/kubernetes_support.md new file mode 100644 index 000000000..7570223c7 --- /dev/null +++ b/versioned_docs/version-5.4.1/kubernetes_support.md @@ -0,0 +1,208 @@ +--- +title: Podman Kube Play Support +version: v5.4.1 +--- + +# Podman Kube Play Support + +This document outlines the kube yaml fields that are currently supported by the **podman kube play** command. + +Note: **N/A** means that the option cannot be supported in a single-node Podman environment. + +## Pod Fields + +| Field | Support | +|-----------------------------------------------------|---------| +| containers | ✅ | +| initContainers | ✅ | +| imagePullSecrets | no | +| enableServiceLinks | no | +| os\.name | no | +| volumes | ✅ | +| nodeSelector | N/A | +| nodeName | N/A | +| affinity\.nodeAffinity | N/A | +| affinity\.podAffinity | N/A | +| affinity\.podAntiAffinity | N/A | +| tolerations\.key | N/A | +| tolerations\.operator | N/A | +| tolerations\.effect | N/A | +| tolerations\.tolerationSeconds | N/A | +| schedulerName | N/A | +| runtimeClassName | no | +| priorityClassName | no | +| priority | no | +| topologySpreadConstraints\.maxSkew | N/A | +| topologySpreadConstraints\.topologyKey | N/A | +| topologySpreadConstraints\.whenUnsatisfiable | N/A | +| topologySpreadConstraints\.labelSelector | N/A | +| topologySpreadConstraints\.minDomains | N/A | +| restartPolicy | ✅ | +| terminationGracePeriodSeconds | ✅ | +| activeDeadlineSeconds | no | +| readinessGates\.conditionType | no | +| hostname | ✅ | +| setHostnameAsFQDN | no | +| subdomain | no | +| hostAliases\.hostnames | ✅ | +| hostAliases\.ip | ✅ | +| dnsConfig\.nameservers | ✅ | +| dnsConfig\.options\.name | ✅ | +| dnsConfig\.options\.value | ✅ | +| dnsConfig\.searches | ✅ | +| dnsPolicy | no | +| hostNetwork | ✅ | +| hostPID | ✅ | +| hostIPC | ✅ | +| shareProcessNamespace | ✅ | +| serviceAccountName | no | +| automountServiceAccountToken | no | +| securityContext\.runAsUser | ✅ | +| securityContext\.runAsNonRoot | no | +| securityContext\.runAsGroup | ✅ | +| securityContext\.supplementalGroups | ✅ | +| securityContext\.fsGroup | no | +| securityContext\.fsGroupChangePolicy | no | +| securityContext\.seccompProfile\.type | no | +| securityContext\.seccompProfile\.localhostProfile | no | +| securityContext\.seLinuxOptions\.level | ✅ | +| securityContext\.seLinuxOptions\.role | ✅ | +| securityContext\.seLinuxOptions\.type | ✅ | +| securityContext\.seLinuxOptions\.user | ✅ | +| securityContext\.sysctls\.name | ✅ | +| securityContext\.sysctls\.value | ✅ | +| securityContext\.windowsOptions\.gmsaCredentialSpec | no | +| securityContext\.windowsOptions\.hostProcess | no | +| securityContext\.windowsOptions\.runAsUserName | no | + +## Container Fields + +| Field | Support | +|-----------------------------------------------------|---------| +| name | ✅ | +| image | ✅ | +| imagePullPolicy | ✅ | +| command | ✅ | +| args | ✅ | +| workingDir | ✅ | +| ports\.containerPort | ✅ | +| ports\.hostIP | ✅ | +| ports\.hostPort | ✅ | +| ports\.name | ✅ | +| ports\.protocol | ✅ | +| env\.name | ✅ | +| env\.value | ✅ | +| env\.valueFrom\.configMapKeyRef\.key | ✅ | +| env\.valueFrom\.configMapKeyRef\.name | ✅ | +| env\.valueFrom\.configMapKeyRef\.optional | ✅ | +| env\.valueFrom\.fieldRef | ✅ | +| env\.valueFrom\.resourceFieldRef | ✅ | +| env\.valueFrom\.secretKeyRef\.key | ✅ | +| env\.valueFrom\.secretKeyRef\.name | ✅ | +| env\.valueFrom\.secretKeyRef\.optional | ✅ | +| envFrom\.configMapRef\.name | ✅ | +| envFrom\.configMapRef\.optional | ✅ | +| envFrom\.prefix | no | +| envFrom\.secretRef\.name | ✅ | +| envFrom\.secretRef\.optional | ✅ | +| volumeMounts\.mountPath | ✅ | +| volumeMounts\.name | ✅ | +| volumeMounts\.mountPropagation | no | +| volumeMounts\.readOnly | ✅ | +| volumeMounts\.subPath | ✅ | +| volumeMounts\.subPathExpr | no | +| volumeDevices\.devicePath | no | +| volumeDevices\.name | no | +| resources\.limits | ✅ | +| resources\.requests | ✅ | +| lifecycle\.postStart | no | +| lifecycle\.preStop | no | +| terminationMessagePath | no | +| terminationMessagePolicy | no | +| livenessProbe | ✅ | +| readinessProbe | no | +| startupProbe | no | +| securityContext\.runAsUser | ✅ | +| securityContext\.runAsNonRoot | no | +| securityContext\.runAsGroup | ✅ | +| securityContext\.readOnlyRootFilesystem | ✅ | +| securityContext\.procMount | ✅ | +| securityContext\.privileged | ✅ | +| securityContext\.allowPrivilegeEscalation | ✅ | +| securityContext\.capabilities\.add | ✅ | +| securityContext\.capabilities\.drop | ✅ | +| securityContext\.seccompProfile\.type | no | +| securityContext\.seccompProfile\.localhostProfile | no | +| securityContext\.seLinuxOptions\.level | ✅ | +| securityContext\.seLinuxOptions\.role | ✅ | +| securityContext\.seLinuxOptions\.type | ✅ | +| securityContext\.seLinuxOptions\.user | ✅ | +| securityContext\.windowsOptions\.gmsaCredentialSpec | no | +| securityContext\.windowsOptions\.hostProcess | no | +| securityContext\.windowsOptions\.runAsUserName | no | +| stdin | no | +| stdinOnce | no | +| tty | no | + +## PersistentVolumeClaim Fields + +| Field | Support | +|---------------------|---------| +| volumeName | no | +| storageClassName | ✅ | +| volumeMode | no | +| accessModes | ✅ | +| selector | no | +| resources\.limits | no | +| resources\.requests | ✅ | + +## ConfigMap Fields + +| Field | Support | +|------------|---------| +| binaryData | ✅ | +| data | ✅ | +| immutable | no | + +## Deployment Fields + +| Field | Support | +|-----------------------------------------|-------------------------------------------------------| +| replicas | ✅ (the actual replica count is ignored and set to 1) | +| selector | ✅ | +| template | ✅ | +| minReadySeconds | no | +| strategy\.type | no | +| strategy\.rollingUpdate\.maxSurge | no | +| strategy\.rollingUpdate\.maxUnavailable | no | +| revisionHistoryLimit | no | +| progressDeadlineSeconds | no | +| paused | no | + +## DaemonSet Fields + +| Field | Support | +|-----------------------------------------|---------| +| selector | ✅ | +| template | ✅ | +| minReadySeconds | no | +| strategy\.type | no | +| strategy\.rollingUpdate\.maxSurge | no | +| strategy\.rollingUpdate\.maxUnavailable | no | +| revisionHistoryLimit | no | + +## Job Fields + +| Field | Support | +|-------------------------|----------------------------------| +| activeDeadlineSeconds | no | +| selector | no (automatically set by k8s) | +| template | ✅ | +| backoffLimit | no | +| completionMode | no | +| completions | no (set to 1 with kube generate) | +| manualSelector | no | +| parallelism | no (set to 1 with kube generate) | +| podFailurePolicy | no | +| suspend | no | +| ttlSecondsAfterFinished | no | diff --git a/versioned_docs/version-5.4.1/source/markdown/options/README.md b/versioned_docs/version-5.4.1/source/markdown/options/README.md new file mode 100644 index 000000000..66bfb65e9 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/README.md @@ -0,0 +1,68 @@ +--- +title: Documentation +version: v5.4.1 +--- + +Common Man Page Options +======================= + +This subdirectory contains option (flag) names and descriptions +common to multiple podman man pages. Each file is one option. The +filename does not necessarily need to be identical to the option +name: for instance, `hostname.container.md` and `hostname.pod.md` +exist because the **--hostname** option is sufficiently different +between `podman-{create,run}` and `podman-pod-{create,run}` to +warrant living separately. + +How +=== + +The files here are included in `podman-*.md.in` files using the `@@option` +mechanism: + +``` +@@option foo ! includes options/foo.md +``` + +The tool that does this is `hack/markdown-preprocess`. It is a python +script because it needs to run on `readthedocs.io`. From a given `.md.in` +file, this script creates a `.md` file that can then be read by +`go-md2man`, `sphinx`, anything that groks markdown. This runs as +part of `make docs`. + +Special Substitutions +===================== + +Some options are almost identical except for 'pod' vs 'container' +differences. For those, use `<>`. +Order is immaterial: the important thing is the presence of the +string "`pod`" in one half but not the other. The correct string +is chosen based on the filename: if the file contains `-pod`, +such as `podman-pod-create`, the string with `pod` (case-insensitive) +in it is chosen. + +The string `<>` is replaced with the podman subcommand +as determined from the filename, e.g., `create` for `podman-create.1.md.in`. +This allows the shared use of examples in the option file: +``` + Example: podman <> --foo --bar +``` +As a special case, `podman-pod-X` becomes just `X` (the "pod" is removed). +This makes the `pod-id-file` man page more useful. To get the full +subcommand including 'pod', use `<>`. + +Restrictions +============ + +There is a restriction for having a single text line with three +back-ticks in the front and the end of the line. For instance: + +\`\`\`Some man page text\`\`\` + +This is currently not allowed and causes a corruption of the +compiled man page. Instead, put the three back-ticks on separate +lines like: + +\`\`\` +Some man page text +\`\`\` diff --git a/versioned_docs/version-5.4.1/source/markdown/options/add-host.md b/versioned_docs/version-5.4.1/source/markdown/options/add-host.md new file mode 100644 index 000000000..a68de7763 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/add-host.md @@ -0,0 +1,44 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, create, farm build, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the <>'s `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/annotation.container.md b/versioned_docs/version-5.4.1/source/markdown/options/annotation.container.md new file mode 100644 index 000000000..a06c5e7bb --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/annotation.container.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, kube play, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--annotation**=*key=value* + +Add an annotation to the container<<| or pod>>. This option can be set multiple times. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/annotation.image.md b/versioned_docs/version-5.4.1/source/markdown/options/annotation.image.md new file mode 100644 index 000000000..f4331b551 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/annotation.image.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--annotation**=*annotation=value* + +Add an image *annotation* (e.g. annotation=*value*) to the image metadata. Can +be used multiple times. + +Note: this information is not present in Docker image formats, so it is +discarded when writing images in Docker formats. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/annotation.manifest.md b/versioned_docs/version-5.4.1/source/markdown/options/annotation.manifest.md new file mode 100644 index 000000000..e85cf1816 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/annotation.manifest.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman artifact add, manifest add, manifest annotate +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--annotation**=*annotation=value* + +Set an annotation on the entry for the specified image or artifact. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/arch.md b/versioned_docs/version-5.4.1/source/markdown/options/arch.md new file mode 100644 index 000000000..1636d90c0 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/arch.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--arch**=*ARCH* +Override the architecture, defaults to hosts, of the image to be pulled. For example, `arm`. +Unless overridden, subsequent lookups of the same image in the local storage matches this architecture, regardless of the host. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/attach.md b/versioned_docs/version-5.4.1/source/markdown/options/attach.md new file mode 100644 index 000000000..ff9882e2c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/attach.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--attach**, **-a**=*stdin* | *stdout* | *stderr* + +Attach to STDIN, STDOUT or STDERR. + +In foreground mode (the default when **-d** +is not specified), **podman run** can start the process in the container +and attach the console to the process's standard input, output, and +error. It can even pretend to be a TTY (this is what most command-line +executables expect) and pass along signals. The **-a** option can be set for +each of **stdin**, **stdout**, and **stderr**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/authfile.md b/versioned_docs/version-5.4.1/source/markdown/options/authfile.md new file mode 100644 index 000000000..afc237b1a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/authfile.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, auto update, build, container runlabel, create, farm build, image sign, kube play, login, logout, manifest add, manifest inspect, manifest push, pull, push, run, search +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/blkio-weight-device.md b/versioned_docs/version-5.4.1/source/markdown/options/blkio-weight-device.md new file mode 100644 index 000000000..8fb34394b --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/blkio-weight-device.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman container clone, create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/blkio-weight.md b/versioned_docs/version-5.4.1/source/markdown/options/blkio-weight.md new file mode 100644 index 000000000..8ac4fb476 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/blkio-weight.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman container clone, create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/build-arg-file.md b/versioned_docs/version-5.4.1/source/markdown/options/build-arg-file.md new file mode 100644 index 000000000..ffd407172 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/build-arg-file.md @@ -0,0 +1,27 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--build-arg-file**=*path* + +Specifies a file containing lines of build arguments of the form `arg=value`. +The suggested file name is `argfile.conf`. + +Comment lines beginning with `#` are ignored, along with blank lines. +All others must be of the `arg=value` format passed to `--build-arg`. + +If several arguments are provided via the `--build-arg-file` +and `--build-arg` options, the build arguments are merged across all +of the provided files and command line arguments. + +Any file provided in a `--build-arg-file` option is read before +the arguments supplied via the `--build-arg` option. + +When a given argument name is specified several times, the last instance +is the one that is passed to the resulting builds. This means `--build-arg` +values always override those in a `--build-arg-file`. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/build-arg.md b/versioned_docs/version-5.4.1/source/markdown/options/build-arg.md new file mode 100644 index 000000000..3f5ad54a6 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/build-arg.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--build-arg**=*arg=value* + +Specifies a build argument and its value, which is interpolated in +instructions read from the Containerfiles in the same way that environment variables are, but which are not added to environment variable list in the resulting image's configuration. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/build-context.md b/versioned_docs/version-5.4.1/source/markdown/options/build-context.md new file mode 100644 index 000000000..0ba06847f --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/build-context.md @@ -0,0 +1,35 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--build-context**=*name=value* + +Specify an additional build context using its short name and its location. +Additional build contexts can be referenced in the same manner as we access +different stages in COPY instruction. + +Valid values are: + +* Local directory – e.g. --build-context project2=../path/to/project2/src (This option is not available with the remote Podman client. On Podman machine setup (i.e macOS and Windows) path must exists on the machine VM) +* HTTP URL to a tarball – e.g. --build-context src=https://example.org/releases/src.tar +* Container image – specified with a container-image:// prefix, e.g. --build-context alpine=container-image://alpine:3.15, (also accepts docker://, docker-image://) + +On the Containerfile side, reference the build context on all +commands that accept the “from” parameter. Here’s how that might look: + +```dockerfile +FROM [name] +COPY --from=[name] ... +RUN --mount=from=[name] … +``` + +The value of [name] is matched with the following priority order: + +* Named build context defined with --build-context [name]=.. +* Stage defined with AS [name] inside Containerfile +* Image [name], either local or in a remote registry diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cache-from.md b/versioned_docs/version-5.4.1/source/markdown/options/cache-from.md new file mode 100644 index 000000000..6f89c264f --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cache-from.md @@ -0,0 +1,26 @@ +--- +title: populate a cache and also consult it +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cache-from**=*image* + +Repository to utilize as a potential cache source. When specified, Buildah tries to look for +cache images in the specified repository and attempts to pull cache images instead of actually +executing the build steps locally. Buildah only attempts to pull previously cached images if they +are considered as valid cache hits. + +Use the `--cache-to` option to populate a remote repository with cache content. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-from` option is ignored unless `--layers` is specified. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cache-to.md b/versioned_docs/version-5.4.1/source/markdown/options/cache-to.md new file mode 100644 index 000000000..d477bf227 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cache-to.md @@ -0,0 +1,24 @@ +--- +title: populate a cache and also consult it +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cache-to**=*image* + +Set this flag to specify a remote repository that is used to store cache images. Buildah attempts to +push newly built cache image to the remote repository. + +Note: Use the `--cache-from` option in order to use cache content in a remote repository. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-to` option is ignored unless `--layers` is specified. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cache-ttl.md b/versioned_docs/version-5.4.1/source/markdown/options/cache-ttl.md new file mode 100644 index 000000000..e9e5a89e0 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cache-ttl.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cache-ttl** + +Limit the use of cached images to only consider images with created timestamps less than *duration* ago. +For example if `--cache-ttl=1h` is specified, Buildah considers intermediate cache images which are created +under the duration of one hour, and intermediate cache images outside this duration is ignored. + +Note: Setting `--cache-ttl=0` manually is equivalent to using `--no-cache` in the +implementation since this means that the user does not want to use cache at all. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cap-add.image.md b/versioned_docs/version-5.4.1/source/markdown/options/cap-add.image.md new file mode 100644 index 000000000..3fdcc66fb --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cap-add.image.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cap-add**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability added to its capability set. +Certain capabilities are granted by default; this option can be used to add +more. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cap-add.md b/versioned_docs/version-5.4.1/source/markdown/options/cap-add.md new file mode 100644 index 000000000..1220fb20b --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cap-add.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cap-add**=*capability* + +Add Linux capabilities. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cap-drop.image.md b/versioned_docs/version-5.4.1/source/markdown/options/cap-drop.image.md new file mode 100644 index 000000000..77bf25286 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cap-drop.image.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cap-drop**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability removed from its capability set. +The CAP\_CHOWN, CAP\_DAC\_OVERRIDE, CAP\_FOWNER, +CAP\_FSETID, CAP\_KILL, CAP\_NET\_BIND\_SERVICE, CAP\_SETFCAP, +CAP\_SETGID, CAP\_SETPCAP, and CAP\_SETUID capabilities are +granted by default; this option can be used to remove them. + +If a capability is specified to both the **--cap-add** and **--cap-drop** +options, it is dropped, regardless of the order in which the options were +given. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cap-drop.md b/versioned_docs/version-5.4.1/source/markdown/options/cap-drop.md new file mode 100644 index 000000000..2a853052e --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cap-drop.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cap-drop**=*capability* + +Drop Linux capabilities. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cert-dir.md b/versioned_docs/version-5.4.1/source/markdown/options/cert-dir.md new file mode 100644 index 000000000..e1863a619 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cert-dir.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, build, container runlabel, farm build, image sign, kube play, login, manifest add, manifest push, pull, push, search +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cgroup-conf.md b/versioned_docs/version-5.4.1/source/markdown/options/cgroup-conf.md new file mode 100644 index 000000000..16d383307 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cgroup-conf.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroup-conf**=*KEY=VALUE* + +When running on cgroup v2, specify the cgroup file to write to and its value. For example **--cgroup-conf=memory.high=1073741824** sets the memory.high limit to 1GB. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cgroup-parent.md b/versioned_docs/version-5.4.1/source/markdown/options/cgroup-parent.md new file mode 100644 index 000000000..854a7f2c3 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cgroup-parent.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, create, farm build, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the <> is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cgroupns.image.md b/versioned_docs/version-5.4.1/source/markdown/options/cgroupns.image.md new file mode 100644 index 000000000..0c6f27c27 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cgroupns.image.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroupns**=*how* + +Sets the configuration for cgroup namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "private" to indicate +that a new cgroup namespace is created, or it can be "host" to indicate +that the cgroup namespace in which `buildah` itself is being run is reused. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cgroupns.md b/versioned_docs/version-5.4.1/source/markdown/options/cgroupns.md new file mode 100644 index 000000000..f38b83dbf --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cgroupns.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroupns**=*mode* + +Set the cgroup namespace mode for the container. + +- **host**: use the host's cgroup namespace inside the container. +- **container:**_id_: join the namespace of the specified container. +- **private**: create a new cgroup namespace. +- **ns:**_path_: join the namespace at the specified path. + +If the host uses cgroups v1, the default is set to **host**. On cgroups v2, the default is **private**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cgroups.md b/versioned_docs/version-5.4.1/source/markdown/options/cgroups.md new file mode 100644 index 000000000..6b5f9cca1 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cgroups.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroups**=*how* + +Determines whether the container creates CGroups. + +Default is **enabled**. + +The **enabled** option creates a new cgroup under the cgroup-parent. +The **disabled** option forces the container to not create CGroups, and thus conflicts with CGroup options (**--cgroupns** and **--cgroup-parent**). +The **no-conmon** option disables a new CGroup only for the **conmon** process. +The **split** option splits the current CGroup in two sub-cgroups: one for conmon and one for the container payload. It is not possible to set **--cgroup-parent** with **split**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/chrootdirs.md b/versioned_docs/version-5.4.1/source/markdown/options/chrootdirs.md new file mode 100644 index 000000000..23d760147 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/chrootdirs.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--chrootdirs**=*path* + +Path to a directory inside the container that is treated as a `chroot` directory. +Any Podman managed file (e.g., /etc/resolv.conf, /etc/hosts, etc/hostname) that is mounted into the root directory is mounted into that location as well. +Multiple directories are separated with a comma. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cidfile.read.md b/versioned_docs/version-5.4.1/source/markdown/options/cidfile.read.md new file mode 100644 index 000000000..688575809 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cidfile.read.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman kill, pause, rm, stop, unpause +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cidfile**=*file* + +Read container ID from the specified *file* and <> the container. +Can be specified multiple times. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cidfile.write.md b/versioned_docs/version-5.4.1/source/markdown/options/cidfile.write.md new file mode 100644 index 000000000..b559725ec --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cidfile.write.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cidfile**=*file* + +Write the container ID to *file*. The file is removed along with the container, except +when used with podman --remote run on detached containers. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/color.md b/versioned_docs/version-5.4.1/source/markdown/options/color.md new file mode 100644 index 000000000..d343ff5ee --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/color.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--color** + +Output the containers with different colors in the log. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/compat-auth-file.md b/versioned_docs/version-5.4.1/source/markdown/options/compat-auth-file.md new file mode 100644 index 000000000..44eca898f --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/compat-auth-file.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman login, logout +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compat-auth-file**=*path* + +Instead of updating the default credentials file, update the one at *path*, and use a Docker-compatible format. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/compat-volumes.md b/versioned_docs/version-5.4.1/source/markdown/options/compat-volumes.md new file mode 100644 index 000000000..5602254da --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/compat-volumes.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compat-volumes** + +Handle directories marked using the VOLUME instruction (both in this build, and +those inherited from base images) such that their contents can only be modified +by ADD and COPY instructions. Any changes made in those locations by RUN +instructions will be reverted. Before the introduction of this option, this +behavior was the default, but it is now disabled by default. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/compression-format.md b/versioned_docs/version-5.4.1/source/markdown/options/compression-format.md new file mode 100644 index 000000000..a9b1a28e8 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/compression-format.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compression-format**=**gzip** | *zstd* | *zstd:chunked* + +Specifies the compression format to use. Supported values are: `gzip`, `zstd` and `zstd:chunked`. The default is `gzip` unless overridden in the containers.conf file. +`zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning in that case. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/compression-level.md b/versioned_docs/version-5.4.1/source/markdown/options/compression-level.md new file mode 100644 index 000000000..4790bf504 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/compression-level.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compression-level**=*level* + +Specifies the compression level to use. The value is specific to the compression algorithm used, e.g. for zstd the accepted values are in the range 1-20 (inclusive) with a default of 3, while for gzip it is 1-9 (inclusive) and has a default of 5. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/conmon-pidfile.md b/versioned_docs/version-5.4.1/source/markdown/options/conmon-pidfile.md new file mode 100644 index 000000000..770adffb1 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/conmon-pidfile.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--conmon-pidfile**=*file* + +Write the pid of the **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to restart Podman containers. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cpp-flag.md b/versioned_docs/version-5.4.1/source/markdown/options/cpp-flag.md new file mode 100644 index 000000000..965bbdf4e --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cpp-flag.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpp-flag**=*flags* + +Set additional flags to pass to the C Preprocessor cpp(1). Containerfiles ending with a ".in" suffix is preprocessed via cpp(1). This option can be used to pass additional flags to cpp.Note: You can also set default CPPFLAGS by setting the BUILDAH_CPPFLAGS environment variable (e.g., export BUILDAH_CPPFLAGS="-DDEBUG"). diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cpu-period.md b/versioned_docs/version-5.4.1/source/markdown/options/cpu-period.md new file mode 100644 index 000000000..0b6c2aabd --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cpu-period.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cpu-quota.md b/versioned_docs/version-5.4.1/source/markdown/options/cpu-quota.md new file mode 100644 index 000000000..3e61d3d83 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cpu-quota.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cpu-rt-period.md b/versioned_docs/version-5.4.1/source/markdown/options/cpu-rt-period.md new file mode 100644 index 000000000..e33f970cd --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cpu-rt-period.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman container clone, create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cpu-rt-runtime.md b/versioned_docs/version-5.4.1/source/markdown/options/cpu-rt-runtime.md new file mode 100644 index 000000000..52d412531 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cpu-rt-runtime.md @@ -0,0 +1,19 @@ +--- +title: of +version: v5.4.1 +--- + +####> This option file is used in: +####> podman container clone, create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cpu-shares.md b/versioned_docs/version-5.4.1/source/markdown/options/cpu-shares.md new file mode 100644 index 000000000..ce27dec73 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cpu-shares.md @@ -0,0 +1,50 @@ +--- +title: of +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cpus.container.md b/versioned_docs/version-5.4.1/source/markdown/options/cpus.container.md new file mode 100644 index 000000000..c005457ea --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cpus.container.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpus**=*number* + +Number of CPUs. The default is *0.0* which means no limit. This is shorthand +for **--cpu-period** and **--cpu-quota**, therefore the option cannot be specified with +**--cpu-period** or **--cpu-quota**. + +On some systems, changing the CPU limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cpuset-cpus.md b/versioned_docs/version-5.4.1/source/markdown/options/cpuset-cpus.md new file mode 100644 index 000000000..f47647296 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cpuset-cpus.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/cpuset-mems.md b/versioned_docs/version-5.4.1/source/markdown/options/cpuset-mems.md new file mode 100644 index 000000000..c91bda12e --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/cpuset-mems.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/creds.md b/versioned_docs/version-5.4.1/source/markdown/options/creds.md new file mode 100644 index 000000000..bc0920c92 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/creds.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, build, container runlabel, farm build, kube play, manifest add, manifest push, pull, push, search +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--creds**=*[username[\\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/decryption-key.md b/versioned_docs/version-5.4.1/source/markdown/options/decryption-key.md new file mode 100644 index 000000000..7c1b11139 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/decryption-key.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman artifact pull, build, create, farm build, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--decryption-key**=*key[\\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/destroy.md b/versioned_docs/version-5.4.1/source/markdown/options/destroy.md new file mode 100644 index 000000000..46ba42f31 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/destroy.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman container clone, pod clone +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--destroy** + +Remove the original <> that we are cloning once used to mimic the configuration. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/detach-keys.md b/versioned_docs/version-5.4.1/source/markdown/options/detach-keys.md new file mode 100644 index 000000000..1c4e4a2ac --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/detach-keys.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman attach, exec, run, start +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/device-cgroup-rule.md b/versioned_docs/version-5.4.1/source/markdown/options/device-cgroup-rule.md new file mode 100644 index 000000000..fd761b956 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/device-cgroup-rule.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-cgroup-rule**=*"type major\\:minor mode"* + +Add a rule to the cgroup allowed devices list. The rule is expected to be +in the format specified in the Linux kernel documentation +[admin-guide/cgroup-v1/devices](https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.html): +- *type*: `a` (all), `c` (char), or `b` (block); +- *major* and *minor*: either a number, or `*` for all; +- *mode*: a composition of `r` (read), `w` (write), and `m` (mknod(2)). diff --git a/versioned_docs/version-5.4.1/source/markdown/options/device-read-bps.md b/versioned_docs/version-5.4.1/source/markdown/options/device-read-bps.md new file mode 100644 index 000000000..1c484001b --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/device-read-bps.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman container clone, create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/device-read-iops.md b/versioned_docs/version-5.4.1/source/markdown/options/device-read-iops.md new file mode 100644 index 000000000..56fb3c4f7 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/device-read-iops.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-read-iops**=*path:rate* + +Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/device-write-bps.md b/versioned_docs/version-5.4.1/source/markdown/options/device-write-bps.md new file mode 100644 index 000000000..d804c2336 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/device-write-bps.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman container clone, create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/device-write-iops.md b/versioned_docs/version-5.4.1/source/markdown/options/device-write-iops.md new file mode 100644 index 000000000..5f96506e3 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/device-write-iops.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-write-iops**=*path:rate* + +Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/device.md b/versioned_docs/version-5.4.1/source/markdown/options/device.md new file mode 100644 index 000000000..a3074345c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/device.md @@ -0,0 +1,31 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, create, farm build, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device**=*host-device[:container-device][\\\:permissions]* + +Add a host device to the <>. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The <> only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true diff --git a/versioned_docs/version-5.4.1/source/markdown/options/digestfile.md b/versioned_docs/version-5.4.1/source/markdown/options/digestfile.md new file mode 100644 index 000000000..ebaed9925 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/digestfile.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman artifact push, manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--digestfile**=*Digestfile* + +After copying the image, write the digest of the resulting image to the file. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/dir-compress.md b/versioned_docs/version-5.4.1/source/markdown/options/dir-compress.md new file mode 100644 index 000000000..1f75825d3 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/dir-compress.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman push, save +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compress** + +Compress tarball image layers when pushing to a directory using the 'dir' transport. (default is same compression type, compressed or uncompressed, as source) diff --git a/versioned_docs/version-5.4.1/source/markdown/options/disable-compression.md b/versioned_docs/version-5.4.1/source/markdown/options/disable-compression.md new file mode 100644 index 000000000..ac7a0346d --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/disable-compression.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--disable-compression**, **-D** + +Don't compress filesystem layers when building the image unless it is required +by the location where the image is being written. This is the default setting, +because image layers are compressed automatically when they are pushed to +registries, and images being written to local storage only need to be +decompressed again to be stored. Compression can be forced in all cases by +specifying **--disable-compression=false**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/disable-content-trust.md b/versioned_docs/version-5.4.1/source/markdown/options/disable-content-trust.md new file mode 100644 index 000000000..3a3949ec5 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/disable-content-trust.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, create, pull, push, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/dns-option.container.md b/versioned_docs/version-5.4.1/source/markdown/options/dns-option.container.md new file mode 100644 index 000000000..2cc61bba1 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/dns-option.container.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns-option**=*option* + +Set custom DNS options. Invalid if using **--dns-option** with **--network** that is set to **none** or **container:**_id_. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/dns-option.image.md b/versioned_docs/version-5.4.1/source/markdown/options/dns-option.image.md new file mode 100644 index 000000000..d17d49bd2 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/dns-option.image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns-option**=*option* + +Set custom DNS options to be used during the build. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/dns-search.container.md b/versioned_docs/version-5.4.1/source/markdown/options/dns-search.container.md new file mode 100644 index 000000000..345819a24 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/dns-search.container.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns-search**=*domain* + +Set custom DNS search domains. Invalid if using **--dns-search** with **--network** that is set to **none** or **container:**_id_. +Use **--dns-search=.** to remove the search domain. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/dns-search.image.md b/versioned_docs/version-5.4.1/source/markdown/options/dns-search.image.md new file mode 100644 index 000000000..d3ad08fc1 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/dns-search.image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns-search**=*domain* + +Set custom DNS search domains to be used during the build. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/dns.md b/versioned_docs/version-5.4.1/source/markdown/options/dns.md new file mode 100644 index 000000000..659004093 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/dns.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, create, farm build, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/entrypoint.md b/versioned_docs/version-5.4.1/source/markdown/options/entrypoint.md new file mode 100644 index 000000000..3836ef28c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/entrypoint.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--entrypoint**=*"command"* | *'["command", "arg1", ...]'* + +Override the default ENTRYPOINT from the image. + +The ENTRYPOINT of an image is similar to a COMMAND +because it specifies what executable to run when the container starts, but it is +(purposely) more difficult to override. The ENTRYPOINT gives a container its +default nature or behavior. When the ENTRYPOINT is set, the +container runs as if it were that binary, complete with default options. More options can be +passed in via the COMMAND. But, if a user wants to run +something else inside the container, the **--entrypoint** option allows a new +ENTRYPOINT to be specified. + +Specify multi option commands in the form of a json string. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/env-file.md b/versioned_docs/version-5.4.1/source/markdown/options/env-file.md new file mode 100644 index 000000000..cbe44529b --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/env-file.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env-file**=*file* + +Read in a line-delimited file of environment variables. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/env-host.md b/versioned_docs/version-5.4.1/source/markdown/options/env-host.md new file mode 100644 index 000000000..f93628aed --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/env-host.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env-host** + +Use host environment inside of the container. See **Environment** note below for precedence. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.4.1/source/markdown/options/env-merge.md b/versioned_docs/version-5.4.1/source/markdown/options/env-merge.md new file mode 100644 index 000000000..f6b4bf92c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/env-merge.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env-merge**=*env* + +Preprocess default environment variables for the containers. For example +if image contains environment variable `hello=world` user can preprocess +it using `--env-merge hello=${hello}-some` so new value is `hello=world-some`. + +Please note that if the environment variable `hello` is not present in the image, +then it'll be replaced by an empty string and so using `--env-merge hello=${hello}-some` +would result in the new value of `hello=-some`, notice the leading `-` delimiter. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/env.image.md b/versioned_docs/version-5.4.1/source/markdown/options/env.image.md new file mode 100644 index 000000000..adee3575c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/env.image.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env**=*env[=value]* + +Add a value (e.g. env=*value*) to the built image. Can be used multiple times. +If neither `=` nor a *value* are specified, but *env* is set in the current +environment, the value from the current environment is added to the image. +To remove an environment variable from the built image, use the `--unsetenv` +option. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/env.md b/versioned_docs/version-5.4.1/source/markdown/options/env.md new file mode 100644 index 000000000..43754cc7f --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/env.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env**, **-e**=*env* + +Set environment variables. + +This option allows arbitrary environment variables that are available for the process to be launched inside of the container. If an environment variable is specified without a value, Podman checks the host environment for a value and set the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the container. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/expose.md b/versioned_docs/version-5.4.1/source/markdown/options/expose.md new file mode 100644 index 000000000..e06b032fa --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/expose.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--expose**=*port[/protocol]* + +Expose a port or a range of ports (e.g. **--expose=3300-3310**). +The protocol can be `tcp`, `udp` or `sctp` and if not given `tcp` is assumed. +This option matches the EXPOSE instruction for image builds and has no effect on +the actual networking rules unless **-P/--publish-all** is used to forward to all +exposed ports from random host ports. To forward specific ports from the host +into the container use the **-p/--publish** option instead. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/farm.md b/versioned_docs/version-5.4.1/source/markdown/options/farm.md new file mode 100644 index 000000000..fd37bc08a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/farm.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--farm** + +This option specifies the name of the farm to be used in the build process. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/features.md b/versioned_docs/version-5.4.1/source/markdown/options/features.md new file mode 100644 index 000000000..7a8fb8806 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/features.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman manifest add, manifest annotate +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--features**=*feature* + +Specify the features list which the list or index records as requirements for +the image. This option is rarely used. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/file.md b/versioned_docs/version-5.4.1/source/markdown/options/file.md new file mode 100644 index 000000000..e364c56d5 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/file.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--file**, **-f**=*Containerfile* + +Specifies a Containerfile which contains instructions for building the image, +either a local file or an **http** or **https** URL. If more than one +Containerfile is specified, *FROM* instructions are only be accepted from the +last specified file. + +If a build context is not specified, and at least one Containerfile is a +local file, the directory in which it resides is used as the build +context. + +Specifying the option `-f -` causes the Containerfile contents to be read from stdin. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/follow.md b/versioned_docs/version-5.4.1/source/markdown/options/follow.md new file mode 100644 index 000000000..3990912c5 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/follow.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--follow**, **-f** + +Follow log output. Default is false. + +Note: When following a <> which is removed by `podman <> rm` +or removed on exit (`podman run --rm ...`), there is a chance that the log +file is removed before `podman<< pod|>> logs` reads the final content. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/force-compression.md b/versioned_docs/version-5.4.1/source/markdown/options/force-compression.md new file mode 100644 index 000000000..b79d85b55 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/force-compression.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--force-compression** + +If set, push uses the specified compression algorithm even if the destination contains a differently-compressed variant already. +Defaults to `true` if `--compression-format` is explicitly specified on the command-line, `false` otherwise. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/force-rm.md b/versioned_docs/version-5.4.1/source/markdown/options/force-rm.md new file mode 100644 index 000000000..26771e41f --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/force-rm.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--force-rm** + +Always remove intermediate containers after a build, even if the build fails (default true). diff --git a/versioned_docs/version-5.4.1/source/markdown/options/format.md b/versioned_docs/version-5.4.1/source/markdown/options/format.md new file mode 100644 index 000000000..b3f51c542 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/format.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--format** + +Control the format for the built image's manifest and configuration data. +Recognized formats include *oci* (OCI image-spec v1.0, the default) and +*docker* (version 2, using schema format 2 for the manifest). + +Note: You can also override the default format by setting the BUILDAH\_FORMAT +environment variable. `export BUILDAH_FORMAT=docker` diff --git a/versioned_docs/version-5.4.1/source/markdown/options/from.md b/versioned_docs/version-5.4.1/source/markdown/options/from.md new file mode 100644 index 000000000..72cd946ad --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/from.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--from** + +Overrides the first `FROM` instruction within the Containerfile. If there are multiple +FROM instructions in a Containerfile, only the first is changed. + +With the remote podman client, not all container transports work as +expected. For example, oci-archive:/x.tar references /x.tar on the remote +machine instead of on the client. When using podman remote clients it is +best to restrict use to *containers-storage*, and *docker:// transports*. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/gidmap.container.md b/versioned_docs/version-5.4.1/source/markdown/options/gidmap.container.md new file mode 100644 index 000000000..21bfb5f22 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/gidmap.container.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--gidmap**=*[flags]container_uid\:from_uid[\\:amount]* + +Run the container in a new user namespace using the supplied GID mapping. This +option conflicts with the **--userns** and **--subgidname** options. This +option provides a way to map host GIDs to container GIDs in the same way as +__--uidmap__ maps host UIDs to container UIDs. For details see __--uidmap__. + +Note: the **--gidmap** option cannot be called in conjunction with the **--pod** option as a gidmap cannot be set on the container level when in a pod. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/gidmap.pod.md b/versioned_docs/version-5.4.1/source/markdown/options/gidmap.pod.md new file mode 100644 index 000000000..337cc5ee7 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/gidmap.pod.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--gidmap**=*pod_gid\:host_gid\\:amount* + +GID map for the user namespace. Using this flag runs all containers in the pod with user namespace enabled. +It conflicts with the **--userns** and **--subgidname** flags. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/gpus.md b/versioned_docs/version-5.4.1/source/markdown/options/gpus.md new file mode 100644 index 000000000..5b66849c6 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/gpus.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/group-add.md b/versioned_docs/version-5.4.1/source/markdown/options/group-add.md new file mode 100644 index 000000000..f14431291 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/group-add.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, create, farm build, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.4.1/source/markdown/options/group-entry.md b/versioned_docs/version-5.4.1/source/markdown/options/group-entry.md new file mode 100644 index 000000000..a06ff5e48 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/group-entry.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--group-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/group` file within the container when `--user` is used. + +The variables $GROUPNAME, $GID, and $USERLIST are automatically replaced with their value at runtime if present. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/health-cmd.md b/versioned_docs/version-5.4.1/source/markdown/options/health-cmd.md new file mode 100644 index 000000000..d4f9d721c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/health-cmd.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set or alter a healthcheck command for a container. The command is a command to be executed inside the +container that determines the container health. The command is required for other healthcheck options +to be applied. A value of **none** disables existing healthchecks. + +Multiple options can be passed in the form of a JSON array; otherwise, the command is interpreted +as an argument to **/bin/sh -c**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/health-interval.md b/versioned_docs/version-5.4.1/source/markdown/options/health-interval.md new file mode 100644 index 000000000..8bd57b121 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/health-interval.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-interval**=*interval* + +Set an interval for the healthchecks. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/health-log-destination.md b/versioned_docs/version-5.4.1/source/markdown/options/health-log-destination.md new file mode 100644 index 000000000..fdaa25e71 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/health-log-destination.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-log-destination**=*directory_path* + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) (Default: local) + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/health-max-log-count.md b/versioned_docs/version-5.4.1/source/markdown/options/health-max-log-count.md new file mode 100644 index 000000000..b12fccd40 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/health-max-log-count.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-max-log-count**=*number of stored logs* + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) (Default: 5 attempts) diff --git a/versioned_docs/version-5.4.1/source/markdown/options/health-max-log-size.md b/versioned_docs/version-5.4.1/source/markdown/options/health-max-log-size.md new file mode 100644 index 000000000..6a47d113e --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/health-max-log-size.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-max-log-size**=*size of stored logs* + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) (Default: 500 characters) diff --git a/versioned_docs/version-5.4.1/source/markdown/options/health-on-failure.md b/versioned_docs/version-5.4.1/source/markdown/options/health-on-failure.md new file mode 100644 index 000000000..c4262581f --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/health-on-failure.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-on-failure**=*action* + +Action to take once the container transitions to an unhealthy state. The default is **none**. + +- **none**: Take no action. +- **kill**: Kill the container. +- **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. +- **stop**: Stop the container. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/health-retries.md b/versioned_docs/version-5.4.1/source/markdown/options/health-retries.md new file mode 100644 index 000000000..c129901db --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/health-retries.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-retries**=*retries* + +The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is **3**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/health-start-period.md b/versioned_docs/version-5.4.1/source/markdown/options/health-start-period.md new file mode 100644 index 000000000..537344b61 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/health-start-period.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-start-period**=*period* + +The initialization time needed for a container to bootstrap. The value can be expressed in time format like +**2m3s**. The default value is **0s**. + +Note: The health check command is executed as soon as a container is started, if the health check is successful +the container's health state will be updated to `healthy`. However, if the health check fails, the health state will +stay as `starting` until either the health check is successful or until the `--health-start-period` time is over. If the +health check command fails after the `--health-start-period` time is over, the health state will be updated to `unhealthy`. +The health check command is executed periodically based on the value of `--health-interval`. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/health-startup-cmd.md b/versioned_docs/version-5.4.1/source/markdown/options/health-startup-cmd.md new file mode 100644 index 000000000..027abc8a7 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/health-startup-cmd.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set a startup healthcheck command for a container. This command is executed inside the container and is used to gate the regular +healthcheck. When the startup command succeeds, the regular healthcheck begins and the startup healthcheck ceases. Optionally, +if the command fails for a set number of attempts, the container is restarted. A startup healthcheck can be used to ensure that +containers with an extended startup period are not marked as unhealthy until they are fully started. Startup healthchecks can only be +used when a regular healthcheck (from the container's image or the **--health-cmd** option) is also set. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/health-startup-interval.md b/versioned_docs/version-5.4.1/source/markdown/options/health-startup-interval.md new file mode 100644 index 000000000..1d0bb62cd --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/health-startup-interval.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-interval**=*interval* + +Set an interval for the startup healthcheck. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/health-startup-retries.md b/versioned_docs/version-5.4.1/source/markdown/options/health-startup-retries.md new file mode 100644 index 000000000..80408ecc3 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/health-startup-retries.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-retries**=*retries* + +The number of attempts allowed before the startup healthcheck restarts the container. If set to **0**, the container is never restarted. The default is **0**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/health-startup-success.md b/versioned_docs/version-5.4.1/source/markdown/options/health-startup-success.md new file mode 100644 index 000000000..f8482d15c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/health-startup-success.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-success**=*retries* + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value +of **0** means that any success begins the regular healthcheck. The default is **0**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/health-startup-timeout.md b/versioned_docs/version-5.4.1/source/markdown/options/health-startup-timeout.md new file mode 100644 index 000000000..7abcbb088 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/health-startup-timeout.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-timeout**=*timeout* + +The maximum time a startup healthcheck command has to complete before it is marked as failed. The value can be expressed in a time +format like **2m3s**. The default value is **30s**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/health-timeout.md b/versioned_docs/version-5.4.1/source/markdown/options/health-timeout.md new file mode 100644 index 000000000..afe8b9fe1 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/health-timeout.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-timeout**=*timeout* + +The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the +value can be expressed in a time format such as **1m22s**. The default value is **30s**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/help.md b/versioned_docs/version-5.4.1/source/markdown/options/help.md new file mode 100644 index 000000000..daa82a762 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/help.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--help**, **-h** + +Print usage statement diff --git a/versioned_docs/version-5.4.1/source/markdown/options/hooks-dir.md b/versioned_docs/version-5.4.1/source/markdown/options/hooks-dir.md new file mode 100644 index 000000000..08db5d5c8 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/hooks-dir.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hooks-dir**=*path* + +Each *.json file in the path configures a hook for buildah build containers. For more details on the syntax of the JSON files and the semantics of hook injection. Buildah currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. + +This option may be set multiple times; paths from later options have higher precedence. + +For the annotation conditions, buildah uses any annotations set in the generated OCI configuration. + +For the bind-mount conditions, only mounts explicitly requested by the caller via --volume are considered. Bind mounts that buildah inserts by default (e.g. /dev/shm) are not considered. + +If --hooks-dir is unset for root callers, Buildah currently defaults to /usr/share/containers/oci/hooks.d and /etc/containers/oci/hooks.d in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting --hooks-dir. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/hostname.container.md b/versioned_docs/version-5.4.1/source/markdown/options/hostname.container.md new file mode 100644 index 000000000..7ddf14f2f --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/hostname.container.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hostname**, **-h**=*name* + +Set the container's hostname inside the container. + +This option can only be used with a private UTS namespace `--uts=private` +(default). If `--pod` is given and the pod shares the same UTS namespace +(default), the pod's hostname is used. The given hostname is also added to the +`/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). diff --git a/versioned_docs/version-5.4.1/source/markdown/options/hostname.pod.md b/versioned_docs/version-5.4.1/source/markdown/options/hostname.pod.md new file mode 100644 index 000000000..54b7bdc70 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/hostname.pod.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hostname**=*name* + +Set the pod's hostname inside all containers. + +The given hostname is also added to the `/etc/hosts` file using the container's +primary IP address (also see the **--add-host** option). diff --git a/versioned_docs/version-5.4.1/source/markdown/options/hosts-file.md b/versioned_docs/version-5.4.1/source/markdown/options/hosts-file.md new file mode 100644 index 000000000..a3e2c29b0 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/hosts-file.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hosts-file**=*path* | *none* | *image* + +Base file to create the `/etc/hosts` file inside the container. This must either +be an absolute path to a file on the host system, or one of the following +special flags: + "" Follow the `base_hosts_file` configuration in _containers.conf_ (the default) + `none` Do not use a base file (i.e. start with an empty file) + `image` Use the container image's `/etc/hosts` file as base file diff --git a/versioned_docs/version-5.4.1/source/markdown/options/hostuser.md b/versioned_docs/version-5.4.1/source/markdown/options/hostuser.md new file mode 100644 index 000000000..06d480fea --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/hostuser.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hostuser**=*name* + +Add a user account to /etc/passwd from the host to the container. The Username +or UID must exist on the host system. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/http-proxy.md b/versioned_docs/version-5.4.1/source/markdown/options/http-proxy.md new file mode 100644 index 000000000..74a67abf4 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/http-proxy.md @@ -0,0 +1,25 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, create, farm build, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/identity-label.md b/versioned_docs/version-5.4.1/source/markdown/options/identity-label.md new file mode 100644 index 000000000..c74c76a35 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/identity-label.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--identity-label** + +Adds default identity label `io.buildah.version` if set. (default true). diff --git a/versioned_docs/version-5.4.1/source/markdown/options/ignore.md b/versioned_docs/version-5.4.1/source/markdown/options/ignore.md new file mode 100644 index 000000000..eaa4758d1 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/ignore.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman pod rm, pod stop, rm, stop +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ignore**, **-i** + +Ignore errors when specified <> are not in the container store. A user +might have decided to manually remove a <> which leads to a failure +during the ExecStop directive of a systemd service referencing that <>. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/ignorefile.md b/versioned_docs/version-5.4.1/source/markdown/options/ignorefile.md new file mode 100644 index 000000000..f3d7f1994 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/ignorefile.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ignorefile** + +Path to an alternative .containerignore file. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/iidfile.md b/versioned_docs/version-5.4.1/source/markdown/options/iidfile.md new file mode 100644 index 000000000..1084f3dcd --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/iidfile.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--iidfile**=*ImageIDfile* + +Write the built image's ID to the file. When `--platform` is specified more than once, attempting to use this option triggers an error. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/image-volume.md b/versioned_docs/version-5.4.1/source/markdown/options/image-volume.md new file mode 100644 index 000000000..a307cde52 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/image-volume.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--image-volume**=**bind** | *tmpfs* | *ignore* + +Tells Podman how to handle the builtin image volumes. Default is **bind**. + +- **bind**: An anonymous named volume is created and mounted into the container. +- **tmpfs**: The volume is mounted onto the container as a tmpfs, which allows the users to create +content that disappears when the container is stopped. +- **ignore**: All volumes are just ignored and no action is taken. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/infra-command.md b/versioned_docs/version-5.4.1/source/markdown/options/infra-command.md new file mode 100644 index 000000000..bfd0aa37b --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/infra-command.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--infra-command**=*command* + +The command that is run to start the infra container. Default: "/pause". diff --git a/versioned_docs/version-5.4.1/source/markdown/options/infra-conmon-pidfile.md b/versioned_docs/version-5.4.1/source/markdown/options/infra-conmon-pidfile.md new file mode 100644 index 000000000..f846f6d89 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/infra-conmon-pidfile.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--infra-conmon-pidfile**=*file* + +Write the pid of the infra container's **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to manage Podman containers and pods. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/infra-name.md b/versioned_docs/version-5.4.1/source/markdown/options/infra-name.md new file mode 100644 index 000000000..35bd8be25 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/infra-name.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--infra-name**=*name* + +The name that is used for the pod's infra container. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/init-path.md b/versioned_docs/version-5.4.1/source/markdown/options/init-path.md new file mode 100644 index 000000000..6940502c2 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/init-path.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--init-path**=*path* + +Path to the container-init binary. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/init.md b/versioned_docs/version-5.4.1/source/markdown/options/init.md new file mode 100644 index 000000000..246ce5566 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/init.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--init** + +Run an init inside the container that forwards signals and reaps processes. +The container-init binary is mounted at `/run/podman-init`. +Mounting over `/run` breaks container execution. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/interactive.md b/versioned_docs/version-5.4.1/source/markdown/options/interactive.md new file mode 100644 index 000000000..55153ab99 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/interactive.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, exec, run, start +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/ip.md b/versioned_docs/version-5.4.1/source/markdown/options/ip.md new file mode 100644 index 000000000..47e847447 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/ip.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ip**=*ipv4* + +Specify a static IPv4 address for the <>, for example **10.88.64.128**. +This option can only be used if the <> is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the <> is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IP address pool (default **10.88.0.0/16**). + +To specify multiple static IP addresses per <>, set multiple networks using the **--network** option with a static IP address specified for each using the `ip` mode for that option. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/ip6.md b/versioned_docs/version-5.4.1/source/markdown/options/ip6.md new file mode 100644 index 000000000..ea728afa3 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/ip6.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ip6**=*ipv6* + +Specify a static IPv6 address for the <>, for example **fd46:db93:aa76\:ac37::10**. +This option can only be used if the <> is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the <> is not joining another container's network namespace via **--network=container\\:_id_**. +The address must be within the network's IPv6 address pool. + +To specify multiple static IPv6 addresses per <>, set multiple networks using the **--network** option with a static IPv6 address specified for each using the `ip6` mode for that option. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/ipc.image.md b/versioned_docs/version-5.4.1/source/markdown/options/ipc.image.md new file mode 100644 index 000000000..d9e0cc453 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/ipc.image.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ipc**=*how* + +Sets the configuration for IPC namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate +that a new IPC namespace is created, or it can be "host" to indicate +that the IPC namespace in which `podman` itself is being run is reused, +or it can be the path to an IPC namespace which is already in use by +another process. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/ipc.md b/versioned_docs/version-5.4.1/source/markdown/options/ipc.md new file mode 100644 index 000000000..cb2637371 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/ipc.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ipc**=*ipc* + +Set the IPC namespace mode for a container. The default is to create +a private IPC namespace. + +- "": Use Podman's default, defined in containers.conf. +- **container:**_id_: reuses another container's shared memory, semaphores, and message queues +- **host**: use the host's shared memory, semaphores, and message queues inside the container. Note: the host mode gives the container full access to local shared memory and is therefore considered insecure. +- **none**: private IPC namespace, with /dev/shm not mounted. +- **ns:**_path_: path to an IPC namespace to join. +- **private**: private IPC namespace. +- **shareable**: private IPC namespace with a possibility to share it with other containers. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/isolation.md b/versioned_docs/version-5.4.1/source/markdown/options/isolation.md new file mode 100644 index 000000000..7d4dd05fd --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/isolation.md @@ -0,0 +1,22 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--isolation**=*type* + +Controls what type of isolation is used for running processes as part of `RUN` +instructions. Recognized types include *oci* (OCI-compatible runtime, the +default), *rootless* (OCI-compatible runtime invoked using a modified +configuration and its --rootless option enabled, with *--no-new-keyring +--no-pivot* added to its *create* invocation, with network and UTS namespaces +disabled, and IPC, PID, and user namespaces enabled; the default for +unprivileged users), and *chroot* (an internal wrapper that leans more toward +chroot(1) than container technology). + +Note: You can also override the default isolation type by setting the +BUILDAH\_ISOLATION environment variable. `export BUILDAH_ISOLATION=oci` diff --git a/versioned_docs/version-5.4.1/source/markdown/options/jobs.md b/versioned_docs/version-5.4.1/source/markdown/options/jobs.md new file mode 100644 index 000000000..3c715c0e7 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/jobs.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--jobs**=*number* + +Run up to N concurrent stages in parallel. If the number of jobs is greater +than 1, stdin is read from /dev/null. If 0 is specified, then there is +no limit in the number of jobs that run in parallel. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/label-file.md b/versioned_docs/version-5.4.1/source/markdown/options/label-file.md new file mode 100644 index 000000000..d169acbae --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/label-file.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--label-file**=*file* + +Read in a line-delimited file of labels. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/label.image.md b/versioned_docs/version-5.4.1/source/markdown/options/label.image.md new file mode 100644 index 000000000..5616809eb --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/label.image.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--label**=*label* + +Add an image *label* (e.g. label=*value*) to the image metadata. Can be used +multiple times. + +Users can set a special LABEL **io.containers.capabilities=CAP1,CAP2,CAP3** in +a Containerfile that specifies the list of Linux capabilities required for the +container to run properly. This label specified in a container image tells +Podman to run the container with just these capabilities. Podman launches the +container with just the specified capabilities, as long as this list of +capabilities is a subset of the default list. + +If the specified capabilities are not in the default set, Podman prints an error +message and runs the container with the default capabilities. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/label.md b/versioned_docs/version-5.4.1/source/markdown/options/label.md new file mode 100644 index 000000000..8fae2b9a2 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/label.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--label**, **-l**=*key=value* + +Add metadata to a <>. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/latest.md b/versioned_docs/version-5.4.1/source/markdown/options/latest.md new file mode 100644 index 000000000..7c0927eb0 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/latest.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman attach, container diff, container inspect, diff, exec, init, inspect, kill, logs, mount, network reload, pause, pod inspect, pod kill, pod logs, pod rm, pod start, pod stats, pod stop, pod top, port, restart, rm, start, stats, stop, top, unmount, unpause, wait +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--latest**, **-l** + +Instead of providing the <> name or ID, use the last created <>. +Note: the last started <> can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) diff --git a/versioned_docs/version-5.4.1/source/markdown/options/layer-label.md b/versioned_docs/version-5.4.1/source/markdown/options/layer-label.md new file mode 100644 index 000000000..d92e2a669 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/layer-label.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--layer-label**=*label[=value]* + +Add an intermediate image *label* (e.g. label=*value*) to the intermediate +image metadata. It can be used multiple times. + +If *label* is named, but neither `=` nor a `value` is provided, then +the *label* is set to an empty value. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/layers.md b/versioned_docs/version-5.4.1/source/markdown/options/layers.md new file mode 100644 index 000000000..928b5ddad --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/layers.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--layers** + +Cache intermediate images during the build process (Default is `true`). + +Note: You can also override the default value of layers by setting the +BUILDAH\_LAYERS environment variable. `export BUILDAH_LAYERS=true` diff --git a/versioned_docs/version-5.4.1/source/markdown/options/link-local-ip.md b/versioned_docs/version-5.4.1/source/markdown/options/link-local-ip.md new file mode 100644 index 000000000..e3f002929 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/link-local-ip.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--link-local-ip**=*ip* + +Not implemented. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/log-driver.md b/versioned_docs/version-5.4.1/source/markdown/options/log-driver.md new file mode 100644 index 000000000..c8030e9ee --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/log-driver.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--log-driver**=*driver* + +Logging driver for the container. Currently available options are **k8s-file**, **journald**, **none**, **passthrough** and **passthrough-tty**, with **json-file** aliased to **k8s-file** for scripting compatibility. (Default **journald**). + +The podman info command below displays the default log-driver for the system. +``` +$ podman info --format '{{ .Host.LogDriver }}' +journald +``` +The **passthrough** driver passes down the standard streams (stdin, stdout, stderr) to the +container. It is not allowed with the remote Podman client, including Mac and Windows (excluding WSL2) machines, and on a tty, since it is +vulnerable to attacks via TIOCSTI. + +The **passthrough-tty** driver is the same as **passthrough** except that it also allows it to be used on a TTY if the user really wants it. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/log-opt.md b/versioned_docs/version-5.4.1/source/markdown/options/log-opt.md new file mode 100644 index 000000000..fec08b194 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/log-opt.md @@ -0,0 +1,25 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, kube play, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--log-opt**=*name=value* + +Logging driver specific options. + +Set custom logging configuration. The following *name*s are supported: + +**path**: specify a path to the log file + (e.g. **--log-opt path=/var/log/container/mycontainer.json**); + +**max-size**: specify a max size of the log file + (e.g. **--log-opt max-size=10mb**); + +**tag**: specify a custom log tag for the container + (e.g. **--log-opt tag="{{.ImageName}}"**. +It supports the same keys as **podman inspect --format**. +This option is currently supported only by the **journald** log driver. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/logfile.md b/versioned_docs/version-5.4.1/source/markdown/options/logfile.md new file mode 100644 index 000000000..a7f44a2e1 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/logfile.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--logfile**=*filename* + +Log output which is sent to standard output and standard error to the +specified file instead of to standard output and standard error. +This option is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/mac-address.md b/versioned_docs/version-5.4.1/source/markdown/options/mac-address.md new file mode 100644 index 000000000..709546aeb --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/mac-address.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--mac-address**=*address* + +<> network interface MAC address (e.g. 92:d0\:c6:0a:29:33) +This option can only be used if the <> is joined to only a single network - i.e., **--network=_network-name_** is used at most once - +and if the <> is not joining another container's network namespace via **--network=container\:_id_**. + +Remember that the MAC address in an Ethernet network must be unique. +The IPv6 link-local address is based on the device's MAC address +according to RFC4862. + +To specify multiple static MAC addresses per <>, set multiple networks using the **--network** option with a static MAC address specified for each using the `mac` mode for that option. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/manifest.md b/versioned_docs/version-5.4.1/source/markdown/options/manifest.md new file mode 100644 index 000000000..17c593e37 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/manifest.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--manifest**=*manifest* + +Name of the manifest list to which the image is added. Creates the manifest list if it does not exist. This option is useful for building multi architecture images. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/memory-reservation.md b/versioned_docs/version-5.4.1/source/markdown/options/memory-reservation.md new file mode 100644 index 000000000..69ac21f45 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/memory-reservation.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman container clone, create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/memory-swap.md b/versioned_docs/version-5.4.1/source/markdown/options/memory-swap.md new file mode 100644 index 000000000..11096dd94 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/memory-swap.md @@ -0,0 +1,22 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/memory-swappiness.md b/versioned_docs/version-5.4.1/source/markdown/options/memory-swappiness.md new file mode 100644 index 000000000..7697c1bf7 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/memory-swappiness.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman container clone, create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/memory.md b/versioned_docs/version-5.4.1/source/markdown/options/memory.md new file mode 100644 index 000000000..c52389dcc --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/memory.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/mount.md b/versioned_docs/version-5.4.1/source/markdown/options/mount.md new file mode 100644 index 000000000..5a2687800 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/mount.md @@ -0,0 +1,112 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--mount**=*type=TYPE,TYPE-SPECIFIC-OPTION[,...]* + +Attach a filesystem mount to the container + +Current supported mount TYPEs are **bind**, **devpts**, **glob**, **image**, **ramfs**, **tmpfs** and **volume**. + +Options common to all mount types: + +- *src*, *source*: mount source spec for **bind**, **glob**, and **volume**. + Mandatory for **bind** and **glob**. + +- *dst*, *destination*, *target*: mount destination spec. + +When source globs are specified without the destination directory, +the files and directories are mounted with their complete path +within the container. When the destination is specified, the +files and directories matching the glob on the base file name +on the destination directory are mounted. The option +`type=glob,src=/foo*,destination=/tmp/bar` tells container engines +to mount host files matching /foo* to the /tmp/bar/ +directory in the container. + +Options specific to type=**volume**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *idmap*: If specified, create an idmapped mount to the target user namespace in the container. + The idmap option is only supported by Podman in rootful mode. The Linux kernel does not allow the use of idmaped file systems for unprivileged users. + The idmap option supports a custom mapping that can be different than the user namespace used by the container. + The mapping can be specified after the idmap option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the first value is the + start of the backing file system IDs that are mapped to the second value on the host. The length of this mapping is given in the third value. + Multiple ranges are separated with #. If the specified mapping is prepended with a '@' then the mapping is considered relative to the container + user namespace. The host ID for the mapping is changed to account for the relative position of the container user in the container user namespace. + +Options specific to type=**image**: + +- *rw*, *readwrite*: *true* or *false* (default if unspecified: *false*). + +- *subpath*: Mount only a specific path within the image, instead of the whole image. + +Options specific to **bind** and **glob**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *bind-propagation*: *shared*, *slave*, *private*, *unbindable*, *rshared*, *rslave*, *runbindable*, or **rprivate** (default).[[1]](#Footnote1) See also mount(2). + +- *bind-nonrecursive*: do not set up a recursive bind mount. By default it is recursive. + +- *relabel*: *shared*, *private*. + +- *idmap*: *true* or *false* (default if unspecified: *false*). If true, create an idmapped mount to the target user namespace in the container. The idmap option is only supported by Podman in rootful mode. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *no-dereference*: do not dereference symlinks but copy the link source into the mount destination. + +Options specific to type=**tmpfs** and **ramfs**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *tmpfs-size*: Size of the tmpfs/ramfs mount, in bytes. Unlimited by default in Linux. + +- *tmpfs-mode*: Octal file mode of the tmpfs/ramfs (e.g. 700 or 0700.). + +- *tmpcopyup*: Enable copyup from the image directory at the same location to the tmpfs/ramfs. Used by default. + +- *notmpcopyup*: Disable copying files from the image to the tmpfs/ramfs. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +Options specific to type=**devpts**: + +- *uid*: numeric UID of the file owner (default: 0). + +- *gid*: numeric GID of the file owner (default: 0). + +- *mode*: octal permission mask for the file (default: 600). + +- *max*: maximum number of PTYs (default: 1048576). + +Examples: + +- `type=bind,source=/path/on/host,destination=/path/in/container` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared,U=true` + +- `type=devpts,destination=/dev/pts` + +- `type=glob,src=/usr/lib/libfoo*,destination=/usr/lib,ro=true` + +- `type=image,source=fedora,destination=/fedora-image,rw=true` + +- `type=ramfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,destination=/path/in/container,noswap` + +- `type=volume,source=vol1,destination=/path/in/container,ro=true` diff --git a/versioned_docs/version-5.4.1/source/markdown/options/name.container.md b/versioned_docs/version-5.4.1/source/markdown/options/name.container.md new file mode 100644 index 000000000..846bed999 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/name.container.md @@ -0,0 +1,25 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--name**=*name* + +Assign a name to the container. + +The operator can identify a container in three ways: + +- UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”); +- UUID short identifier (“f78375b1c487”); +- Name (“jonah”). + +Podman generates a UUID for each container, and if no name is assigned to the +container using **--name**, Podman generates a random string name. The name can +be useful as a more human-friendly way to identify containers. This works for +both background and foreground containers. The container's name is also added +to the `/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). diff --git a/versioned_docs/version-5.4.1/source/markdown/options/names.md b/versioned_docs/version-5.4.1/source/markdown/options/names.md new file mode 100644 index 000000000..5795d2997 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/names.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--names**, **-n** + +Output the container names instead of the container IDs in the log. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/network-alias.md b/versioned_docs/version-5.4.1/source/markdown/options/network-alias.md new file mode 100644 index 000000000..6365982f7 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/network-alias.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--network-alias**=*alias* + +Add a network-scoped alias for the <>, setting the alias for all networks that the container joins. To set a +name only for a specific network, use the alias option as described under the **--network** option. +If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. This option can be specified multiple times. +NOTE: When using CNI a <> only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/network.image.md b/versioned_docs/version-5.4.1/source/markdown/options/network.image.md new file mode 100644 index 000000000..3725d4ea6 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/network.image.md @@ -0,0 +1,68 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--network**=*mode*, **--net** + +Sets the configuration for network namespaces when handling `RUN` instructions. + +Valid _mode_ values are: + +- **none**: no networking. +- **host**: use the Podman host network stack. Note: the host mode gives the +container full access to local system services such as D-bus and is therefore +considered insecure. +- **ns:**_path_: path to a network namespace to join. +- **private**: create a new namespace for the container (default) +- **\**: Join the network with the given name or ID, e.g. use `--network mynet` to join the network with the name mynet. Only supported for rootful users. +- **slirp4netns[\\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=MTU**: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=CIDR**: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=INTERFACE**: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=IPv4**: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=INTERFACE**: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=IPv6**: Specify the outbound ipv6 address slirp binds to. +- **pasta[\\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance diff --git a/versioned_docs/version-5.4.1/source/markdown/options/network.md b/versioned_docs/version-5.4.1/source/markdown/options/network.md new file mode 100644 index 000000000..316447d17 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/network.md @@ -0,0 +1,92 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, kube play, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--network**=*mode*, **--net** + +Set the network mode for the <>. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured, to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance diff --git a/versioned_docs/version-5.4.1/source/markdown/options/no-cache.md b/versioned_docs/version-5.4.1/source/markdown/options/no-cache.md new file mode 100644 index 000000000..b77040400 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/no-cache.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-cache** + +Do not use existing cached images for the container build. Build from the start with a new set of cached layers. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/no-healthcheck.md b/versioned_docs/version-5.4.1/source/markdown/options/no-healthcheck.md new file mode 100644 index 000000000..4cea7f1a2 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/no-healthcheck.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-healthcheck** + +Disable any defined healthchecks for container. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/no-hostname.md b/versioned_docs/version-5.4.1/source/markdown/options/no-hostname.md new file mode 100644 index 000000000..abf742147 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/no-hostname.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, create, farm build, kube play, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/no-hosts.md b/versioned_docs/version-5.4.1/source/markdown/options/no-hosts.md new file mode 100644 index 000000000..460ffbdd2 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/no-hosts.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, create, farm build, kube play, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the <>. + +Podman assumes control over the <>'s `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/no-reset.md b/versioned_docs/version-5.4.1/source/markdown/options/no-reset.md new file mode 100644 index 000000000..001425f85 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/no-reset.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman pod stats, stats +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-reset** + +Do not clear the terminal/screen in between reporting intervals diff --git a/versioned_docs/version-5.4.1/source/markdown/options/no-stream.md b/versioned_docs/version-5.4.1/source/markdown/options/no-stream.md new file mode 100644 index 000000000..9001f6b85 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/no-stream.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman pod stats, stats +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-stream** + +Disable streaming <<|pod >>stats and only pull the first result, default setting is false diff --git a/versioned_docs/version-5.4.1/source/markdown/options/no-trunc.md b/versioned_docs/version-5.4.1/source/markdown/options/no-trunc.md new file mode 100644 index 000000000..d47317e3c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/no-trunc.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman artifact ls, images +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-trunc** + +Do not truncate the output (default *false*). diff --git a/versioned_docs/version-5.4.1/source/markdown/options/noheading.md b/versioned_docs/version-5.4.1/source/markdown/options/noheading.md new file mode 100644 index 000000000..2b86aaeac --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/noheading.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman artifact ls, image trust, images, machine list, network ls, pod ps, secret ls, volume ls +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--noheading**, **-n** + +Omit the table headings from the listing. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/omit-history.md b/versioned_docs/version-5.4.1/source/markdown/options/omit-history.md new file mode 100644 index 000000000..5f23df694 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/omit-history.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--omit-history** + +Omit build history information in the built image. (default false). + +This option is useful for the cases where end users explicitly +want to set `--omit-history` to omit the optional `History` from +built images or when working with images built using build tools that +do not include `History` information in their images. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/oom-kill-disable.md b/versioned_docs/version-5.4.1/source/markdown/options/oom-kill-disable.md new file mode 100644 index 000000000..0987b8444 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/oom-kill-disable.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--oom-kill-disable** + +Whether to disable OOM Killer for the container or not. + +This flag is not supported on cgroups V2 systems. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/oom-score-adj.md b/versioned_docs/version-5.4.1/source/markdown/options/oom-score-adj.md new file mode 100644 index 000000000..6be9ae813 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/oom-score-adj.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--oom-score-adj**=*num* + +Tune the host's OOM preferences for containers (accepts values from **-1000** to **1000**). + +When running in rootless mode, the specified value can't be lower than +the oom_score_adj for the current process. In this case, the +oom-score-adj is clamped to the current process value. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/os-feature.md b/versioned_docs/version-5.4.1/source/markdown/options/os-feature.md new file mode 100644 index 000000000..4d424c5c4 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/os-feature.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os-feature**=*feature* + +Set the name of a required operating system *feature* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS feature list is kept, if the base image specified any. This option is typically only meaningful when the image's OS is Windows. + +If *feature* has a trailing `-`, then the *feature* is removed from the set of required features which is listed in the image. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/os-version.image.md b/versioned_docs/version-5.4.1/source/markdown/options/os-version.image.md new file mode 100644 index 000000000..4f67082a3 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/os-version.image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os-version**=*version* + +Set the exact required operating system *version* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS version is kept, if the base image specified one. This option is typically only meaningful when the image's OS is Windows, and is typically set in Windows base images, so using this option is usually unnecessary. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/os-version.md b/versioned_docs/version-5.4.1/source/markdown/options/os-version.md new file mode 100644 index 000000000..13f2b9f9e --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/os-version.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman manifest add, manifest annotate +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os-version**=*version* + +Specify the OS version which the list or index records as a requirement for the +image. This option is rarely used. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/os.md b/versioned_docs/version-5.4.1/source/markdown/options/os.md new file mode 100644 index 000000000..23c72a9b4 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/os.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os**=*string* + +Set the OS of the image to be built, and that of the base image to be pulled, if the build uses one, instead of using the current operating system of the build host. Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/os.pull.md b/versioned_docs/version-5.4.1/source/markdown/options/os.pull.md new file mode 100644 index 000000000..4b665d9cb --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/os.pull.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os**=*OS* + +Override the OS, defaults to hosts, of the image to be pulled. For example, `windows`. +Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/passwd-entry.md b/versioned_docs/version-5.4.1/source/markdown/options/passwd-entry.md new file mode 100644 index 000000000..fcc8ef8e1 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/passwd-entry.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--passwd-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/passwd` file within the container when `--passwd` is used. + +The variables $USERNAME, $UID, $GID, $NAME, $HOME are automatically replaced with their value at runtime. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/personality.md b/versioned_docs/version-5.4.1/source/markdown/options/personality.md new file mode 100644 index 000000000..44435a112 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/personality.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--personality**=*persona* + +Personality sets the execution domain via Linux personality(2). diff --git a/versioned_docs/version-5.4.1/source/markdown/options/pid.container.md b/versioned_docs/version-5.4.1/source/markdown/options/pid.container.md new file mode 100644 index 000000000..1c7db7749 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/pid.container.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pid**=*mode* + +Set the PID namespace mode for the container. +The default is to create a private PID namespace for the container. + +- **container:**_id_: join another container's PID namespace; +- **host**: use the host's PID namespace for the container. Note the host mode gives the container full access to local PID and is therefore considered insecure; +- **ns:**_path_: join the specified PID namespace; +- **private**: create a new namespace for the container (default). diff --git a/versioned_docs/version-5.4.1/source/markdown/options/pid.image.md b/versioned_docs/version-5.4.1/source/markdown/options/pid.image.md new file mode 100644 index 000000000..c4621ae95 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/pid.image.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pid**=*pid* + +Sets the configuration for PID namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new PID namespace is created, or it can be "host" to indicate that the PID namespace in which `podman` itself is being run is reused, or it can be the path to a PID namespace which is already in use by another +process. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/pid.pod.md b/versioned_docs/version-5.4.1/source/markdown/options/pid.pod.md new file mode 100644 index 000000000..7daab4ca8 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/pid.pod.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pid**=*pid* + +Set the PID mode for the pod. The default is to create a private PID namespace for the pod. Requires the PID namespace to be shared via --share. + + host: use the host’s PID namespace for the pod + ns: join the specified PID namespace + private: create a new namespace for the pod (default) diff --git a/versioned_docs/version-5.4.1/source/markdown/options/pidfile.md b/versioned_docs/version-5.4.1/source/markdown/options/pidfile.md new file mode 100644 index 000000000..520cc9d9e --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/pidfile.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pidfile**=*path* + +When the pidfile location is specified, the container process' PID is written to the pidfile. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +If the pidfile option is not specified, the container process' PID is written to /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile. + +After the container is started, the location for the pidfile can be discovered with the following `podman inspect` command: + + $ podman inspect --format '{{ .PidFile }}' $CID + /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile diff --git a/versioned_docs/version-5.4.1/source/markdown/options/pids-limit.md b/versioned_docs/version-5.4.1/source/markdown/options/pids-limit.md new file mode 100644 index 000000000..ffc565e3a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/pids-limit.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pids-limit**=*limit* + +Tune the container's pids limit. Set to **-1** to have unlimited pids for the container. The default is **2048** on systems that support "pids" cgroup controller. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/platform.md b/versioned_docs/version-5.4.1/source/markdown/options/platform.md new file mode 100644 index 000000000..a6ccbbb3a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/platform.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with --arch and --os) +The `--platform` option can be used to override the current architecture and operating system. +Unless overridden, subsequent lookups of the same image in the local storage matches this platform, regardless of the host. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/pod-id-file.container.md b/versioned_docs/version-5.4.1/source/markdown/options/pod-id-file.container.md new file mode 100644 index 000000000..5bd1aca31 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/pod-id-file.container.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pod-id-file**=*file* + +Run container in an existing pod and read the pod's ID from the specified *file*. +When a container is run within a pod which has an infra-container, the infra-container starts first. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/pod-id-file.pod.md b/versioned_docs/version-5.4.1/source/markdown/options/pod-id-file.pod.md new file mode 100644 index 000000000..abfe57466 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/pod-id-file.pod.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman pod rm, pod start, pod stop +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pod-id-file**=*file* + +Read pod ID from the specified *file* and <> the pod. Can be specified multiple times. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/pod.run.md b/versioned_docs/version-5.4.1/source/markdown/options/pod.run.md new file mode 100644 index 000000000..c6228811a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/pod.run.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pod**=*name* + +Run container in an existing pod. Podman makes the pod automatically if the pod name is prefixed with **new:**. +To make a pod with more granular options, use the **podman pod create** command before creating a container. +When a container is run with a pod with an infra-container, the infra-container is started first. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/preserve-fd.md b/versioned_docs/version-5.4.1/source/markdown/options/preserve-fd.md new file mode 100644 index 000000000..69477b062 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/preserve-fd.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--preserve-fd**=*FD1[,FD2,...]* + +Pass down to the process the additional file descriptors specified in the comma separated list. It can be specified multiple times. +This option is only supported with the crun OCI runtime. It might be a security risk to use this option with other OCI runtimes. + +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.4.1/source/markdown/options/preserve-fds.md b/versioned_docs/version-5.4.1/source/markdown/options/preserve-fds.md new file mode 100644 index 000000000..ad72b8518 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/preserve-fds.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--preserve-fds**=*N* + +Pass down to the process N additional file descriptors (in addition to 0, 1, 2). +The total FDs are 3+N. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.4.1/source/markdown/options/privileged.md b/versioned_docs/version-5.4.1/source/markdown/options/privileged.md new file mode 100644 index 000000000..042c9eee2 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/privileged.md @@ -0,0 +1,28 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--privileged** + +Give extended privileges to this container. The default is **false**. + +By default, Podman containers are unprivileged (**=false**) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read-only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. +Due to the disabled security features, the privileged field should almost never +be set as containers can easily break out of confinement. + +Containers running in a user namespace (e.g., rootless containers) cannot have +more privileges than the user that launched them. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/publish-all.md b/versioned_docs/version-5.4.1/source/markdown/options/publish-all.md new file mode 100644 index 000000000..2d8ae77ec --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/publish-all.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--publish-all**, **-P** + +Publish all exposed ports to random ports on the host interfaces. The default is **false**. + +When set to **true**, publish all exposed ports to the host interfaces. +If the operator uses **-P** (or **-p**) then Podman makes the +exposed port accessible on the host and the ports are available to any +client that can reach the host. + +When using this option, Podman binds any exposed port to a random port on the host +within an ephemeral port range defined by */proc/sys/net/ipv4/ip_local_port_range*. +To find the mapping between the host ports and the exposed ports, use **podman port**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/publish.md b/versioned_docs/version-5.4.1/source/markdown/options/publish.md new file mode 100644 index 000000000..330b6c63f --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/publish.md @@ -0,0 +1,31 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--publish**, **-p**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Publish a container's port, or range of ports,<<| within this pod>> to the host. + +Both *hostPort* and *containerPort* can be specified as a range of ports. +When specifying ranges for both, the number of container ports in the +range must match the number of host ports in the range. + +If host IP is set to 0.0.0.0 or not set at all, the port is bound on all IPs on the host. + +By default, Podman publishes TCP ports. To publish a UDP port instead, give +`udp` as protocol. To publish both TCP and UDP ports, set `--publish` twice, +with `tcp`, and `udp` as protocols respectively. Rootful containers can also +publish ports using the `sctp` protocol. + +Host port does not have to be specified (e.g. `podman run -p 127.0.0.1::80`). +If it is not, the container port is randomly assigned a port on the host. + +Use **podman port** to see the actual mapping: `podman port $CONTAINER $CONTAINERPORT`. + +Note that the network drivers `macvlan` and `ipvlan` do not support port forwarding, +it will have no effect on these networks. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/pull.image.md b/versioned_docs/version-5.4.1/source/markdown/options/pull.image.md new file mode 100644 index 000000000..9200e4992 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/pull.image.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Only pull the image when it does not exist in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error when no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/pull.md b/versioned_docs/version-5.4.1/source/markdown/options/pull.md new file mode 100644 index 000000000..411c40a49 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/pull.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Pull the image only when the image is not in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error if no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/quiet.md b/versioned_docs/version-5.4.1/source/markdown/options/quiet.md new file mode 100644 index 000000000..9e0d86fe4 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/quiet.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--quiet**, **-q** + +Suppress output messages which indicate which instruction is being processed, and of progress when pulling images from a registry, and when writing the output image. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/rdt-class.md b/versioned_docs/version-5.4.1/source/markdown/options/rdt-class.md new file mode 100644 index 000000000..984c837d3 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/rdt-class.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--rdt-class**=*intel-rdt-class-of-service* + +Rdt-class sets the class of service (CLOS or COS) for the container to run in. Based on the Cache Allocation Technology (CAT) feature that is part of Intel's Resource Director Technology (RDT) feature set, all container processes will run within the pre-configured COS, representing a part of the cache. The COS has to be created and configured using a pseudo file system (usually mounted at `/sys/fs/resctrl`) that the resctrl kernel driver provides. Assigning the container to a COS requires root privileges and thus doesn't work in a rootless environment. Currently, the feature is only supported using `runc` as a runtime. See for more details on creating a COS before a container can be assigned to it. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/read-only-tmpfs.md b/versioned_docs/version-5.4.1/source/markdown/options/read-only-tmpfs.md new file mode 100644 index 000000000..d708778ca --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/read-only-tmpfs.md @@ -0,0 +1,31 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--read-only-tmpfs** + +When running --read-only containers, mount a read-write tmpfs on _/dev_, _/dev/shm_, _/run_, _/tmp_, and _/var/tmp_. The default is **true**. + +| --read-only | --read-only-tmpfs | / | /run, /tmp, /var/tmp| +| ----------- | ----------------- | ---- | ----------------------------------- | +| true | true | r/o | r/w | +| true | false | r/o | r/o | +| false | false | r/w | r/w | +| false | true | r/w | r/w | + +When **--read-only=true** and **--read-only-tmpfs=true** additional tmpfs are mounted on +the /tmp, /run, and /var/tmp directories. + +When **--read-only=true** and **--read-only-tmpfs=false** /dev and /dev/shm are marked +Read/Only and no tmpfs are mounted on /tmp, /run and /var/tmp. The directories +are exposed from the underlying image, meaning they are read-only by default. +This makes the container totally read-only. No writable directories exist within +the container. In this mode writable directories need to be added via external +volumes or mounts. + +By default, when **--read-only=false**, the /dev and /dev/shm are read/write, and the /tmp, /run, and /var/tmp are read/write directories from the container image. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/read-only.md b/versioned_docs/version-5.4.1/source/markdown/options/read-only.md new file mode 100644 index 000000000..ef2240970 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/read-only.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--read-only** + +Mount the container's root filesystem as read-only. + +By default, container root filesystems are writable, allowing processes +to write files anywhere. By specifying the **--read-only** flag, the containers root filesystem are mounted read-only prohibiting any writes. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/replace.md b/versioned_docs/version-5.4.1/source/markdown/options/replace.md new file mode 100644 index 000000000..c87672a43 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/replace.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--replace** + +If another <> with the same name already exists, replace and remove it. The default is **false**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/requires.md b/versioned_docs/version-5.4.1/source/markdown/options/requires.md new file mode 100644 index 000000000..9b1368a76 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/requires.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--requires**=*container* + +Specify one or more requirements. +A requirement is a dependency container that is started before this container. +Containers can be specified by name or ID, with multiple containers being separated by commas. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/restart.md b/versioned_docs/version-5.4.1/source/markdown/options/restart.md new file mode 100644 index 000000000..3ca0be232 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/restart.md @@ -0,0 +1,27 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). diff --git a/versioned_docs/version-5.4.1/source/markdown/options/retry-delay.md b/versioned_docs/version-5.4.1/source/markdown/options/retry-delay.md new file mode 100644 index 000000000..7c3c0095f --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/retry-delay.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, build, create, farm build, pull, push, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/retry.md b/versioned_docs/version-5.4.1/source/markdown/options/retry.md new file mode 100644 index 000000000..920aad256 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/retry.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, build, create, farm build, pull, push, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/rm.md b/versioned_docs/version-5.4.1/source/markdown/options/rm.md new file mode 100644 index 000000000..7f0a09447 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/rm.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--rm** + +Remove intermediate containers after a successful build (default true). diff --git a/versioned_docs/version-5.4.1/source/markdown/options/rootfs.md b/versioned_docs/version-5.4.1/source/markdown/options/rootfs.md new file mode 100644 index 000000000..8b9073fa2 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/rootfs.md @@ -0,0 +1,39 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--rootfs** + +If specified, the first argument refers to an exploded container on the file system. + +This is useful to run a container without requiring any image management, the rootfs +of the container is assumed to be managed externally. + + `Overlay Rootfs Mounts` + + The `\:O` flag tells Podman to mount the directory from the rootfs path as +storage using the `overlay file system`. The container processes +can modify content within the mount point which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +Note: On **SELinux** systems, the rootfs needs the correct label, which is by default +**unconfined_u:object_r:container_file_t\\:s0**. + + `idmap` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. +The idmap option supports a custom mapping that can be different than the user +namespace used by the container. The mapping can be specified after the idmap +option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the +first value is the start of the backing file system IDs that are mapped to the +second value on the host. The length of this mapping is given in the third value. +Multiple ranges are separated with #. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/runtime-flag.md b/versioned_docs/version-5.4.1/source/markdown/options/runtime-flag.md new file mode 100644 index 000000000..34c3605a4 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/runtime-flag.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--runtime-flag**=*flag* + +Adds global flags for the container runtime. To list the supported flags, please consult the manpages of the selected container runtime. + +Note: Do not pass the leading -- to the flag. To pass the runc flag --log-format json to buildah build, the option given is --runtime-flag log-format=json. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/runtime.md b/versioned_docs/version-5.4.1/source/markdown/options/runtime.md new file mode 100644 index 000000000..d5c2a8bb1 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/runtime.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--runtime**=*path* + +The *path* to an alternate OCI-compatible runtime, which is used to run +commands specified by the **RUN** instruction. + +Note: You can also override the default runtime by setting the BUILDAH\_RUNTIME environment variable. `export BUILDAH_RUNTIME=/usr/local/bin/runc` diff --git a/versioned_docs/version-5.4.1/source/markdown/options/sbom-image-output.md b/versioned_docs/version-5.4.1/source/markdown/options/sbom-image-output.md new file mode 100644 index 000000000..6cd944658 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/sbom-image-output.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-image-output**=*path* + +When generating SBOMs, store the generated SBOM in the specified path in the +output image. There is no default. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/sbom-image-purl-output.md b/versioned_docs/version-5.4.1/source/markdown/options/sbom-image-purl-output.md new file mode 100644 index 000000000..7238ef173 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/sbom-image-purl-output.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-image-purl-output**=*path* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the specified path in the output +image. There is no default. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/sbom-merge-strategy.md b/versioned_docs/version-5.4.1/source/markdown/options/sbom-merge-strategy.md new file mode 100644 index 000000000..6c489891c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/sbom-merge-strategy.md @@ -0,0 +1,29 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-merge-strategy**=*method* + +If more than one **--sbom-scanner-command** value is being used, use the +specified method to merge the output from later commands with output from +earlier commands. Recognized values include: + + - cat + Concatenate the files. + - merge-cyclonedx-by-component-name-and-version + Merge the "component" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "version" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + - merge-spdx-by-package-name-and-versioninfo + Merge the "package" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "versionInfo" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/sbom-output.md b/versioned_docs/version-5.4.1/source/markdown/options/sbom-output.md new file mode 100644 index 000000000..9edb1d3a8 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/sbom-output.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-output**=*file* + +When generating SBOMs, store the generated SBOM in the named file on the local +filesystem. There is no default. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/sbom-purl-output.md b/versioned_docs/version-5.4.1/source/markdown/options/sbom-purl-output.md new file mode 100644 index 000000000..81cf9bc4b --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/sbom-purl-output.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-purl-output**=*file* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the named file in the local +filesystem. There is no default. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/sbom-scanner-command.md b/versioned_docs/version-5.4.1/source/markdown/options/sbom-scanner-command.md new file mode 100644 index 000000000..8f836a4ec --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/sbom-scanner-command.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-scanner-command**=*image* + +Generate SBOMs by running the specified command from the scanner image. If +multiple commands are specified, they are run in the order in which they are +specified. These text substitutions are performed: + - {ROOTFS} + The root of the built image's filesystem, bind mounted. + - {CONTEXT} + The build context and additional build contexts, bind mounted. + - {OUTPUT} + The name of a temporary output file, to be read and merged with others or copied elsewhere. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/sbom-scanner-image.md b/versioned_docs/version-5.4.1/source/markdown/options/sbom-scanner-image.md new file mode 100644 index 000000000..879d07f23 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/sbom-scanner-image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-scanner-image**=*image* + +Generate SBOMs using the specified scanner image. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/sbom.md b/versioned_docs/version-5.4.1/source/markdown/options/sbom.md new file mode 100644 index 000000000..578a57e69 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/sbom.md @@ -0,0 +1,38 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom**=*preset* + +Generate SBOMs (Software Bills Of Materials) for the output image by scanning +the working container and build contexts using the named combination of scanner +image, scanner commands, and merge strategy. Must be specified with one or +more of **--sbom-image-output**, **--sbom-image-purl-output**, **--sbom-output**, +and **--sbom-purl-output**. Recognized presets, and the set of options which +they equate to: + + - "syft", "syft-cyclonedx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output cyclonedx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output cyclonedx-json={OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "syft-spdx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output spdx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output spdx-json={OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + - "trivy", "trivy-cyclonedx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "trivy-spdx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo diff --git a/versioned_docs/version-5.4.1/source/markdown/options/sdnotify.md b/versioned_docs/version-5.4.1/source/markdown/options/sdnotify.md new file mode 100644 index 000000000..b562a9431 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/sdnotify.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sdnotify**=**container** | *conmon* | *healthy* | *ignore* + +Determines how to use the NOTIFY_SOCKET, as passed with systemd and Type=notify. + +Default is **container**, which means allow the OCI runtime to proxy the socket into the +container to receive ready notification. Podman sets the MAINPID to conmon's pid. +The **conmon** option sets MAINPID to conmon's pid, and sends READY when the container +has started. The socket is never passed to the runtime or the container. +The **healthy** option sets MAINPID to conmon's pid, and sends READY when the container +has turned healthy; requires a healthcheck to be set. The socket is never passed to the runtime or the container. +The **ignore** option removes NOTIFY_SOCKET from the environment for itself and child processes, +for the case where some other process above Podman uses NOTIFY_SOCKET and Podman does not use it. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/seccomp-policy.md b/versioned_docs/version-5.4.1/source/markdown/options/seccomp-policy.md new file mode 100644 index 000000000..6a031aa32 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/seccomp-policy.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--seccomp-policy**=*policy* + +Specify the policy to select the seccomp profile. If set to *image*, Podman looks for a "io.containers.seccomp.profile" label in the container-image config and use its value as a seccomp profile. Otherwise, Podman follows the *default* policy by applying the default profile unless specified otherwise via *--security-opt seccomp* as described below. + +Note that this feature is experimental and may change in the future. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/secret.image.md b/versioned_docs/version-5.4.1/source/markdown/options/secret.image.md new file mode 100644 index 000000000..85685c900 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/secret.image.md @@ -0,0 +1,28 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--secret**=**id=id[,src=*envOrFile*][,env=*ENV*][,type=*file* | *env*]** + +Pass secret information to be used in the Containerfile for building images +in a safe way that will not end up stored in the final image, or be seen in other stages. +The value of the secret will be read from an environment variable or file named +by the "id" option, or named by the "src" option if it is specified, or from an +environment variable specified by the "env" option. See [EXAMPLES](#examples). +The secret will be mounted in the container at `/run/secrets/id` by default. + +To later use the secret, use the --mount flag in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret` + +The location of the secret in the container can be overridden using the +"target", "dst", or "destination" option of the `RUN --mount` flag. + +`RUN --mount=type=secret,id=mysecret,target=/run/secrets/myothersecret cat /run/secrets/myothersecret` + +Note: changing the contents of secret files will not trigger a rebuild of layers that use said secrets. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/secret.md b/versioned_docs/version-5.4.1/source/markdown/options/secret.md new file mode 100644 index 000000000..bf2aed144 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/secret.md @@ -0,0 +1,59 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--secret**=*secret[,opt=opt ...]* + +Give the container access to a secret. Can be specified multiple times. + +A secret is a blob of sensitive data which a container needs at runtime but +is not stored in the image or in source control, such as usernames and passwords, +TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 500 kb in size). + +When secrets are specified as type `mount`, the secrets are copied and mounted into the container when a container is created. +When secrets are specified as type `env`, the secret is set as an environment variable within the container. +Secrets are written in the container at the time of container creation, and modifying the secret using `podman secret` commands +after the container is created affects the secret inside the container. + +Secrets and its storage are managed using the `podman secret` command. + +Secret Options + +- `type=mount|env` : How the secret is exposed to the container. + `mount` mounts the secret into the container as a file. + `env` exposes the secret as an environment variable. + Defaults to `mount`. +- `target=target` : Target of secret. + For mounted secrets, this is the path to the secret inside the container. + If a fully qualified path is provided, the secret is mounted at that location. + Otherwise, the secret is mounted to + `/run/secrets/target` for linux containers or + `/var/run/secrets/target` for freebsd containers. + If the target is not set, the secret is mounted to `/run/secrets/secretname` by default. + For env secrets, this is the environment variable key. Defaults to `secretname`. +- `uid=0` : UID of secret. Defaults to 0. Mount secret type only. +- `gid=0` : GID of secret. Defaults to 0. Mount secret type only. +- `mode=0` : Mode of secret. Defaults to 0444. Mount secret type only. + + +Examples + +Mount at `/my/location/mysecret` with UID 1: +``` +--secret mysecret,target=/my/location/mysecret,uid=1 +``` + +Mount at `/run/secrets/customtarget` with mode 0777: +``` +--secret mysecret,target=customtarget,mode=0777 +``` + +Create a secret environment variable called `ENVSEC`: +``` +--secret mysecret,type=env,target=ENVSEC +``` diff --git a/versioned_docs/version-5.4.1/source/markdown/options/security-opt.image.md b/versioned_docs/version-5.4.1/source/markdown/options/security-opt.image.md new file mode 100644 index 000000000..5adc6139a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/security-opt.image.md @@ -0,0 +1,27 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--security-opt**=*option* + +Security Options + +- `apparmor=unconfined` : Turn off apparmor confinement for the container +- `apparmor=alternate-profile` : Set the apparmor confinement profile for the +container + +- `label=user:USER` : Set the label user for the container processes +- `label=role:ROLE` : Set the label role for the container processes +- `label=type:TYPE` : Set the label process type for the container processes +- `label=level:LEVEL` : Set the label level for the container processes +- `label=filetype:TYPE` : Set the label file type for the container files +- `label=disable` : Turn off label separation for the container +- `no-new-privileges` : Not supported + +- `seccomp=unconfined` : Turn off seccomp confinement for the container +- `seccomp=profile.json` : JSON file to be used as the seccomp filter for the container. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/security-opt.md b/versioned_docs/version-5.4.1/source/markdown/options/security-opt.md new file mode 100644 index 000000000..c283dceef --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/security-opt.md @@ -0,0 +1,41 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the <> +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the <> + +- **label=user:**_USER_: Set the label user for the <> processes +- **label=role:**_ROLE_: Set the label role for the <> processes +- **label=type:**_TYPE_: Set the label process type for the <> processes +- **label=level:**_LEVEL_: Set the label level for the <> processes +- **label=filetype:**_TYPE_: Set the label file type for the <> files +- **label=disable**: Turn off label separation for the <> + +Note: Labeling can be disabled for all <<|pods/>>containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the container<>. + +- **no-new-privileges**: Disable container processes from gaining additional privileges. + +- **seccomp=unconfined**: Turn off seccomp confinement for the <>. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/shm-size-systemd.md b/versioned_docs/version-5.4.1/source/markdown/options/shm-size-systemd.md new file mode 100644 index 000000000..c3b690928 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/shm-size-systemd.md @@ -0,0 +1,15 @@ +--- +title: of +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/shm-size.md b/versioned_docs/version-5.4.1/source/markdown/options/shm-size.md new file mode 100644 index 000000000..197a35dc7 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/shm-size.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, create, farm build, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the <>. +This option conflicts with **--ipc=host**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/sig-proxy.md b/versioned_docs/version-5.4.1/source/markdown/options/sig-proxy.md new file mode 100644 index 000000000..c3c6ab05e --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/sig-proxy.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman attach, run, start +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sig-proxy** + +Proxy received signals to the container process. SIGCHLD, SIGURG, SIGSTOP, and SIGKILL are not proxied. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/sign-by-sigstore.md b/versioned_docs/version-5.4.1/source/markdown/options/sign-by-sigstore.md new file mode 100644 index 000000000..8fe3e96f3 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/sign-by-sigstore.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman artifact push, manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sign-by-sigstore**=*param-file* + +Add a sigstore signature based on further options specified in a container's sigstore signing parameter file *param-file*. +See containers-sigstore-signing-params.yaml(5) for details about the file format. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/sign-passphrase-file.md b/versioned_docs/version-5.4.1/source/markdown/options/sign-passphrase-file.md new file mode 100644 index 000000000..555b3dfd9 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/sign-passphrase-file.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman artifact push, manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sign-passphrase-file**=*path* + +If signing the image (using either **--sign-by** or **--sign-by-sigstore-private-key**), read the passphrase to use from the specified path. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/signal.md b/versioned_docs/version-5.4.1/source/markdown/options/signal.md new file mode 100644 index 000000000..f8c74166a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/signal.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman kill, pod kill +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--signal**, **-s**=**signal** + +Signal to send to the container<<|s in the pod>>. For more information on Linux signals, refer to *signal(7)*. +The default is **SIGKILL**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/since.md b/versioned_docs/version-5.4.1/source/markdown/options/since.md new file mode 100644 index 000000000..094b8253e --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/since.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--since**=*TIMESTAMP* + +Show logs since TIMESTAMP. The --since option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/skip-unused-stages.md b/versioned_docs/version-5.4.1/source/markdown/options/skip-unused-stages.md new file mode 100644 index 000000000..b7984a89a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/skip-unused-stages.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--skip-unused-stages** + +Skip stages in multi-stage builds which don't affect the target stage. (Default: **true**). diff --git a/versioned_docs/version-5.4.1/source/markdown/options/squash-all.md b/versioned_docs/version-5.4.1/source/markdown/options/squash-all.md new file mode 100644 index 000000000..6788ebc76 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/squash-all.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--squash-all** + +Squash all of the new image's layers (including those inherited from a base image) into a single new layer. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/squash.md b/versioned_docs/version-5.4.1/source/markdown/options/squash.md new file mode 100644 index 000000000..4f7857a20 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/squash.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--squash** + +Squash all of the image's new layers into a single new layer; any preexisting layers are not squashed. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/ssh.md b/versioned_docs/version-5.4.1/source/markdown/options/ssh.md new file mode 100644 index 000000000..fef535ee6 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/ssh.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ssh**=*default* | *id[=socket>* + +SSH agent socket or keys to expose to the build. +The socket path can be left empty to use the value of `default=$SSH_AUTH_SOCK` + +To later use the ssh agent, use the --mount option in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=ssh,id=id mycmd` diff --git a/versioned_docs/version-5.4.1/source/markdown/options/stop-signal.md b/versioned_docs/version-5.4.1/source/markdown/options/stop-signal.md new file mode 100644 index 000000000..5f2af4df1 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/stop-signal.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--stop-signal**=*signal* + +Signal to stop a container. Default is **SIGTERM**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/stop-timeout.md b/versioned_docs/version-5.4.1/source/markdown/options/stop-timeout.md new file mode 100644 index 000000000..e4ca94afd --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/stop-timeout.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--stop-timeout**=*seconds* + +Timeout to stop a container. Default is **10**. +Remote connections use local containers.conf for defaults. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/subgidname.md b/versioned_docs/version-5.4.1/source/markdown/options/subgidname.md new file mode 100644 index 000000000..390fb6e3e --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/subgidname.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/subuidname.md b/versioned_docs/version-5.4.1/source/markdown/options/subuidname.md new file mode 100644 index 000000000..738df2b1e --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/subuidname.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/sysctl.md b/versioned_docs/version-5.4.1/source/markdown/options/sysctl.md new file mode 100644 index 000000000..d98f4fa20 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/sysctl.md @@ -0,0 +1,30 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters <>. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: <>, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: <>, the above sysctls are not allowed. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/systemd.md b/versioned_docs/version-5.4.1/source/markdown/options/systemd.md new file mode 100644 index 000000000..e12455de1 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/systemd.md @@ -0,0 +1,42 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--systemd**=*true* | *false* | *always* + +Run container in systemd mode. The default is **true**. + +- **true** enables systemd mode only when the command executed inside the container is *systemd*, */usr/sbin/init*, +*/sbin/init* or */usr/local/sbin/init*. + +- **false** disables systemd mode. + +- **always** enforces the systemd mode to be enabled. + +Running the container in systemd mode causes the following changes: + +* Podman mounts tmpfs file systems on the following directories + * _/run_ + * _/run/lock_ + * _/tmp_ + * _/sys/fs/cgroup/systemd_ (on a cgroup v1 system) + * _/var/lib/journal_ +* Podman sets the default stop signal to **SIGRTMIN+3**. +* Podman sets **container_uuid** environment variable in the container to the +first 32 characters of the container ID. +* Podman does not mount virtual consoles (_/dev/tty\d+_) when running with **--privileged**. +* On cgroup v2, */sys/fs/cgroup* is mounted writeable. + +This allows systemd to run in a confined container without any modifications. + +Note that on **SELinux** systems, systemd attempts to write to the cgroup +file system. Containers writing to the cgroup file system are denied by default. +The **container_manage_cgroup** boolean must be enabled for this to be allowed on an SELinux separated system. +``` +setsebool -P container_manage_cgroup true +``` diff --git a/versioned_docs/version-5.4.1/source/markdown/options/tag.md b/versioned_docs/version-5.4.1/source/markdown/options/tag.md new file mode 100644 index 000000000..a191e2462 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/tag.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tag**, **-t**=*imageName* + +Specifies the name which is assigned to the resulting image if the build process completes successfully. +If _imageName_ does not include a registry name, the registry name *localhost* is prepended to the image name. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/tail.md b/versioned_docs/version-5.4.1/source/markdown/options/tail.md new file mode 100644 index 000000000..a885ca740 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/tail.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tail**=*LINES* + +Output the specified number of LINES at the end of the logs. LINES must be an integer. Defaults to -1, +which prints all lines diff --git a/versioned_docs/version-5.4.1/source/markdown/options/target.md b/versioned_docs/version-5.4.1/source/markdown/options/target.md new file mode 100644 index 000000000..5be201c4b --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/target.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--target**=*stageName* + +Set the target build stage to build. When building a Containerfile with multiple build stages, --target can be used to specify an intermediate build stage by name as the final stage for the resulting image. Commands after the target stage is skipped. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/time.md b/versioned_docs/version-5.4.1/source/markdown/options/time.md new file mode 100644 index 000000000..b7029e837 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/time.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman pod rm, pod stop, restart, rm, stop +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping <>. +Use -1 for infinite wait. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/timeout.md b/versioned_docs/version-5.4.1/source/markdown/options/timeout.md new file mode 100644 index 000000000..75bfca59f --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/timeout.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--timeout**=*seconds* + +Maximum time a container is allowed to run before conmon sends it the kill +signal. By default containers run until they exit or are stopped by +`podman stop`. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/timestamp.md b/versioned_docs/version-5.4.1/source/markdown/options/timestamp.md new file mode 100644 index 000000000..a7227123e --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/timestamp.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--timestamp**=*seconds* + +Set the create timestamp to seconds since epoch to allow for deterministic builds (defaults to current time). By default, the created timestamp is changed and written into the image manifest with every commit, causing the image's sha256 hash to be different even if the sources are exactly the same otherwise. +When --timestamp is set, the created timestamp is always set to the time specified and therefore not changed, allowing the image's sha256 hash to remain the same. All files committed to the layers of the image is created with the timestamp. + +If the only instruction in a Containerfile is `FROM`, this flag has no effect. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/timestamps.md b/versioned_docs/version-5.4.1/source/markdown/options/timestamps.md new file mode 100644 index 000000000..c7f437ee4 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/timestamps.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--timestamps**, **-t** + +Show timestamps in the log outputs. The default is false diff --git a/versioned_docs/version-5.4.1/source/markdown/options/tls-verify.md b/versioned_docs/version-5.4.1/source/markdown/options/tls-verify.md new file mode 100644 index 000000000..e47ba287d --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/tls-verify.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, auto update, build, container runlabel, create, farm build, kube play, login, manifest add, manifest create, manifest inspect, manifest push, pull, push, run, search +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/options/tmpfs.md b/versioned_docs/version-5.4.1/source/markdown/options/tmpfs.md new file mode 100644 index 000000000..5649bae09 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/tmpfs.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tmpfs**=*fs* + +Create a tmpfs mount. + +Mount a temporary filesystem (**tmpfs**) mount into a container, for example: + +``` +$ podman <> -d --tmpfs /tmp\:rw,size=787448k,mode=1777 my_image +``` + +This command mounts a **tmpfs** at _/tmp_ within the container. The supported mount +options are the same as the Linux default mount flags. If no options are specified, +the system uses the following options: +**rw,noexec,nosuid,nodev**. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/tty.md b/versioned_docs/version-5.4.1/source/markdown/options/tty.md new file mode 100644 index 000000000..2de341458 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/tty.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tty**, **-t** + +Allocate a pseudo-TTY. The default is **false**. + +When set to **true**, Podman allocates a pseudo-tty and attach to the standard +input of the container. This can be used, for example, to run a throwaway +interactive shell. + +**NOTE**: The --tty flag prevents redirection of standard output. It combines STDOUT and STDERR, it can insert control characters, and it can hang pipes. This option is only used when run interactively in a terminal. When feeding input to Podman, use -i only, not -it. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/tz.md b/versioned_docs/version-5.4.1/source/markdown/options/tz.md new file mode 100644 index 000000000..9304affed --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/tz.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tz**=*timezone* + +Set timezone in container. This flag takes area-based timezones, GMT time, as well as `local`, which sets the timezone in the container to match the host machine. See `/usr/share/zoneinfo/` for valid timezones. +Remote connections use local containers.conf for defaults diff --git a/versioned_docs/version-5.4.1/source/markdown/options/uidmap.container.md b/versioned_docs/version-5.4.1/source/markdown/options/uidmap.container.md new file mode 100644 index 000000000..273da920a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/uidmap.container.md @@ -0,0 +1,201 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uidmap**=*[flags]container_uid\:from_uid[\\:amount]* + +Run the container in a new user namespace using the supplied UID mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +The possible values of the optional *flags* are discussed further down on this page. +The *amount* value is optional and assumed to be **1** if not given. + +The *from_uid* value is based upon the user running the command, either rootful or rootless users. + +* rootful user: [*flags*]*container_uid*:*host_uid*[:*amount*] +* rootless user: [*flags*]*container_uid*:*intermediate_uid*[:*amount*] + + `Rootful mappings` + + +When **podman <>** is called by a privileged user, the option **--uidmap** +works as a direct mapping between host UIDs and container UIDs. + +host UID -> container UID + +The _amount_ specifies the number of consecutive UIDs that is mapped. +If for example _amount_ is **4** the mapping looks like: + +| host UID | container UID | +| ---------- | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | + + `Rootless mappings` + +When **podman <>** is called by an unprivileged user (i.e. running rootless), +the value *from_uid* is interpreted as an "intermediate UID". In the rootless +case, host UIDs are not mapped directly to container UIDs. Instead the mapping +happens over two mapping steps: + +host UID -> intermediate UID -> container UID + +The **--uidmap** option only influences the second mapping step. + +The first mapping step is derived by Podman from the contents of the file +_/etc/subuid_ and the UID of the user calling Podman. + +First mapping step: + +| host UID | intermediate UID | +| -------- | ---------------- | +| UID for Podman user | 0 | +| 1st subordinate UID | 1 | +| 2nd subordinate UID | 2 | +| 3rd subordinate UID | 3 | +| nth subordinate UID | n | + +To be able to use intermediate UIDs greater than zero, the user needs to have +subordinate UIDs configured in _/etc/subuid_. See **subuid**(5). + +The second mapping step is configured with **--uidmap**. + +If for example _amount_ is **5** the second mapping step looks like: + +| intermediate UID | container UID | +| ------------------ | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | +| *from_uid* + 4 | *container_uid* + 4 | + +When running as rootless, Podman uses all the ranges configured in the _/etc/subuid_ file. + +The current user ID is mapped to UID=0 in the rootless user namespace. +Every additional range is added sequentially afterward: + +| host | rootless user namespace | length | +| ------ | ----------------------- | ------ | +| $UID | 0 | 1 | +| 1 | $FIRST_RANGE_ID | $FIRST_RANGE_LENGTH | +| 1+$FIRST_RANGE_LENGTH | $SECOND_RANGE_ID | $SECOND_RANGE_LENGTH| + + `Referencing a host ID from the parent namespace` + +As a rootless user, the given host ID in **--uidmap** or **--gidmap** +is mapped from the *intermediate namespace* generated by Podman. Sometimes +it is desirable to refer directly at the *host namespace*. It is possible +to manually do so, by running `podman unshare cat /proc/self/gid_map`, +finding the desired host id at the second column of the output, and getting +the corresponding intermediate id from the first column. + +Podman can perform all that by preceding the host id in the mapping +with the `@` symbol. For instance, by specifying `--gidmap 100000:@2000:1`, +podman will look up the intermediate id corresponding to host id `2000` and +it will map the found intermediate id to the container id `100000`. The +given host id must have been subordinated (otherwise it would not be mapped +into the intermediate space in the first place). + +If the length is greater than one, for instance with `--gidmap 100000:@2000:2`, +Podman will map host ids `2000` and `2001` to `100000` and `100001`, respectively, +regardless of how the intermediate mapping is defined. + + `Extending previous mappings` + +Some mapping modifications may be cumbersome. For instance, a user +starts with a mapping such as `--gidmap="0:0:65000"`, that needs to be +changed such as the parent id `1000` is mapped to container id `100000` +instead, leaving container id `1` unassigned. The corresponding `--gidmap` +becomes `--gidmap="0:0:1" --gidmap="2:2:65534" --gidmap="100000:1:1"`. + +This notation can be simplified using the `+` flag, that takes care of +breaking previous mappings removing any conflicting assignment with +the given mapping. The flag is given before the container id +as follows: `--gidmap="0:0:65000" --gidmap="+100000:1:1"` + + + Flag | Example | Description +-----------|---------------|------------- + `+` | `+100000:1:1` | Extend the previous mapping + +This notation leads to gaps in the assignment, so it may be convenient to +fill those gaps afterwards: `--gidmap="0:0:65000" --gidmap="+100000:1:1" --gidmap="1:65001:1"` + +One specific use case for this flag is in the context of rootless +users. A rootless user may specify mappings with the `+` flag as +in `--gidmap="+100000:1:1"`. Podman will then "fill the gaps" starting +from zero with all the remaining intermediate ids. This is convenient when +a user wants to map a specific intermediate id to a container id, leaving +the rest of subordinate ids to be mapped by Podman at will. + + `Passing only one of --uidmap or --gidmap` + +Usually, subordinated user and group ids are assigned simultaneously, and +for any user the subordinated user ids match the subordinated group ids. +For convenience, if only one of **--uidmap** or **--gidmap** is given, +podman assumes the mapping refers to both UIDs and GIDs and applies the +given mapping to both. If only one value of the two needs to be changed, +the mappings should include the `u` or the `g` flags to specify that +they only apply to UIDs or GIDs and should not be copied over. + + flag | Example | Description +---------|-----------------|----------------- + `u` | `u20000:2000:1` |The mapping only applies to UIDs + `g` | `g10000:1000:1` |The mapping only applies to GIDs + +For instance given the command + + podman <> --gidmap "0:0:1000" --gidmap "g2000:2000:1" + +Since no **--uidmap** is given, the **--gidmap** is copied to **--uidmap**, +giving a command equivalent to + + podman <> --gidmap "0:0:1000" --gidmap "2000:2000:1" --uidmap "0:0:1000" + +The `--gidmap "g2000:2000:1"` used the `g` flag and therefore it was +not copied to **--uidmap**. + + `Rootless mapping of additional host GIDs` + +A rootless user may desire to map a specific host group that has already been +subordinated within _/etc/subgid_ without specifying the rest of the mapping. + +This can be done with **--gidmap "+g*container_gid*:@*host_gid*"** + +Where: + +- The host GID is given through the `@` symbol +- The mapping of this GID is not copied over to **--usermap** thanks to the `g` flag. +- The rest of the container IDs will be mapped starting from 0 to n, + with all the remaining subordinated GIDs, thanks to the `+` flag. + +For instance, if a user belongs to the group `2000` and that group is +subordinated to that user (with `usermod --add-subgids 2000-2000 $USER`), +the user can map the group into the container with: **--gidmap=+g100000:@2000**. + +If this mapping is combined with the option, **--group-add=keep-groups**, the +process in the container will belong to group `100000`, and files belonging +to group `2000` in the host will appear as being owned by group `100000` +inside the container. + + podman run --group-add=keep-groups --gidmap="+g100000:@2000" ... + + `No subordinate UIDs` + +Even if a user does not have any subordinate UIDs in _/etc/subuid_, +**--uidmap** can be used to map the normal UID of the user to a +container UID by running `podman <> --uidmap $container_uid:0:1 --user $container_uid ...`. + + `Pods` + +The **--uidmap** option cannot be called in conjunction with the **--pod** option as a uidmap cannot be set on the container level when in a pod. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/uidmap.pod.md b/versioned_docs/version-5.4.1/source/markdown/options/uidmap.pod.md new file mode 100644 index 000000000..89402f303 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/uidmap.pod.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uidmap**=*container_uid\:from_uid\\:amount* + +Run all containers in the pod in a new user namespace using the supplied mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/ulimit.image.md b/versioned_docs/version-5.4.1/source/markdown/options/ulimit.image.md new file mode 100644 index 000000000..a775ba055 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/ulimit.image.md @@ -0,0 +1,27 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ulimit**=*type=soft-limit[\\:hard-limit]* + +Specifies resource limits to apply to processes launched when processing `RUN` instructions. This option can be specified multiple times. Recognized resource types include: + "core": maximum core dump size (ulimit -c) + "cpu": maximum CPU time (ulimit -t) + "data": maximum size of a process's data segment (ulimit -d) + "fsize": maximum size of new files (ulimit -f) + "locks": maximum number of file locks (ulimit -x) + "memlock": maximum amount of locked memory (ulimit -l) + "msgqueue": maximum amount of data in message queues (ulimit -q) + "nice": niceness adjustment (nice -n, ulimit -e) + "nofile": maximum number of open files (ulimit -n) + "nproc": maximum number of processes (ulimit -u) + "rss": maximum size of a process's (ulimit -m) + "rtprio": maximum real-time scheduling priority (ulimit -r) + "rttime": maximum amount of real-time execution between blocking syscalls + "sigpending": maximum number of pending signals (ulimit -i) + "stack": maximum stack size (ulimit -s) diff --git a/versioned_docs/version-5.4.1/source/markdown/options/ulimit.md b/versioned_docs/version-5.4.1/source/markdown/options/ulimit.md new file mode 100644 index 000000000..a282535b8 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/ulimit.md @@ -0,0 +1,33 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ulimit**=*option* + +Ulimit options. Sets the ulimits values inside of the container. + +--ulimit with a soft and hard limit in the format =[:]. For example: + +$ podman run --ulimit nofile=1024:1024 --rm ubi9 ulimit -n +1024 + +Set -1 for the soft or hard limit to set the limit to the maximum limit of the current +process. In rootful mode this is often unlimited. + + +If nofile and nproc are unset, a default value of 1048576 will be used, unless overridden +in containers.conf(5). However, if the default value exceeds the hard limit for the current +rootless user, the current hard limit will be applied instead. + +Use **host** to copy the current configuration from the host. + +Don't use nproc with the ulimit flag as Linux uses nproc to set the +maximum number of processes available to a user, not to a container. + +Use the --pids-limit option to modify the cgroup control to limit the number +of processes within a container. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/umask.md b/versioned_docs/version-5.4.1/source/markdown/options/umask.md new file mode 100644 index 000000000..ba1e7a7f7 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/umask.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--umask**=*umask* + +Set the umask inside the container. Defaults to `0022`. +Remote connections use local containers.conf for defaults diff --git a/versioned_docs/version-5.4.1/source/markdown/options/unsetenv-all.md b/versioned_docs/version-5.4.1/source/markdown/options/unsetenv-all.md new file mode 100644 index 000000000..0cd1fef88 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/unsetenv-all.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetenv-all** + +Unset all default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/unsetenv.image.md b/versioned_docs/version-5.4.1/source/markdown/options/unsetenv.image.md new file mode 100644 index 000000000..08a850ddb --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/unsetenv.image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetenv**=*env* + +Unset environment variables from the final image. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/unsetenv.md b/versioned_docs/version-5.4.1/source/markdown/options/unsetenv.md new file mode 100644 index 000000000..dca1c501a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/unsetenv.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetenv**=*env* + +Unset default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/unsetlabel.md b/versioned_docs/version-5.4.1/source/markdown/options/unsetlabel.md new file mode 100644 index 000000000..bcb6a8801 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/unsetlabel.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetlabel**=*label* + +Unset the image label, causing the label not to be inherited from the base image. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/until.md b/versioned_docs/version-5.4.1/source/markdown/options/until.md new file mode 100644 index 000000000..bb2d41f81 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/until.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--until**=*TIMESTAMP* + +Show logs until TIMESTAMP. The --until option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/user-mode-networking.md b/versioned_docs/version-5.4.1/source/markdown/options/user-mode-networking.md new file mode 100644 index 000000000..7ec261c37 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/user-mode-networking.md @@ -0,0 +1,26 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman machine init, machine set +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--user-mode-networking** + +Indicates that this machine relays traffic from the guest through a user-space +process running on the host. In some VPN configurations the VPN may drop +traffic from alternate network interfaces, including VM network devices. By +enabling user-mode networking (a setting of `true`), VPNs observe all +podman machine traffic as coming from the host, bypassing the problem. + +When the qemu backend is used (Linux, Mac), user-mode networking is +mandatory and the only allowed value is `true`. In contrast, The Windows/WSL +backend defaults to `false`, and follows the standard WSL network setup. +Changing this setting to `true` on Windows/WSL informs Podman to replace +the WSL networking setup on start of this machine instance with a user-mode +networking distribution. Since WSL shares the same kernel across +distributions, all other running distributions reuses this network. +Likewise, when the last machine instance with a `true` setting stops, the +original networking setup is restored. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/user.md b/versioned_docs/version-5.4.1/source/markdown/options/user.md new file mode 100644 index 000000000..2b40947c6 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/user.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--user**, **-u**=*user[\:group]* + +Sets the username or UID used and, optionally, the groupname or GID for the specified command. Both *user* and *group* may be symbolic or numeric. + +Without this argument, the command runs as the user specified in the container image. Unless overridden by a `USER` command in the Containerfile or by a value passed to this option, this user generally defaults to root. + +When a user namespace is not in use, the UID and GID used within the container and on the host match. When user namespaces are in use, however, the UID and GID in the container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container by default corresponds to the UID and GID of the user invoking Podman. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/userns-gid-map-group.md b/versioned_docs/version-5.4.1/source/markdown/options/userns-gid-map-group.md new file mode 100644 index 000000000..847ee713f --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/userns-gid-map-group.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns-gid-map-group**=*group* + +Specifies that a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subgid` file which correspond to the specified group. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-uid-map-user is specified, but --userns-gid-map-group is not specified, `podman` assumes that the specified user name is also a +suitable group name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/userns-gid-map.md b/versioned_docs/version-5.4.1/source/markdown/options/userns-gid-map.md new file mode 100644 index 000000000..07b0851a9 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/userns-gid-map.md @@ -0,0 +1,24 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns-gid-map**=*mapping* + +Directly specifies a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container GID, a corresponding starting host-level GID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-gids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-gid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-gid-map are specified, but --userns-uid-map is specified, the GID map is set to use the same numeric values as the UID map. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/userns-uid-map-user.md b/versioned_docs/version-5.4.1/source/markdown/options/userns-uid-map-user.md new file mode 100644 index 000000000..6bc7c7bed --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/userns-uid-map-user.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns-uid-map-user**=*user* + +Specifies that a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subuid` file which correspond to the specified user. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-gid-map-group is specified, but --userns-uid-map-user is not specified, `podman` assumes that the specified group name is also a +suitable user name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/userns-uid-map.md b/versioned_docs/version-5.4.1/source/markdown/options/userns-uid-map.md new file mode 100644 index 000000000..12ef85c6d --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/userns-uid-map.md @@ -0,0 +1,24 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns-uid-map**=*mapping* + +Directly specifies a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions default to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container UID, a corresponding starting host-level UID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-uids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-uid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-uid-map are specified, but --userns-gid-map is specified, the UID map is set to use the same numeric values as the GID map. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/userns.container.md b/versioned_docs/version-5.4.1/source/markdown/options/userns.container.md new file mode 100644 index 000000000..dacbffd55 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/userns.container.md @@ -0,0 +1,74 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, kube play, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns**=*mode* + +Set the user namespace mode for the container. + +If `--userns` is not set, the default value is determined as follows. +- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used. +- If the environment variable **PODMAN_USERNS** is set its value is used. +- If `userns` is specified in `containers.conf` this value is used. +- Otherwise, `--userns=host` is assumed. + +`--userns=""` (i.e., an empty string) is an alias for `--userns=host`. + +This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +------------------------|-----------|--------------------- +auto | $UID | nil (Host User UID is not mapped into container.) +host | $UID | 0 (Default User account mapped to root user in container.) +keep-id | $UID | $UID (Map user account to same UID within container.) +keep-id\:uid=200,gid=210 | $UID | 200:210 (Map user account to specified UID, GID value within container.) +nomap | $UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + +**auto**[\:_OPTIONS,..._]: automatically create a unique user namespace. + +* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. + + Example: `containers:2147483647:2147483648`. + +* `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5). + +Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user IDs. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. + +The option `--userns=keep-id` uses all the subuids and subgids of the user. +The option `--userns=nomap` uses all the subuids and subgids of the user except the user's own ID. +Using `--userns=auto` when starting new containers does not work as long as any containers exist that were started with `--userns=nomap` or `--userns=keep-id` without limiting the user namespace size. + + Valid `auto` options: + + - *gidmapping*=_CONTAINER\_GID\:HOST\_GID\:SIZE_: to force a GID mapping to be present in the user namespace. + - *size*=_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates a size for the user namespace. + - *uidmapping*=_CONTAINER\_UID\:HOST\_UID\:SIZE_: to force a UID mapping to be present in the user namespace. + +The host UID and GID in *gidmapping* and *uidmapping* can optionally be prefixed with the `@` symbol. +In this case, podman will look up the intermediate ID corresponding to host ID and it will map the found intermediate ID to the container id. +For details see **--uidmap**. + +**container:**_id_: join the user namespace of the specified container. + +**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user. + +**keep-id**: creates a user namespace where the current user's UID\:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace. + + Valid `keep-id` options: + + - *uid*=UID: override the UID inside the container that is used to map the current user to. + - *gid*=GID: override the GID inside the container that is used to map the current user to. + - *size*=SIZE: override the size of the configured user namespace. It is useful to not saturate all the available IDs. Not supported when running as root. + +**nomap**: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +**ns:**_namespace_: run the <> in the given existing user namespace. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/userns.image.md b/versioned_docs/version-5.4.1/source/markdown/options/userns.image.md new file mode 100644 index 000000000..9055ac479 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/userns.image.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns**=*how* + +Sets the configuration for user namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new user namespace is created, it can be "host" to indicate that the user namespace in which `podman` itself is being run is reused, or it can be the path to a user namespace which is already in use by another process. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/userns.pod.md b/versioned_docs/version-5.4.1/source/markdown/options/userns.pod.md new file mode 100644 index 000000000..77b514f19 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/userns.pod.md @@ -0,0 +1,38 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns**=*mode* + +Set the user namespace mode for all the containers in a pod. It defaults to the `PODMAN_USERNS` environment variable. An empty value ("") means user namespaces are disabled. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +----------|---------------|--------------------- +"" |$UID |0 (Default User account mapped to root user in container.) +host |$UID |0 (Default User account mapped to root user in container.) +keep-id |$UID |$UID (Map user account to same UID within container.) +auto |$UID | nil (Host User UID is not mapped into container.) +nomap |$UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + + - *auto[:*_OPTIONS,..._*]*: automatically create a namespace. It is possible to specify these options to `auto`: + + - *gidmapping=*_CONTAINER\_GID\:HOST\_GID\:SIZE_ to force a GID mapping to be present in the user namespace. + + - *size=*_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates the size for the user namespace. + + - *uidmapping=*_CONTAINER\_UID\:HOST\_UID\:SIZE_ to force a UID mapping to be present in the user namespace. + + - *host*: run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user (default). + + - *keep-id*: creates a user namespace where the current rootless user's UID\:GID are mapped to the same values in the container. This option is not allowed for containers created by the root user. + + - *nomap*: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/uts.container.md b/versioned_docs/version-5.4.1/source/markdown/options/uts.container.md new file mode 100644 index 000000000..7a155a429 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/uts.container.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uts**=*mode* + +Set the UTS namespace mode for the container. The following values are supported: + +- **host**: use the host's UTS namespace inside the container. +- **private**: create a new namespace for the container (default). +- **ns:[path]**: run the container in the given existing UTS namespace. +- **container:[container]**: join the UTS namespace of the specified container. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/uts.md b/versioned_docs/version-5.4.1/source/markdown/options/uts.md new file mode 100644 index 000000000..1ca2e247d --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/uts.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uts**=*how* + +Sets the configuration for UTS namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new UTS namespace to be created, or it can be "host" to indicate that the UTS namespace in which `podman` itself is being run is reused, or it can be the path to a UTS namespace which is already in use by another process. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/uts.pod.md b/versioned_docs/version-5.4.1/source/markdown/options/uts.pod.md new file mode 100644 index 000000000..ce0dcc8b1 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/uts.pod.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uts**=*mode* + +Set the UTS namespace mode for the pod. The following values are supported: + +- **host**: use the host's UTS namespace inside the pod. +- **private**: create a new namespace for the pod (default). +- **ns:[path]**: run the pod in the given existing UTS namespace. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/variant.container.md b/versioned_docs/version-5.4.1/source/markdown/options/variant.container.md new file mode 100644 index 000000000..e51304b73 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/variant.container.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--variant**=*VARIANT* + +Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/variant.manifest.md b/versioned_docs/version-5.4.1/source/markdown/options/variant.manifest.md new file mode 100644 index 000000000..f7389a941 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/variant.manifest.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman manifest add, manifest annotate +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--variant** + +Specify the variant which the list or index records for the image. This option +is typically used to distinguish between multiple entries which share the same +architecture value, but which expect different versions of its instruction set. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/volume.image.md b/versioned_docs/version-5.4.1/source/markdown/options/volume.image.md new file mode 100644 index 000000000..7316ba5f0 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/volume.image.md @@ -0,0 +1,125 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--volume**, **-v**=*[HOST-DIR\:CONTAINER-DIR[\\\:OPTIONS]]* + +Mount a host directory into containers when executing RUN instructions during +the build. + +The `OPTIONS` are a comma-separated list and can be one or more of: + + * [rw|ro] + * [z|Z|O] + * [U] + * [`[r]shared`|`[r]slave`|`[r]private`][[1]](#Footnote1) + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR` +must be an absolute path as well. Podman bind-mounts the `HOST-DIR` to the +specified path when processing RUN instructions. + +You can specify multiple **-v** options to mount one or more mounts. + +You can add the `:ro` or `:rw` suffix to a volume to mount it read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted. When running using user namespaces, the UID and GID inside +the namespace may correspond to another UID and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the namespace, to change recursively the owner and group of +the source volume. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add one of these two suffixes +`:z` or `:Z` to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The `z` option tells Podman that two containers +share the volume content. As a result, Podman labels the content with a shared +content label. Shared volume labels allow all containers to read/write content. +The `Z` option tells Podman to label the content with a private unshared label. +Only the current container can use a private volume. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the host machine to fail. For these types +of containers, disabling SELinux separation is recommended. The option +`--security-opt label=disable` disables SELinux separation for the container. +For example, if a user wanted to volume mount their entire home directory into the build containers, they need to disable SELinux separation. + + $ podman build --security-opt label=disable -v $HOME:/home/user . + +`Overlay Volume Mounts` + +The `:O` flag tells Podman to mount the directory from the host as a +temporary storage using the Overlay file system. The `RUN` command containers +are allowed to modify contents within the mountpoint and are stored in the +container storage in a separate directory. In Overlay FS terms the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the `RUN` command +finishes executing, similar to a tmpfs mount point. + +Any subsequent execution of `RUN` commands sees the original source directory +content, any changes from previous RUN commands no longer exists. + +One use case of the `overlay` mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: + +- Overlay mounts are not currently supported in rootless mode. +- The `O` flag is not allowed to be specified with the `Z` or `z` flags. + Content mounted into the container is labeled with the private label. + On SELinux systems, labels in the source directory needs to be readable + by the container label. If not, SELinux container separation must be disabled + for the container to work. +- Modification of the directory volume mounted into the container with an + overlay mount can cause unexpected failures. Do not modify the directory until + the container finishes running. + +By default bind mounted volumes are `private`. That means any mounts done +inside containers are not be visible on the host and vice versa. This behavior +can be changed by specifying a volume mount propagation property. + +When the mount propagation policy is set to `shared`, any mounts completed +inside the container on that volume is visible to both the host and +container. When the mount propagation policy is set to `slave`, one way mount +propagation is enabled and any mounts completed on the host for that volume is +visible only inside of the container. To control the mount propagation +property of volume use the `:[r]shared`, `:[r]slave` or `:[r]private` +propagation flag. For mount propagation to work on the source mount point (mount +point where source dir is mounted on) has to have the right propagation properties. +For shared volumes, the source mount point has to be shared. And for slave volumes, +the source mount has to be either shared or slave. [[1]](#Footnote1) + +Use `df ` to determine the source mount and then use +`findmnt -o TARGET,PROPAGATION ` to determine propagation +properties of source mount, if `findmnt` utility is not available, the source +mount point can be determined by looking at the mount entry in +`/proc/self/mountinfo`. Look at `optional fields` and see if any propagation +properties are specified. +`shared:X` means the mount is `shared`, `master:X` means the mount is `slave` +and if nothing is there that means the mount is `private`. [[1]](#Footnote1) + +To change propagation properties of a mount point use the `mount` command. For +example, to bind mount the source directory `/foo` do +`mount --bind /foo /foo` and `mount --make-private --make-shared /foo`. This +converts /foo into a `shared` mount point. The propagation properties of +the source mount can be changed directly. For instance if `/` is the source +mount for `/foo`, then use `mount --make-shared /` to convert `/` into a +`shared` mount. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/volume.md b/versioned_docs/version-5.4.1/source/markdown/options/volume.md new file mode 100644 index 000000000..4990e1f22 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/volume.md @@ -0,0 +1,214 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the <> is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +<>. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a <> is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the <>, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the <>. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a <>. Without a label, the security system +might prevent the processes running inside the <> from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the <> context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +<> share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label Only the current <> can use a private +volume. Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any of one the containers. Relabeling walks +the file system under the volume and changes the label on each file, if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the <>. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually change with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the <>. +For example if a user wanted to volume mount their entire home directory into a +<>, they need to disable SELinux separation. + + $ podman <> --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The <> processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the <> +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous <> executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the <<|pod infra>> container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the <<|pod or infra>> container +to work. + +Do not modify the source directory mounted into the <> with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the <> are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the <> +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +<>, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +<>. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the <>. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the <>. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless <> fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/volumes-from.md b/versioned_docs/version-5.4.1/source/markdown/options/volumes-from.md new file mode 100644 index 000000000..2e9db26d8 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/volumes-from.md @@ -0,0 +1,41 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--volumes-from**=*CONTAINER[\\\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers<<| and pods>>. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +<>. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a <>. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the <> context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target <>, then the volume hides +that data on the target. diff --git a/versioned_docs/version-5.4.1/source/markdown/options/workdir.md b/versioned_docs/version-5.4.1/source/markdown/options/workdir.md new file mode 100644 index 000000000..2b3bb31e4 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/options/workdir.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.1 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--workdir**, **-w**=*dir* + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (**/**). +The image developer can set a different default with the WORKDIR instruction. The operator +can override the working directory by using the **-w** option. diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-artifact-add.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-artifact-add.1.md new file mode 100644 index 000000000..37a1f7cf3 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-artifact-add.1.md @@ -0,0 +1,68 @@ +--- +title: podman-artifact-add +version: v5.4.1 +--- + +% podman-artifact-add 1 + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-add - Add an OCI artifact to the local store + +## SYNOPSIS +**podman artifact add** *name* *file* [*file*]... + +## DESCRIPTION + +Add an OCI artifact to the local store from the local filesystem. You must +provide at least one file to create the artifact, but several can also be +added. + + +## OPTIONS + + +[//]: # (BEGIN included file options/annotation.manifest.md) +#### **--annotation**=*annotation=value* + +Set an annotation on the entry for the specified image or artifact. + +[//]: # (END included file options/annotation.manifest.md) + +#### **--help** + +Print usage statement. + +#### **--type** + +Set a type for the artifact being added. + +## EXAMPLES + +Add a single file to an artifact + +``` +$ podman artifact add quay.io/myartifact/myml:latest /tmp/foobar.ml +0fe1488ecdef8cc4093e11a55bc048d9fc3e13a4ba846efd24b5a715006c95b3 +``` + +Add multiple files to an artifact +``` +$ podman artifact add quay.io/myartifact/myml:latest /tmp/foobar1.ml /tmp/foobar2.ml +1487acae11b5a30948c50762882036b41ac91a7b9514be8012d98015c95ddb78 +``` + +Set an annotation for an artifact +``` +$ podman artifact add --annotation date=2025-01-30 quay.io/myartifact/myml\:latest /tmp/foobar1.ml +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-artifact-inspect.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-artifact-inspect.1.md new file mode 100644 index 000000000..62c633369 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-artifact-inspect.1.md @@ -0,0 +1,43 @@ +--- +title: podman-artifact-inspect +version: v5.4.1 +--- + +% podman-artifact-inspect 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-inspect - Inspect an OCI artifact + +## SYNOPSIS +**podman artifact inspect** [*name*] ... + +## DESCRIPTION + +Inspect an artifact in the local store. The artifact can be referred to with either: + +1. Fully qualified artifact name +2. Full or partial digest of the artifact's manifest + +## OPTIONS + +#### **--help** + +Print usage statement. + +## EXAMPLES + +Inspect an OCI image in the local store. +``` +$ podman artifact inspect quay.io/myartifact/myml\:latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Sept 2024, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-artifact-ls.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-artifact-ls.1.md new file mode 100644 index 000000000..0981f9fa6 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-artifact-ls.1.md @@ -0,0 +1,90 @@ +--- +title: podman-artifact-ls +version: v5.4.1 +--- + +% podman-artifact-ls 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-ls - List OCI artifacts in local store + +## SYNOPSIS +**podman artifact ls** [*options*] + +## DESCRIPTION + +List all local artifacts in your local store. + +## OPTIONS + +#### **--format** + +Print results with a Go template. + +| **Placeholder** | **Description** | +|-----------------|------------------------------------------------| +| .Digest | The computed digest of the artifact's manifest | +| .Repository | Repository name of the artifact | +| .Size | Size artifact in human readable units | +| .Tag | Tag of the artifact name | + + +[//]: # (BEGIN included file options/no-trunc.md) +#### **--no-trunc** + +Do not truncate the output (default *false*). + +[//]: # (END included file options/no-trunc.md) + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +## EXAMPLES + +List artifacts in the local store +``` +$ podman artifact ls +REPOSITORY TAG DIGEST SIZE +quay.io/artifact/foobar1 latest ab609fad386d 2.097GB +quay.io/artifact/foobar2 special cd734b558ceb 12.58MB +``` + +List artifacts in the local store without truncating the digest +``` +$ podman artifact ls --no-trunc +REPOSITORY TAG DIGEST SIZE +quay.io/artifact/foobar1 latest ab609fad386df1433f461b0643d9cf575560baf633809dcc9c190da6cc3a3c29 2.097GB +quay.io/artifact/foobar2 special cd734b558ceb8ccc0281ca76530e1dea1eb479407d3163f75fb601bffb6f73d0 12.58MB +``` + +List artifacts in the local store without the title header +``` +$ podman artifact ls --noheading +quay.io/artifact/foobar1 latest ab609fad386d 2.097GB +quay.io/artifact/foobar2 special cd734b558ceb 12.58MB +``` + +List artifact digests and size using a --format +``` +$ podman artifact ls --format "{{.Digest}} {{.Size}}" +ab609fad386d 2.097GB +cd734b558ceb 12.58MB +``` + + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-artifact-pull.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-artifact-pull.1.md new file mode 100644 index 000000000..05add34f4 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-artifact-pull.1.md @@ -0,0 +1,140 @@ +--- +title: podman-artifact-pull +version: v5.4.1 +--- + +% podman-artifact-pull 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-pull - Pulls an artifact from a registry and stores it locally + +## SYNOPSIS +**podman artifact pull** [*options*] *source* + + +## DESCRIPTION +podman artifact pull copies an artifact from a registry onto the local machine. + + +## SOURCE +SOURCE is the location from which the artifact image is obtained. + +``` +# Pull from a registry +$ podman artifact pull quay.io/foobar/artifact\:special +``` + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +#### **--help**, **-h** + +Print the usage statement. + +#### **--quiet**, **-q** + +Suppress output information when pulling images + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## FILES + +## EXAMPLES +Pull an artifact from a registry + +``` +podman artifact pull quay.io/baude/artifact\:josey +Getting image source signatures +Copying blob e741c35a27bb done | +Copying config 44136fa355 done | +Writing manifest to image destination + +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-artifact-push.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-artifact-push.1.md new file mode 100644 index 000000000..232d24624 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-artifact-push.1.md @@ -0,0 +1,149 @@ +--- +title: podman-artifact-push +version: v5.4.1 +--- + +% podman-artifact-push 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-push - Push an OCI artifact from local storage to an image registry + +## SYNOPSIS +**podman artifact push** [*options*] *image* + +## DESCRIPTION +Pushes an artifact from the local artifact store to an image registry. + +``` +# Push artifact to a container registry +$ podman artifact push quay.io/artifact/foobar1\:latest +``` + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\\\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/digestfile.md) +#### **--digestfile**=*Digestfile* + +After copying the image, write the digest of the resulting image to the file. + +[//]: # (END included file options/digestfile.md) + +#### **--quiet**, **-q** + +When writing the output image, suppress progress output + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + +#### **--sign-by**=*key* + +Add a “simple signing” signature at the destination using the specified key. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-by-sigstore.md) +#### **--sign-by-sigstore**=*param-file* + +Add a sigstore signature based on further options specified in a container's sigstore signing parameter file *param-file*. +See containers-sigstore-signing-params.yaml(5) for details about the file format. + +[//]: # (END included file options/sign-by-sigstore.md) + + +#### **--sign-by-sigstore-private-key**=*path* + +Add a sigstore signature at the destination using a private key at the specified path. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-passphrase-file.md) +#### **--sign-passphrase-file**=*path* + +If signing the image (using either **--sign-by** or **--sign-by-sigstore-private-key**), read the passphrase to use from the specified path. + +[//]: # (END included file options/sign-passphrase-file.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLE + +Push the specified iage to a container registry: +``` +$ podman artifact push quay.io/baude/artifact\:single +Getting image source signatures +Copying blob 3ddc0a3cdb61 done | +Copying config 44136fa355 done | +Writing manifest to image destination +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)**, **[podman-pull(1)](podman-pull.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** + + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-artifact-rm.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-artifact-rm.1.md new file mode 100644 index 000000000..2c91b526a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-artifact-rm.1.md @@ -0,0 +1,51 @@ +--- +title: podman-artifact-rm +version: v5.4.1 +--- + +% podman-artifact-rm 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-rm - Remove an OCI from local storage + +## SYNOPSIS +**podman artifact rm** *name* + +## DESCRIPTION + +Remove an artifact from the local artifact store. The input may be the fully +qualified artifact name or a full or partial artifact digest. + +## OPTIONS + +#### **--help** + +Print usage statement. + + +## EXAMPLES + +Remove an artifact by name + +``` +$ podman artifact rm quay.io/artifact/foobar2\:test +e7b417f49fc24fc7ead6485da0ebd5bc4419d8a3f394c169fee5a6f38faa4056 +``` + +Remove an artifact by partial digest + +``` +$ podman artifact rm e7b417f49fc +e7b417f49fc24fc7ead6485da0ebd5bc4419d8a3f394c169fee5a6f38faa4056 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-artifact.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-artifact.1.md new file mode 100644 index 000000000..2c279fe38 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-artifact.1.md @@ -0,0 +1,41 @@ +--- +title: podman-artifact +version: v5.4.1 +--- + +% podman-artifact 1 + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact - Manage OCI artifacts + +## SYNOPSIS +**podman artifact** *subcommand* + +## DESCRIPTION +`podman artifact` is a set of subcommands that manage OCI artifacts. + +OCI artifacts are a common way to distribute files that are associated with OCI images and +containers. Podman is capable of managing (pulling, inspecting, pushing) these artifacts +from its local "artifact store". + +## SUBCOMMANDS + +| Command | Man Page | Description | +|---------|------------------------------------------------------------|--------------------------------------------------------------| +| add | [podman-artifact-add(1)](podman-artifact-add.1.md) | Add an OCI artifact to the local store | +| inspect | [podman-artifact-inspect(1)](podman-artifact-inspect.1.md) | Inspect an OCI artifact | +| ls | [podman-artifact-ls(1)](podman-artifact-ls.1.md) | List OCI artifacts in local store | +| pull | [podman-artifact-pull(1)](podman-artifact-pull.1.md) | Pulls an artifact from a registry and stores it locally | +| push | [podman-artifact-push(1)](podman-artifact-push.1.md) | Push an OCI artifact from local storage to an image registry | +| rm | [podman-artifact-rm(1)](podman-artifact-rm.1.md) | Remove an OCI from local storage | + + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +Sept 2024, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-attach.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-attach.1.md new file mode 100644 index 000000000..0be6d656a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-attach.1.md @@ -0,0 +1,78 @@ +--- +title: podman-attach +version: v5.4.1 +--- + +% podman-attach 1 + +## NAME +podman\-attach - Attach to a running container + +## SYNOPSIS +**podman attach** [*options*] *container* + +**podman container attach** [*options*] *container* + +## DESCRIPTION +**podman attach** attaches to a running *container* using the *container's name* or *ID*, to either view its ongoing output or to control it interactively.\ +The *container* can be detached from (and leave it running) using a configurable key sequence. The default sequence is `ctrl-p,ctrl-q`. Configure the keys sequence using the **--detach-keys** OPTION, or specifying it in the `containers.conf` file: see **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** for more information. + +## OPTIONS + +[//]: # (BEGIN included file options/detach-keys.md) +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. + +[//]: # (END included file options/detach-keys.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--no-stdin** + +Do not attach STDIN. The default is **false**. + + +[//]: # (BEGIN included file options/sig-proxy.md) +#### **--sig-proxy** + +Proxy received signals to the container process. SIGCHLD, SIGURG, SIGSTOP, and SIGKILL are not proxied. + +[//]: # (END included file options/sig-proxy.md) + +The default is **true**. + +## EXAMPLES +Attach to a container called "foobar". +``` +$ podman attach foobar +``` + +Attach to the latest created container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman attach --latest +``` + +Attach to a container that start with the ID "1234". +``` +$ podman attach 1234 +``` + +Attach to a container without attaching STDIN. +``` +$ podman attach --no-stdin foobar +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-exec(1)](podman-exec.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-auto-update.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-auto-update.1.md new file mode 100644 index 000000000..527939aab --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-auto-update.1.md @@ -0,0 +1,146 @@ +--- +title: podman-auto-update +version: v5.4.1 +--- + +% podman-auto-update 1 + +## NAME +podman\-auto-update - Auto update containers according to their auto-update policy + +## SYNOPSIS +**podman auto-update** [*options*] + +## DESCRIPTION +**podman auto-update** pulls down new container images and restarts containers configured for auto updates. +To make use of auto updates, the container or Kubernetes workloads must run inside a systemd unit. +After a successful update of an image, the containers using the image get updated by restarting the systemd units they run in. +Please refer to `podman-systemd.unit(5)` on how to run Podman under systemd. + +To configure a container for auto updates, it must be created with the `io.containers.autoupdate` label or the `AutoUpdate` field in `podman-systemd.unit(5)` with one of the following two values: + +* `registry`: If the label is present and set to `registry`, Podman reaches out to the corresponding registry to check if the image has been updated. +The label `image` is an alternative to `registry` maintained for backwards compatibility. +An image is considered updated if the digest in the local storage is different than the one of the remote image. +If an image must be updated, Podman pulls it down and restarts the systemd unit executing the container. +The registry policy requires a fully-qualified image reference (e.g., quay.io/podman/stable\\:latest) to be used to create the container. +This enforcement is necessary to know which image to actually check and pull. +If an image ID was used, Podman would not know which image to check/pull anymore. + +* `local`: If the autoupdate label is set to `local`, Podman compares the image digest of the container to the one in the local container storage. +If they differ, the local image is considered to be newer and the systemd unit gets restarted. + +### Auto Updates and Kubernetes YAML + +Podman supports auto updates for Kubernetes workloads. The auto-update policy can be configured directly via `podman-systemd.unit(5)` or inside the Kubernetes YAML with the Podman-specific annotations mentioned below: + +* `io.containers.autoupdate`: "registry|local" to apply the auto-update policy to all containers +* `io.containers.autoupdate/$container`: "registry|local" to apply the auto-update policy to `$container` only +* `io.containers.sdnotify`: "conmon|container" to apply the sdnotify policy to all containers +* `io.containers.sdnotify/$container`: "conmon|container" to apply the sdnotify policy to `$container` only + +By default, the autoupdate policy is set to "disabled", the sdnotify policy is set to "conmon". + +### Systemd Unit and Timer + +Podman ships with a `podman-auto-update.service` systemd unit. This unit is triggered daily at midnight by the `podman-auto-update.timer` systemd timer. +The timer can be altered for custom time-based updates if desired. +The unit can further be invoked by other systemd units (e.g., via the dependency tree) or manually via **systemctl start podman-auto-update.service**. + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + +Alternatively, the `io.containers.autoupdate.authfile` container label can be configured. In that case, Podman will use the specified label's value instead. + +#### **--dry-run** + +Check for the availability of new images but do not perform any pull operation or restart any service or container. +The `UPDATED` field indicates the availability of a new image with "pending". + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| --------------- | -------------------------------------- | +| .Container | ID and name of the container | +| .ContainerID | ID of the container | +| .ContainerName | Name of the container | +| .Image | Name of the image | +| .Policy | Auto-update policy of the container | +| .Unit | Name of the systemd unit | +| .Updated | Update status: true,false,failed | + +#### **--rollback** + +If restarting a systemd unit after updating the image has failed, rollback to using the previous image and restart the unit another time. Default is true. + +Note that detecting if a systemd unit has failed is best done by the container sending the READY message via SDNOTIFY. +This way, restarting the unit waits until having received the message or a timeout kicked in. +Without that, restarting the systemd unit may succeed even if the container has failed shortly after. + +For a container to send the READY message via SDNOTIFY it must be created with the `--sdnotify=container` option (see podman-run(1)). +The application running inside the container can then execute `systemd-notify --ready` when ready or use the sdnotify bindings of the specific programming language (e.g., sd_notify(3)). + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Create a Quadlet file configured for auto updates: +``` +$ cat ~/.config/containers/systemd/sleep.container +[Container] +Image=registry.fedoraproject.org/fedora:latest +Exec=sleep infinity +AutoUpdate=registry +``` + +Generate a systemd service from the Quadlet file by reloading the systemd user daemon: +``` +$ systemctl --user daemon-reload +``` + +Start the systemd service and make sure the container is running +``` +$ systemctl --user start sleep.service +$ podman ps +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +f8e4759798d4 registry.fedoraproject.org/fedora:latest sleep infinity 2 seconds ago Up 2 seconds systemd-sleep +``` + +Check if a new image is available via `--dry-run`: +``` +$ podman auto-update --dry-run --format "{{.Image}} {{.Updated}}" +registry.fedoraproject.org/fedora:latest pending +``` + +Update the service: +``` +$ podman auto-update +UNIT CONTAINER IMAGE POLICY UPDATED +sleep.service f8e4759798d4 (systemd-sleep) registry.fedoraproject.org/fedora\\:latest registry true +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-generate-systemd(1)](podman-generate-systemd.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-systemd.unit(5)](podman-systemd.unit.5.md)**, **sd_notify(3)**, **[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-build.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-build.1.md new file mode 100644 index 000000000..cbaf489b2 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-build.1.md @@ -0,0 +1,1943 @@ +--- +title: podman-build +version: v5.4.1 +--- + +% podman-build 1 + +## NAME +podman\-build - Build a container image using a Containerfile + +## SYNOPSIS +**podman build** [*options*] [*context*] + +**podman image build** [*options*] [*context*] + +## DESCRIPTION +**podman build** Builds an image using instructions from one or more +Containerfiles or Dockerfiles and a specified build context directory. A +Containerfile uses the same syntax as a Dockerfile internally. For this +document, a file referred to as a Containerfile can be a file named +either 'Containerfile' or 'Dockerfile' exclusively. Any file that has additional +extension attached will not be recognized by `podman build .` unless a `-f` flag is +used to specify the file. + +The build context directory can be specified as the http(s) URL of an archive, +git repository or Containerfile. + +When invoked with `-f` and a path to a Containerfile, with no explicit CONTEXT +directory, Podman uses the Containerfile's parent directory as its build context. + +Containerfiles ending with a ".in" suffix are preprocessed via CPP(1). This +can be useful to decompose Containerfiles into several reusable parts that can +be used via CPP's **#include** directive. Containerfiles ending in .in are +restricted to no comment lines unless they are CPP commands. +Note, a Containerfile.in file can still be used by other tools when manually +preprocessing them via `cpp -E`. + +When the URL is an archive, the contents of the URL is downloaded to a temporary +location and extracted before execution. + +When the URL is a Containerfile, the Containerfile is downloaded to a temporary +location. + +When a Git repository is set as the URL, the repository is cloned locally and +then set as the context. A URL is treated as a Git repository if it +has a `git://` prefix or a `.git` suffix. + +NOTE: `podman build` uses code sourced from the `Buildah` project to build +container images. This `Buildah` code creates `Buildah` containers for the +`RUN` options in container storage. In certain situations, when the +`podman build` crashes or users kill the `podman build` process, these external +containers can be left in container storage. Use the `podman ps --all --external` +command to see these containers. + +`podman buildx build` command is an alias of `podman build`. Not all `buildx build` features are available in Podman. The `buildx build` option is provided for scripting compatibility. + +## OPTIONS + + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the container's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + +#### **--all-platforms** + +Instead of building for a set of platforms specified using the **--platform** option, inspect the build's base images, and build for all of the platforms for which they are all available. Stages that use *scratch* as a starting point can not be inspected, so at least one non-*scratch* stage must be present for detection to work usefully. + + +[//]: # (BEGIN included file options/annotation.image.md) +#### **--annotation**=*annotation=value* + +Add an image *annotation* (e.g. annotation=*value*) to the image metadata. Can +be used multiple times. + +Note: this information is not present in Docker image formats, so it is +discarded when writing images in Docker formats. + +[//]: # (END included file options/annotation.image.md) + +#### **--arch**=*arch* + +Set the architecture of the image to be built, and that of the base image to be +pulled, if the build uses one, to the provided value instead of using the +architecture of the build host. Unless overridden, subsequent lookups of the +same image in the local storage matches this architecture, regardless of the +host. (Examples: arm, arm64, 386, amd64, ppc64le, s390x) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/build-arg.md) +#### **--build-arg**=*arg=value* + +Specifies a build argument and its value, which is interpolated in +instructions read from the Containerfiles in the same way that environment variables are, but which are not added to environment variable list in the resulting image's configuration. + +[//]: # (END included file options/build-arg.md) + + +[//]: # (BEGIN included file options/build-arg-file.md) +#### **--build-arg-file**=*path* + +Specifies a file containing lines of build arguments of the form `arg=value`. +The suggested file name is `argfile.conf`. + +Comment lines beginning with `#` are ignored, along with blank lines. +All others must be of the `arg=value` format passed to `--build-arg`. + +If several arguments are provided via the `--build-arg-file` +and `--build-arg` options, the build arguments are merged across all +of the provided files and command line arguments. + +Any file provided in a `--build-arg-file` option is read before +the arguments supplied via the `--build-arg` option. + +When a given argument name is specified several times, the last instance +is the one that is passed to the resulting builds. This means `--build-arg` +values always override those in a `--build-arg-file`. + +[//]: # (END included file options/build-arg-file.md) + + +[//]: # (BEGIN included file options/build-context.md) +#### **--build-context**=*name=value* + +Specify an additional build context using its short name and its location. +Additional build contexts can be referenced in the same manner as we access +different stages in COPY instruction. + +Valid values are: + +* Local directory – e.g. --build-context project2=../path/to/project2/src (This option is not available with the remote Podman client. On Podman machine setup (i.e macOS and Windows) path must exists on the machine VM) +* HTTP URL to a tarball – e.g. --build-context src=https://example.org/releases/src.tar +* Container image – specified with a container-image:// prefix, e.g. --build-context alpine=container-image://alpine:3.15, (also accepts docker://, docker-image://) + +On the Containerfile side, reference the build context on all +commands that accept the “from” parameter. Here’s how that might look: + +```dockerfile +FROM [name] +COPY --from=[name] ... +RUN --mount=from=[name] … +``` + +The value of [name] is matched with the following priority order: + +* Named build context defined with --build-context [name]=.. +* Stage defined with AS [name] inside Containerfile +* Image [name], either local or in a remote registry + +[//]: # (END included file options/build-context.md) + + +[//]: # (BEGIN included file options/cache-from.md) +#### **--cache-from**=*image* + +Repository to utilize as a potential cache source. When specified, Buildah tries to look for +cache images in the specified repository and attempts to pull cache images instead of actually +executing the build steps locally. Buildah only attempts to pull previously cached images if they +are considered as valid cache hits. + +Use the `--cache-to` option to populate a remote repository with cache content. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-from` option is ignored unless `--layers` is specified. + +[//]: # (END included file options/cache-from.md) + + +[//]: # (BEGIN included file options/cache-to.md) +#### **--cache-to**=*image* + +Set this flag to specify a remote repository that is used to store cache images. Buildah attempts to +push newly built cache image to the remote repository. + +Note: Use the `--cache-from` option in order to use cache content in a remote repository. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-to` option is ignored unless `--layers` is specified. + +[//]: # (END included file options/cache-to.md) + + +[//]: # (BEGIN included file options/cache-ttl.md) +#### **--cache-ttl** + +Limit the use of cached images to only consider images with created timestamps less than *duration* ago. +For example if `--cache-ttl=1h` is specified, Buildah considers intermediate cache images which are created +under the duration of one hour, and intermediate cache images outside this duration is ignored. + +Note: Setting `--cache-ttl=0` manually is equivalent to using `--no-cache` in the +implementation since this means that the user does not want to use cache at all. + +[//]: # (END included file options/cache-ttl.md) + + +[//]: # (BEGIN included file options/cap-add.image.md) +#### **--cap-add**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability added to its capability set. +Certain capabilities are granted by default; this option can be used to add +more. + +[//]: # (END included file options/cap-add.image.md) + + +[//]: # (BEGIN included file options/cap-drop.image.md) +#### **--cap-drop**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability removed from its capability set. +The CAP\_CHOWN, CAP\_DAC\_OVERRIDE, CAP\_FOWNER, +CAP\_FSETID, CAP\_KILL, CAP\_NET\_BIND\_SERVICE, CAP\_SETFCAP, +CAP\_SETGID, CAP\_SETPCAP, and CAP\_SETUID capabilities are +granted by default; this option can be used to remove them. + +If a capability is specified to both the **--cap-add** and **--cap-drop** +options, it is dropped, regardless of the order in which the options were +given. + +[//]: # (END included file options/cap-drop.image.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the container is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cgroupns.image.md) +#### **--cgroupns**=*how* + +Sets the configuration for cgroup namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "private" to indicate +that a new cgroup namespace is created, or it can be "host" to indicate +that the cgroup namespace in which `buildah` itself is being run is reused. + +[//]: # (END included file options/cgroupns.image.md) + + +[//]: # (BEGIN included file options/compat-volumes.md) +#### **--compat-volumes** + +Handle directories marked using the VOLUME instruction (both in this build, and +those inherited from base images) such that their contents can only be modified +by ADD and COPY instructions. Any changes made in those locations by RUN +instructions will be reverted. Before the introduction of this option, this +behavior was the default, but it is now disabled by default. + +[//]: # (END included file options/compat-volumes.md) + +#### **--compress** + +This option is added to be aligned with other containers CLIs. +Podman doesn't communicate with a daemon or a remote server. +Thus, compressing the data before sending it is irrelevant to Podman. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/cpp-flag.md) +#### **--cpp-flag**=*flags* + +Set additional flags to pass to the C Preprocessor cpp(1). Containerfiles ending with a ".in" suffix is preprocessed via cpp(1). This option can be used to pass additional flags to cpp.Note: You can also set default CPPFLAGS by setting the BUILDAH_CPPFLAGS environment variable (e.g., export BUILDAH_CPPFLAGS="-DDEBUG"). + +[//]: # (END included file options/cpp-flag.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + +#### **--cw**=*options* + +Produce an image suitable for use as a confidential workload running in a +trusted execution environment (TEE) using krun (i.e., *crun* built with the +libkrun feature enabled and invoked as *krun*). Instead of the conventional +contents, the root filesystem of the image will contain an encrypted disk image +and configuration information for krun. + +The value for *options* is a comma-separated list of key=value pairs, supplying +configuration information which is needed for producing the additional data +which will be included in the container image. + +Recognized _keys_ are: + +*attestation_url*: The location of a key broker / attestation server. +If a value is specified, the new image's workload ID, along with the passphrase +used to encrypt the disk image, will be registered with the server, and the +server's location will be stored in the container image. +At run-time, krun is expected to contact the server to retrieve the passphrase +using the workload ID, which is also stored in the container image. +If no value is specified, a *passphrase* value *must* be specified. + +*cpus*: The number of virtual CPUs which the image expects to be run with at +run-time. If not specified, a default value will be supplied. + +*firmware_library*: The location of the libkrunfw-sev shared library. If not +specified, `buildah` checks for its presence in a number of hard-coded +locations. + +*memory*: The amount of memory which the image expects to be run with at +run-time, as a number of megabytes. If not specified, a default value will be +supplied. + +*passphrase*: The passphrase to use to encrypt the disk image which will be +included in the container image. +If no value is specified, but an *attestation_url* value is specified, a +randomly-generated passphrase will be used. +The authors recommend setting an *attestation_url* but not a *passphrase*. + +*slop*: Extra space to allocate for the disk image compared to the size of the +container image's contents, expressed either as a percentage (..%) or a size +value (bytes, or larger units if suffixes like KB or MB are present), or a sum +of two or more such specifications. If not specified, `buildah` guesses that +25% more space than the contents will be enough, but this option is provided in +case its guess is wrong. + +*type*: The type of trusted execution environment (TEE) which the image should +be marked for use with. Accepted values are "SEV" (AMD Secure Encrypted +Virtualization - Encrypted State) and "SNP" (AMD Secure Encrypted +Virtualization - Secure Nested Paging). If not specified, defaults to "SNP". + +*workload_id*: A workload identifier which will be recorded in the container +image, to be used at run-time for retrieving the passphrase which was used to +encrypt the disk image. If not specified, a semi-random value will be derived +from the base image's image ID. + +This option is not supported on the remote client, including Mac and Windows +(excluding WSL2) machines. + + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the container. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The container only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: if the user only has access rights via a group, accessing the device +from inside a rootless container fails. The **[crun(1)](https://github.com/containers/crun/tree/main/crun.1.md)** runtime offers a +workaround for this by adding the option +**--annotation run.oci.keep_original_groups=1**. + + +[//]: # (BEGIN included file options/disable-compression.md) +#### **--disable-compression**, **-D** + +Don't compress filesystem layers when building the image unless it is required +by the location where the image is being written. This is the default setting, +because image layers are compressed automatically when they are pushed to +registries, and images being written to local storage only need to be +decompressed again to be stored. Compression can be forced in all cases by +specifying **--disable-compression=false**. + +[//]: # (END included file options/disable-compression.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + + +[//]: # (BEGIN included file options/dns.md) +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. + +[//]: # (END included file options/dns.md) + +This option cannot be combined with **--network** that is set to **none**. + +Note: this option takes effect only during *RUN* instructions in the build. +It does not affect _/etc/resolv.conf_ in the final image. + + +[//]: # (BEGIN included file options/dns-option.image.md) +#### **--dns-option**=*option* + +Set custom DNS options to be used during the build. + +[//]: # (END included file options/dns-option.image.md) + + +[//]: # (BEGIN included file options/dns-search.image.md) +#### **--dns-search**=*domain* + +Set custom DNS search domains to be used during the build. + +[//]: # (END included file options/dns-search.image.md) + + +[//]: # (BEGIN included file options/env.image.md) +#### **--env**=*env[=value]* + +Add a value (e.g. env=*value*) to the built image. Can be used multiple times. +If neither `=` nor a *value* are specified, but *env* is set in the current +environment, the value from the current environment is added to the image. +To remove an environment variable from the built image, use the `--unsetenv` +option. + +[//]: # (END included file options/env.image.md) + + +[//]: # (BEGIN included file options/file.md) +#### **--file**, **-f**=*Containerfile* + +Specifies a Containerfile which contains instructions for building the image, +either a local file or an **http** or **https** URL. If more than one +Containerfile is specified, *FROM* instructions are only be accepted from the +last specified file. + +If a build context is not specified, and at least one Containerfile is a +local file, the directory in which it resides is used as the build +context. + +Specifying the option `-f -` causes the Containerfile contents to be read from stdin. + +[//]: # (END included file options/file.md) + + +[//]: # (BEGIN included file options/force-rm.md) +#### **--force-rm** + +Always remove intermediate containers after a build, even if the build fails (default true). + +[//]: # (END included file options/force-rm.md) + + +[//]: # (BEGIN included file options/format.md) +#### **--format** + +Control the format for the built image's manifest and configuration data. +Recognized formats include *oci* (OCI image-spec v1.0, the default) and +*docker* (version 2, using schema format 2 for the manifest). + +Note: You can also override the default format by setting the BUILDAH\_FORMAT +environment variable. `export BUILDAH_FORMAT=docker` + +[//]: # (END included file options/format.md) + + +[//]: # (BEGIN included file options/from.md) +#### **--from** + +Overrides the first `FROM` instruction within the Containerfile. If there are multiple +FROM instructions in a Containerfile, only the first is changed. + +With the remote podman client, not all container transports work as +expected. For example, oci-archive:/x.tar references /x.tar on the remote +machine instead of on the client. When using podman remote clients it is +best to restrict use to *containers-storage*, and *docker:// transports*. + +[//]: # (END included file options/from.md) + + +[//]: # (BEGIN included file options/group-add.md) +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/group-add.md) + + +[//]: # (BEGIN included file options/help.md) +#### **--help**, **-h** + +Print usage statement + +[//]: # (END included file options/help.md) + + +[//]: # (BEGIN included file options/hooks-dir.md) +#### **--hooks-dir**=*path* + +Each *.json file in the path configures a hook for buildah build containers. For more details on the syntax of the JSON files and the semantics of hook injection. Buildah currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. + +This option may be set multiple times; paths from later options have higher precedence. + +For the annotation conditions, buildah uses any annotations set in the generated OCI configuration. + +For the bind-mount conditions, only mounts explicitly requested by the caller via --volume are considered. Bind mounts that buildah inserts by default (e.g. /dev/shm) are not considered. + +If --hooks-dir is unset for root callers, Buildah currently defaults to /usr/share/containers/oci/hooks.d and /etc/containers/oci/hooks.d in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting --hooks-dir. + +[//]: # (END included file options/hooks-dir.md) + + +[//]: # (BEGIN included file options/http-proxy.md) +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. + +[//]: # (END included file options/http-proxy.md) + + +[//]: # (BEGIN included file options/identity-label.md) +#### **--identity-label** + +Adds default identity label `io.buildah.version` if set. (default true). + +[//]: # (END included file options/identity-label.md) + + +[//]: # (BEGIN included file options/ignorefile.md) +#### **--ignorefile** + +Path to an alternative .containerignore file. + +[//]: # (END included file options/ignorefile.md) + + +[//]: # (BEGIN included file options/iidfile.md) +#### **--iidfile**=*ImageIDfile* + +Write the built image's ID to the file. When `--platform` is specified more than once, attempting to use this option triggers an error. + +[//]: # (END included file options/iidfile.md) + + +[//]: # (BEGIN included file options/ipc.image.md) +#### **--ipc**=*how* + +Sets the configuration for IPC namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate +that a new IPC namespace is created, or it can be "host" to indicate +that the IPC namespace in which `podman` itself is being run is reused, +or it can be the path to an IPC namespace which is already in use by +another process. + +[//]: # (END included file options/ipc.image.md) + + +[//]: # (BEGIN included file options/isolation.md) +#### **--isolation**=*type* + +Controls what type of isolation is used for running processes as part of `RUN` +instructions. Recognized types include *oci* (OCI-compatible runtime, the +default), *rootless* (OCI-compatible runtime invoked using a modified +configuration and its --rootless option enabled, with *--no-new-keyring +--no-pivot* added to its *create* invocation, with network and UTS namespaces +disabled, and IPC, PID, and user namespaces enabled; the default for +unprivileged users), and *chroot* (an internal wrapper that leans more toward +chroot(1) than container technology). + +Note: You can also override the default isolation type by setting the +BUILDAH\_ISOLATION environment variable. `export BUILDAH_ISOLATION=oci` + +[//]: # (END included file options/isolation.md) + + +[//]: # (BEGIN included file options/jobs.md) +#### **--jobs**=*number* + +Run up to N concurrent stages in parallel. If the number of jobs is greater +than 1, stdin is read from /dev/null. If 0 is specified, then there is +no limit in the number of jobs that run in parallel. + +[//]: # (END included file options/jobs.md) + + +[//]: # (BEGIN included file options/label.image.md) +#### **--label**=*label* + +Add an image *label* (e.g. label=*value*) to the image metadata. Can be used +multiple times. + +Users can set a special LABEL **io.containers.capabilities=CAP1,CAP2,CAP3** in +a Containerfile that specifies the list of Linux capabilities required for the +container to run properly. This label specified in a container image tells +Podman to run the container with just these capabilities. Podman launches the +container with just the specified capabilities, as long as this list of +capabilities is a subset of the default list. + +If the specified capabilities are not in the default set, Podman prints an error +message and runs the container with the default capabilities. + +[//]: # (END included file options/label.image.md) + + +[//]: # (BEGIN included file options/layer-label.md) +#### **--layer-label**=*label[=value]* + +Add an intermediate image *label* (e.g. label=*value*) to the intermediate +image metadata. It can be used multiple times. + +If *label* is named, but neither `=` nor a `value` is provided, then +the *label* is set to an empty value. + +[//]: # (END included file options/layer-label.md) + + +[//]: # (BEGIN included file options/layers.md) +#### **--layers** + +Cache intermediate images during the build process (Default is `true`). + +Note: You can also override the default value of layers by setting the +BUILDAH\_LAYERS environment variable. `export BUILDAH_LAYERS=true` + +[//]: # (END included file options/layers.md) + + +[//]: # (BEGIN included file options/logfile.md) +#### **--logfile**=*filename* + +Log output which is sent to standard output and standard error to the +specified file instead of to standard output and standard error. +This option is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. + +[//]: # (END included file options/logfile.md) + +#### **--logsplit**=*bool-value* + +If `--logfile` and `--platform` are specified, the `--logsplit` option allows +end-users to split the log file for each platform into different files in the +following format: `${logfile}_${platform-os}_${platform-arch}`. +This option is not supported on the remote client, including Mac and Windows +(excluding WSL2) machines. + + +[//]: # (BEGIN included file options/manifest.md) +#### **--manifest**=*manifest* + +Name of the manifest list to which the image is added. Creates the manifest list if it does not exist. This option is useful for building multi architecture images. + +[//]: # (END included file options/manifest.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/network.image.md) +#### **--network**=*mode*, **--net** + +Sets the configuration for network namespaces when handling `RUN` instructions. + +Valid _mode_ values are: + +- **none**: no networking. +- **host**: use the Podman host network stack. Note: the host mode gives the +container full access to local system services such as D-bus and is therefore +considered insecure. +- **ns:**_path_: path to a network namespace to join. +- **private**: create a new namespace for the container (default) +- **\**: Join the network with the given name or ID, e.g. use `--network mynet` to join the network with the name mynet. Only supported for rootful users. +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=MTU**: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=CIDR**: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=INTERFACE**: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=IPv4**: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=INTERFACE**: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=IPv6**: Specify the outbound ipv6 address slirp binds to. +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.image.md) + + +[//]: # (BEGIN included file options/no-cache.md) +#### **--no-cache** + +Do not use existing cached images for the container build. Build from the start with a new set of cached layers. + +[//]: # (END included file options/no-cache.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the container. + +Podman assumes control over the container's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/omit-history.md) +#### **--omit-history** + +Omit build history information in the built image. (default false). + +This option is useful for the cases where end users explicitly +want to set `--omit-history` to omit the optional `History` from +built images or when working with images built using build tools that +do not include `History` information in their images. + +[//]: # (END included file options/omit-history.md) + + +[//]: # (BEGIN included file options/os.md) +#### **--os**=*string* + +Set the OS of the image to be built, and that of the base image to be pulled, if the build uses one, instead of using the current operating system of the build host. Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. + +[//]: # (END included file options/os.md) + + +[//]: # (BEGIN included file options/os-feature.md) +#### **--os-feature**=*feature* + +Set the name of a required operating system *feature* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS feature list is kept, if the base image specified any. This option is typically only meaningful when the image's OS is Windows. + +If *feature* has a trailing `-`, then the *feature* is removed from the set of required features which is listed in the image. + +[//]: # (END included file options/os-feature.md) + + +[//]: # (BEGIN included file options/os-version.image.md) +#### **--os-version**=*version* + +Set the exact required operating system *version* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS version is kept, if the base image specified one. This option is typically only meaningful when the image's OS is Windows, and is typically set in Windows base images, so using this option is usually unnecessary. + +[//]: # (END included file options/os-version.image.md) + +#### **--output**, **-o**=*output-opts* + +Output destination (format: type=local,dest=path) + +The --output (or -o) option extends the default behavior of building a container image by allowing users to export the contents of the image as files on the local filesystem, which can be useful for generating local binaries, code generation, etc. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +The value for --output is a comma-separated sequence of key=value pairs, defining the output type and options. + +Supported _keys_ are: +- **dest**: Destination path for exported output. Valid value is absolute or relative path, `-` means the standard output. +- **type**: Defines the type of output to be used. Valid values is documented below. + +Valid _type_ values are: +- **local**: write the resulting build files to a directory on the client-side. +- **tar**: write the resulting files as a single tarball (.tar). + +If no type is specified, the value defaults to **local**. +Alternatively, instead of a comma-separated sequence, the value of **--output** can be just a destination (in the **dest** format) (e.g. `--output some-path`, `--output -`) where `--output some-path` is treated as if **type=local** and `--output -` is treated as if **type=tar**. + + +[//]: # (BEGIN included file options/pid.image.md) +#### **--pid**=*pid* + +Sets the configuration for PID namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new PID namespace is created, or it can be "host" to indicate that the PID namespace in which `podman` itself is being run is reused, or it can be the path to a PID namespace which is already in use by another +process. + +[//]: # (END included file options/pid.image.md) + +#### **--platform**=*os/arch[/variant][,...]* + +Set the *os/arch* of the built image (and its base image, when using one) +to the provided value instead of using the current operating system and +architecture of the host (for example `linux/arm`). Unless overridden, +subsequent lookups of the same image in the local storage matches this +platform, regardless of the host. + +If `--platform` is set, then the values of the `--arch`, `--os`, and +`--variant` options is overridden. + +The `--platform` option can be specified more than once, or given a +comma-separated list of values as its argument. When more than one platform is +specified, the `--manifest` option is used instead of the `--tag` +option. + +Os/arch pairs are those used by the Go Programming Language. In several cases +the *arch* value for a platform differs from one produced by other tools such as +the `arch` command. Valid OS and architecture name combinations are listed as +values for $GOOS and $GOARCH at https://golang.org/doc/install/source#environment, +and can also be found by running `go tool dist list`. + +While `podman build` is happy to use base images and build images for any +platform that exists, `RUN` instructions are unable to succeed without +the help of emulation provided by packages like `qemu-user-static`. + + +[//]: # (BEGIN included file options/pull.image.md) +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Only pull the image when it does not exist in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error when no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. + +[//]: # (END included file options/pull.image.md) + + +[//]: # (BEGIN included file options/quiet.md) +#### **--quiet**, **-q** + +Suppress output messages which indicate which instruction is being processed, and of progress when pulling images from a registry, and when writing the output image. + +[//]: # (END included file options/quiet.md) + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + + +[//]: # (BEGIN included file options/rm.md) +#### **--rm** + +Remove intermediate containers after a successful build (default true). + +[//]: # (END included file options/rm.md) + + +[//]: # (BEGIN included file options/runtime.md) +#### **--runtime**=*path* + +The *path* to an alternate OCI-compatible runtime, which is used to run +commands specified by the **RUN** instruction. + +Note: You can also override the default runtime by setting the BUILDAH\_RUNTIME environment variable. `export BUILDAH_RUNTIME=/usr/local/bin/runc` + +[//]: # (END included file options/runtime.md) + + +[//]: # (BEGIN included file options/runtime-flag.md) +#### **--runtime-flag**=*flag* + +Adds global flags for the container runtime. To list the supported flags, please consult the manpages of the selected container runtime. + +Note: Do not pass the leading -- to the flag. To pass the runc flag --log-format json to buildah build, the option given is --runtime-flag log-format=json. + +[//]: # (END included file options/runtime-flag.md) + +#### **--sbom**=*preset* + +Generate SBOMs (Software Bills Of Materials) for the output image by scanning +the working container and build contexts using the named combination of scanner +image, scanner commands, and merge strategy. Must be specified with one or +more of **--sbom-image-output**, **--sbom-image-purl-output**, **--sbom-output**, +and **--sbom-purl-output**. Recognized presets, and the set of options which +they equate to: + + - "syft", "syft-cyclonedx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output cyclonedx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output cyclonedx-json={OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "syft-spdx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output spdx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output spdx-json={OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + - "trivy", "trivy-cyclonedx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "trivy-spdx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + +#### **--sbom-image-output**=*path* + +When generating SBOMs, store the generated SBOM in the specified path in the +output image. There is no default. + +#### **--sbom-image-purl-output**=*path* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the specified path in the output +image. There is no default. + +#### **--sbom-merge-strategy**=*method* + +If more than one **--sbom-scanner-command** value is being used, use the +specified method to merge the output from later commands with output from +earlier commands. Recognized values include: + + - cat + Concatenate the files. + - merge-cyclonedx-by-component-name-and-version + Merge the "component" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "version" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + - merge-spdx-by-package-name-and-versioninfo + Merge the "package" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "versionInfo" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + +#### **--sbom-output**=*file* + +When generating SBOMs, store the generated SBOM in the named file on the local +filesystem. There is no default. + +#### **--sbom-purl-output**=*file* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the named file in the local +filesystem. There is no default. + +#### **--sbom-scanner-command**=*image* + +Generate SBOMs by running the specified command from the scanner image. If +multiple commands are specified, they are run in the order in which they are +specified. These text substitutions are performed: + - {ROOTFS} + The root of the built image's filesystem, bind mounted. + - {CONTEXT} + The build context and additional build contexts, bind mounted. + - {OUTPUT} + The name of a temporary output file, to be read and merged with others or copied elsewhere. + +#### **--sbom-scanner-image**=*image* + +Generate SBOMs using the specified scanner image. + + +[//]: # (BEGIN included file options/secret.image.md) +#### **--secret**=**id=id[,src=*envOrFile*][,env=*ENV*][,type=*file* | *env*]** + +Pass secret information to be used in the Containerfile for building images +in a safe way that will not end up stored in the final image, or be seen in other stages. +The value of the secret will be read from an environment variable or file named +by the "id" option, or named by the "src" option if it is specified, or from an +environment variable specified by the "env" option. See [EXAMPLES](#examples). +The secret will be mounted in the container at `/run/secrets/id` by default. + +To later use the secret, use the --mount flag in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret` + +The location of the secret in the container can be overridden using the +"target", "dst", or "destination" option of the `RUN --mount` flag. + +`RUN --mount=type=secret,id=mysecret,target=/run/secrets/myothersecret cat /run/secrets/myothersecret` + +Note: changing the contents of secret files will not trigger a rebuild of layers that use said secrets. + +[//]: # (END included file options/secret.image.md) + + +[//]: # (BEGIN included file options/security-opt.image.md) +#### **--security-opt**=*option* + +Security Options + +- `apparmor=unconfined` : Turn off apparmor confinement for the container +- `apparmor=alternate-profile` : Set the apparmor confinement profile for the +container + +- `label=user:USER` : Set the label user for the container processes +- `label=role:ROLE` : Set the label role for the container processes +- `label=type:TYPE` : Set the label process type for the container processes +- `label=level:LEVEL` : Set the label level for the container processes +- `label=filetype\:TYPE` : Set the label file type for the container files +- `label=disable` : Turn off label separation for the container +- `no-new-privileges` : Not supported + +- `seccomp=unconfined` : Turn off seccomp confinement for the container +- `seccomp=profile.json` : JSON file to be used as the seccomp filter for the container. + +[//]: # (END included file options/security-opt.image.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the container. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + +#### **--sign-by**=*fingerprint* + +Sign the image using a GPG key with the specified FINGERPRINT. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines,) + + +[//]: # (BEGIN included file options/skip-unused-stages.md) +#### **--skip-unused-stages** + +Skip stages in multi-stage builds which don't affect the target stage. (Default: **true**). + +[//]: # (END included file options/skip-unused-stages.md) + + +[//]: # (BEGIN included file options/squash.md) +#### **--squash** + +Squash all of the image's new layers into a single new layer; any preexisting layers are not squashed. + +[//]: # (END included file options/squash.md) + + +[//]: # (BEGIN included file options/squash-all.md) +#### **--squash-all** + +Squash all of the new image's layers (including those inherited from a base image) into a single new layer. + +[//]: # (END included file options/squash-all.md) + + +[//]: # (BEGIN included file options/ssh.md) +#### **--ssh**=*default* | *id[=socket>* + +SSH agent socket or keys to expose to the build. +The socket path can be left empty to use the value of `default=$SSH_AUTH_SOCK` + +To later use the ssh agent, use the --mount option in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=ssh,id=id mycmd` + +[//]: # (END included file options/ssh.md) + +#### **--stdin** + +Pass stdin into the RUN containers. Sometime commands being RUN within a Containerfile +want to request information from the user. For example apt asking for a confirmation for install. +Use --stdin to be able to interact from the terminal during the build. + + +[//]: # (BEGIN included file options/tag.md) +#### **--tag**, **-t**=*imageName* + +Specifies the name which is assigned to the resulting image if the build process completes successfully. +If _imageName_ does not include a registry name, the registry name *localhost* is prepended to the image name. + +[//]: # (END included file options/tag.md) + + +[//]: # (BEGIN included file options/target.md) +#### **--target**=*stageName* + +Set the target build stage to build. When building a Containerfile with multiple build stages, --target can be used to specify an intermediate build stage by name as the final stage for the resulting image. Commands after the target stage is skipped. + +[//]: # (END included file options/target.md) + + +[//]: # (BEGIN included file options/timestamp.md) +#### **--timestamp**=*seconds* + +Set the create timestamp to seconds since epoch to allow for deterministic builds (defaults to current time). By default, the created timestamp is changed and written into the image manifest with every commit, causing the image's sha256 hash to be different even if the sources are exactly the same otherwise. +When --timestamp is set, the created timestamp is always set to the time specified and therefore not changed, allowing the image's sha256 hash to remain the same. All files committed to the layers of the image is created with the timestamp. + +If the only instruction in a Containerfile is `FROM`, this flag has no effect. + +[//]: # (END included file options/timestamp.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/ulimit.image.md) +#### **--ulimit**=*type=soft-limit[\:hard-limit]* + +Specifies resource limits to apply to processes launched when processing `RUN` instructions. This option can be specified multiple times. Recognized resource types include: + "core": maximum core dump size (ulimit -c) + "cpu": maximum CPU time (ulimit -t) + "data": maximum size of a process's data segment (ulimit -d) + "fsize": maximum size of new files (ulimit -f) + "locks": maximum number of file locks (ulimit -x) + "memlock": maximum amount of locked memory (ulimit -l) + "msgqueue": maximum amount of data in message queues (ulimit -q) + "nice": niceness adjustment (nice -n, ulimit -e) + "nofile": maximum number of open files (ulimit -n) + "nproc": maximum number of processes (ulimit -u) + "rss": maximum size of a process's (ulimit -m) + "rtprio": maximum real-time scheduling priority (ulimit -r) + "rttime": maximum amount of real-time execution between blocking syscalls + "sigpending": maximum number of pending signals (ulimit -i) + "stack": maximum stack size (ulimit -s) + +[//]: # (END included file options/ulimit.image.md) + + +[//]: # (BEGIN included file options/unsetenv.image.md) +#### **--unsetenv**=*env* + +Unset environment variables from the final image. + +[//]: # (END included file options/unsetenv.image.md) + + +[//]: # (BEGIN included file options/unsetlabel.md) +#### **--unsetlabel**=*label* + +Unset the image label, causing the label not to be inherited from the base image. + +[//]: # (END included file options/unsetlabel.md) + + +[//]: # (BEGIN included file options/userns.image.md) +#### **--userns**=*how* + +Sets the configuration for user namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new user namespace is created, it can be "host" to indicate that the user namespace in which `podman` itself is being run is reused, or it can be the path to a user namespace which is already in use by another process. + +[//]: # (END included file options/userns.image.md) + + +[//]: # (BEGIN included file options/userns-gid-map.md) +#### **--userns-gid-map**=*mapping* + +Directly specifies a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container GID, a corresponding starting host-level GID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-gids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-gid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-gid-map are specified, but --userns-uid-map is specified, the GID map is set to use the same numeric values as the UID map. + +[//]: # (END included file options/userns-gid-map.md) + + +[//]: # (BEGIN included file options/userns-gid-map-group.md) +#### **--userns-gid-map-group**=*group* + +Specifies that a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subgid` file which correspond to the specified group. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-uid-map-user is specified, but --userns-gid-map-group is not specified, `podman` assumes that the specified user name is also a +suitable group name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. + +[//]: # (END included file options/userns-gid-map-group.md) + + +[//]: # (BEGIN included file options/userns-uid-map.md) +#### **--userns-uid-map**=*mapping* + +Directly specifies a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions default to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container UID, a corresponding starting host-level UID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-uids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-uid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-uid-map are specified, but --userns-gid-map is specified, the UID map is set to use the same numeric values as the GID map. + +[//]: # (END included file options/userns-uid-map.md) + + +[//]: # (BEGIN included file options/userns-uid-map-user.md) +#### **--userns-uid-map-user**=*user* + +Specifies that a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subuid` file which correspond to the specified user. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-gid-map-group is specified, but --userns-uid-map-user is not specified, `podman` assumes that the specified group name is also a +suitable user name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. + +[//]: # (END included file options/userns-uid-map-user.md) + + +[//]: # (BEGIN included file options/uts.md) +#### **--uts**=*how* + +Sets the configuration for UTS namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new UTS namespace to be created, or it can be "host" to indicate that the UTS namespace in which `podman` itself is being run is reused, or it can be the path to a UTS namespace which is already in use by another process. + +[//]: # (END included file options/uts.md) + +#### **--variant**=*variant* + +Set the architecture variant of the image to be built, and that of the base +image to be pulled, if the build uses one, to the provided value instead of +using the architecture variant of the build host. + + +[//]: # (BEGIN included file options/volume.image.md) +#### **--volume**, **-v**=*[HOST-DIR\:CONTAINER-DIR[\:OPTIONS]]* + +Mount a host directory into containers when executing RUN instructions during +the build. + +The `OPTIONS` are a comma-separated list and can be one or more of: + + * [rw|ro] + * [z|Z|O] + * [U] + * [`[r]shared`|`[r]slave`|`[r]private`][[1]](#Footnote1) + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR` +must be an absolute path as well. Podman bind-mounts the `HOST-DIR` to the +specified path when processing RUN instructions. + +You can specify multiple **-v** options to mount one or more mounts. + +You can add the `:ro` or `:rw` suffix to a volume to mount it read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted. When running using user namespaces, the UID and GID inside +the namespace may correspond to another UID and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the namespace, to change recursively the owner and group of +the source volume. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add one of these two suffixes +`:z` or `:Z` to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The `z` option tells Podman that two containers +share the volume content. As a result, Podman labels the content with a shared +content label. Shared volume labels allow all containers to read/write content. +The `Z` option tells Podman to label the content with a private unshared label. +Only the current container can use a private volume. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the host machine to fail. For these types +of containers, disabling SELinux separation is recommended. The option +`--security-opt label=disable` disables SELinux separation for the container. +For example, if a user wanted to volume mount their entire home directory into the build containers, they need to disable SELinux separation. + + $ podman build --security-opt label=disable -v $HOME:/home/user . + +`Overlay Volume Mounts` + +The `:O` flag tells Podman to mount the directory from the host as a +temporary storage using the Overlay file system. The `RUN` command containers +are allowed to modify contents within the mountpoint and are stored in the +container storage in a separate directory. In Overlay FS terms the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the `RUN` command +finishes executing, similar to a tmpfs mount point. + +Any subsequent execution of `RUN` commands sees the original source directory +content, any changes from previous RUN commands no longer exists. + +One use case of the `overlay` mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: + +- Overlay mounts are not currently supported in rootless mode. +- The `O` flag is not allowed to be specified with the `Z` or `z` flags. + Content mounted into the container is labeled with the private label. + On SELinux systems, labels in the source directory needs to be readable + by the container label. If not, SELinux container separation must be disabled + for the container to work. +- Modification of the directory volume mounted into the container with an + overlay mount can cause unexpected failures. Do not modify the directory until + the container finishes running. + +By default bind mounted volumes are `private`. That means any mounts done +inside containers are not be visible on the host and vice versa. This behavior +can be changed by specifying a volume mount propagation property. + +When the mount propagation policy is set to `shared`, any mounts completed +inside the container on that volume is visible to both the host and +container. When the mount propagation policy is set to `slave`, one way mount +propagation is enabled and any mounts completed on the host for that volume is +visible only inside of the container. To control the mount propagation +property of volume use the `:[r]shared`, `:[r]slave` or `:[r]private` +propagation flag. For mount propagation to work on the source mount point (mount +point where source dir is mounted on) has to have the right propagation properties. +For shared volumes, the source mount point has to be shared. And for slave volumes, +the source mount has to be either shared or slave. [[1]](#Footnote1) + +Use `df ` to determine the source mount and then use +`findmnt -o TARGET,PROPAGATION ` to determine propagation +properties of source mount, if `findmnt` utility is not available, the source +mount point can be determined by looking at the mount entry in +`/proc/self/mountinfo`. Look at `optional fields` and see if any propagation +properties are specified. +`shared:X` means the mount is `shared`, `master:X` means the mount is `slave` +and if nothing is there that means the mount is `private`. [[1]](#Footnote1) + +To change propagation properties of a mount point use the `mount` command. For +example, to bind mount the source directory `/foo` do +`mount --bind /foo /foo` and `mount --make-private --make-shared /foo`. This +converts /foo into a `shared` mount point. The propagation properties of +the source mount can be changed directly. For instance if `/` is the source +mount for `/foo`, then use `mount --make-shared /` to convert `/` into a +`shared` mount. + +[//]: # (END included file options/volume.image.md) + +## EXAMPLES + +### Build an image using local Containerfiles + +Build image using Containerfile with content from current directory: +``` +$ podman build . +``` + +Build image using specified Containerfile with content from current directory: +``` +$ podman build -f Containerfile.simple . +``` + +Build image using Containerfile from stdin with content from current directory: +``` +$ cat $HOME/Containerfile | podman build -f - . +``` + +Build image using multiple Containerfiles with content from current directory: +``` +$ podman build -f Containerfile.simple -f Containerfile.notsosimple . +``` + +Build image with specified Containerfile with content from $HOME directory. Note `cpp` is applied to Containerfile.in before processing as Containerfile: +``` +$ podman build -f Containerfile.in $HOME +``` + +Build image with the specified tag with Containerfile and content from current directory: +``` +$ podman build -t imageName . +``` + +Build image ignoring registry verification for any images pulled via the Containerfile: +``` +$ podman build --tls-verify=false -t imageName . +``` + +Build image with the specified logging format: +``` +$ podman build --runtime-flag log-format=json . +``` + +Build image using debug mode for logging: +``` +$ podman build --runtime-flag debug . +``` + +Build image using specified registry attributes when pulling images from the selected Containerfile: +``` +$ podman build --authfile /tmp/auths/myauths.json --cert-dir $HOME/auth --tls-verify=true --creds=username:password -t imageName -f Containerfile.simple . +``` + +Build image using specified resource controls when running containers during the build: +``` +$ podman build --memory 40m --cpu-period 10000 --cpu-quota 50000 --ulimit nofile=1024:1028 -t imageName . +``` + +Build image using specified SELinux labels and cgroup config running containers during the build: +``` +$ podman build --security-opt label=level:s0:c100,c200 --cgroup-parent /path/to/cgroup/parent -t imageName . +``` + +Build image with read-only and SELinux relabeled volume mounted from the host into running containers during the build: +``` +$ podman build --volume /home/test:/myvol:ro,Z -t imageName . +``` + +Build image with overlay volume mounted from the host into running containers during the build: +``` +$ podman build -v /var/lib/yum:/var/lib/yum\:O -t imageName . +``` + +Build image using layers and then removing intermediate containers even if the build fails. +``` +$ podman build --layers --force-rm -t imageName . +``` + +Build image ignoring cache and not removing intermediate containers even if the build succeeds: +``` +$ podman build --no-cache --rm=false -t imageName . +``` + +Build image using the specified network when running containers during the build: +``` +$ podman build --network mynet . +``` + +Build an image using a secret stored in an environment variable or file named `mysecret` to be used with the instruction `RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret`: +``` +$ podman build --secret=id=mysecret . +``` + +Build an image using a secret stored in an environment variable named `MYSECRET` to be used with the instruction `RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret`: +``` +$ podman build --secret=id=mysecret,env=MYSECRET . +$ podman build --secret=id=mysecret,src=MYSECRET,type=env . +``` + +Build an image using a secret stored in a file named `.mysecret` to be used with the instruction `RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret`: +``` +$ podman build --secret=id=mysecret,src=.mysecret . +$ podman build --secret=id=mysecret,src=.mysecret,type=file . +``` + +### Building a multi-architecture image using the --manifest option (requires emulation software) + +Build image using the specified architectures and link to a single manifest on successful completion: +``` +$ podman build --arch arm --manifest myimage /tmp/mysrc +$ podman build --arch amd64 --manifest myimage /tmp/mysrc +$ podman build --arch s390x --manifest myimage /tmp/mysrc +``` + +Similarly build using a single command +``` +$ podman build --platform linux/s390x,linux/ppc64le,linux/amd64 --manifest myimage /tmp/mysrc +``` + +Build image using multiple specified architectures and link to single manifest on successful completion: +``` +$ podman build --platform linux/arm64 --platform linux/amd64 --manifest myimage /tmp/mysrc +``` + +### Building an image using a URL, Git repo, or archive + + The build context directory can be specified as a URL to a Containerfile, a +Git repository, or URL to an archive. If the URL is a Containerfile, it is +downloaded to a temporary location and used as the context. When a Git +repository is set as the URL, the repository is cloned locally to a temporary +location and then used as the context. Lastly, if the URL is an archive, it is +downloaded to a temporary location and extracted before being used as the +context. + +#### Building an image using a URL to a Containerfile + +Build image from Containerfile downloaded into temporary location used as the build context: +``` +$ podman build https://10.10.10.1/podman/Containerfile +``` + +#### Building an image using a Git repository + + Podman clones the specified GitHub repository to a temporary location and +uses it as the context. The Containerfile at the root of the repository is used +and it only works if the GitHub repository is a dedicated repository. + +Build image from specified git repository downloaded into temporary location used as the build context: +``` +$ podman build -t hello https://github.com/containers/PodmanHello.git +$ podman run hello +``` + + Note: GitHub does not support using `git://` for performing `clone` operation due to recent changes in their security guidance (https://github.blog/2021-09-01-improving-git-protocol-security-github/). Use an `https://` URL if the source repository is hosted on GitHub. + +#### Building an image using a URL to an archive + + Podman fetches the archive file, decompresses it, and uses its contents as the +build context. The Containerfile at the root of the archive and the rest of the +archive are used as the context of the build. Passing the +`-f PATH/Containerfile` option as well tells the system to look for that file +inside the contents of the archive. + +``` +$ podman build -f dev/Containerfile https://10.10.10.1/podman/context.tar.gz +``` + + Note: supported compression formats are 'xz', 'bzip2', 'gzip' and 'identity' +(no compression). + +## Files + +### .containerignore/.dockerignore + +If the file *.containerignore* or *.dockerignore* exists in the context directory, +`podman build` reads its contents. Use the `--ignorefile` option to override the +.containerignore path location. +Podman uses the content to exclude files and directories from the context +directory, when executing COPY and ADD directives in the +Containerfile/Dockerfile + +The .containerignore and .dockerignore files use the same syntax; if both +are in the context directory, podman build only uses .containerignore. + +Users can specify a series of Unix shell globs in a .containerignore file to +identify files/directories to exclude. + +Podman supports a special wildcard string `**` which matches any number of +directories (including zero). For example, **/*.go excludes all files that +end with .go that are found in all directories. + +Example .containerignore file: + +``` +# exclude this content for image +*/*.c +**/output* +src +``` + +`*/*.c` +Excludes files and directories whose names ends with .c in any top level +subdirectory. For example, the source file include/rootless.c. + +`**/output*` +Excludes files and directories starting with `output` from any directory. + +`src` +Excludes files named src and the directory src as well as any content in it. + +Lines starting with ! (exclamation mark) can be used to make exceptions to +exclusions. The following is an example .containerignore file that uses this +mechanism: +``` +*.doc +!Help.doc +``` + +Exclude all doc files except Help.doc from the image. + +This functionality is compatible with the handling of .containerignore files +described here: + +https://github.com/containers/common/blob/main/docs/containerignore.5.md + +**registries.conf** (`/etc/containers/registries.conf`) + +registries.conf is the configuration file which specifies which container +registries is consulted when completing image names which do not include +a registry or domain portion. + +## Troubleshooting + +### lastlog sparse file + +Using a useradd command within a Containerfile with a large UID/GID creates +a large sparse file `/var/log/lastlog`. This can cause the +build to hang forever. Go language does not support sparse files correctly, +which can lead to some huge files being created in the container image. + +When using the `useradd` command within the build script, pass the +`--no-log-init or -l` option to the `useradd` command. This option tells +useradd to stop creating the lastlog file. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/main/man/runc.8.md)**, **[useradd(8)](https://www.unix.com/man-page/redhat/8/useradd)**, **[podman-ps(1)](podman-ps.1.md)**, **[podman-rm(1)](podman-rm.1.md)**, **[Containerfile(5)](https://github.com/containers/common/blob/main/docs/Containerfile.5.md)**, **[containerignore(5)](https://github.com/containers/common/blob/main/docs/containerignore.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +See [podman-rootless(7)](https://github.com/containers/podman/blob/main/rootless.md) +for rootless issues. + +## HISTORY +Aug 2020, Additional options and .containerignore added by Dan Walsh `` + +May 2018, Minor revisions added by Joe Doss `` + +December 2017, Originally compiled by Tom Sweeney `` + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a +core value of open source. The `master` and `slave` mount propagation +terminology used here is problematic and divisive, and needs to be changed. +However, these terms are currently used within the Linux kernel and must be +used as-is at this time. When the kernel maintainers rectify this usage, +Podman will follow suit immediately. diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-commit.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-commit.1.md new file mode 100644 index 000000000..6342dc618 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-commit.1.md @@ -0,0 +1,139 @@ +--- +title: podman-commit +version: v5.4.1 +--- + +% podman-commit 1 + +## NAME +podman\-commit - Create new image based on the changed container + +## SYNOPSIS +**podman commit** [*options*] *container* [*image*] + +**podman container commit** [*options*] *container* [*image*] + +## DESCRIPTION +**podman commit** creates an image based on a changed *container*. The author of the image can be set using the **--author** OPTION. Various image instructions can be configured with the **--change** OPTION and a commit message can be set using the **--message** OPTION. The *container* and its processes aren't paused while the image is committed. If this is not desired, the **--pause** OPTION can be set to *true*. When the commit is complete, Podman prints out the ID of the new image. + +If `image` does not begin with a registry name component, `localhost` is added to the name. +If `image` is not provided, the values for the `REPOSITORY` and `TAG` values of the created image is set to ``. + +## OPTIONS +#### **--author**, **-a**=*author* + +Set the author for the committed image. + +#### **--change**, **-c**=*instruction* + +Apply the following possible instructions to the created image: + +- *CMD* +- *ENTRYPOINT* +- *ENV* +- *EXPOSE* +- *LABEL* +- *ONBUILD* +- *STOPSIGNAL* +- *USER* +- *VOLUME* +- *WORKDIR* + +Can be set multiple times. + +#### **--config**=*ConfigBlobFile* + +Merge the container configuration from the specified file into the configuration for the image +as it is being committed. The file contents should be a JSON-encoded version of +a Schema2Config structure, which is defined at +https://github.com/containers/image/blob/v5.29.0/manifest/docker_schema2.go#L67. + +#### **--format**, **-f**=**oci** | *docker* + +Set the format of the image manifest and metadata. The currently supported formats are **oci** and *docker*.\ +The default is **oci**. + +#### **--iidfile**=*ImageIDfile* + +Write the image ID to the file. + +#### **--include-volumes** + +Include in the committed image any volumes added to the container by the **--volume** or **--mount** OPTIONS to the **[podman create](podman-create.1.md)** and **[podman run](podman-run.1.md)** commands.\ +The default is **false**. + +#### **--message**, **-m**=*message* + +Set commit message for committed image.\ +*IMPORTANT: The message field is not supported in `oci` format.* + +#### **--pause**, **-p** + +Pause the container when creating an image.\ +The default is **false**. + +#### **--quiet**, **-q** + +Suppresses output.\ +The default is **false**. + +#### **--squash**, **-s** + +Squash newly built layers into a single new layer.\ +The default is **false**. + +## EXAMPLES +Create image from container with entrypoint and label: +``` +$ podman commit --change CMD=/bin/bash --change ENTRYPOINT=/bin/sh --change "LABEL blue=image" reverent_golick image-committed +Getting image source signatures +Copying blob sha256:b41deda5a2feb1f03a5c1bb38c598cbc12c9ccd675f438edc6acd815f7585b86 + 25.80 MB / 25.80 MB [======================================================] 0s +Copying config sha256\:c16a6d30f3782288ec4e7521c754acc29d37155629cb39149756f486dae2d4cd + 448 B / 448 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Create image from container with commit message: +``` +$ podman commit -q --message "committing container to image" +reverent_golick image-committed +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Create image from container with author: +``` +$ podman commit -q --author "firstName lastName" reverent_golick image-committed +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Pause running container while creating image: +``` +$ podman commit -q --pause=true containerID image-committed +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Create image from container with default image tag: +``` +$ podman commit containerID +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Create image from container with default required capabilities: +``` +$ podman commit -q --change LABEL=io.containers.capabilities=setuid,setgid epic_nobel privimage +400d31a3f36dca751435e80a0e16da4859beb51ff84670ce6bdc5edb30b94066 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-create(1)](podman-create.1.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +December 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-completion.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-completion.1.md new file mode 100644 index 000000000..81aea1a1e --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-completion.1.md @@ -0,0 +1,83 @@ +--- +title: podman-completion +version: v5.4.1 +--- + +% podman-completion 1 + +## NAME +podman\-completion - Generate shell completion scripts + +## SYNOPSIS +**podman completion** [*options*] *bash* | *zsh* | *fish* | *powershell* + +## DESCRIPTION +**podman completion** generates shell completion scripts for a variety of shells. Supported shells are *bash*, *zsh*, *fish* and *powershell*. + +These script are used by the shell to provide suggestions and complete commands when the command is typed and `[TAB]` is pressed. + +Usually these scripts are automatically installed via the package manager. + +## OPTIONS +#### **--file**, **-f**=*file* + +Write the generated output to a file. + +#### **--no-desc** + +Do not provide description in the completions.\ +The default is **false**. + +## Installation + +### BASH +`bash-completion` has to be installed on the system. + +To load the completion script into the current session run: +``` +source <(podman completion bash) +``` + +To make it available for all bash sessions run: +``` +podman completion -f /etc/bash_completion.d/podman bash +``` + + +### ZSH +Shell completion needs to be already enabled in the environment. The following can be executed: +``` +echo "autoload -U compinit; compinit" >> ~/.zshrc +``` + +To make it available for all zsh sessions run: +``` +podman completion -f "${fpath[1]}/_podman" zsh +``` + +Once the shell is reloaded the auto-completion works. + + +### FISH +To load the completion script into the current session run: +``` +podman completion fish | source +``` + +To make it available for all fish sessions run: +``` +podman completion -f ~/.config/fish/completions/podman.fish fish +``` + +### POWERSHELL +To load the completion script into the current session run: +``` +podman.exe completion powershell | Out-String | Invoke-Expression +``` + +To make it available in all powershell sessions that a user has, write the +completion output to a file and source that to the user's powershell profile. +More information about profiles is available with **Get-Help about_Profiles**. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **zsh(1)**, **fish(1)**, **powershell(1)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-compose.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-compose.1.md new file mode 100644 index 000000000..1d455fa06 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-compose.1.md @@ -0,0 +1,28 @@ +--- +title: podman-compose +version: v5.4.1 +--- + +% podman-compose 1 + +## NAME +podman\-compose - Run Compose workloads via an external compose provider + +## SYNOPSIS +**podman compose** [*options*] [*command* [*arg* ...]] + +## DESCRIPTION +**podman compose** is a thin wrapper around an external compose provider such as docker-compose or podman-compose. This means that `podman compose` is executing another tool that implements the compose functionality but sets up the environment in a way to let the compose provider communicate transparently with the local Podman socket. The specified options as well the command and argument are passed directly to the compose provider. + +The default compose providers are `docker-compose` and `podman-compose`. If installed, `docker-compose` takes precedence since it is the original implementation of the Compose specification and is widely used on the supported platforms (i.e., Linux, Mac OS, Windows). + +If you want to change the default behavior or have a custom installation path for your provider of choice, please change the `compose_providers` field in `containers.conf(5)` to `compose_providers = ["/path/to/provider"]`. You may also set the `PODMAN_COMPOSE_PROVIDER` environment variable. + +By default, `podman compose` will emit a warning saying that it executes an external command. This warning can be disabled by setting `compose_warning_logs` to false in `containers.conf(5)` or setting the `PODMAN_COMPOSE_WARNING_LOGS` environment variable to false. See the man page for `containers.conf(5)` for more information. + +## OPTIONS + +To see supported options of the installed compose provider, please run `podman compose --help`. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-container-checkpoint.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-container-checkpoint.1.md new file mode 100644 index 000000000..c85495606 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-container-checkpoint.1.md @@ -0,0 +1,231 @@ +--- +title: podman-container-checkpoint +version: v5.4.1 +--- + +% podman-container-checkpoint 1 + +## NAME +podman\-container\-checkpoint - Checkpoint one or more running containers + +## SYNOPSIS +**podman container checkpoint** [*options*] *container* [*container* ...] + +## DESCRIPTION +**podman container checkpoint** checkpoints all the processes in one or more *containers*. A *container* can be restored from a checkpoint with **[podman-container-restore](podman-container-restore.1.md)**. The *container IDs* or *names* are used as input. + +*IMPORTANT: If the container is using __systemd__ as __entrypoint__ checkpointing the container might not be possible.* + +## OPTIONS +#### **--all**, **-a** + +Checkpoint all running *containers*.\ +The default is **false**.\ +*IMPORTANT: This OPTION does not need a container name or ID as input argument.* + +#### **--compress**, **-c**=**zstd** | *none* | *gzip* + +Specify the compression algorithm used for the checkpoint archive created +with the **--export, -e** OPTION. Possible algorithms are **zstd**, *none* +and *gzip*.\ +One possible reason to use *none* is to enable faster creation of checkpoint +archives. Not compressing the checkpoint archive can result in faster checkpoint +archive creation.\ +The default is **zstd**. + +#### **--create-image**=*image* + +Create a checkpoint image from a running container. This is a standard OCI image +created in the local image store. It consists of a single layer that contains +all of the checkpoint files. The content of this image layer is in the same format as a +checkpoint created with **--export**. A checkpoint image can be pushed to a +standard container registry and pulled on a different system to enable container +migration. In addition, the image can be exported with **podman image save** and +inspected with **podman inspect**. Inspecting a checkpoint image displays +additional information, stored as annotations, about the host environment used +to do the checkpoint: + +- **io.podman.annotations.checkpoint.name**: Human-readable name of the original + container. + +- **io.podman.annotations.checkpoint.rawImageName**: Unprocessed name of the + image used to create the original container (as specified by the user). + +- **io.podman.annotations.checkpoint.rootfsImageID**: ID of the image used to + create the original container. + +- **io.podman.annotations.checkpoint.rootfsImageName**: Image name used to + create the original container. + +- **io.podman.annotations.checkpoint.podman.version**: Version of Podman used to + create the checkpoint. + +- **io.podman.annotations.checkpoint.criu.version**: Version of CRIU used to + create the checkpoint. + +- **io.podman.annotations.checkpoint.runtime.name**: Container runtime (e.g., + runc, crun) used to create the checkpoint. + +- **io.podman.annotations.checkpoint.runtime.version**: Version of the container + runtime used to create the checkpoint. + +- **io.podman.annotations.checkpoint.conmon.version**: Version of conmon used + with the original container. + +- **io.podman.annotations.checkpoint.host.arch**: CPU architecture of the host + on which the checkpoint was created. + +- **io.podman.annotations.checkpoint.host.kernel**: Version of Linux kernel + of the host where the checkpoint was created. + +- **io.podman.annotations.checkpoint.cgroups.version**: cgroup version used by + the host where the checkpoint was created. + +- **io.podman.annotations.checkpoint.distribution.version**: Version of host + distribution on which the checkpoint was created. + +- **io.podman.annotations.checkpoint.distribution.name**: Name of host + distribution on which the checkpoint was created. + +#### **--export**, **-e**=*archive* + +Export the checkpoint to a tar.gz file. The exported checkpoint can be used +to import the *container* on another system and thus enabling container live +migration. This checkpoint archive also includes all changes to the *container's* +root file-system, if not explicitly disabled using **--ignore-rootfs**. + +#### **--file-locks** + +Checkpoint a *container* with file locks. If an application running in the container +is using file locks, this OPTION is required during checkpoint and restore. Otherwise +checkpointing *containers* with file locks is expected to fail. If file locks are not +used, this option is ignored.\ +The default is **false**. + +#### **--ignore-rootfs** + +If a checkpoint is exported to a tar.gz file it is possible with the help of **--ignore-rootfs** to explicitly disable including changes to the root file-system into the checkpoint archive file.\ +The default is **false**.\ +*IMPORTANT: This OPTION only works in combination with __--export, -e__.* + +#### **--ignore-volumes** + +This OPTION must be used in combination with the **--export, -e** OPTION. +When this OPTION is specified, the content of volumes associated with +the *container* is not included into the checkpoint tar.gz file.\ +The default is **false**. + +#### **--keep**, **-k** + +Keep all temporary log and statistics files created by CRIU during checkpointing. These files are not deleted if checkpointing fails for further debugging. If checkpointing succeeds these files are theoretically not needed, but if these files are needed Podman can keep the files for further analysis.\ +The default is **false**. + +#### **--latest**, **-l** + +Instead of providing the *container ID* or *name*, use the last created *container*. The default is **false**. +*IMPORTANT: This OPTION is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines. This OPTION does not need a container name or ID as input argument.* + +#### **--leave-running**, **-R** + +Leave the *container* running after checkpointing instead of stopping it.\ +The default is **false**. + +#### **--pre-checkpoint**, **-P** + +Dump the *container's* memory information only, leaving the *container* running. Later +operations supersedes prior dumps. It only works on `runc 1.0-rc3` or `higher`.\ +The default is **false**. + +The functionality to only checkpoint the memory of the container and in a second +checkpoint only write out the memory pages which have changed since the first +checkpoint relies on the Linux kernel's soft-dirty bit, which is not available +on all systems as it depends on the system architecture and the configuration +of the Linux kernel. Podman verifies if the current system supports this +functionality and return an error if the current system does not support it. + +#### **--print-stats** + +Print out statistics about checkpointing the container(s). The output is +rendered in a JSON array and contains information about how much time different +checkpoint operations required. Many of the checkpoint statistics are created +by CRIU and just passed through to Podman. The following information is provided +in the JSON array: + +- **podman_checkpoint_duration**: Overall time (in microseconds) needed to create + all checkpoints. + +- **runtime_checkpoint_duration**: Time (in microseconds) the container runtime + needed to create the checkpoint. + +- **freezing_time**: Time (in microseconds) CRIU needed to pause (freeze) all + processes in the container (measured by CRIU). + +- **frozen_time**: Time (in microseconds) all processes in the container were + paused (measured by CRIU). + +- **memdump_time**: Time (in microseconds) needed to extract all required memory + pages from all container processes (measured by CRIU). + +- **memwrite_time**: Time (in microseconds) needed to write all required memory + pages to the corresponding checkpoint image files (measured by CRIU). + +- **pages_scanned**: Number of memory pages scanned to determine if they need + to be checkpointed (measured by CRIU). + +- **pages_written**: Number of memory pages actually written to the checkpoint + image files (measured by CRIU). + +The default is **false**. + +#### **--tcp-established** + +Checkpoint a *container* with established TCP connections. If the checkpoint +image contains established TCP connections, this OPTION is required during +restore. Defaults to not checkpointing *containers* with established TCP +connections.\ +The default is **false**. + +#### **--with-previous** + +Check out the *container* with previous criu image files in pre-dump. It only works on `runc 1.0-rc3` or `higher`.\ +The default is **false**.\ +*IMPORTANT: This OPTION is not available with __--pre-checkpoint__*. + +This option requires that the option __--pre-checkpoint__ has been used before on the +same container. Without an existing pre-checkpoint, this option fails. + +Also see __--pre-checkpoint__ for additional information about __--pre-checkpoint__ +availability on different systems. + +## EXAMPLES +Make a checkpoint for the container "mywebserver". +``` +# podman container checkpoint mywebserver +``` + +Create a checkpoint image for the container "mywebserver". +``` +# podman container checkpoint --create-image mywebserver-checkpoint-1 mywebserver +``` + +Dumps the container's memory information of the latest container into an archive. +``` +# podman container checkpoint -P -e pre-checkpoint.tar.gz -l +``` + +Keep the container's memory information from an older dump and add the new container's memory information. +``` +# podman container checkpoint --with-previous -e checkpoint.tar.gz -l +``` + +Dump the container's memory information of the latest container into an archive with the specified compress method. +``` +# podman container checkpoint -l --compress=none --export=dump.tar +# podman container checkpoint -l --compress=gzip --export=dump.tar.gz +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container-restore(1)](podman-container-restore.1.md)**, **criu(8)** + +## HISTORY +September 2018, Originally compiled by Adrian Reber diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-container-cleanup.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-container-cleanup.1.md new file mode 100644 index 000000000..2f708d808 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-container-cleanup.1.md @@ -0,0 +1,61 @@ +--- +title: podman-container-cleanup +version: v5.4.1 +--- + +% podman-container-cleanup 1 + +## NAME +podman\-container\-cleanup - Clean up the container's network and mountpoints + +## SYNOPSIS +**podman container cleanup** [*options*] *container* [*container* ...] + +## DESCRIPTION +**podman container cleanup** cleans up exited *containers* by removing all mountpoints and network configurations from the host. The *container name* or *ID* can be used. The cleanup command does not remove the *containers*. Running *containers* are not cleaned up.\ +Sometimes container mount points and network stacks can remain if the podman command was killed or the *container* ran in daemon mode. This command is automatically executed when *containers* are run in daemon mode by the `conmon process` when the *container* exits. + +## OPTIONS +#### **--all**, **-a** + +Clean up all *containers*.\ +The default is **false**.\ +*IMPORTANT: This OPTION does not need a container name or ID as input argument.* + +#### **--exec**=*session* + +Clean up an exec session for a single *container*. +It can only be specified if a single *container* is being cleaned up (conflicts with **--all** as such). If **--rm** is not specified, temporary files for the exec session are cleaned up; if it is, the exec session is removed from the *container*.\ +*IMPORTANT: Conflicts with **--rmi** as the container is not being cleaned up so the image cannot be removed.* + +#### **--latest**, **-l** + +Instead of providing the *container ID* or *name*, use the last created *container*. The default is **false**. +*IMPORTANT: This OPTION is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines. This OPTION does not need a container name or ID as input argument.* + +#### **--rm** + +After cleanup, remove the *container* entirely.\ +The default is **false**. + +#### **--rmi** + +After cleanup, remove the image entirely.\ +The default is **false**. + +## EXAMPLES +Clean up the container "mywebserver". +``` +$ podman container cleanup mywebserver +``` + +Clean up the containers with the names "mywebserver", "myflaskserver", "860a4b23". +``` +$ podman container cleanup mywebserver myflaskserver 860a4b23 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)** + +## HISTORY +Jun 2018, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-container-clone.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-container-clone.1.md new file mode 100644 index 000000000..01442e601 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-container-clone.1.md @@ -0,0 +1,362 @@ +--- +title: podman-container-clone +version: v5.4.1 +--- + +% podman-container-clone 1 + +## NAME +podman\-container\-clone - Create a copy of an existing container + +## SYNOPSIS +**podman container clone** [*options*] *container* *name* *image* + +## DESCRIPTION +**podman container clone** creates a copy of a container, recreating the original with an identical configuration. This command takes three arguments: the first being the container ID or name to clone, the second argument in this command can change the name of the clone from the default of $ORIGINAL_NAME-clone, and the third is a new image to use in the cloned container. + +## OPTIONS + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + +If none is specified, the original container's cpu period is used + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + +If none is specified, the original container's CPU quota are used. + + +[//]: # (BEGIN included file options/cpu-rt-period.md) +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-period.md) + +If none is specified, the original container's CPU runtime period is used. + + +[//]: # (BEGIN included file options/cpu-rt-runtime.md) +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-runtime.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + +If none are specified, the original container's CPU shares are used. + +#### **--cpus** + +Set a number of CPUs for the container that overrides the original containers CPU limits. If none are specified, the original container's Nano CPUs are used. + +This is shorthand +for **--cpu-period** and **--cpu-quota**, so only **--cpus** or either both the **--cpu-period** and **--cpu-quota** options can be set. + +This option is not supported on cgroups V1 rootless systems. + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + +If none are specified, the original container's CPUset is used. + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + +If none are specified, the original container's CPU memory nodes are used. + + +[//]: # (BEGIN included file options/destroy.md) +#### **--destroy** + +Remove the original container that we are cloning once used to mimic the configuration. + +[//]: # (END included file options/destroy.md) + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + +#### **--force**, **-f** + +Force removal of the original container that we are cloning. Can only be used in conjunction with **--destroy**. + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + +If no memory limits are specified, the original container's memory limits are used. + + +[//]: # (BEGIN included file options/memory-reservation.md) +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-reservation.md) + +If unspecified, memory reservation is the same as memory limit from the +container being cloned. + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + +If unspecified, the container being cloned is used to derive +the swap value. + + +[//]: # (BEGIN included file options/memory-swappiness.md) +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/memory-swappiness.md) + +#### **--name** + +Set a custom name for the cloned container. The default if not specified is of the syntax: **\-clone** + +#### **--pod**=*name* + +Clone the container in an existing pod. It is helpful to move a container to an +existing pod. The container joins the pod shared namespaces, losing its configuration +that conflicts with the shared namespaces. + +#### **--run** + +When set to true, this flag runs the newly created container after the +clone process has completed, this specifies a detached running mode. + +## EXAMPLES + +Clone specified container into a new container: +``` +# podman container clone d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone specified container into a newly named container: +``` +# podman container clone --name=clone d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Replace specified container with selected resource constraints into a new container, removing original container: +``` +# podman container clone --destroy --cpus=5 d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone specified container giving a new name and then replacing the image of the original container with the specified image name: +``` +# podman container clone 2d4d4fca7219b4437e0d74fcdc272c4f031426a6eacd207372691207079551de new_name fedora +Resolved "fedora" as an alias (/etc/containers/registries.conf.d/shortnames.conf) +Trying to pull registry.fedoraproject.org/fedora\:latest... +Getting image source signatures +Copying blob c6183d119aa8 done +Copying config e417cd49a8 done +Writing manifest to image destination +Storing signatures +5a9b7851013d326aa4ac4565726765901b3ecc01fcbc0f237bc7fd95588a24f9 +``` + +## SEE ALSO +**[podman-create(1)](podman-create.1.md)**, **[cgroups(7)](https://man7.org/linux/man-pages/man7/cgroups.7.html)** + +## HISTORY +January 2022, Originally written by Charlie Doern diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-container-diff.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-container-diff.1.md new file mode 100644 index 000000000..a514e9b35 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-container-diff.1.md @@ -0,0 +1,65 @@ +--- +title: podman-container-diff +version: v5.4.1 +--- + +% podman-container-diff 1 + +## NAME +podman\-container\-diff - Inspect changes on a container's filesystem + +## SYNOPSIS +**podman container diff** [*options*] *container* [*container*] + +## DESCRIPTION +Displays changes on a container's filesystem. The container is compared to its parent layer or the second argument when given. + +The output is prefixed with the following symbols: + +| Symbol | Description | +|--------|-------------| +| A | A file or directory was added. | +| D | A file or directory was deleted. | +| C | A file or directory was changed. | + +## OPTIONS + +#### **--format** + +Alter the output into a different format. The only valid format for **podman container diff** is `json`. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +``` +# podman container diff container1 +C /usr +C /usr/local +C /usr/local/bin +A /usr/local/bin/docker-entrypoint.sh +``` + +``` +$ podman container diff --format json container1 container2 +{ + "added": [ + "/test" + ] +} +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)** + +## HISTORY +July 2021, Originally compiled by Paul Holzinger diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-container-exists.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-container-exists.1.md new file mode 100644 index 000000000..73d3189ff --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-container-exists.1.md @@ -0,0 +1,56 @@ +--- +title: podman-container-exists +version: v5.4.1 +--- + +% podman-container-exists 1 + +## NAME +podman\-container\-exists - Check if a container exists in local storage + +## SYNOPSIS +**podman container exists** [*options*] *container* + +## DESCRIPTION +**podman container exists** checks if a container exists in local storage. The *container ID* or *name* is used as input. Podman returns an exit code +of `0` when the container is found. A `1` is returned otherwise. An exit code of `125` indicates there was an issue accessing the local storage. + +## OPTIONS +#### **--external** + +Check for external *containers* as well as Podman *containers*. These external *containers* are generally created via other container technology such as `Buildah` or `CRI-O`.\ +The default is **false**. + +**-h**, **--help** + +Prints usage statement.\ +The default is **false**. + +## EXAMPLES + +Check if a container called "webclient" exists in local storage. Here, the container does exist. +``` +$ podman container exists webclient +$ echo $? +0 +``` + +Check if a container called "webbackend" exists in local storage. Here, the container does not exist. +``` +$ podman container exists webbackend +$ echo $? +1 +``` + +Check if a container called "ubi8-working-container" created via Buildah exists in local storage. Here, the container does not exist. +``` +$ podman container exists --external ubi8-working-container +$ echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +November 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-container-inspect.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-container-inspect.1.md new file mode 100644 index 000000000..870fc741c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-container-inspect.1.md @@ -0,0 +1,349 @@ +--- +title: podman-container-inspect +version: v5.4.1 +--- + +% podman-container-inspect 1 + +## NAME +podman\-container\-inspect - Display a container's configuration + +## SYNOPSIS +**podman container inspect** [*options*] *container* [*container* ...] + +## DESCRIPTION + +This displays the low-level information on containers identified by name or ID. By default, this renders +all results in a JSON array. If a format is specified, the given template is executed for each result. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Format the output using the given Go template. +The keys of the returned JSON can be used as the values for the --format flag (see examples below). + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------------ | -------------------------------------------------- | +| .AppArmorProfile | AppArmor profile (string) | +| .Args | Command-line arguments (array of strings) | +| .BoundingCaps | Bounding capability set (array of strings) | +| .Config ... | Structure with config info | +| .ConmonPidFile | Path to file containing conmon pid (string) | +| .Created ... | Container creation time (string, ISO3601) | +| .Dependencies | Dependencies (array of strings) | +| .Driver | Storage driver (string) | +| .EffectiveCaps | Effective capability set (array of strings) | +| .ExecIDs | Exec IDs (array of strings) | +| .GraphDriver ... | Further details of graph driver (struct) | +| .HostConfig ... | Host config details (struct) | +| .HostnamePath | Path to file containing hostname (string) | +| .HostsPath | Path to container /etc/hosts file (string) | +| .ID | Container ID (full 64-char hash) | +| .Image | Container image ID (64-char hash) | +| .ImageDigest | Container image digest (sha256:+64-char hash) | +| .ImageName | Container image name (string) | +| .IsInfra | Is this an infra container? (string: true/false) | +| .IsService | Is this a service container? (string: true/false) | +| .KubeExitCodePropagation | Kube exit-code propagation (string) | +| .LockNumber | Number of the container's Libpod lock | +| .MountLabel | SELinux label of mount (string) | +| .Mounts | Mounts (array of strings) | +| .Name | Container name (string) | +| .Namespace | Container namespace (string) | +| .NetworkSettings ... | Network settings (struct) | +| .OCIConfigPath | Path to OCI config file (string) | +| .OCIRuntime | OCI runtime name (string) | +| .Path | Path to container command (string) | +| .PidFile | Path to file containing container PID (string) | +| .Pod | Parent pod (string) | +| .ProcessLabel | SELinux label of process (string) | +| .ResolvConfPath | Path to container's resolv.conf file (string) | +| .RestartCount | Number of times container has been restarted (int) | +| .Rootfs | Container rootfs (string) | +| .SizeRootFs | Size of rootfs, in bytes [1] | +| .SizeRw | Size of upper (R/W) container layer, in bytes [1] | +| .State ... | Container state info (struct) | +| .StaticDir | Path to container metadata dir (string) | +| .UseImageHostname | Use /etc/hostname from the image if it exists? (string: true/false) +| +| .UseImageHosts | Use /etc/hosts from the image? (string: true/false) +| + +[1] This format specifier requires the **--size** option + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--size**, **-s** + +In addition to normal output, display the total file size if the type is a container. + + +## EXAMPLE + +Inspect the specified container and print its information in json format. +``` +$ podman container inspect foobar +[ + { + "Id": "99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6", + "Created": "2021-09-16T06:09:08.936623325-04:00", + "Path": "echo", + "Args": [ + "hi" + ], + "State": { + "OciVersion": "1.0.2-dev", + "Status": "exited", + "Running": false, + "Paused": false, + "Restarting": false, + "OOMKilled": false, + "Dead": false, + "Pid": 0, + "ExitCode": 0, + "Error": "", + "StartedAt": "2021-09-16T06:09:09.033564436-04:00", + "FinishedAt": "2021-09-16T06:09:09.036184314-04:00", + "Healthcheck": { + "Status": "", + "FailingStreak": 0, + "Log": null + } + }, + "Image": "14119a10abf4669e8cdbdff324a9f9605d99697215a0d21c360fe8dfa8471bab", + "ImageName": "docker.io/library/alpine:latest", + "Rootfs": "", + "Pod": "", + "ResolvConfPath": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/resolv.conf", + "HostnamePath": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/hostname", + "HostsPath": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/hosts", + "StaticDir": "/home/dwalsh/.local/share/containers/storage/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata", + "OCIConfigPath": "/home/dwalsh/.local/share/containers/storage/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/config.json", + "OCIRuntime": "crun", + "ConmonPidFile": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/conmon.pid", + "PidFile": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/pidfile", + "Name": "foobar", + "RestartCount": 0, + "Driver": "overlay", + "MountLabel": "system_u:object_r:container_file_t:s0:c25,c695", + "ProcessLabel": "system_u:system_r:container_t:s0:c25,c695", + "AppArmorProfile": "", + "EffectiveCaps": [ + "CAP_CHOWN", + "CAP_DAC_OVERRIDE", + "CAP_FOWNER", + "CAP_FSETID", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_SETFCAP", + "CAP_SETGID", + "CAP_SETPCAP", + "CAP_SETUID", + ], + "BoundingCaps": [ + "CAP_CHOWN", + "CAP_DAC_OVERRIDE", + "CAP_FOWNER", + "CAP_FSETID", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_SETFCAP", + "CAP_SETGID", + "CAP_SETPCAP", + "CAP_SETUID", + ], + "ExecIDs": [], + "GraphDriver": { + "Name": "overlay", + "Data": { + "LowerDir": "/home/dwalsh/.local/share/containers/storage/overlay/e2eb06d8af8218cfec8210147357a68b7e13f7c485b991c288c2d01dc228bb68/diff", + "UpperDir": "/home/dwalsh/.local/share/containers/storage/overlay/8f3d70434a3db17410ec4710caf4f251f3e4ed0a96a08124e4b3d4af0a0ea300/diff", + "WorkDir": "/home/dwalsh/.local/share/containers/storage/overlay/8f3d70434a3db17410ec4710caf4f251f3e4ed0a96a08124e4b3d4af0a0ea300/work" + } + }, + "Mounts": [], + "Dependencies": [], + "NetworkSettings": { + "EndpointID": "", + "Gateway": "", + "IPAddress": "", + "IPPrefixLen": 0, + "IPv6Gateway": "", + "GlobalIPv6Address": "", + "GlobalIPv6PrefixLen": 0, + "MacAddress": "", + "Bridge": "", + "SandboxID": "", + "HairpinMode": false, + "LinkLocalIPv6Address": "", + "LinkLocalIPv6PrefixLen": 0, + "Ports": {}, + "SandboxKey": "" + }, + "Namespace": "", + "IsInfra": false, + "Config": { + "Hostname": "99f66530fe9c", + "Domainname": "", + "User": "", + "AttachStdin": false, + "AttachStdout": false, + "AttachStderr": false, + "Tty": false, + "OpenStdin": false, + "StdinOnce": false, + "Env": [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "TERM=xterm", + "container=podman", + "HOME=/root", + "HOSTNAME=99f66530fe9c" + ], + "Cmd": [ + "echo", + "hi" + ], + "Image": "docker.io/library/alpine:latest", + "Volumes": null, + "WorkingDir": "/", + "Entrypoint": "", + "OnBuild": null, + "Labels": null, + "Annotations": { + "io.container.manager": "libpod", + "io.kubernetes.cri-o.Created": "2021-09-16T06:09:08.936623325-04:00", + "org.opencontainers.image.stopSignal": "15" + }, + "StopSignal": 15, + "CreateCommand": [ + "podman", + "run", + "--name", + "foobar", + "alpine", + "echo", + "hi" + ], + "Timezone": "local", + "Umask": "0022", + "Timeout": 0, + "StopTimeout": 10 + }, + "HostConfig": { + "Binds": [], + "CgroupManager": "systemd", + "CgroupMode": "private", + "ContainerIDFile": "", + "LogConfig": { + "Type": "journald", + "Config": null, + "Path": "", + "Tag": "", + "Size": "0B" + }, + "NetworkMode": "slirp4netns", + "PortBindings": {}, + "RestartPolicy": { + "Name": "", + "MaximumRetryCount": 0 + }, + "AutoRemove": false, + "VolumeDriver": "", + "VolumesFrom": null, + "CapAdd": [], + "CapDrop": [], + "Dns": [], + "DnsOptions": [], + "DnsSearch": [], + "ExtraHosts": [], + "GroupAdd": [], + "IpcMode": "shareable", + "Cgroup": "", + "Cgroups": "default", + "Links": null, + "OomScoreAdj": 0, + "PidMode": "private", + "Privileged": false, + "PublishAllPorts": false, + "ReadonlyRootfs": false, + "SecurityOpt": [], + "Tmpfs": {}, + "UTSMode": "private", + "UsernsMode": "", + "ShmSize": 65536000, + "Runtime": "oci", + "ConsoleSize": [ + 0, + 0 + ], + "Isolation": "", + "CpuShares": 0, + "Memory": 0, + "NanoCpus": 0, + "CgroupParent": "user.slice", + "BlkioWeight": 0, + "BlkioWeightDevice": null, + "BlkioDeviceReadBps": null, + "BlkioDeviceWriteBps": null, + "BlkioDeviceReadIOps": null, + "BlkioDeviceWriteIOps": null, + "CpuPeriod": 0, + "CpuQuota": 0, + "CpuRealtimePeriod": 0, + "CpuRealtimeRuntime": 0, + "CpusetCpus": "", + "CpusetMems": "", + "Devices": [], + "DiskQuota": 0, + "KernelMemory": 0, + "MemoryReservation": 0, + "MemorySwap": 0, + "MemorySwappiness": 0, + "OomKillDisable": false, + "PidsLimit": 2048, + "Ulimits": [], + "CpuCount": 0, + "CpuPercent": 0, + "IOMaximumIOps": 0, + "IOMaximumBandwidth": 0, + "CgroupConf": null + } + } +] +``` + +Inspect the specified container for the Image Name it is based on. +``` +$ podman container inspect nervous_fermi --format "{{.ImageName}}" +registry.access.redhat.com/ubi8:latest +``` + +Inspect the specified container for the GraphDriver Name it is running with. +``` +$ podman container inspect foobar --format "{{.GraphDriver.Name}}" +overlay +``` + +Inspect the latest container created for its EffectiveCaps field. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman container inspect --latest --format {{.EffectiveCaps}} +[CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_FSETID CAP_KILL CAP_NET_BIND_SERVICE CAP_SETFCAP CAP_SETGID CAP_SETPCAP CAP_SETUID] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +Sep 2021, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-container-prune.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-container-prune.1.md new file mode 100644 index 000000000..7d2cecc6e --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-container-prune.1.md @@ -0,0 +1,83 @@ +--- +title: podman-container-prune +version: v5.4.1 +--- + +% podman-container-prune 1 + +## NAME +podman\-container\-prune - Remove all stopped containers from local storage + +## SYNOPSIS +**podman container prune** [*options*] + +## DESCRIPTION +**podman container prune** removes all stopped containers from local storage. + +## OPTIONS +#### **--filter**=*filters* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------:|------------------------------------------------------------------------------------------------------| +| label | Only remove containers, with (or without, in the case of label!=[...] is used) the specified labels. | +| until | Only remove containers created before given timestamp. | + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes containers with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes containers without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not provide an interactive prompt for container removal.\ +The default is **false**. + +**-h**, **--help** + +Print usage statement.\ +The default is **false**. + +## EXAMPLES +Remove all stopped containers from local storage: +``` +$ podman container prune +WARNING! This will remove all stopped containers. +Are you sure you want to continue? [y/N] y +878392adf2e6c5c9bb1fc19b69d37d2e98c8abf9d539c0bce4b15b46bbcce471 +37664467fbe3618bf9479c34393ac29c02696675addf1750f9e346581636cde7 +ed0c6468b8e1cb641b4621d1fe30cb477e1fefc5c0bceb66feaf2f7cb50e5962 +6ac6c8f0067b7a4682e6b8e18902665b57d1a0e07e885d9abcd382232a543ccd +fff1c5b6c3631746055ec40598ce8ecaa4b82aef122f9e3a85b03b55c0d06c23 +602d343cd47e7cb3dfc808282a9900a3e4555747787ec6723bb68cedab8384d5 +``` + +Remove all stopped containers from local storage without confirmation: +``` +$ podman container prune -f +878392adf2e6c5c9bb1fc19b69d37d2e98c8abf9d539c0bce4b15b46bbcce471 +37664467fbe3618bf9479c34393ac29c02696675addf1750f9e346581636cde7 +ed0c6468b8e1cb641b4621d1fe30cb477e1fefc5c0bceb66feaf2f7cb50e5962 +6ac6c8f0067b7a4682e6b8e18902665b57d1a0e07e885d9abcd382232a543ccd +fff1c5b6c3631746055ec40598ce8ecaa4b82aef122f9e3a85b03b55c0d06c23 +602d343cd47e7cb3dfc808282a9900a3e4555747787ec6723bb68cedab8384d5 +``` + +Remove all stopped containers from local storage created before the last 10 minutes: +``` +$ podman container prune --filter until="10m" +WARNING! This will remove all stopped containers. +Are you sure you want to continue? [y/N] y +3d366295e33d8cc612c4d873199bacadd55088d90d17dcafaa9a2d317ad50b4e +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-ps(1)](podman-ps.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude \ +December 2020, converted filter information from docs.docker.com documentation by Dan Walsh diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-container-restore.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-container-restore.1.md new file mode 100644 index 000000000..79dbc9439 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-container-restore.1.md @@ -0,0 +1,198 @@ +--- +title: podman-container-restore +version: v5.4.1 +--- + +% podman-container-restore 1 + +## NAME +podman\-container\-restore - Restore one or more containers from a checkpoint + +## SYNOPSIS +**podman container restore** [*options*] *name* [...] + +## DESCRIPTION +**podman container restore** restores a container from a container checkpoint or +checkpoint image. The *container IDs*, *image IDs* or *names* are used as input. + +## OPTIONS +#### **--all**, **-a** + +Restore all checkpointed *containers*.\ +The default is **false**.\ +*IMPORTANT: This OPTION does not need a container name or ID as input argument.* + +#### **--file-locks** + +Restore a *container* with file locks. This option is required to +restore file locks from a checkpoint image. If the checkpoint image +does not contain file locks, this option is ignored. Defaults to not +restoring file locks.\ +The default is **false**. + +#### **--ignore-rootfs** + +If a *container* is restored from a checkpoint tar.gz file it is possible that it also contains all root file-system changes. With **--ignore-rootfs** it is possible to explicitly disable applying these root file-system changes to the restored *container*.\ +The default is **false**.\ +*IMPORTANT: This OPTION is only available in combination with __--import, -i__.* + +#### **--ignore-static-ip** + +If the *container* was started with **--ip** the restored *container* also tries to use that +IP address and restore fails if that IP address is already in use. This can happen, if +a *container* is restored multiple times from an exported checkpoint with **--name, -n**. + +Using **--ignore-static-ip** tells Podman to ignore the IP address if it was configured +with **--ip** during *container* creation. + +The default is **false**. + +#### **--ignore-static-mac** + +If the *container* was started with **--mac-address** the restored *container* also +tries to use that MAC address and restore fails if that MAC address is already +in use. This can happen, if a *container* is restored multiple times from an +exported checkpoint with **--name, -n**. + +Using **--ignore-static-mac** tells Podman to ignore the MAC address if it was +configured with **--mac-address** during *container* creation. + +The default is **false**. + +#### **--ignore-volumes** + +This option must be used in combination with the **--import, -i** option. +When restoring *containers* from a checkpoint tar.gz file with this option, +the content of associated volumes are not restored.\ +The default is **false**. + +#### **--import**, **-i**=*file* + +Import a checkpoint tar.gz file, which was exported by Podman. This can be used +to import a checkpointed *container* from another host.\ +*IMPORTANT: This OPTION does not need a container name or ID as input argument.* + +During the import of a checkpoint file Podman selects the same container runtime +which was used during checkpointing. This is especially important if a specific +(non-default) container runtime was specified during container creation. Podman +also aborts the restore if the container runtime specified during restore does +not much the container runtime used for container creation. + +#### **--import-previous**=*file* + +Import a pre-checkpoint tar.gz file which was exported by Podman. This option +must be used with **-i** or **--import**. It only works on `runc 1.0-rc3` or `higher`. +*IMPORTANT: This OPTION is not supported on the remote client, including Mac and Windows (excluding WSL2) machines.* + +#### **--keep**, **-k** + +Keep all temporary log and statistics files created by `CRIU` during +checkpointing as well as restoring. These files are not deleted if restoring +fails for further debugging. If restoring succeeds these files are +theoretically not needed, but if these files are needed Podman can keep the +files for further analysis. This includes the checkpoint directory with all +files created during checkpointing. The size required by the checkpoint +directory is roughly the same as the amount of memory required by the +processes in the checkpointed *container*.\ +Without the **--keep**, **-k** option, the checkpoint is consumed and cannot be used again.\ +The default is **false**. + +#### **--latest**, **-l** + +Instead of providing the *container ID* or *name*, use the last created *container*. The default is **false**. +*IMPORTANT: This OPTION is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines. This OPTION does not need a container name or ID as input argument.* + +#### **--name**, **-n**=*name* + +If a *container* is restored from a checkpoint tar.gz file it is possible to rename it with **--name, -n**. This way it is possible to restore a *container* from a checkpoint multiple times with different +names. + +If the **--name, -n** option is used, Podman does not attempt to assign the same IP +address to the *container* it was using before checkpointing as each IP address can only +be used once, and the restored *container* has another IP address. This also means +that **--name, -n** cannot be used in combination with **--tcp-established**.\ +*IMPORTANT: This OPTION is only available for a checkpoint image or in combination +with __--import, -i__.* + +#### **--pod**=*name* + +Restore a container into the pod *name*. The destination pod for this restore +has to have the same namespaces shared as the pod this container was checkpointed +from (see **[podman pod create --share](podman-pod-create.1.md#--share)**).\ +*IMPORTANT: This OPTION is only available for a checkpoint image or in combination +with __--import, -i__.* + +This option requires at least CRIU 3.16. + +#### **--print-stats** + +Print out statistics about restoring the container(s). The output is +rendered in a JSON array and contains information about how much time different +restore operations required. Many of the restore statistics are created +by CRIU and just passed through to Podman. The following information is provided +in the JSON array: + +- **podman_restore_duration**: Overall time (in microseconds) needed to restore + all checkpoints. + +- **runtime_restore_duration**: Time (in microseconds) the container runtime + needed to restore the checkpoint. + +- **forking_time**: Time (in microseconds) CRIU needed to create (fork) all + processes in the restored container (measured by CRIU). + +- **restore_time**: Time (in microseconds) CRIU needed to restore all processes + in the container (measured by CRIU). + +- **pages_restored**: Number of memory pages restored (measured by CRIU). + +The default is **false**. + +#### **--publish**, **-p**=*port* + +Replaces the ports that the *container* publishes, as configured during the +initial *container* start, with a new set of port forwarding rules. + +For more details, see **[podman run --publish](podman-run.1.md#--publish)**. + +#### **--tcp-established** + +Restore a *container* with established TCP connections. If the checkpoint image +contains established TCP connections, this option is required during restore. +If the checkpoint image does not contain established TCP connections this +option is ignored. Defaults to not restoring *containers* with established TCP +connections.\ +The default is **false**. + +## EXAMPLE +Restore the container "mywebserver". +``` +# podman container restore mywebserver +``` + +Import a checkpoint file and a pre-checkpoint file. +``` +# podman container restore --import-previous pre-checkpoint.tar.gz --import checkpoint.tar.gz +``` + +Start the container "mywebserver". Make a checkpoint of the container and export it. Restore the container with other port ranges from the exported file. +``` +$ podman run --rm -p 2345:80 -d webserver +# podman container checkpoint -l --export=dump.tar +# podman container restore -p 5432:8080 --import=dump.tar +``` + +Start a container with the name "foobar-1". Create a checkpoint image "foobar-checkpoint". Restore the container from the checkpoint image with a different name. +``` +# podman run --name foobar-1 -d webserver +# podman container checkpoint --create-image foobar-checkpoint foobar-1 +# podman inspect foobar-checkpoint +# podman container restore --name foobar-2 foobar-checkpoint +# podman container restore --name foobar-3 foobar-checkpoint +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container-checkpoint(1)](podman-container-checkpoint.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-pod-create(1)](podman-pod-create.1.md)**, **criu(8)** + +## HISTORY +September 2018, Originally compiled by Adrian Reber diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-container-runlabel.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-container-runlabel.1.md new file mode 100644 index 000000000..90c82b592 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-container-runlabel.1.md @@ -0,0 +1,128 @@ +--- +title: podman-container-runlabel +version: v5.4.1 +--- + +% podman-container-runlabel 1 + +## NAME +podman-container-runlabel - Execute a command as described by a container-image label + +## SYNOPSIS +**podman container runlabel** [*options*] *label* *image* [*arg...*] + +## DESCRIPTION +**podman container runlabel** reads the specified `label` of the `image` and executes it as command on the host. If the label does not exist, Podman exits with an error. Additional arguments are appended to the command. + +Historically, container images describe the contents (e.g., layers) and how a container runtime (e.g., crun(1) or runc(1)) executes the container. For instance, an image may set the environment and the command in its configuration. However, a container image cannot directly specify how a container engine such as Podman executes it. For instance, an image configuration does not include information about log drivers, namespaces, or which capabilities it needs to run correctly. + +`podman container runlabel` addresses the limitation of container images in a simple yet efficient way. Podman reads the contents of the label and interpret it as a command that is executed on the host. This way an image can describe exactly how it is executed by Podman. For instance, a label with the content `/usr/bin/podman run -d --pid=host --privileged \${IMAGE}` instructs the image to be executed in a detached, privileged container that is using the PID namespace of the host. This lifts the self-description of a container image from "what" to "how". + +Note that the `runlabel` command is intended to be run in trusted environments exclusively. Using the command on untrusted images is not recommended. + +## VARIABLES + +The contents of a label may refer to the following variables which is substituted while processing the label. + +**IMAGE** +The name of the image. When executing `podman container runlabel label fedora` the `IMAGE` variable is replaced with `fedora`. Valid formats are `IMAGE`, `$IMAGE`, `${IMAGE}` and `=IMAGE`. + +**NAME** +As specified by the `--name` option. The format is identical to the one of the IMAGE attribute. + +**PWD** +Will be replaced with the current working directory. + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + +#### **--display** + +Display the label's value of the image having populated its environment variables. The runlabel command is not executed if --display is specified. + +#### **--help**, **-h** +Print usage statement + +#### **--name**, **-n**=*name* + +Use this name for creating content for the container. If not specified, name defaults to the name of the image. + +#### **--quiet**, **-q** + +Suppress output information when pulling images + +#### **--replace** + +If a container exists with the current name, it is stopped, deleted and a new container is created from this image. + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Execute the `run` label of an image called foobar. +``` +$ podman container runlabel run foobar +``` + +Execute the `install` label of an image called foobar with additional arguments. +``` +$ podman container runlabel install foobar apples oranges +``` + +Display the contents of the `run` label of image foobar. +``` +$ podman container runlabel --display run foobar +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/main/man/runc.8.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-auth.json(5)](https://github.com/containers/image/blob/main/docs/containers-auth.json.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +## HISTORY +August 2021, Refinements by Valentin Rothberg (rothberg at redhat dot com) + +September 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-container.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-container.1.md new file mode 100644 index 000000000..af65296bd --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-container.1.md @@ -0,0 +1,58 @@ +--- +title: podman-container +version: v5.4.1 +--- + +% podman-container 1 + +## NAME +podman\-container - Manage containers + +## SYNOPSIS +**podman container** *subcommand* + +## DESCRIPTION +The container command allows management of containers + +## COMMANDS + +| Command | Man Page | Description | +| --------- | --------------------------------------------------- | ---------------------------------------------------------------------------- | +| attach | [podman-attach(1)](podman-attach.1.md) | Attach to a running container. | +| checkpoint | [podman-container-checkpoint(1)](podman-container-checkpoint.1.md) | Checkpoint one or more running containers. | +| cleanup | [podman-container-cleanup(1)](podman-container-cleanup.1.md) | Clean up the container's network and mountpoints. | +| clone | [podman-container-clone(1)](podman-container-clone.1.md) | Create a copy of an existing container. | +| commit | [podman-commit(1)](podman-commit.1.md) | Create new image based on the changed container. | +| cp | [podman-cp(1)](podman-cp.1.md) | Copy files/folders between a container and the local filesystem. | +| create | [podman-create(1)](podman-create.1.md) | Create a new container. | +| diff | [podman-container-diff(1)](podman-container-diff.1.md) | Inspect changes on a container's filesystem | +| exec | [podman-exec(1)](podman-exec.1.md) | Execute a command in a running container. | +| exists | [podman-container-exists(1)](podman-container-exists.1.md) | Check if a container exists in local storage | +| export | [podman-export(1)](podman-export.1.md) | Export a container's filesystem contents as a tar archive. | +| init | [podman-init(1)](podman-init.1.md) | Initialize a container | +| inspect | [podman-container-inspect(1)](podman-container-inspect.1.md)| Display a container's configuration. | +| kill | [podman-kill(1)](podman-kill.1.md) | Kill the main process in one or more containers. | +| list | [podman-ps(1)](podman-ps.1.md) | List the containers on the system.(alias ls) | +| logs | [podman-logs(1)](podman-logs.1.md) | Display the logs of a container. | +| mount | [podman-mount(1)](podman-mount.1.md) | Mount a working container's root filesystem. | +| pause | [podman-pause(1)](podman-pause.1.md) | Pause one or more containers. | +| port | [podman-port(1)](podman-port.1.md) | List port mappings for the container. | +| prune | [podman-container-prune(1)](podman-container-prune.1.md)| Remove all stopped containers from local storage. | +| ps | [podman-ps(1)](podman-ps.1.md) | Print out information about containers. | +| rename | [podman-rename(1)](podman-rename.1.md) | Rename an existing container. | +| restart | [podman-restart(1)](podman-restart.1.md) | Restart one or more containers. | +| restore | [podman-container-restore(1)](podman-container-restore.1.md) | Restore one or more containers from a checkpoint. | +| rm | [podman-rm(1)](podman-rm.1.md) | Remove one or more containers. | +| run | [podman-run(1)](podman-run.1.md) | Run a command in a container. | +| runlabel | [podman-container-runlabel(1)](podman-container-runlabel.1.md) | Execute a command as described by a container-image label. | +| start | [podman-start(1)](podman-start.1.md) | Start one or more containers. | +| stats | [podman-stats(1)](podman-stats.1.md) | Display a live stream of one or more container's resource usage statistics. | +| stop | [podman-stop(1)](podman-stop.1.md) | Stop one or more running containers. | +| top | [podman-top(1)](podman-top.1.md) | Display the running processes of a container. | +| unmount | [podman-unmount(1)](podman-unmount.1.md) | Unmount a working container's root filesystem.(Alias unmount) | +| unpause | [podman-unpause(1)](podman-unpause.1.md) | Unpause one or more containers. | +| update | [podman-update(1)](podman-update.1.md) | Update the cgroup configuration of a given container. | +| wait | [podman-wait(1)](podman-wait.1.md) | Wait on one or more containers to stop and print their exit codes. | + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-exec(1)](podman-exec.1.md)**, **[podman-run(1)](podman-run.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-cp.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-cp.1.md new file mode 100644 index 000000000..4c4ae69a0 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-cp.1.md @@ -0,0 +1,140 @@ +--- +title: podman-cp +version: v5.4.1 +--- + +% podman-cp 1 + +## NAME +podman\-cp - Copy files/folders between a container and the local filesystem + +## SYNOPSIS +**podman cp** [*options*] [*container*:]*src_path* [*container*:]*dest_path* + +**podman container cp** [*options*] [*container*:]*src_path* [*container*:]*dest_path* + +## DESCRIPTION +**podman cp** allows copying the contents of **src_path** to the **dest_path**. Files can be copied from a container to the local machine and vice versa or between two containers. +If `-` is specified for either the `SRC_PATH` or `DEST_PATH`, one can also stream a tar archive from `STDIN` or to `STDOUT`. + +The containers can be either running or stopped and the *src_path* or *dest_path* can be a file or directory. + +*IMPORTANT: The **podman cp** command assumes container paths are relative to the container's root directory (`/`), which means supplying the initial forward slash is optional and therefore sees `compassionate_darwin:/tmp/foo/myfile.txt` and `compassionate_darwin\:tmp/foo/myfile.txt` as identical.* + +Local machine paths can be an absolute or relative value. +The command interprets a local machine's relative paths as relative to the current working directory where **podman cp** is run. + +Assuming a path separator of `/`, a first argument of **src_path** and second argument of **dest_path**, the behavior is as follows: + +**src_path** specifies a file: + - **dest_path** does not exist + - the file is saved to a file created at **dest_path** (note that parent directory must exist). + - **dest_path** exists and is a file + - the destination is overwritten with the source file's contents. + - **dest_path** exists and is a directory + - the file is copied into this directory using the base name from **src_path**. + +**src_path** specifies a directory: + - **dest_path** does not exist + - **dest_path** is created as a directory and the contents of the source directory are copied into this directory. + - **dest_path** exists and is a file + - Error condition: cannot copy a directory to a file. + - **dest_path** exists and is a directory + - **src_path** ends with `/` + - the source directory is copied into this directory. + - **src_path** ends with `/.` (i.e., slash followed by dot) + - the content of the source directory is copied into this directory. + +The command requires **src_path** and **dest_path** to exist according to the above rules. + +If **src_path** is local and is a symbolic link, the symbolic target, is copied by default. + +A *colon* ( : ) is used as a delimiter between a container and its path, it can also be used when specifying paths to a **src_path** or **dest_path** on a local machine, for example, `file:name.txt`. + +*IMPORTANT: while using a *colon* ( : ) in a local machine path, one must be explicit with a relative or absolute path, for example: `/path/to/file:name.txt` or `./file:name.txt`* + +Using `-` as the **src_path** streams the contents of `STDIN` as a tar archive. The command extracts the content of the tar to the `DEST_PATH` in the container. In this case, **dest_path** must specify a directory. Using `-` as the **dest_path** streams the contents of the resource (can be a directory) as a tar archive to `STDOUT`. + +Note that `podman cp` ignores permission errors when copying from a running rootless container. The TTY devices inside a rootless container are owned by the host's root user and hence cannot be read inside the container's user namespace. + +Further note that `podman cp` does not support globbing (e.g., `cp dir/*.txt`). To copy multiple files from the host to the container use xargs(1) or find(1) (or similar tools for chaining commands) in conjunction with `podman cp`. To copy multiple files from the container to the host, use `podman mount CONTAINER` and operate on the returned mount point instead (see ALTERNATIVES below). + +## OPTIONS + +#### **--archive**, **-a** + +Archive mode (copy all UID/GID information). +When set to true, files copied to a container have changed ownership to the primary UID/GID of the container. +When set to false, maintain UID/GID from archive sources instead of changing them to the primary UID/GID of the destination container. +The default is **true**. + +#### **--overwrite** + +Allow directories to be overwritten with non-directories and vice versa. By default, `podman cp` errors out when attempting to overwrite, for instance, a regular file with a directory. + +## ALTERNATIVES + +Podman has much stronger capabilities than just `podman cp` to achieve copying files between the host and containers. + +Using standard **[podman-mount(1)](podman-mount.1.md)** and **[podman-unmount(1)](podman-unmount.1.md)** takes advantage of the entire linux tool chain, rather than just cp. + +copying contents out of a container or into a container, can be achieved with a few simple commands. For example: + +To copy the `/etc/foobar` directory out of a container and onto `/tmp` on the host, the following commands can be executed: + + mnt=$(podman mount CONTAINERID) + cp -R ${mnt}/etc/foobar /tmp + podman umount CONTAINERID + +To untar a tar ball into a container, following commands can be executed: + + mnt=$(podman mount CONTAINERID) + tar xf content.tgz -C ${mnt} + podman umount CONTAINERID + +To install a package into a container that +does not have dnf installed, following commands can be executed: + + mnt=$(podman mount CONTAINERID) + dnf install --installroot=${mnt} httpd + chroot ${mnt} rm -rf /var/log/dnf /var/cache/dnf + podman umount CONTAINERID + +By using `podman mount` and `podman unmount`, one can use all of the +standard linux tools for moving files into and out of containers, not just +the cp command. + +## EXAMPLES + +Copy a file from the host to a container: +``` +podman cp /myapp/app.conf containerID:/myapp/app.conf +``` + +Copy a file from a container to a directory on another container: +``` +podman cp containerID1:/myfile.txt containerID2:/tmp +``` + +Copy a directory on a container to a directory on the host: +``` +podman cp containerID:/myapp/ /myapp/ +``` + +Copy the contents of a directory on a container to a directory on the host: +``` +podman cp containerID:/home/myuser/. /home/myuser/ +``` + +Copy a directory on a container into a directory on another: +``` +podman cp containerA:/myapp containerB:/newapp +``` + +Stream a tar archive from `STDIN` to a container: +``` +podman cp - containerID:/myfiles.tar.gz < myfiles.tar.gz +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-mount(1)](podman-mount.1.md)**, **[podman-unmount(1)](podman-unmount.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-create.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-create.1.md new file mode 100644 index 000000000..cbdd80aa1 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-create.1.md @@ -0,0 +1,2849 @@ +--- +title: podman-create +version: v5.4.1 +--- + +% podman-create 1 + +## NAME +podman\-create - Create a new container + +## SYNOPSIS +**podman create** [*options*] *image* [*command* [*arg* ...]] + +**podman container create** [*options*] *image* [*command* [*arg* ...]] + +## DESCRIPTION + +Creates a writable container layer over the specified image and prepares it for +running the specified command. The container ID is then printed to STDOUT. This +is similar to **podman run -d** except the container is never started. Use the +**podman start** *container* command to start the container at any point. + +The initial status of the container created with **podman create** is 'created'. + +Default settings for flags are defined in `containers.conf`. Most settings for +remote connections use the server's containers.conf, except when documented in +man pages. + +## IMAGE + + The image is specified using transport\:path format. If no transport is specified, the `docker` (container registry) +transport is used by default. For remote Podman, including Mac and Windows (excluding WSL2) machines, `docker` is the only allowed transport. + + **dir:**_path_ + An existing local directory _path_ storing the manifest, layer tarballs and signatures as individual files. This +is a non-standardized format, primarily useful for debugging or noninvasive container inspection. + + $ podman save --format docker-dir fedora -o /tmp/fedora + $ podman create dir:/tmp/fedora echo hello + + **docker://**_docker-reference_ (Default) + An image reference stored in a remote container image registry. Example: "quay.io/podman/stable:latest". +The reference can include a path to a specific registry; if it does not, the +registries listed in registries.conf is queried to find a matching image. +By default, credentials from `podman login` (stored at +$XDG_RUNTIME_DIR/containers/auth.json by default) is used to authenticate; +otherwise it falls back to using credentials in $HOME/.docker/config.json. + + $ podman create registry.fedoraproject.org/fedora\:latest echo hello + + **docker-archive:**_path_[**:**_docker-reference_] +An image stored in the `docker save` formatted file. _docker-reference_ is only used when creating such a +file, and it must not contain a digest. + + $ podman save --format docker-archive fedora -o /tmp/fedora + $ podman create docker-archive:/tmp/fedora echo hello + + **docker-daemon:**_docker-reference_ + An image in _docker-reference_ format stored in the docker daemon internal storage. The _docker-reference_ can also be an image ID (docker-daemon\:algo\:digest). + + $ sudo docker pull fedora + $ sudo podman create docker-daemon\:docker.io/library/fedora echo hello + + **oci-archive:**_path_**:**_tag_ + An image in a directory compliant with the "Open Container Image Layout Specification" at the specified _path_ +and specified with a _tag_. + + $ podman save --format oci-archive fedora -o /tmp/fedora + $ podman create oci-archive:/tmp/fedora echo hello + +## OPTIONS + + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the container's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + + +[//]: # (BEGIN included file options/annotation.container.md) +#### **--annotation**=*key=value* + +Add an annotation to the container. This option can be set multiple times. + +[//]: # (END included file options/annotation.container.md) + + +[//]: # (BEGIN included file options/arch.md) +#### **--arch**=*ARCH* +Override the architecture, defaults to hosts, of the image to be pulled. For example, `arm`. +Unless overridden, subsequent lookups of the same image in the local storage matches this architecture, regardless of the host. + +[//]: # (END included file options/arch.md) + + +[//]: # (BEGIN included file options/attach.md) +#### **--attach**, **-a**=*stdin* | *stdout* | *stderr* + +Attach to STDIN, STDOUT or STDERR. + +In foreground mode (the default when **-d** +is not specified), **podman run** can start the process in the container +and attach the console to the process's standard input, output, and +error. It can even pretend to be a TTY (this is what most command-line +executables expect) and pass along signals. The **-a** option can be set for +each of **stdin**, **stdout**, and **stderr**. + +[//]: # (END included file options/attach.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cap-add.md) +#### **--cap-add**=*capability* + +Add Linux capabilities. + +[//]: # (END included file options/cap-add.md) + + +[//]: # (BEGIN included file options/cap-drop.md) +#### **--cap-drop**=*capability* + +Drop Linux capabilities. + +[//]: # (END included file options/cap-drop.md) + + +[//]: # (BEGIN included file options/cgroup-conf.md) +#### **--cgroup-conf**=*KEY=VALUE* + +When running on cgroup v2, specify the cgroup file to write to and its value. For example **--cgroup-conf=memory.high=1073741824** sets the memory.high limit to 1GB. + +[//]: # (END included file options/cgroup-conf.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the container is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cgroupns.md) +#### **--cgroupns**=*mode* + +Set the cgroup namespace mode for the container. + +- **host**: use the host's cgroup namespace inside the container. +- **container:**_id_: join the namespace of the specified container. +- **private**: create a new cgroup namespace. +- **ns:**_path_: join the namespace at the specified path. + +If the host uses cgroups v1, the default is set to **host**. On cgroups v2, the default is **private**. + +[//]: # (END included file options/cgroupns.md) + + +[//]: # (BEGIN included file options/cgroups.md) +#### **--cgroups**=*how* + +Determines whether the container creates CGroups. + +Default is **enabled**. + +The **enabled** option creates a new cgroup under the cgroup-parent. +The **disabled** option forces the container to not create CGroups, and thus conflicts with CGroup options (**--cgroupns** and **--cgroup-parent**). +The **no-conmon** option disables a new CGroup only for the **conmon** process. +The **split** option splits the current CGroup in two sub-cgroups: one for conmon and one for the container payload. It is not possible to set **--cgroup-parent** with **split**. + +[//]: # (END included file options/cgroups.md) + + +[//]: # (BEGIN included file options/chrootdirs.md) +#### **--chrootdirs**=*path* + +Path to a directory inside the container that is treated as a `chroot` directory. +Any Podman managed file (e.g., /etc/resolv.conf, /etc/hosts, etc/hostname) that is mounted into the root directory is mounted into that location as well. +Multiple directories are separated with a comma. + +[//]: # (END included file options/chrootdirs.md) + + +[//]: # (BEGIN included file options/cidfile.write.md) +#### **--cidfile**=*file* + +Write the container ID to *file*. The file is removed along with the container, except +when used with podman --remote run on detached containers. + +[//]: # (END included file options/cidfile.write.md) + + +[//]: # (BEGIN included file options/conmon-pidfile.md) +#### **--conmon-pidfile**=*file* + +Write the pid of the **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to restart Podman containers. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/conmon-pidfile.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-rt-period.md) +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-period.md) + + +[//]: # (BEGIN included file options/cpu-rt-runtime.md) +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-runtime.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpus.container.md) +#### **--cpus**=*number* + +Number of CPUs. The default is *0.0* which means no limit. This is shorthand +for **--cpu-period** and **--cpu-quota**, therefore the option cannot be specified with +**--cpu-period** or **--cpu-quota**. + +On some systems, changing the CPU limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpus.container.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the container. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The container only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: if the user only has access rights via a group, accessing the device +from inside a rootless container fails. Use the `--group-add keep-groups` +flag to pass the user's supplementary group access into the container. + + +[//]: # (BEGIN included file options/device-cgroup-rule.md) +#### **--device-cgroup-rule**=*"type major\:minor mode"* + +Add a rule to the cgroup allowed devices list. The rule is expected to be +in the format specified in the Linux kernel documentation +[admin-guide/cgroup-v1/devices](https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.html): +- *type*: `a` (all), `c` (char), or `b` (block); +- *major* and *minor*: either a number, or `*` for all; +- *mode*: a composition of `r` (read), `w` (write), and `m` (mknod(2)). + +[//]: # (END included file options/device-cgroup-rule.md) + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-read-iops.md) +#### **--device-read-iops**=*path:rate* + +Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-iops.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + + +[//]: # (BEGIN included file options/device-write-iops.md) +#### **--device-write-iops**=*path:rate* + +Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-iops.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + + +[//]: # (BEGIN included file options/dns.md) +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. + +[//]: # (END included file options/dns.md) + +This option cannot be combined with **--network** that is set to **none** or **container:**_id_. + + +[//]: # (BEGIN included file options/dns-option.container.md) +#### **--dns-option**=*option* + +Set custom DNS options. Invalid if using **--dns-option** with **--network** that is set to **none** or **container:**_id_. + +[//]: # (END included file options/dns-option.container.md) + + +[//]: # (BEGIN included file options/dns-search.container.md) +#### **--dns-search**=*domain* + +Set custom DNS search domains. Invalid if using **--dns-search** with **--network** that is set to **none** or **container:**_id_. +Use **--dns-search=.** to remove the search domain. + +[//]: # (END included file options/dns-search.container.md) + + +[//]: # (BEGIN included file options/entrypoint.md) +#### **--entrypoint**=*"command"* | *'["command", "arg1", ...]'* + +Override the default ENTRYPOINT from the image. + +The ENTRYPOINT of an image is similar to a COMMAND +because it specifies what executable to run when the container starts, but it is +(purposely) more difficult to override. The ENTRYPOINT gives a container its +default nature or behavior. When the ENTRYPOINT is set, the +container runs as if it were that binary, complete with default options. More options can be +passed in via the COMMAND. But, if a user wants to run +something else inside the container, the **--entrypoint** option allows a new +ENTRYPOINT to be specified. + +Specify multi option commands in the form of a json string. + +[//]: # (END included file options/entrypoint.md) + + +[//]: # (BEGIN included file options/env.md) +#### **--env**, **-e**=*env* + +Set environment variables. + +This option allows arbitrary environment variables that are available for the process to be launched inside of the container. If an environment variable is specified without a value, Podman checks the host environment for a value and set the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the container. + +[//]: # (END included file options/env.md) + +See [**Environment**](#environment) note below for precedence and examples. + + +[//]: # (BEGIN included file options/env-file.md) +#### **--env-file**=*file* + +Read in a line-delimited file of environment variables. + +[//]: # (END included file options/env-file.md) + +See [**Environment**](#environment) note below for precedence and examples. + + +[//]: # (BEGIN included file options/env-host.md) +#### **--env-host** + +Use host environment inside of the container. See **Environment** note below for precedence. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/env-host.md) + + +[//]: # (BEGIN included file options/env-merge.md) +#### **--env-merge**=*env* + +Preprocess default environment variables for the containers. For example +if image contains environment variable `hello=world` user can preprocess +it using `--env-merge hello=${hello}-some` so new value is `hello=world-some`. + +Please note that if the environment variable `hello` is not present in the image, +then it'll be replaced by an empty string and so using `--env-merge hello=${hello}-some` +would result in the new value of `hello=-some`, notice the leading `-` delimiter. + +[//]: # (END included file options/env-merge.md) + + +[//]: # (BEGIN included file options/expose.md) +#### **--expose**=*port[/protocol]* + +Expose a port or a range of ports (e.g. **--expose=3300-3310**). +The protocol can be `tcp`, `udp` or `sctp` and if not given `tcp` is assumed. +This option matches the EXPOSE instruction for image builds and has no effect on +the actual networking rules unless **-P/--publish-all** is used to forward to all +exposed ports from random host ports. To forward specific ports from the host +into the container use the **-p/--publish** option instead. + +[//]: # (END included file options/expose.md) + + +[//]: # (BEGIN included file options/gidmap.container.md) +#### **--gidmap**=*[flags]container_uid\:from_uid[\:amount]* + +Run the container in a new user namespace using the supplied GID mapping. This +option conflicts with the **--userns** and **--subgidname** options. This +option provides a way to map host GIDs to container GIDs in the same way as +__--uidmap__ maps host UIDs to container UIDs. For details see __--uidmap__. + +Note: the **--gidmap** option cannot be called in conjunction with the **--pod** option as a gidmap cannot be set on the container level when in a pod. + +[//]: # (END included file options/gidmap.container.md) + + +[//]: # (BEGIN included file options/gpus.md) +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. + +[//]: # (END included file options/gpus.md) + + +[//]: # (BEGIN included file options/group-add.md) +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/group-add.md) + + +[//]: # (BEGIN included file options/group-entry.md) +#### **--group-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/group` file within the container when `--user` is used. + +The variables $GROUPNAME, $GID, and $USERLIST are automatically replaced with their value at runtime if present. + +[//]: # (END included file options/group-entry.md) + + +[//]: # (BEGIN included file options/health-cmd.md) +#### **--health-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set or alter a healthcheck command for a container. The command is a command to be executed inside the +container that determines the container health. The command is required for other healthcheck options +to be applied. A value of **none** disables existing healthchecks. + +Multiple options can be passed in the form of a JSON array; otherwise, the command is interpreted +as an argument to **/bin/sh -c**. + +[//]: # (END included file options/health-cmd.md) + + +[//]: # (BEGIN included file options/health-interval.md) +#### **--health-interval**=*interval* + +Set an interval for the healthchecks. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-interval.md) + + +[//]: # (BEGIN included file options/health-log-destination.md) +#### **--health-log-destination**=*directory_path* + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) (Default: local) + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. + +[//]: # (END included file options/health-log-destination.md) + + +[//]: # (BEGIN included file options/health-max-log-count.md) +#### **--health-max-log-count**=*number of stored logs* + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) (Default: 5 attempts) + +[//]: # (END included file options/health-max-log-count.md) + + +[//]: # (BEGIN included file options/health-max-log-size.md) +#### **--health-max-log-size**=*size of stored logs* + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) (Default: 500 characters) + +[//]: # (END included file options/health-max-log-size.md) + + +[//]: # (BEGIN included file options/health-on-failure.md) +#### **--health-on-failure**=*action* + +Action to take once the container transitions to an unhealthy state. The default is **none**. + +- **none**: Take no action. +- **kill**: Kill the container. +- **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. +- **stop**: Stop the container. + +[//]: # (END included file options/health-on-failure.md) + + +[//]: # (BEGIN included file options/health-retries.md) +#### **--health-retries**=*retries* + +The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is **3**. + +[//]: # (END included file options/health-retries.md) + + +[//]: # (BEGIN included file options/health-start-period.md) +#### **--health-start-period**=*period* + +The initialization time needed for a container to bootstrap. The value can be expressed in time format like +**2m3s**. The default value is **0s**. + +Note: The health check command is executed as soon as a container is started, if the health check is successful +the container's health state will be updated to `healthy`. However, if the health check fails, the health state will +stay as `starting` until either the health check is successful or until the `--health-start-period` time is over. If the +health check command fails after the `--health-start-period` time is over, the health state will be updated to `unhealthy`. +The health check command is executed periodically based on the value of `--health-interval`. + +[//]: # (END included file options/health-start-period.md) + + +[//]: # (BEGIN included file options/health-startup-cmd.md) +#### **--health-startup-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set a startup healthcheck command for a container. This command is executed inside the container and is used to gate the regular +healthcheck. When the startup command succeeds, the regular healthcheck begins and the startup healthcheck ceases. Optionally, +if the command fails for a set number of attempts, the container is restarted. A startup healthcheck can be used to ensure that +containers with an extended startup period are not marked as unhealthy until they are fully started. Startup healthchecks can only be +used when a regular healthcheck (from the container's image or the **--health-cmd** option) is also set. + +[//]: # (END included file options/health-startup-cmd.md) + + +[//]: # (BEGIN included file options/health-startup-interval.md) +#### **--health-startup-interval**=*interval* + +Set an interval for the startup healthcheck. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-startup-interval.md) + + +[//]: # (BEGIN included file options/health-startup-retries.md) +#### **--health-startup-retries**=*retries* + +The number of attempts allowed before the startup healthcheck restarts the container. If set to **0**, the container is never restarted. The default is **0**. + +[//]: # (END included file options/health-startup-retries.md) + + +[//]: # (BEGIN included file options/health-startup-success.md) +#### **--health-startup-success**=*retries* + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value +of **0** means that any success begins the regular healthcheck. The default is **0**. + +[//]: # (END included file options/health-startup-success.md) + + +[//]: # (BEGIN included file options/health-startup-timeout.md) +#### **--health-startup-timeout**=*timeout* + +The maximum time a startup healthcheck command has to complete before it is marked as failed. The value can be expressed in a time +format like **2m3s**. The default value is **30s**. + +[//]: # (END included file options/health-startup-timeout.md) + + +[//]: # (BEGIN included file options/health-timeout.md) +#### **--health-timeout**=*timeout* + +The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the +value can be expressed in a time format such as **1m22s**. The default value is **30s**. + +[//]: # (END included file options/health-timeout.md) + +#### **--help** + +Print usage statement + + +[//]: # (BEGIN included file options/hostname.container.md) +#### **--hostname**, **-h**=*name* + +Set the container's hostname inside the container. + +This option can only be used with a private UTS namespace `--uts=private` +(default). If `--pod` is given and the pod shares the same UTS namespace +(default), the pod's hostname is used. The given hostname is also added to the +`/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). + +[//]: # (END included file options/hostname.container.md) + + +[//]: # (BEGIN included file options/hosts-file.md) +#### **--hosts-file**=*path* | *none* | *image* + +Base file to create the `/etc/hosts` file inside the container. This must either +be an absolute path to a file on the host system, or one of the following +special flags: + "" Follow the `base_hosts_file` configuration in _containers.conf_ (the default) + `none` Do not use a base file (i.e. start with an empty file) + `image` Use the container image's `/etc/hosts` file as base file + +[//]: # (END included file options/hosts-file.md) + + +[//]: # (BEGIN included file options/hostuser.md) +#### **--hostuser**=*name* + +Add a user account to /etc/passwd from the host to the container. The Username +or UID must exist on the host system. + +[//]: # (END included file options/hostuser.md) + + +[//]: # (BEGIN included file options/http-proxy.md) +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. + +[//]: # (END included file options/http-proxy.md) + + +[//]: # (BEGIN included file options/image-volume.md) +#### **--image-volume**=**bind** | *tmpfs* | *ignore* + +Tells Podman how to handle the builtin image volumes. Default is **bind**. + +- **bind**: An anonymous named volume is created and mounted into the container. +- **tmpfs**: The volume is mounted onto the container as a tmpfs, which allows the users to create +content that disappears when the container is stopped. +- **ignore**: All volumes are just ignored and no action is taken. + +[//]: # (END included file options/image-volume.md) + + +[//]: # (BEGIN included file options/init.md) +#### **--init** + +Run an init inside the container that forwards signals and reaps processes. +The container-init binary is mounted at `/run/podman-init`. +Mounting over `/run` breaks container execution. + +[//]: # (END included file options/init.md) + +#### **--init-ctr**=*type* + +(Pods only). +When using pods, create an init style container, which is run after the infra container is started +but before regular pod containers are started. Init containers are useful for running +setup operations for the pod's applications. + +Valid values for `init-ctr` type are *always* or *once*. The *always* value +means the container runs with each and every `pod start`, whereas the *once* +value means the container only runs once when the pod is started and then the container is removed. + +Init containers are only run on pod `start`. Restarting a pod does not execute +any init containers. Furthermore, init containers can only be created in a +pod when that pod is not running. + + +[//]: # (BEGIN included file options/init-path.md) +#### **--init-path**=*path* + +Path to the container-init binary. + +[//]: # (END included file options/init-path.md) + + +[//]: # (BEGIN included file options/interactive.md) +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. + +[//]: # (END included file options/interactive.md) + + +[//]: # (BEGIN included file options/ip.md) +#### **--ip**=*ipv4* + +Specify a static IPv4 address for the container, for example **10.88.64.128**. +This option can only be used if the container is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IP address pool (default **10.88.0.0/16**). + +To specify multiple static IP addresses per container, set multiple networks using the **--network** option with a static IP address specified for each using the `ip` mode for that option. + +[//]: # (END included file options/ip.md) + + +[//]: # (BEGIN included file options/ip6.md) +#### **--ip6**=*ipv6* + +Specify a static IPv6 address for the container, for example **fd46\:db93\:aa76\:ac37::10**. +This option can only be used if the container is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IPv6 address pool. + +To specify multiple static IPv6 addresses per container, set multiple networks using the **--network** option with a static IPv6 address specified for each using the `ip6` mode for that option. + +[//]: # (END included file options/ip6.md) + + +[//]: # (BEGIN included file options/ipc.md) +#### **--ipc**=*ipc* + +Set the IPC namespace mode for a container. The default is to create +a private IPC namespace. + +- "": Use Podman's default, defined in containers.conf. +- **container:**_id_: reuses another container's shared memory, semaphores, and message queues +- **host**: use the host's shared memory, semaphores, and message queues inside the container. Note: the host mode gives the container full access to local shared memory and is therefore considered insecure. +- **none**: private IPC namespace, with /dev/shm not mounted. +- **ns:**_path_: path to an IPC namespace to join. +- **private**: private IPC namespace. +- **shareable**: private IPC namespace with a possibility to share it with other containers. + +[//]: # (END included file options/ipc.md) + + +[//]: # (BEGIN included file options/label.md) +#### **--label**, **-l**=*key=value* + +Add metadata to a container. + +[//]: # (END included file options/label.md) + + +[//]: # (BEGIN included file options/label-file.md) +#### **--label-file**=*file* + +Read in a line-delimited file of labels. + +[//]: # (END included file options/label-file.md) + + +[//]: # (BEGIN included file options/link-local-ip.md) +#### **--link-local-ip**=*ip* + +Not implemented. + +[//]: # (END included file options/link-local-ip.md) + + +[//]: # (BEGIN included file options/log-driver.md) +#### **--log-driver**=*driver* + +Logging driver for the container. Currently available options are **k8s-file**, **journald**, **none**, **passthrough** and **passthrough-tty**, with **json-file** aliased to **k8s-file** for scripting compatibility. (Default **journald**). + +The podman info command below displays the default log-driver for the system. +``` +$ podman info --format '{{ .Host.LogDriver }}' +journald +``` +The **passthrough** driver passes down the standard streams (stdin, stdout, stderr) to the +container. It is not allowed with the remote Podman client, including Mac and Windows (excluding WSL2) machines, and on a tty, since it is +vulnerable to attacks via TIOCSTI. + +The **passthrough-tty** driver is the same as **passthrough** except that it also allows it to be used on a TTY if the user really wants it. + +[//]: # (END included file options/log-driver.md) + + +[//]: # (BEGIN included file options/log-opt.md) +#### **--log-opt**=*name=value* + +Logging driver specific options. + +Set custom logging configuration. The following *name*s are supported: + +**path**: specify a path to the log file + (e.g. **--log-opt path=/var/log/container/mycontainer.json**); + +**max-size**: specify a max size of the log file + (e.g. **--log-opt max-size=10mb**); + +**tag**: specify a custom log tag for the container + (e.g. **--log-opt tag="{{.ImageName}}"**. +It supports the same keys as **podman inspect --format**. +This option is currently supported only by the **journald** log driver. + +[//]: # (END included file options/log-opt.md) + + +[//]: # (BEGIN included file options/mac-address.md) +#### **--mac-address**=*address* + +Container network interface MAC address (e.g. 92\:d0\:c6:0a:29:33) +This option can only be used if the container is joined to only a single network - i.e., **--network=_network-name_** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. + +Remember that the MAC address in an Ethernet network must be unique. +The IPv6 link-local address is based on the device's MAC address +according to RFC4862. + +To specify multiple static MAC addresses per container, set multiple networks using the **--network** option with a static MAC address specified for each using the `mac` mode for that option. + +[//]: # (END included file options/mac-address.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-reservation.md) +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-reservation.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/memory-swappiness.md) +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/memory-swappiness.md) + + +[//]: # (BEGIN included file options/mount.md) +#### **--mount**=*type=TYPE,TYPE-SPECIFIC-OPTION[,...]* + +Attach a filesystem mount to the container + +Current supported mount TYPEs are **bind**, **devpts**, **glob**, **image**, **ramfs**, **tmpfs** and **volume**. + +Options common to all mount types: + +- *src*, *source*: mount source spec for **bind**, **glob**, and **volume**. + Mandatory for **bind** and **glob**. + +- *dst*, *destination*, *target*: mount destination spec. + +When source globs are specified without the destination directory, +the files and directories are mounted with their complete path +within the container. When the destination is specified, the +files and directories matching the glob on the base file name +on the destination directory are mounted. The option +`type=glob,src=/foo*,destination=/tmp/bar` tells container engines +to mount host files matching /foo* to the /tmp/bar/ +directory in the container. + +Options specific to type=**volume**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *idmap*: If specified, create an idmapped mount to the target user namespace in the container. + The idmap option is only supported by Podman in rootful mode. The Linux kernel does not allow the use of idmaped file systems for unprivileged users. + The idmap option supports a custom mapping that can be different than the user namespace used by the container. + The mapping can be specified after the idmap option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the first value is the + start of the backing file system IDs that are mapped to the second value on the host. The length of this mapping is given in the third value. + Multiple ranges are separated with #. If the specified mapping is prepended with a '@' then the mapping is considered relative to the container + user namespace. The host ID for the mapping is changed to account for the relative position of the container user in the container user namespace. + +Options specific to type=**image**: + +- *rw*, *readwrite*: *true* or *false* (default if unspecified: *false*). + +- *subpath*: Mount only a specific path within the image, instead of the whole image. + +Options specific to **bind** and **glob**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *bind-propagation*: *shared*, *slave*, *private*, *unbindable*, *rshared*, *rslave*, *runbindable*, or **rprivate** (default).[[1]](#Footnote1) See also mount(2). + +- *bind-nonrecursive*: do not set up a recursive bind mount. By default it is recursive. + +- *relabel*: *shared*, *private*. + +- *idmap*: *true* or *false* (default if unspecified: *false*). If true, create an idmapped mount to the target user namespace in the container. The idmap option is only supported by Podman in rootful mode. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *no-dereference*: do not dereference symlinks but copy the link source into the mount destination. + +Options specific to type=**tmpfs** and **ramfs**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *tmpfs-size*: Size of the tmpfs/ramfs mount, in bytes. Unlimited by default in Linux. + +- *tmpfs-mode*: Octal file mode of the tmpfs/ramfs (e.g. 700 or 0700.). + +- *tmpcopyup*: Enable copyup from the image directory at the same location to the tmpfs/ramfs. Used by default. + +- *notmpcopyup*: Disable copying files from the image to the tmpfs/ramfs. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +Options specific to type=**devpts**: + +- *uid*: numeric UID of the file owner (default: 0). + +- *gid*: numeric GID of the file owner (default: 0). + +- *mode*: octal permission mask for the file (default: 600). + +- *max*: maximum number of PTYs (default: 1048576). + +Examples: + +- `type=bind,source=/path/on/host,destination=/path/in/container` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared,U=true` + +- `type=devpts,destination=/dev/pts` + +- `type=glob,src=/usr/lib/libfoo*,destination=/usr/lib,ro=true` + +- `type=image,source=fedora,destination=/fedora-image,rw=true` + +- `type=ramfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,destination=/path/in/container,noswap` + +- `type=volume,source=vol1,destination=/path/in/container,ro=true` + +[//]: # (END included file options/mount.md) + + +[//]: # (BEGIN included file options/name.container.md) +#### **--name**=*name* + +Assign a name to the container. + +The operator can identify a container in three ways: + +- UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”); +- UUID short identifier (“f78375b1c487”); +- Name (“jonah”). + +Podman generates a UUID for each container, and if no name is assigned to the +container using **--name**, Podman generates a random string name. The name can +be useful as a more human-friendly way to identify containers. This works for +both background and foreground containers. The container's name is also added +to the `/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). + +[//]: # (END included file options/name.container.md) + + +[//]: # (BEGIN included file options/network.md) +#### **--network**=*mode*, **--net** + +Set the network mode for the container. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured, to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.md) + +Invalid if using **--dns**, **--dns-option**, or **--dns-search** with **--network** set to **none** or **container:**_id_. + +If used together with **--pod**, the container does not join the pod's network namespace. + + +[//]: # (BEGIN included file options/network-alias.md) +#### **--network-alias**=*alias* + +Add a network-scoped alias for the container, setting the alias for all networks that the container joins. To set a +name only for a specific network, use the alias option as described under the **--network** option. +If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. This option can be specified multiple times. +NOTE: When using CNI a container only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. + +[//]: # (END included file options/network-alias.md) + + +[//]: # (BEGIN included file options/no-healthcheck.md) +#### **--no-healthcheck** + +Disable any defined healthchecks for container. + +[//]: # (END included file options/no-healthcheck.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the container. + +Podman assumes control over the container's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/oom-kill-disable.md) +#### **--oom-kill-disable** + +Whether to disable OOM Killer for the container or not. + +This flag is not supported on cgroups V2 systems. + +[//]: # (END included file options/oom-kill-disable.md) + + +[//]: # (BEGIN included file options/oom-score-adj.md) +#### **--oom-score-adj**=*num* + +Tune the host's OOM preferences for containers (accepts values from **-1000** to **1000**). + +When running in rootless mode, the specified value can't be lower than +the oom_score_adj for the current process. In this case, the +oom-score-adj is clamped to the current process value. + +[//]: # (END included file options/oom-score-adj.md) + + +[//]: # (BEGIN included file options/os.pull.md) +#### **--os**=*OS* + +Override the OS, defaults to hosts, of the image to be pulled. For example, `windows`. +Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. + +[//]: # (END included file options/os.pull.md) + + +[//]: # (BEGIN included file options/passwd-entry.md) +#### **--passwd-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/passwd` file within the container when `--passwd` is used. + +The variables $USERNAME, $UID, $GID, $NAME, $HOME are automatically replaced with their value at runtime. + +[//]: # (END included file options/passwd-entry.md) + + +[//]: # (BEGIN included file options/personality.md) +#### **--personality**=*persona* + +Personality sets the execution domain via Linux personality(2). + +[//]: # (END included file options/personality.md) + + +[//]: # (BEGIN included file options/pid.container.md) +#### **--pid**=*mode* + +Set the PID namespace mode for the container. +The default is to create a private PID namespace for the container. + +- **container:**_id_: join another container's PID namespace; +- **host**: use the host's PID namespace for the container. Note the host mode gives the container full access to local PID and is therefore considered insecure; +- **ns:**_path_: join the specified PID namespace; +- **private**: create a new namespace for the container (default). + +[//]: # (END included file options/pid.container.md) + + +[//]: # (BEGIN included file options/pidfile.md) +#### **--pidfile**=*path* + +When the pidfile location is specified, the container process' PID is written to the pidfile. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +If the pidfile option is not specified, the container process' PID is written to /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile. + +After the container is started, the location for the pidfile can be discovered with the following `podman inspect` command: + + $ podman inspect --format '{{ .PidFile }}' $CID + /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile + +[//]: # (END included file options/pidfile.md) + + +[//]: # (BEGIN included file options/pids-limit.md) +#### **--pids-limit**=*limit* + +Tune the container's pids limit. Set to **-1** to have unlimited pids for the container. The default is **2048** on systems that support "pids" cgroup controller. + +[//]: # (END included file options/pids-limit.md) + + +[//]: # (BEGIN included file options/platform.md) +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with --arch and --os) +The `--platform` option can be used to override the current architecture and operating system. +Unless overridden, subsequent lookups of the same image in the local storage matches this platform, regardless of the host. + +[//]: # (END included file options/platform.md) + + +[//]: # (BEGIN included file options/pod.run.md) +#### **--pod**=*name* + +Run container in an existing pod. Podman makes the pod automatically if the pod name is prefixed with **new:**. +To make a pod with more granular options, use the **podman pod create** command before creating a container. +When a container is run with a pod with an infra-container, the infra-container is started first. + +[//]: # (END included file options/pod.run.md) + + +[//]: # (BEGIN included file options/pod-id-file.container.md) +#### **--pod-id-file**=*file* + +Run container in an existing pod and read the pod's ID from the specified *file*. +When a container is run within a pod which has an infra-container, the infra-container starts first. + +[//]: # (END included file options/pod-id-file.container.md) + + +[//]: # (BEGIN included file options/privileged.md) +#### **--privileged** + +Give extended privileges to this container. The default is **false**. + +By default, Podman containers are unprivileged (**=false**) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read-only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. +Due to the disabled security features, the privileged field should almost never +be set as containers can easily break out of confinement. + +Containers running in a user namespace (e.g., rootless containers) cannot have +more privileges than the user that launched them. + +[//]: # (END included file options/privileged.md) + + +[//]: # (BEGIN included file options/publish.md) +#### **--publish**, **-p**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Publish a container's port, or range of ports, to the host. + +Both *hostPort* and *containerPort* can be specified as a range of ports. +When specifying ranges for both, the number of container ports in the +range must match the number of host ports in the range. + +If host IP is set to 0.0.0.0 or not set at all, the port is bound on all IPs on the host. + +By default, Podman publishes TCP ports. To publish a UDP port instead, give +`udp` as protocol. To publish both TCP and UDP ports, set `--publish` twice, +with `tcp`, and `udp` as protocols respectively. Rootful containers can also +publish ports using the `sctp` protocol. + +Host port does not have to be specified (e.g. `podman run -p 127.0.0.1::80`). +If it is not, the container port is randomly assigned a port on the host. + +Use **podman port** to see the actual mapping: `podman port $CONTAINER $CONTAINERPORT`. + +Note that the network drivers `macvlan` and `ipvlan` do not support port forwarding, +it will have no effect on these networks. + +[//]: # (END included file options/publish.md) + +**Note:** If a container runs within a pod, it is not necessary to publish the port for +the containers in the pod. The port must only be published by the pod itself. Pod network +stacks act like the network stack on the host - when there are a variety of containers in the pod, +and programs in the container, all sharing a single interface and IP address, and +associated ports. If one container binds to a port, no other container can use that port +within the pod while it is in use. Containers in the pod can also communicate over localhost +by having one container bind to localhost in the pod, and another connect to that port. + + +[//]: # (BEGIN included file options/publish-all.md) +#### **--publish-all**, **-P** + +Publish all exposed ports to random ports on the host interfaces. The default is **false**. + +When set to **true**, publish all exposed ports to the host interfaces. +If the operator uses **-P** (or **-p**) then Podman makes the +exposed port accessible on the host and the ports are available to any +client that can reach the host. + +When using this option, Podman binds any exposed port to a random port on the host +within an ephemeral port range defined by */proc/sys/net/ipv4/ip_local_port_range*. +To find the mapping between the host ports and the exposed ports, use **podman port**. + +[//]: # (END included file options/publish-all.md) + + +[//]: # (BEGIN included file options/pull.md) +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Pull the image only when the image is not in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error if no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. + +[//]: # (END included file options/pull.md) + +#### **--quiet**, **-q** + +Suppress output information when pulling images + + +[//]: # (BEGIN included file options/rdt-class.md) +#### **--rdt-class**=*intel-rdt-class-of-service* + +Rdt-class sets the class of service (CLOS or COS) for the container to run in. Based on the Cache Allocation Technology (CAT) feature that is part of Intel's Resource Director Technology (RDT) feature set, all container processes will run within the pre-configured COS, representing a part of the cache. The COS has to be created and configured using a pseudo file system (usually mounted at `/sys/fs/resctrl`) that the resctrl kernel driver provides. Assigning the container to a COS requires root privileges and thus doesn't work in a rootless environment. Currently, the feature is only supported using `runc` as a runtime. See for more details on creating a COS before a container can be assigned to it. + +[//]: # (END included file options/rdt-class.md) + + +[//]: # (BEGIN included file options/read-only.md) +#### **--read-only** + +Mount the container's root filesystem as read-only. + +By default, container root filesystems are writable, allowing processes +to write files anywhere. By specifying the **--read-only** flag, the containers root filesystem are mounted read-only prohibiting any writes. + +[//]: # (END included file options/read-only.md) + + +[//]: # (BEGIN included file options/read-only-tmpfs.md) +#### **--read-only-tmpfs** + +When running --read-only containers, mount a read-write tmpfs on _/dev_, _/dev/shm_, _/run_, _/tmp_, and _/var/tmp_. The default is **true**. + +| --read-only | --read-only-tmpfs | / | /run, /tmp, /var/tmp| +| ----------- | ----------------- | ---- | ----------------------------------- | +| true | true | r/o | r/w | +| true | false | r/o | r/o | +| false | false | r/w | r/w | +| false | true | r/w | r/w | + +When **--read-only=true** and **--read-only-tmpfs=true** additional tmpfs are mounted on +the /tmp, /run, and /var/tmp directories. + +When **--read-only=true** and **--read-only-tmpfs=false** /dev and /dev/shm are marked +Read/Only and no tmpfs are mounted on /tmp, /run and /var/tmp. The directories +are exposed from the underlying image, meaning they are read-only by default. +This makes the container totally read-only. No writable directories exist within +the container. In this mode writable directories need to be added via external +volumes or mounts. + +By default, when **--read-only=false**, the /dev and /dev/shm are read/write, and the /tmp, /run, and /var/tmp are read/write directories from the container image. + +[//]: # (END included file options/read-only-tmpfs.md) + + +[//]: # (BEGIN included file options/replace.md) +#### **--replace** + +If another container with the same name already exists, replace and remove it. The default is **false**. + +[//]: # (END included file options/replace.md) + + +[//]: # (BEGIN included file options/requires.md) +#### **--requires**=*container* + +Specify one or more requirements. +A requirement is a dependency container that is started before this container. +Containers can be specified by name or ID, with multiple containers being separated by commas. + +[//]: # (END included file options/requires.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + +#### **--rm** + +Automatically remove the container and any anonymous unnamed volume associated with +the container when it exits. The default is **false**. + + +[//]: # (BEGIN included file options/rootfs.md) +#### **--rootfs** + +If specified, the first argument refers to an exploded container on the file system. + +This is useful to run a container without requiring any image management, the rootfs +of the container is assumed to be managed externally. + + `Overlay Rootfs Mounts` + + The `\:O` flag tells Podman to mount the directory from the rootfs path as +storage using the `overlay file system`. The container processes +can modify content within the mount point which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +Note: On **SELinux** systems, the rootfs needs the correct label, which is by default +**unconfined_u\:object_r\:container_file_t\:s0**. + + `idmap` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. +The idmap option supports a custom mapping that can be different than the user +namespace used by the container. The mapping can be specified after the idmap +option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the +first value is the start of the backing file system IDs that are mapped to the +second value on the host. The length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/rootfs.md) + + +[//]: # (BEGIN included file options/sdnotify.md) +#### **--sdnotify**=**container** | *conmon* | *healthy* | *ignore* + +Determines how to use the NOTIFY_SOCKET, as passed with systemd and Type=notify. + +Default is **container**, which means allow the OCI runtime to proxy the socket into the +container to receive ready notification. Podman sets the MAINPID to conmon's pid. +The **conmon** option sets MAINPID to conmon's pid, and sends READY when the container +has started. The socket is never passed to the runtime or the container. +The **healthy** option sets MAINPID to conmon's pid, and sends READY when the container +has turned healthy; requires a healthcheck to be set. The socket is never passed to the runtime or the container. +The **ignore** option removes NOTIFY_SOCKET from the environment for itself and child processes, +for the case where some other process above Podman uses NOTIFY_SOCKET and Podman does not use it. + +[//]: # (END included file options/sdnotify.md) + + +[//]: # (BEGIN included file options/seccomp-policy.md) +#### **--seccomp-policy**=*policy* + +Specify the policy to select the seccomp profile. If set to *image*, Podman looks for a "io.containers.seccomp.profile" label in the container-image config and use its value as a seccomp profile. Otherwise, Podman follows the *default* policy by applying the default profile unless specified otherwise via *--security-opt seccomp* as described below. + +Note that this feature is experimental and may change in the future. + +[//]: # (END included file options/seccomp-policy.md) + + +[//]: # (BEGIN included file options/secret.md) +#### **--secret**=*secret[,opt=opt ...]* + +Give the container access to a secret. Can be specified multiple times. + +A secret is a blob of sensitive data which a container needs at runtime but +is not stored in the image or in source control, such as usernames and passwords, +TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 500 kb in size). + +When secrets are specified as type `mount`, the secrets are copied and mounted into the container when a container is created. +When secrets are specified as type `env`, the secret is set as an environment variable within the container. +Secrets are written in the container at the time of container creation, and modifying the secret using `podman secret` commands +after the container is created affects the secret inside the container. + +Secrets and its storage are managed using the `podman secret` command. + +Secret Options + +- `type=mount|env` : How the secret is exposed to the container. + `mount` mounts the secret into the container as a file. + `env` exposes the secret as an environment variable. + Defaults to `mount`. +- `target=target` : Target of secret. + For mounted secrets, this is the path to the secret inside the container. + If a fully qualified path is provided, the secret is mounted at that location. + Otherwise, the secret is mounted to + `/run/secrets/target` for linux containers or + `/var/run/secrets/target` for freebsd containers. + If the target is not set, the secret is mounted to `/run/secrets/secretname` by default. + For env secrets, this is the environment variable key. Defaults to `secretname`. +- `uid=0` : UID of secret. Defaults to 0. Mount secret type only. +- `gid=0` : GID of secret. Defaults to 0. Mount secret type only. +- `mode=0` : Mode of secret. Defaults to 0444. Mount secret type only. + + +Examples + +Mount at `/my/location/mysecret` with UID 1: +``` +--secret mysecret,target=/my/location/mysecret,uid=1 +``` + +Mount at `/run/secrets/customtarget` with mode 0777: +``` +--secret mysecret,target=customtarget,mode=0777 +``` + +Create a secret environment variable called `ENVSEC`: +``` +--secret mysecret,type=env,target=ENVSEC +``` + +[//]: # (END included file options/secret.md) + + +[//]: # (BEGIN included file options/security-opt.md) +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the container +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the container + +- **label=user:**_USER_: Set the label user for the container processes +- **label=role:**_ROLE_: Set the label role for the container processes +- **label=type:**_TYPE_: Set the label process type for the container processes +- **label=level:**_LEVEL_: Set the label level for the container processes +- **label=filetype:**_TYPE_: Set the label file type for the container files +- **label=disable**: Turn off label separation for the container + +Note: Labeling can be disabled for all containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the container. + +- **no-new-privileges**: Disable container processes from gaining additional privileges. + +- **seccomp=unconfined**: Turn off seccomp confinement for the container. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. + +[//]: # (END included file options/security-opt.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the container. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/shm-size-systemd.md) +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. + +[//]: # (END included file options/shm-size-systemd.md) + + +[//]: # (BEGIN included file options/stop-signal.md) +#### **--stop-signal**=*signal* + +Signal to stop a container. Default is **SIGTERM**. + +[//]: # (END included file options/stop-signal.md) + + +[//]: # (BEGIN included file options/stop-timeout.md) +#### **--stop-timeout**=*seconds* + +Timeout to stop a container. Default is **10**. +Remote connections use local containers.conf for defaults. + +[//]: # (END included file options/stop-timeout.md) + + +[//]: # (BEGIN included file options/subgidname.md) +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. + +[//]: # (END included file options/subgidname.md) + + +[//]: # (BEGIN included file options/subuidname.md) +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. + +[//]: # (END included file options/subuidname.md) + + +[//]: # (BEGIN included file options/sysctl.md) +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters at runtime. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: if using the **--ipc=host** option, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: if using the **--network=host** option, the above sysctls are not allowed. + +[//]: # (END included file options/sysctl.md) + + +[//]: # (BEGIN included file options/systemd.md) +#### **--systemd**=*true* | *false* | *always* + +Run container in systemd mode. The default is **true**. + +- **true** enables systemd mode only when the command executed inside the container is *systemd*, */usr/sbin/init*, +*/sbin/init* or */usr/local/sbin/init*. + +- **false** disables systemd mode. + +- **always** enforces the systemd mode to be enabled. + +Running the container in systemd mode causes the following changes: + +* Podman mounts tmpfs file systems on the following directories + * _/run_ + * _/run/lock_ + * _/tmp_ + * _/sys/fs/cgroup/systemd_ (on a cgroup v1 system) + * _/var/lib/journal_ +* Podman sets the default stop signal to **SIGRTMIN+3**. +* Podman sets **container_uuid** environment variable in the container to the +first 32 characters of the container ID. +* Podman does not mount virtual consoles (_/dev/tty\d+_) when running with **--privileged**. +* On cgroup v2, */sys/fs/cgroup* is mounted writeable. + +This allows systemd to run in a confined container without any modifications. + +Note that on **SELinux** systems, systemd attempts to write to the cgroup +file system. Containers writing to the cgroup file system are denied by default. +The **container_manage_cgroup** boolean must be enabled for this to be allowed on an SELinux separated system. +``` +setsebool -P container_manage_cgroup true +``` + +[//]: # (END included file options/systemd.md) + + +[//]: # (BEGIN included file options/timeout.md) +#### **--timeout**=*seconds* + +Maximum time a container is allowed to run before conmon sends it the kill +signal. By default containers run until they exit or are stopped by +`podman stop`. + +[//]: # (END included file options/timeout.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/tmpfs.md) +#### **--tmpfs**=*fs* + +Create a tmpfs mount. + +Mount a temporary filesystem (**tmpfs**) mount into a container, for example: + +``` +$ podman create -d --tmpfs /tmp\:rw,size=787448k,mode=1777 my_image +``` + +This command mounts a **tmpfs** at _/tmp_ within the container. The supported mount +options are the same as the Linux default mount flags. If no options are specified, +the system uses the following options: +**rw,noexec,nosuid,nodev**. + +[//]: # (END included file options/tmpfs.md) + + +[//]: # (BEGIN included file options/tty.md) +#### **--tty**, **-t** + +Allocate a pseudo-TTY. The default is **false**. + +When set to **true**, Podman allocates a pseudo-tty and attach to the standard +input of the container. This can be used, for example, to run a throwaway +interactive shell. + +**NOTE**: The --tty flag prevents redirection of standard output. It combines STDOUT and STDERR, it can insert control characters, and it can hang pipes. This option is only used when run interactively in a terminal. When feeding input to Podman, use -i only, not -it. + +[//]: # (END included file options/tty.md) + + +[//]: # (BEGIN included file options/tz.md) +#### **--tz**=*timezone* + +Set timezone in container. This flag takes area-based timezones, GMT time, as well as `local`, which sets the timezone in the container to match the host machine. See `/usr/share/zoneinfo/` for valid timezones. +Remote connections use local containers.conf for defaults + +[//]: # (END included file options/tz.md) + + +[//]: # (BEGIN included file options/uidmap.container.md) +#### **--uidmap**=*[flags]container_uid\:from_uid[\:amount]* + +Run the container in a new user namespace using the supplied UID mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +The possible values of the optional *flags* are discussed further down on this page. +The *amount* value is optional and assumed to be **1** if not given. + +The *from_uid* value is based upon the user running the command, either rootful or rootless users. + +* rootful user: [*flags*]*container_uid*:*host_uid*[:*amount*] +* rootless user: [*flags*]*container_uid*:*intermediate_uid*[:*amount*] + + `Rootful mappings` + + +When **podman create** is called by a privileged user, the option **--uidmap** +works as a direct mapping between host UIDs and container UIDs. + +host UID -> container UID + +The _amount_ specifies the number of consecutive UIDs that is mapped. +If for example _amount_ is **4** the mapping looks like: + +| host UID | container UID | +| ---------- | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | + + `Rootless mappings` + +When **podman create** is called by an unprivileged user (i.e. running rootless), +the value *from_uid* is interpreted as an "intermediate UID". In the rootless +case, host UIDs are not mapped directly to container UIDs. Instead the mapping +happens over two mapping steps: + +host UID -> intermediate UID -> container UID + +The **--uidmap** option only influences the second mapping step. + +The first mapping step is derived by Podman from the contents of the file +_/etc/subuid_ and the UID of the user calling Podman. + +First mapping step: + +| host UID | intermediate UID | +| -------- | ---------------- | +| UID for Podman user | 0 | +| 1st subordinate UID | 1 | +| 2nd subordinate UID | 2 | +| 3rd subordinate UID | 3 | +| nth subordinate UID | n | + +To be able to use intermediate UIDs greater than zero, the user needs to have +subordinate UIDs configured in _/etc/subuid_. See **subuid**(5). + +The second mapping step is configured with **--uidmap**. + +If for example _amount_ is **5** the second mapping step looks like: + +| intermediate UID | container UID | +| ------------------ | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | +| *from_uid* + 4 | *container_uid* + 4 | + +When running as rootless, Podman uses all the ranges configured in the _/etc/subuid_ file. + +The current user ID is mapped to UID=0 in the rootless user namespace. +Every additional range is added sequentially afterward: + +| host | rootless user namespace | length | +| ------ | ----------------------- | ------ | +| $UID | 0 | 1 | +| 1 | $FIRST_RANGE_ID | $FIRST_RANGE_LENGTH | +| 1+$FIRST_RANGE_LENGTH | $SECOND_RANGE_ID | $SECOND_RANGE_LENGTH| + + `Referencing a host ID from the parent namespace` + +As a rootless user, the given host ID in **--uidmap** or **--gidmap** +is mapped from the *intermediate namespace* generated by Podman. Sometimes +it is desirable to refer directly at the *host namespace*. It is possible +to manually do so, by running `podman unshare cat /proc/self/gid_map`, +finding the desired host id at the second column of the output, and getting +the corresponding intermediate id from the first column. + +Podman can perform all that by preceding the host id in the mapping +with the `@` symbol. For instance, by specifying `--gidmap 100000:@2000:1`, +podman will look up the intermediate id corresponding to host id `2000` and +it will map the found intermediate id to the container id `100000`. The +given host id must have been subordinated (otherwise it would not be mapped +into the intermediate space in the first place). + +If the length is greater than one, for instance with `--gidmap 100000:@2000:2`, +Podman will map host ids `2000` and `2001` to `100000` and `100001`, respectively, +regardless of how the intermediate mapping is defined. + + `Extending previous mappings` + +Some mapping modifications may be cumbersome. For instance, a user +starts with a mapping such as `--gidmap="0:0:65000"`, that needs to be +changed such as the parent id `1000` is mapped to container id `100000` +instead, leaving container id `1` unassigned. The corresponding `--gidmap` +becomes `--gidmap="0:0:1" --gidmap="2:2:65534" --gidmap="100000:1:1"`. + +This notation can be simplified using the `+` flag, that takes care of +breaking previous mappings removing any conflicting assignment with +the given mapping. The flag is given before the container id +as follows: `--gidmap="0:0:65000" --gidmap="+100000:1:1"` + + + Flag | Example | Description +-----------|---------------|------------- + `+` | `+100000:1:1` | Extend the previous mapping + +This notation leads to gaps in the assignment, so it may be convenient to +fill those gaps afterwards: `--gidmap="0:0:65000" --gidmap="+100000:1:1" --gidmap="1:65001:1"` + +One specific use case for this flag is in the context of rootless +users. A rootless user may specify mappings with the `+` flag as +in `--gidmap="+100000:1:1"`. Podman will then "fill the gaps" starting +from zero with all the remaining intermediate ids. This is convenient when +a user wants to map a specific intermediate id to a container id, leaving +the rest of subordinate ids to be mapped by Podman at will. + + `Passing only one of --uidmap or --gidmap` + +Usually, subordinated user and group ids are assigned simultaneously, and +for any user the subordinated user ids match the subordinated group ids. +For convenience, if only one of **--uidmap** or **--gidmap** is given, +podman assumes the mapping refers to both UIDs and GIDs and applies the +given mapping to both. If only one value of the two needs to be changed, +the mappings should include the `u` or the `g` flags to specify that +they only apply to UIDs or GIDs and should not be copied over. + + flag | Example | Description +---------|-----------------|----------------- + `u` | `u20000:2000:1` |The mapping only applies to UIDs + `g` | `g10000:1000:1` |The mapping only applies to GIDs + +For instance given the command + + podman create --gidmap "0:0:1000" --gidmap "g2000:2000:1" + +Since no **--uidmap** is given, the **--gidmap** is copied to **--uidmap**, +giving a command equivalent to + + podman create --gidmap "0:0:1000" --gidmap "2000:2000:1" --uidmap "0:0:1000" + +The `--gidmap "g2000:2000:1"` used the `g` flag and therefore it was +not copied to **--uidmap**. + + `Rootless mapping of additional host GIDs` + +A rootless user may desire to map a specific host group that has already been +subordinated within _/etc/subgid_ without specifying the rest of the mapping. + +This can be done with **--gidmap "+g*container_gid*:@*host_gid*"** + +Where: + +- The host GID is given through the `@` symbol +- The mapping of this GID is not copied over to **--usermap** thanks to the `g` flag. +- The rest of the container IDs will be mapped starting from 0 to n, + with all the remaining subordinated GIDs, thanks to the `+` flag. + +For instance, if a user belongs to the group `2000` and that group is +subordinated to that user (with `usermod --add-subgids 2000-2000 $USER`), +the user can map the group into the container with: **--gidmap=+g100000:@2000**. + +If this mapping is combined with the option, **--group-add=keep-groups**, the +process in the container will belong to group `100000`, and files belonging +to group `2000` in the host will appear as being owned by group `100000` +inside the container. + + podman run --group-add=keep-groups --gidmap="+g100000:@2000" ... + + `No subordinate UIDs` + +Even if a user does not have any subordinate UIDs in _/etc/subuid_, +**--uidmap** can be used to map the normal UID of the user to a +container UID by running `podman create --uidmap $container_uid:0:1 --user $container_uid ...`. + + `Pods` + +The **--uidmap** option cannot be called in conjunction with the **--pod** option as a uidmap cannot be set on the container level when in a pod. + +[//]: # (END included file options/uidmap.container.md) + + +[//]: # (BEGIN included file options/ulimit.md) +#### **--ulimit**=*option* + +Ulimit options. Sets the ulimits values inside of the container. + +--ulimit with a soft and hard limit in the format =[:]. For example: + +$ podman run --ulimit nofile=1024:1024 --rm ubi9 ulimit -n +1024 + +Set -1 for the soft or hard limit to set the limit to the maximum limit of the current +process. In rootful mode this is often unlimited. + + +If nofile and nproc are unset, a default value of 1048576 will be used, unless overridden +in containers.conf(5). However, if the default value exceeds the hard limit for the current +rootless user, the current hard limit will be applied instead. + +Use **host** to copy the current configuration from the host. + +Don't use nproc with the ulimit flag as Linux uses nproc to set the +maximum number of processes available to a user, not to a container. + +Use the --pids-limit option to modify the cgroup control to limit the number +of processes within a container. + +[//]: # (END included file options/ulimit.md) + + +[//]: # (BEGIN included file options/umask.md) +#### **--umask**=*umask* + +Set the umask inside the container. Defaults to `0022`. +Remote connections use local containers.conf for defaults + +[//]: # (END included file options/umask.md) + + +[//]: # (BEGIN included file options/unsetenv.md) +#### **--unsetenv**=*env* + +Unset default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. + +[//]: # (END included file options/unsetenv.md) + + +[//]: # (BEGIN included file options/unsetenv-all.md) +#### **--unsetenv-all** + +Unset all default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. + +[//]: # (END included file options/unsetenv-all.md) + + +[//]: # (BEGIN included file options/user.md) +#### **--user**, **-u**=*user[\:group]* + +Sets the username or UID used and, optionally, the groupname or GID for the specified command. Both *user* and *group* may be symbolic or numeric. + +Without this argument, the command runs as the user specified in the container image. Unless overridden by a `USER` command in the Containerfile or by a value passed to this option, this user generally defaults to root. + +When a user namespace is not in use, the UID and GID used within the container and on the host match. When user namespaces are in use, however, the UID and GID in the container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container by default corresponds to the UID and GID of the user invoking Podman. + +[//]: # (END included file options/user.md) + + +[//]: # (BEGIN included file options/userns.container.md) +#### **--userns**=*mode* + +Set the user namespace mode for the container. + +If `--userns` is not set, the default value is determined as follows. +- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used. +- If the environment variable **PODMAN_USERNS** is set its value is used. +- If `userns` is specified in `containers.conf` this value is used. +- Otherwise, `--userns=host` is assumed. + +`--userns=""` (i.e., an empty string) is an alias for `--userns=host`. + +This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +------------------------|-----------|--------------------- +auto | $UID | nil (Host User UID is not mapped into container.) +host | $UID | 0 (Default User account mapped to root user in container.) +keep-id | $UID | $UID (Map user account to same UID within container.) +keep-id\:uid=200,gid=210 | $UID | 200:210 (Map user account to specified UID, GID value within container.) +nomap | $UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + +**auto**[\:_OPTIONS,..._]: automatically create a unique user namespace. + +* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. + + Example: `containers:2147483647:2147483648`. + +* `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5). + +Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user IDs. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. + +The option `--userns=keep-id` uses all the subuids and subgids of the user. +The option `--userns=nomap` uses all the subuids and subgids of the user except the user's own ID. +Using `--userns=auto` when starting new containers does not work as long as any containers exist that were started with `--userns=nomap` or `--userns=keep-id` without limiting the user namespace size. + + Valid `auto` options: + + - *gidmapping*=_CONTAINER\_GID\:HOST\_GID\:SIZE_: to force a GID mapping to be present in the user namespace. + - *size*=_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates a size for the user namespace. + - *uidmapping*=_CONTAINER\_UID\:HOST\_UID\:SIZE_: to force a UID mapping to be present in the user namespace. + +The host UID and GID in *gidmapping* and *uidmapping* can optionally be prefixed with the `@` symbol. +In this case, podman will look up the intermediate ID corresponding to host ID and it will map the found intermediate ID to the container id. +For details see **--uidmap**. + +**container:**_id_: join the user namespace of the specified container. + +**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user. + +**keep-id**: creates a user namespace where the current user's UID\:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace. + + Valid `keep-id` options: + + - *uid*=UID: override the UID inside the container that is used to map the current user to. + - *gid*=GID: override the GID inside the container that is used to map the current user to. + - *size*=SIZE: override the size of the configured user namespace. It is useful to not saturate all the available IDs. Not supported when running as root. + +**nomap**: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +**ns:**_namespace_: run the container in the given existing user namespace. + +[//]: # (END included file options/userns.container.md) + + +[//]: # (BEGIN included file options/uts.container.md) +#### **--uts**=*mode* + +Set the UTS namespace mode for the container. The following values are supported: + +- **host**: use the host's UTS namespace inside the container. +- **private**: create a new namespace for the container (default). +- **ns:[path]**: run the container in the given existing UTS namespace. +- **container:[container]**: join the UTS namespace of the specified container. + +[//]: # (END included file options/uts.container.md) + + +[//]: # (BEGIN included file options/variant.container.md) +#### **--variant**=*VARIANT* + +Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. + +[//]: # (END included file options/variant.container.md) + + +[//]: # (BEGIN included file options/volume.md) +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the container is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +container. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a container is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the container, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the container. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system +might prevent the processes running inside the container from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the container context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +containers share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label Only the current container can use a private +volume. Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any of one the containers. Relabeling walks +the file system under the volume and changes the label on each file, if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the container. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually change with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the container. +For example if a user wanted to volume mount their entire home directory into a +container, they need to disable SELinux separation. + + $ podman create --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The container processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous container executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the container +to work. + +Do not modify the source directory mounted into the container with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the container are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the container +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +container, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +container. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the container. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the container. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless container fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/volume.md) + +Use the **--group-add keep-groups** option to pass the user's supplementary group access into the container. + + +[//]: # (BEGIN included file options/volumes-from.md) +#### **--volumes-from**=*CONTAINER[\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +container. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target container, then the volume hides +that data on the target. + +[//]: # (END included file options/volumes-from.md) + + +[//]: # (BEGIN included file options/workdir.md) +#### **--workdir**, **-w**=*dir* + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (**/**). +The image developer can set a different default with the WORKDIR instruction. The operator +can override the working directory by using the **-w** option. + +[//]: # (END included file options/workdir.md) + +## EXAMPLES + +Create a container using a local image: +``` +$ podman create alpine ls +``` + +Create a container using a local image and annotate it: +``` +$ podman create --annotation HELLO=WORLD alpine ls +``` + +Create a container using a local image, allocating a pseudo-TTY, keeping stdin open and name it myctr: +``` + podman create -t -i --name myctr alpine ls +``` + +Running a container in a new user namespace requires a mapping of +the UIDs and GIDs from the host: +``` +$ podman create --uidmap 0:30000:7000 --gidmap 0:30000:7000 fedora echo hello +``` + +Setting automatic user-namespace separated containers: +``` +# podman create --userns=auto\:size=65536 ubi8-init +``` + +Configure the timezone in a container: +``` +$ podman create --tz=local alpine date +$ podman create --tz=Asia/Shanghai alpine date +$ podman create --tz=US/Eastern alpine date +``` + +Ensure the first container (container1) is running before the second container (container2) is started: +``` +$ podman create --name container1 -t -i fedora bash +$ podman create --name container2 --requires container1 -t -i fedora bash +$ podman start --attach container2 +``` + +Create a container which requires multiple containers: +``` +$ podman create --name container1 -t -i fedora bash +$ podman create --name container2 -t -i fedora bash +$ podman create --name container3 --requires container1,container2 -t -i fedora bash +$ podman start --attach container3 +``` + +Expose shared libraries inside of container as read-only using a glob: +``` +$ podman create --mount type=glob,src=/usr/lib64/libnvidia\*,ro -i -t fedora /bin/bash +``` + +Create a container allowing supplemental groups to have access to the volume: +``` +$ podman create -v /var/lib/design:/var/lib/design --group-add keep-groups ubi8 +``` + +Configure execution domain for containers using the personality option: +``` +$ podman create --name container1 --personality=LINUX32 fedora bash +``` + +Create a container with external rootfs mounted as an overlay: +``` +$ podman create --name container1 --rootfs /path/to/rootfs:O bash +``` + +Create a container connected to two networks (called net1 and net2) with a static ip: +``` +$ podman create --network net1\:ip=10.89.1.5 --network net2:ip=10.89.10.10 alpine ip addr +``` + +### Rootless Containers + +Podman runs as a non-root user on most systems. This feature requires that a new enough version of shadow-utils +be installed. The shadow-utils package must include the newuidmap and newgidmap executables. + +In order for users to run rootless, there must be an entry for their username in /etc/subuid and /etc/subgid which lists the UIDs for their user namespace. + +Rootless Podman works better if the fuse-overlayfs and slirp4netns packages are installed. +The fuse-overlayfs package provides a userspace overlay storage driver, otherwise users need to use +the vfs storage driver, which can be disk space expensive and less performant +than other drivers. + +To enable VPN on the container, slirp4netns or pasta needs to be specified; +without either, containers need to be run with the --network=host flag. + +## ENVIRONMENT + +Environment variables within containers can be set using multiple different options: This section describes the precedence. + +Precedence order (later entries override earlier entries): + +- **--env-host** : Host environment of the process executing Podman is added. +- **--http-proxy**: By default, several environment variables are passed in from the host, such as **http_proxy** and **no_proxy**. See **--http-proxy** for details. +- Container image : Any environment variables specified in the container image. +- **--env-file** : Any environment variables specified via env-files. If multiple files specified, then they override each other in order of entry. +- **--env** : Any environment variables specified overrides previous settings. + +Create containers and set the environment ending with a __*__. +The trailing __*__ glob functionality is only active when no value is specified: + +``` +$ export ENV1=a +$ podman create --name ctr1 --env 'ENV*' alpine env +$ podman start --attach ctr1 | grep ENV +ENV1=a +$ podman create --name ctr2 --env 'ENV*=b' alpine env +$ podman start --attach ctr2 | grep ENV +ENV*=b +``` + +## CONMON + +When Podman starts a container it actually executes the conmon program, which +then executes the OCI Runtime. Conmon is the container monitor. It is a small +program whose job is to watch the primary process of the container, and if the +container dies, save the exit code. It also holds open the tty of the +container, so that it can be attached to later. This is what allows Podman to +run in detached mode (backgrounded), so Podman can exit but conmon continues to +run. Each container has their own instance of conmon. Conmon waits for the +container to exit, gathers and saves the exit code, and then launches a Podman +process to complete the container cleanup, by shutting down the network and +storage. For more information about conmon, see the conmon(8) man +page. + +## FILES + +**/etc/subuid** +**/etc/subgid** + +NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-save(1)](podman-save.1.md)**, **[podman-ps(1)](podman-ps.1.md)**, **[podman-attach(1)](podman-attach.1.md)**, **[podman-pod-create(1)](podman-pod-create.1.md)**, **[podman-port(1)](podman-port.1.md)**, **[podman-start(1)](podman-start.1.md)**, **[podman-kill(1)](podman-kill.1.md)**, **[podman-stop(1)](podman-stop.1.md)**, **[podman-generate-systemd(1)](podman-generate-systemd.1.md)**, **[podman-rm(1)](podman-rm.1.md)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)**, **[setsebool(8)](https://man7.org/linux/man-pages/man8/setsebool.8.html)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, **[pasta(1)](https://passt.top/builds/latest/web/passt.1.html)**, **[fuse-overlayfs(1)](https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md)**, **proc(5)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)**, **personality(2)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +See [podman-rootless(7)](https://github.com/containers/podman/blob/main/rootless.md) +for rootless issues. + +## HISTORY +October 2017, converted from Docker documentation to Podman by Dan Walsh for Podman `` + +November 2014, updated by Sven Dowideit `` + +September 2014, updated by Sven Dowideit `` + +August 2014, updated by Sven Dowideit `` + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a core value of open source. The `master` and `slave` mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately. diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-diff.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-diff.1.md new file mode 100644 index 000000000..b834355c6 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-diff.1.md @@ -0,0 +1,75 @@ +--- +title: podman-diff +version: v5.4.1 +--- + +% podman-diff 1 + +## NAME +podman\-diff - Inspect changes on a container or image's filesystem + +## SYNOPSIS +**podman diff** [*options*] *container|image* [*container|image*] + +## DESCRIPTION +Displays changes on a container or image's filesystem. The container or image is compared to its parent layer or the second argument when given. + +The output is prefixed with the following symbols: + +| Symbol | Description | +|--------|-------------| +| A | A file or directory was added. | +| D | A file or directory was deleted. | +| C | A file or directory was changed. | + +## OPTIONS + +#### **--format** + +Alter the output into a different format. The only valid format for **podman diff** is `json`. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Show container-modified files versus the container's image: +``` +$ podman diff container1 +A /myscript.sh +``` + +Show container-modified files versus the container's image in JSON format: +``` +$ podman diff --format json myimage +{ + "changed": [ + "/usr", + "/usr/local", + "/usr/local/bin" + ], + "added": [ + "/usr/local/bin/docker-entrypoint.sh" + ] +} +``` + +Show the difference between the specified container and the image: +``` +$ podman diff container1 image1 +A /test +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container-diff(1)](podman-container-diff.1.md)**, **[podman-image-diff(1)](podman-image-diff.1.md)** + +## HISTORY +August 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-events.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-events.1.md new file mode 100644 index 000000000..9e34ee90c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-events.1.md @@ -0,0 +1,222 @@ +--- +title: podman-events +version: v5.4.1 +--- + +% podman-events 1 + +## NAME +podman\-events - Monitor Podman events + +## SYNOPSIS +**podman events** [*options*] + +**podman system events** [*options*] + +## DESCRIPTION + +Monitor and print events that occur in Podman. Each event includes a timestamp, +a type, a status, name (if applicable), and image (if applicable). The default logging +mechanism is *journald*. This can be changed in containers.conf by changing the `events_logger` +value to `file`. Only `file` and `journald` are accepted. A `none` logger is also +available, but this logging mechanism completely disables events; nothing is reported by +`podman events`. + +By default, streaming mode is used, printing new events as they occur. Previous events can be listed via `--since` and `--until`. + +The *container* event type reports the follow statuses: + * attach + * checkpoint + * cleanup + * commit + * connect + * create + * died + * disconnect + * exec + * exec_died + * exited + * export + * import + * init + * kill + * mount + * pause + * prune + * remove + * rename + * restart + * restore + * start + * stop + * sync + * unmount + * unpause + * update + +The *pod* event type reports the follow statuses: + * create + * kill + * pause + * remove + * start + * stop + * unpause + +The *image* event type reports the following statuses: + * loadFromArchive, + * mount + * pull + * pull-error + * push + * remove + * save + * tag + * unmount + * untag + +The *system* type reports the following statuses: + * refresh + * renumber + +The *volume* type reports the following statuses: + * create + * prune + * remove + +#### Verbose Create Events + +Setting `events_container_create_inspect_data=true` in containers.conf(5) instructs Podman to create more verbose container-create events which include a JSON payload with detailed information about the containers. The JSON payload is identical to the one of podman-container-inspect(1). The associated field in journald is named `PODMAN_CONTAINER_INSPECT_DATA`. + +## OPTIONS + +#### **--filter**, **-f**=*filter* + +Filter events that are displayed. They must be in the format of "filter=value". The following +filters are supported: + +| **Filter** | **Description** | +|------------|-------------------------------------| +| container | [Name or ID] Container's name or ID | +| event | event_status (described above) | +| image | [Name or ID] Image name or ID | +| label | [key=value] label | +| pod | [Name or ID] Pod name or ID | +| volume | [Name or ID] Volume name or ID | +| type | Event_type (described above) | + +In the case where an ID is used, the ID may be in its full or shortened form. The "die" event is mapped to "died" for Docker compatibility. + +#### **--format** + +Format the output to JSON Lines or using the given Go template. + +| **Placeholder** | **Description** | +| --------------------- | -------------------------------------------------------------------- | +| .Attributes ... | created_at, _by, labels, and more (map[]) | +| .ContainerExitCode | Exit code (int) | +| .ContainerInspectData | Payload of the container's inspect | +| .Error | Error message in case the event status is an error (e.g. pull-error) | +| .HealthStatus | Health Status (string) | +| .ID | Container ID (full 64-bit SHA) | +| .Image | Name of image being run (string) | +| .Name | Container name (string) | +| .Network | Name of network being used (string) | +| .PodID | ID of pod associated with container, if any | +| .Status | Event status (e.g., create, start, died, ...) | +| .Time | Event timestamp (string) | +| .TimeNano | Event timestamp with nanosecond precision (int64) | +| .Type | Event type (e.g., image, container, pod, ...) | + +#### **--help** + +Print usage statement. + +#### **--no-trunc** + +Do not truncate the output (default *true*). + +#### **--since**=*timestamp* + +Show all events created since the given timestamp + +#### **--stream** + +Stream events and do not exit after reading the last known event (default *true*). + +#### **--until**=*timestamp* + +Show all events created until the given timestamp + +The *since* and *until* values can be RFC3339Nano time stamps or a Go duration string such as 10m, 5h. If no +*since* or *until* values are provided, only new events are shown. + +## JOURNALD IDENTIFIERS + +The journald events-backend of Podman uses the following journald identifiers. You can use the identifiers to filter Podman events directly with `journalctl`. + +| **Identifier** | **Description** | +|-------------------------------|---------------------------------------------------------| +| SYSLOG_IDENTIFIER | Always set to "podman" | +| PODMAN_EVENT | The event status as described above | +| PODMAN_TYPE | The event type as described above | +| PODMAN_TIME | The time stamp when the event was written | +| PODMAN_NAME | Name of the event object (e.g., container, image) | +| PODMAN_ID | ID of the event object (e.g., container, image) | +| PODMAN_EXIT_CODE | Exit code of the container | +| PODMAN_POD_ID | Pod ID of the container | +| PODMAN_LABELS | Labels of the container | +| PODMAN_HEALTH_STATUS | Health status of the container | +| PODMAN_CONTAINER_INSPECT_DATA | The JSON payload of `podman-inspect` as described above | +| PODMAN_NETWORK_NAME | The name of the network | + +## EXAMPLES + +Show Podman events: +``` +$ podman events +2019-03-02 10:33:42.312377447 -0600 CST container create 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +2019-03-02 10:33:46.958768077 -0600 CST container init 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +2019-03-02 10:33:46.973661968 -0600 CST container start 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +2019-03-02 10:33:50.833761479 -0600 CST container stop 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +2019-03-02 10:33:51.047104966 -0600 CST container cleanup 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +``` + +Show only Podman container create events: +``` +$ podman events -f event=create +2019-03-02 10:36:01.375685062 -0600 CST container create 20dc581f6fbf (image=docker.io/library/alpine:latest, name=sharp_morse) +2019-03-02 10:36:08.561188337 -0600 CST container create 58e7e002344c (image=registry.k8s.io/pause:3.1, name=3e701f270d54-infra) +2019-03-02 10:36:13.146899437 -0600 CST volume create cad6dc50e087 (image=, name=cad6dc50e0879568e7d656bd004bd343d6035e7fc4024e1711506fe2fd459e6f) +2019-03-02 10:36:29.978806894 -0600 CST container create d81e30f1310f (image=docker.io/library/busybox:latest, name=musing_newton) +``` + +Show only Podman pod create events: +``` +$ podman events --filter event=create --filter type=pod +2019-03-02 10:44:29.601746633 -0600 CST pod create 1df5ebca7b44 (image=, name=confident_hawking) +2019-03-02 10:44:42.374637304 -0600 CST pod create ca731231718e (image=, name=webapp) +2019-03-02 10:44:47.486759133 -0600 CST pod create 71e807fc3a8e (image=, name=reverent_swanson) +``` + +Show only Podman events created in the last five minutes: +``` +$ sudo podman events --since 5m +2019-03-02 10:44:29.598835409 -0600 CST container create b629d10d3831 (image=registry.k8s.io/pause:3.1, name=1df5ebca7b44-infra) +2019-03-02 10:44:29.601746633 -0600 CST pod create 1df5ebca7b44 (image=, name=confident_hawking) +2019-03-02 10:44:42.371100253 -0600 CST container create 170a0f457d00 (image=registry.k8s.io/pause:3.1, name=ca731231718e-infra) +2019-03-02 10:44:42.374637304 -0600 CST pod create ca731231718e (image=, name=webapp) +``` + +Show Podman events in JSON Lines format: +``` +$ podman events --format json +{"ID":"683b0909d556a9c02fa8cd2b61c3531a965db42158627622d1a67b391964d519","Image":"localhost/myshdemo:latest","Name":"agitated_diffie","Status":"cleanup","Time":"2019-04-27T22:47:00.849932843-04:00","Type":"container"} +{"ID":"a0f8ab051bfd43f9c5141a8a2502139707e4b38d98ac0872e57c5315381e88ad","Image":"docker.io/library/alpine:latest","Name":"friendly_tereshkova","Status":"unmount","Time":"2019-04-28T13:43:38.063017276-04:00","Type":"container"} +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +## HISTORY +March 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-exec.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-exec.1.md new file mode 100644 index 000000000..9f86e32e0 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-exec.1.md @@ -0,0 +1,208 @@ +--- +title: podman-exec +version: v5.4.1 +--- + +% podman-exec 1 + +## NAME +podman\-exec - Execute a command in a running container + +## SYNOPSIS +**podman exec** [*options*] *container* *command* [*arg* ...] + +**podman container exec** [*options*] *container* *command* [*arg* ...] + +## DESCRIPTION +**podman exec** executes a command in a running container. + +## OPTIONS + +#### **--detach**, **-d** + +Start the exec session, but do not attach to it. The command runs in the background, and the exec session is automatically removed when it completes. The **podman exec** command prints the ID of the exec session and exits immediately after it starts. + + +[//]: # (BEGIN included file options/detach-keys.md) +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. + +[//]: # (END included file options/detach-keys.md) + + +[//]: # (BEGIN included file options/env.md) +#### **--env**, **-e**=*env* + +Set environment variables. + +This option allows arbitrary environment variables that are available for the process to be launched inside of the container. If an environment variable is specified without a value, Podman checks the host environment for a value and set the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the container. + +[//]: # (END included file options/env.md) + + +[//]: # (BEGIN included file options/env-file.md) +#### **--env-file**=*file* + +Read in a line-delimited file of environment variables. + +[//]: # (END included file options/env-file.md) + + +[//]: # (BEGIN included file options/interactive.md) +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. + +[//]: # (END included file options/interactive.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/preserve-fd.md) +#### **--preserve-fd**=*FD1[,FD2,...]* + +Pass down to the process the additional file descriptors specified in the comma separated list. It can be specified multiple times. +This option is only supported with the crun OCI runtime. It might be a security risk to use this option with other OCI runtimes. + +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/preserve-fd.md) + + +[//]: # (BEGIN included file options/preserve-fds.md) +#### **--preserve-fds**=*N* + +Pass down to the process N additional file descriptors (in addition to 0, 1, 2). +The total FDs are 3+N. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/preserve-fds.md) + + +[//]: # (BEGIN included file options/privileged.md) +#### **--privileged** + +Give extended privileges to this container. The default is **false**. + +By default, Podman containers are unprivileged (**=false**) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read-only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. +Due to the disabled security features, the privileged field should almost never +be set as containers can easily break out of confinement. + +Containers running in a user namespace (e.g., rootless containers) cannot have +more privileges than the user that launched them. + +[//]: # (END included file options/privileged.md) + + +[//]: # (BEGIN included file options/tty.md) +#### **--tty**, **-t** + +Allocate a pseudo-TTY. The default is **false**. + +When set to **true**, Podman allocates a pseudo-tty and attach to the standard +input of the container. This can be used, for example, to run a throwaway +interactive shell. + +**NOTE**: The --tty flag prevents redirection of standard output. It combines STDOUT and STDERR, it can insert control characters, and it can hang pipes. This option is only used when run interactively in a terminal. When feeding input to Podman, use -i only, not -it. + +[//]: # (END included file options/tty.md) + + +[//]: # (BEGIN included file options/user.md) +#### **--user**, **-u**=*user[:group]* + +Sets the username or UID used and, optionally, the groupname or GID for the specified command. Both *user* and *group* may be symbolic or numeric. + +Without this argument, the command runs as the user specified in the container image. Unless overridden by a `USER` command in the Containerfile or by a value passed to this option, this user generally defaults to root. + +When a user namespace is not in use, the UID and GID used within the container and on the host match. When user namespaces are in use, however, the UID and GID in the container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container by default corresponds to the UID and GID of the user invoking Podman. + +[//]: # (END included file options/user.md) + + +[//]: # (BEGIN included file options/workdir.md) +#### **--workdir**, **-w**=*dir* + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (**/**). +The image developer can set a different default with the WORKDIR instruction. The operator +can override the working directory by using the **-w** option. + +[//]: # (END included file options/workdir.md) + +## Exit Status + +The exit code from `podman exec` gives information about why the command within the container failed to run or why it exited. When `podman exec` exits with a +non-zero code, the exit codes follow the `chroot` standard, see below: + + **125** The error is with Podman itself + + $ podman exec --foo ctrID /bin/sh; echo $? + Error: unknown flag: --foo + 125 + + **126** The _contained command_ cannot be invoked + + $ podman exec ctrID /etc; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error + 126 + + **127** The _contained command_ cannot be found + + $ podman exec ctrID foo; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error + 127 + + **Exit code** The _contained command_ exit code + + $ podman exec ctrID /bin/sh -c 'exit 3'; echo $? + 3 + +## EXAMPLES + +Execute command in selected container with a stdin and a tty allocated: +``` +$ podman exec -it ctrID ls +``` + +Execute command with the overridden working directory in selected container with a stdin and a tty allocated: +``` +$ podman exec -it -w /tmp myCtr pwd +``` + +Execute command as the specified user in selected container: +``` +$ podman exec --user root ctrID ls +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)** + +## HISTORY +December 2017, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-export.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-export.1.md new file mode 100644 index 000000000..a39cea901 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-export.1.md @@ -0,0 +1,56 @@ +--- +title: podman-export +version: v5.4.1 +--- + +% podman-export 1 + +## NAME +podman\-export - Export a container's filesystem contents as a tar archive + +## SYNOPSIS +**podman export** [*options*] *container* + +**podman container export** [*options*] *container* + +## DESCRIPTION +**podman export** exports the filesystem of a container and saves it as a tarball +on the local machine. **podman export** writes to STDOUT by default and can be +redirected to a file using the `--output` flag. +The image of the container exported by **podman export** can be imported by **podman import**. +To export image(s) with parent layers, use **podman save**. +Note: `:` is a restricted character and cannot be part of the file name. + +**podman [GLOBAL OPTIONS]** + +**podman export [GLOBAL OPTIONS]** + +**podman export [OPTIONS] CONTAINER** + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--output**, **-o** + +Write to a file, default is STDOUT + +## EXAMPLES + +Export container into specified tar ball: +``` +$ podman export -o redis-container.tar 883504668ec465463bc0fe7e63d53154ac3b696ea8d7b233748918664ea90e57 +``` + +Export container to stdout: +``` +$ podman export 883504668ec465463bc0fe7e63d53154ac3b696ea8d7b233748918664ea90e57 > redis-container.tar +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-import(1)](podman-import.1.md)** + +## HISTORY +August 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-farm-build.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-farm-build.1.md new file mode 100644 index 000000000..76643052e --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-farm-build.1.md @@ -0,0 +1,1564 @@ +--- +title: podman-farm-build +version: v5.4.1 +--- + +% podman-farm-build 1 + +## NAME +podman\-farm\-build - Build images on farm nodes, then bundle them into a manifest list + +## SYNOPSIS +**podman farm build** [*options*] [*context*] + +## DESCRIPTION +**podman farm build** Builds an image on all nodes in a farm and bundles them up into a manifest list. +It executes the `podman build` command on the nodes in the farm with the given Containerfile. Once the +images are built on all the farm nodes, the images will be pushed to the registry given via the **--tag** +flag. Once all the images have been pushed, a manifest list will be created locally and pushed to the registry +as well. + +The manifest list will contain an image per native architecture type that is present in the farm. + +The primary function of this command is to create multi-architecture builds that will be faster than doing it +via emulation using `podman build --arch --platform`. + +If no farm is specified, the build will be sent out to all the nodes that `podman system connection` knows of. + +Note: Since the images built are directly pushed to a registry, the user must pass in a full image name using the +**--tag** option in the format _registry_**/**_repository_**/**_imageName_[**:**_tag_]`. + +## OPTIONS + + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the container's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + + +[//]: # (BEGIN included file options/annotation.image.md) +#### **--annotation**=*annotation=value* + +Add an image *annotation* (e.g. annotation=*value*) to the image metadata. Can +be used multiple times. + +Note: this information is not present in Docker image formats, so it is +discarded when writing images in Docker formats. + +[//]: # (END included file options/annotation.image.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/build-arg.md) +#### **--build-arg**=*arg=value* + +Specifies a build argument and its value, which is interpolated in +instructions read from the Containerfiles in the same way that environment variables are, but which are not added to environment variable list in the resulting image's configuration. + +[//]: # (END included file options/build-arg.md) + + +[//]: # (BEGIN included file options/build-arg-file.md) +#### **--build-arg-file**=*path* + +Specifies a file containing lines of build arguments of the form `arg=value`. +The suggested file name is `argfile.conf`. + +Comment lines beginning with `#` are ignored, along with blank lines. +All others must be of the `arg=value` format passed to `--build-arg`. + +If several arguments are provided via the `--build-arg-file` +and `--build-arg` options, the build arguments are merged across all +of the provided files and command line arguments. + +Any file provided in a `--build-arg-file` option is read before +the arguments supplied via the `--build-arg` option. + +When a given argument name is specified several times, the last instance +is the one that is passed to the resulting builds. This means `--build-arg` +values always override those in a `--build-arg-file`. + +[//]: # (END included file options/build-arg-file.md) + + +[//]: # (BEGIN included file options/build-context.md) +#### **--build-context**=*name=value* + +Specify an additional build context using its short name and its location. +Additional build contexts can be referenced in the same manner as we access +different stages in COPY instruction. + +Valid values are: + +* Local directory – e.g. --build-context project2=../path/to/project2/src (This option is not available with the remote Podman client. On Podman machine setup (i.e macOS and Windows) path must exists on the machine VM) +* HTTP URL to a tarball – e.g. --build-context src=https://example.org/releases/src.tar +* Container image – specified with a container-image:// prefix, e.g. --build-context alpine=container-image://alpine:3.15, (also accepts docker://, docker-image://) + +On the Containerfile side, reference the build context on all +commands that accept the “from” parameter. Here’s how that might look: + +```dockerfile +FROM [name] +COPY --from=[name] ... +RUN --mount=from=[name] … +``` + +The value of [name] is matched with the following priority order: + +* Named build context defined with --build-context [name]=.. +* Stage defined with AS [name] inside Containerfile +* Image [name], either local or in a remote registry + +[//]: # (END included file options/build-context.md) + + +[//]: # (BEGIN included file options/cache-from.md) +#### **--cache-from**=*image* + +Repository to utilize as a potential cache source. When specified, Buildah tries to look for +cache images in the specified repository and attempts to pull cache images instead of actually +executing the build steps locally. Buildah only attempts to pull previously cached images if they +are considered as valid cache hits. + +Use the `--cache-to` option to populate a remote repository with cache content. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-from` option is ignored unless `--layers` is specified. + +[//]: # (END included file options/cache-from.md) + + +[//]: # (BEGIN included file options/cache-to.md) +#### **--cache-to**=*image* + +Set this flag to specify a remote repository that is used to store cache images. Buildah attempts to +push newly built cache image to the remote repository. + +Note: Use the `--cache-from` option in order to use cache content in a remote repository. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-to` option is ignored unless `--layers` is specified. + +[//]: # (END included file options/cache-to.md) + + +[//]: # (BEGIN included file options/cache-ttl.md) +#### **--cache-ttl** + +Limit the use of cached images to only consider images with created timestamps less than *duration* ago. +For example if `--cache-ttl=1h` is specified, Buildah considers intermediate cache images which are created +under the duration of one hour, and intermediate cache images outside this duration is ignored. + +Note: Setting `--cache-ttl=0` manually is equivalent to using `--no-cache` in the +implementation since this means that the user does not want to use cache at all. + +[//]: # (END included file options/cache-ttl.md) + + +[//]: # (BEGIN included file options/cap-add.image.md) +#### **--cap-add**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability added to its capability set. +Certain capabilities are granted by default; this option can be used to add +more. + +[//]: # (END included file options/cap-add.image.md) + + +[//]: # (BEGIN included file options/cap-drop.image.md) +#### **--cap-drop**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability removed from its capability set. +The CAP\_CHOWN, CAP\_DAC\_OVERRIDE, CAP\_FOWNER, +CAP\_FSETID, CAP\_KILL, CAP\_NET\_BIND\_SERVICE, CAP\_SETFCAP, +CAP\_SETGID, CAP\_SETPCAP, and CAP\_SETUID capabilities are +granted by default; this option can be used to remove them. + +If a capability is specified to both the **--cap-add** and **--cap-drop** +options, it is dropped, regardless of the order in which the options were +given. + +[//]: # (END included file options/cap-drop.image.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the container is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cgroupns.image.md) +#### **--cgroupns**=*how* + +Sets the configuration for cgroup namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "private" to indicate +that a new cgroup namespace is created, or it can be "host" to indicate +that the cgroup namespace in which `buildah` itself is being run is reused. + +[//]: # (END included file options/cgroupns.image.md) + +#### **--cleanup** + +Remove built images from farm nodes on success (Default: false). + + +[//]: # (BEGIN included file options/compat-volumes.md) +#### **--compat-volumes** + +Handle directories marked using the VOLUME instruction (both in this build, and +those inherited from base images) such that their contents can only be modified +by ADD and COPY instructions. Any changes made in those locations by RUN +instructions will be reverted. Before the introduction of this option, this +behavior was the default, but it is now disabled by default. + +[//]: # (END included file options/compat-volumes.md) + + +[//]: # (BEGIN included file options/cpp-flag.md) +#### **--cpp-flag**=*flags* + +Set additional flags to pass to the C Preprocessor cpp(1). Containerfiles ending with a ".in" suffix is preprocessed via cpp(1). This option can be used to pass additional flags to cpp.Note: You can also set default CPPFLAGS by setting the BUILDAH_CPPFLAGS environment variable (e.g., export BUILDAH_CPPFLAGS="-DDEBUG"). + +[//]: # (END included file options/cpp-flag.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the container. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The container only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: if the user only has access rights via a group, accessing the device +from inside a rootless container fails. The **[crun(1)](https://github.com/containers/crun/tree/main/crun.1.md)** runtime offers a +workaround for this by adding the option +**--annotation run.oci.keep_original_groups=1**. + + +[//]: # (BEGIN included file options/disable-compression.md) +#### **--disable-compression**, **-D** + +Don't compress filesystem layers when building the image unless it is required +by the location where the image is being written. This is the default setting, +because image layers are compressed automatically when they are pushed to +registries, and images being written to local storage only need to be +decompressed again to be stored. Compression can be forced in all cases by +specifying **--disable-compression=false**. + +[//]: # (END included file options/disable-compression.md) + + +[//]: # (BEGIN included file options/dns.md) +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. + +[//]: # (END included file options/dns.md) + +This option cannot be combined with **--network** that is set to **none**. + +Note: this option takes effect only during *RUN* instructions in the build. +It does not affect _/etc/resolv.conf_ in the final image. + + +[//]: # (BEGIN included file options/dns-option.image.md) +#### **--dns-option**=*option* + +Set custom DNS options to be used during the build. + +[//]: # (END included file options/dns-option.image.md) + + +[//]: # (BEGIN included file options/dns-search.image.md) +#### **--dns-search**=*domain* + +Set custom DNS search domains to be used during the build. + +[//]: # (END included file options/dns-search.image.md) + + +[//]: # (BEGIN included file options/env.image.md) +#### **--env**=*env[=value]* + +Add a value (e.g. env=*value*) to the built image. Can be used multiple times. +If neither `=` nor a *value* are specified, but *env* is set in the current +environment, the value from the current environment is added to the image. +To remove an environment variable from the built image, use the `--unsetenv` +option. + +[//]: # (END included file options/env.image.md) + + +[//]: # (BEGIN included file options/farm.md) +#### **--farm** + +This option specifies the name of the farm to be used in the build process. + +[//]: # (END included file options/farm.md) + +This option specifies the name of the farm to be used in the build process. + + +[//]: # (BEGIN included file options/file.md) +#### **--file**, **-f**=*Containerfile* + +Specifies a Containerfile which contains instructions for building the image, +either a local file or an **http** or **https** URL. If more than one +Containerfile is specified, *FROM* instructions are only be accepted from the +last specified file. + +If a build context is not specified, and at least one Containerfile is a +local file, the directory in which it resides is used as the build +context. + +Specifying the option `-f -` causes the Containerfile contents to be read from stdin. + +[//]: # (END included file options/file.md) + + +[//]: # (BEGIN included file options/force-rm.md) +#### **--force-rm** + +Always remove intermediate containers after a build, even if the build fails (default true). + +[//]: # (END included file options/force-rm.md) + + +[//]: # (BEGIN included file options/format.md) +#### **--format** + +Control the format for the built image's manifest and configuration data. +Recognized formats include *oci* (OCI image-spec v1.0, the default) and +*docker* (version 2, using schema format 2 for the manifest). + +Note: You can also override the default format by setting the BUILDAH\_FORMAT +environment variable. `export BUILDAH_FORMAT=docker` + +[//]: # (END included file options/format.md) + + +[//]: # (BEGIN included file options/from.md) +#### **--from** + +Overrides the first `FROM` instruction within the Containerfile. If there are multiple +FROM instructions in a Containerfile, only the first is changed. + +With the remote podman client, not all container transports work as +expected. For example, oci-archive:/x.tar references /x.tar on the remote +machine instead of on the client. When using podman remote clients it is +best to restrict use to *containers-storage*, and *docker:// transports*. + +[//]: # (END included file options/from.md) + + +[//]: # (BEGIN included file options/group-add.md) +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/group-add.md) + + +[//]: # (BEGIN included file options/help.md) +#### **--help**, **-h** + +Print usage statement + +[//]: # (END included file options/help.md) + + +[//]: # (BEGIN included file options/hooks-dir.md) +#### **--hooks-dir**=*path* + +Each *.json file in the path configures a hook for buildah build containers. For more details on the syntax of the JSON files and the semantics of hook injection. Buildah currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. + +This option may be set multiple times; paths from later options have higher precedence. + +For the annotation conditions, buildah uses any annotations set in the generated OCI configuration. + +For the bind-mount conditions, only mounts explicitly requested by the caller via --volume are considered. Bind mounts that buildah inserts by default (e.g. /dev/shm) are not considered. + +If --hooks-dir is unset for root callers, Buildah currently defaults to /usr/share/containers/oci/hooks.d and /etc/containers/oci/hooks.d in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting --hooks-dir. + +[//]: # (END included file options/hooks-dir.md) + + +[//]: # (BEGIN included file options/http-proxy.md) +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. + +[//]: # (END included file options/http-proxy.md) + + +[//]: # (BEGIN included file options/identity-label.md) +#### **--identity-label** + +Adds default identity label `io.buildah.version` if set. (default true). + +[//]: # (END included file options/identity-label.md) + + +[//]: # (BEGIN included file options/ignorefile.md) +#### **--ignorefile** + +Path to an alternative .containerignore file. + +[//]: # (END included file options/ignorefile.md) + + +[//]: # (BEGIN included file options/iidfile.md) +#### **--iidfile**=*ImageIDfile* + +Write the built image's ID to the file. When `--platform` is specified more than once, attempting to use this option triggers an error. + +[//]: # (END included file options/iidfile.md) + + +[//]: # (BEGIN included file options/ipc.image.md) +#### **--ipc**=*how* + +Sets the configuration for IPC namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate +that a new IPC namespace is created, or it can be "host" to indicate +that the IPC namespace in which `podman` itself is being run is reused, +or it can be the path to an IPC namespace which is already in use by +another process. + +[//]: # (END included file options/ipc.image.md) + + +[//]: # (BEGIN included file options/isolation.md) +#### **--isolation**=*type* + +Controls what type of isolation is used for running processes as part of `RUN` +instructions. Recognized types include *oci* (OCI-compatible runtime, the +default), *rootless* (OCI-compatible runtime invoked using a modified +configuration and its --rootless option enabled, with *--no-new-keyring +--no-pivot* added to its *create* invocation, with network and UTS namespaces +disabled, and IPC, PID, and user namespaces enabled; the default for +unprivileged users), and *chroot* (an internal wrapper that leans more toward +chroot(1) than container technology). + +Note: You can also override the default isolation type by setting the +BUILDAH\_ISOLATION environment variable. `export BUILDAH_ISOLATION=oci` + +[//]: # (END included file options/isolation.md) + + +[//]: # (BEGIN included file options/jobs.md) +#### **--jobs**=*number* + +Run up to N concurrent stages in parallel. If the number of jobs is greater +than 1, stdin is read from /dev/null. If 0 is specified, then there is +no limit in the number of jobs that run in parallel. + +[//]: # (END included file options/jobs.md) + + +[//]: # (BEGIN included file options/label.image.md) +#### **--label**=*label* + +Add an image *label* (e.g. label=*value*) to the image metadata. Can be used +multiple times. + +Users can set a special LABEL **io.containers.capabilities=CAP1,CAP2,CAP3** in +a Containerfile that specifies the list of Linux capabilities required for the +container to run properly. This label specified in a container image tells +Podman to run the container with just these capabilities. Podman launches the +container with just the specified capabilities, as long as this list of +capabilities is a subset of the default list. + +If the specified capabilities are not in the default set, Podman prints an error +message and runs the container with the default capabilities. + +[//]: # (END included file options/label.image.md) + + +[//]: # (BEGIN included file options/layer-label.md) +#### **--layer-label**=*label[=value]* + +Add an intermediate image *label* (e.g. label=*value*) to the intermediate +image metadata. It can be used multiple times. + +If *label* is named, but neither `=` nor a `value` is provided, then +the *label* is set to an empty value. + +[//]: # (END included file options/layer-label.md) + + +[//]: # (BEGIN included file options/layers.md) +#### **--layers** + +Cache intermediate images during the build process (Default is `true`). + +Note: You can also override the default value of layers by setting the +BUILDAH\_LAYERS environment variable. `export BUILDAH_LAYERS=true` + +[//]: # (END included file options/layers.md) + +#### **--local**, **-l** + +Build image on local machine as well as on farm nodes. + + +[//]: # (BEGIN included file options/logfile.md) +#### **--logfile**=*filename* + +Log output which is sent to standard output and standard error to the +specified file instead of to standard output and standard error. +This option is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. + +[//]: # (END included file options/logfile.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/network.image.md) +#### **--network**=*mode*, **--net** + +Sets the configuration for network namespaces when handling `RUN` instructions. + +Valid _mode_ values are: + +- **none**: no networking. +- **host**: use the Podman host network stack. Note: the host mode gives the +container full access to local system services such as D-bus and is therefore +considered insecure. +- **ns:**_path_: path to a network namespace to join. +- **private**: create a new namespace for the container (default) +- **\**: Join the network with the given name or ID, e.g. use `--network mynet` to join the network with the name mynet. Only supported for rootful users. +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=MTU**: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=CIDR**: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=INTERFACE**: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=IPv4**: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=INTERFACE**: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=IPv6**: Specify the outbound ipv6 address slirp binds to. +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.image.md) + + +[//]: # (BEGIN included file options/no-cache.md) +#### **--no-cache** + +Do not use existing cached images for the container build. Build from the start with a new set of cached layers. + +[//]: # (END included file options/no-cache.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the container. + +Podman assumes control over the container's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/omit-history.md) +#### **--omit-history** + +Omit build history information in the built image. (default false). + +This option is useful for the cases where end users explicitly +want to set `--omit-history` to omit the optional `History` from +built images or when working with images built using build tools that +do not include `History` information in their images. + +[//]: # (END included file options/omit-history.md) + + +[//]: # (BEGIN included file options/os-feature.md) +#### **--os-feature**=*feature* + +Set the name of a required operating system *feature* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS feature list is kept, if the base image specified any. This option is typically only meaningful when the image's OS is Windows. + +If *feature* has a trailing `-`, then the *feature* is removed from the set of required features which is listed in the image. + +[//]: # (END included file options/os-feature.md) + + +[//]: # (BEGIN included file options/os-version.image.md) +#### **--os-version**=*version* + +Set the exact required operating system *version* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS version is kept, if the base image specified one. This option is typically only meaningful when the image's OS is Windows, and is typically set in Windows base images, so using this option is usually unnecessary. + +[//]: # (END included file options/os-version.image.md) + + +[//]: # (BEGIN included file options/pid.image.md) +#### **--pid**=*pid* + +Sets the configuration for PID namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new PID namespace is created, or it can be "host" to indicate that the PID namespace in which `podman` itself is being run is reused, or it can be the path to a PID namespace which is already in use by another +process. + +[//]: # (END included file options/pid.image.md) + +#### **--platforms**=*p1,p2,p3...* + +Build only on farm nodes that match the given platforms. + + +[//]: # (BEGIN included file options/pull.image.md) +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Only pull the image when it does not exist in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error when no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. + +[//]: # (END included file options/pull.image.md) + + +[//]: # (BEGIN included file options/quiet.md) +#### **--quiet**, **-q** + +Suppress output messages which indicate which instruction is being processed, and of progress when pulling images from a registry, and when writing the output image. + +[//]: # (END included file options/quiet.md) + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + + +[//]: # (BEGIN included file options/rm.md) +#### **--rm** + +Remove intermediate containers after a successful build (default true). + +[//]: # (END included file options/rm.md) + + +[//]: # (BEGIN included file options/runtime.md) +#### **--runtime**=*path* + +The *path* to an alternate OCI-compatible runtime, which is used to run +commands specified by the **RUN** instruction. + +Note: You can also override the default runtime by setting the BUILDAH\_RUNTIME environment variable. `export BUILDAH_RUNTIME=/usr/local/bin/runc` + +[//]: # (END included file options/runtime.md) + + +[//]: # (BEGIN included file options/runtime-flag.md) +#### **--runtime-flag**=*flag* + +Adds global flags for the container runtime. To list the supported flags, please consult the manpages of the selected container runtime. + +Note: Do not pass the leading -- to the flag. To pass the runc flag --log-format json to buildah build, the option given is --runtime-flag log-format=json. + +[//]: # (END included file options/runtime-flag.md) + + +[//]: # (BEGIN included file options/sbom.md) +#### **--sbom**=*preset* + +Generate SBOMs (Software Bills Of Materials) for the output image by scanning +the working container and build contexts using the named combination of scanner +image, scanner commands, and merge strategy. Must be specified with one or +more of **--sbom-image-output**, **--sbom-image-purl-output**, **--sbom-output**, +and **--sbom-purl-output**. Recognized presets, and the set of options which +they equate to: + + - "syft", "syft-cyclonedx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output cyclonedx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output cyclonedx-json={OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "syft-spdx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output spdx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output spdx-json={OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + - "trivy", "trivy-cyclonedx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "trivy-spdx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + +[//]: # (END included file options/sbom.md) + + +[//]: # (BEGIN included file options/sbom-image-output.md) +#### **--sbom-image-output**=*path* + +When generating SBOMs, store the generated SBOM in the specified path in the +output image. There is no default. + +[//]: # (END included file options/sbom-image-output.md) + + +[//]: # (BEGIN included file options/sbom-image-purl-output.md) +#### **--sbom-image-purl-output**=*path* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the specified path in the output +image. There is no default. + +[//]: # (END included file options/sbom-image-purl-output.md) + + +[//]: # (BEGIN included file options/sbom-merge-strategy.md) +#### **--sbom-merge-strategy**=*method* + +If more than one **--sbom-scanner-command** value is being used, use the +specified method to merge the output from later commands with output from +earlier commands. Recognized values include: + + - cat + Concatenate the files. + - merge-cyclonedx-by-component-name-and-version + Merge the "component" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "version" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + - merge-spdx-by-package-name-and-versioninfo + Merge the "package" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "versionInfo" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + +[//]: # (END included file options/sbom-merge-strategy.md) + + +[//]: # (BEGIN included file options/sbom-output.md) +#### **--sbom-output**=*file* + +When generating SBOMs, store the generated SBOM in the named file on the local +filesystem. There is no default. + +[//]: # (END included file options/sbom-output.md) + + +[//]: # (BEGIN included file options/sbom-purl-output.md) +#### **--sbom-purl-output**=*file* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the named file in the local +filesystem. There is no default. + +[//]: # (END included file options/sbom-purl-output.md) + + +[//]: # (BEGIN included file options/sbom-scanner-command.md) +#### **--sbom-scanner-command**=*image* + +Generate SBOMs by running the specified command from the scanner image. If +multiple commands are specified, they are run in the order in which they are +specified. These text substitutions are performed: + - {ROOTFS} + The root of the built image's filesystem, bind mounted. + - {CONTEXT} + The build context and additional build contexts, bind mounted. + - {OUTPUT} + The name of a temporary output file, to be read and merged with others or copied elsewhere. + +[//]: # (END included file options/sbom-scanner-command.md) + + +[//]: # (BEGIN included file options/sbom-scanner-image.md) +#### **--sbom-scanner-image**=*image* + +Generate SBOMs using the specified scanner image. + +[//]: # (END included file options/sbom-scanner-image.md) + + +[//]: # (BEGIN included file options/secret.image.md) +#### **--secret**=**id=id[,src=*envOrFile*][,env=*ENV*][,type=*file* | *env*]** + +Pass secret information to be used in the Containerfile for building images +in a safe way that will not end up stored in the final image, or be seen in other stages. +The value of the secret will be read from an environment variable or file named +by the "id" option, or named by the "src" option if it is specified, or from an +environment variable specified by the "env" option. See [EXAMPLES](#examples). +The secret will be mounted in the container at `/run/secrets/id` by default. + +To later use the secret, use the --mount flag in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret` + +The location of the secret in the container can be overridden using the +"target", "dst", or "destination" option of the `RUN --mount` flag. + +`RUN --mount=type=secret,id=mysecret,target=/run/secrets/myothersecret cat /run/secrets/myothersecret` + +Note: changing the contents of secret files will not trigger a rebuild of layers that use said secrets. + +[//]: # (END included file options/secret.image.md) + + +[//]: # (BEGIN included file options/security-opt.image.md) +#### **--security-opt**=*option* + +Security Options + +- `apparmor=unconfined` : Turn off apparmor confinement for the container +- `apparmor=alternate-profile` : Set the apparmor confinement profile for the +container + +- `label=user:USER` : Set the label user for the container processes +- `label=role:ROLE` : Set the label role for the container processes +- `label=type:TYPE` : Set the label process type for the container processes +- `label=level:LEVEL` : Set the label level for the container processes +- `label=filetype\:TYPE` : Set the label file type for the container files +- `label=disable` : Turn off label separation for the container +- `no-new-privileges` : Not supported + +- `seccomp=unconfined` : Turn off seccomp confinement for the container +- `seccomp=profile.json` : JSON file to be used as the seccomp filter for the container. + +[//]: # (END included file options/security-opt.image.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the container. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/skip-unused-stages.md) +#### **--skip-unused-stages** + +Skip stages in multi-stage builds which don't affect the target stage. (Default: **true**). + +[//]: # (END included file options/skip-unused-stages.md) + + +[//]: # (BEGIN included file options/squash.md) +#### **--squash** + +Squash all of the image's new layers into a single new layer; any preexisting layers are not squashed. + +[//]: # (END included file options/squash.md) + + +[//]: # (BEGIN included file options/squash-all.md) +#### **--squash-all** + +Squash all of the new image's layers (including those inherited from a base image) into a single new layer. + +[//]: # (END included file options/squash-all.md) + + +[//]: # (BEGIN included file options/ssh.md) +#### **--ssh**=*default* | *id[=socket>* + +SSH agent socket or keys to expose to the build. +The socket path can be left empty to use the value of `default=$SSH_AUTH_SOCK` + +To later use the ssh agent, use the --mount option in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=ssh,id=id mycmd` + +[//]: # (END included file options/ssh.md) + + +[//]: # (BEGIN included file options/tag.md) +#### **--tag**, **-t**=*imageName* + +Specifies the name which is assigned to the resulting image if the build process completes successfully. +If _imageName_ does not include a registry name, the registry name *localhost* is prepended to the image name. + +[//]: # (END included file options/tag.md) + + +[//]: # (BEGIN included file options/target.md) +#### **--target**=*stageName* + +Set the target build stage to build. When building a Containerfile with multiple build stages, --target can be used to specify an intermediate build stage by name as the final stage for the resulting image. Commands after the target stage is skipped. + +[//]: # (END included file options/target.md) + + +[//]: # (BEGIN included file options/timestamp.md) +#### **--timestamp**=*seconds* + +Set the create timestamp to seconds since epoch to allow for deterministic builds (defaults to current time). By default, the created timestamp is changed and written into the image manifest with every commit, causing the image's sha256 hash to be different even if the sources are exactly the same otherwise. +When --timestamp is set, the created timestamp is always set to the time specified and therefore not changed, allowing the image's sha256 hash to remain the same. All files committed to the layers of the image is created with the timestamp. + +If the only instruction in a Containerfile is `FROM`, this flag has no effect. + +[//]: # (END included file options/timestamp.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/ulimit.image.md) +#### **--ulimit**=*type=soft-limit[\:hard-limit]* + +Specifies resource limits to apply to processes launched when processing `RUN` instructions. This option can be specified multiple times. Recognized resource types include: + "core": maximum core dump size (ulimit -c) + "cpu": maximum CPU time (ulimit -t) + "data": maximum size of a process's data segment (ulimit -d) + "fsize": maximum size of new files (ulimit -f) + "locks": maximum number of file locks (ulimit -x) + "memlock": maximum amount of locked memory (ulimit -l) + "msgqueue": maximum amount of data in message queues (ulimit -q) + "nice": niceness adjustment (nice -n, ulimit -e) + "nofile": maximum number of open files (ulimit -n) + "nproc": maximum number of processes (ulimit -u) + "rss": maximum size of a process's (ulimit -m) + "rtprio": maximum real-time scheduling priority (ulimit -r) + "rttime": maximum amount of real-time execution between blocking syscalls + "sigpending": maximum number of pending signals (ulimit -i) + "stack": maximum stack size (ulimit -s) + +[//]: # (END included file options/ulimit.image.md) + + +[//]: # (BEGIN included file options/unsetenv.image.md) +#### **--unsetenv**=*env* + +Unset environment variables from the final image. + +[//]: # (END included file options/unsetenv.image.md) + + +[//]: # (BEGIN included file options/unsetlabel.md) +#### **--unsetlabel**=*label* + +Unset the image label, causing the label not to be inherited from the base image. + +[//]: # (END included file options/unsetlabel.md) + + +[//]: # (BEGIN included file options/userns.image.md) +#### **--userns**=*how* + +Sets the configuration for user namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new user namespace is created, it can be "host" to indicate that the user namespace in which `podman` itself is being run is reused, or it can be the path to a user namespace which is already in use by another process. + +[//]: # (END included file options/userns.image.md) + + +[//]: # (BEGIN included file options/userns-gid-map.md) +#### **--userns-gid-map**=*mapping* + +Directly specifies a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container GID, a corresponding starting host-level GID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-gids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-gid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-gid-map are specified, but --userns-uid-map is specified, the GID map is set to use the same numeric values as the UID map. + +[//]: # (END included file options/userns-gid-map.md) + + +[//]: # (BEGIN included file options/userns-gid-map-group.md) +#### **--userns-gid-map-group**=*group* + +Specifies that a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subgid` file which correspond to the specified group. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-uid-map-user is specified, but --userns-gid-map-group is not specified, `podman` assumes that the specified user name is also a +suitable group name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. + +[//]: # (END included file options/userns-gid-map-group.md) + + +[//]: # (BEGIN included file options/userns-uid-map.md) +#### **--userns-uid-map**=*mapping* + +Directly specifies a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions default to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container UID, a corresponding starting host-level UID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-uids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-uid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-uid-map are specified, but --userns-gid-map is specified, the UID map is set to use the same numeric values as the GID map. + +[//]: # (END included file options/userns-uid-map.md) + + +[//]: # (BEGIN included file options/userns-uid-map-user.md) +#### **--userns-uid-map-user**=*user* + +Specifies that a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subuid` file which correspond to the specified user. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-gid-map-group is specified, but --userns-uid-map-user is not specified, `podman` assumes that the specified group name is also a +suitable user name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. + +[//]: # (END included file options/userns-uid-map-user.md) + + +[//]: # (BEGIN included file options/uts.md) +#### **--uts**=*how* + +Sets the configuration for UTS namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new UTS namespace to be created, or it can be "host" to indicate that the UTS namespace in which `podman` itself is being run is reused, or it can be the path to a UTS namespace which is already in use by another process. + +[//]: # (END included file options/uts.md) + + +[//]: # (BEGIN included file options/volume.image.md) +#### **--volume**, **-v**=*[HOST-DIR\:CONTAINER-DIR[\:OPTIONS]]* + +Mount a host directory into containers when executing RUN instructions during +the build. + +The `OPTIONS` are a comma-separated list and can be one or more of: + + * [rw|ro] + * [z|Z|O] + * [U] + * [`[r]shared`|`[r]slave`|`[r]private`][[1]](#Footnote1) + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR` +must be an absolute path as well. Podman bind-mounts the `HOST-DIR` to the +specified path when processing RUN instructions. + +You can specify multiple **-v** options to mount one or more mounts. + +You can add the `:ro` or `:rw` suffix to a volume to mount it read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted. When running using user namespaces, the UID and GID inside +the namespace may correspond to another UID and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the namespace, to change recursively the owner and group of +the source volume. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add one of these two suffixes +`:z` or `:Z` to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The `z` option tells Podman that two containers +share the volume content. As a result, Podman labels the content with a shared +content label. Shared volume labels allow all containers to read/write content. +The `Z` option tells Podman to label the content with a private unshared label. +Only the current container can use a private volume. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the host machine to fail. For these types +of containers, disabling SELinux separation is recommended. The option +`--security-opt label=disable` disables SELinux separation for the container. +For example, if a user wanted to volume mount their entire home directory into the build containers, they need to disable SELinux separation. + + $ podman build --security-opt label=disable -v $HOME:/home/user . + +`Overlay Volume Mounts` + +The `:O` flag tells Podman to mount the directory from the host as a +temporary storage using the Overlay file system. The `RUN` command containers +are allowed to modify contents within the mountpoint and are stored in the +container storage in a separate directory. In Overlay FS terms the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the `RUN` command +finishes executing, similar to a tmpfs mount point. + +Any subsequent execution of `RUN` commands sees the original source directory +content, any changes from previous RUN commands no longer exists. + +One use case of the `overlay` mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: + +- Overlay mounts are not currently supported in rootless mode. +- The `O` flag is not allowed to be specified with the `Z` or `z` flags. + Content mounted into the container is labeled with the private label. + On SELinux systems, labels in the source directory needs to be readable + by the container label. If not, SELinux container separation must be disabled + for the container to work. +- Modification of the directory volume mounted into the container with an + overlay mount can cause unexpected failures. Do not modify the directory until + the container finishes running. + +By default bind mounted volumes are `private`. That means any mounts done +inside containers are not be visible on the host and vice versa. This behavior +can be changed by specifying a volume mount propagation property. + +When the mount propagation policy is set to `shared`, any mounts completed +inside the container on that volume is visible to both the host and +container. When the mount propagation policy is set to `slave`, one way mount +propagation is enabled and any mounts completed on the host for that volume is +visible only inside of the container. To control the mount propagation +property of volume use the `:[r]shared`, `:[r]slave` or `:[r]private` +propagation flag. For mount propagation to work on the source mount point (mount +point where source dir is mounted on) has to have the right propagation properties. +For shared volumes, the source mount point has to be shared. And for slave volumes, +the source mount has to be either shared or slave. [[1]](#Footnote1) + +Use `df ` to determine the source mount and then use +`findmnt -o TARGET,PROPAGATION ` to determine propagation +properties of source mount, if `findmnt` utility is not available, the source +mount point can be determined by looking at the mount entry in +`/proc/self/mountinfo`. Look at `optional fields` and see if any propagation +properties are specified. +`shared:X` means the mount is `shared`, `master\:X` means the mount is `slave` +and if nothing is there that means the mount is `private`. [[1]](#Footnote1) + +To change propagation properties of a mount point use the `mount` command. For +example, to bind mount the source directory `/foo` do +`mount --bind /foo /foo` and `mount --make-private --make-shared /foo`. This +converts /foo into a `shared` mount point. The propagation properties of +the source mount can be changed directly. For instance if `/` is the source +mount for `/foo`, then use `mount --make-shared /` to convert `/` into a +`shared` mount. + +[//]: # (END included file options/volume.image.md) + +## EXAMPLES + +Build named image and manifest list using specified Containerfile with default farm: +``` +$ podman farm build --local -t name -f /path/to/containerfile . +``` + +Build named image and manifest list using the specified farm: +``` +$ podman farm build --farm myfarm -t name . +``` + +Build named image and manifest list using the specified farm, removing all images from farm nodes, after they are pushed to registry: +``` +$ podman farm build --farm myfarm --cleanup -t name . +``` + +Build named images and manifest list for specified platforms using default farm: +``` +$ podman farm build --platforms arm64,amd64 -t name . +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/main/man/runc.8.md)**, **[useradd(8)](https://www.unix.com/man-page/redhat/8/useradd)**, **[Containerfile(5)](https://github.com/containers/common/blob/main/docs/Containerfile.5.md)**, **[containerignore(5)](https://github.com/containers/common/blob/main/docs/containerignore.5.md)** + +## HISTORY + +September 2023, Originally compiled by Urvashi Mohnani `` + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a +core value of open source. The `master` and `slave` mount propagation +terminology used here is problematic and divisive, and needs to be changed. +However, these terms are currently used within the Linux kernel and must be +used as-is at this time. When the kernel maintainers rectify this usage, +Podman will follow suit immediately. diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-farm-create.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-farm-create.1.md new file mode 100644 index 000000000..015f752f5 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-farm-create.1.md @@ -0,0 +1,39 @@ +--- +title: podman-farm-create +version: v5.4.1 +--- + +% podman-farm-create 1 + +## NAME +podman\-farm\-create - Create a new farm + +## SYNOPSIS +**podman farm create** *name* [*connections*] + +## DESCRIPTION +Create a new farm with connections that Podman knows about which were added via the +*podman system connection add* command. + +An empty farm can be created without adding any connections to it. Add or remove +connections from a farm via the *podman farm update* command. + +## EXAMPLE + + + +Create the specified farm: +``` +$ podman farm create farm2 +``` + +Create multiple farms: +``` +$ podman farm create farm1 f37 f38 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)**, **[podman-system-connection-add(1)](podman-system-connection-add.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-farm-list.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-farm-list.1.md new file mode 100644 index 000000000..f44567481 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-farm-list.1.md @@ -0,0 +1,47 @@ +--- +title: podman-farm-list +version: v5.4.1 +--- + +% podman-farm-list 1 + +## NAME +podman\-farm\-list - List the existing farms + +## SYNOPSIS +**podman farm list** [*options*] + +**podman farm ls** [*options*] + +## DESCRIPTION +List all the existing farms. + +## OPTIONS + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' or a Go template. +Valid placeholders for the Go template listed below: + +| **Placeholder** | **Description** | +| --------------- | --------------------------------------------------------------------- | +| .Connections | List of all system connections in the farm | +| .Default | Indicates whether farm is the default | +| .Name | Farm name | +| .ReadWrite | Indicates if this farm can be modified using the podman farm commands | + +## EXAMPLE + +List all farms: +``` +$ podman farm list +Name Connections Default ReadWrite +farm1 [f38 f37] false true +farm2 [f37] true true +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-farm-remove.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-farm-remove.1.md new file mode 100644 index 000000000..a8c6c0617 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-farm-remove.1.md @@ -0,0 +1,41 @@ +--- +title: podman-farm-remove +version: v5.4.1 +--- + +% podman-farm-remove 1 + +## NAME +podman\-farm\-remove - Delete one or more farms + +## SYNOPSIS +**podman farm remove** [*options*] *name* + +**podman farm rm** [*options*] *name* + +## DESCRIPTION +Delete one or more farms. + +## OPTIONS + +#### **--all**, **-a** + +Remove all farms. + +## EXAMPLE + +Remove specified farm: +``` +$ podman farm remove farm1 +``` + +Remove all farms: +``` +$ podman farm rm --all +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com)s diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-farm-update.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-farm-update.1.md new file mode 100644 index 000000000..8e68ea078 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-farm-update.1.md @@ -0,0 +1,53 @@ +--- +title: podman-farm-update +version: v5.4.1 +--- + +% podman-farm-update 1 + +## NAME +podman\-farm\-update - Update an existing farm + +## SYNOPSIS +**podman farm update** [*options*] *name* + +## DESCRIPTION +Update a farm by either adding connections to it, removing connections from it, or setting it as the new +default farm. + +## OPTIONS + +#### **--add**, **-a** + +Add new connections to an existing farm. Multiple connections can be added at once. + +#### **--default**, **-d** + +Set the current farm as the default. + +#### **--remove**, **-r** + +Remove one or more connections from an existing farm. + +## EXAMPLE + +Add two connections to specified farm: +``` +$ podman farm update --add f35,f38 farm1 +``` + +Add connection to specified farm: +``` +$ podman farm update --remove f35 farm1 +``` + +Change specified farm to be default: +``` +$ podman farm update --default farm2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com)s diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-farm.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-farm.1.md new file mode 100644 index 000000000..2bee3c89c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-farm.1.md @@ -0,0 +1,46 @@ +--- +title: podman-farm +version: v5.4.1 +--- + +% podman-farm 1 + +## NAME +podman\-farm - Farm out builds to machines running podman for different architectures + +## SYNOPSIS +**podman farm** *subcommand* + +## DESCRIPTION +Farm out builds to machines running Podman for different architectures. + +Manage farms by creating, updating, and removing them. + +Note: All farm machines must have a minimum podman version of v4.9.0. + +Podman manages the farms by writing and reading the `podman-connections.json` file located under +`$XDG_CONFIG_HOME/containers` or if the env is not set it defaults to `$HOME/.config/containers`. +Or the `PODMAN_CONNECTIONS_CONF` environment variable can be set to a full file path which podman +will use instead. +This file is managed by the podman commands and should never be edited by users directly. To manually +configure the farms use the `[farm]` section in containers.conf. + +If the ReadWrite column in the **podman farm list** output is set to true the farm is stored in the +`podman-connections.json` file otherwise it is stored in containers.conf and can therefore not be +edited with the **podman farm remove/update** commands. It can still be used with **podman farm build**. + +## COMMANDS + +| Command | Man Page | Description | +| -------- | ----------------------------------------------------| ----------------------------------------------------------------- | +| build | [podman-farm\-build(1)](podman-farm-build.1.md) | Build images on farm nodes, then bundle them into a manifest list | +| create | [podman-farm\-create(1)](podman-farm-create.1.md) | Create a new farm | +| list | [podman-farm\-list(1)](podman-farm-list.1.md) | List the existing farms | +| remove | [podman-farm\-remove(1)](podman-farm-remove.1.md) | Delete one or more farms | +| update | [podman-farm\-update(1)](podman-farm-update.1.md) | Update an existing farm | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-generate-spec.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-generate-spec.1.md new file mode 100644 index 000000000..3a113e35a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-generate-spec.1.md @@ -0,0 +1,31 @@ +--- +title: podman-generate-spec +version: v5.4.1 +--- + +% podman-generate-spec 1 + +## NAME +podman\-generate\-spec - Generate Specgen JSON based on containers or pods + +## SYNOPSIS +**podman generate spec** [*options*] *container | *pod* + +## DESCRIPTION +**podman generate spec** generates SpecGen JSON from Podman Containers and Pods. This JSON can be printed to a file, directly to the command line, or both. + +This JSON can then be used as input for the Podman API, specifically for Podman container and pod creation. Specgen is Podman's internal structure for formulating new container-related entities. + +## OPTIONS + +#### **--compact**, **-c** + +Print the output in a compact, one line format. This is useful when piping the data to the Podman API + +#### **--filename**, **-f**=**filename** + +Output to the given file. + +#### **--name**, **-n** + +Rename the pod or container, so that it does not conflict with the existing entity. This is helpful when the JSON is to be used before the source pod or container is deleted. diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-generate-systemd.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-generate-systemd.1.md new file mode 100644 index 000000000..9f0ab8f24 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-generate-systemd.1.md @@ -0,0 +1,326 @@ +--- +title: podman-generate-systemd +version: v5.4.1 +--- + +% podman-generate-systemd 1 + +## NAME +podman\-generate\-systemd - [DEPRECATED] Generate systemd unit file(s) for a container or pod + +## SYNOPSIS +**podman generate systemd** [*options*] *container|pod* + +## DESCRIPTION +DEPRECATED: +Note: **podman generate systemd** is deprecated. We recommend using [Quadlet](podman-systemd.unit.5.md) +files when running Podman containers or pods under systemd. There are no plans to remove the command. +It will receive urgent bug fixes but no new features. + +**podman generate systemd** creates a systemd unit file that can be used to control a container or pod. +By default, the command prints the content of the unit files to stdout. + +Generating unit files for a pod requires the pod to be created with an infra container (see `--infra=true`). An infra container runs across the entire lifespan of a pod and is hence required for systemd to manage the life cycle of the pod's main unit. + +- Note: When using this command with the remote client, including Mac and Windows (excluding WSL2) machines, place the generated units on the remote system. Moreover, make sure that the `XDG_RUNTIME_DIR` environment variable is set. If unset, set it via `export XDG_RUNTIME_DIR=/run/user/$(id -u)`._ + +- Note: The generated `podman run` command contains an `--sdnotify` option with the value taken from the container. +If the container does not have any explicitly set value or the value is set to __ignore__, the value __conmon__ is used. +The reason for overriding the default value __container__ is that almost no container workloads send notify messages. +Systemd waits for a ready message that never comes, if the value __container__ is used for a container +that does not send notify messages. The use of the default value might have been unintentional by the user, +therefore the overridden default value._ + +### Kubernetes Integration + +A Kubernetes YAML can be executed in systemd via the `podman-kube@.service` systemd template. The template's argument is the path to the YAML file. Given a `workload.yaml` file in the home directory, it can be executed as follows: + +``` +$ escaped=$(systemd-escape ~/workload.yaml) +$ systemctl --user start podman-kube@$escaped.service +$ systemctl --user is-active podman-kube@$escaped.service +active +``` + +## OPTIONS + +#### **--after**=*dependency_name* + +Add the systemd unit after (`After=`) option, that ordering dependencies between the list of dependencies and this service. This option may be specified more than once. + +User-defined dependencies are appended to the generated unit file, but any existing options needed or defined by default (e.g., `online.target`) are **not** removed or overridden. + +#### **--container-prefix**=*prefix* + +Set the systemd unit name prefix for containers. The default is *container*. + +#### **--env**, **-e**=*env* + +Set environment variables to the systemd unit files. + +If an environment variable is specified without a value, Podman checks the host environment for a value and sets the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the systemd unit files. + +#### **--files**, **-f** + +Generate files instead of printing to stdout. The generated files are named {container,pod}-{ID,name}.service and are placed in the current working directory. + +Note: On a system with SELinux enabled, the generated files inherits contexts from the current working directory. Depending on the SELinux setup, changes to the generated files using `restorecon`, `chcon`, or `semanage` may be required to allow systemd to access these files. Alternatively, use the `-Z` option when running `mv` or `cp`. + +#### **--format**=*format* + +Print the created units in the specified format (json). If `--files` is specified, the paths to the created files are printed instead of the unit content. + +#### **--name**, **-n** + +Use the name of the container for the start, stop, and description in the unit file + +#### **--new** + +This option yields unit files that do not expect containers and pods to exist. Instead, new containers and pods are created based on their configuration files. The unit files are created best effort and may need further editing; please review the generated files carefully before using them in production. + +Note that `--new` only works on containers and pods created directly via Podman (i.e., `podman [container] {create,run}` or `podman pod create`). It does not work on containers or pods created via the REST API or via `podman kube play`. For `podman kube play`, use the `podman-kube@.service` systemd template instead. + +#### **--no-header** + +Do not generate the header including meta data such as the Podman version and the timestamp. + +#### **--pod-prefix**=*prefix* + +Set the systemd unit name prefix for pods. The default is *pod*. + +#### **--requires**=*dependency_name* + +Set the systemd unit requires (`Requires=`) option. Similar to wants, but declares a stronger requirement dependency. + +#### **--restart-policy**=*policy* + +Set the systemd restart policy. The restart-policy must be one of: "no", "on-success", "on-failure", "on-abnormal", +"on-watchdog", "on-abort", or "always". The default policy is *on-failure* unless the container was created with a custom restart policy. + +Note that generating a unit without `--new` on a container with a custom restart policy can lead to issues on shutdown; systemd attempts to stop the unit while Podman tries to restart it. Creating the container without `--restart` and using the `--restart-policy` option when generating the unit file is recommended. + +#### **--restart-sec**=*time* + +Set the systemd service restartsec value. Configures the time to sleep before restarting a service (as configured with restart-policy). +Takes a value in seconds. + +#### **--separator**=*separator* + +Set the systemd unit name separator between the name/id of a container/pod and the prefix. The default is *-*. + +#### **--start-timeout**=*value* + +Override the default start timeout for the container with the given value in seconds. + +#### **--stop-timeout**=*value* + +Override the default stop timeout for the container with the given value in seconds. + +#### **--template** + +Add template specifiers to run multiple services from the systemd unit file. + +Note that if `--new` was not set to true, it is set to true by default. However, the command fails if `--new` is set to `false` explicitly. + +#### **--wants**=*dependency_name* + +Add the systemd unit wants (`Wants=`) option, that this service is (weak) dependent on. This option may be specified more than once. This option does not influence the order in which services are started or stopped. + +User-defined dependencies are appended to the generated unit file, but any existing options needed or defined by default (e.g., `online.target`) are **not** removed or overridden. + +## EXAMPLES + +### Generate and print a systemd unit file for a container + +Generate a systemd unit file for a container running nginx with an *always* restart policy and 1-second timeout to stdout. Note that the **RequiresMountsFor** option in the **Unit** section ensures that the container storage for both the GraphRoot and the RunRoot are mounted prior to starting the service. For systems with container storage on disks like iSCSI or other remote block protocols, this ensures that Podman is not executed prior to any necessary storage operations coming online. + +``` +$ podman create --name nginx nginx:latest +$ podman generate systemd --restart-policy=always -t 1 nginx +# container-de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6.service +# autogenerated by Podman 1.8.0 +# Wed Mar 09 09:46:45 CEST 2020 + +[Unit] +Description=Podman container-de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6.service +Documentation=man:podman-generate-systemd(1) +Wants=network-online.target +After=network-online.target +RequiresMountsFor=/var/run/container/storage + +[Service] +Restart=always +ExecStart=/usr/bin/podman start de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6 +ExecStop=/usr/bin/podman stop \ + -t 1 de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6 +KillMode=none +Type=forking +PIDFile=/run/user/1000/overlay-containers/de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6/userdata/conmon.pid + +[Install] +WantedBy=default.target +``` + +### Generate systemd unit file for a container with `--new` flag + + The `--new` flag generates systemd unit files that create and remove containers at service start and stop commands (see ExecStartPre and ExecStopPost service actions). Such unit files are not tied to a single machine and can easily be shared and used on other machines. + +``` +$ sudo podman generate systemd --new --files --name bb310a0780ae +# container-busy_moser.service +# autogenerated by Podman 1.8.3 +# Fri Apr 3 09:40:47 EDT 2020 + +[Unit] +Description=Podman container-busy_moser.service +Documentation=man:podman-generate-systemd(1) +Wants=network-online.target +After=network-online.target +RequiresMountsFor=/var/run/container/storage + +[Service] +Environment=PODMAN_SYSTEMD_UNIT=%n +Restart=on-failure +ExecStartPre=/bin/rm -f %t/%n-pid %t/%n-cid +ExecStart=/usr/local/bin/podman run \ + --conmon-pidfile %t/%n-pid \ + --cidfile %t/%n-cid \ + --cgroups=no-conmon \ + -d \ + -dit alpine +ExecStop=/usr/local/bin/podman stop \ + --ignore \ + --cidfile %t/%n-cid -t 10 +ExecStopPost=/usr/local/bin/podman rm \ + --ignore \ + -f \ + --cidfile %t/%n-cid +PIDFile=%t/%n-pid +KillMode=none +Type=forking + +[Install] +WantedBy=default.target +``` + +### Generate systemd unit files for a pod with two simple alpine containers + +Note `systemctl` must only be used on the pod unit and not used to start or stop containers individually. The containers are managed by the pod service along with the internal infra-container. + +Use `systemctl status` or `journalctl` to examine container or pod unit files. +``` +$ podman pod create --name systemd-pod +$ podman create --pod systemd-pod alpine top +$ podman create --pod systemd-pod alpine top +$ podman generate systemd --files --name systemd-pod +/home/user/pod-systemd-pod.service +/home/user/container-amazing_chandrasekhar.service +/home/user/container-jolly_shtern.service +$ cat pod-systemd-pod.service +# pod-systemd-pod.service +# autogenerated by Podman 1.8.0 +# Wed Mar 09 09:52:37 CEST 2020 + +[Unit] +Description=Podman pod-systemd-pod.service +Documentation=man:podman-generate-systemd(1) +Requires=container-amazing_chandrasekhar.service container-jolly_shtern.service +Before=container-amazing_chandrasekhar.service container-jolly_shtern.service +Wants=network-online.target +After=network-online.target +RequiresMountsFor=/var/run/container/storage + +[Service] +Restart=on-failure +ExecStart=/usr/bin/podman start 77a818221650-infra +ExecStop=/usr/bin/podman stop \ + -t 10 77a818221650-infra +KillMode=none +Type=forking +PIDFile=/run/user/1000/overlay-containers/ccfd5c71a088768774ca7bd05888d55cc287698dde06f475c8b02f696a25adcd/userdata/conmon.pid + +[Install] +WantedBy=default.target +``` + +### Installation of generated systemd unit files. + +Podman-generated unit files include an `[Install]` section, which carries installation information for the unit. It is used by the enable and disable commands of systemctl(1) during installation. + +Once the systemd unit file is generated, install it to */etc/systemd/system* to be run by the root user or to *$HOME/.config/systemd/user* for installing it as a non-root user. Enable the copied unit file or files using `systemctl enable`. + +Note: Copying unit files to */etc/systemd/system* and enabling it marks the unit file to be automatically started at boot. And similarly, copying a unit file to *$HOME/.config/systemd/user* and enabling it marks the unit file to be automatically started on user login. + + +``` +# Generated systemd files. +$ podman pod create --name systemd-pod +$ podman create --pod systemd-pod alpine top +$ podman generate systemd --files --name systemd-pod + +# Copy all the generated files. + +$ sudo cp pod-systemd-pod.service container-great_payne.service /etc/systemd/system +$ systemctl enable pod-systemd-pod.service +Created symlink /etc/systemd/system/multi-user.target.wants/pod-systemd-pod.service → /etc/systemd/system/pod-systemd-pod.service. +Created symlink /etc/systemd/system/default.target.wants/pod-systemd-pod.service → /etc/systemd/system/pod-systemd-pod.service. +$ systemctl is-enabled pod-systemd-pod.service +enabled +``` +To run the user services placed in `$HOME/.config/systemd/user` on first login of that user, enable the service with --user flag. + +``` +$ systemctl --user enable <.service> +``` +The systemd user instance is killed after the last session for the user is closed. The systemd user instance can be started at boot and kept running even after the user logs out by enabling `lingering` using + +``` +$ loginctl enable-linger +``` +### Use `systemctl` to perform operations on generated installed unit files. + +Create and enable systemd unit files for a pod using the above examples as reference and use `systemctl` to perform operations. + +Since systemctl defaults to using the root user, all the changes using the systemctl can be seen by appending sudo to the podman cli commands. To perform `systemctl` actions as a non-root user use the `--user` flag when interacting with `systemctl`. + +Note: If the previously created containers or pods are using shared resources, such as ports, make sure to remove them before starting the generated systemd units. + +``` +$ systemctl --user start pod-systemd-pod.service +$ podman pod ps +POD ID NAME STATUS CREATED # OF CONTAINERS INFRA ID +0815c7b8e7f5 systemd-pod Running 29 minutes ago 2 6c5d116f4bbe +$ sudo podman ps # 0 Number of pods on root. +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +$ systemctl stop pod-systemd-pod.service +$ podman pod ps +POD ID NAME STATUS CREATED # OF CONTAINERS INFRA ID +272d2813c798 systemd-pod Exited 29 minutes ago 2 6c5d116f4bbe +``` + +Create a simple alpine container and generate the systemd unit file with `--new` flag. +Enable the service and control operations using the systemctl commands. + +Note: When starting the container using `systemctl start` rather than altering the already running container it spins up a "new" container with similar configuration. + +``` +# Enable the service. + +$ sudo podman ps -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +bb310a0780ae docker.io/library/alpine:latest /bin/sh 2 minutes ago Created busy_moser +$ sudo systemctl start container-busy_moser.service +$ sudo podman ps -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +772df2f8cf3b docker.io/library/alpine:latest /bin/sh 1 second ago Up 1 second distracted_albattani +bb310a0780ae docker.io/library/alpine\:latest /bin/sh 3 minutes ago Created busy_moser +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **systemctl(1)**, **systemd.unit(5)**, **systemd.service(5)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)**, **[podman-systemd.unit(5)](podman-systemd.unit.5.md)** + +## HISTORY +April 2020, Updated details and added use case to use generated .service files as root and non-root, by Sujil Shah (sushah at redhat dot com) + +August 2019, Updated with pod support by Valentin Rothberg (rothberg at redhat dot com) + +April 2019, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-generate.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-generate.1.md new file mode 100644 index 000000000..18dbac4be --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-generate.1.md @@ -0,0 +1,27 @@ +--- +title: podman-generate +version: v5.4.1 +--- + +% podman-generate 1 + +## NAME +podman\-generate - Generate structured data based on containers, pods or volumes + +## SYNOPSIS +**podman generate** *subcommand* + +## DESCRIPTION +The generate command creates structured output (like YAML) based on a container, pod or volume. + +## COMMANDS + +| Command | Man Page | Description | +|---------|------------------------------------------------------------|-------------------------------------------------------------------------------------| +| kube | [podman-kube-generate(1)](podman-kube-generate.1.md) | Generate Kubernetes YAML based on containers, pods or volumes. | +| spec | [podman-generate-spec(1)](podman-generate-spec.1.md) | Generate Specgen JSON based on containers or pods. | +| systemd | [podman-generate-systemd(1)](podman-generate-systemd.1.md) | [DEPRECATED] Generate systemd unit file(s) for a container or pod. | + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-container(1)](podman-container.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-healthcheck-run.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-healthcheck-run.1.md new file mode 100644 index 000000000..0acfb05eb --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-healthcheck-run.1.md @@ -0,0 +1,45 @@ +--- +title: podman-healthcheck-run +version: v5.4.1 +--- + +% podman-healthcheck-run 1 + +## NAME +podman\-healthcheck\-run - Run a container healthcheck + +## SYNOPSIS +**podman healthcheck run** *container* + +## DESCRIPTION + +Runs the healthcheck command defined in a running container manually. The resulting error codes are defined +as follows: + +* 0 = healthcheck command succeeded +* 1 = healthcheck command failed +* 125 = an error has occurred + +Possible errors that can occur during the healthcheck are: +* unable to find the container +* container has no defined healthcheck +* container is not running + +## OPTIONS +#### **--help** + +Print usage statement + + +## EXAMPLES + +Run healthchecks in specified container: +``` +$ podman healthcheck run mywebapp +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-healthcheck(1)](podman-healthcheck.1.md)** + +## HISTORY +Feb 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-healthcheck.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-healthcheck.1.md new file mode 100644 index 000000000..e7920c653 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-healthcheck.1.md @@ -0,0 +1,27 @@ +--- +title: podman-healthcheck +version: v5.4.1 +--- + +% podman-healthcheck 1 + +## NAME +podman\-healthcheck - Manage healthchecks for containers + +## SYNOPSIS +**podman healthcheck** *subcommand* + +## DESCRIPTION +podman healthcheck is a set of subcommands that manage container healthchecks + +## SUBCOMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------- | ------------------------------------------------------------------------------ | +| run | [podman-healthcheck-run(1)](podman-healthcheck-run.1.md) | Run a container healthcheck | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +Feb 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-history.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-history.1.md new file mode 100644 index 000000000..ec163291c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-history.1.md @@ -0,0 +1,110 @@ +--- +title: podman-history +version: v5.4.1 +--- + +% podman-history 1 + +## NAME +podman\-history - Show the history of an image + +## SYNOPSIS +**podman history** [*options*] *image*[:*tag*|@*digest*] + +**podman image history** [*options*] *image*[:*tag*|@*digest*] + +## DESCRIPTION +**podman history** displays the history of an image by printing out information +about each layer used in the image. The information printed out for each layer +include Created (time and date), Created By, Size, and Comment. The output can +be truncated or not using the **--no-trunc** flag. If the **--human** flag is +set, the time of creation and size are printed out in a human readable format. +The **--quiet** flag displays the ID of the image only when set and the **--format** +flag is used to print the information using the Go template provided by the user. + +## OPTIONS + +#### **--format**=*format* + +Alter the output for a format like 'json' or a Go template. + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|------------------------|---------------------------------------------------------------------------| +| .Comment | Comment for the layer | +| .Created | if --human, time elapsed since creation, otherwise time stamp of creation | +| .CreatedAt | Time when the image layer was created | +| .CreatedBy | Command used to create the layer | +| .CreatedSince | Elapsed time since the image layer was created | +| .ID | Image ID | +| .Size | Size of layer on disk | +| .Tags | Image tags | + +#### **--help**, **-h** + +Print usage statement + +#### **--human**, **-H** + +Display sizes and dates in human readable format (default *true*). + +#### **--no-trunc** + +Do not truncate the output (default *false*). + +#### **--quiet**, **-q** + +Print the numeric IDs only (default *false*). + +## EXAMPLES + +Show the history of the specified image: +``` +$ podman history debian +ID CREATED CREATED BY SIZE COMMENT +b676ca55e4f2c 9 weeks ago /bin/sh -c #(nop) CMD ["bash"] 0 B + 9 weeks ago /bin/sh -c #(nop) ADD file:ebba725fb97cea4... 45.14 MB +``` + +Show the history of the specified image without truncating content and using raw data: +``` +$ podman history --no-trunc=true --human=false debian +ID CREATED CREATED BY SIZE COMMENT +b676ca55e4f2c 2017-07-24T16:52:55Z /bin/sh -c #(nop) CMD ["bash"] 0 + 2017-07-24T16:52:54Z /bin/sh -c #(nop) ADD file:ebba725fb97cea4... 45142935 +``` + +Show the formatted history of the specified image: +``` +$ podman history --format "{{.ID}} {{.Created}}" debian +b676ca55e4f2c 9 weeks ago + 9 weeks ago +``` + +Show the history in JSON format for the specified image: +``` +$ podman history --format json debian +[ + { + "id": "b676ca55e4f2c0ce53d0636438c5372d3efeb5ae99b676fa5a5d1581bad46060", + "created": "2017-07-24T16:52:55.195062314Z", + "createdBy": "/bin/sh -c #(nop) CMD [\"bash\"]", + "size": 0, + "comment": "" + }, + { + "id": "b676ca55e4f2c0ce53d0636438c5372d3efeb5ae99b676fa5a5d1581bad46060", + "created": "2017-07-24T16:52:54.898893387Z", + "createdBy": "/bin/sh -c #(nop) ADD file:ebba725fb97cea45d0b1b35ccc8144e766fcfc9a78530465c23b0c4674b14042 in / ", + "size": 45142935, + "comment": "" + } +] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-image-diff.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-image-diff.1.md new file mode 100644 index 000000000..83b0a05c7 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-image-diff.1.md @@ -0,0 +1,61 @@ +--- +title: podman-image-diff +version: v5.4.1 +--- + +% podman-image-diff 1 + +## NAME +podman-image-diff - Inspect changes on an image's filesystem + +## SYNOPSIS +**podman image diff** [*options*] *image* [*image*] + +## DESCRIPTION +Displays changes on an image's filesystem. The image is compared to its parent layer or the second argument when given. + +The output is prefixed with the following symbols: + +| Symbol | Description | +|--------|-------------| +| A | A file or directory was added. | +| D | A file or directory was deleted. | +| C | A file or directory was changed. | + +## OPTIONS + +#### **--format** + +Alter the output into a different format. The only valid format for **podman image diff** is `json`. + +## EXAMPLE + +Display image differences from images parent layer: +``` +$ podman image diff redis:old +C /usr +C /usr/local +C /usr/local/bin +A /usr/local/bin/docker-entrypoint.sh +``` + +Display image differences between two different images in JSON format: +``` +$ podman image diff --format json redis:old redis\:alpine +{ + "changed": [ + "/usr", + "/usr/local", + "/usr/local/bin" + ], + "added": [ + "/usr/local/bin/docker-entrypoint.sh" + ] +} +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image(1)](podman-image.1.md)** + +## HISTORY +August 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-image-exists.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-image-exists.1.md new file mode 100644 index 000000000..d07168974 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-image-exists.1.md @@ -0,0 +1,46 @@ +--- +title: podman-image-exists +version: v5.4.1 +--- + +% podman-image-exists 1 + +## NAME +podman-image-exists - Check if an image exists in local storage + +## SYNOPSIS +**podman image exists** *image* + +## DESCRIPTION +**podman image exists** checks if an image exists in local storage. The **ID** or **Name** +of the image may be used as input. Podman returns an exit code +of `0` when the image is found. A `1` is returned otherwise. An exit code of `125` indicates there +was an issue accessing the local storage. + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Check if an image called `webclient` exists in local storage (the image does actually exist): +``` +$ podman image exists webclient +$ echo $? +0 +``` + +Check if an image called `webbackend` exists in local storage (the image does not actually exist): +``` +$ podman image exists webbackend +$ echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image(1)](podman-image.1.md)** + +## HISTORY +November 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-image-inspect.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-image-inspect.1.md new file mode 100644 index 000000000..9211effc7 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-image-inspect.1.md @@ -0,0 +1,139 @@ +--- +title: podman-image-inspect +version: v5.4.1 +--- + +% podman-image-inspect 1 + +## NAME +podman\-image\-inspect - Display an image's configuration + +## SYNOPSIS +**podman image inspect** [*options*] *image* [*image* ...] + +## DESCRIPTION + +This displays the low-level information on images identified by name or ID. By default, this renders all results in a JSON array. If a format is specified, the given template is executed for each result. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Format the output using the given Go template. +The keys of the returned JSON can be used as the values for the --format flag (see examples below). + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ----------------- | ------------------ | +| .Annotations ... | Annotation information included in the image | +| .Architecture | Architecture of software in the image | +| .Author | Image author | +| .Comment | Image comment | +| .Config ... | Structure with config info | +| .Created ... | Image creation time (string, ISO3601) | +| .Digest | Image digest (sha256:+64-char hash) | +| .GraphDriver ... | Structure for the graph driver info | +| .HealthCheck ... | Structure for the health check info | +| .History | History information stored in image | +| .ID | Image ID (full 64-char hash) | +| .Labels ... | Label information included in the image | +| .ManifestType | Manifest type of the image | +| .NamesHistory | Name history information stored in image | +| .Os | Operating system of software in the image | +| .Parent | Parent image of the specified image | +| .RepoDigests | Repository digests for the image | +| .RepoTags | Repository tags for the image | +| .RootFS ... | Structure for the root file system info | +| .Size | Size of image, in bytes | +| .User | Default user to execute the image as | +| .Version | Image Version | +| .VirtualSize | Virtual size of image, in bytes | + +## EXAMPLE + +Inspect information on the specified image: +``` +$ podman image inspect fedora +[ + { + "Id": "37e5619f4a8ca9dbc4d6c0ae7890625674a10dbcfb76201399e2aaddb40da17d", + "Digest": "sha256:1b0d4ddd99b1a8c8a80e885aafe6034c95f266da44ead992aab388e6aa91611a", + "RepoTags": [ + "registry.fedoraproject.org/fedora:latest" + ], + "RepoDigests": [ + "registry.fedoraproject.org/fedora@sha256:1b0d4ddd99b1a8c8a80e885aafe6034c95f266da44ead992aab388e6aa91611a", + "registry.fedoraproject.org/fedora@sha256:b5290db40008aae9272ad3a6bd8070ef7ecd547c3bef014b894c327960acc582" + ], + "Parent": "", + "Comment": "Created by Image Factory", + "Created": "2021-08-09T05:48:47Z", + "Config": { + "Env": [ + "DISTTAG=f34container", + "FGC=f34", + "container=oci" + ], + "Cmd": [ + "/bin/bash" + ], + "Labels": { + "license": "MIT", + "name": "fedora", + "vendor": "Fedora Project", + "version": "34" + } + }, + "Version": "1.10.1", + "Author": "", + "Architecture": "amd64", + "Os": "linux", + "Size": 183852302, + "VirtualSize": 183852302, + "GraphDriver": { + "Name": "overlay", + "Data": { + "UpperDir": "/home/dwalsh/.local/share/containers/storage/overlay/0203e243f1ca4b6bb49371ecd21363212467ec6d7d3fa9f324cd4e78cc6b5fa2/diff", + "WorkDir": "/home/dwalsh/.local/share/containers/storage/overlay/0203e243f1ca4b6bb49371ecd21363212467ec6d7d3fa9f324cd4e78cc6b5fa2/work" + } + }, + "RootFS": { + "Type": "layers", + "Layers": [ + "sha256:0203e243f1ca4b6bb49371ecd21363212467ec6d7d3fa9f324cd4e78cc6b5fa2" + ] + }, + "Labels": { + "license": "MIT", + "name": "fedora", + "vendor": "Fedora Project", + "version": "34" + }, + "Annotations": {}, + "ManifestType": "application/vnd.docker.distribution.manifest.v2+json", + "User": "", + "History": [ + { + "created": "2021-08-09T05:48:47Z", + "comment": "Created by Image Factory" + } + ], + "NamesHistory": [ + "registry.fedoraproject.org/fedora:latest" + ] + } +] +``` + +Inspect image ID for the specified image: +``` +$ podman image inspect --format '{{ .Id }}' fedora +37e5619f4a8ca9dbc4d6c0ae7890625674a10dbcfb76201399e2aaddb40da17d +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image(1)](podman-image.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +Sep 2021, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-image-mount.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-image-mount.1.md new file mode 100644 index 000000000..c96396fee --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-image-mount.1.md @@ -0,0 +1,82 @@ +--- +title: podman-image-mount +version: v5.4.1 +--- + +% podman-image-mount 1 + +## NAME +podman\-image\-mount - Mount an image's root filesystem + +## SYNOPSIS +**podman image mount** [*options*] [*image* ...] + +## DESCRIPTION +Mounts the specified images' root file system in a location which can be +accessed from the host, and returns its location. + +The `podman image mount` command without any arguments lists all of the +currently mounted images. + +Rootless mode only supports mounting VFS driver, unless podman is run in a user namespace. +Use the `podman unshare` command to enter the user namespace. All other storage drivers fail to mount. + +## RETURN VALUE +The location of the mounted file system. On error an empty string and errno is +returned. + +## OPTIONS + +#### **--all**, **-a** + +Mount all images. + +#### **--format**=*format* + +Print the mounted images in specified format (json). + +## EXAMPLE + +Mount multiple images. Note: In rootless mode, image mounting works only after executing the podman unshare command to enter the user namespace. +``` +podman image mount fedora ubi8-init +/var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +/var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged +``` + +List mounted images: +``` +podman image mount +registry.fedoraproject.org/fedora:latest /var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +registry.access.redhat.com/ubi8-init:latest /var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged +``` + +List mounted images in JSON format: +``` +podman image mount --format json +[ + { + "id": "00ff39a8bf19f810a7e641f7eb3ddc47635913a19c4996debd91fafb6b379069", + "Names": [ + "sha256:58de585a231aca14a511347bc85b912a6f000159b49bc2b0582032911e5d3a6c" + ], + "Repositories": [ + "registry.fedoraproject.org/fedora:latest" + ], + "mountpoint": "/var/lib/containers/storage/overlay/0ccfac04663bbe8813b5f24502ee0b7371ce5bf3c5adeb12e4258d191c2cf7bc/merged" + }, + { + "id": "bcc2dc9a261774ad25a15e07bb515f9b77424266abf2a1252ec7bcfed1dd0ac2", + "Names": [ + "sha256:d5f260b2e51b3ee9d05de1c31d261efc9af28e7d2d47cedf054c496d71424d63" + ], + "Repositories": [ + "registry.access.redhat.com/ubi8-init:latest" + ], + "mountpoint": "/var/lib/containers/storage/overlay/d66b58e3391ea8ce4c81316c72e22b332618f2a28b461a32ed673e8998cdaeb8/merged" + } +] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image(1)](podman-image.1.md)**, **[podman-image-unmount(1)](podman-image-unmount.1.md)**, **[podman-unshare(1)](podman-unshare.1.md)**, **mount(8)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-image-prune.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-image-prune.1.md new file mode 100644 index 000000000..eb001b175 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-image-prune.1.md @@ -0,0 +1,121 @@ +--- +title: podman-image-prune +version: v5.4.1 +--- + +% podman-image-prune 1 + +## NAME +podman-image-prune - Remove all unused images from the local store + +## SYNOPSIS +**podman image prune** [*options*] + +## DESCRIPTION +**podman image prune** removes all dangling images from local storage. With the `all` option, +all unused images are deleted (i.e., images not in use by any container). + +The image prune command does not prune cache images that only use layers that are necessary for other images. + +## OPTIONS +#### **--all**, **-a** + +Remove dangling images and images that have no associated containers. + +#### **--build-cache** + +Remove persistent build cache create for `--mount=type=cache`. + +#### **--external** + +Remove images even when they are used by external containers (e.g., build containers). + +#### **--filter**=*filters* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------:|--------------------------------------------------------------------------------------------------| +| label | Only remove images, with (or without, in the case of label!=[...] is used) the specified labels. | +| until | Only remove images created before given timestamp. | + + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes containers with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes containers without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not provide an interactive prompt for container removal. + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Remove all dangling images from local storage: +``` +$ sudo podman image prune + +WARNING! This will remove all dangling images. +Are you sure you want to continue? [y/N] y +f3e20dc537fb04cb51672a5cb6fdf2292e61d411315549391a0d1f64e4e3097e +324a7a3b2e0135f4226ffdd473e4099fd9e477a74230cdc35de69e84c0f9d907 +``` + +Remove all unused images from local storage without confirming: +``` +$ sudo podman image prune -a -f +f3e20dc537fb04cb51672a5cb6fdf2292e61d411315549391a0d1f64e4e3097e +324a7a3b2e0135f4226ffdd473e4099fd9e477a74230cdc35de69e84c0f9d907 +6125002719feb1ddf3030acab1df6156da7ce0e78e571e9b6e9c250424d6220c +91e732da5657264c6f4641b8d0c4001c218ae6c1adb9dcef33ad00cafd37d8b6 +e4e5109420323221f170627c138817770fb64832da7d8fe2babd863148287fca +77a57fa8285e9656dbb7b23d9efa837a106957409ddd702f995605af27a45ebe + +``` + +Remove all unused images from local storage since given time/hours: +``` +$ sudo podman image prune -a --filter until=2019-11-14T06:15:42.937792374Z + +WARNING! This will remove all dangling images. +Are you sure you want to continue? [y/N] y +e813d2135f17fadeffeea8159a34cfdd4c30b98d8111364b913a91fd930643e9 +5e6572320437022e2746467ddf5b3561bf06e099e8e6361df27e0b2a7ed0b17b +58fda2abf5042b35dfe04e5f8ee458a3cc26375bf309efb42c078b551a2055c7 +6d2bd30fe924d3414b64bd3920760617e6ced872364bc3bc6959a623252da002 +33d1c829be64a1e1d379caf4feec1f05a892c3ef7aa82c0be53d3c08a96c59c5 +f9f0a8a58c9e02a2b3250b88cc5c95b1e10245ca2c4161d19376580aaa90f55c +1ef14d5ede80db78978b25ad677fd3e897a578c3af614e1fda608d40c8809707 +45e1482040e441a521953a6da2eca9bafc769e15667a07c23720d6e0cafc3ab2 + +$ sudo podman image prune -f --filter until=10h +f3e20dc537fb04cb51672a5cb6fdf2292e61d411315549391a0d1f64e4e3097e +324a7a3b2e0135f4226ffdd473e4099fd9e477a74230cdc35de69e84c0f9d907 +``` + +Remove all unused images from local storage with label version 1.0: +``` +$ sudo podman image prune -a -f --filter label=version=1.0 +e813d2135f17fadeffeea8159a34cfdd4c30b98d8111364b913a91fd930643e9 +5e6572320437022e2746467ddf5b3561bf06e099e8e6361df27e0b2a7ed0b17b +58fda2abf5042b35dfe04e5f8ee458a3cc26375bf309efb42c078b551a2055c7 +6d2bd30fe924d3414b64bd3920760617e6ced872364bc3bc6959a623252da002 +33d1c829be64a1e1d379caf4feec1f05a892c3ef7aa82c0be53d3c08a96c59c5 +f9f0a8a58c9e02a2b3250b88cc5c95b1e10245ca2c4161d19376580aaa90f55c +1ef14d5ede80db78978b25ad677fd3e897a578c3af614e1fda608d40c8809707 +45e1482040e441a521953a6da2eca9bafc769e15667a07c23720d6e0cafc3ab2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-images(1)](podman-images.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) +December 2020, converted filter information from docs.docker.com documentation by Dan Walsh (dwalsh at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-image-scp.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-image-scp.1.md new file mode 100644 index 000000000..346b89dff --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-image-scp.1.md @@ -0,0 +1,107 @@ +--- +title: podman-image-scp +version: v5.4.1 +--- + +% podman-image-scp 1 + +## NAME +podman-image-scp - Securely copy an image from one host to another + +## SYNOPSIS +**podman image scp** [*options*] *name*[:*tag*] + +## DESCRIPTION +**podman image scp** copies container images between hosts on a network. This command can copy images to the remote host or from the remote host as well as between two remote hosts. +Note: `::` is used to specify the image name depending on Podman is saving or loading. Images can also be transferred from rootful to rootless storage on the same machine without using sshd. This feature is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. + +**podman image scp [GLOBAL OPTIONS]** + +**podman image** *scp [OPTIONS] NAME[:TAG] [HOSTNAME::]* + +**podman image** *scp [OPTIONS] [HOSTNAME::]IMAGENAME* + +**podman image** *scp [OPTIONS] [HOSTNAME::]IMAGENAME [HOSTNAME::]* + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--quiet**, **-q** + +Suppress the output + +## EXAMPLES + +Copy specified image to local storage: +``` +$ podman image scp alpine +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image from local storage to remote connection: +``` +$ podman image scp alpine Fedora::/home/charliedoern/Documents/alpine +Getting image source signatures +Copying blob 72e830a4dff5 done +Copying config 85f9dc67c7 done +Writing manifest to image destination +Storing signatures +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image from remote connection to remote connection: +``` +$ podman image scp Fedora::alpine RHEL:: +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image via ssh to local storage: +``` +$ podman image scp charliedoern@192.168.68.126:22/run/user/1000/podman/podman.sock::alpine +WARN[0000] Unknown connection name given. Please use system connection add to specify the default remote socket location +Getting image source signatures +Copying blob 9450ef9feb15 [--------------------------------------] 0.0b / 0.0b +Copying config 1f97f0559c done +Writing manifest to image destination +Storing signatures +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image from root account to user accounts local storage: +``` +$ sudo podman image scp root@localhost::alpine username@localhost:: +Copying blob e2eb06d8af82 done +Copying config 696d33ca15 done +Writing manifest to image destination +Storing signatures +Getting image source signatures +Copying blob 5eb901baf107 skipped: already exists +Copying config 696d33ca15 done +Writing manifest to image destination +Storing signatures +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image from root account to local storage: +``` +$ sudo podman image scp root@localhost::alpine +Copying blob e2eb06d8af82 done +Copying config 696d33ca15 done +Writing manifest to image destination +Storing signatures +Getting image source signatures +Copying blob 5eb901baf107 +Copying config 696d33ca15 done +Writing manifest to image destination +Storing signatures +Loaded image: docker.io/library/alpine:latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-load(1)](podman-load.1.md)**, **[podman-save(1)](podman-save.1.md)**, **[podman-remote(1)](podman-remote.1.md)**, **[podman-system-connection-add(1)](podman-system-connection-add.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** + +## HISTORY +July 2021, Originally written by Charlie Doern diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-image-sign.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-image-sign.1.md new file mode 100644 index 000000000..eaf8b7e9b --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-image-sign.1.md @@ -0,0 +1,94 @@ +--- +title: podman-image-sign +version: v5.4.1 +--- + +% podman-image-sign 1 + +## NAME +podman-image-sign - Create a signature for an image + +## SYNOPSIS +**podman image sign** [*options*] *image* [*image* ...] + +## DESCRIPTION +**podman image sign** creates a local signature for one or more local images that have +been pulled from a registry. The signature is written to a directory +derived from the registry configuration files in `$HOME/.config/containers/registries.d` if it exists, +otherwise `/etc/containers/registries.d` (unless overridden at compile-time), see **containers-registries.d(5)** for more information. +By default, the signature is written into `/var/lib/containers/sigstore` for root and `$HOME/.local/share/containers/sigstore` for non-root users + +## OPTIONS + +#### **--all**, **-a** + +Sign all the manifests of the multi-architecture image (default false). + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + +#### **--directory**, **-d**=*dir* + +Store the signatures in the specified directory. Default: /var/lib/containers/sigstore + +#### **--help**, **-h** + +Print usage statement. + +#### **--sign-by**=*identity* + +Override the default identity of the signature. + +## EXAMPLES +Sign the busybox image with the identity of foo@bar.com with a user's keyring and save the signature in /tmp/signatures/. + +```bash + $ sudo podman image sign --sign-by foo@bar.com --directory /tmp/signatures docker://privateregistry.example.com/foobar + + $ sudo podman image sign --authfile=/tmp/foobar.json --sign-by foo@bar.com --directory /tmp/signatures docker://privateregistry.example.com/foobar +``` + +## RELATED CONFIGURATION + +The write (and read) location for signatures is defined in YAML-based +configuration files in /etc/containers/registries.d/ for root, +or $HOME/.config/containers/registries.d for non-root users. When signing +an image, Podman uses those configuration files to determine +where to write the signature based on the name of the originating +registry or a default storage value unless overridden with the --directory +option. For example, consider the following configuration file. + +```yaml +docker: + privateregistry.example.com: + sigstore: file:///var/lib/containers/sigstore +``` + +When signing an image preceded with the registry name 'privateregistry.example.com', +the signature is written into sub-directories of +/var/lib/containers/sigstore/privateregistry.example.com. The use of 'sigstore' also means +the signature is 'read' from that same location on a pull-related function. + +## SEE ALSO +**[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.d(5)](https://github.com/containers/image/blob/main/docs/containers-registries.d.5.md)** + +## HISTORY +November 2018, Originally compiled by Qi Wang (qiwan at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-image-tree.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-image-tree.1.md new file mode 100644 index 000000000..67dc0fcf7 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-image-tree.1.md @@ -0,0 +1,91 @@ +--- +title: podman-image-tree +version: v5.4.1 +--- + +% podman-image-tree 1 + +## NAME +podman\-image\-tree - Print layer hierarchy of an image in a tree format + +## SYNOPSIS +**podman image tree** [*options*] *image:tag*|*image-id* + + +## DESCRIPTION +Prints layer hierarchy of an image in a tree format. +If no *tag* is provided, Podman defaults to `latest` for the *image*. +Layers are indicated with image tags as `Top Layer of`, when the tag is known locally. +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--whatrequires** + +Show all child images and layers of the specified image + +## EXAMPLES + +List image tree information on specified image: +``` +$ podman image tree docker.io/library/wordpress +Image ID: 6e880d17852f +Tags: [docker.io/library/wordpress:latest] +Size: 429.9MB +Image Layers +├── ID: 3c816b4ead84 Size: 58.47MB +├── ID: e39dad2af72e Size: 3.584kB +├── ID: b2d6a702383c Size: 213.6MB +├── ID: 94609408badd Size: 3.584kB +├── ID: f4dddbf86725 Size: 43.04MB +├── ID: 8f695df43a4c Size: 11.78kB +├── ID: c29d67bf8461 Size: 9.728kB +├── ID: 23f4315918f8 Size: 7.68kB +├── ID: d082f93a18b3 Size: 13.51MB +├── ID: 7ea8bedcac69 Size: 4.096kB +├── ID: dc3bbf7b3dc0 Size: 57.53MB +├── ID: fdbbc6404531 Size: 11.78kB +├── ID: 8d24785437c6 Size: 4.608kB +├── ID: 80715f9e8880 Size: 4.608kB Top Layer of: [docker.io/library/php:7.2-apache] +├── ID: c93cbcd6437e Size: 3.573MB +├── ID: dece674f3cd1 Size: 4.608kB +├── ID: 834f4497afda Size: 7.168kB +├── ID: bfe2ce1263f8 Size: 40.06MB +└── ID: 748e99b214cf Size: 11.78kB Top Layer of: [docker.io/library/wordpress:latest] +``` + +Show all child images and layers of the specified image: +``` +$ podman image tree ae96a4ad4f3f --whatrequires +Image ID: ae96a4ad4f3f +Tags: [docker.io/library/ruby:latest] +Size: 894.2MB +Image Layers +└── ID: 9c92106221c7 Size: 2.56kB Top Layer of: [docker.io/library/ruby\:latest] + ├── ID: 1b90f2b80ba0 Size: 3.584kB + │ ├── ID: 42b7d43ae61c Size: 169.5MB + │ ├── ID: 26dc8ba99ec3 Size: 2.048kB + │ ├── ID: b4f822db8d95 Size: 3.957MB + │ ├── ID: 044e9616ef8a Size: 164.7MB + │ ├── ID: bf94b940200d Size: 11.75MB + │ ├── ID: 4938e71bfb3b Size: 8.532MB + │ └── ID: f513034bf553 Size: 1.141MB + ├── ID: 1e55901c3ea9 Size: 3.584kB + ├── ID: b62835a63f51 Size: 169.5MB + ├── ID: 9f4e8857f3fd Size: 2.048kB + ├── ID: c3b392020e8f Size: 3.957MB + ├── ID: 880163026a0a Size: 164.8MB + ├── ID: 8c78b2b14643 Size: 11.75MB + ├── ID: 830370cfa182 Size: 8.532MB + └── ID: 567fd7b7bd38 Size: 1.141MB Top Layer of: [docker.io/circleci/ruby\\:latest] + +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +Feb 2019, Originally compiled by Kunal Kushwaha `` diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-image-trust.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-image-trust.1.md new file mode 100644 index 000000000..f526410d6 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-image-trust.1.md @@ -0,0 +1,211 @@ +--- +title: podman-image-trust +version: v5.4.1 +--- + +% podman-image-trust 1 + +## NAME +podman\-image\-trust - Manage container registry image trust policy + + +## SYNOPSIS +**podman image trust** set|show [*options*] *registry[/repository]* + +## DESCRIPTION +Manages which registries to trust as a source of container images based on its location. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +The location is determined +by the transport and the registry host of the image. Using this container image `docker://docker.io/library/busybox` +as an example, `docker` is the transport and `docker.io` is the registry host. + +Trust is defined in **/etc/containers/policy.json** and is enforced when a user attempts to pull +a remote image from a registry. The trust policy in policy.json describes a registry scope (registry and/or repository) for the trust. This trust can use public keys for signed images. + +The scope of the trust is evaluated from most specific to the least specific. In other words, a policy may be: + + * Defined to an entire registry. + * Defined to a particular repository in that registry. + * Defined to a specific signed image inside of the registry. + +The following list are examples of valid scope values used in policy.json from most specific to the least specific: + +docker.io/library/busybox\:notlatest + +docker.io/library/busybox + +docker.io/library + +docker.io + +If no configuration is found for any of these scopes, the default value (specified by using "default" instead of REGISTRY[/REPOSITORY]) is used. + +Trust **type** provides a way to: + +Allowlist ("accept") or +Denylist ("reject") registries or +Require a simple signing signature (“signedBy”), +Require a sigstore signature ("sigstoreSigned"). + +Trust may be updated using the command **podman image trust set** for an existing trust scope. + +## OPTIONS +#### **--help**, **-h** + Print usage statement. + +### set OPTIONS + +#### **--pubkeysfile**, **-f**=*KEY1* + A path to an exported public key on the local system. Key paths + are referenced in policy.json. Any path to a file may be used but locating the file in **/etc/pki/containers** is recommended. Options may be used multiple times to + require an image be signed by multiple keys. The **--pubkeysfile** option is required for the **signedBy** and **sigstoreSigned** types. + +#### **--type**, **-t**=*value* + The trust type for this policy entry. + Accepted values: + **signedBy** (default): Require simple signing signatures with corresponding list of + public keys + **sigstoreSigned**: Require sigstore signatures with corresponding list of + public keys + **accept**: do not require any signatures for this + registry scope + **reject**: do not accept images for this registry scope + +### show OPTIONS + +#### **--json**, **-j** + Output trust as JSON for machine parsing + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--raw** + Output trust policy file as raw JSON + +## EXAMPLES + +Accept all unsigned images from a registry: +``` +sudo podman image trust set --type accept docker.io +``` + +Modify default trust policy: +``` +sudo podman image trust set -t reject default +``` + +Display system trust policy: +``` +podman image trust show +TRANSPORT NAME TYPE ID STORE +all default reject +repository docker.io/library accept +repository registry.access.redhat.com signed security@redhat.com https://access.redhat.com/webassets/docker/content/sigstore +repository registry.redhat.io signed security@redhat.com https://registry.redhat.io/containers/sigstore +repository docker.io reject +docker-daemon accept +``` + +Display trust policy file: +``` +podman image trust show --raw +{ + "default": [ + { + "type": "reject" + } + ], + "transports": { + "docker": { + "docker.io": [ + { + "type": "reject" + } + ], + "docker.io/library": [ + { + "type": "insecureAcceptAnything" + } + ], + "registry.access.redhat.com": [ + { + "type": "signedBy", + "keyType": "GPGKeys", + "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" + } + ], + "registry.redhat.io": [ + { + "type": "signedBy", + "keyType": "GPGKeys", + "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" + } + ] + }, + "docker-daemon": { + "": [ + { + "type": "insecureAcceptAnything" + } + ] + } + } +} +``` + +Display trust as JSON: +``` +podman image trust show --json +[ + { + "transport": "all", + "name": "* (default)", + "repo_name": "default", + "type": "reject" + }, + { + "transport": "repository", + "name": "docker.io", + "repo_name": "docker.io", + "type": "reject" + }, + { + "transport": "repository", + "name": "docker.io/library", + "repo_name": "docker.io/library", + "type": "accept" + }, + { + "transport": "repository", + "name": "registry.access.redhat.com", + "repo_name": "registry.access.redhat.com", + "sigstore": "https://access.redhat.com/webassets/docker/content/sigstore", + "type": "signed", + "gpg_id": "security@redhat.com" + }, + { + "transport": "repository", + "name": "registry.redhat.io", + "repo_name": "registry.redhat.io", + "sigstore": "https://registry.redhat.io/containers/sigstore", + "type": "signed", + "gpg_id": "security@redhat.com" + }, + { + "transport": "docker-daemon", + "type": "accept" + } +] +``` + +## SEE ALSO +**[containers-policy.json(5)](https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md)** + +## HISTORY +January 2019, updated by Tom Sweeney (tsweeney at redhat dot com) +December 2018, originally compiled by Qi Wang (qiwan at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-image-unmount.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-image-unmount.1.md new file mode 100644 index 000000000..a3919e815 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-image-unmount.1.md @@ -0,0 +1,55 @@ +--- +title: podman-image-unmount +version: v5.4.1 +--- + +% podman-image-unmount 1 + +## NAME +podman\-image\-unmount - Unmount an image's root filesystem + +## SYNOPSIS +**podman image unmount** [*options*] *image* [...] + +**podman image umount** [*options*] *image* [...] + +## DESCRIPTION +Unmounts the specified images' root file system, if no other processes +are using it. + +Image storage increments a mount counter each time an image is mounted. +When an image is unmounted, the mount counter is decremented, and the +image's root filesystem is physically unmounted only when the mount +counter reaches zero indicating no other processes are using the mount. +An unmount can be forced with the --force flag. + +## OPTIONS +#### **--all**, **-a** + +All of the currently mounted images are unmounted. + +#### **--force**, **-f** + +Force the unmounting of specified images' root file system, even if other +processes have mounted it. + +Note: Other processes using the file system can fail if the mount point is removed without their knowledge. + +## EXAMPLE + +Unmount image with a given ID: +``` +podman image unmount imageID +``` + +Unmount multiple images with given IDs: +``` +podman image unmount imageID1 imageID2 imageID3 +``` + +Unmount all images: +``` +podman image unmount --all +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image-mount(1)](podman-image-mount.1.md)**, **[podman-mount(1)](podman-mount.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-image.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-image.1.md new file mode 100644 index 000000000..024b8f55a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-image.1.md @@ -0,0 +1,45 @@ +--- +title: podman-image +version: v5.4.1 +--- + +% podman-image 1 + +## NAME +podman\-image - Manage images + +## SYNOPSIS +**podman image** *subcommand* + +## DESCRIPTION +The image command allows the management of images + +## COMMANDS + +| Command | Man Page | Description | +| -------- | --------------------------------------------------- | ----------------------------------------------------------------------- | +| build | [podman-build(1)](podman-build.1.md) | Build a container using a Dockerfile. | +| diff | [podman-image-diff(1)](podman-image-diff.1.md) | Inspect changes on an image's filesystem. | +| exists | [podman-image-exists(1)](podman-image-exists.1.md) | Check if an image exists in local storage. | +| history | [podman-history(1)](podman-history.1.md) | Show the history of an image. | +| import | [podman-import(1)](podman-import.1.md) | Import a tarball and save it as a filesystem image. | +| inspect | [podman-image-inspect(1)](podman-image-inspect.1.md)| Display an image's configuration. | +| list | [podman-images(1)](podman-images.1.md) | List the container images on the system.(alias ls) | +| load | [podman-load(1)](podman-load.1.md) | Load an image from the docker archive. | +| mount | [podman-image-mount(1)](podman-image-mount.1.md) | Mount an image's root filesystem. | +| prune | [podman-image-prune(1)](podman-image-prune.1.md) | Remove all unused images from the local store. | +| pull | [podman-pull(1)](podman-pull.1.md) | Pull an image from a registry. | +| push | [podman-push(1)](podman-push.1.md) | Push an image from local storage to elsewhere. | +| rm | [podman-rmi(1)](podman-rmi.1.md) | Remove one or more locally stored images. | +| save | [podman-save(1)](podman-save.1.md) | Save an image to docker-archive or oci. | +| scp | [podman-image-scp(1)](podman-image-scp.1.md) | Securely copy an image from one host to another. | +| search | [podman-search(1)](podman-search.1.md) | Search a registry for an image. | +| sign | [podman-image-sign(1)](podman-image-sign.1.md) | Create a signature for an image. | +| tag | [podman-tag(1)](podman-tag.1.md) | Add an additional name to a local image. | +| tree | [podman-image-tree(1)](podman-image-tree.1.md) | Print layer hierarchy of an image in a tree format. | +| trust | [podman-image-trust(1)](podman-image-trust.1.md) | Manage container registry image trust policy. | +| unmount | [podman-image-unmount(1)](podman-image-unmount.1.md) | Unmount an image's root filesystem. | +| untag | [podman-untag(1)](podman-untag.1.md) | Remove one or more names from a locally-stored image. | + +## SEE ALSO +**[podman(1)](podman.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-images.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-images.1.md new file mode 100644 index 000000000..1c869571b --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-images.1.md @@ -0,0 +1,268 @@ +--- +title: podman-images +version: v5.4.1 +--- + +% podman-images 1 + +## NAME +podman\-images - List images in local storage + +## SYNOPSIS +**podman images** [*options*] [image] + +**podman image list** [*options*] [image] + +**podman image ls** [*options*] [image] + +## DESCRIPTION +Displays locally stored images, their names, and their IDs. + +## OPTIONS + +#### **--all**, **-a** + +Show all images (by default filter out the intermediate image layers). The default is false. + +#### **--digests** + +Show image digests + +#### **--filter**, **-f**=*filter* + +Provide filter values. + +The *filters* argument format is of `key=value` or `key!=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------------:|-----------------------------------------------------------------------------------------------| +| id | Filter by image ID. | +| before | Filter by images created before the given IMAGE (name or tag). | +| containers | Filter by images with a running container. | +| dangling | Filter by dangling (unused) images. | +| digest | Filter by digest. | +| intermediate | Filter by images that are dangling and have no children | +| label | Filter by images with (or without, in the case of label!=[...] is used) the specified labels. | +| manifest | Filter by images that are manifest lists. | +| readonly | Filter by read-only or read/write images. | +| reference | Filter by image name. | +| after/since | Filter by images created after the given IMAGE (name or tag). | +| until | Filter by images created until the given duration or time. | + +The `id` *filter* accepts the image ID string. + +The `before` *filter* accepts formats: `[:]`, `` or ``. + +The `containers` *filter* shows images that have a running container based on that image. + +The `dangling` *filter* shows images that are taking up disk space and serve no purpose. Dangling image is a file system layer that was used in a previous build of an image and is no longer referenced by any image. They are denoted with the `` tag, consume disk space and serve no active purpose. + +The `digest` *filter* accepts the image digest string. + +The `intermediate` *filter* shows images that are dangling and have no children. + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which shows images with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which shows images without the specified labels. + +The `manifest` *filter* shows images that are manifest lists. + +The `readonly` *filter* shows, as a default, both read-only and read/write images. Read-only images can be configured by modifying the `additionalimagestores` in the `/etc/containers/storage.conf` file. + +The `reference` *filter* accepts the pattern of an image reference `[:]`. + +The `after` or `since` *filter* accepts formats: `[:]`, `` or ``. + +The `until` *filter* accepts formats: golang duration, RFC3339 time, or a Unix timestamp and shows all images that are created until that time. + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|-----------------|------------------------------------------------------------| +| .Containers | Number of containers using this image | +| .Created | Elapsed time since the image was created | +| .CreatedAt | Time when the image was created, YYYY-MM-DD HH\:MM\:SS +nnnn | +| .CreatedSince | Same as .Created | +| .CreatedTime | Same as .CreatedAt | +| .Dangling | Same as .IsDangling | +| .Digest | Image digest | +| .History | History of the image layer | +| .ID | Image ID (truncated) | +| .Id | Image ID (full SHA) | +| .IsDangling | Is image dangling? (true/false) | +| .IsReadOnly | Is unage read-only? (true/false) | +| .Labels ... | map[] of labels | +| .Names | Image FQIN | +| .ParentId | Full SHA of parent image ID, or null (string) | +| .ReadOnly | Same as .IsReadOnly | +| .RepoDigests | map[] of zero or more repo/name@sha256\:SHA strings | +| .Repository | Image repository | +| .RepoTags | map[] of zero or more FQIN strings for this image | +| .SharedSize | Always seems to be 0 | +| .Size | Size of layer on disk (human-friendly string) | +| .Tag | Image tag | +| .VirtualSize | Size of layer on disk (bytes) | + +#### **--history** + +Display the history of image names. If an image gets re-tagged or untagged, then the image name history gets prepended (latest image first). This is especially useful when undoing a tag operation or an image does not contain any name because it has been untagged. + + +[//]: # (BEGIN included file options/no-trunc.md) +#### **--no-trunc** + +Do not truncate the output (default *false*). + +[//]: # (END included file options/no-trunc.md) + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Lists only the image IDs. + +#### **--sort**=*sort* + +Sort by *created*, *id*, *repository*, *size* or *tag* (default: **created**) +When sorting by *repository* it also sorts by the *tag* as second criteria to provide a stable output. + +## EXAMPLE + +List all non-dangling images in local storage: +``` +$ podman images +REPOSITORY TAG IMAGE ID CREATED SIZE +quay.io/podman/stable latest e0b7dabc3352 22 hours ago 331 MB +docker.io/library/alpine latest 9c6f07244728 5 days ago 5.83 MB +registry.fedoraproject.org/fedora latest 2ecb6df95994 3 weeks ago 169 MB +quay.io/libpod/testimage 20220615 f26aa69bb3f3 2 months ago 8.4 MB +``` + +List all images matching the specified name: +``` +$ podman images stable +REPOSITORY TAG IMAGE ID CREATED SIZE +quay.io/podman/stable latest e0b7dabc3352 22 hours ago 331 MB +``` + +List image ids of all images in containers storage: +``` +# podman image ls --quiet +e3d42bcaf643 +ebb91b73692b +4526339ae51c +``` + +List all images without showing the headers: +``` +# podman images --noheading +docker.io/kubernetes/pause latest e3d42bcaf643 3 years ago 251 kB + ebb91b73692b 4 weeks ago 27.2 MB +docker.io/library/ubuntu latest 4526339ae51c 6 weeks ago 126 MB +``` + +List all images without truncating output: +``` +# podman image list --no-trunc +REPOSITORY TAG IMAGE ID CREATED SIZE +docker.io/kubernetes/pause latest sha256:e3d42bcaf643097dd1bb0385658ae8cbe100a80f773555c44690d22c25d16b27 3 years ago 251 kB + sha256:ebb91b73692bd27890685846412ae338d13552165eacf7fcd5f139bfa9c2d6d9 4 weeks ago 27.2 MB +docker.io/library/ubuntu latest sha256:4526339ae51c3cdc97956a7a961c193c39dfc6bd9733b0d762a36c6881b5583a 6 weeks ago 126 MB +``` + +List all image content with the formatted content: +``` +# podman images --format "table {{.ID}} {{.Repository}} {{.Tag}}" +IMAGE ID REPOSITORY TAG +e3d42bcaf643 docker.io/kubernetes/pause latest +ebb91b73692b +4526339ae51c docker.io/library/ubuntu latest +``` + +List any image that is not tagged with a name (dangling): +``` +# podman images --filter dangling=true +REPOSITORY TAG IMAGE ID CREATED SIZE + ebb91b73692b 4 weeks ago 27.2 MB +``` + +List all images in JSON format: +``` +# podman images --format json +[ + { + "id": "e3d42bcaf643097dd1bb0385658ae8cbe100a80f773555c44690d22c25d16b27", + "names": [ + "docker.io/kubernetes/pause:latest" + ], + "digest": "sha256:0aecf73ff86844324847883f2e916d3f6984c5fae3c2f23e91d66f549fe7d423", + "created": "2014-07-19T07:02:32.267701596Z", + "size": 250665 + }, + { + "id": "ebb91b73692bd27890685846412ae338d13552165eacf7fcd5f139bfa9c2d6d9", + "names": [ + "\u003cnone\u003e" + ], + "digest": "sha256:ba7e4091d27e8114a205003ca6a768905c3395d961624a2c78873d9526461032", + "created": "2017-10-26T03:07:22.796184288Z", + "size": 27170520 + }, + { + "id": "4526339ae51c3cdc97956a7a961c193c39dfc6bd9733b0d762a36c6881b5583a", + "names": [ + "docker.io/library/ubuntu\:latest" + ], + "digest": "sha256:193f7734ddd68e0fb24ba9af8c2b673aecb0227b026871f8e932dab45add7753", + "created": "2017-10-10T20:59:05.10196344Z", + "size": 126085200 + } +] +``` + +List all images sorted by the specified column: +``` +# podman images --sort repository +REPOSITORY TAG IMAGE ID CREATED SIZE + 2460217d76fc About a minute ago 4.41 MB +docker.io/library/alpine latest 3fd9065eaf02 5 months ago 4.41 MB +localhost/myapp latest b2e0ad03474a About a minute ago 4.41 MB +registry.access.redhat.com/rhel7 latest 7a840db7f020 2 weeks ago 211 MB +registry.fedoraproject.org/fedora 27 801894bc0e43 6 weeks ago 246 MB +``` + +Show the difference between listed images in use versus all images, including dangling images: +``` +# podman images +REPOSITORY TAG IMAGE ID CREATED SIZE +localhost/test latest 18f0c080cd72 4 seconds ago 4.42 MB +docker.io/library/alpine latest 3fd9065eaf02 5 months ago 4.41 MB +# podman images -a +REPOSITORY TAG IMAGE ID CREATED SIZE +localhost/test latest 18f0c080cd72 6 seconds ago 4.42 MB + 270e70dc54c0 7 seconds ago 4.42 MB + 4ed6fbe43414 8 seconds ago 4.41 MB + 6b0df8e71508 8 seconds ago 4.41 MB +docker.io/library/alpine latest 3fd9065eaf02 5 months ago 4.41 MB +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +March 2017, Originally compiled by Dan Walsh `` diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-import.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-import.1.md new file mode 100644 index 000000000..2dd79aeed --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-import.1.md @@ -0,0 +1,121 @@ +--- +title: podman-import +version: v5.4.1 +--- + +% podman-import 1 + +## NAME +podman\-import - Import a tarball and save it as a filesystem image + +## SYNOPSIS +**podman import** [*options*] *path* [*reference*] + +**podman image import** [*options*] *path* [*reference*] + +## DESCRIPTION +**podman import** imports a tarball (.tar, .tar.gz, .tgz) +and saves it as a filesystem image. Remote tarballs can be specified using a URL. +Various image instructions can be configured with the **--change** flag and +a commit message can be set using the **--message** flag. +**reference**, if present, is a tag to assign to the image. +**podman import** is used for importing from the archive generated by **podman export**, that includes the container's filesystem. To import the archive of image layers created by **podman save**, use **podman load**. +Note: `:` is a restricted character and cannot be part of the file name. + +## OPTIONS + +#### **--arch** + +Set architecture of the imported image. + +#### **--change**, **-c**=*instruction* + +Apply the following possible instructions to the created image: +**CMD** | **ENTRYPOINT** | **ENV** | **EXPOSE** | **LABEL** | **STOPSIGNAL** | **USER** | **VOLUME** | **WORKDIR** + +Can be set multiple times + +#### **--help**, **-h** + +Print usage statement + +#### **--message**, **-m**=*message* + +Set commit message for imported image + +#### **--os** + +Set OS of the imported image. + +#### **--quiet**, **-q** + +Shows progress on the import + +#### **--variant** + +Set variant of the imported image. + +## EXAMPLES + +Import the selected tarball into new image, specifying the CMD, ENTRYPOINT and LABEL: +``` +$ podman import --change CMD=/bin/bash --change ENTRYPOINT=/bin/sh --change LABEL=blue=image ctr.tar image-imported +Getting image source signatures +Copying blob sha256:b41deda5a2feb1f03a5c1bb38c598cbc12c9ccd675f438edc6acd815f7585b86 + 25.80 MB / 25.80 MB [======================================================] 0s +Copying config sha256:c16a6d30f3782288ec4e7521c754acc29d37155629cb39149756f486dae2d4cd + 448 B / 448 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +db65d991f3bbf7f31ed1064db9a6ced7652e3f8166c4736aa9133dadd3c7acb3 +``` + +Import the selected tarball into new image, specifying the CMD, ENTRYPOINT and LABEL: +``` +$ podman import --change 'ENTRYPOINT ["/bin/sh","-c","test-image"]' --change LABEL=blue=image test-image.tar image-imported +Getting image source signatures +Copying blob e3b0c44298fc skipped: already exists +Copying config 1105523502 done +Writing manifest to image destination +Storing signatures +110552350206337183ceadc0bdd646dc356e06514c548b69a8917b4182414b +``` + +Import new tagged image from stdin in quiet mode: +``` +$ cat ctr.tar | podman -q import --message "importing the ctr.tar file" - image-imported +db65d991f3bbf7f31ed1064db9a6ced7652e3f8166c4736aa9133dadd3c7acb3 +``` + +Import an image from stdin: +``` +$ cat ctr.tar | podman import - +Getting image source signatures +Copying blob sha256:b41deda5a2feb1f03a5c1bb38c598cbc12c9ccd675f438edc6acd815f7585b86 + 25.80 MB / 25.80 MB [======================================================] 0s +Copying config sha256:d61387b4d5edf65edee5353e2340783703074ffeaaac529cde97a8357eea7645 + 378 B / 378 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +db65d991f3bbf7f31ed1064db9a6ced7652e3f8166c4736aa9133dadd3c7acb3 +``` + +Import named image from tarball via a URL: +``` +$ podman import http://example.com/ctr.tar url-image +Downloading from "http://example.com/ctr.tar" +Getting image source signatures +Copying blob sha256:b41deda5a2feb1f03a5c1bb38c598cbc12c9ccd675f438edc6acd815f7585b86 + 25.80 MB / 25.80 MB [======================================================] 0s +Copying config sha256:5813fe8a3b18696089fd09957a12e88bda43dc1745b5240879ffffe93240d29a + 419 B / 419 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +db65d991f3bbf7f31ed1064db9a6ced7652e3f8166c4736aa9133dadd3c7acb3 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-export(1)](podman-export.1.md)** + +## HISTORY +November 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-info.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-info.1.md new file mode 100644 index 000000000..5b2359e4b --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-info.1.md @@ -0,0 +1,409 @@ +--- +title: podman-info +version: v5.4.1 +--- + +% podman-info 1 + +## NAME +podman\-info - Display Podman related system information + +## SYNOPSIS +**podman info** [*options*] + +**podman system info** [*options*] + +## DESCRIPTION + +Displays information pertinent to the host, current storage stats, configured container registries, and build of podman. + + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change output format to "json" or a Go template. + +| **Placeholder** | **Info pertaining to ...** | +| ------------------- | --------------------------------------- | +| .Host ... | ...the host on which podman is running | +| .Plugins ... | ...external plugins | +| .Registries ... | ...configured registries | +| .Store ... | ...the storage driver and paths | +| .Version ... | ...podman version | + +Each of the above branch out into further subfields, more than can +reasonably be enumerated in this document. + +## EXAMPLES + +Run `podman info` for a YAML formatted response: +``` +$ podman info +host: + arch: amd64 + buildahVersion: 1.23.0 + cgroupControllers: [] + cgroupManager: systemd + cgroupVersion: v2 + conmon: + package: conmon-2.0.29-2.fc34.x86_64 + path: /usr/bin/conmon + version: 'conmon version 2.0.29, commit: ' + cpu_utilization: + idle_percent: 96.84 + system_percent: 0.71 + user_percent: 2.45 + cpus: 8 + distribution: + distribution: fedora + variant: workstation + version: "34" + eventLogger: journald + hostname: localhost.localdomain + idMappings: + gidmap: + - container_id: 0 + host_id: 3267 + size: 1 + - container_id: 1 + host_id: 100000 + size: 65536 + uidmap: + - container_id: 0 + host_id: 3267 + size: 1 + - container_id: 1 + host_id: 100000 + size: 65536 + kernel: 5.13.13-200.fc34.x86_64 + linkmode: dynamic + logDriver: journald + memFree: 1833385984 + memTotal: 16401895424 + networkBackend: cni + networkBackendInfo: + backend: cni + dns: + package: podman-plugins-3.4.4-1.fc34.x86_64 + path: /usr/libexec/cni/dnsname + version: |- + CNI dnsname plugin + version: 1.3.1 + commit: unknown + package: |- + containernetworking-plugins-1.0.1-1.fc34.x86_64 + podman-plugins-3.4.4-1.fc34.x86_64 + path: /usr/libexec/cni + ociRuntime: + name: crun + package: crun-1.0-1.fc34.x86_64 + path: /usr/bin/crun + version: |- + crun version 1.0 + commit: 139dc6971e2f1d931af520188763e984d6cdfbf8 + spec: 1.0.0 + +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL + os: linux + pasta: + executable: /usr/bin/passt + package: passt-0^20221116.gace074c-1.fc34.x86_64 + version: | + passt 0^20221116.gace074c-1.fc34.x86_64 + Copyright Red Hat + GNU Affero GPL version 3 or later + This is free software: you are free to change and redistribute it. + There is NO WARRANTY, to the extent permitted by law. + remoteSocket: + path: /run/user/3267/podman/podman.sock + security: + apparmorEnabled: false + capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID + rootless: true + seccompEnabled: true + seccompProfilePath: /usr/share/containers/seccomp.json + selinuxEnabled: true + serviceIsRemote: false + slirp4netns: + executable: /bin/slirp4netns + package: slirp4netns-1.1.12-2.fc34.x86_64 + version: |- + slirp4netns version 1.1.12 + commit: 7a104a101aa3278a2152351a082a6df71f57c9a3 + libslirp: 4.4.0 + SLIRP_CONFIG_VERSION_MAX: 3 + libseccomp: 2.5.0 + swapFree: 15687475200 + swapTotal: 16886259712 + uptime: 47h 15m 9.91s (Approximately 1.96 days) +plugins: + log: + - k8s-file + - none + - journald + network: + - bridge + - macvlan + volume: + - local +registries: + search: + - registry.fedoraproject.org + - registry.access.redhat.com + - docker.io + - quay.io +store: + configFile: /home/dwalsh/.config/containers/storage.conf + containerStore: + number: 9 + paused: 0 + running: 1 + stopped: 8 + graphDriverName: overlay + graphOptions: {} + graphRoot: /home/dwalsh/.local/share/containers/storage + graphRootAllocated: 510389125120 + graphRootUsed: 129170714624 + graphStatus: + Backing Filesystem: extfs + Native Overlay Diff: "true" + Supports d_type: "true" + Using metacopy: "false" + imageCopyTmpDir: /home/dwalsh/.local/share/containers/storage/tmp + imageStore: + number: 5 + runRoot: /run/user/3267/containers + transientStore: false + volumePath: /home/dwalsh/.local/share/containers/storage/volumes +version: + APIVersion: 4.0.0 + Built: 1631648722 + BuiltTime: Tue Sep 14 15:45:22 2021 + GitCommit: 23677f92dd83e96d2bc8f0acb611865fb8b1a56d + GoVersion: go1.16.6 + OsArch: linux/amd64 + Version: 4.0.0 +``` + +Run `podman info --format json` for a JSON formatted response: +``` +$ podman info --format json +{ + "host": { + "arch": "amd64", + "buildahVersion": "1.23.0", + "cgroupManager": "systemd", + "cgroupVersion": "v2", + "cgroupControllers": [], + "conmon": { + "package": "conmon-2.0.29-2.fc34.x86_64", + "path": "/usr/bin/conmon", + "version": "conmon version 2.0.29, commit: " + }, + "cpus": 8, + "distribution": { + "distribution": "fedora", + "version": "34" + }, + "eventLogger": "journald", + "hostname": "localhost.localdomain", + "idMappings": { + "gidmap": [ + { + "container_id": 0, + "host_id": 3267, + "size": 1 + }, + { + "container_id": 1, + "host_id": 100000, + "size": 65536 + } + ], + "uidmap": [ + { + "container_id": 0, + "host_id": 3267, + "size": 1 + }, + { + "container_id": 1, + "host_id": 100000, + "size": 65536 + } + ] + }, + "kernel": "5.13.13-200.fc34.x86_64", + "logDriver": "journald", + "memFree": 1785753600, + "memTotal": 16401895424, + "networkBackend": "cni", + "networkBackendInfo": { + "backend": "cni", + "package": "containernetworking-plugins-1.0.1-1.fc34.x86_64\npodman-plugins-3.4.4-1.fc34.x86_64", + "path": "/usr/libexec/cni", + "dns": { + "version": "CNI dnsname plugin\nversion: 1.3.1\ncommit: unknown", + "package": "podman-plugins-3.4.4-1.fc34.x86_64", + "path": "/usr/libexec/cni/dnsname" + } + }, + "ociRuntime": { + "name": "crun", + "package": "crun-1.0-1.fc34.x86_64", + "path": "/usr/bin/crun", + "version": "crun version 1.0\ncommit: 139dc6971e2f1d931af520188763e984d6cdfbf8\nspec: 1.0.0\n+SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL" + }, + "os": "linux", + "remoteSocket": { + "path": "/run/user/3267/podman/podman.sock" + }, + "serviceIsRemote": false, + "security": { + "apparmorEnabled": false, + "capabilities": "CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID", + "rootless": true, + "seccompEnabled": true, + "seccompProfilePath": "/usr/share/containers/seccomp.json", + "selinuxEnabled": true + }, + "slirp4netns": { + "executable": "/bin/slirp4netns", + "package": "slirp4netns-1.1.12-2.fc34.x86_64", + "version": "slirp4netns version 1.1.12\ncommit: 7a104a101aa3278a2152351a082a6df71f57c9a3\nlibslirp: 4.4.0\nSLIRP_CONFIG_VERSION_MAX: 3\nlibseccomp: 2.5.0" + }, + "pasta": { + "executable": "/usr/bin/passt", + "package": "passt-0^20221116.gace074c-1.fc34.x86_64", + "version": "passt 0^20221116.gace074c-1.fc34.x86_64\nCopyright Red Hat\nGNU Affero GPL version 3 or later \u003chttps://www.gnu.org/licenses/agpl-3.0.html\u003e\nThis is free software: you are free to change and redistribute it.\nThere is NO WARRANTY, to the extent permitted by law.\n" + }, + "swapFree": 15687475200, + "swapTotal": 16886259712, + "uptime": "47h 17m 29.75s (Approximately 1.96 days)", + "linkmode": "dynamic" + }, + "store": { + "configFile": "/home/dwalsh/.config/containers/storage.conf", + "containerStore": { + "number": 9, + "paused": 0, + "running": 1, + "stopped": 8 + }, + "graphDriverName": "overlay", + "graphOptions": { + + }, + "graphRoot": "/home/dwalsh/.local/share/containers/storage", + "graphStatus": { + "Backing Filesystem": "extfs", + "Native Overlay Diff": "true", + "Supports d_type": "true", + "Using metacopy": "false" + }, + "imageCopyTmpDir": "/home/dwalsh/.local/share/containers/storage/tmp", + "imageStore": { + "number": 5 + }, + "runRoot": "/run/user/3267/containers", + "volumePath": "/home/dwalsh/.local/share/containers/storage/volumes", + "transientStore": false + }, + "registries": { + "search": [ + "registry.fedoraproject.org", + "registry.access.redhat.com", + "docker.io", + "quay.io" +] + }, + "plugins": { + "volume": [ + "local" + ], + "network": [ + "bridge", + "macvlan" + ], + "log": [ + "k8s-file", + "none", + "journald" + ] + }, + "version": { + "APIVersion": "4.0.0", + "Version": "4.0.0", + "GoVersion": "go1.16.6", + "GitCommit": "23677f92dd83e96d2bc8f0acb611865fb8b1a56d", + "BuiltTime": "Tue Sep 14 15:45:22 2021", + "Built": 1631648722, + "OsArch": "linux/amd64" + } +} +``` + +#### Extracting the list of container registries with a Go template + +If shell completion is enabled, type `podman info --format={{.` and then press `[TAB]` twice. + +``` +$ podman info --format={{. +{{.Host. {{.Plugins. {{.Registries}} {{.Store. {{.Version. +``` + +Press `R` `[TAB]` `[ENTER]` to print the registries information. + +``` +$ podman info -f {{.Registries}} +map[search:[registry.fedoraproject.org registry.access.redhat.com docker.io quay.io]] +$ +``` + +The output still contains a map and an array. The map value can be extracted with + +``` +$ podman info -f '{{index .Registries "search"}}' +[registry.fedoraproject.org registry.access.redhat.com docker.io quay.io] +``` + +The array can be printed as one entry per line + +``` +$ podman info -f '{{range index .Registries "search"}}{{.}}\n{{end}}' +registry.fedoraproject.org +registry.access.redhat.com +docker.io +quay.io + +``` + +#### Extracting the list of container registries from JSON with jq + +The command-line JSON processor [__jq__](https://stedolan.github.io/jq/) can be used to extract the list +of container registries. + +``` +$ podman info -f json | jq '.registries["search"]' +[ + "registry.fedoraproject.org", + "registry.access.redhat.com", + "docker.io", + "quay.io" +] +``` + +The array can be printed as one entry per line + +``` +$ podman info -f json | jq -r '.registries["search"] | .[]' +registry.fedoraproject.org +registry.access.redhat.com +docker.io +quay.io +``` + +Note, the Go template struct fields start with upper case. When running `podman info` or `podman info --format=json`, the same names start with lower case. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-init.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-init.1.md new file mode 100644 index 000000000..6beff658c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-init.1.md @@ -0,0 +1,61 @@ +--- +title: podman-init +version: v5.4.1 +--- + +% podman-init 1 + +## NAME +podman\-init - Initialize one or more containers + +## SYNOPSIS +**podman init** [*options*] *container* [*container*...] + +**podman container init** [*options*] *container* [*container*...] + +## DESCRIPTION +Initialize one or more containers. +You may use container IDs or names as input. +Initializing a container performs all tasks necessary for starting the container (mounting filesystems, creating an OCI spec, initializing the container network) but does not start the container. +If a container is not initialized, the `podman start` and `podman run` commands initialize it automatically prior to starting it. +This command is intended to be used for inspecting a container's filesystem or OCI spec prior to starting it. +This can be used to inspect the container before it runs, or debug why a container is failing to run. + +## OPTIONS + +#### **--all**, **-a** + +Initialize all containers. Containers that have already initialized (including containers that have been started and are running) are ignored. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Initialize specified container with a given ID. +``` +podman init 35480fc9d568 +``` + +Initialize specified container with a given name. +``` +podman init test1 +``` + +Initialize the latest container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +podman init --latest +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-start(1)](podman-start.1.md)** + +## HISTORY +April 2019, Originally compiled by Matthew Heon diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-inspect.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-inspect.1.md new file mode 100644 index 000000000..bf2b6532e --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-inspect.1.md @@ -0,0 +1,185 @@ +--- +title: podman-inspect +version: v5.4.1 +--- + +% podman-inspect 1 + +## NAME +podman\-inspect - Display a container, image, volume, network, or pod's configuration + +## SYNOPSIS +**podman inspect** [*options*] *name* [...] + +## DESCRIPTION + +This displays the low-level information on containers and images identified by name or ID. By default, this renders +all results in a JSON array. If the inspect type is all, the order of inspection is: containers, images, volumes, network, pods. + If a container has the same name as an image, then the container JSON is returned, and so on. + If a format is specified, the given template is executed for each result. + +For more inspection options, see also +[podman-container-inspect(1)](podman-container-inspect.1.md), +[podman-image-inspect(1)](podman-image-inspect.1.md), +[podman-network-inspect(1)](podman-network-inspect.1.md), +[podman-pod-inspect(1)](podman-pod-inspect.1.md), and +[podman-volume-inspect(1)](podman-volume-inspect.1.md). + +## OPTIONS + +#### **--format**, **-f**=*format* + +Format the output using the given Go template. +The keys of the returned JSON can be used as the values for the --format flag (see examples below). + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--size**, **-s** + +In addition to normal output, display the total file size if the type is a container. + +#### **--type**, **-t**=*type* + +Return JSON for the specified type. Type can be 'container', 'image', 'volume', 'network', 'pod', or 'all' (default: all) +(Only meaningful when invoked as *podman inspect*) + +## EXAMPLE + +Inspect the fedora image: +``` +# podman inspect fedora +[ + { + "Id": "f0858ad3febdf45bb2e5501cb459affffacef081f79eaa436085c3b6d9bd46ca", + "Digest": "sha256:d4f7df6b691d61af6cee7328f82f1d8afdef63bc38f58516858ae3045083924a", + "RepoTags": [ + "docker.io/library/fedora:latest" + ], + "RepoDigests": [ + "docker.io/library/fedora@sha256:8fa60b88e2a7eac8460b9c0104b877f1aa0cea7fbc03c701b7e545dacccfb433", + "docker.io/library/fedora@sha256:d4f7df6b691d61af6cee7328f82f1d8afdef63bc38f58516858ae3045083924a" + ], + "Parent": "", + "Comment": "", + "Created": "2019-10-29T03:23:37.695123423Z", + "Config": { + "Env": [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "DISTTAG=f31-updates-candidatecontainer", + "FGC=f31-updates-candidate", + "FBR=f31-updates-candidate" + ], + "Cmd": [ + "/bin/bash" + ], + "Labels": { + "maintainer": "Clement Verna \u003ccverna@fedoraproject.org\u003e" + } + }, + "Version": "18.06.1-ce", + "Author": "", + "Architecture": "amd64", + "Os": "linux", + "Size": 201096840, + "VirtualSize": 201096840, + "GraphDriver": { + "Name": "overlay", + "Data": { + "UpperDir": "/home/user/.local/share/containers/storage/overlay/2ae3cee18c8ef9e0d448649747dab81c4f1ca2714a8c4550eff49574cab262c9/diff", + "WorkDir": "/home/user/.local/share/containers/storage/overlay/2ae3cee18c8ef9e0d448649747dab81c4f1ca2714a8c4550eff49574cab262c9/work" + } + }, + "RootFS": { + "Type": "layers", + "Layers": [ + "sha256:2ae3cee18c8ef9e0d448649747dab81c4f1ca2714a8c4550eff49574cab262c9" + ] + }, + "Labels": { + "maintainer": "Clement Verna \u003ccverna@fedoraproject.org\u003e" + }, + "Annotations": {}, + "ManifestType": "application/vnd.docker.distribution.manifest.v2+json", + "User": "", + "History": [ + { + "created": "2019-01-16T21:21:55.569693599Z", + "created_by": "/bin/sh -c #(nop) LABEL maintainer=Clement Verna \u003ccverna@fedoraproject.org\u003e", + "empty_layer": true + }, + { + "created": "2019-09-27T21:21:07.784469821Z", + "created_by": "/bin/sh -c #(nop) ENV DISTTAG=f31-updates-candidatecontainer FGC=f31-updates-candidate FBR=f31-updates-candidate", + "empty_layer": true + }, + { + "created": "2019-10-29T03:23:37.355187998Z", + "created_by": "/bin/sh -c #(nop) ADD file:298f828afc880ccde9205fc4418435d5e696ad165e283f0530d0b1a74326d6dc in / " + }, + { + "created": "2019-10-29T03:23:37.695123423Z", + "created_by": "/bin/sh -c #(nop) CMD [\"/bin/bash\"]", + "empty_layer": true + } + ], + "NamesHistory": [] + } +] +``` + +Inspect the specified image with the `ImageName` format specifier: +``` +# podman inspect a04 --format "{{.ImageName}}" +fedora +``` + +Inspect the specified image for `GraphDriver` format specifier: +``` +# podman inspect a04 --format "{{.GraphDriver.Name}}" +overlay +``` + +Inspect the specified image for its `Size` format specifier: +``` +# podman image inspect --format "size: {{.Size}}" alpine +size: 4405240 +``` + +Inspect the latest container created for `EffectiveCaps` format specifier. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman container inspect --latest --format {{.EffectiveCaps}} +[CAP_CHOWN CAP_DAC_OVERRIDE CAP_FSETID CAP_FOWNER CAP_SETGID CAP_SETUID CAP_SETFCAP CAP_SETPCAP CAP_NET_BIND_SERVICE CAP_KILL] +``` + +Inspect the specified pod for the `Name` format specifier: +``` +# podman inspect myPod --type pod --format "{{.Name}}" +myPod +``` + +Inspect the specified volume for the `Name` format specifier: +``` +# podman inspect myVolume --type volume --format "{{.Name}}" +myVolume +``` + +Inspect the specified network for the `Name` format specifier: +``` +# podman inspect nyNetwork --type network --format "{{.name}}" +myNetwork +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container-inspect(1)](podman-container-inspect.1.md)**, **[podman-image-inspect(1)](podman-image-inspect.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-pod-inspect(1)](podman-pod-inspect.1.md)**, **[podman-volume-inspect(1)](podman-volume-inspect.1.md)** + +## HISTORY +July 2017, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-kill.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-kill.1.md new file mode 100644 index 000000000..89fcbb47d --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-kill.1.md @@ -0,0 +1,91 @@ +--- +title: podman-kill +version: v5.4.1 +--- + +% podman-kill 1 + +## NAME +podman\-kill - Kill the main process in one or more containers + +## SYNOPSIS +**podman kill** [*options*] [*container* ...] + +**podman container kill** [*options*] [*container* ...] + +## DESCRIPTION +The main process inside each container specified is sent SIGKILL or any signal specified with the `--signal` option. + +## OPTIONS +#### **--all**, **-a** + +Signal all running and paused containers. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and kill the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/signal.md) +#### **--signal**, **-s**=**signal** + +Signal to send to the container. For more information on Linux signals, refer to *signal(7)*. +The default is **SIGKILL**. + +[//]: # (END included file options/signal.md) + +## EXAMPLE + +Kill container with a given name: +``` +podman kill mywebserver +``` + +Kill container with a given ID: +``` +podman kill 860a4b23 +``` + +Terminate container by sending `TERM` signal: +``` +podman kill --signal TERM 860a4b23 +``` + +Kill the latest container. (This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines): +``` +podman kill --latest +``` + +Terminate all containers by sending `KILL` signal: +``` +podman kill --signal KILL -a +``` + +Kill containers using ID specified in a given files: +``` +podman kill --cidfile /home/user/cidfile-1 +podman kill --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-stop(1)](podman-stop.1.md)** + +## HISTORY +September 2017, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-kube-apply.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-kube-apply.1.md new file mode 100644 index 000000000..5b3a3673a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-kube-apply.1.md @@ -0,0 +1,79 @@ +--- +title: podman-kube-apply +version: v5.4.1 +--- + +% podman-kube-apply 1 + +## NAME +podman-kube-apply - Apply Kubernetes YAML based on containers, pods, or volumes to a Kubernetes cluster + +## SYNOPSIS +**podman kube apply** [*options*] [*container...* | *pod...* | *volume...*] + +## DESCRIPTION +**podman kube apply** deploys a podman container, pod, or volume to a Kubernetes cluster. Use the `--file` option to deploy a Kubernetes YAML (v1 specification) to a Kubernetes cluster as well. + +Note that the Kubernetes YAML file can be used to run the deployment in Podman via podman-play-kube(1). + +## OPTIONS + +#### **--ca-cert-file**=*ca cert file path | "insecure"* + +The path to the CA cert file for the Kubernetes cluster. Usually the kubeconfig has the CA cert file data and `generate kube` automatically picks that up if it is available in the kubeconfig. If no CA cert file data is available, set this to `insecure` to bypass the certificate verification. + +#### **--file**, **-f**=*kube yaml filepath* + +Path to the kubernetes yaml file to deploy onto the kubernetes cluster. This file can be generated using the `podman kube generate` command. The input may be in the form of a yaml file, or stdin. For stdin, use `--file=-`. + +#### **--kubeconfig**, **-k**=*kubeconfig filepath* + +Path to the kubeconfig file to be used when deploying the generated kube yaml to the Kubernetes cluster. The environment variable `KUBECONFIG` can be used to set the path for the kubeconfig file as well. +Note: A kubeconfig can have multiple cluster configurations, but `kube generate` always picks the first cluster configuration in the given kubeconfig. + +#### **--ns**=*namespace* + +The namespace or project to deploy the workloads of the generated kube yaml to in the Kubernetes cluster. + +#### **--service**, **-s** + +Used to create a service for the corresponding container or pod being deployed to the cluster. In particular, if the container or pod has portmap bindings, the service specification includes a NodePort declaration to expose the service. A random port is assigned by Podman in the service specification that is deployed to the cluster. + +## EXAMPLES + +Apply a podman volume and container to the "default" namespace in a Kubernetes cluster. +``` +$ podman kube apply --kubeconfig /tmp/kubeconfig myvol vol-test-1 +Deploying to cluster... +Successfully deployed workloads to cluster! +$ kubectl get pods +NAME READY STATUS RESTARTS AGE +vol-test-1-pod 1/1 Running 0 9m +``` + +Apply a Kubernetes YAML file to the "default" namespace in a Kubernetes cluster. +``` +$ podman kube apply --kubeconfig /tmp/kubeconfig -f vol.yaml +Deploying to cluster... +Successfully deployed workloads to cluster! +$ kubectl get pods +NAME READY STATUS RESTARTS AGE +vol-test-2-pod 1/1 Running 0 9m +``` + +Apply a Kubernetes YAML file to the "test1" namespace in a Kubernetes cluster. +``` +$ podman kube apply --kubeconfig /tmp/kubeconfig --ns test1 vol-test-3 +Deploying to cluster... +Successfully deployed workloads to cluster! +$ kubectl get pods --namespace test1 +NAME READY STATUS RESTARTS AGE +vol-test-3-pod 1/1 Running 0 9m + +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)** + +## HISTORY +September 2022, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-kube-down.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-kube-down.1.md new file mode 100644 index 000000000..32be2df3d --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-kube-down.1.md @@ -0,0 +1,76 @@ +--- +title: podman-kube-down +version: v5.4.1 +--- + +% podman-kube-down 1 + +## NAME +podman-kube-down - Remove containers and pods based on Kubernetes YAML + +## SYNOPSIS +**podman kube down** [*options*] *file.yml|-|https://website.io/file.yml* + +## DESCRIPTION +**podman kube down** reads a specified Kubernetes YAML file, tearing down pods that were created by the `podman kube play` command via the same Kubernetes YAML +file. Any volumes that were created by the previous `podman kube play` command remain intact unless the `--force` options is used. If the YAML file is +specified as `-`, `podman kube down` reads the YAML from stdin. The input can also be a URL that points to a YAML file such as https://podman.io/demo.yml. +`podman kube down` tears down the pods and containers created by `podman kube play` via the same Kubernetes YAML from the URL. However, +`podman kube down` does not work with a URL if the YAML file the URL points to has been changed or altered since the creation of the pods and containers using +`podman kube play`. + +## OPTIONS + +#### **--force** + +Tear down the volumes linked to the PersistentVolumeClaims as part --down + +## EXAMPLES + +Example YAML file `demo.yml`: +``` +apiVersion: v1 +kind: Pod +metadata: +... +spec: + containers: + - command: + - top + - name: container + value: podman + image: foobar +... +``` + +Remove the pod and containers as described in the `demo.yml` file +``` +$ podman kube down demo.yml +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Remove the pod and containers as described in the `demo.yml` file YAML sent to stdin +``` +$ cat demo.yml | podman kube play - +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Remove the pods and containers as described in the `demo.yml` file YAML read from a URL +``` +$ podman kube down https://podman.io/demo.yml +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` +`podman kube down` does not work with a URL if the YAML file the URL points to has been changed +or altered since it was used to create the pods and containers. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-kube(1)](podman-kube.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-kube-generate.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-kube-generate.1.md new file mode 100644 index 000000000..c0167e56f --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-kube-generate.1.md @@ -0,0 +1,254 @@ +--- +title: podman-kube-generate +version: v5.4.1 +--- + +% podman-kube-generate 1 + +## NAME +podman-kube-generate - Generate Kubernetes YAML based on containers, pods or volumes + +## SYNOPSIS +**podman kube generate** [*options*] *container...* | *pod...* | *volume...* + +## DESCRIPTION +**podman kube generate** generates Kubernetes YAML (v1 specification) from Podman containers, pods or volumes. Regardless of whether +the input is for containers or pods, Podman generates the specification as a Pod by default. The input may be in the form +of one or more containers, pods or volumes names or IDs. + +`Podman Containers or Pods` + +Volumes appear in the generated YAML according to two different volume types. Bind-mounted volumes become *hostPath* volume types and named volumes become *persistentVolumeClaim* volume types. Generated *hostPath* volume types are one of three subtypes depending on the state of the host path: *DirectoryOrCreate* when no file or directory exists at the host, *Directory* when host path is a directory, or *File* when host path is a file. The value for *claimName* for a *persistentVolumeClaim* is the name of the named volume registered in Podman. + +Potential name conflicts between volumes are avoided by using a standard naming scheme for each volume type. The *hostPath* volume types are named according to the path on the host machine, replacing forward slashes with hyphens less any leading and trailing forward slashes. The special case of the filesystem root, `/`, translates to the name `root`. Additionally, the name is suffixed with `-host` to avoid naming conflicts with *persistentVolumeClaim* volumes. Each *persistentVolumeClaim* volume type uses the name of its associated named volume suffixed with `-pvc`. + +Note that if an init container is created with type `once` and the pod has been started, it does not show up in the generated kube YAML as `once` type init containers are deleted after they are run. If the pod has only been created and not started, it is in the generated kube YAML. +Init containers created with type `always` are always generated in the kube YAML as they are never deleted, even after running to completion. + +*Note*: When using volumes and generating a Kubernetes YAML for an unprivileged and rootless podman container on an **SELinux enabled system**, one of the following options must be completed: + * Add the "privileged: true" option to the pod spec + * Add `type: spc_t` under the `securityContext` `seLinuxOptions` in the pod spec + * Relabel the volume via the CLI command `chcon -t container_file_t -R ` + +Once completed, the correct permissions are in place to access the volume when the pod/container is created in a Kubernetes cluster. + +Note that the generated Kubernetes YAML file can be used to re-run the deployment via podman-play-kube(1). + +Note that if the pod being generated was created with the **--infra-name** flag set, then the generated kube yaml will have the **io.podman.annotations.infra.name** set where the value is the name of the infra container set by the user. + +Note that both Deployment and DaemonSet can only have `restartPolicy` set to `Always`. + +Note that Job can only have `restartPolicy` set to `OnFailure` or `Never`. By default, podman sets it to `Never` when generating a kube yaml using `kube generate`. + +## OPTIONS + +#### **--filename**, **-f**=*filename* + +Output to the given file instead of STDOUT. If the file already exists, `kube generate` refuses to replace it and returns an error. + +#### **--podman-only** + +Add podman-only reserved annotations in generated YAML file (Cannot be used by Kubernetes) + +#### **--replicas**, **-r**=*replica count* + +The value to set `replicas` to when generating a **Deployment** kind. +Note: this can only be set with the option `--type=deployment`. + +#### **--service**, **-s** + +Generate a Kubernetes service object in addition to the Pods. Used to generate a Service specification for the corresponding Pod output. In particular, if the object has portmap bindings, the service specification includes a NodePort declaration to expose the service. A random port is assigned by Podman in the specification. + +#### **--type**, **-t**=*pod* | *deployment* | *daemonset* | *job* + +The Kubernetes kind to generate in the YAML file. Currently, the only supported Kubernetes specifications are `Pod`, `Deployment`, `Job`, and `DaemonSet`. By default, the `Pod` specification is generated. + +## EXAMPLES + +Create Kubernetes Pod YAML for the specified container. +``` +$ podman kube generate some-mariadb +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-4.8.2 + +# NOTE: If you generated this yaml from an unprivileged and rootless podman container on an SELinux +# enabled system, check the podman generate kube man page for steps to follow to ensure that your pod/container +# has the right permissions to access the volumes added. +--- +apiVersion: v1 +kind: Pod +metadata: + creationTimestamp: "2024-01-09T02:24:55Z" + labels: + app: some-mariadb-pod + name: some-mariadb-pod +spec: + containers: + - args: + - mariadbd + env: + - name: MARIADB_ROOT_PASSWORD + value: x + image: docker.io/library/mariadb:10.11 + name: some-mariadb + ports: + - containerPort: 3306 + hostPort: 34891 + volumeMounts: + - mountPath: /var/lib/mysql + name: mariadb_data-pvc + volumes: + - name: mariadb_data-pvc + persistentVolumeClaim: + claimName: mariadb_data +``` + +Create Kubernetes Deployment YAML with 3 replicas for the specified container. +``` +$ podman kube generate --type deployment --replicas 3 dep-ct +r +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-4.5.0-dev +apiVersion: apps/v1 +kind: Deployment +metadata: + creationTimestamp: "2023-03-27T20:45:08Z" + labels: + app: dep-ctr-pod + name: dep-ctr-pod-deployment +spec: + replicas: 3 + selector: + matchLabels: + app: dep-ctr-pod + template: + metadata: + annotations: + io.podman.annotations.ulimit: nofile=524288:524288,nproc=127332:127332 + creationTimestamp: "2023-03-27T20:45:08Z" + labels: + app: dep-ctr-pod + name: dep-ctr-pod + spec: + containers: + - command: + - top + image: docker.io/library/alpine:latest + name: dep-ctr +``` + + +Create Kubernetes Pod YAML for the specified container with the host directory `/home/user/my-data` bind-mounted onto the container path `/volume`. +``` +$ podman kube generate my-container-with-bind-mounted-data +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-3.1.0-dev +apiVersion: v1 +kind: Pod +metadata: + creationTimestamp: "2021-03-18T16:26:08Z" + labels: + app: my-container-with-bind-mounted-data + name: my-container-with-bind-mounted-data +spec: + containers: + - command: + - /bin/sh + image: docker.io/library/alpine:latest + name: test-bind-mount + volumeMounts: + - mountPath: /volume + name: home-user-my-data-host + restartPolicy: Never + volumes: + - hostPath: + path: /home/user/my-data + type: Directory + name: home-user-my-data-host +``` + +Create Kubernetes Pod YAML for the specified container with named volume `priceless-data` mounted onto the container path `/volume`. +``` +$ podman kube generate my-container-using-priceless-data +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-3.1.0-dev +apiVersion: v1 +kind: Pod +metadata: + creationTimestamp: "2021-03-18T16:26:08Z" + labels: + app: my-container-using-priceless-data + name: my-container-using-priceless-data +spec: + containers: + - command: + - /bin/sh + image: docker.io/library/alpine:latest + name: test-bind-mount + volumeMounts: + - mountPath: /volume + name: priceless-data-pvc + restartPolicy: Never + volumes: + - name: priceless-data-pvc + persistentVolumeClaim: + claimName: priceless-data +``` + +Create Kubernetes Pod YAML for the specified pod and include a service. +``` +$ sudo podman kube generate -s demoweb +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-0.12.2-dev +apiVersion: v1 +kind: Pod +metadata: + creationTimestamp: 2018-12-18T15:16:06Z + labels: + app: demoweb + name: demoweb-libpod +spec: + containers: + - command: + - python3 + - /root/code/graph.py + image: quay.io/baude/demoweb:latest + name: practicalarchimedes + tty: true + workingDir: /root/code +--- +apiVersion: v1 +kind: Service +metadata: + creationTimestamp: 2018-12-18T15:16:06Z + labels: + app: demoweb + name: demoweb-libpod +spec: + ports: + - name: "8050" + nodePort: 31269 + port: 8050 + targetPort: 0 + selector: + app: demoweb + type: NodePort +status: + loadBalancer: {} +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-down(1)](podman-kube-down.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-kube-play.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-kube-play.1.md new file mode 100644 index 000000000..c29119519 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-kube-play.1.md @@ -0,0 +1,813 @@ +--- +title: podman-kube-play +version: v5.4.1 +--- + +% podman-kube-play 1 + +## NAME +podman-kube-play - Create containers, pods and volumes based on Kubernetes YAML + +## SYNOPSIS +**podman kube play** [*options*] *file.yml|-|https://website.io/file.yml* + +## DESCRIPTION +**podman kube play** reads in a structured file of Kubernetes YAML. It recreates the containers, pods, or volumes described in the YAML. Containers within a pod are then started, and the ID of the new Pod or the name of the new Volume is output. If the YAML file is specified as "-", then `podman kube play` reads the YAML file from stdin. +The input can also be a URL that points to a YAML file such as https://podman.io/demo.yml. `podman kube play` reads the YAML from the URL and create pods and containers from it. + +Using the `--down` command line option, it is also capable of tearing down the pods created by a previous run of `podman kube play`. + +Using the `--replace` command line option, it tears down the pods(if any) created by a previous run of `podman kube play` and recreate the pods with the Kubernetes YAML file. + +Ideally the input file is created by the Podman command (see podman-kube-generate(1)). This guarantees a smooth import and expected results. + +Currently, the supported Kubernetes kinds are: + +- Pod +- Deployment +- PersistentVolumeClaim +- ConfigMap +- Secret +- DaemonSet +- Job + +`Kubernetes Pods or Deployments` + +Only four volume types are supported by kube play, the *hostPath*, *emptyDir*, *persistentVolumeClaim*, and *image* volume types. + +- When using the *hostPath* volume type, only the *default (empty)*, *DirectoryOrCreate*, *Directory*, *FileOrCreate*, *File*, *Socket*, *CharDevice* and *BlockDevice* subtypes are supported. Podman interprets the value of *hostPath* *path* as a file path when it contains at least one forward slash, otherwise Podman treats the value as the name of a named volume. +- When using a *persistentVolumeClaim*, the value for *claimName* is the name for the Podman named volume. +- When using an *emptyDir* volume, Podman creates an anonymous volume that is attached the containers running inside the pod and is deleted once the pod is removed. +- When using an *image* volume, Podman creates a read-only image volume with an empty subpath (the whole image is mounted). The image must already exist locally. It is supported in rootful mode only. + +Note: The default restart policy for containers is `always`. You can change the default by setting the `restartPolicy` field in the spec. + +Note: When playing a kube YAML with init containers, the init container is created with init type value `once`. To change the default type, use the `io.podman.annotations.init.container.type` annotation to set the type to `always`. + +Note: *hostPath* volume types created by kube play is given an SELinux shared label (z), bind mounts are not relabeled (use `chcon -t container_file_t -R `). + +Note: To set userns of a pod, use the **io.podman.annotations.userns** annotation in the pod/deployment definition. For example, **io.podman.annotations.userns=keep-id** annotation tells Podman to create a user namespace where the current rootless user's UID\:GID are mapped to the same values in the container. This can be overridden with the `--userns` flag. + +Note: Use the **io.podman.annotations.volumes-from** annotation to bind mount volumes of one container to another. You can mount volumes from multiple source containers to a target container. The source containers that belong to the same pod must be defined before the source container in the kube YAML. The annotation format is `io.podman.annotations.volumes-from/targetContainer: "sourceContainer1\:mountOpts1;sourceContainer2:mountOpts2"`. + +Note: If the `:latest` tag is used, Podman attempts to pull the image from a registry. If the image was built locally with Podman or Buildah, it has `localhost` as the domain, in that case, Podman uses the image from the local store even if it has the `\:latest` tag. + +Note: The command `podman play kube` is an alias of `podman kube play`, and performs the same function. + +Note: The command `podman kube down` can be used to stop and remove pods or containers based on the same Kubernetes YAML used +by `podman kube play` to create them. + +Note: To customize the name of the infra container created during `podman kube play`, use the **io.podman.annotations.infra.name** annotation in the pod definition. This annotation is automatically set when generating a kube yaml from a pod that was created with the `--infra-name` flag set. + +`Kubernetes PersistentVolumeClaims` + +A Kubernetes PersistentVolumeClaim represents a Podman named volume. Only the PersistentVolumeClaim name is required by Podman to create a volume. Kubernetes annotations can be used to make use of the available options for Podman volumes. + +- volume.podman.io/driver +- volume.podman.io/device +- volume.podman.io/type +- volume.podman.io/uid +- volume.podman.io/gid +- volume.podman.io/mount-options +- volume.podman.io/import-source +- volume.podman.io/image + +Use `volume.podman.io/import-source` to import the contents of the tarball (.tar, .tar.gz, .tgz, .bzip, .tar.xz, .txz) specified in the annotation's value into the created Podman volume + +Kube play is capable of building images on the fly given the correct directory layout and Containerfiles. This +option is not available for remote clients, including Mac and Windows (excluding WSL2) machines, yet. Consider the following excerpt from a YAML file: +``` +apiVersion: v1 +kind: Pod +metadata: +... +spec: + containers: + - name: container + image: foobar +... +``` + +If there is a directory named `foobar` in the current working directory with a file named `Containerfile` or `Dockerfile`, +Podman kube play builds that image and name it `foobar`. An example directory structure for this example looks +like: +``` +|- mykubefiles + |- myplayfile.yaml + |- foobar + |- Containerfile +``` + +The build considers `foobar` to be the context directory for the build. If there is an image in local storage +called `foobar`, the image is not built unless the `--build` flag is used. Use `--build=false` to completely +disable builds. + +Kube play supports CDI (Container Device Interface) device selectors to share +host devices (e.g. GPUs) with containers. The configuration format follows +Kubernetes extended resource management: +``` +apiVersion: v1 +kind: Pod +spec: + containers: + - name: container + resources: + limits: + nvidia.com/gpu=all: 1 +``` + +To enable sharing host devices, analogous to using the `--device` flag Podman +kube supports a custom CDI selector: `podman.io/device=`. + +`Kubernetes ConfigMap` + +Kubernetes ConfigMap can be referred as a source of environment variables or volumes in Pods or Deployments. +ConfigMaps aren't a standalone object in Podman; instead, when a container uses a ConfigMap, Podman creates environment variables or volumes as needed. + +For example, the following YAML document defines a ConfigMap and then uses it in a Pod: + +``` +apiVersion: v1 +kind: ConfigMap +metadata: + name: foo +data: + FOO: bar +--- +apiVersion: v1 +kind: Pod +metadata: + name: foobar +spec: + containers: + - name: container-1 + image: foobar + envFrom: + - configMapRef: + name: foo + optional: false +``` + +and as a result environment variable `FOO` is set to `bar` for container `container-1`. + +`Kubernetes Secret` + +Kubernetes Secret represents a Podman named secret. The Kubernetes Secret is saved as a whole and may be referred to as a source of environment variables or volumes in Pods or Deployments. + +For example, the following YAML document defines a Secret and then uses it in a Pod: + +``` +kind: Secret +apiVersion: v1 +metadata: + name: foo +data: + foo: YmFy # base64 for bar +--- +apiVersion: v1 +kind: Pod +metadata: + name: foobar +spec: + containers: + - name: container-1 + image: foobar + env: + - name: FOO + valueFrom: + secretKeyRef: + name: foo + key: foo +``` + +and as a result environment variable `FOO` is set to `bar` for container `container-1`. + +`Automounting Volumes (deprecated)` + +Note: The automounting annotation is deprecated. Kubernetes has [native support for image volumes](https://kubernetes.io/docs/tasks/configure-pod-container/image-volumes/) and that should be used rather than this podman-specific annotation. + +An image can be automatically mounted into a container if the annotation `io.podman.annotations.kube.image.automount/$ctrname` is given. The following rules apply: + +- The image must already exist locally. +- The image must have at least 1 volume directive. +- The path given by the volume directive will be mounted from the image into the container. For example, an image with a volume at `/test/test_dir` will have `/test/test_dir` in the image mounted to `/test/test_dir` in the container. +- Multiple images can be specified. If multiple images have a volume at a specific path, the last image specified trumps. +- The images are always mounted read-only. +- Images to mount are defined in the annotation "io.podman.annotations.kube.image.automount/$ctrname" as a semicolon-separated list. They are mounted into a single container in the pod, not the whole pod. The annotation can be specified for additional containers if additional mounts are required. + +## OPTIONS + + +[//]: # (BEGIN included file options/annotation.container.md) +#### **--annotation**=*key=value* + +Add an annotation to the container or pod. This option can be set multiple times. + +[//]: # (END included file options/annotation.container.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + +#### **--build** + +Build images even if they are found in the local storage. Use `--build=false` to completely disable builds. (This option is not available with the remote Podman client) + +Note: You can also override the default isolation type by setting the BUILDAH_ISOLATION environment variable. export BUILDAH_ISOLATION=oci. See podman-build.1.md for more information. + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + +#### **--configmap**=*path* + +Use Kubernetes configmap YAML at path to provide a source for environment variable values within the containers of the pod. (This option is not available with the remote Podman client) + +Note: The *--configmap* option can be used multiple times or a comma-separated list of paths can be used to pass multiple Kubernetes configmap YAMLs. +The YAML file may be in a multi-doc YAML format. But, it must container only configmaps + +#### **--context-dir**=*path* + +Use *path* as the build context directory for each image. Requires --build option be true. (This option is not available with the remote Podman client) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + +#### **--force** + +Tear down the volumes linked to the PersistentVolumeClaims as part of --down + +#### **--help**, **-h** + +Print usage statement + +#### **--ip**=*IP address* + +Assign a static ip address to the pod. This option can be specified several times when kube play creates more than one pod. +Note: When joining multiple networks use the **--network name\:ip=\** syntax. + +#### **--log-driver**=*driver* + +Set logging driver for all created containers. + + +[//]: # (BEGIN included file options/log-opt.md) +#### **--log-opt**=*name=value* + +Logging driver specific options. + +Set custom logging configuration. The following *name*s are supported: + +**path**: specify a path to the log file + (e.g. **--log-opt path=/var/log/container/mycontainer.json**); + +**max-size**: specify a max size of the log file + (e.g. **--log-opt max-size=10mb**); + +**tag**: specify a custom log tag for the container + (e.g. **--log-opt tag="{{.ImageName}}"**. +It supports the same keys as **podman inspect --format**. +This option is currently supported only by the **journald** log driver. + +[//]: # (END included file options/log-opt.md) + +#### **--mac-address**=*MAC address* + +Assign a static mac address to the pod. This option can be specified several times when kube play creates more than one pod. +Note: When joining multiple networks use the **--network name\:mac=\** syntax. + + +[//]: # (BEGIN included file options/network.md) +#### **--network**=*mode*, **--net** + +Set the network mode for the pod. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured, to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.md) + +When no network option is specified and *host* network mode is not configured in the YAML file, a new network stack is created and pods are attached to it making possible pod to pod communication. + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the pod. + +Podman assumes control over the pod's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with host added in the Kubernetes YAML. + +#### **--publish**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Define or override a port definition in the YAML file. + +The lists of ports in the YAML file and the command line are merged. Matching is done by using the **containerPort** field. +If **containerPort** exists in both the YAML file and the option, the latter takes precedence. + +#### **--publish-all** + +Setting this option to `true` will expose all ports to the host, +even if only specified via **containerPort** in the K8 YAML. +In terms of which port will be exposed, **--publish** has higher priority than **hostPort**, has higher priority than +**containerPort**. + +If set to `false` (which is the default), only ports defined via **hostPort** +or **--publish** are published on the host. + +#### **--quiet**, **-q** + +Suppress output information when pulling images + +#### **--replace** + +Tears down the pods created by a previous run of `kube play` and recreates the pods. This option is used to keep the existing pods up to date based upon the Kubernetes YAML. + +#### **--seccomp-profile-root**=*path* + +Directory path for seccomp profiles (default: "/var/lib/kubelet/seccomp"). (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +#### **--start** + +Start the pod after creating it, set to false to only create it. + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/userns.container.md) +#### **--userns**=*mode* + +Set the user namespace mode for the container. + +If `--userns` is not set, the default value is determined as follows. +- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used. +- If the environment variable **PODMAN_USERNS** is set its value is used. +- If `userns` is specified in `containers.conf` this value is used. +- Otherwise, `--userns=host` is assumed. + +`--userns=""` (i.e., an empty string) is an alias for `--userns=host`. + +This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +------------------------|-----------|--------------------- +auto | $UID | nil (Host User UID is not mapped into container.) +host | $UID | 0 (Default User account mapped to root user in container.) +keep-id | $UID | $UID (Map user account to same UID within container.) +keep-id\:uid=200,gid=210 | $UID | 200:210 (Map user account to specified UID, GID value within container.) +nomap | $UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + +**auto**[\:_OPTIONS,..._]: automatically create a unique user namespace. + +* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. + + Example: `containers:2147483647:2147483648`. + +* `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5). + +Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user IDs. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. + +The option `--userns=keep-id` uses all the subuids and subgids of the user. +The option `--userns=nomap` uses all the subuids and subgids of the user except the user's own ID. +Using `--userns=auto` when starting new containers does not work as long as any containers exist that were started with `--userns=nomap` or `--userns=keep-id` without limiting the user namespace size. + + Valid `auto` options: + + - *gidmapping*=_CONTAINER\_GID\:HOST\_GID\:SIZE_: to force a GID mapping to be present in the user namespace. + - *size*=_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates a size for the user namespace. + - *uidmapping*=_CONTAINER\_UID\:HOST\_UID\:SIZE_: to force a UID mapping to be present in the user namespace. + +The host UID and GID in *gidmapping* and *uidmapping* can optionally be prefixed with the `@` symbol. +In this case, podman will look up the intermediate ID corresponding to host ID and it will map the found intermediate ID to the container id. +For details see **--uidmap**. + +**container:**_id_: join the user namespace of the specified container. + +**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user. + +**keep-id**: creates a user namespace where the current user's UID\:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace. + + Valid `keep-id` options: + + - *uid*=UID: override the UID inside the container that is used to map the current user to. + - *gid*=GID: override the GID inside the container that is used to map the current user to. + - *size*=SIZE: override the size of the configured user namespace. It is useful to not saturate all the available IDs. Not supported when running as root. + +**nomap**: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +**ns:**_namespace_: run the pod in the given existing user namespace. + +[//]: # (END included file options/userns.container.md) + +#### **--wait**, **-w** + +Run pods and containers in the foreground. Default is false. + +At any time you can run `podman pod ps` in another shell to view a list of +the running pods and containers. + +When attached in the tty mode, you can kill the pods and containers by pressing +Ctrl-C or receiving any other interrupt signals. + +All pods, containers, and volumes created with `podman kube play` is removed +upon exit. + +## EXAMPLES + +Recreate the pod and containers described in the specified host YAML file. +``` +$ podman kube play demo.yml +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Recreate the pod and containers specified in a YAML file sent to stdin. +``` +$ cat demo.yml | podman kube play - +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Tear down the pod and containers as described in the specified YAML file. +``` +$ podman kube play --down demo.yml +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Provide multiple configmap files as sources for environment variables within the specified pods and containers. +``` +$ podman kube play demo.yml --configmap configmap-foo.yml,configmap-bar.yml +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 + +$ podman kube play demo.yml --configmap configmap-foo.yml --configmap configmap-bar.yml +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Create a pod connected to two networks with a static ip on each. +``` +$ podman kube play demo.yml --network net1\:ip=10.89.1.5 --network net2\:ip=10.89.10.10 +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` +Please take into account that networks must be created first using podman-network-create(1). + +Create and teardown from a URL pointing to a YAML file. +``` +$ podman kube play https://podman.io/demo.yml +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 + +$ podman kube play --down https://podman.io/demo.yml +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` +`podman kube play --down` does not work with a URL if the YAML file the URL points to +has been changed or altered. + + +[//]: # (BEGIN included file ../../kubernetes_support.md) +# Podman Kube Play Support + +This document outlines the kube yaml fields that are currently supported by the **podman kube play** command. + +Note: **N/A** means that the option cannot be supported in a single-node Podman environment. + +## Pod Fields + +| Field | Support | +|-----------------------------------------------------|---------| +| containers | ✅ | +| initContainers | ✅ | +| imagePullSecrets | no | +| enableServiceLinks | no | +| os\.name | no | +| volumes | ✅ | +| nodeSelector | N/A | +| nodeName | N/A | +| affinity\.nodeAffinity | N/A | +| affinity\.podAffinity | N/A | +| affinity\.podAntiAffinity | N/A | +| tolerations\.key | N/A | +| tolerations\.operator | N/A | +| tolerations\.effect | N/A | +| tolerations\.tolerationSeconds | N/A | +| schedulerName | N/A | +| runtimeClassName | no | +| priorityClassName | no | +| priority | no | +| topologySpreadConstraints\.maxSkew | N/A | +| topologySpreadConstraints\.topologyKey | N/A | +| topologySpreadConstraints\.whenUnsatisfiable | N/A | +| topologySpreadConstraints\.labelSelector | N/A | +| topologySpreadConstraints\.minDomains | N/A | +| restartPolicy | ✅ | +| terminationGracePeriodSeconds | ✅ | +| activeDeadlineSeconds | no | +| readinessGates\.conditionType | no | +| hostname | ✅ | +| setHostnameAsFQDN | no | +| subdomain | no | +| hostAliases\.hostnames | ✅ | +| hostAliases\.ip | ✅ | +| dnsConfig\.nameservers | ✅ | +| dnsConfig\.options\.name | ✅ | +| dnsConfig\.options\.value | ✅ | +| dnsConfig\.searches | ✅ | +| dnsPolicy | no | +| hostNetwork | ✅ | +| hostPID | ✅ | +| hostIPC | ✅ | +| shareProcessNamespace | ✅ | +| serviceAccountName | no | +| automountServiceAccountToken | no | +| securityContext\.runAsUser | ✅ | +| securityContext\.runAsNonRoot | no | +| securityContext\.runAsGroup | ✅ | +| securityContext\.supplementalGroups | ✅ | +| securityContext\.fsGroup | no | +| securityContext\.fsGroupChangePolicy | no | +| securityContext\.seccompProfile\.type | no | +| securityContext\.seccompProfile\.localhostProfile | no | +| securityContext\.seLinuxOptions\.level | ✅ | +| securityContext\.seLinuxOptions\.role | ✅ | +| securityContext\.seLinuxOptions\.type | ✅ | +| securityContext\.seLinuxOptions\.user | ✅ | +| securityContext\.sysctls\.name | ✅ | +| securityContext\.sysctls\.value | ✅ | +| securityContext\.windowsOptions\.gmsaCredentialSpec | no | +| securityContext\.windowsOptions\.hostProcess | no | +| securityContext\.windowsOptions\.runAsUserName | no | + +## Container Fields + +| Field | Support | +|-----------------------------------------------------|---------| +| name | ✅ | +| image | ✅ | +| imagePullPolicy | ✅ | +| command | ✅ | +| args | ✅ | +| workingDir | ✅ | +| ports\.containerPort | ✅ | +| ports\.hostIP | ✅ | +| ports\.hostPort | ✅ | +| ports\.name | ✅ | +| ports\.protocol | ✅ | +| env\.name | ✅ | +| env\.value | ✅ | +| env\.valueFrom\.configMapKeyRef\.key | ✅ | +| env\.valueFrom\.configMapKeyRef\.name | ✅ | +| env\.valueFrom\.configMapKeyRef\.optional | ✅ | +| env\.valueFrom\.fieldRef | ✅ | +| env\.valueFrom\.resourceFieldRef | ✅ | +| env\.valueFrom\.secretKeyRef\.key | ✅ | +| env\.valueFrom\.secretKeyRef\.name | ✅ | +| env\.valueFrom\.secretKeyRef\.optional | ✅ | +| envFrom\.configMapRef\.name | ✅ | +| envFrom\.configMapRef\.optional | ✅ | +| envFrom\.prefix | no | +| envFrom\.secretRef\.name | ✅ | +| envFrom\.secretRef\.optional | ✅ | +| volumeMounts\.mountPath | ✅ | +| volumeMounts\.name | ✅ | +| volumeMounts\.mountPropagation | no | +| volumeMounts\.readOnly | ✅ | +| volumeMounts\.subPath | ✅ | +| volumeMounts\.subPathExpr | no | +| volumeDevices\.devicePath | no | +| volumeDevices\.name | no | +| resources\.limits | ✅ | +| resources\.requests | ✅ | +| lifecycle\.postStart | no | +| lifecycle\.preStop | no | +| terminationMessagePath | no | +| terminationMessagePolicy | no | +| livenessProbe | ✅ | +| readinessProbe | no | +| startupProbe | no | +| securityContext\.runAsUser | ✅ | +| securityContext\.runAsNonRoot | no | +| securityContext\.runAsGroup | ✅ | +| securityContext\.readOnlyRootFilesystem | ✅ | +| securityContext\.procMount | ✅ | +| securityContext\.privileged | ✅ | +| securityContext\.allowPrivilegeEscalation | ✅ | +| securityContext\.capabilities\.add | ✅ | +| securityContext\.capabilities\.drop | ✅ | +| securityContext\.seccompProfile\.type | no | +| securityContext\.seccompProfile\.localhostProfile | no | +| securityContext\.seLinuxOptions\.level | ✅ | +| securityContext\.seLinuxOptions\.role | ✅ | +| securityContext\.seLinuxOptions\.type | ✅ | +| securityContext\.seLinuxOptions\.user | ✅ | +| securityContext\.windowsOptions\.gmsaCredentialSpec | no | +| securityContext\.windowsOptions\.hostProcess | no | +| securityContext\.windowsOptions\.runAsUserName | no | +| stdin | no | +| stdinOnce | no | +| tty | no | + +## PersistentVolumeClaim Fields + +| Field | Support | +|---------------------|---------| +| volumeName | no | +| storageClassName | ✅ | +| volumeMode | no | +| accessModes | ✅ | +| selector | no | +| resources\.limits | no | +| resources\.requests | ✅ | + +## ConfigMap Fields + +| Field | Support | +|------------|---------| +| binaryData | ✅ | +| data | ✅ | +| immutable | no | + +## Deployment Fields + +| Field | Support | +|-----------------------------------------|-------------------------------------------------------| +| replicas | ✅ (the actual replica count is ignored and set to 1) | +| selector | ✅ | +| template | ✅ | +| minReadySeconds | no | +| strategy\.type | no | +| strategy\.rollingUpdate\.maxSurge | no | +| strategy\.rollingUpdate\.maxUnavailable | no | +| revisionHistoryLimit | no | +| progressDeadlineSeconds | no | +| paused | no | + +## DaemonSet Fields + +| Field | Support | +|-----------------------------------------|---------| +| selector | ✅ | +| template | ✅ | +| minReadySeconds | no | +| strategy\.type | no | +| strategy\.rollingUpdate\.maxSurge | no | +| strategy\.rollingUpdate\.maxUnavailable | no | +| revisionHistoryLimit | no | + +## Job Fields + +| Field | Support | +|-------------------------|----------------------------------| +| activeDeadlineSeconds | no | +| selector | no (automatically set by k8s) | +| template | ✅ | +| backoffLimit | no | +| completionMode | no | +| completions | no (set to 1 with kube generate) | +| manualSelector | no | +| parallelism | no (set to 1 with kube generate) | +| podFailurePolicy | no | +| suspend | no | +| ttlSecondsAfterFinished | no | + +[//]: # (END included file ../../kubernetes_support.md) + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-kube(1)](podman-kube.1.md)**, **[podman-kube-down(1)](podman-kube-down.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)**, **[podman-build(1)](podman-build.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-kube.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-kube.1.md new file mode 100644 index 000000000..3cab159a4 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-kube.1.md @@ -0,0 +1,35 @@ +--- +title: podman-kube +version: v5.4.1 +--- + +% podman-kube 1 + +## NAME +podman\-kube - Play containers, pods or volumes based on a structured input file + +## SYNOPSIS +**podman kube** *subcommand* + +## DESCRIPTION +The kube command recreates containers, pods or volumes based on the input from a structured (like YAML) +file input. Containers are automatically started. + +Note: The kube commands in podman focus on simplifying the process of moving containers from podman to a Kubernetes +environment and from a Kubernetes environment back to podman. Podman is not replicating the kubectl CLI. Once containers +are deployed to a Kubernetes cluster from podman, please use `kubectl` to manage the workloads in the cluster. + +## COMMANDS + +| Command | Man Page | Description | +| ------- | ---------------------------------------------------- | ----------------------------------------------------------------------------- | +| apply | [podman-kube-apply(1)](podman-kube-apply.1.md) | Apply Kubernetes YAML based on containers, pods, or volumes to a Kubernetes cluster | +| down | [podman-kube-down(1)](podman-kube-down.1.md) | Remove containers and pods based on Kubernetes YAML. | +| generate | [podman-kube-generate(1)](podman-kube-generate.1.md) | Generate Kubernetes YAML based on containers, pods or volumes. | +| play | [podman-kube-play(1)](podman-kube-play.1.md) | Create containers, pods and volumes based on Kubernetes YAML. | + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-down(1)](podman-kube-down.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)**, **[podman-kube-apply(1)](podman-kube-apply.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-load.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-load.1.md new file mode 100644 index 000000000..c207d2dc8 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-load.1.md @@ -0,0 +1,92 @@ +--- +title: podman-load +version: v5.4.1 +--- + +% podman-load 1 + +## NAME +podman\-load - Load image(s) from a tar archive into container storage + +## SYNOPSIS +**podman load** [*options*] + +**podman image load** [*options*] + +## DESCRIPTION +**podman load** loads an image from either an **oci-archive** or a **docker-archive** stored on the local machine into container storage. **podman load** reads from stdin by default or a file if the **input** option is set. +**podman load** is used for loading from the archive generated by **podman save**, that includes the image parent layers. To load the archive of container's filesystem created by **podman export**, use **podman import**. + +The local client further supports loading an **oci-dir** or a **docker-dir** as created with **podman save** (1). + +The **quiet** option suppresses the progress output when set. +Note: `:` is a restricted character and cannot be part of the file name. + + +**podman [GLOBAL OPTIONS]** + +**podman load [GLOBAL OPTIONS]** + +**podman load [OPTIONS]** + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--input**, **-i**=*input* + +Load the specified input file instead of from stdin. The file can be on the local file system or on a server (e.g., https://server.com/archive.tar). Also supports loading in compressed files. + +The remote client, including Mac and Windows (excluding WSL2) machines, requires the use of this option. + +NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of container images. Podman defaults to use `/var/tmp`. + +#### **--quiet**, **-q** + +Suppress the progress output + +## EXAMPLES + +Create an image from a compressed tar file, without showing progress. +``` +$ podman load --quiet -i fedora.tar.gz +``` + +Create an image from the archive.tar file pulled from a URL, without showing progress. +``` +$ podman load -q -i https://server.com/archive.tar +``` + +Create an image from stdin using bash redirection from a tar file. +``` +$ podman load < fedora.tar +Getting image source signatures +Copying blob sha256:5bef08742407efd622d243692b79ba0055383bbce12900324f75e56f589aedb0 + 0 B / 4.03 MB [---------------------------------------------------------------] +Copying config sha256:7328f6f8b41890597575cbaadc884e7386ae0acc53b747401ebce5cf0d624560 + 0 B / 1.48 KB [---------------------------------------------------------------] +Writing manifest to image destination +Storing signatures +Loaded image: registry.fedoraproject.org/fedora:latest +``` + +Create an image from stdin using a pipe. +``` +$ cat fedora.tar | podman load +Getting image source signatures +Copying blob sha256:5bef08742407efd622d243692b79ba0055383bbce12900324f75e56f589aedb0 + 0 B / 4.03 MB [---------------------------------------------------------------] +Copying config sha256:7328f6f8b41890597575cbaadc884e7386ae0acc53b747401ebce5cf0d624560 + 0 B / 1.48 KB [---------------------------------------------------------------] +Writing manifest to image destination +Storing signatures +Loaded image: registry.fedoraproject.org/fedora:latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-save(1)](podman-save.1.md)** + +## HISTORY +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-login.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-login.1.md new file mode 100644 index 000000000..10ac7b1f0 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-login.1.md @@ -0,0 +1,188 @@ +--- +title: podman-login +version: v5.4.1 +--- + +% podman-login 1 + +## NAME +podman\-login - Log in to a container registry + +## SYNOPSIS +**podman login** [*options*] [*registry*] + +## DESCRIPTION +**podman login** logs into a specified registry server with the correct username +and password. If the registry is not specified, the first registry under [registries.search] +from registries.conf is used. **podman login** reads in the username and password from STDIN. +The username and password can also be set using the **username** and **password** flags. +The path of the authentication file can be specified by the user by setting the **authfile** +flag. The default path for reading and writing credentials is **${XDG\_RUNTIME\_DIR}/containers/auth.json**. +Podman uses existing credentials if the user does not pass in a username. +Podman first searches for the username and password in the **${XDG\_RUNTIME\_DIR}/containers/auth.json**, if they are not valid, +Podman then uses any existing credentials found in **$HOME/.docker/config.json**. +If those credentials are not present, Podman creates **${XDG\_RUNTIME\_DIR}/containers/auth.json** (if the file does not exist) and +then stores the username and password from STDIN as a base64 encoded string in it. +For more details about format and configurations of the auth.json file, see containers-auth.json(5) + +**podman [GLOBAL OPTIONS]** + +**podman login [GLOBAL OPTIONS]** + +**podman login [OPTIONS] [REGISTRY] [GLOBAL OPTIONS]** + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/compat-auth-file.md) +#### **--compat-auth-file**=*path* + +Instead of updating the default credentials file, update the one at *path*, and use a Docker-compatible format. + +[//]: # (END included file options/compat-auth-file.md) + +#### **--get-login** + +Return the logged-in user for the registry. Return error if no login is found. + +#### **--help**, **-h** + +Print usage statement + +#### **--password**, **-p**=*password* + +Password for registry + +#### **--password-stdin** + +Take the password from stdin + +#### **--secret**=*name* + +Read the password for the registry from the podman secret `name`. +If --username is not specified --username=`name` is used. + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +#### **--username**, **-u**=*username* + +Username for registry + +#### **--verbose**, **-v** + +print detailed information about credential store + +## EXAMPLES + +Add login credentials for specified registry to default authentication file; +note that unlike the `docker` default, the default credentials are under `$XDG_RUNTIME_DIR` +which is a subdirectory of `/run` (an emphemeral directory) and hence do not persist across reboot. + +``` +$ podman login quay.io +Username: umohnani +Password: +Login Succeeded! +``` + +To explicitly preserve credentials across reboot, you will need to specify +the default persistent path: + +``` +$ podman login --authfile ~/.config/containers/auth.json quay.io +Username: umohnani +Password: +Login Succeeded! +``` + +Add login credentials using specified username and password for local registry to default authentication file. +``` +$ podman login -u testuser -p testpassword localhost:5000 +Login Succeeded! +``` + +Add login credentials for alternate authfile path for the specified registry. +``` +$ podman login --authfile authdir/myauths.json quay.io +Username: umohnani +Password: +Login Succeeded! +``` + +Add login credentials using a Podman secret for the password. +``` +$ echo -n MySecret! | podman secret create secretname - +a0ad54df3c97cf89d5ca6193c +$ podman login --secret secretname -u testuser quay.io +Login Succeeded! +``` + +Add login credentials for user test with password test to localhost:5000 registry disabling tls verification requirement. +``` +$ podman login --tls-verify=false -u test -p test localhost:5000 +Login Succeeded! +``` + +Add login credentials for user foo with password bar to localhost:5000 registry using the certificate directory /etc/containers/certs.d. +``` +$ podman login --cert-dir /etc/containers/certs.d/ -u foo -p bar localhost:5000 +Login Succeeded! +``` + +Add login credentials for specified registries to default authentication file for given user with password information provided via stdin from a file on disk. +``` +$ podman login -u testuser --password-stdin < testpassword.txt docker.io +Login Succeeded! +``` + +Add login credentials for specified registry to default authentication file for given user with password information provided via stdin from a pipe. +``` +$ echo $testpassword | podman login -u testuser --password-stdin quay.io +Login Succeeded! +``` + +Add login credentials for specified registry to default authentication file in verbose mode. +``` +$ podman login quay.io --verbose +Username: myusername +Password: +Used: /run/user/1000/containers/auth.json +Login Succeeded! +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-logout(1)](podman-logout.1.md)**, **[containers-auth.json(5)](https://github.com/containers/image/blob/main/docs/containers-auth.json.5.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[podman-secret(1)](podman-secret.1.md)**, **[podman-secret-create(1)](podman-secret-create.1.md)** + +## HISTORY +August 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-logout.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-logout.1.md new file mode 100644 index 000000000..3c003c3a8 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-logout.1.md @@ -0,0 +1,77 @@ +--- +title: podman-logout +version: v5.4.1 +--- + +% podman-logout 1 + +## NAME +podman\-logout - Log out of a container registry + +## SYNOPSIS +**podman logout** [*options*] *registry* + +## DESCRIPTION +**podman logout** logs out of a specified registry server by deleting the cached credentials +stored in the **auth.json** file. If the registry is not specified, the first registry under [registries.search] +from registries.conf is used. The path of the authentication file can be overridden by the user by setting the **authfile** flag. +The default path used is **${XDG\_RUNTIME\_DIR}/containers/auth.json**. For more details about format and configurations of the auth,json file, see containers-auth.json(5) +All the cached credentials can be removed by setting the **all** flag. + +**podman [GLOBAL OPTIONS]** + +**podman logout [GLOBAL OPTIONS]** + +**podman logout [OPTIONS] REGISTRY [GLOBAL OPTIONS]** + +## OPTIONS + +#### **--all**, **-a** + +Remove the cached credentials for all registries in the auth file + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/compat-auth-file.md) +#### **--compat-auth-file**=*path* + +Instead of updating the default credentials file, update the one at *path*, and use a Docker-compatible format. + +[//]: # (END included file options/compat-auth-file.md) + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Remove login credentials for the docker.io registry from the authentication file: +``` +$ podman logout docker.io +``` + +Remove login credentials for the docker.io registry from the authdir/myauths.json file: +``` +$ podman logout --authfile authdir/myauths.json docker.io +``` + +Remove login credentials for all registries: +``` +$ podman logout --all +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-auth.json(5)](https://github.com/containers/image/blob/main/docs/containers-auth.json.5.md)** + +## HISTORY +August 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-logs.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-logs.1.md new file mode 100644 index 000000000..add1a4c7b --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-logs.1.md @@ -0,0 +1,173 @@ +--- +title: podman-logs +version: v5.4.1 +--- + +% podman-logs 1 + +## NAME +podman\-logs - Display the logs of one or more containers + +## SYNOPSIS +**podman logs** [*options*] *container* [*container...*] + +**podman container logs** [*options*] *container* [*container...*] + +## DESCRIPTION +The podman logs command batch-retrieves whatever logs are present for one or more containers at the time of execution. +This does not guarantee execution order when combined with podman run (i.e. the run may not have generated +any logs at the time podman logs was executed). + +## OPTIONS + + +[//]: # (BEGIN included file options/color.md) +#### **--color** + +Output the containers with different colors in the log. + +[//]: # (END included file options/color.md) + + +[//]: # (BEGIN included file options/follow.md) +#### **--follow**, **-f** + +Follow log output. Default is false. + +Note: When following a container which is removed by `podman container rm` +or removed on exit (`podman run --rm ...`), there is a chance that the log +file is removed before `podman logs` reads the final content. + +[//]: # (END included file options/follow.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/names.md) +#### **--names**, **-n** + +Output the container names instead of the container IDs in the log. + +[//]: # (END included file options/names.md) + + +[//]: # (BEGIN included file options/since.md) +#### **--since**=*TIMESTAMP* + +Show logs since TIMESTAMP. The --since option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. + +[//]: # (END included file options/since.md) + + +[//]: # (BEGIN included file options/tail.md) +#### **--tail**=*LINES* + +Output the specified number of LINES at the end of the logs. LINES must be an integer. Defaults to -1, +which prints all lines + +[//]: # (END included file options/tail.md) + + +[//]: # (BEGIN included file options/timestamps.md) +#### **--timestamps**, **-t** + +Show timestamps in the log outputs. The default is false + +[//]: # (END included file options/timestamps.md) + + +[//]: # (BEGIN included file options/until.md) +#### **--until**=*TIMESTAMP* + +Show logs until TIMESTAMP. The --until option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. + +[//]: # (END included file options/until.md) + +## EXAMPLE + +To view a container's logs: +``` +podman logs -t b3f2436bdb978c1d33b1387afb5d7ba7e3243ed2ce908db431ac0069da86cb45 + +2017/08/07 10:16:21 Seeked /var/log/crio/pods/eb296bd56fab164d4d3cc46e5776b54414af3bf543d138746b25832c816b933b/c49f49788da14f776b7aa93fb97a2a71f9912f4e5a3e30397fca7dfe0ee0367b.log - &{Offset:0 Whence:0} +1:C 07 Aug 14:10:09.055 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo +1:C 07 Aug 14:10:09.055 # Redis version=4.0.1, bits=64, commit=00000000, modified=0, pid=1, just started +1:C 07 Aug 14:10:09.055 # Warning: no config file specified, using the default config. In order to specify a config file use redis-server /path/to/redis.conf +1:M 07 Aug 14:10:09.055 # You requested maxclients of 10000 requiring at least 10032 max file descriptors. +1:M 07 Aug 14:10:09.055 # Server can't set maximum open files to 10032 because of OS error: Operation not permitted. +1:M 07 Aug 14:10:09.055 # Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit. If you need higher maxclients increase 'ulimit -n'. +1:M 07 Aug 14:10:09.056 * Running mode=standalone, port=6379. +1:M 07 Aug 14:10:09.056 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. +1:M 07 Aug 14:10:09.056 # Server initialized +``` + +To view only the last two lines in container's log: +``` +podman logs --tail 2 b3f2436bdb97 + +# WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. +# Server initialized +``` + +To view all containers logs: +``` +podman logs -t --since 0 myserver + +1:M 07 Aug 14:10:09.055 # Server can't set maximum open files to 10032 because of OS error: Operation not permitted. +1:M 07 Aug 14:10:09.055 # Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit. If you need higher maxclients increase 'ulimit -n'. +1:M 07 Aug 14:10:09.056 * Running mode=standalone, port=6379. +1:M 07 Aug 14:10:09.056 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. +1:M 07 Aug 14:10:09.056 # Server initialized +``` + +To view a container's logs since a certain time: +``` +podman logs -t --since 2017-08-07T10:10:09.055837383-04:00 myserver + +1:M 07 Aug 14:10:09.055 # Server can't set maximum open files to 10032 because of OS error: Operation not permitted. +1:M 07 Aug 14:10:09.055 # Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit. If you need higher maxclients increase 'ulimit -n'. +1:M 07 Aug 14:10:09.056 * Running mode=standalone, port=6379. +1:M 07 Aug 14:10:09.056 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. +1:M 07 Aug 14:10:09.056 # Server initialized +``` + +To view a container's logs generated in the last 10 minutes: +``` +podman logs --since 10m myserver + +# Server can't set maximum open files to 10032 because of OS error: Operation not permitted. +# Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit, Increase 'ulimit -n' when higher maxclients are required. +``` + +To view a container's logs until 30 minutes ago: +``` +podman logs --until 30m myserver + +AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.0.2.100. Set the 'ServerName' directive globally to suppress this message +AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.0.2.100. Set the 'ServerName' directive globally to suppress this message +[Tue Jul 20 13:18:14.223727 2021] [mpm_event:notice] [pid 1:tid 140021067187328] AH00489: Apache/2.4.48 (Unix) configured -- resuming normal operations +[Tue Jul 20 13:18:14.223819 2021] [core:notice] [pid 1:tid 140021067187328] AH00094: Command line: 'httpd -D FOREGROUND' +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-rm(1)](podman-rm.1.md)** + +## HISTORY +February 2018, Updated by Brent Baude + +August 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-machine-info.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-machine-info.1.md new file mode 100644 index 000000000..e894bc919 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-machine-info.1.md @@ -0,0 +1,107 @@ +--- +title: podman-machine-info +version: v5.4.1 +--- + +% podman-machine-info 1 + +## NAME +podman\-machine\-info - Display machine host info + +## SYNOPSIS +**podman machine info** + +## DESCRIPTION + +Display information pertaining to the machine host. +Rootless only, as all `podman machine` commands can be only be used with rootless Podman. + +*Note*: The `DefaultMachine` field in the `Host` output does not suggest that +one can set a default podman machine via system connections. This value represents +the current active system connection associated with a podman machine. Regardless +of the default system connection, the default podman machine will always be +`podman-machine-default`. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change output format to "json" or a Go template. + +| **Placeholder** | **Description** | +| ------------------- | --------------------------------- | +| .Host ... | Host information for local machine| +| .Version ... | Version of the machine | + +#### **--help** + +Print usage statement. + +## EXAMPLES + +Display default Podman machine info. +``` +$ podman machine info +Host: + Arch: amd64 + CurrentMachine: "" + DefaultMachine: "" + EventsDir: /run/user/3267/podman + MachineConfigDir: /home/myusername/.config/containers/podman/machine/qemu + MachineImageDir: /home/myusername/.local/share/containers/podman/machine/qemu + MachineState: "" + NumberOfMachines: 0 + OS: linux + VMType: qemu +Version: + APIVersion: 4.4.0 + Built: 1677097848 + BuiltTime: Wed Feb 22 15:30:48 2023 + GitCommit: aa196c0d5c9abd5800edf9e27587c60343a26c2b-dirty + GoVersion: go1.20 + Os: linux + OsArch: linux/amd64 + Version: 4.4.0 +``` + +Display default Podman machine info formatted as json. +``` +$ podman machine info --format json +{ + "Host": { + "Arch": "amd64", + "CurrentMachine": "", + "DefaultMachine": "", + "EventsDir": "/run/user/3267/podman", + "MachineConfigDir": "/home/myusername/.config/containers/podman/machine/qemu", + "MachineImageDir": "/home/myusername/.local/share/containers/podman/machine/qemu", + "MachineState": "", + "NumberOfMachines": 0, + "OS": "linux", + "VMType": "qemu" + }, + "Version": { + "APIVersion": "4.4.0", + "Version": "4.4.0", + "GoVersion": "go1.20", + "GitCommit": "aa196c0d5c9abd5800edf9e27587c60343a26c2b-dirty", + "BuiltTime": "Wed Feb 22 15:30:48 2023", + "Built": 1677097848, + "OsArch": "linux/amd64", + "Os": "linux" + } +} +``` + +Display default Podman machine Host.Arch field. +``` +$ podman machine info --format "{{ .Host.Arch }}" +amd64 + +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +June 2022, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-machine-init.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-machine-init.1.md new file mode 100644 index 000000000..40ef70453 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-machine-init.1.md @@ -0,0 +1,250 @@ +--- +title: podman-machine-init +version: v5.4.1 +--- + +% podman-machine-init 1 + +## NAME +podman\-machine\-init - Initialize a new virtual machine + +## SYNOPSIS +**podman machine init** [*options*] [*name*] + +## DESCRIPTION + +Initialize a new virtual machine for Podman. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then the new machine will be named `podman-machine-default`. + +Rootless only. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +**podman machine init** initializes a new Linux virtual machine where containers are run. +SSH keys are automatically generated to access the VM, and system connections to the root account +and a user account inside the VM are added. + +By default, the VM distribution is [Fedora CoreOS](https://getfedora.org/en/coreos?stream=testing) except for +WSL which is based on a custom Fedora image. While Fedora CoreOS upgrades come out every 14 days, the automatic +update mechanism Zincata is disabled by Podman machine. + +To check if there is an upgrade available for your machine os, you can run the following command: + +``` +$ podman machine ssh 'sudo rpm-ostree upgrade --check' + +``` +If an update is available, you can rerun the above command and remove the `--check` and your operating system will +be updated. After updating, you must stop and start your machine with `podman machine stop && podman machine start` for +it to take effect. + +Note: Updating as described above can result in version mismatches between Podman on the host and Podman in the +machine. Executing `podman info` should reveal versions of both. A configuration where the Podman host and machine +mismatch are unsupported. + +For more information on updates and advanced configuration, +see the Fedora CoreOS documentation about [auto-updates](https://docs.fedoraproject.org/en-US/fedora-coreos/auto-updates/) and [update strategies](https://coreos.github.io/zincati/usage/updates-strategy/). + + + + +Fedora CoreOS upgrades come out every 14 days and are detected and installed automatically. The VM is rebooted during the upgrade. +For more information on updates and advanced configuration, +see the Fedora CoreOS documentation about [auto-updates](https://docs.fedoraproject.org/en-US/fedora-coreos/auto-updates/) and [update strategies](https://coreos.github.io/zincati/usage/updates-strategy/). + +Default Podman machine settings can be set via the [machine] section in the containers.conf(5) file. + +## OPTIONS + +#### **--cpus**=*number* + +Number of CPUs. + +#### **--disk-size**=*number* + +Size of the disk for the guest VM in GiB. + +#### **--help** + +Print usage statement. + +#### **--ignition-path** + +Fully qualified path of the ignition file. + +If an ignition file is provided, the file +is copied into the user's CONF_DIR and renamed. Additionally, no SSH keys are generated, nor are any system connections made. It is assumed that the user does these things manually or handled otherwise. + +#### **--image** + +Fully qualified registry, path, or URL to a VM image. +Registry target must be in the form of `docker://registry/repo/image:version`. + +Note: Only images provided by podman will be supported. + +#### **--memory**, **-m**=*number* + +Memory (in MiB). Note: 1024MiB = 1GiB. + +#### **--now** + +Start the virtual machine immediately after it has been initialized. + +#### **--playbook** + +Add the provided Ansible playbook to the machine and execute it after the first boot. + +Note: The playbook will be executed with the same privileges given to the user in the virtual machine. The playbook provided cannot include other files from the host system, as they will not be copied. +Use of the `--playbook` flag will require the image to include Ansible. The default image provided will have Ansible included. + +#### **--rootful** + +Whether this machine prefers rootful (`true`) or rootless (`false`) +container execution. This option determines the remote connection default +if there is no existing remote connection configurations. + +API forwarding, if available, follows this setting. + +#### **--timezone** + +Set the timezone for the machine and containers. Valid values are `local` or +a `timezone` such as `America/Chicago`. A value of `local`, which is the default, +means to use the timezone of the machine host. + +The timezone setting is not used with WSL. WSL automatically sets the timezone to the same +as the host Windows operating system. + +#### **--usb**=*bus=number,devnum=number* or *vendor=hexadecimal,product=hexadecimal* + +Assign a USB device from the host to the VM via USB passthrough. +Only supported for QEMU Machines. + +The device needs to have proper permissions in order to be passed to the machine. This +means the device needs to be under your user group. + +Note that using bus and device number are simpler but the values can change every boot +or when the device is unplugged. + +When specifying a USB using vendor and product ID's, if more than one device has the +same vendor and product ID, the first available device is assigned. + + +[//]: # (BEGIN included file options/user-mode-networking.md) +#### **--user-mode-networking** + +Indicates that this machine relays traffic from the guest through a user-space +process running on the host. In some VPN configurations the VPN may drop +traffic from alternate network interfaces, including VM network devices. By +enabling user-mode networking (a setting of `true`), VPNs observe all +podman machine traffic as coming from the host, bypassing the problem. + +When the qemu backend is used (Linux, Mac), user-mode networking is +mandatory and the only allowed value is `true`. In contrast, The Windows/WSL +backend defaults to `false`, and follows the standard WSL network setup. +Changing this setting to `true` on Windows/WSL informs Podman to replace +the WSL networking setup on start of this machine instance with a user-mode +networking distribution. Since WSL shares the same kernel across +distributions, all other running distributions reuses this network. +Likewise, when the last machine instance with a `true` setting stops, the +original networking setup is restored. + +[//]: # (END included file options/user-mode-networking.md) + +#### **--username** + +Username to use for executing commands in remote VM. Default value is `core` +for FCOS and `user` for Fedora (default on Windows hosts). Should match the one +used inside the resulting VM image. + +#### **--volume**, **-v**=*source:target[\\\:options]* + +Mounts a volume from source to target. + +Create a mount. If /host-dir:/machine-dir is specified as the `*source:target*`, +Podman mounts _host-dir_ in the host to _machine-dir_ in the Podman machine. + +Additional options may be specified as a comma-separated string. Recognized +options are: +* **ro**: mount volume read-only +* **rw**: mount volume read/write (default) +* **security_model=[model]**: specify 9p security model (see below) + +The 9p security model [determines] https://wiki.qemu.org/Documentation/9psetup#Starting_the_Guest_directly +if and how the 9p filesystem translates some filesystem operations before +actual storage on the host. + +In order to allow symlinks to work, on MacOS the default security model is + *none*. + +The value of *mapped-xattr* specifies that 9p store symlinks and some file +attributes as extended attributes on the host. This is suitable when the host +and the guest do not need to interoperate on the shared filesystem, but has +caveats for actual shared access; notably, symlinks on the host are not usable +on the guest and vice versa. If interoperability is required, then choose +*none* instead, but keep in mind that the guest is not able to do things +that the user running the virtual machine cannot do, e.g. create files owned by +another user. Using *none* is almost certainly the best choice for read-only +volumes. + +Example: `-v "$HOME/git:$HOME/git:ro,security_model=none"` + +Default volume mounts are defined in *containers.conf*. Unless changed, the default values +is `$HOME:$HOME`. + +**Note on Windows Subsystem for Linux (WSL)** +Since all drives are mounted at `/mnt` on startup by default in WSL, passing +`--volume` is redundant and has no effect. The host home directory for a `C:` +drive will be mounted at `/mnt/c/Users/`. + +## EXAMPLES + +Initialize the default Podman machine, pulling the content from the internet. +``` +$ podman machine init +``` + +Initialize a Podman machine for the specified name pulling the content from the internet. +``` +$ podman machine init myvm +``` + +Initialize the default Podman machine pulling the content from the internet defaulting to rootful mode. The default is rootless. +``` +$ podman machine init --rootful +``` + +Initialize the default Podman machine overriding its disk size override, pulling the content from the internet. +``` +$ podman machine init --disk-size 50 +``` + +Initialize the specified Podman machine overriding its memory size, pulling the content from the internet. +``` +$ podman machine init --memory=1024 myvm +``` + +Initialize the default Podman machine with the host directory `/Users` mounted into the VM at `/Users`. +``` +$ podman machine init -v /Users:/Users +``` + +Initialize the default Podman machine with a usb device passthrough specified with options. Only supported for QEMU Machines. +``` +$ podman machine init --usb vendor=13d3,product=5406 +``` + +Initialize the default Podman machine with a usb device passthrough with specified with options. Only supported for QEMU Machines. +``` +$ podman machine init --usb bus=1,devnum=3 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**, **containers.conf(5)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-machine-inspect.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-machine-inspect.1.md new file mode 100644 index 000000000..67219e69e --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-machine-inspect.1.md @@ -0,0 +1,60 @@ +--- +title: podman-machine-inspect +version: v5.4.1 +--- + +% podman-machine-inspect 1 + +## NAME +podman\-machine\-inspect - Inspect one or more virtual machines + +## SYNOPSIS +**podman machine inspect** [*options*] [*name*] ... + +## DESCRIPTION + +Inspect one or more virtual machines + +Obtain greater detail about Podman virtual machines. More than one virtual machine can be +inspected at once. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be inspected. + +Rootless only. + +## OPTIONS +#### **--format** + +Print results with a Go template. + +| **Placeholder** | **Description** | +| ------------------- | --------------------------------------------------------------------- | +| .ConfigDir ... | Machine configuration directory location | +| .ConnectionInfo ... | Machine connection information | +| .Created ... | Machine creation time (string, ISO3601) | +| .LastUp ... | Time when machine was last booted | +| .Name | Name of the machine | +| .Resources ... | Resources used by the machine | +| .Rootful | Whether the machine prefers rootful or rootless container execution | +| .Rosetta | Whether this machine uses Rosetta | +| .SSHConfig ... | SSH configuration info for communicating with machine | +| .State | Machine state | +| .UserModeNetworking | Whether this machine uses user-mode networking | + +#### **--help** + +Print usage statement. + +## EXAMPLES + +Inspect the specified Podman machine. +``` +$ podman machine inspect podman-machine-default +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +April 2022, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-machine-list.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-machine-list.1.md new file mode 100644 index 000000000..383ed7d7d --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-machine-list.1.md @@ -0,0 +1,117 @@ +--- +title: podman-machine-list +version: v5.4.1 +--- + +% podman-machine-list 1 + +## NAME +podman\-machine\-list - List virtual machines + +## SYNOPSIS +**podman machine list** [*options*] + +**podman machine ls** [*options*] + +## DESCRIPTION + +List Podman managed virtual machines. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +Rootless only. + +NOTE: The podman-machine configuration file is managed under the +`$XDG_CONFIG_HOME/containers/podman/machine/` directory. Changing the `$XDG_CONFIG_HOME` +environment variable while the machines are running can lead to unexpected behavior. +(see [podman(1)](podman.1.md)) + +## OPTIONS + +#### **--all-providers** + +Show machines from all providers + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------- | ----------------------------------------- | +| .CPUs | Number of CPUs | +| .Created | Time since VM creation | +| .Default | Is default machine | +| .DiskSize | Disk size of machine | +| .IdentityPath | Path to ssh identity file | +| .LastUp | Time since the VM was last run | +| .Memory | Allocated memory for machine | +| .Name | VM name | +| .Port | SSH Port to use to connect to VM | +| .RemoteUsername | VM Username for rootless Podman | +| .Running | Is machine running | +| .Stream | Stream name | +| .UserModeNetworking | Whether machine uses user-mode networking | +| .VMType | VM type | + +#### **--help** + +Print usage statement. + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Only print the name of the machine. This also implies no table heading +is printed. + +## EXAMPLES + +List all Podman machines. +``` +$ podman machine list +NAME VM TYPE CREATED LAST UP CPUS MEMORY DISK SIZE +podman-machine-default qemu 2 weeks ago 2 weeks ago 1 2.147GB 10.74GB +``` + +List all Podman machines using the specified table format. +``` +$ podman machine ls --format "table {{.Name}}\t{{.VMType}}\t{{.Created}}\t{{.LastUp}}" +NAME VM TYPE CREATED LAST UP +podman-machine-default qemu 2 weeks ago 2 weeks ago +``` + +List all Podman machines in json format. +``` +$ podman machine ls --format json +[ + { + "Name": "podman-machine-default", + "Default": false, + "Created": "2021-12-27T10:36:14.373347492-05:00", + "Running": false, + "LastUp": "2021-12-27T11:22:50.17333371-05:00", + "Stream": "default", + "VMType": "qemu", + "CPUs": 1, + "Memory": "2147483648", + "DiskSize": "10737418240" + } +] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-machine-os-apply.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-machine-os-apply.1.md new file mode 100644 index 000000000..1d805c9e4 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-machine-os-apply.1.md @@ -0,0 +1,54 @@ +--- +title: podman-machine-os-apply +version: v5.4.1 +--- + +% podman-machine-os-apply 1 + +## NAME +podman\-machine\-os\-apply - Apply an OCI image to a Podman Machine's OS + +## SYNOPSIS +**podman machine os apply** [*options*] *image* [vm] + +## DESCRIPTION + +Apply machine OS changes from an OCI image. + +VM's that use OS's that use rpm-ostreee have the capability to rebase itself from the content of an OCI image. +`podman machine image apply` takes an OCI image with container native ostree functionality and rebases itself on that image. + +By default, Podman machines on Mac and Linux use an rpm-ostree based distribution (Fedora CoreOS). + +For more information, see the [rpm-ostree documentation](https://coreos.github.io/rpm-ostree/container/). + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then the OS changes will be applied to `podman-machine-default`. + +## OPTIONS + +#### **--help** + +Print usage statement. + +#### **--restart** + +Restart VM after applying changes. + +## EXAMPLES + +Update the default Podman machine to the specified bootable OCI image. +``` +$ podman machine os apply quay.io/podman_next +``` + +Update the specified Podman machine to the specified bootable OCI image. +``` +$ podman machine os apply quay.io/podman_next podman-machine-default +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**, **[podman-machine-os(1)](podman-machine-os.1.md)** + +## HISTORY +February 2023, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-machine-os.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-machine-os.1.md new file mode 100644 index 000000000..d1b18d490 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-machine-os.1.md @@ -0,0 +1,27 @@ +--- +title: podman-machine-os +version: v5.4.1 +--- + +% podman-machine-os 1 + +## NAME +podman\-machine\-os - Manage a Podman virtual machine's OS + +## SYNOPSIS +**podman machine os** *subcommand* + +## DESCRIPTION +`podman machine os` is a set of subcommands that manage a Podman virtual machine's operating system. + +## SUBCOMMANDS + +| Command | Man Page | Description | +|---------|--------------------------------------------------------------|----------------------------------------------| +| apply | [podman-machine-os-apply(1)](podman-machine-os-apply.1.md) | Apply an OCI image to a Podman Machine's OS | + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**, **[podman-machine-os-apply(1)](podman-machine-os-apply.1.md)** + +## HISTORY +February 2023, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-machine-reset.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-machine-reset.1.md new file mode 100644 index 000000000..073a781bd --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-machine-reset.1.md @@ -0,0 +1,52 @@ +--- +title: podman-machine-reset +version: v5.4.1 +--- + +% podman-machine-reset 1 + +## NAME +podman\-machine\-reset - Reset Podman machines and environment + +## SYNOPSIS +**podman machine reset** [*options*] + +## DESCRIPTION + +Reset your Podman machine environment. This command stops any running machines +and then removes them. Configuration and data files are then removed. Data files +would include machine disk images and any previously pulled cache images. When +this command is run, all of your Podman machines will have been deleted. + +## OPTIONS + +#### **--force**, **-f** + +Reset without confirmation. + +#### **--help** + +Print usage statement. + + +## EXAMPLES + +``` +$ podman machine reset +Warning: this command will delete all existing podman machines +and all of the configuration and data directories for Podman machines + +The following machine(s) will be deleted: + +dev +podman-machine-default + +Are you sure you want to continue? [y/N] y +$ +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +Feb 2024, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-machine-rm.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-machine-rm.1.md new file mode 100644 index 000000000..ff9797648 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-machine-rm.1.md @@ -0,0 +1,71 @@ +--- +title: podman-machine-rm +version: v5.4.1 +--- + +% podman-machine-rm 1 + +## NAME +podman\-machine\-rm - Remove a virtual machine + +## SYNOPSIS +**podman machine rm** [*options*] [*name*] + +## DESCRIPTION + +Remove a virtual machine and its related files. What is actually deleted +depends on the virtual machine type. For all virtual machines, the generated +podman system connections are deleted. The ignition files +generated for that VM are also removed as is its image file on the filesystem. + +Users get a display of what is deleted and are required to confirm unless the option `--force` +is used. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be removed. + +Rootless only. + +## OPTIONS + +#### **--force**, **-f** + +Stop and delete without confirmation. + +#### **--help** + +Print usage statement. + +#### **--save-ignition** + +Do not delete the generated ignition file. + +#### **--save-image** + +Do not delete the VM image. + +## EXAMPLES + +Remove the specified Podman machine. +``` +$ podman machine rm test1 + +The following files will be deleted: + +/home/user/.config/containers/podman/machine/qemu/test1.ign +/home/user/.local/share/containers/podman/machine/qemu/test1_fedora-coreos-33.20210315.1.0-qemu.x86_64.qcow2 +/home/user/.config/containers/podman/machine/qemu/test1.json + +Are you sure you want to continue? [y/N] y +``` + +Remove the specified Podman machine even if it is running. +``` +$ podman machine rm -f test1 +$ +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-machine-set.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-machine-set.1.md new file mode 100644 index 000000000..dc970bd9c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-machine-set.1.md @@ -0,0 +1,126 @@ +--- +title: podman-machine-set +version: v5.4.1 +--- + +% podman-machine-set 1 + +## NAME +podman\-machine\-set - Set a virtual machine setting + +## SYNOPSIS +**podman machine set** [*options*] [*name*] + +## DESCRIPTION + +Change a machine setting. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then the settings will be applied to `podman-machine-default`. + +Rootless only. + +Default Podman machine settings can be set via the [machine] section in the containers.conf(5) file. + +## OPTIONS + +#### **--cpus**=*number* + +Number of CPUs. +Only supported for QEMU machines. + +#### **--disk-size**=*number* + +Size of the disk for the guest VM in GB. +Can only be increased. Only supported for QEMU machines. + +#### **--help** + +Print usage statement. + +#### **--memory**, **-m**=*number* + +Memory (in MB). +Only supported for QEMU machines. + +#### **--rootful** + +Whether this machine prefers rootful (`true`) or rootless (`false`) +container execution. This option updates the current podman +remote connection default if it is currently pointing at the specified +machine name (or `podman-machine-default` if no name is specified). + +Unlike [**podman system connection default**](podman-system-connection-default.1.md) +this option makes the API socket, if available, forward to the rootful/rootless +socket in the VM. + +Note that changing this option means that all the existing containers/images/volumes, etc... +are no longer visible with the default connection/socket. This is because the root and rootless +users in the VM are completely separated and do not share any storage. The data however is not +lost and you can always change this option back or use the other connection to access it. + +#### **--usb**=*bus=number,devnum=number* or *vendor=hexadecimal,product=hexadecimal* or *""* + +Assign a USB device from the host to the VM. +Only supported for QEMU Machines. + +The device needs to be present when the VM starts. +The device needs to have proper permissions in order to be assign to podman machine. + +Use an empty string to remove all previously set USB devices. + +Note that using bus and device number are simpler but the values can change every boot or when the +device is unplugged. Using vendor and product might lead to collision in the case of multiple +devices with the same vendor product value, the first available device is assigned. + + +[//]: # (BEGIN included file options/user-mode-networking.md) +#### **--user-mode-networking** + +Indicates that this machine relays traffic from the guest through a user-space +process running on the host. In some VPN configurations the VPN may drop +traffic from alternate network interfaces, including VM network devices. By +enabling user-mode networking (a setting of `true`), VPNs observe all +podman machine traffic as coming from the host, bypassing the problem. + +When the qemu backend is used (Linux, Mac), user-mode networking is +mandatory and the only allowed value is `true`. In contrast, The Windows/WSL +backend defaults to `false`, and follows the standard WSL network setup. +Changing this setting to `true` on Windows/WSL informs Podman to replace +the WSL networking setup on start of this machine instance with a user-mode +networking distribution. Since WSL shares the same kernel across +distributions, all other running distributions reuses this network. +Likewise, when the last machine instance with a `true` setting stops, the +original networking setup is restored. + +[//]: # (END included file options/user-mode-networking.md) + +## EXAMPLES + +To switch the default Podman machine from rootless to rootful: + +``` +$ podman machine set --rootful +``` + +or more explicitly set with value true. + +``` +$ podman machine set --rootful=true +``` + +Switch the default Podman machine from rootful to rootless. +``` +$ podman machine set --rootful=false +``` + +Switch the specified Podman machine from rootless to rootful. +``` +$ podman machine set --rootful myvm +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**, **containers.conf(5)** + +## HISTORY +February 2022, Originally compiled by Jason Greene diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-machine-ssh.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-machine-ssh.1.md new file mode 100644 index 000000000..e855872c8 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-machine-ssh.1.md @@ -0,0 +1,91 @@ +--- +title: podman-machine-ssh +version: v5.4.1 +--- + +% podman-machine-ssh 1 + +## NAME +podman\-machine\-ssh - SSH into a virtual machine + +## SYNOPSIS +**podman machine ssh** [*options*] [*name*] [*command* [*arg* ...]] + +## DESCRIPTION + +SSH into a Podman-managed virtual machine and optionally execute a command +on the virtual machine. Unless using the default virtual machine, the +first argument must be the virtual machine name. The optional command to +execute can then follow. If no command is provided, an interactive session +with the virtual machine is established. + +The exit code from ssh command is forwarded to the podman machine ssh caller, see [Exit Codes](#Exit-Codes). + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be SSH'd into. + +Rootless only. + +## OPTIONS + +#### **--help** + +Print usage statement. + +#### **--username**=*name* + +Username to use when SSH-ing into the VM. + +## Exit Codes + +The exit code from `podman machine ssh` gives information about why the command failed. +When `podman machine ssh` commands exit with a non-zero code, +the exit codes follow the `chroot` standard, see below: + + **125** The error is with podman **_itself_** + + $ podman machine ssh --foo; echo $? + Error: unknown flag: --foo + 125 + + **126** Executing a _contained command_ and the _command_ cannot be invoked + + $ podman machine ssh /etc; echo $? + Error: fork/exec /etc: permission denied + 126 + + **127** Executing a _contained command_ and the _command_ cannot be found + + $ podman machine ssh foo; echo $? + Error: fork/exec /usr/bin/bogus: no such file or directory + 127 + + **Exit code** _contained command_ exit code + + $ podman machine ssh /bin/sh -c 'exit 3'; echo $? + 3 + +## EXAMPLES + +To get an interactive session with the default Podman machine: + +SSH into the default Podman machine. +``` +$ podman machine ssh +``` + +Run command inside the default Podman machine via ssh. +``` +$ podman machine ssh myvm +``` + +Run command inside the specified Podman machine via ssh. +``` +$ podman machine ssh myvm rpm -q podman +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-machine-start.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-machine-start.1.md new file mode 100644 index 000000000..5d4baa22c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-machine-start.1.md @@ -0,0 +1,58 @@ +--- +title: podman-machine-start +version: v5.4.1 +--- + +% podman-machine-start 1 + +## NAME +podman\-machine\-start - Start a virtual machine + +## SYNOPSIS +**podman machine start** [*name*] + +## DESCRIPTION + +Starts a virtual machine for Podman. + +Rootless only. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be started. + +Only one Podman managed VM can be active at a time. If a VM is already running, +`podman machine start` returns an error. + +**podman machine start** starts a Linux virtual machine where containers are run. + +## OPTIONS + +#### **--help** + +Print usage statement. + +#### **--no-info** + +Suppress informational tips. + +#### **--quiet**, **-q** + +Suppress machine starting status output. + +## EXAMPLES + +Start the specified podman machine. +``` +$ podman machine start myvm +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-machine-stop.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-machine-stop.1.md new file mode 100644 index 000000000..a752a32a7 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-machine-stop.1.md @@ -0,0 +1,47 @@ +--- +title: podman-machine-stop +version: v5.4.1 +--- + +% podman-machine-stop 1 + +## NAME +podman\-machine\-stop - Stop a virtual machine + +## SYNOPSIS +**podman machine stop** [*name*] + +## DESCRIPTION + +Stops a virtual machine. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be stopped. + +Rootless only. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +**podman machine stop** stops a Linux virtual machine where containers are run. + +## OPTIONS + +#### **--help** + +Print usage statement. + +## EXAMPLES + +Stop a podman machine named myvm. +``` +$ podman machine stop myvm +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-machine.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-machine.1.md new file mode 100644 index 000000000..4395a40ed --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-machine.1.md @@ -0,0 +1,55 @@ +--- +title: podman-machine +version: v5.4.1 +--- + +% podman-machine 1 + +## NAME +podman\-machine - Manage Podman's virtual machine + +## SYNOPSIS +**podman machine** *subcommand* + +## DESCRIPTION +`podman machine` is a set of subcommands that manage Podman's virtual machine. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +All `podman machine` commands are rootless only. + +NOTE: The podman-machine configuration file is managed under the +`$XDG_CONFIG_HOME/containers/podman/machine/` directory. Changing the `$XDG_CONFIG_HOME` +environment variable while the machines are running can lead to unexpected behavior. + +Podman machine behaviour can be modified via the [machine] section in the containers.conf(5) file. + +## SUBCOMMANDS + +| Command | Man Page | Description | +|---------|----------------------------------------------------------|---------------------------------------| +| info | [podman-machine-info(1)](podman-machine-info.1.md) | Display machine host info | +| init | [podman-machine-init(1)](podman-machine-init.1.md) | Initialize a new virtual machine | +| inspect | [podman-machine-inspect(1)](podman-machine-inspect.1.md) | Inspect one or more virtual machines | +| list | [podman-machine-list(1)](podman-machine-list.1.md) | List virtual machines | +| os | [podman-machine-os(1)](podman-machine-os.1.md) | Manage a Podman virtual machine's OS | +| reset | [podman-machine-reset(1)](podman-machine-reset.1.md) | Reset Podman machines and environment | +| rm | [podman-machine-rm(1)](podman-machine-rm.1.md) | Remove a virtual machine | +| set | [podman-machine-set(1)](podman-machine-set.1.md) | Set a virtual machine setting | +| ssh | [podman-machine-ssh(1)](podman-machine-ssh.1.md) | SSH into a virtual machine | +| start | [podman-machine-start(1)](podman-machine-start.1.md) | Start a virtual machine | +| stop | [podman-machine-stop(1)](podman-machine-stop.1.md) | Stop a virtual machine | + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine-info(1)](podman-machine-info.1.md)**, **[podman-machine-init(1)](podman-machine-init.1.md)**, **[podman-machine-list(1)](podman-machine-list.1.md)**, **[podman-machine-os(1)](podman-machine-os.1.md)**, **[podman-machine-rm(1)](podman-machine-rm.1.md)**, **[podman-machine-ssh(1)](podman-machine-ssh.1.md)**, **[podman-machine-start(1)](podman-machine-start.1.md)**, **[podman-machine-stop(1)](podman-machine-stop.1.md)**, **[podman-machine-inspect(1)](podman-machine-inspect.1.md)**, **[podman-machine-reset(1)](podman-machine-reset.1.md)**, **containers.conf(5)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-manifest-add.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-manifest-add.1.md new file mode 100644 index 000000000..a4cdcf8b6 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-manifest-add.1.md @@ -0,0 +1,235 @@ +--- +title: podman-manifest-add +version: v5.4.1 +--- + +% podman-manifest-add 1 + +## NAME +podman\-manifest\-add - Add an image or artifact to a manifest list or image index + +## SYNOPSIS +**podman manifest add** [*options*] *listnameorindexname* [*transport*]:*imagename* *imageorartifactname* [...] + +## DESCRIPTION + +Adds the specified image to the specified manifest list or image index, or +creates an artifact manifest and adds it to the specified image index. + +## RETURN VALUE + +The list image's ID. + +## OPTIONS + +#### **--all** + +If the image which is added to the list or index is itself a list or +index, add all of the contents to the local list. By default, only one image +from such a list or index is added to the list or index. Combining +*--all* with any of the other options described below is NOT recommended. + + +[//]: # (BEGIN included file options/annotation.manifest.md) +#### **--annotation**=*annotation=value* + +Set an annotation on the entry for the specified image or artifact. + +[//]: # (END included file options/annotation.manifest.md) + +#### **--arch**=*architecture* + +Override the architecture which the list or index records as a requirement for +the image. If *imageName* refers to a manifest list or image index, the +architecture information is retrieved from it. Otherwise, it is +retrieved from the image's configuration information. + +#### **--artifact** + +Create an artifact manifest and add it to the image index. Arguments after the +index name will be interpreted as file names rather than as image references. +In most scenarios, the **--artifact-type** option should also be specified. + +#### **--artifact-config**=*path* + +When creating an artifact manifest and adding it to the image index, use the +specified file's contents as the configuration blob in the artifact manifest. +In most scenarios, leaving the default value, which signifies an empty +configuration, unchanged, is the preferred option. + +#### **--artifact-config-type**=*type* + +When creating an artifact manifest and adding it to the image index, use the +specified MIME type as the `mediaType` associated with the configuration blob +in the artifact manifest. In most scenarios, leaving the default value, which +signifies either an empty configuration or the standard OCI configuration type, +unchanged, is the preferred option. + +#### **--artifact-exclude-titles** + +When creating an artifact manifest and adding it to the image index, do not +set "org.opencontainers.image.title" annotations equal to the file's basename +for each file added to the artifact manifest. Tools which retrieve artifacts +from a registry may use these values to choose names for files when saving +artifacts to disk, so this option is not recommended unless it is required +for interoperability with a particular registry. + +#### **--artifact-layer-type**=*type* + +When creating an artifact manifest and adding it to the image index, use the +specified MIME type as the `mediaType` associated with the files' contents. If +not specified, guesses based on either the files names or their contents will +be made and used, but the option should be specified if certainty is needed. + +#### **--artifact-subject**=*imageName* + +When creating an artifact manifest and adding it to the image index, set the +*subject* field in the artifact manifest to mark the artifact manifest as being +associated with the specified image in some way. An artifact manifest can only +be associated with, at most, one subject. + +#### **--artifact-type**=*type* + +When creating an artifact manifest, use the specified MIME type as the +manifest's `artifactType` value instead of the less informative default value. + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/features.md) +#### **--features**=*feature* + +Specify the features list which the list or index records as requirements for +the image. This option is rarely used. + +[//]: # (END included file options/features.md) + +#### **--os**=*OS* + +Override the OS which the list or index records as a requirement for the image. +If *imagename* refers to a manifest list or image index, the OS information +is retrieved from it. Otherwise, it is retrieved from the image's +configuration information. + + +[//]: # (BEGIN included file options/os-version.md) +#### **--os-version**=*version* + +Specify the OS version which the list or index records as a requirement for the +image. This option is rarely used. + +[//]: # (END included file options/os-version.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/variant.manifest.md) +#### **--variant** + +Specify the variant which the list or index records for the image. This option +is typically used to distinguish between multiple entries which share the same +architecture value, but which expect different versions of its instruction set. + +[//]: # (END included file options/variant.manifest.md) + +## Transport + + Multiple transports are supported: + + **docker://**_docker-reference_ _(default)_ + An image in a registry implementing the "Docker Registry HTTP API V2". By default, uses the authorization state in `$XDG_RUNTIME_DIR/containers/auth.json`, which is set using `(podman login)`. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using `(docker login)`. + + $ podman manifest add mylist\:v1.11 docker://quay.io/username/myimage + + **containers-storage:**_oci-reference_ + An image in _oci-reference_ format stored in the local container storage. _oci-reference_ must contain a tag. + + $ podman manifest add mylist\:v1.11 containers-storage\:quay.io/username/myimage + + **dir:**_path_ + An existing local directory _path_ storing the manifest, layer tarballs, and signatures as individual files. This + is a non-standardized format, primarily useful for debugging or noninvasive container inspection. + + $ podman manifest add dir:/tmp/myimage + + **docker-archive:**_path_[**:**_docker-reference_] + An image is stored in the `docker save` formatted file. _docker-reference_ is only used when creating such a + file, and it must not contain a digest. + + $ podman manifest add docker-archive:/tmp/myimage + + **docker-daemon:**_docker-reference_ + An image in _docker-reference_ format stored in the docker daemon internal storage. The _docker-reference_ can also be an image ID (docker-daemon\:algo\:digest). + + $ sudo podman manifest add docker-daemon\:docker.io/library/myimage:33 + + **oci-archive:**_path_**:**_tag_ + An image _tag_ in a directory compliant with "Open Container Image Layout Specification" at _path_. + + $ podman manifest add oci-archive:/tmp/myimage + +## EXAMPLE + +Add specified default image from source manifest list to destination manifest list: +``` +podman manifest add mylist:v1.11 docker://fedora +71c201d10fffdcac52968a000d85a0a016ca1c7d5473948000d3131c1773d965 +``` + +Add all images from source manifest list to destination manifest list: +``` +podman manifest add --all mylist:v1.11 docker://fedora +71c201d10fffdcac52968a000d85a0a016ca1c7d5473948000d3131c1773d965 +``` + +Add selected image matching arch and variant from source manifest list to destination manifest list: +``` +podman manifest add --arch arm64 --variant v8 mylist\:v1.11 docker://71c201d10fffdcac52968a000d85a0a016ca1c7d5473948000d3131c1773d965 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-manifest-annotate.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-manifest-annotate.1.md new file mode 100644 index 000000000..f05a32be6 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-manifest-annotate.1.md @@ -0,0 +1,95 @@ +--- +title: podman-manifest-annotate +version: v5.4.1 +--- + +% podman-manifest-annotate 1 + +## NAME +podman\-manifest\-annotate - Add and update information about an image or artifact in a manifest list or image index + +## SYNOPSIS +**podman manifest annotate** [*options*] *listnameorindexname* *imagemanifestdigestorimageorartifactname* + +## DESCRIPTION + +Adds or updates information about an image or artifact included in a manifest list or image index. + +## OPTIONS + + +[//]: # (BEGIN included file options/annotation.manifest.md) +#### **--annotation**=*annotation=value* + +Set an annotation on the entry for the specified image or artifact. + +[//]: # (END included file options/annotation.manifest.md) +If **--index** is also specified, sets the annotation on the entire image index. + +#### **--arch**=*architecture* + +Override the architecture which the list or index records as a requirement for +the image. This is usually automatically retrieved from the image's +configuration information, so it is rarely necessary to use this option. + + +[//]: # (BEGIN included file options/features.md) +#### **--features**=*feature* + +Specify the features list which the list or index records as requirements for +the image. This option is rarely used. + +[//]: # (END included file options/features.md) + +#### **--index** + +Treats arguments to the **--annotation** option as annotation values to be set +on the image index itself rather than on an entry in the image index. Implied +for **--subject**. + +#### **--os**=*OS* + +Override the OS which the list or index records as a requirement for the image. +This is usually automatically retrieved from the image's configuration +information, so it is rarely necessary to use this option. + +#### **--os-features**=*feature* + +Specify the OS features list which the list or index records as requirements +for the image. This option is rarely used. + + +[//]: # (BEGIN included file options/os-version.md) +#### **--os-version**=*version* + +Specify the OS version which the list or index records as a requirement for the +image. This option is rarely used. + +[//]: # (END included file options/os-version.md) + +#### **--subject**=*imageName* + +Set the *subject* field in the image index to mark the image index as being +associated with the specified image in some way. An image index can only be +associated with, at most, one subject. + + +[//]: # (BEGIN included file options/variant.manifest.md) +#### **--variant** + +Specify the variant which the list or index records for the image. This option +is typically used to distinguish between multiple entries which share the same +architecture value, but which expect different versions of its instruction set. + +[//]: # (END included file options/variant.manifest.md) + +## EXAMPLE + +Update arch and variant information to specified manifest list for image: +``` +podman manifest annotate --arch arm64 --variant v8 mylist:v1.11 sha256:59eec8837a4d942cc19a52b8c09ea75121acc38114a2c68b98983ce9356b8610 +07ec8dc22b5dba3a33c60b68bce28bbd2b905e383fdb32a90708fa5eeac13a07: sha256:59eec8837a4d942cc19a52b8c09ea75121acc38114a2c68b98983ce9356b8610 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-manifest-create.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-manifest-create.1.md new file mode 100644 index 000000000..e7f935d7e --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-manifest-create.1.md @@ -0,0 +1,79 @@ +--- +title: podman-manifest-create +version: v5.4.1 +--- + +% podman-manifest-create 1 + +## NAME +podman\-manifest\-create - Create a manifest list or image index + +## SYNOPSIS +**podman manifest create** [*options*] *listnameorindexname* [*imagename* ...] + +## DESCRIPTION + +Creates a new manifest list and stores it as an image in local storage using +the specified name. + +If additional images are specified, they are added to the newly-created list or +index. + +## OPTIONS + +#### **--all** + +If any of the images added to the new list or index are +themselves lists or indexes, add all of their contents. By default, only one +image from such a list is added to the newly-created list or index. + +#### **--amend**, **-a** + +If a manifest list named *listnameorindexname* already exists, modify the +preexisting list instead of exiting with an error. The contents of +*listnameorindexname* are not modified if no *imagename*s are given. + +#### **--annotation**=*value* + +Set an annotation on the newly-created image index. + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Create the specified manifest. +``` +podman manifest create mylist:v1.11 +9cfd24048d5fc80903f088f1531a21bff01172abe66effa8941a4c2308dc745f +``` + +Create the specified manifest manifest or modify it if it previously exist. +``` +podman manifest create --amend mylist:v1.11 +9cfd24048d5fc80903f088f1531a21bff01172abe66effa8941a4c2308dc745f +``` + +Create the named manifest including the specified image matching the current platform. +``` +podman manifest create mylist:v1.11 docker://fedora +5c2bc76bfb4ba6665a7973f7e1c05ee0536b4580637f27adc9fa5a4b2bc03cf1 +``` + +Create the named manifest including all images referred to with the specified image reference. +``` +podman manifest create --all mylist\:v1.11 docker://fedora +30330571e79c65288a4fca421d9aed29b0210d57294d9c2056743fdcf6e3967b +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-manifest-exists.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-manifest-exists.1.md new file mode 100644 index 000000000..39e80f57a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-manifest-exists.1.md @@ -0,0 +1,47 @@ +--- +title: podman-manifest-exists +version: v5.4.1 +--- + +% podman-manifest-exists 1 + +## NAME +podman\-manifest\-exists - Check if the given manifest list exists in local storage + +## SYNOPSIS +**podman manifest exists** *manifest* + +## DESCRIPTION +**podman manifest exists** checks if a manifest list exists on local storage. +Podman returns an exit code of `0` when the manifest is found. A `1` is +returned otherwise. +An exit code of `125` indicates there was another issue. + + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement. + +## EXAMPLE + +Check if a manifest list called `list1` exists (the manifest list does actually exist): +``` +$ podman manifest exists list1 +$ echo $? +0 +``` + +Check if a manifest called `mylist` exists (the manifest list does not actually exist): +``` +$ podman manifest exists mylist +$ echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** + +## HISTORY +January 2021, Originally compiled by Paul Holzinger `` diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-manifest-inspect.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-manifest-inspect.1.md new file mode 100644 index 000000000..e47f57138 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-manifest-inspect.1.md @@ -0,0 +1,54 @@ +--- +title: podman-manifest-inspect +version: v5.4.1 +--- + +% podman-manifest-inspect 1 + +## NAME +podman\-manifest\-inspect - Display a manifest list or image index + +## SYNOPSIS +**podman manifest inspect** [*options*] *listnameorindexname* + +## DESCRIPTION + +Displays the manifest list or image index stored using the specified image name. +## RETURN VALUE + +A formatted JSON representation of the manifest list or image index. + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Inspect the manifest of mylist:v1.11. +``` +podman manifest inspect mylist\:v1.11 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-manifest-push.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-manifest-push.1.md new file mode 100644 index 000000000..6a5ab0b59 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-manifest-push.1.md @@ -0,0 +1,173 @@ +--- +title: podman-manifest-push +version: v5.4.1 +--- + +% podman-manifest-push 1 + +## NAME +podman\-manifest\-push - Push a manifest list or image index to a registry + +## SYNOPSIS +**podman manifest push** [*options*] *listnameorindexname* [*destination*] + +## DESCRIPTION +Pushes a manifest list or image index to a registry. + +## RETURN VALUE +The list image's ID and the digest of the image's manifest. + +## OPTIONS + +#### **--add-compression**=*compression* + +Makes sure that requested compression variant for each platform is added to the manifest list keeping original instance +intact in the same manifest list. Supported values are (`gzip`, `zstd` and `zstd:chunked`). Following flag can be used +multiple times. + +Note that `--compression-format` controls the compression format of each instance in the manifest list. `--add-compression` +will add another variant for each instance in the list with the specified compressions. `--compression-format` gzip `--add-compression` +zstd will push a manifest list with each instance being compressed with gzip plus an additional variant of each instance +being compressed with zstd. + +#### **--all** + +Push the images mentioned in the manifest list or image index, in addition to +the list or index itself. (Default true) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/compression-format.md) +#### **--compression-format**=**gzip** | *zstd* | *zstd:chunked* + +Specifies the compression format to use. Supported values are: `gzip`, `zstd` and `zstd:chunked`. The default is `gzip` unless overridden in the containers.conf file. +`zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning in that case. + +[//]: # (END included file options/compression-format.md) + + +[//]: # (BEGIN included file options/compression-level.md) +#### **--compression-level**=*level* + +Specifies the compression level to use. The value is specific to the compression algorithm used, e.g. for zstd the accepted values are in the range 1-20 (inclusive) with a default of 3, while for gzip it is 1-9 (inclusive) and has a default of 5. + +[//]: # (END included file options/compression-level.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/digestfile.md) +#### **--digestfile**=*Digestfile* + +After copying the image, write the digest of the resulting image to the file. + +[//]: # (END included file options/digestfile.md) + + +[//]: # (BEGIN included file options/force-compression.md) +#### **--force-compression** + +If set, push uses the specified compression algorithm even if the destination contains a differently-compressed variant already. +Defaults to `true` if `--compression-format` is explicitly specified on the command-line, `false` otherwise. + +[//]: # (END included file options/force-compression.md) + +#### **--format**, **-f**=*format* + +Manifest list type (oci or v2s2) to use when pushing the list (default is oci). + +#### **--quiet**, **-q** + +When writing the manifest, suppress progress output + +#### **--remove-signatures** + +Don't copy signatures when pushing images. + +#### **--rm** + +Delete the manifest list or image index from local storage if pushing succeeds. + +#### **--sign-by**=*fingerprint* + +Sign the pushed images with a “simple signing” signature using the specified key. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-by-sigstore.md) +#### **--sign-by-sigstore**=*param-file* + +Add a sigstore signature based on further options specified in a container's sigstore signing parameter file *param-file*. +See containers-sigstore-signing-params.yaml(5) for details about the file format. + +[//]: # (END included file options/sign-by-sigstore.md) + +#### **--sign-by-sigstore-private-key**=*path* + +Sign the pushed images with a sigstore signature using a private key at the specified path. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-passphrase-file.md) +#### **--sign-passphrase-file**=*path* + +If signing the image (using either **--sign-by** or **--sign-by-sigstore-private-key**), read the passphrase to use from the specified path. + +[//]: # (END included file options/sign-passphrase-file.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## DESTINATION + + DESTINATION is the location the container image is pushed to. It supports all transports from `containers-transports(5)`. If no transport is specified, the `docker` (i.e., container registry) transport is used. For remote clients, including Mac and Windows (excluding WSL2) machines, `docker` is the only supported transport. + +## EXAMPLE + +Push manifest list to container registry: +``` +podman manifest push mylist:v1.11 docker://registry.example.org/mylist:v1.11 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-manifest-remove.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-manifest-remove.1.md new file mode 100644 index 000000000..5c8c65574 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-manifest-remove.1.md @@ -0,0 +1,29 @@ +--- +title: podman-manifest-remove +version: v5.4.1 +--- + +% podman-manifest-remove 1 + +## NAME +podman\-manifest\-remove - Remove an item from a manifest list or image index + +## SYNOPSIS +**podman manifest remove** *listnameorindexname* *digest* + +## DESCRIPTION +Removes the item with the specified digest from the specified manifest list or image index. + +## RETURN VALUE +The list image's ID and the digest of the removed image's manifest. + +## EXAMPLE + +Remove specified digest from the manifest list: +``` +podman manifest remove mylist:v1.11 sha256:cb8a924afdf0229ef7515d9e5b3024e23b3eb03ddbba287f4a19c6ac90b8d221 +podman manifest remove e604eabaaee4858232761b4fef84e2316ed8f93e15eceafce845966ee3400036 sha256\:cb8a924afdf0229ef7515d9e5b3024e23b3eb03ddbba287f4a19c6ac90b8d221 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-manifest-rm.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-manifest-rm.1.md new file mode 100644 index 000000000..b85c0770b --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-manifest-rm.1.md @@ -0,0 +1,36 @@ +--- +title: podman-manifest-rm +version: v5.4.1 +--- + +% podman-manifest-rm 1 + +## NAME +podman\-manifest\-rm - Remove manifest list or image index from local storage + +## SYNOPSIS +**podman manifest rm** [*options*] *list-or-index* [...] + +## DESCRIPTION +Removes one or more locally stored manifest lists. + +## OPTIONS + +#### **--ignore**, **-i** + +If a specified manifest does not exist in the local storage, ignore it and do not throw an error. + +## EXAMPLE + +podman manifest rm `` + +podman manifest rm listid1 listid2 + +**storage.conf** (`/etc/containers/storage.conf`) + +storage.conf is the storage configuration file for all tools using containers/storage + +The storage configuration file specifies all of the available container storage options for tools using shared container storage. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-manifest.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-manifest.1.md new file mode 100644 index 000000000..5ab51cdea --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-manifest.1.md @@ -0,0 +1,76 @@ +--- +title: podman-manifest +version: v5.4.1 +--- + +% podman-manifest 1 + +## NAME +podman\-manifest - Create and manipulate manifest lists and image indexes + +## SYNOPSIS +**podman manifest** *subcommand* + +## DESCRIPTION +The `podman manifest` command provides subcommands which can be used to: + + * Create a working Docker manifest list or OCI image index. + +## SUBCOMMANDS + +| Command | Man Page | Description | +| -------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------------------- | +| add | [podman-manifest-add(1)](podman-manifest-add.1.md) | Add an image or artifact to a manifest list or image index. | +| annotate | [podman-manifest-annotate(1)](podman-manifest-annotate.1.md) | Add and update information about an image or artifact in a manifest list or image index. | +| create | [podman-manifest-create(1)](podman-manifest-create.1.md) | Create a manifest list or image index. | +| exists | [podman-manifest-exists(1)](podman-manifest-exists.1.md) | Check if the given manifest list exists in local storage | +| inspect | [podman-manifest-inspect(1)](podman-manifest-inspect.1.md) | Display a manifest list or image index. | +| push | [podman-manifest-push(1)](podman-manifest-push.1.md) | Push a manifest list or image index to a registry. | +| remove | [podman-manifest-remove(1)](podman-manifest-remove.1.md) | Remove an item from a manifest list or image index. | +| rm | [podman-manifest-rm(1)](podman-manifest-rm.1.md) | Remove manifest list or image index from local storage. | + +## EXAMPLES + +### Building a multi-arch manifest list from a Containerfile + +Assuming the `Containerfile` uses `RUN` instructions, the host needs +a way to execute non-native binaries. Configuring this is beyond +the scope of this example. Building a multi-arch manifest list +`shazam` in parallel across 4-threads can be done like this: + + $ platarch=linux/amd64,linux/ppc64le,linux/arm64,linux/s390x + $ podman build --jobs=4 --platform=$platarch --manifest shazam . + +**Note:** The `--jobs` argument is optional. Do not use the `podman build` command's `--tag` (or `-t`) option when building a multi-arch manifest list. + +### Assembling a multi-arch manifest from separately built images + +Assuming `example.com/example/shazam:$arch` images are built separately +on other hosts and pushed to the `example.com` registry. They may +be combined into a manifest list, and pushed using a simple loop: + + $ REPO=example.com/example/shazam + $ podman manifest create $REPO:latest + $ for IMGTAG in amd64 s390x ppc64le arm64; do \ + podman manifest add $REPO:latest docker://$REPO\:IMGTAG; \ + done + $ podman manifest push --all $REPO\:latest + +**Note:** The `add` instruction argument order is `` then ``. +Also, the `--all` push option is required to ensure all contents are +pushed, not just the native platform/arch. + +### Removing and tagging a manifest list before pushing + +Special care is needed when removing and pushing manifest lists, as opposed +to the contents. You almost always want to use the `manifest rm` and +`manifest push --all` subcommands. For example, a rename and push can +be performed like this: + + $ podman tag localhost/shazam example.com/example/shazam + $ podman manifest rm localhost/shazam + $ podman manifest push --all example.com/example/shazam + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest-add(1)](podman-manifest-add.1.md)**, **[podman-manifest-annotate(1)](podman-manifest-annotate.1.md)**, **[podman-manifest-create(1)](podman-manifest-create.1.md)**, **[podman-manifest-inspect(1)](podman-manifest-inspect.1.md)**, **[podman-manifest-push(1)](podman-manifest-push.1.md)**, **[podman-manifest-remove(1)](podman-manifest-remove.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-mount.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-mount.1.md new file mode 100644 index 000000000..e6e9c4b88 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-mount.1.md @@ -0,0 +1,86 @@ +--- +title: podman-mount +version: v5.4.1 +--- + +% podman-mount 1 + +## NAME +podman\-mount - Mount a working container's root filesystem + +## SYNOPSIS +**podman mount** [*options*] [*container* ...] + +**podman container mount** [*options*] [*container* ...] + +## DESCRIPTION +Mounts the specified containers' root file system in a location which can be +accessed from the host, and returns its location. + +Podman lists all of the currently mounted containers, including external containers, when the command is executed +without any arguments. External containers are containers in container/storage by tools other than Podman. +For example Buildah and CRI-O. + +Rootless mode only supports mounting VFS driver, unless Podman is run within the user namespace +via the `podman unshare` command. All other storage drivers fails to mount. + +## RETURN VALUE +The location of the mounted file system. On error an empty string and errno is +returned. + +## OPTIONS + +#### **--all**, **-a** + +Mount all podman containers. (External containers are not mounted) + +#### **--format**=*format* + +Print the mounted containers in specified format (json). + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--no-trunc** + +Do not truncate the output (default *false*). + +## EXAMPLE + +In rootful mode, Mount specified container. +``` +# podman mount c831414b10a3 +/var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +``` + +In rootless mode, container mounting only works from inside the user namespace. +``` +$ podman unshare +# podman mount affectionate_mcnulty +/home/dwalsh/.local/share/containers/storage/overlay/4218326b9a80619aef005ff95067f76687ad975ce101c176598fb416f6186906/merged +``` + +List the currently mounted containers: +``` +podman mount +c831414b10a3 /var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +a7060253093b /var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged +``` + +Mount multiple containers: +``` +podman mount c831414b10a3 a7060253093b +/var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +/var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-unmount(1)](podman-unmount.1.md)**, **[podman-unshare(1)](podman-unshare.1.md)**, **mount(8)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-network-connect.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-network-connect.1.md new file mode 100644 index 000000000..b360c3e7d --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-network-connect.1.md @@ -0,0 +1,55 @@ +--- +title: podman-network-connect +version: v5.4.1 +--- + +% podman-network-connect 1 + +## NAME +podman\-network\-connect - Connect a container to a network + +## SYNOPSIS +**podman network connect** [*options*] network container + +## DESCRIPTION +Connects a container to a network. A container can be connected to a network by name or by ID. +Once connected, the container can communicate with other containers in the same network. + +## OPTIONS +#### **--alias**=*name* +Add network-scoped alias for the container. If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. Multiple *--alias* options may be specified as input. +NOTE: When using CNI, a container only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. + +#### **--ip**=*address* +Set a static ipv4 address for this container on this network. + +#### **--ip6**=*address* +Set a static ipv6 address for this container on this network. + +#### **--mac-address**=*address* +Set a static mac address for this container on this network. + +## EXAMPLE + +Connect specified container to a named network: +``` +podman network connect test web +``` + +Connect specified container to named network with two aliases: +``` +podman network connect --alias web1 --alias web2 test web +``` + +Connect specified container to named network with a static ip: +``` +podman network connect --ip 10.89.1.13 test web +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-network-disconnect(1)](podman-network-disconnect.1.md)** + +## HISTORY +November 2020, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-network-create.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-network-create.1.md new file mode 100644 index 000000000..5d6b343a0 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-network-create.1.md @@ -0,0 +1,220 @@ +--- +title: podman-network-create +version: v5.4.1 +--- + +% podman-network-create 1 + +## NAME +podman\-network-create - Create a Podman network + +## SYNOPSIS +**podman network create** [*options*] [*name*] + +## DESCRIPTION +Create a network configuration for use with Podman. By default, Podman creates a bridge connection. +A *Macvlan* connection can be created with the *-d macvlan* option. A parent device for macvlan or +ipvlan can be designated with the *-o parent=``* or *--network-interface=``* option. + +If no options are provided, Podman assigns a free subnet and name for the network. + +Upon completion of creating the network, Podman displays the name of the newly added network. + +## OPTIONS +#### **--disable-dns** + +Disables the DNS plugin for this network which if enabled, can perform container to container name +resolution. It is only supported with the `bridge` driver, for other drivers it is always disabled. + +#### **--dns**=*ip* + +Set network-scoped DNS resolver/nameserver for containers in this network. If not set, the host servers from `/etc/resolv.conf` is used. It can be overwritten on the container level with the `podman run/create --dns` option. This option can be specified multiple times to set more than one IP. + +#### **--driver**, **-d**=*driver* + +Driver to manage the network. Currently `bridge`, `macvlan` and `ipvlan` are supported. Defaults to `bridge`. +As rootless the `macvlan` and `ipvlan` driver have no access to the host network interfaces because rootless networking requires a separate network namespace. + +The netavark backend allows the use of so called *netavark plugins*, see the +[plugin-API.md](https://github.com/containers/netavark/blob/main/plugin-API.md) +documentation in netavark. The binary must be placed in a specified directory +so podman can discover it, this list is set in `netavark_plugin_dirs` in +**[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** +under the `[network]` section. + +The name of the plugin can then be used as driver to create a network for your plugin. +The list of all supported drivers and plugins can be seen with `podman info --format {{.Plugins.Network}}`. + +Note that the `macvlan` and `ipvlan` drivers do not support port forwarding. Support for port forwarding +with a plugin depends on the implementation of the plugin. + +#### **--gateway**=*ip* + +Define a gateway for the subnet. To provide a gateway address, a +*subnet* option is required. Can be specified multiple times. +The argument order of the **--subnet**, **--gateway** and **--ip-range** options must match. + +#### **--ignore** + +Ignore the create request if a network with the same name already exists instead of failing. +Note, trying to create a network with an existing name and different parameters does not change the configuration of the existing one. + +#### **--interface-name**=*name* + +This option maps the *network_interface* option in the network config, see **podman network inspect**. +Depending on the driver, this can have different effects; for `bridge`, it uses the bridge interface name. +For `macvlan` and `ipvlan`, it is the parent device on the host. It is the same as `--opt parent=...`. + +#### **--internal** + +Restrict external access of this network when using a `bridge` network. Note when using the CNI backend +DNS will be automatically disabled, see **--disable-dns**. + +When using the `macvlan` or `ipvlan` driver with this option no default route will be added to the container. +Because it bypasses the host network stack no additional restrictions can be set by podman and if a +privileged container is run it can set a default route themselves. If this is a concern then the +container connections should be blocked on your actual network gateway. + +Using the `bridge` driver with this option has the following effects: + - Global IP forwarding sysctls will not be changed in the host network namespace. + - IP forwarding is disabled on the bridge interface instead of setting up a firewall. + - No default route will be added to the container. + +In all cases, aardvark-dns will only resolve container names with this option enabled. +Other queries will be answered with `NXDOMAIN`. + +#### **--ip-range**=*range* + +Allocate container IP from a range. The range must be a either a complete subnet in CIDR notation or be in +the `-` syntax which allows for a more flexible range compared to the CIDR subnet. +The *ip-range* option must be used with a *subnet* option. Can be specified multiple times. +The argument order of the **--subnet**, **--gateway** and **--ip-range** options must match. + +#### **--ipam-driver**=*driver* + +Set the ipam driver (IP Address Management Driver) for the network. When unset podman chooses an +ipam driver automatically based on the network driver. + +Valid values are: + + - `dhcp`: IP addresses are assigned from a dhcp server on the network. When using the netavark backend + the `netavark-dhcp-proxy.socket` must be enabled in order to start the dhcp-proxy when a container is + started, for CNI use the `cni-dhcp.socket` unit instead. + - `host-local`: IP addresses are assigned locally. + - `none`: No ip addresses are assigned to the interfaces. + +View the driver in the **podman network inspect** output under the `ipam_options` field. + +#### **--ipv6** + +Enable IPv6 (Dual Stack) networking. If no subnets are given, it allocates an ipv4 and an ipv6 subnet. + +#### **--label**=*label* + +Set metadata for a network (e.g., --label mykey=value). + +#### **--opt**, **-o**=*option* + +Set driver specific options. + +All drivers accept the `mtu`, `metric`, `no_default_route` and options. + +- `mtu`: Sets the Maximum Transmission Unit (MTU) and takes an integer value. +- `metric` Sets the Route Metric for the default route created in every container joined to this network. Accepts a positive integer value. Can only be used with the Netavark network backend. +- `no_default_route`: If set to 1, Podman will not automatically add a default route to subnets. Routes can still be added +manually by creating a custom route using `--route`. + +Additionally the `bridge` driver supports the following options: + +- `vlan`: This option assign VLAN tag and enables vlan\_filtering. Defaults to none. +- `isolate`: This option isolates networks by blocking traffic between those that have this option enabled. +- `com.docker.network.bridge.name`: This option assigns the given name to the created Linux Bridge +- `com.docker.network.driver.mtu`: Sets the Maximum Transmission Unit (MTU) and takes an integer value. +- `vrf`: This option assigns a VRF to the bridge interface. It accepts the name of the VRF and defaults to none. Can only be used with the Netavark network backend. +- `mode`: This option sets the specified bridge mode on the interface. Defaults to `managed`. Supported values: + - `managed`: Podman creates and deletes the bridge and changes sysctls of it. It adds firewall rules to masquerade outgoing traffic, as well as setup port forwarding for incoming traffic using DNAT. + - `unmanaged`: Podman uses an existing bridge. It must exist by the time you want to start a container which uses the network. There will be no NAT or port forwarding, even if such options were passed while creating the container. + +The `macvlan` and `ipvlan` driver support the following options: + +- `parent`: The host device which is used for the macvlan interface. Defaults to the default route interface. +- `mode`: This option sets the specified ip/macvlan mode on the interface. + - Supported values for `macvlan` are `bridge`, `private`, `vepa`, `passthru`. Defaults to `bridge`. + - Supported values for `ipvlan` are `l2`, `l3`, `l3s`. Defaults to `l2`. + +Additionally the `macvlan` driver supports the `bclim` option: + +- `bclim`: Set the threshold for broadcast queueing. Must be a 32 bit integer. Setting this value to `-1` disables broadcast queueing altogether. + +#### **--route**=*route* + +A static route in the format `,,`. This route will be added to every container in this network. Only available with the netavark backend. It can be specified multiple times if more than one static route is desired. + +#### **--subnet**=*subnet* + +The subnet in CIDR notation. Can be specified multiple times to allocate more than one subnet for this network. +The argument order of the **--subnet**, **--gateway** and **--ip-range** options must match. +This is useful to set a static ipv4 and ipv6 subnet. + +## EXAMPLE + +Create a network with no options. +``` +$ podman network create +podman2 +``` + +Create a network named *newnet* that uses *192.5.0.0/16* for its subnet. +``` +$ podman network create --subnet 192.5.0.0/16 newnet +newnet +``` + +Create an IPv6 network named *newnetv6* with a subnet of *2001\:db8::/64*. +``` +$ podman network create --subnet 2001:db8::/64 --ipv6 newnetv6 +newnetv6 +``` + +Create a network named *newnet* that uses *192.168.33.0/24* and defines a gateway as *192.168.33.3*. +``` +$ podman network create --subnet 192.168.33.0/24 --gateway 192.168.33.3 newnet +newnet +``` + +Create a network that uses a *192.168.55.0/24* subnet and has an IP address range of *192.168.55.129 - 192.168.55.254*. +``` +$ podman network create --subnet 192.168.55.0/24 --ip-range 192.168.55.128/25 +podman5 +``` + +Create a network with a static ipv4 and ipv6 subnet and set a gateway. +``` +$ podman network create --subnet 192.168.55.0/24 --gateway 192.168.55.3 --subnet fd52:2a5a:747e:3acd::/64 --gateway fd52:2a5a:747e:3acd::10 +podman4 +``` + +Create a network with a static subnet and a static route. +``` +$ podman network create --subnet 192.168.33.0/24 --route 10.1.0.0/24,192.168.33.10 newnet +``` + +Create a network with a static subnet and a static route without a default +route. +``` +$ podman network create --subnet 192.168.33.0/24 --route 10.1.0.0/24,192.168.33.10 --opt no_default_route=1 newnet +``` + +Create a Macvlan based network using the host interface eth0. Macvlan networks can only be used as root. +``` +$ sudo podman network create -d macvlan -o parent=eth0 --subnet 192.5.0.0/16 newnet +newnet +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-network-ls(1)](podman-network-ls.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +## HISTORY +August 2021, Updated with the new network format by Paul Holzinger + +August 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-network-disconnect.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-network-disconnect.1.md new file mode 100644 index 000000000..8ff14d59b --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-network-disconnect.1.md @@ -0,0 +1,37 @@ +--- +title: podman-network-disconnect +version: v5.4.1 +--- + +% podman-network-disconnect 1 + +## NAME +podman\-network\-disconnect - Disconnect a container from a network + +## SYNOPSIS +**podman network disconnect** [*options*] network container + +## DESCRIPTION +Disconnects a container from a network. A container can be disconnected from a network by name or by ID. +If all networks are disconnected from the container, it behaves like a container created with `--network=none` +and it does not have network connectivity until a network is connected again. + + +## OPTIONS +#### **--force**, **-f** + +Force the container to disconnect from a network + +## EXAMPLE + +Disconnect container from specified network: +``` +podman network disconnect test web +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-connect(1)](podman-network-connect.1.md)** + +## HISTORY +November 2020, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-network-exists.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-network-exists.1.md new file mode 100644 index 000000000..2e09b8577 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-network-exists.1.md @@ -0,0 +1,47 @@ +--- +title: podman-network-exists +version: v5.4.1 +--- + +% podman-network-exists 1 + +## NAME +podman\-network\-exists - Check if the given network exists + +## SYNOPSIS +**podman network exists** *network* + +## DESCRIPTION +**podman network exists** checks if a network exists. The **Name** or **ID** +of the network may be used as input. Podman returns an exit code +of `0` when the network is found. A `1` is returned otherwise. An exit code of +`125` indicates there was another issue. + + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLE + +Check if specified network exists (the network does actually exist): +``` +$ podman network exists net1 +$ echo $? +0 +``` + +Check if nonexistent network exists: +``` +$ podman network exists webbackend +$ echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)** + +## HISTORY +January 2021, Originally compiled by Paul Holzinger `` diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-network-inspect.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-network-inspect.1.md new file mode 100644 index 000000000..864209c46 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-network-inspect.1.md @@ -0,0 +1,83 @@ +--- +title: podman-network-inspect +version: v5.4.1 +--- + +% podman-network-inspect 1 + +## NAME +podman\-network\-inspect - Display the network configuration for one or more networks + +## SYNOPSIS +**podman network inspect** [*options*] *network* [*network* ...] + +## DESCRIPTION +Display the (JSON format) network configuration. + +## OPTIONS +#### **--format**, **-f**=*format* + +Pretty-print networks to JSON or using a Go template. + +| **Placeholder** | **Description** | +|--------------------|-------------------------------------------| +| .Containers ... | Running containers on this network. | +| .Created ... | Timestamp when the network was created | +| .DNSEnabled | Network has dns enabled (boolean) | +| .Driver | Network driver | +| .ID | Network ID | +| .Internal | Network is internal (boolean) | +| .IPAMOptions ... | Network ipam options | +| .IPv6Enabled | Network has ipv6 subnet (boolean) | +| .Labels ... | Network labels | +| .Name | Network name | +| .Network ... | Nested Network type | +| .NetworkDNSServers | Array of DNS servers used in this network | +| .NetworkInterface | Name of the network interface on the host | +| .Options ... | Network options | +| .Routes | List of static routes for this network | +| .Subnets | List of subnets on this network | + +## EXAMPLE + +Inspect the default podman network. + +``` +$ podman network inspect podman +[ + { + "name": "podman", + "id": "2f259bab93aaaaa2542ba43ef33eb990d0999ee1b9924b557b7be53c0b7a1bb9", + "driver": "bridge", + "network_interface": "podman0", + "created": "2021-06-03T12:04:33.088567413+02:00", + "subnets": [ + { + "subnet": "10.88.0.0/16", + "gateway": "10.88.0.1" + } + ], + "ipv6_enabled": false, + "internal": false, + "dns_enabled": false, + "ipam_options": { + "driver": "host-local" + } + } +] +``` + +Show the subnet and gateway for a network. + +``` +$ podman network inspect podman --format "{{range .Subnets}}Subnet: {{.Subnet}} Gateway: {{.Gateway}}{{end}}" +Subnet: 10.88.0.0/16 Gateway: 10.88.0.1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-ls(1)](podman-network-ls.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)** + +## HISTORY +August 2021, Updated with the new network format by Paul Holzinger + +August 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-network-ls.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-network-ls.1.md new file mode 100644 index 000000000..a4ca4f5ff --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-network-ls.1.md @@ -0,0 +1,124 @@ +--- +title: podman-network-ls +version: v5.4.1 +--- + +% podman-network-ls 1 + +## NAME +podman\-network\-ls - Display a summary of networks + +## SYNOPSIS +**podman network ls** [*options*] + +## DESCRIPTION +Displays a list of existing podman networks. + +## OPTIONS +#### **--filter**, **-f**=*filter=value* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| **Filter** | **Description** | +| ---------- | ------------------------------------------------------------------------------------------------ | +| driver | Filter by driver type. | +| id | Filter by full or partial network ID. | +| label | Filter by network with (or without, in the case of label!=[...] is used) the specified labels. | +| name | Filter by network name (accepts `regex`). | +| until | Filter by networks created before given timestamp. | +| dangling | Filter by networks with no containers attached. | + + +The `driver` filter accepts values: `bridge`, `macvlan`, `ipvlan`. + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which shows images with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which shows images without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +The `dangling` *filter* accepts values `true` or `false`. + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|--------------------|-------------------------------------------| +| .Created ... | Timestamp when the network was created | +| .DNSEnabled | Network has dns enabled (boolean) | +| .Driver | Network driver | +| .ID | Network ID | +| .Internal | Network is internal (boolean) | +| .IPAMOptions ... | Network ipam options | +| .IPv6Enabled | Network has ipv6 subnet (boolean) | +| .Labels | Network labels | +| .Name | Network name | +| .NetworkDNSServers | Array of DNS servers used in this network | +| .NetworkInterface | Name of the network interface on the host | +| .Options ... | Network options | +| .Routes | List of static routes for this network | +| .Subnets | List of subnets on this network | + +#### **--no-trunc** + +Do not truncate the network ID. + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +The `quiet` option restricts the output to only the network names. + +## EXAMPLE + +Display networks: +``` +$ podman network ls +NETWORK ID NAME DRIVER +88a7120ee19d podman bridge +6dd508dbf8cd podman6 bridge +8e35c2cd3bf6 podman5 macvlan +``` + +Display only network names: +``` +$ podman network ls -q +podman +podman2 +outside +podman9 +``` + +Display name of network which support bridge plugin: +``` +$ podman network ls --filter driver=bridge --format {{.Name}} +podman +podman2 +podman9 +``` +List networks with their subnets: +``` +$ podman network ls --format "{{.Name}}: {{range .Subnets}}{{.Subnet}} {{end}}" +podman: 10.88.0.0/16 +podman3: 10.89.30.0/24 fde4:f86f:4aab\:e68f::/64 +macvlan: +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)** + +## HISTORY +August 2021, Updated with the new network format by Paul Holzinger + +August 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-network-prune.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-network-prune.1.md new file mode 100644 index 000000000..e56d728dc --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-network-prune.1.md @@ -0,0 +1,58 @@ +--- +title: podman-network-prune +version: v5.4.1 +--- + +% podman-network-prune 1 + +## NAME +podman\-network\-prune - Remove all unused networks + +## SYNOPSIS +**podman network prune** [*options*] + +## DESCRIPTION +Remove all unused networks. An unused network is defined by a network which +has no containers connected or configured to connect to it. It does not remove +the so-called default network which goes by the name of *podman*. + +## OPTIONS + +#### **--filter** + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------:|----------------------------------------------------------------------------------------------------| +| label | Only remove networks, with (or without, in the case of label!=[...] is used) the specified labels. | +| until | Only remove networks created before given timestamp. | + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes networks with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes networks without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not prompt for confirmation + +## EXAMPLE + +Prune networks: +``` +podman network prune +``` + +Prune all networks created not created in the last two hours: +``` +podman network prune --filter until=2h +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-rm(1)](podman-network-rm.1.md)** + +## HISTORY +February 2021, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-network-reload.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-network-reload.1.md new file mode 100644 index 000000000..0427a813f --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-network-reload.1.md @@ -0,0 +1,67 @@ +--- +title: podman-network-reload +version: v5.4.1 +--- + +% podman-network-reload 1 + +## NAME +podman\-network\-reload - Reload network configuration for containers + +## SYNOPSIS +**podman network reload** [*options*] [*container...*] + +## DESCRIPTION +Reload one or more container network configurations. + +Rootful Podman relies on iptables rules in order to provide network connectivity. If the iptables rules are deleted, +this happens for example with `firewall-cmd --reload`, the container loses network connectivity. This command restores +the network connectivity. + +## OPTIONS +#### **--all**, **-a** + +Reload network configuration of all containers. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Reload the network configuration after a firewall reload: +``` +# podman run -p 80:80 -d nginx +b1b538e8bc4078fc3ee1c95b666ebc7449b9a97bacd15bcbe464a29e1be59c1c +# curl 127.0.0.1 +works +# sudo firewall-cmd --reload +success +# curl 127.0.0.1 +hangs +# podman network reload b1b538e8bc40 +b1b538e8bc4078fc3ee1c95b666ebc7449b9a97bacd15bcbe464a29e1be59c1c +# curl 127.0.0.1 +works +``` + +Reload the network configuration for all containers: +``` +# podman network reload --all +b1b538e8bc4078fc3ee1c95b666ebc7449b9a97bacd15bcbe464a29e1be59c1c +fe7e8eca56f844ec33af10f0aa3b31b44a172776e3277b9550a623ed5d96e72b +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)** + +## HISTORY +December 2020, Originally compiled by Paul Holzinger diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-network-rm.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-network-rm.1.md new file mode 100644 index 000000000..3719cb490 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-network-rm.1.md @@ -0,0 +1,54 @@ +--- +title: podman-network-rm +version: v5.4.1 +--- + +% podman-network-rm 1 + +## NAME +podman\-network\-rm - Remove one or more networks + +## SYNOPSIS +**podman network rm** [*options*] [*network...*] + +## DESCRIPTION +Delete one or more Podman networks. + +## OPTIONS +#### **--force**, **-f** + +The `force` option removes all containers that use the named network. If the container is +running, the container is stopped and removed. + +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping the running containers that are using the specified network. The --force option must be specified to use the --time option. Use -1 for infinite wait. + +## EXAMPLE + +Delete specified network: +``` +# podman network rm podman9 +Deleted: podman9 +``` + +Delete specified network and all containers associated with the network: +``` +# podman network rm -f fred +Deleted: fred +``` + +## Exit Status + **0** All specified networks removed + + **1** One of the specified networks did not exist, and no other failures + + **2** The network is in use by a container or a Pod + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)** + +## HISTORY +August 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-network-update.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-network-update.1.md new file mode 100644 index 000000000..5d16abef8 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-network-update.1.md @@ -0,0 +1,41 @@ +--- +title: podman-network-update +version: v5.4.1 +--- + +% podman-network-update 1 + +## NAME +podman\-network\-update - Update an existing Podman network + +## SYNOPSIS +**podman network update** [*options*] *network* + +## DESCRIPTION +Allow changes to existing container networks. At present, only changes to the DNS servers in use by a network is supported. + +NOTE: Only supported with the netavark network backend. + + +## OPTIONS +#### **--dns-add** + +Accepts array of DNS resolvers and add it to the existing list of resolvers configured for a network. + +#### **--dns-drop** + +Accepts array of DNS resolvers and removes them from the existing list of resolvers configured for a network. + +## EXAMPLE + +Update a network: +``` +$ podman network update network1 --dns-add 8.8.8.8,1.1.1.1 +``` + +Update a network and add/remove dns servers: +``` +$ podman network update network1 --dns-drop 8.8.8.8 --dns-add 3.3.3.3 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-network-ls(1)](podman-network-ls.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-network.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-network.1.md new file mode 100644 index 000000000..86c44750c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-network.1.md @@ -0,0 +1,61 @@ +--- +title: podman-network +version: v5.4.1 +--- + +% podman-network 1 + +## NAME +podman\-network - Manage Podman networks + +## SYNOPSIS +**podman network** *subcommand* + +## DESCRIPTION +The network command manages networks for Podman. + +Podman supports two network backends [Netavark](https://github.com/containers/netavark) +and [CNI](https://www.cni.dev/). Netavark is the default network backend and was added in Podman version 4.0. +CNI is deprecated and will be removed in the next major Podman version 5.0, in preference of Netavark. +To configure the network backend use the `network_backend` key under the `[Network]` in +**[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**. +New systems use netavark by default, to check what backend is used run +`podman info --format {{.Host.NetworkBackend}}`. + +All network commands work for both backends but CNI and Netavark use different config files +so networks have to be created again after a backend change. + +## COMMANDS + +| Command | Man Page | Description | +| ---------- | -------------------------------------------------------------- | --------------------------------------------------------------- | +| connect | [podman-network-connect(1)](podman-network-connect.1.md) | Connect a container to a network | +| create | [podman-network-create(1)](podman-network-create.1.md) | Create a Podman network | +| disconnect | [podman-network-disconnect(1)](podman-network-disconnect.1.md) | Disconnect a container from a network | +| exists | [podman-network-exists(1)](podman-network-exists.1.md) | Check if the given network exists | +| inspect | [podman-network-inspect(1)](podman-network-inspect.1.md) | Display the network configuration for one or more networks | +| ls | [podman-network-ls(1)](podman-network-ls.1.md) | Display a summary of networks | +| prune | [podman-network-prune(1)](podman-network-prune.1.md) | Remove all unused networks | +| reload | [podman-network-reload(1)](podman-network-reload.1.md) | Reload network configuration for containers | +| rm | [podman-network-rm(1)](podman-network-rm.1.md) | Remove one or more networks | +| update | [podman-network-update(1)](podman-network-update.1.md) | Update an existing Podman network | + +## SUBNET NOTES +Podman requires specific default IPs and, thus, network subnets. The default values used by Podman can be modified in the **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** file. + +### Podman network +The default bridge network (called `podman`) uses 10.88.0.0/16 as a subnet. When Podman runs as root, the `podman` network is used as default. It is the same as adding the option `--network bridge` or `--network podman`. This subnet can be changed in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** under the [network] section. Set the `default_subnet` to any subnet that is free in the environment. The name of the default network can also be changed from `podman` to another name using the default network key. Note that this is only done when no containers are running. + +### Pasta +Pasta by default performs no Network Address Translation (NAT) and copies the IPs from your main interface into the container namespace. If pasta cannot find an interface with the default route, it will select an interface if there is only one interface with a valid route. If you do not have a default route and several interfaces have defined routes, pasta will be unable to figure out the correct interface and it will fail to start. To specify the interface, use `-i` option to pasta. A default set of pasta options can be set in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** under the `[network]` section with the `pasta_options` key. + +The default rootless networking tool can be selected in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** under the `[network]` section with `default_rootless_network_cmd`, which can be set to `pasta` (default) or `slirp4netns`. + +### Slirp4netns +Slirp4netns uses 10.0.2.0/24 for its default network. This can also be changed in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** but under the `[engine]` section. Use the `network_cmd_options` key and add `["cidr=X.X.X.X/24"]` as a value. Note that slirp4netns needs a network prefix size between 1 and 25. This option accepts an array, so more options can be added in a comma-separated string as described on the **[podman-network-create(1)](podman-network-create.1.md)** man page. To change the CIDR for just one container, specify it on the cli using the `--network` option like this: `--network slirp4netns\:cidr=192.168.1.0/24`. + +### Podman network create +When a new network is created with a `podman network create` command, and no subnet is given with the --subnet option, Podman starts picking a free subnet from 10.89.0.0/24 to 10.255.255.0/24. Use the `default_subnet_pools` option under the `[network]` section in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** to change the range and/or size that is assigned by default. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-pause.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-pause.1.md new file mode 100644 index 000000000..4585a1edd --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-pause.1.md @@ -0,0 +1,102 @@ +--- +title: podman-pause +version: v5.4.1 +--- + +% podman-pause 1 + +## NAME +podman\-pause - Pause one or more containers + +## SYNOPSIS +**podman pause** [*options*] [*container*...] + +**podman container pause** [*options*] [*container*...] + +## DESCRIPTION +Pauses all the processes in one or more containers. You may use container IDs or names as input. + +## OPTIONS + +#### **--all**, **-a** + +Pause all running containers. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and pause the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + +#### **--filter**, **-f**=*filter* + +Filter what containers pause. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Pause specified container: +``` +podman pause mywebserver +``` + +Pause container by partial container ID: +``` +podman pause 860a4b23 +``` + +Pause all **running** containers: +``` +podman pause --all +``` + +Pause container using ID specified in given files: +``` +podman pause --cidfile /home/user/cidfile-1 +podman pause --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +Pause the latest container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman pause --latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-unpause(1)](podman-unpause.1.md)** + +## HISTORY +September 2017, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-pod-clone.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-pod-clone.1.md new file mode 100644 index 000000000..5ebdefcdf --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-pod-clone.1.md @@ -0,0 +1,794 @@ +--- +title: podman-pod-clone +version: v5.4.1 +--- + +% podman-pod-clone 1 + +## NAME +podman\-pod\-clone - Create a copy of an existing pod + +## SYNOPSIS +**podman pod clone** [*options*] *pod* *name* + +## DESCRIPTION +**podman pod clone** creates a copy of a pod, recreating the identical config for the pod and for all of its containers. Users can modify the pods new name and select pod details within the infra container + +## OPTIONS + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the pod is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + +#### **--cpus** + +Set a number of CPUs for the pod that overrides the original pods CPU limits. If none are specified, the original pod's Nano CPUs are used. + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + +If none are specified, the original pod's CPUset is used. + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/destroy.md) +#### **--destroy** + +Remove the original pod that we are cloning once used to mimic the configuration. + +[//]: # (END included file options/destroy.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the pod. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The pod only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: the pod implements devices by storing the initial configuration passed by the user and recreating the device on each container added to the pod. + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + + +[//]: # (BEGIN included file options/gidmap.pod.md) +#### **--gidmap**=*pod_gid\:host_gid\:amount* + +GID map for the user namespace. Using this flag runs all containers in the pod with user namespace enabled. +It conflicts with the **--userns** and **--subgidname** flags. + +[//]: # (END included file options/gidmap.pod.md) + + +[//]: # (BEGIN included file options/gpus.md) +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. + +[//]: # (END included file options/gpus.md) + +#### **--help**, **-h** + +Print usage statement. + + +[//]: # (BEGIN included file options/hostname.pod.md) +#### **--hostname**=*name* + +Set the pod's hostname inside all containers. + +The given hostname is also added to the `/etc/hosts` file using the container's +primary IP address (also see the **--add-host** option). + +[//]: # (END included file options/hostname.pod.md) + + +[//]: # (BEGIN included file options/infra-command.md) +#### **--infra-command**=*command* + +The command that is run to start the infra container. Default: "/pause". + +[//]: # (END included file options/infra-command.md) + + +[//]: # (BEGIN included file options/infra-conmon-pidfile.md) +#### **--infra-conmon-pidfile**=*file* + +Write the pid of the infra container's **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to manage Podman containers and pods. + +[//]: # (END included file options/infra-conmon-pidfile.md) + + +[//]: # (BEGIN included file options/infra-name.md) +#### **--infra-name**=*name* + +The name that is used for the pod's infra container. + +[//]: # (END included file options/infra-name.md) + + +[//]: # (BEGIN included file options/label.md) +#### **--label**, **-l**=*key=value* + +Add metadata to a pod. + +[//]: # (END included file options/label.md) + + +[//]: # (BEGIN included file options/label-file.md) +#### **--label-file**=*file* + +Read in a line-delimited file of labels. + +[//]: # (END included file options/label-file.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + +#### **--name**, **-n** + +Set a custom name for the cloned pod. The default if not specified is of the syntax: **\-clone** + + +[//]: # (BEGIN included file options/pid.pod.md) +#### **--pid**=*pid* + +Set the PID mode for the pod. The default is to create a private PID namespace for the pod. Requires the PID namespace to be shared via --share. + + host: use the host’s PID namespace for the pod + ns: join the specified PID namespace + private: create a new namespace for the pod (default) + +[//]: # (END included file options/pid.pod.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + +Default restart policy for all the containers in a pod. + + +[//]: # (BEGIN included file options/security-opt.md) +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the pod +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the pod + +- **label=user:**_USER_: Set the label user for the pod processes +- **label=role:**_ROLE_: Set the label role for the pod processes +- **label=type:**_TYPE_: Set the label process type for the pod processes +- **label=level:**_LEVEL_: Set the label level for the pod processes +- **label=filetype:**_TYPE_: Set the label file type for the pod files +- **label=disable**: Turn off label separation for the pod + +Note: Labeling can be disabled for all pods/containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the containers within the pod. + +- **no-new-privileges**: Disable container processes from gaining additional privileges. + +- **seccomp=unconfined**: Turn off seccomp confinement for the pod. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. + +[//]: # (END included file options/security-opt.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the pod. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/shm-size-systemd.md) +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. + +[//]: # (END included file options/shm-size-systemd.md) + +#### **--start** + +When set to true, this flag starts the newly created pod after the +clone process has completed. All containers within the pod are started. + + +[//]: # (BEGIN included file options/subgidname.md) +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. + +[//]: # (END included file options/subgidname.md) + + +[//]: # (BEGIN included file options/subuidname.md) +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. + +[//]: # (END included file options/subuidname.md) + + +[//]: # (BEGIN included file options/sysctl.md) +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters for all containers in the pod. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: if the ipc namespace is not shared within the pod, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: if the network namespace is not shared within the pod, the above sysctls are not allowed. + +[//]: # (END included file options/sysctl.md) + + +[//]: # (BEGIN included file options/uidmap.pod.md) +#### **--uidmap**=*container_uid\:from_uid\:amount* + +Run all containers in the pod in a new user namespace using the supplied mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +[//]: # (END included file options/uidmap.pod.md) + + +[//]: # (BEGIN included file options/userns.pod.md) +#### **--userns**=*mode* + +Set the user namespace mode for all the containers in a pod. It defaults to the `PODMAN_USERNS` environment variable. An empty value ("") means user namespaces are disabled. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +----------|---------------|--------------------- +"" |$UID |0 (Default User account mapped to root user in container.) +host |$UID |0 (Default User account mapped to root user in container.) +keep-id |$UID |$UID (Map user account to same UID within container.) +auto |$UID | nil (Host User UID is not mapped into container.) +nomap |$UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + + - *auto[:*_OPTIONS,..._*]*: automatically create a namespace. It is possible to specify these options to `auto`: + + - *gidmapping=*_CONTAINER\_GID\:HOST\_GID\:SIZE_ to force a GID mapping to be present in the user namespace. + + - *size=*_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates the size for the user namespace. + + - *uidmapping=*_CONTAINER\_UID\:HOST\_UID\:SIZE_ to force a UID mapping to be present in the user namespace. + + - *host*: run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user (default). + + - *keep-id*: creates a user namespace where the current rootless user's UID\:GID are mapped to the same values in the container. This option is not allowed for containers created by the root user. + + - *nomap*: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +[//]: # (END included file options/userns.pod.md) + + +[//]: # (BEGIN included file options/uts.pod.md) +#### **--uts**=*mode* + +Set the UTS namespace mode for the pod. The following values are supported: + +- **host**: use the host's UTS namespace inside the pod. +- **private**: create a new namespace for the pod (default). +- **ns:[path]**: run the pod in the given existing UTS namespace. + +[//]: # (END included file options/uts.pod.md) + + +[//]: # (BEGIN included file options/volume.md) +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the pod is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +pod. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a pod is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the pod, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the pod. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a pod. Without a label, the security system +might prevent the processes running inside the pod from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the pod context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +pods share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label Only the current pod can use a private +volume. Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any of one the containers. Relabeling walks +the file system under the volume and changes the label on each file, if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the pod. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually change with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the pod. +For example if a user wanted to volume mount their entire home directory into a +pod, they need to disable SELinux separation. + + $ podman pod clone --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The pod processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the pod +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous pod executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the pod infra container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the pod or infra container +to work. + +Do not modify the source directory mounted into the pod with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the pod are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the pod +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +pod, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +pod. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the pod. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the pod. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless pod fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/volume.md) + + +[//]: # (BEGIN included file options/volumes-from.md) +#### **--volumes-from**=*CONTAINER[\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers and pods. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +pod. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a pod. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the pod context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target pod, then the volume hides +that data on the target. + +[//]: # (END included file options/volumes-from.md) + +## EXAMPLES + +Clone the specified pod to a new pod. +``` +# podman pod clone pod-name +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone the specified pod to a new pod with a new name. +``` +# podman pod clone pod-name --name=cloned-pod +d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone and remove the specified pod to a new pod, modifying its cpus. +``` +# podman pod clone --destroy --cpus=5 d0cf1 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone the specified pod to a new named pod. +``` +# podman pod clone 2d4d4fca7219b4437e0d74fcdc272c4f031426a6eacd207372691207079551de new_name +5a9b7851013d326aa4ac4565726765901b3ecc01fcbc0f237bc7fd95588a24f9 +``` +## SEE ALSO +**[podman-pod-create(1)](podman-pod-create.1.md)** + +## HISTORY +May 2022, Originally written by Charlie Doern + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a core value of open source. The `master` and `slave` mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately. diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-pod-create.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-pod-create.1.md new file mode 100644 index 000000000..54a812c44 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-pod-create.1.md @@ -0,0 +1,1130 @@ +--- +title: podman-pod-create +version: v5.4.1 +--- + +% podman-pod-create 1 + +## NAME +podman\-pod\-create - Create a new pod + +## SYNOPSIS +**podman pod create** [*options*] [*name*] + +## DESCRIPTION + +Creates an empty pod, or unit of multiple containers, and prepares it to have +containers added to it. The pod can be created with a specific name. If a name +is not given a random name is generated. The pod ID is printed to STDOUT. You +can then use **podman create --pod `` ...** to add containers +to the pod, and **podman pod start ``** to start the pod. + +The operator can identify a pod in three ways: +UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”) +UUID short identifier (“f78375b1c487”) +Name (“jonah”) + +podman generates a UUID for each pod, and if a name is not assigned +to the container with **--name** then a random string name is generated +for it. This name is useful to identify a pod. + +Note: resource limit related flags work by setting the limits explicitly in the pod's cgroup parent +for all containers joining the pod. A container can override the resource limits when joining a pod. +For example, if a pod was created via **podman pod create --cpus=5**, specifying **podman container create --pod=`` --cpus=4** causes the container to use the smaller limit. Also, containers which specify their own cgroup, such as **--cgroupns=host**, do NOT get the assigned pod level cgroup resources. + +## OPTIONS + + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the pod's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + +The /etc/hosts file is shared between all containers in the pod. + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the pod is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + +#### **--cpus**=*amount* + +Set the total number of CPUs delegated to the pod. Default is 0.000 which indicates that there is no limit on computation power. + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the pod. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The pod only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: the pod implements devices by storing the initial configuration passed by the user and recreating the device on each container added to the pod. + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + +#### **--dns**=*ipaddr* + +Set custom DNS servers in the /etc/resolv.conf file that is shared between all containers in the pod. A special option, "none" is allowed which disables creation of /etc/resolv.conf for the pod. + +#### **--dns-option**=*option* + +Set custom DNS options in the /etc/resolv.conf file that is shared between all containers in the pod. + +#### **--dns-search**=*domain* + +Set custom DNS search domains in the /etc/resolv.conf file that is shared between all containers in the pod. + +#### **--exit-policy**=**continue** | *stop* + +Set the exit policy of the pod when the last container exits. Supported policies are: + +| Exit Policy | Description | +| ------------------ | -------------------------------------------------------------------------------------------------------------------------- | +| *continue* | The pod continues running, by keeping its infra container alive, when the last container exits. Used by default. | +| *stop* | The pod (including its infra container) is stopped when the last container exits. Used in `kube play`. | + + +[//]: # (BEGIN included file options/gidmap.pod.md) +#### **--gidmap**=*pod_gid\:host_gid\:amount* + +GID map for the user namespace. Using this flag runs all containers in the pod with user namespace enabled. +It conflicts with the **--userns** and **--subgidname** flags. + +[//]: # (END included file options/gidmap.pod.md) + + +[//]: # (BEGIN included file options/gpus.md) +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. + +[//]: # (END included file options/gpus.md) + +#### **--help**, **-h** + +Print usage statement. + + +[//]: # (BEGIN included file options/hostname.pod.md) +#### **--hostname**=*name* + +Set the pod's hostname inside all containers. + +The given hostname is also added to the `/etc/hosts` file using the container's +primary IP address (also see the **--add-host** option). + +[//]: # (END included file options/hostname.pod.md) + + +[//]: # (BEGIN included file options/hosts-file.md) +#### **--hosts-file**=*path* | *none* | *image* + +Base file to create the `/etc/hosts` file inside the container. This must either +be an absolute path to a file on the host system, or one of the following +special flags: + "" Follow the `base_hosts_file` configuration in _containers.conf_ (the default) + `none` Do not use a base file (i.e. start with an empty file) + `image` Use the container image's `/etc/hosts` file as base file + +[//]: # (END included file options/hosts-file.md) + +#### **--infra** + +Create an infra container and associate it with the pod. An infra container is a lightweight container used to coordinate the shared kernel namespace of a pod. Default: true. + + +[//]: # (BEGIN included file options/infra-command.md) +#### **--infra-command**=*command* + +The command that is run to start the infra container. Default: "/pause". + +[//]: # (END included file options/infra-command.md) + + +[//]: # (BEGIN included file options/infra-conmon-pidfile.md) +#### **--infra-conmon-pidfile**=*file* + +Write the pid of the infra container's **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to manage Podman containers and pods. + +[//]: # (END included file options/infra-conmon-pidfile.md) + +#### **--infra-image**=*image* + +The custom image that is used for the infra container. Unless specified, Podman builds a custom local image which does not require pulling down an image. + + +[//]: # (BEGIN included file options/infra-name.md) +#### **--infra-name**=*name* + +The name that is used for the pod's infra container. + +[//]: # (END included file options/infra-name.md) + + +[//]: # (BEGIN included file options/ip.md) +#### **--ip**=*ipv4* + +Specify a static IPv4 address for the pod, for example **10.88.64.128**. +This option can only be used if the pod is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the pod is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IP address pool (default **10.88.0.0/16**). + +To specify multiple static IP addresses per pod, set multiple networks using the **--network** option with a static IP address specified for each using the `ip` mode for that option. + +[//]: # (END included file options/ip.md) + + +[//]: # (BEGIN included file options/ip6.md) +#### **--ip6**=*ipv6* + +Specify a static IPv6 address for the pod, for example **fd46\:db93\:aa76\:ac37::10**. +This option can only be used if the pod is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the pod is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IPv6 address pool. + +To specify multiple static IPv6 addresses per pod, set multiple networks using the **--network** option with a static IPv6 address specified for each using the `ip6` mode for that option. + +[//]: # (END included file options/ip6.md) + + +[//]: # (BEGIN included file options/label.md) +#### **--label**, **-l**=*key=value* + +Add metadata to a pod. + +[//]: # (END included file options/label.md) + + +[//]: # (BEGIN included file options/label-file.md) +#### **--label-file**=*file* + +Read in a line-delimited file of labels. + +[//]: # (END included file options/label-file.md) + + +[//]: # (BEGIN included file options/mac-address.md) +#### **--mac-address**=*address* + +Pod network interface MAC address (e.g. 92\:d0\:c6:0a:29:33) +This option can only be used if the pod is joined to only a single network - i.e., **--network=_network-name_** is used at most once - +and if the pod is not joining another container's network namespace via **--network=container\:_id_**. + +Remember that the MAC address in an Ethernet network must be unique. +The IPv6 link-local address is based on the device's MAC address +according to RFC4862. + +To specify multiple static MAC addresses per pod, set multiple networks using the **--network** option with a static MAC address specified for each using the `mac` mode for that option. + +[//]: # (END included file options/mac-address.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + +#### **--name**, **-n**=*name* + +Assign a name to the pod. + + +[//]: # (BEGIN included file options/network.md) +#### **--network**=*mode*, **--net** + +Set the network mode for the pod. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured, to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.md) + +Invalid if using **--dns**, **--dns-option**, or **--dns-search** with **--network** set to **none** or **container:**_id_. + + +[//]: # (BEGIN included file options/network-alias.md) +#### **--network-alias**=*alias* + +Add a network-scoped alias for the pod, setting the alias for all networks that the container joins. To set a +name only for a specific network, use the alias option as described under the **--network** option. +If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. This option can be specified multiple times. +NOTE: When using CNI a pod only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. + +[//]: # (END included file options/network-alias.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the pod. + +Podman assumes control over the pod's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/pid.pod.md) +#### **--pid**=*pid* + +Set the PID mode for the pod. The default is to create a private PID namespace for the pod. Requires the PID namespace to be shared via --share. + + host: use the host’s PID namespace for the pod + ns: join the specified PID namespace + private: create a new namespace for the pod (default) + +[//]: # (END included file options/pid.pod.md) + +#### **--pod-id-file**=*path* + +Write the pod ID to the file. + + +[//]: # (BEGIN included file options/publish.md) +#### **--publish**, **-p**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Publish a container's port, or range of ports, within this pod to the host. + +Both *hostPort* and *containerPort* can be specified as a range of ports. +When specifying ranges for both, the number of container ports in the +range must match the number of host ports in the range. + +If host IP is set to 0.0.0.0 or not set at all, the port is bound on all IPs on the host. + +By default, Podman publishes TCP ports. To publish a UDP port instead, give +`udp` as protocol. To publish both TCP and UDP ports, set `--publish` twice, +with `tcp`, and `udp` as protocols respectively. Rootful containers can also +publish ports using the `sctp` protocol. + +Host port does not have to be specified (e.g. `podman run -p 127.0.0.1::80`). +If it is not, the container port is randomly assigned a port on the host. + +Use **podman port** to see the actual mapping: `podman port $CONTAINER $CONTAINERPORT`. + +Note that the network drivers `macvlan` and `ipvlan` do not support port forwarding, +it will have no effect on these networks. + +[//]: # (END included file options/publish.md) + +**Note:** You must not publish ports of containers in the pod individually, +but only by the pod itself. + +**Note:** This cannot be modified once the pod is created. + + +[//]: # (BEGIN included file options/replace.md) +#### **--replace** + +If another pod with the same name already exists, replace and remove it. The default is **false**. + +[//]: # (END included file options/replace.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + +Default restart policy for all the containers in a pod. + + +[//]: # (BEGIN included file options/security-opt.md) +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the pod +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the pod + +- **label=user:**_USER_: Set the label user for the pod processes +- **label=role:**_ROLE_: Set the label role for the pod processes +- **label=type:**_TYPE_: Set the label process type for the pod processes +- **label=level:**_LEVEL_: Set the label level for the pod processes +- **label=filetype:**_TYPE_: Set the label file type for the pod files +- **label=disable**: Turn off label separation for the pod + +Note: Labeling can be disabled for all pods/containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the containers within the pod. + +- **no-new-privileges**: Disable container processes from gaining additional privileges. + +- **seccomp=unconfined**: Turn off seccomp confinement for the pod. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. + +[//]: # (END included file options/security-opt.md) + +#### **--share**=*namespace* + +A comma-separated list of kernel namespaces to share. If none or "" is specified, no namespaces are shared, and the infra container is not created unless explicitly specified via **--infra=true**. The namespaces to choose from are cgroup, ipc, net, pid, uts. If the option is prefixed with a "+", the namespace is appended to the default list. Otherwise, it replaces the default list. Defaults match Kubernetes default (ipc, net, uts) + +#### **--share-parent** + +This boolean determines whether or not all containers entering the pod use the pod as their cgroup parent. The default value of this option is true. Use the **--share** option to share the cgroup namespace rather than a cgroup parent in a pod. + +Note: This option conflicts with the **--share=cgroup** option since that option sets the pod as the cgroup parent but enters the container into the same cgroupNS as the infra container. + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the pod. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/shm-size-systemd.md) +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. + +[//]: # (END included file options/shm-size-systemd.md) + + +[//]: # (BEGIN included file options/subgidname.md) +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. + +[//]: # (END included file options/subgidname.md) + + +[//]: # (BEGIN included file options/subuidname.md) +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. + +[//]: # (END included file options/subuidname.md) + + +[//]: # (BEGIN included file options/sysctl.md) +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters for all containers in the pod. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: if the ipc namespace is not shared within the pod, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: if the network namespace is not shared within the pod, the above sysctls are not allowed. + +[//]: # (END included file options/sysctl.md) + + +[//]: # (BEGIN included file options/uidmap.pod.md) +#### **--uidmap**=*container_uid\:from_uid\:amount* + +Run all containers in the pod in a new user namespace using the supplied mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +[//]: # (END included file options/uidmap.pod.md) + + +[//]: # (BEGIN included file options/userns.pod.md) +#### **--userns**=*mode* + +Set the user namespace mode for all the containers in a pod. It defaults to the `PODMAN_USERNS` environment variable. An empty value ("") means user namespaces are disabled. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +----------|---------------|--------------------- +"" |$UID |0 (Default User account mapped to root user in container.) +host |$UID |0 (Default User account mapped to root user in container.) +keep-id |$UID |$UID (Map user account to same UID within container.) +auto |$UID | nil (Host User UID is not mapped into container.) +nomap |$UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + + - *auto[:*_OPTIONS,..._*]*: automatically create a namespace. It is possible to specify these options to `auto`: + + - *gidmapping=*_CONTAINER\_GID\:HOST\_GID\:SIZE_ to force a GID mapping to be present in the user namespace. + + - *size=*_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates the size for the user namespace. + + - *uidmapping=*_CONTAINER\_UID\:HOST\_UID\:SIZE_ to force a UID mapping to be present in the user namespace. + + - *host*: run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user (default). + + - *keep-id*: creates a user namespace where the current rootless user's UID\:GID are mapped to the same values in the container. This option is not allowed for containers created by the root user. + + - *nomap*: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +[//]: # (END included file options/userns.pod.md) + + +[//]: # (BEGIN included file options/uts.pod.md) +#### **--uts**=*mode* + +Set the UTS namespace mode for the pod. The following values are supported: + +- **host**: use the host's UTS namespace inside the pod. +- **private**: create a new namespace for the pod (default). +- **ns:[path]**: run the pod in the given existing UTS namespace. + +[//]: # (END included file options/uts.pod.md) + + +[//]: # (BEGIN included file options/volume.md) +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the pod is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +pod. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a pod is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the pod, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the pod. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a pod. Without a label, the security system +might prevent the processes running inside the pod from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the pod context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +pods share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label Only the current pod can use a private +volume. Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any of one the containers. Relabeling walks +the file system under the volume and changes the label on each file, if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the pod. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually change with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the pod. +For example if a user wanted to volume mount their entire home directory into a +pod, they need to disable SELinux separation. + + $ podman pod create --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The pod processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the pod +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous pod executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the pod infra container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the pod or infra container +to work. + +Do not modify the source directory mounted into the pod with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the pod are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the pod +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +pod, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +pod. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the pod. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the pod. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless pod fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/volume.md) + + +[//]: # (BEGIN included file options/volumes-from.md) +#### **--volumes-from**=*CONTAINER[\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers and pods. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +pod. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a pod. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the pod context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target pod, then the volume hides +that data on the target. + +[//]: # (END included file options/volumes-from.md) + +## EXAMPLES + +Create a named pod. +``` +$ podman pod create --name test +``` + +Create a named pod. +``` +$ podman pod create mypod +``` + +Create a pod without an infra container. +``` +$ podman pod create --infra=false +``` + +Create a named pod with infra container command to run. +``` +$ podman pod create --infra-command /top toppod +``` + +Create a pod with published ports on the host. +``` +$ podman pod create --publish 8443:443 +``` + +Create a pod with the specified network configuration. +``` +$ podman pod create --network slirp4netns:outbound_addr=127.0.0.1,allow_host_loopback=true +``` + +Create a pod with the specified network. +``` +$ podman pod create --network pasta +``` + +Create a pod on two networks. +``` +$ podman pod create --network net1\:ip=10.89.1.5 --network net2\:ip=10.89.10.10 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **containers.conf(1)**, **[cgroups(7)](https://man7.org/linux/man-pages/man7/cgroups.7.html)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +July 2018, Originally compiled by Peter Hunt + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a core value of open source. The `master` and `slave` mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately. diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-pod-exists.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-pod-exists.1.md new file mode 100644 index 000000000..7dc246d86 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-pod-exists.1.md @@ -0,0 +1,38 @@ +--- +title: podman-pod-exists +version: v5.4.1 +--- + +% podman-pod-exists 1 + +## NAME +podman-pod-exists - Check if a pod exists in local storage + +## SYNOPSIS +**podman pod exists** *pod* + +## DESCRIPTION +**podman pod exists** checks if a pod exists in local storage. The **ID** or **Name** +of the pod may be used as input. Podman returns an exit code +of `0` when the pod is found. A `1` is returned otherwise. An exit code of `125` indicates there +was an issue accessing the local storage. + +## EXAMPLES + +Check if specified pod exists in local storage (the pod does actually exist): +``` +$ sudo podman pod exists web; echo $? +0 +``` + +Check if specified pod exists in local storage (the pod does not actually exist): +``` +$ sudo podman pod exists backend; echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-pod-inspect.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-pod-inspect.1.md new file mode 100644 index 000000000..529f6538f --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-pod-inspect.1.md @@ -0,0 +1,113 @@ +--- +title: podman-pod-inspect +version: v5.4.1 +--- + +% podman-pod-inspect 1 + +## NAME +podman\-pod\-inspect - Display information describing a pod + +## SYNOPSIS +**podman pod inspect** [*options*] *pod* ... + +## DESCRIPTION +Displays configuration and state information about a given pod. It also displays information about containers +that belong to the pod. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|----------------------|---------------------------------------------| +| .BlkioDeviceReadBps | Block I/O Device Read, in bytes/sec | +| .BlkioDeviceWriteBps | Block I/O Device Read, in bytes/sec | +| .BlkioWeight | Block I/O Weight | +| .BlkioWeightDevice | Block I/O Device Weight | +| .CgroupParent | Pod cgroup parent | +| .CgroupPath | Pod cgroup path | +| .Containers | Pod containers | +| .CPUPeriod | CPU period | +| .CPUQuota | CPU quota | +| .CPUSetCPUs | CPU Set CPUs | +| .CPUSetMems | CPU Set Mems | +| .CPUShares | CPU Shares | +| .CreateCgroup | Whether cgroup was created | +| .CreateCommand | Create command | +| .Created ... | Time when the pod was created | +| .CreateInfra | Whether infrastructure created | +| .Devices | Devices | +| .ExitPolicy | Exit policy | +| .Hostname | Pod hostname | +| .ID | Pod ID | +| .InfraConfig ... | Infra config (contains further fields) | +| .InfraContainerID | Pod infrastructure ID | +| .InspectPodData ... | Nested structure, for experts only | +| .Labels ... | Pod labels | +| .LockNumber | Number of the pod's Libpod lock | +| .MemoryLimit | Memory limit, bytes | +| .MemorySwap | Memory swap limit, in bytes | +| .Mounts | Mounts | +| .Name | Pod name | +| .Namespace | Namespace | +| .NumContainers | Number of containers in the pod | +| .RestartPolicy | Restart policy of the pod | +| .SecurityOpts | Security options | +| .SharedNamespaces | Pod shared namespaces | +| .State | Pod state | +| .VolumesFrom | Volumes from | + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Inspect specified pod: +``` +# podman pod inspect foobar +[ + { + "Id": "3513ca70583dd7ef2bac83331350f6b6c47d7b4e526c908e49d89ebf720e4693", + "Name": "foobar", + "Labels": {}, + "CgroupParent": "/libpod_parent", + "CreateCgroup": true, + "Created": "2018-08-08T11:15:18.823115347-05:00" + "State": "created", + "Hostname": "", + "SharedNamespaces": [ + "uts", + "ipc", + "net" + ] + "CreateInfra": false, + "InfraContainerID": "1020dd70583dd7ff2bac83331350f6b6e007de0d026c908e49d89ebf891d4699" + "CgroupPath": "" + "Containers": [ + { + "id": "d53f8bf1e9730281264aac6e6586e327429f62c704abea4b6afb5d8a2b2c9f2c", + "state": "configured" + } + ] + } +] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +August 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-pod-kill.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-pod-kill.1.md new file mode 100644 index 000000000..af949d587 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-pod-kill.1.md @@ -0,0 +1,73 @@ +--- +title: podman-pod-kill +version: v5.4.1 +--- + +% podman-pod-kill 1 + +## NAME +podman\-pod\-kill - Kill the main process of each container in one or more pods + +## SYNOPSIS +**podman pod kill** [*options*] *pod* ... + +## DESCRIPTION +The main process of each container inside the pods specified is sent SIGKILL, or any signal specified with option --signal. + +## OPTIONS +#### **--all**, **-a** + +Sends signal to all containers associated with a pod. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/signal.md) +#### **--signal**, **-s**=**signal** + +Signal to send to the containers in the pod. For more information on Linux signals, refer to *signal(7)*. +The default is **SIGKILL**. + +[//]: # (END included file options/signal.md) + +## EXAMPLE + +Kill pod with a given name: +``` +podman pod kill mywebserver +``` + +Kill pod with a given ID: +``` +podman pod kill 860a4b23 +``` + +Terminate pod by sending `TERM` signal: +``` +podman pod kill --signal TERM 860a4b23 +``` + +Kill the latest pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman pod kill --latest +``` + +Terminate all pods by sending `KILL` signal: +``` +podman pod kill --all +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-stop(1)](podman-pod-stop.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-pod-logs.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-pod-logs.1.md new file mode 100644 index 000000000..9ec880004 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-pod-logs.1.md @@ -0,0 +1,136 @@ +--- +title: podman-pod-logs +version: v5.4.1 +--- + +% podman-pod-logs 1 + +## NAME +podman\-pod\-logs - Display logs for pod with one or more containers + +## SYNOPSIS +**podman pod logs** [*options*] *pod* + +## DESCRIPTION +The podman pod logs command batch-retrieves whatever logs are present with all the containers of a pod. Pod logs can be filtered by container name or ID using flag **-c** or **--container** if needed. + +Note: A long-running `podman pod log` command with a `-f` or `--follow` option needs to be reinvoked if a new container is added to the pod dynamically; otherwise, logs of newly added containers are not visible in the log stream. + +## OPTIONS + + +[//]: # (BEGIN included file options/color.md) +#### **--color** + +Output the containers with different colors in the log. + +[//]: # (END included file options/color.md) + +#### **--container**, **-c** + +By default, `podman pod logs` retrieves logs for all the containers available within the pod, differentiated by the field `container`. However, there are use cases where the user wants to limit the log stream only to a particular container of a pod. For such cases, `-c` can be used like `podman pod logs -c ctrNameorID podname`. + + +[//]: # (BEGIN included file options/follow.md) +#### **--follow**, **-f** + +Follow log output. Default is false. + +Note: When following a pod which is removed by `podman pod rm` +or removed on exit (`podman run --rm ...`), there is a chance that the log +file is removed before `podman pod logs` reads the final content. + +[//]: # (END included file options/follow.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/names.md) +#### **--names**, **-n** + +Output the container names instead of the container IDs in the log. + +[//]: # (END included file options/names.md) + + +[//]: # (BEGIN included file options/since.md) +#### **--since**=*TIMESTAMP* + +Show logs since TIMESTAMP. The --since option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. + +[//]: # (END included file options/since.md) + + +[//]: # (BEGIN included file options/tail.md) +#### **--tail**=*LINES* + +Output the specified number of LINES at the end of the logs. LINES must be an integer. Defaults to -1, +which prints all lines + +[//]: # (END included file options/tail.md) + + +[//]: # (BEGIN included file options/timestamps.md) +#### **--timestamps**, **-t** + +Show timestamps in the log outputs. The default is false + +[//]: # (END included file options/timestamps.md) + + +[//]: # (BEGIN included file options/until.md) +#### **--until**=*TIMESTAMP* + +Show logs until TIMESTAMP. The --until option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. + +[//]: # (END included file options/until.md) + +## EXAMPLE + +To view a pod's logs: +``` +podman pod logs -t podIdorName +``` + +To view logs of a specific container on the pod: +``` +podman pod logs -c ctrIdOrName podIdOrName +``` + +To view all pod logs: +``` +podman pod logs -t --since 0 myserver-pod-1 +``` + +To view a pod's logs since a certain time: +``` +podman pod logs -t --since 2017-08-07T10:10:09.055837383-04:00 myserver-pod-1 +``` + +To view a pod's logs generated in the last 10 minutes: +``` +podman pod logs --since 10m myserver-pod-1 +``` + +To view a pod's logs until 30 minutes ago: +``` +podman pod logs --until 30m myserver-pod-1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-rm(1)](podman-pod-rm.1.md)**, **[podman-logs(1)](podman-logs.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-pod-pause.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-pod-pause.1.md new file mode 100644 index 000000000..32dcebfc1 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-pod-pause.1.md @@ -0,0 +1,43 @@ +--- +title: podman-pod-pause +version: v5.4.1 +--- + +% podman-pod-pause 1 + +## NAME +podman\-pod\-pause - Pause one or more pods + +## SYNOPSIS +**podman pod pause** [*options*] *pod* ... + +## DESCRIPTION +Pauses all the running processes in the containers of one or more pods. You may use pod IDs or names as input. + +## OPTIONS + +#### **--all**, **-a** + +Pause all pods. + +#### **--latest**, **-l** + +Instead of providing the pod name or ID, pause the last created pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +## EXAMPLE + +Pause a pod with a given name: +``` +podman pod pause mywebserverpod +``` + +Pause a pod with a given ID: +``` +podman pod pause 860a4b23 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-unpause(1)](podman-pod-unpause.1.md)**, **[podman-pause(1)](podman-pause.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-pod-prune.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-pod-prune.1.md new file mode 100644 index 000000000..7ed26f584 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-pod-prune.1.md @@ -0,0 +1,38 @@ +--- +title: podman-pod-prune +version: v5.4.1 +--- + +% podman-pod-prune 1 + +## NAME +podman-pod-prune - Remove all stopped pods and their containers + +## SYNOPSIS +**podman pod prune** [*options*] + +## DESCRIPTION +**podman pod prune** removes all stopped pods and their containers from local storage. + +## OPTIONS + +#### **--force**, **-f** +Force removal of all running pods and their containers. The default is false. + +## EXAMPLES + +Remove all stopped pods and their containers from local storage. +``` +$ sudo podman pod prune +22b8813332948064b6566370088c5e0230eeaf15a58b1c5646859fd9fc364fe7 +2afb26869fe5beab979c234afb75c7506063cd4655b1a73557c9d583ff1aebe9 +49161ad2a722cf18722f0e17199a9e840703a17d1158cdeda502b6d54080f674 +5ca429f37fb83a9f54eea89e3a9102b7780a6e6ae5f132db0672da551d862c4a +6bb06573787efb8b0675bc88ebf8361f1a56d3ac7922d1a6436d8f59ffd955f1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +April 2019, Originally compiled by Peter Hunt (pehunt at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-pod-ps.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-pod-ps.1.md new file mode 100644 index 000000000..40702f1e7 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-pod-ps.1.md @@ -0,0 +1,206 @@ +--- +title: podman-pod-ps +version: v5.4.1 +--- + +% podman-pod-ps 1 + +## NAME +podman\-pod\-ps - Print out information about pods + +## SYNOPSIS +**podman pod ps** [*options*] + +## DESCRIPTION +**podman pod ps** lists the pods on the system. +By default it lists: + + * pod ID + * pod name + * the time the pod was created + * number of containers attached to pod + * container ID of the pod infra container + * status of pod as defined by the following table + +| **Status** | **Description** | +| ------------ | ------------------------------------------------| +| Created | No containers running nor stopped | +| Running | at least one container is running | +| Stopped | At least one container stopped and none running | +| Exited | All containers stopped in pod | +| Dead | Error retrieving state | + + +## OPTIONS + +#### **--ctr-ids** + +Display the container IDs + +#### **--ctr-names** + +Display the container names + +#### **--ctr-status** + +Display the container statuses + +#### **--filter**, **-f**=*filter* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|------------|--------------------------------------------------------------------------------------------------| +| ctr-ids | Filter by container ID within the pod. (CID prefix match by default; accepts regex) | +| ctr-names | Filter by container name within the pod. | +| ctr-number | Filter by number of containers in the pod. | +| ctr-status | Filter by container status within the pod. | +| id | Filter by pod ID. (Prefix match by default; accepts regex) | +| label | Filter by container with (or without, in the case of label!=[...] is used) the specified labels. | +| name | Filter by pod name. | +| network | Filter by network name or full ID of network. | +| status | Filter by pod status. | +| until | Filter by pods created before given timestamp. | + +The `ctr-ids`, `ctr-names`, `id`, `name` filters accept `regex` format. + +The `ctr-status` filter accepts values: `created`, `running`, `paused`, `stopped`, `exited`, `unknown`. + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes containers with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes containers without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +The `status` filter accepts values: `stopped`, `running`, `paused`, `exited`, `dead`, `created`, `degraded`. + +#### **--format**=*format* + +Pretty-print containers to JSON or using a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|---------------------|------------------------------------------------------| +| .Cgroup | Cgroup path of pod | +| .ContainerIds | Comma-separated list of container IDs in the pod | +| .ContainerNames | Comma-separated list of container names in the pod | +| .ContainerStatuses | Comma-separated list of container statuses | +| .Created | Creation time of pod | +| .ID | Container ID | +| .InfraID | Pod infra container ID | +| .Label *string* | Specified label of the pod | +| .Labels ... | All the labels assigned to the pod | +| .Name | Name of pod | +| .Networks | Show all networks connected to the infra container | +| .NumberOfContainers | Show the number of containers attached to pod | +| .Restarts | Show the total number of container restarts in a pod | +| .Status | Status of pod | + +#### **--help**, **-h** + +Print usage statement + +#### **--latest**, **-l** + +Show the latest pod created (all states) (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +#### **--namespace**, **--ns** + +Display namespace information of the pod + +#### **--no-trunc** + +Do not truncate the output (default *false*). + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Print the numeric IDs of the pods only + +#### **--sort** + +Sort by created, ID, name, status, or number of containers + +Default: created + +## EXAMPLES + +List all running pods. +``` +$ podman pod ps +POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS +00dfd6fa02c0 jolly_goldstine Running 31 hours ago ba465ab0a3a4 1 +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a 2 +``` + +List all running pods along with container names within the pods. +``` +$ podman pod ps --ctr-names +POD ID NAME STATUS CREATED INFRA ID NAMES +00dfd6fa02c0 jolly_goldstine Running 31 hours ago ba465ab0a3a4 loving_archimedes +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a thirsty_hawking,wizardly_golick +``` + +List all running pods along with status, names and ids. +``` +$ podman pod ps --ctr-status --ctr-names --ctr-ids +POD ID NAME STATUS CREATED INFRA ID IDS NAMES STATUS +00dfd6fa02c0 jolly_goldstine Running 31 hours ago ba465ab0a3a4 ba465ab0a3a4 loving_archimedes running +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a 331693bff40a,8e428daeb89e thirsty_hawking,wizardly_golick configured,configured +``` + +List all running pods and print ID, Container Names, and cgroups. +``` +$ podman pod ps --format "{{.ID}} {{.ContainerNames}} {{.Cgroup}}" +00dfd6fa02c0 loving_archimedes /libpod_parent +f4df8692e116 thirsty_hawking,wizardly_golick /libpod_parent +``` + +List all running pods with two containers sorted by pod ID. +``` +$ podman pod ps --sort id --filter ctr-number=2 +POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a 2 +``` + +List all running pods with their container ids. +``` +$ podman pod ps --ctr-ids +POD ID NAME STATUS CREATED INFRA ID IDS +00dfd6fa02c0 jolly_goldstine Running 31 hours ago ba465ab0a3a4 ba465ab0a3a4 +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a 331693bff40a,8e428daeb89e +``` + +List all running pods with container ids without truncating IDs. +``` +$ podman pod ps --no-trunc --ctr-ids +POD ID NAME STATUS CREATED INFRA ID IDS +00dfd6fa02c0a2daaedfdf8fcecd06f22ad114d46d167d71777224735f701866 jolly_goldstine Running 31 hours ago ba465ab0a3a4e15e3539a1e79c32d1213a02b0989371e274f98e0f1ae9de7050 ba465ab0a3a4e15e3539a1e79c32d1213a02b0989371e274f98e0f1ae9de7050 +f4df8692e116a3e6d1d62572644ed36ca475d933808cc3c93435c45aa139314b nifty_torvalds Created 10 minutes ago 331693bff40a926b6d52b184e116afd15497610c378d5d4c42945dd6e33b75b0 331693bff40a926b6d52b184e116afd15497610c378d5d4c42945dd6e33b75b0,8e428daeb89e69b71e7916a13accfb87d122889442b5c05c2d99cf94a3230e9d +``` + +List all running pods with container names. +``` +$ podman pod ps --ctr-names +POD ID NAME STATUS CREATED INFRA ID NAMES +314f4da82d74 hi Created 17 hours ago a9f2d2165675 jovial_jackson,hopeful_archimedes,vibrant_ptolemy,heuristic_jennings,keen_raman,hopeful_newton,mystifying_bose,silly_lalande,serene_lichterman ... +``` + +## pod ps +Print a list of pods + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-pod-restart.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-pod-restart.1.md new file mode 100644 index 000000000..45a58f4f7 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-pod-restart.1.md @@ -0,0 +1,64 @@ +--- +title: podman-pod-restart +version: v5.4.1 +--- + +% podman-pod-restart 1 + +## NAME +podman\-pod\-restart - Restart one or more pods + +## SYNOPSIS +**podman pod restart** [*options*] *pod* ... + +## DESCRIPTION +Restart containers in one or more pods. Running containers are stopped and restarted. +Stopped containers are started. You may use pod IDs or names as input. +The pod ID is printed upon successful restart. +When restarting multiple pods, an error from restarting one pod does not effect restarting other pods. + +## OPTIONS + +#### **--all**, **-a** + +Restarts all pods + +#### **--latest**, **-l** + +Instead of providing the pod name or ID, restart the last created pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +## EXAMPLE + +Restart pod with a given name: +``` +podman pod restart mywebserverpod +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` + +Restart multiple pods with given IDs: +``` +podman pod restart 490eb 3557fb +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +``` + +Restart the last created pod: +``` +podman pod restart --latest +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +``` + +Restart all pods: +``` +podman pod restart --all +19456b4cd557eaf9629825113a552681a6013f8c8cad258e36ab825ef536e818 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +70c358daecf71ef9be8f62404f926080ca0133277ef7ce4f6aa2d5af6bb2d3e9 +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-restart(1)](podman-restart.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-pod-rm.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-pod-rm.1.md new file mode 100644 index 000000000..152c5fd16 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-pod-rm.1.md @@ -0,0 +1,109 @@ +--- +title: podman-pod-rm +version: v5.4.1 +--- + +% podman-pod-rm 1 + +## NAME +podman\-pod\-rm - Remove one or more stopped pods and containers + +## SYNOPSIS +**podman pod rm** [*options*] *pod* + +## DESCRIPTION +**podman pod rm** removes one or more stopped pods and their containers from the host. The pod name or ID can be used. The \-f option stops all containers and then removes them before removing the pod. If all containers added by the user are in an exited state, the pod is removed. + +## OPTIONS + +#### **--all**, **-a** + +Remove all pods. Can be used in conjunction with \-f as well. + +#### **--force**, **-f** + +Stop running containers and delete all stopped containers before removal of pod. + + +[//]: # (BEGIN included file options/ignore.md) +#### **--ignore**, **-i** + +Ignore errors when specified pods are not in the container store. A user +might have decided to manually remove a pod which leads to a failure +during the ExecStop directive of a systemd service referencing that pod. + +[//]: # (END included file options/ignore.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/pod-id-file.pod.md) +#### **--pod-id-file**=*file* + +Read pod ID from the specified *file* and rm the pod. Can be specified multiple times. + +[//]: # (END included file options/pod-id-file.pod.md) +If specified, the pod-id-file is removed along with the pod. + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping running containers within the pod. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +The --force option must be specified to use the --time option. + +## EXAMPLE + +Remove pod with a given name: +``` +podman pod rm mywebserverpod +``` + +Remove multiple pods with given names and/or IDs: +``` +podman pod rm mywebserverpod myflaskserverpod 860a4b23 +``` + +Forcefully remove pod with a given ID: +``` +podman pod rm -f 860a4b23 +``` + +Forcefully remove all pods: +``` +podman pod rm -f -a +podman pod rm -fa +``` + +Remove pod using ID specified in a given file: +``` +podman pod rm --pod-id-file /path/to/id/file +``` + +## Exit Status + **0** All specified pods removed + + **1** One of the specified pods did not exist, and no other failures + + **2** One of the specified pods is attached to a container + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-pod-start.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-pod-start.1.md new file mode 100644 index 000000000..4845487f2 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-pod-start.1.md @@ -0,0 +1,74 @@ +--- +title: podman-pod-start +version: v5.4.1 +--- + +% podman-pod-start 1 + +## NAME +podman\-pod\-start - Start one or more pods + +## SYNOPSIS +**podman pod start** [*options*] *pod* ... + +## DESCRIPTION +Start containers in one or more pods. You may use pod IDs or names as input. The pod must have a container attached +to be started. + +## OPTIONS + +#### **--all**, **-a** + +Starts all pods + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/pod-id-file.pod.md) +#### **--pod-id-file**=*file* + +Read pod ID from the specified *file* and start the pod. Can be specified multiple times. + +[//]: # (END included file options/pod-id-file.pod.md) + +## EXAMPLE + +Start pod with a given name: +``` +podman pod start mywebserverpod +``` + +Start pods with given IDs: +``` +podman pod start 860a4b23 5421ab4 +``` + +Start the latest pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman pod start --latest +``` + +Start all pods: +``` +podman pod start --all +``` + +Start pod using ID specified in a given file: +``` +podman pod start --pod-id-file /path/to/id/file +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-stop(1)](podman-pod-stop.1.md)** + +## HISTORY +July 2018, Adapted from podman start man page by Peter Hunt diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-pod-stats.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-pod-stats.1.md new file mode 100644 index 000000000..3e991a31b --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-pod-stats.1.md @@ -0,0 +1,116 @@ +--- +title: podman-pod-stats +version: v5.4.1 +--- + +% podman-pod-stats 1 + +## NAME +podman\-pod\-stats - Display a live stream of resource usage stats for containers in one or more pods + +## SYNOPSIS +**podman pod stats** [*options*] [*pod*] + +## DESCRIPTION +Display a live stream of containers in one or more pods resource usage statistics. Running rootless is only supported on cgroups v2. + +## OPTIONS + +#### **--all**, **-a** + +Show all containers. Only running containers are shown by default + +#### **--format**=*template* + +Pretty-print container statistics to JSON or using a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| --------------- | ------------------ | +| .BlockIO | Block IO | +| .CID | Container ID | +| .CPU | CPU percentage | +| .Mem | Memory percentage | +| .MemUsage | Memory usage | +| .MemUsageBytes | Memory usage (IEC) | +| .Name | Container Name | +| .NetIO | Network IO | +| .PIDS | Number of PIDs | +| .Pod | Pod ID | + +When using a Go template, precede the format with `table` to print headers. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/no-reset.md) +#### **--no-reset** + +Do not clear the terminal/screen in between reporting intervals + +[//]: # (END included file options/no-reset.md) + + +[//]: # (BEGIN included file options/no-stream.md) +#### **--no-stream** + +Disable streaming pod stats and only pull the first result, default setting is false + +[//]: # (END included file options/no-stream.md) + +## EXAMPLE + +List statistics about all pods without streaming: +``` +# podman pod stats -a --no-stream +ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS +a9f807ffaacd frosty_hodgkin -- 3.092MB / 16.7GB 0.02% -- / -- -- / -- 2 +3b33001239ee sleepy_stallman -- -- / -- -- -- / -- -- / -- -- +``` + +List statistics about specified pod without streaming: +``` +# podman pod stats --no-stream a9f80 +ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS +a9f807ffaacd frosty_hodgkin -- 3.092MB / 16.7GB 0.02% -- / -- -- / -- 2 +``` + +List statistics about specified pod in JSON format without streaming: +``` +# podman pod stats --no-stream --format=json a9f80 +[ + { + "id": "a9f807ffaacd", + "name": "frosty_hodgkin", + "cpu_percent": "--", + "mem_usage": "3.092MB / 16.7GB", + "mem_percent": "0.02%", + "netio": "-- / --", + "blocki": "-- / --", + "pids": "2" + } +] +``` + +List selected statistics formatted in a table about specified pod: +``` +# podman pod stats --no-stream --format "table {{.ID}} {{.Name}} {{.MemUsage}}" 6eae +ID NAME MEM USAGE / LIMIT +6eae9e25a564 clever_bassi 3.031MB / 16.7GB +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +February 2019, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-pod-stop.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-pod-stop.1.md new file mode 100644 index 000000000..5a20ea59a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-pod-stop.1.md @@ -0,0 +1,111 @@ +--- +title: podman-pod-stop +version: v5.4.1 +--- + +% podman-pod-stop 1 + +## NAME +podman\-pod\-stop - Stop one or more pods + +## SYNOPSIS +**podman pod stop** [*options*] *pod* ... + +## DESCRIPTION +Stop containers in one or more pods. You may use pod IDs or names as input. + +## OPTIONS + +#### **--all**, **-a** + +Stops all pods + + +[//]: # (BEGIN included file options/ignore.md) +#### **--ignore**, **-i** + +Ignore errors when specified pods are not in the container store. A user +might have decided to manually remove a pod which leads to a failure +during the ExecStop directive of a systemd service referencing that pod. + +[//]: # (END included file options/ignore.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/pod-id-file.pod.md) +#### **--pod-id-file**=*file* + +Read pod ID from the specified *file* and stop the pod. Can be specified multiple times. + +[//]: # (END included file options/pod-id-file.pod.md) + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping running containers within the pod. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +## EXAMPLE + +Stop pod with a given name. +``` +$ podman pod stop mywebserverpod +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` + +Stop multiple pods with given IDs. +``` +$ podman pod stop 490eb 3557fb +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +``` + +Stop the last created pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman pod stop --latest +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +``` + +Stop all pods. +``` +$ podman pod stop --all +19456b4cd557eaf9629825113a552681a6013f8c8cad258e36ab825ef536e818 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +70c358daecf71ef9be8f62404f926080ca0133277ef7ce4f6aa2d5af6bb2d3e9 +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` + +Stop two pods via --pod-id-file. +``` +$ podman pod stop --pod-id-file file1 --pod-id-file file2 +19456b4cd557eaf9629825113a552681a6013f8c8cad258e36ab825ef536e818 +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` + +Stop all pods with a timeout of 1 second. +``` +$ podman pod stop -a -t 1 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +70c358daecf71ef9be8f62404f926080ca0133277ef7ce4f6aa2d5af6bb2d3e9 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-start(1)](podman-pod-start.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-pod-top.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-pod-top.1.md new file mode 100644 index 000000000..ab490b241 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-pod-top.1.md @@ -0,0 +1,65 @@ +--- +title: podman-pod-top +version: v5.4.1 +--- + +% podman-pod-top 1 + +## NAME +podman\-pod\-top - Display the running processes of containers in a pod + +## SYNOPSIS +**podman pod top** [*options*] *pod* [*format-descriptors*] + +## DESCRIPTION +Display the running processes of containers in a pod. The *format-descriptors* are ps (1) compatible AIX format +descriptors but extended to print additional information, such as the seccomp mode or the effective capabilities +of a given process. The descriptors can either be passed as separate arguments or as a single comma-separated argument. + +## OPTIONS + +#### **--help**, **-h** + + Print usage statement + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## FORMAT DESCRIPTORS + +For a full list of available descriptors, see podman-top(1) + +## EXAMPLES + +Print top data for the specified pod. +By default, `podman-pod-top` prints data similar to `ps -ef`: +``` +$ podman pod top b031293491cc +USER PID PPID %CPU ELAPSED TTY TIME COMMAND +root 1 0 0.000 2h5m38.737137571s ? 0s top +root 8 0 0.000 2h5m15.737228361s ? 0s top +``` + +The output can be controlled by specifying format descriptors as arguments after the pod. + +Print the pod top data fields pid,seccomp, args and %C on the latest pod created. (This -l option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman pod top -l pid seccomp args %C +PID SECCOMP COMMAND %CPU +1 filter top 0.000 +1 filter /bin/sh 0.000 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **ps(1)**, **seccomp(2)**, **proc(5)**, **capabilities(7)** + +## HISTORY +August 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-pod-unpause.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-pod-unpause.1.md new file mode 100644 index 000000000..0ba391cad --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-pod-unpause.1.md @@ -0,0 +1,43 @@ +--- +title: podman-pod-unpause +version: v5.4.1 +--- + +% podman-pod-unpause 1 + +## NAME +podman\-pod\-unpause - Unpause one or more pods + +## SYNOPSIS +**podman pod unpause** [*options*] *pod* ... + +## DESCRIPTION +Unpauses all the paused processes in the containers of one or more pods. You may use pod IDs or names as input. + +## OPTIONS + +#### **--all**, **-a** + +Unpause all pods. + +#### **--latest**, **-l** + +Instead of providing the pod name or ID, unpause the last created pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +## EXAMPLE + +Unpause pod with a given name: +``` +podman pod unpause mywebserverpod +``` + +Unpause pod with a given ID: +``` +podman pod unpause 860a4b23 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-pause(1)](podman-pod-pause.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-pod.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-pod.1.md new file mode 100644 index 000000000..3f9edaab6 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-pod.1.md @@ -0,0 +1,42 @@ +--- +title: podman-pod +version: v5.4.1 +--- + +% podman-pod 1 + +## NAME +podman\-pod - Management tool for groups of containers, called pods + +## SYNOPSIS +**podman pod** *subcommand* + +## DESCRIPTION +podman pod is a set of subcommands that manage pods, or groups of containers. + +## SUBCOMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------- | --------------------------------------------------------------------------------- | +| clone | [podman-pod-clone(1)](podman-pod-clone.1.md) | Create a copy of an existing pod. | +| create | [podman-pod-create(1)](podman-pod-create.1.md) | Create a new pod. | +| exists | [podman-pod-exists(1)](podman-pod-exists.1.md) | Check if a pod exists in local storage. | +| inspect | [podman-pod-inspect(1)](podman-pod-inspect.1.md) | Display information describing a pod. | +| kill | [podman-pod-kill(1)](podman-pod-kill.1.md) | Kill the main process of each container in one or more pods. | +| logs | [podman-pod-logs(1)](podman-pod-logs.1.md) | Display logs for pod with one or more containers. | +| pause | [podman-pod-pause(1)](podman-pod-pause.1.md) | Pause one or more pods. | +| prune | [podman-pod-prune(1)](podman-pod-prune.1.md) | Remove all stopped pods and their containers. | +| ps | [podman-pod-ps(1)](podman-pod-ps.1.md) | Print out information about pods. | +| restart | [podman-pod-restart(1)](podman-pod-restart.1.md) | Restart one or more pods. | +| rm | [podman-pod-rm(1)](podman-pod-rm.1.md) | Remove one or more stopped pods and containers. | +| start | [podman-pod-start(1)](podman-pod-start.1.md) | Start one or more pods. | +| stats | [podman-pod-stats(1)](podman-pod-stats.1.md) | Display a live stream of resource usage stats for containers in one or more pods. | +| stop | [podman-pod-stop(1)](podman-pod-stop.1.md) | Stop one or more pods. | +| top | [podman-pod-top(1)](podman-pod-top.1.md) | Display the running processes of containers in a pod. | +| unpause | [podman-pod-unpause(1)](podman-pod-unpause.1.md) | Unpause one or more pods. | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-port.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-port.1.md new file mode 100644 index 000000000..76fb713da --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-port.1.md @@ -0,0 +1,71 @@ +--- +title: podman-port +version: v5.4.1 +--- + +% podman-port 1 + +## NAME +podman\-port - List port mappings for a container + +## SYNOPSIS +**podman port** [*options*] *container* [*private-port*[/*proto*]] + +**podman container port** [*options*] *container* [*private-port*[/*proto*]] + +## DESCRIPTION +List port mappings for the *container* or look up the public-facing port that is NAT-ed to the *private-port*. + +## OPTIONS + +#### **--all**, **-a** + +List all known port mappings for running containers; when using this option, container names or private ports/protocols filters cannot be used. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +List all port mappings: +``` +# podman port -a +b4d2f05432e482e017b1a4b2eae15fa7b4f6fb7e9f65c1bde46294fdef285906 +80/udp -> 0.0.0.0:44327 +80/tcp -> 0.0.0.0:44327 +# +``` + +List port mappings for a specific container: +``` +# podman port b4d2f054 +80/udp -> 0.0.0.0:44327 +80/tcp -> 0.0.0.0:44327 +# +``` +List the specified port mappings for a specific container: +``` +# podman port b4d2f054 80 + 0.0.0.0:44327 +# +``` + +List the port mappings for a specific container for port 80 and the tcp protocol: +``` +# podman port b4d2f054 80/tcp +0.0.0.0:44327 +# +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +January 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-ps.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-ps.1.md new file mode 100644 index 000000000..b296836a8 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-ps.1.md @@ -0,0 +1,228 @@ +--- +title: podman-ps +version: v5.4.1 +--- + +% podman-ps 1 + +## NAME +podman\-ps - Print out information about containers + +## SYNOPSIS +**podman ps** [*options*] + +**podman container ps** [*options*] + +**podman container list** [*options*] + +**podman container ls** [*options*] + +## DESCRIPTION +**podman ps** lists the running containers on the system. Use the **--all** flag to view +all the containers information. By default it lists: + + * container id + * the name of the image the container is using + * the COMMAND the container is executing + * the time the container was created + * the status of the container + * port mappings the container is using + * alternative names for the container + +## OPTIONS + +#### **--all**, **-a** + +Show all the containers, default is only running containers. + +Note: Podman shares containers storage with other tools such as Buildah and CRI-O. In some cases these `external` containers might also exist in the same storage. Use the `--external` option to see these external containers. External containers show the 'storage' status. + +#### **--external** + +Display external containers that are not controlled by Podman but are stored in containers storage. These external containers are generally created via other container technology such as Buildah or CRI-O and may depend on the same container images that Podman is also using. External containers are denoted with either a 'buildah' or 'storage' in the COMMAND and STATUS column of the ps output. + +#### **--filter**, **-f** + +Filter what containers are shown in the output. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| label! | [Key] or [Key=Value] Label NOT assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container (accepts regex) | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] container created before the given duration or time. | + + +#### **--format**=*format* + +Pretty-print containers to JSON or using a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|--------------------|----------------------------------------------| +| .AutoRemove | If true, containers are removed on exit | +| .CIDFile | Container ID File | +| .Command | Quoted command used | +| .Created ... | Creation time for container, Y-M-D H:M\:S | +| .CreatedAt | Creation time for container (same as above) | +| .CreatedHuman | Creation time, relative | +| .ExitCode | Container exit code | +| .Exited | "true" if container has exited | +| .ExitedAt | Time (epoch seconds) that container exited | +| .ExposedPorts ... | Map of exposed ports on this container | +| .ID | Container ID | +| .Image | Image Name/ID | +| .ImageID | Image ID | +| .IsInfra | "true" if infra container | +| .Label *string* | Specified label of the container | +| .Labels ... | All the labels assigned to the container | +| .Mounts | Volumes mounted in the container | +| .Names | Name of container | +| .Networks | Show all networks connected to the container | +| .Pid | Process ID on host system | +| .Pod | Pod the container is associated with (SHA) | +| .PodName | PodName of the container | +| .Ports | Forwarded and exposed ports | +| .Restarts | Display the container restart count | +| .RunningFor | Time elapsed since container was started | +| .Size | Size of container | +| .StartedAt | Time (epoch seconds) the container started | +| .State | Human-friendly description of ctr state | +| .Status | Status of container | + +#### **--help**, **-h** + +Print usage statement + +#### **--last**, **-n** + +Print the n last created containers (all states) + +#### **--latest**, **-l** + +Show the latest container created (all states) (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +#### **--namespace**, **--ns** + +Display namespace information + +#### **--no-trunc** + +Do not truncate the output (default *false*). + +#### **--noheading** + +Omit the table headings from the listing of containers. + +#### **--pod**, **-p** + +Display the pods the containers are associated with + +#### **--quiet**, **-q** + +Print the numeric IDs of the containers only + +#### **--size**, **-s** + +Display the total file size + +#### **--sort**=*created* + +Sort by command, created, id, image, names, runningfor, size, or status", +Note: Choosing size sorts by size of rootFs, not alphabetically like the rest of the options + +#### **--sync** + +Force a sync of container state with the OCI runtime. +In some cases, a container's state in the runtime can become out of sync with Podman's state. +This updates Podman's state based on what the OCI runtime reports. +Forcibly syncing is much slower, but can resolve inconsistent state issues. + +#### **--watch**, **-w** + +Refresh the output with current containers on an interval in seconds. + +## EXAMPLES + +List running containers. +``` +$ podman ps +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +4089df24d4f3 docker.io/library/centos:latest /bin/bash 2 minutes ago Up 2 minutes 0.0.0.0:80->8080/tcp, 0.0.0.0:2000-2006->2000-2006/tcp manyports +92f58933c28c docker.io/library/centos:latest /bin/bash 3 minutes ago Up 3 minutes 192.168.99.100:1000-1006->1000-1006/tcp zen_sanderson +``` + +List all containers. +``` +$ podman ps -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +02f65160e14ca redis:alpine "redis-server" 19 hours ago Exited (-1) 19 hours ago 6379/tcp k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0 +69ed779d8ef9f redis:alpine "redis-server" 25 hours ago Created 6379/tcp k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 +``` + +List all containers including their size. Note: this can take longer since Podman needs to calculate the size from the file system. +``` +$ podman ps -a -s +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES SIZE +02f65160e14ca redis:alpine "redis-server" 20 hours ago Exited (-1) 20 hours ago 6379/tcp k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0 27.49 MB +69ed779d8ef9f redis:alpine "redis-server" 25 hours ago Created 6379/tcp k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 27.49 MB +``` + +List all containers, running or not, using a custom Go format. +``` +$ podman ps -a --format "{{.ID}} {{.Image}} {{.Labels}} {{.Mounts}}" +02f65160e14ca redis:alpine tier=backend proc,tmpfs,devpts,shm,mqueue,sysfs,cgroup,/var/run/,/var/run/ +69ed779d8ef9f redis:alpine batch=no,type=small proc,tmpfs,devpts,shm,mqueue,sysfs,cgroup,/var/run/,/var/run/ +``` + +List all containers and display their namespaces. +``` +$ podman ps --ns -a +CONTAINER ID NAMES PID CGROUP IPC MNT NET PIDNS USER UTS +3557d882a82e3 k8s_container2_podsandbox1_redhat.test.crio_redhat-test-crio_1 29910 4026531835 4026532585 4026532593 4026532508 4026532595 4026531837 4026532594 +09564cdae0bec k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 29851 4026531835 4026532585 4026532590 4026532508 4026532592 4026531837 4026532591 +a31ebbee9cee7 k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0 29717 4026531835 4026532585 4026532587 4026532508 4026532589 4026531837 4026532588 +``` + +List all containers including size sorted by names. +``` +$ podman ps -a --size --sort names +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +69ed779d8ef9f redis:alpine "redis-server" 25 hours ago Created 6379/tcp k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 +02f65160e14ca redis:alpine "redis-server" 19 hours ago Exited (-1) 19 hours ago 6379/tcp k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0 +``` + +List all external containers created by tools other than Podman. +``` +$ podman ps --external -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +69ed779d8ef9f redis:alpine "redis-server" 25 hours ago Created 6379/tcp k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 +38a8a78596f9 docker.io/library/busybox:latest buildah 2 hours ago storage busybox-working-container +fd7b786b5c32 docker.io/library/alpine\:latest buildah 2 hours ago storage alpine-working-container +f78620804e00 scratch buildah 2 hours ago storage working-container +``` + +## ps +Print a list of containers + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **[crio(8)](https://github.com/cri-o/cri-o/blob/main/docs/crio.8.md)** + +## HISTORY +August 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-pull.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-pull.1.md new file mode 100644 index 000000000..8220acd45 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-pull.1.md @@ -0,0 +1,327 @@ +--- +title: podman-pull +version: v5.4.1 +--- + +% podman-pull 1 + +## NAME +podman\-pull - Pull an image from a registry + +## SYNOPSIS +**podman pull** [*options*] *source* [*source*...] + +**podman image pull** [*options*] *source* [*source*...] + +**podman pull** [*options*] [*transport*]*name*[:*tag*|@*digest*] + +**podman image pull** [*options*] [*transport*]*name*[:*tag*|@*digest*] + +## DESCRIPTION +podman pull copies an image from a registry onto the local machine. The command can pull one or more images. If the image reference in the command line argument does not contain a registry, it is referred to as a `short-name` reference. If the image is a 'short-name' reference, Podman prompts the user for the specific container registry to pull the image from, if an alias for the short-name has not been specified in the `short-name-aliases.conf`. If an image tag is not specified, **podman pull** defaults to the image with the **latest** tag (if it exists) and pulls it. After the image is pulled, podman prints the full image ID. **podman pull** can also pull images using a digest **podman pull** *image*@*digest* and can also be used to pull images from archives and local storage using different transports. +*IMPORTANT: Images are stored in local image storage.* + +## SOURCE +SOURCE is the location from which the container image is pulled from. It supports all transports from **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)**. If no transport is specified, the input is subject to short-name resolution and the `docker` (i.e., container registry) transport is used. For remote clients, including Mac and Windows (excluding WSL2) machines, `docker` is the only supported transport. + +``` +# Pull from a container registry +$ podman pull quay.io/username/myimage + +# Pull from a container registry with short-name resolution +$ podman pull fedora + +# Pull from a container registry via the docker transport +$ podman pull docker://quay.io/username/myimage + +# Pull from a local directory +$ podman pull dir:/tmp/myimage + +# Pull from a tarball in the docker-archive format +$ podman pull docker-archive:/tmp/myimage + +# Pull from a local docker daemon +$ sudo podman pull docker-daemon\:docker.io/library/myimage:33 + +# Pull from a tarball in the OCI-archive format +$ podman pull oci-archive:/tmp/myimage +``` + +## OPTIONS +#### **--all-tags**, **-a** + +All tagged images in the repository are pulled. + +*IMPORTANT: When using the all-tags flag, Podman does not iterate over the search registries in the **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** but always uses docker.io for unqualified image names.* + + +[//]: # (BEGIN included file options/arch.md) +#### **--arch**=*ARCH* +Override the architecture, defaults to hosts, of the image to be pulled. For example, `arm`. +Unless overridden, subsequent lookups of the same image in the local storage matches this architecture, regardless of the host. + +[//]: # (END included file options/arch.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + +#### **--help**, **-h** + +Print the usage statement. + + +[//]: # (BEGIN included file options/os.pull.md) +#### **--os**=*OS* + +Override the OS, defaults to hosts, of the image to be pulled. For example, `windows`. +Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. + +[//]: # (END included file options/os.pull.md) + + +[//]: # (BEGIN included file options/platform.md) +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with --arch and --os) +The `--platform` option can be used to override the current architecture and operating system. +Unless overridden, subsequent lookups of the same image in the local storage matches this platform, regardless of the host. + +[//]: # (END included file options/platform.md) + +#### **--quiet**, **-q** + +Suppress output information when pulling images + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/variant.container.md) +#### **--variant**=*VARIANT* + +Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. + +[//]: # (END included file options/variant.container.md) + +## FILES + +**short-name-aliases.conf** (`/var/cache/containers/short-name-aliases.conf`, `$HOME/.cache/containers/short-name-aliases.conf`) + +When users specify images that do not include the container registry where the +image is stored, this is called a short name. The use of unqualified-search registries entails an ambiguity as it is unclear from which registry a given image, referenced by a short name, may be pulled from. + +Using short names is subject to the risk of hitting squatted registry namespaces. If the unqualified-search registries are set to ["public-registry.com", "my-private-registry.com"] an attacker may take over a namespace of `public-registry.com` such that an image may be pulled from `public-registry.com` instead of the intended source `my-private-registry.com`. + +While it is highly recommended to always use fully-qualified image references, existing deployments using short names may not be easily changed. To circumvent the aforementioned ambiguity, so called short-name aliases can be configured that point to a fully-qualified image reference. Distributions often ship a default shortnames.conf expansion file in /etc/containers/registries.conf.d/ directory. Administrators can use this directory to add their own local short-name expansion files. + +When pulling an image, if the user does not specify the complete registry, container engines attempt to expand the short-name into a full name. If the command is executed with a tty, the user is prompted to select a registry from the +default list unqualified registries defined in registries.conf. The user's selection is then stored in a cache file to be used in all future short-name expansions. Rootful short-names are stored in /var/cache/containers/short-name-aliases.conf. Rootless short-names are stored in the $HOME/.cache/containers/short-name-aliases.conf file. + +For more information on short-names, see `containers-registries.conf(5)` + +**registries.conf** (`/etc/containers/registries.conf`) + +registries.conf is the configuration file which specifies which container registries is consulted when completing image names which do not include a registry or domain portion. + +NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + + +## EXAMPLES +Pull a single image with short name resolution. +``` +$ podman pull alpine:latest +Resolved "alpine" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf) +Trying to pull docker.io/library/alpine:latest... +Getting image source signatures +Copying blob 5843afab3874 done +Copying config d4ff818577 done +Writing manifest to image destination +Storing signatures +d4ff818577bc193b309b355b02ebc9220427090057b54a59e73b79bdfe139b83 +``` + +Pull multiple images with/without short name resolution. +``` +podman pull busybox:musl alpine quay.io/libpod/cirros +Trying to pull docker.io/library/busybox:musl... +Getting image source signatures +Copying blob 0c52b060233b [--------------------------------------] 0.0b / 0.0b +Copying config 9ad2c435a8 done +Writing manifest to image destination +Storing signatures +9ad2c435a887e3f723654e09b48563de44aa3c7950246b2e9305ec85dd3422db +Trying to pull docker.io/library/alpine:latest... +Getting image source signatures +Copying blob 5843afab3874 [--------------------------------------] 0.0b / 0.0b +Copying config d4ff818577 done +Writing manifest to image destination +Storing signatures +d4ff818577bc193b309b355b02ebc9220427090057b54a59e73b79bdfe139b83 +Trying to pull quay.io/libpod/cirros:latest... +Getting image source signatures +Copying blob 8da581cc9286 done +Copying blob 856628d95d17 done +Copying blob f513001ba4ab done +Copying config 3c82e4d066 done +Writing manifest to image destination +Storing signatures +3c82e4d066cf6f9e50efaead6e3ff7fddddf5527826afd68e5a969579fc4db4a +``` + +Pull an image using its digest. +``` +$ podman pull alpine@sha256:d7342993700f8cd7aba8496c2d0e57be0666e80b4c441925fc6f9361fa81d10e +Trying to pull docker.io/library/alpine@sha256:d7342993700f8cd7aba8496c2d0e57be0666e80b4c441925fc6f9361fa81d10e... +Getting image source signatures +Copying blob 188c0c94c7c5 done +Copying config d6e46aa247 done +Writing manifest to image destination +Storing signatures +d6e46aa2470df1d32034c6707c8041158b652f38d2a9ae3d7ad7e7532d22ebe0 +``` + +Pull an image by specifying an authentication file. +``` +$ podman pull --authfile temp-auths/myauths.json docker://docker.io/umohnani/finaltest +Trying to pull docker.io/umohnani/finaltest:latest...Getting image source signatures +Copying blob sha256:6d987f6f42797d81a318c40d442369ba3dc124883a0964d40b0c8f4f7561d913 + 1.90 MB / 1.90 MB [========================================================] 0s +Copying config sha256:ad4686094d8f0186ec8249fc4917b71faa2c1030d7b5a025c29f26e19d95c156 + 1.41 KB / 1.41 KB [========================================================] 0s +Writing manifest to image destination +Storing signatures +03290064078cb797f3e0a530e78c20c13dd22a3dd3adf84a5da2127b48df0438 +``` + +Pull an image by authenticating to a registry. +``` +$ podman pull --creds testuser:testpassword docker.io/umohnani/finaltest +Trying to pull docker.io/umohnani/finaltest:latest...Getting image source signatures +Copying blob sha256:6d987f6f42797d81a318c40d442369ba3dc124883a0964d40b0c8f4f7561d913 + 1.90 MB / 1.90 MB [========================================================] 0s +Copying config sha256:ad4686094d8f0186ec8249fc4917b71faa2c1030d7b5a025c29f26e19d95c156 + 1.41 KB / 1.41 KB [========================================================] 0s +Writing manifest to image destination +Storing signatures +03290064078cb797f3e0a530e78c20c13dd22a3dd3adf84a5da2127b48df0438 +``` + +Pull an image using tls verification. +``` +$ podman pull --tls-verify=false --cert-dir image/certs docker.io/umohnani/finaltest +Trying to pull docker.io/umohnani/finaltest:latest...Getting image source signatures +Copying blob sha256:6d987f6f42797d81a318c40d442369ba3dc124883a0964d40b0c8f4f7561d913 + 1.90 MB / 1.90 MB [========================================================] 0s +Copying config sha256:ad4686094d8f0186ec8249fc4917b71faa2c1030d7b5a025c29f26e19d95c156 + 1.41 KB / 1.41 KB [========================================================] 0s +Writing manifest to image destination +Storing signatures +03290064078cb797f3e0a530e78c20c13dd22a3dd3adf84a5da2127b48df0438 +``` + +Pull an image by overriding the host architecture. +``` +$ podman pull --arch=arm arm32v7/debian:stretch +Trying to pull docker.io/arm32v7/debian\:stretch... +Getting image source signatures +Copying blob b531ae4a3925 done +Copying config 3cba58dad5 done +Writing manifest to image destination +Storing signatures +3cba58dad5d9b35e755b48b634acb3fdd185ab1c996ac11510cc72c17780e13c +``` + +Pull an image with up to 6 retries, delaying 10 seconds between retries in quet mode. +``` +$ podman --remote pull -q --retry 6 --retry-delay 10s ubi9 +4d6addf62a90e392ff6d3f470259eb5667eab5b9a8e03d20b41d0ab910f92170 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-push(1)](podman-push.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-push.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-push.1.md new file mode 100644 index 000000000..9ee806a33 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-push.1.md @@ -0,0 +1,276 @@ +--- +title: podman-push +version: v5.4.1 +--- + +% podman-push 1 + +## NAME +podman\-push - Push an image, manifest list or image index from local storage to elsewhere + +## SYNOPSIS +**podman push** [*options*] *image* [*destination*] + +**podman image push** [*options*] *image* [*destination*] + +## DESCRIPTION +Pushes an image, manifest list or image index from local storage to a specified +destination. + +## Image storage +Images are pushed from those stored in local image storage. + +## DESTINATION + + DESTINATION is the location the container image is pushed to. It supports all transports from `containers-transports(5)`. If no transport is specified, the `docker` (i.e., container registry) transport is used. For remote clients, including Mac and Windows (excluding WSL2) machines, `docker` is the only supported transport. + +``` +# Push to a container registry +$ podman push quay.io/podman/stable + +# Push to a container registry via the docker transport +$ podman push docker://quay.io/podman/stable + +# Push to a container registry with another tag +$ podman push myimage quay.io/username/myimage + +# Push to a local directory +$ podman push myimage dir:/tmp/myimage + +# Push to a tarball in the docker-archive format +$ podman push myimage docker-archive:/tmp/myimage + +# Push to a local docker daemon +$ sudo podman push myimage docker-daemon\:docker.io/library/myimage:33 + +# Push to a tarball in the OCI format +$ podman push myimage oci-archive:/tmp/myimage +``` + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/dir-compress.md) +#### **--compress** + +Compress tarball image layers when pushing to a directory using the 'dir' transport. (default is same compression type, compressed or uncompressed, as source) + +[//]: # (END included file options/dir-compress.md) + +Note: This flag can only be set when using the **dir** transport + + +[//]: # (BEGIN included file options/compression-format.md) +#### **--compression-format**=**gzip** | *zstd* | *zstd:chunked* + +Specifies the compression format to use. Supported values are: `gzip`, `zstd` and `zstd:chunked`. The default is `gzip` unless overridden in the containers.conf file. +`zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning in that case. + +[//]: # (END included file options/compression-format.md) + + +[//]: # (BEGIN included file options/compression-level.md) +#### **--compression-level**=*level* + +Specifies the compression level to use. The value is specific to the compression algorithm used, e.g. for zstd the accepted values are in the range 1-20 (inclusive) with a default of 3, while for gzip it is 1-9 (inclusive) and has a default of 5. + +[//]: # (END included file options/compression-level.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/digestfile.md) +#### **--digestfile**=*Digestfile* + +After copying the image, write the digest of the resulting image to the file. + +[//]: # (END included file options/digestfile.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + +#### **--encrypt-layer**=*layer(s)* + +Layer(s) to encrypt: 0-indexed layer indices with support for negative indexing (e.g. 0 is the first layer, -1 is the last layer). If not defined, encrypts all layers if encryption-key flag is specified. + +#### **--encryption-key**=*key* + +The [protocol\:keyfile] specifies the encryption protocol, which can be JWE (RFC7516), PGP (RFC4880), and PKCS7 (RFC2315) and the key material required for image encryption. For instance, jwe:/path/to/key.pem or pgp\:admin@example.com or pkcs7:/path/to/x509-file. + + +[//]: # (BEGIN included file options/force-compression.md) +#### **--force-compression** + +If set, push uses the specified compression algorithm even if the destination contains a differently-compressed variant already. +Defaults to `true` if `--compression-format` is explicitly specified on the command-line, `false` otherwise. + +[//]: # (END included file options/force-compression.md) + +#### **--format**, **-f**=*format* + +Manifest Type (oci, v2s2, or v2s1) to use when pushing an image. + +#### **--quiet**, **-q** + +When writing the output image, suppress progress output + +#### **--remove-signatures** + +Discard any pre-existing signatures in the image. + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + +#### **--sign-by**=*key* + +Add a “simple signing” signature at the destination using the specified key. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-by-sigstore.md) +#### **--sign-by-sigstore**=*param-file* + +Add a sigstore signature based on further options specified in a container's sigstore signing parameter file *param-file*. +See containers-sigstore-signing-params.yaml(5) for details about the file format. + +[//]: # (END included file options/sign-by-sigstore.md) + +#### **--sign-by-sigstore-private-key**=*path* + +Add a sigstore signature at the destination using a private key at the specified path. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-passphrase-file.md) +#### **--sign-passphrase-file**=*path* + +If signing the image (using either **--sign-by** or **--sign-by-sigstore-private-key**), read the passphrase to use from the specified path. + +[//]: # (END included file options/sign-passphrase-file.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLE + +Push the specified image to a local directory: +``` +# podman push imageID dir:/path/to/image +``` + +Push the specified image to a local directory in OCI format: +``` +# podman push imageID oci-archive:/path/to/layout:image:tag +``` + +Push the specified image to a container registry: +``` +# podman push imageID docker://registry.example.com/repository:tag +``` + +Push the specified image to a container registry and save the digest in the specified file: +``` +# podman push --digestfile=/tmp/mydigest imageID docker://registry.example.com/repository:tag +``` + +Push the specified image into the local Docker daemon container store: +``` +# podman push imageID docker-daemon:image:tag +``` + +Push the specified image with a different image name using credentials from an alternate authfile path: +``` +# podman push --authfile temp-auths/myauths.json alpine docker://docker.io/umohnani/alpine +Getting image source signatures +Copying blob sha256:5bef08742407efd622d243692b79ba0055383bbce12900324f75e56f589aedb0 + 4.03 MB / 4.03 MB [========================================================] 1s +Copying config sha256:ad4686094d8f0186ec8249fc4917b71faa2c1030d7b5a025c29f26e19d95c156 + 1.41 KB / 1.41 KB [========================================================] 1s +Writing manifest to image destination +Storing signatures +``` + +Push the specified image to a local directory as an OCI image: +``` +# podman push --format oci registry.access.redhat.com/rhel7 dir\:rhel7-dir +Getting image source signatures +Copying blob sha256:9cadd93b16ff2a0c51ac967ea2abfadfac50cfa3af8b5bf983d89b8f8647f3e4 + 71.41 MB / 71.41 MB [======================================================] 9s +Copying blob sha256:4aa565ad8b7a87248163ce7dba1dd3894821aac97e846b932ff6b8ef9a8a508a + 1.21 KB / 1.21 KB [========================================================] 0s +Copying config sha256\:f1b09a81455c351eaa484b61aacd048ab613c08e4c5d1da80c4c46301b03cf3b + 3.01 KB / 3.01 KB [========================================================] 0s +Writing manifest to image destination +Storing signatures +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pull(1)](podman-pull.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-remote.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-remote.1.md new file mode 100644 index 000000000..ef3222294 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-remote.1.md @@ -0,0 +1,206 @@ +--- +title: podman-remote +version: v5.4.1 +--- + +% podman-remote 1 + +## NAME +podman-remote - A remote CLI for Podman: A Simple management tool for pods, containers and images. + +## SYNOPSIS +**podman-remote** [*options*] *command* + +## DESCRIPTION +Podman (Pod Manager) is a fully featured container engine that is a simple daemonless tool. +Podman provides a Docker-CLI comparable command line that eases the transition from other +container engines and allows the management of pods, containers and images. Simply put: `alias docker=podman`. +Most Podman commands can be run as a regular user, without requiring additional +privileges. + +Podman uses Buildah(1) internally to create container images. Both tools share image +(not container) storage, hence each can use or manipulate images (but not containers) +created by the other. + +Podman-remote provides a local client interacting with a Podman backend node through a RESTful API tunneled through a ssh connection. In this context, a Podman node is a Linux system with Podman installed on it and the API service activated. Credentials for this session can be passed in using flags, environment variables, or in `containers.conf`. + +The `containers.conf` file is placed under `$HOME/.config/containers/containers.conf` on Linux and Mac and `%APPDATA%\containers\containers.conf` on Windows. + +**podman [GLOBAL OPTIONS]** + +## GLOBAL OPTIONS + +#### **--connection**=*name*, **-c** + +Remote connection name + +Overrides environment variable `CONTAINER_CONNECTION` if set. + +#### **--help**, **-h** + +Print usage statement + +#### **--identity**=*path* + +Path to ssh identity file. If the identity file has been encrypted, Podman prompts the user for the passphrase. +If no identity file is provided and no user is given, Podman defaults to the user running the podman command. +Podman prompts for the login password on the remote server. + +Identity value resolution precedence: + - command line value + - environment variable `CONTAINER_SSHKEY`, if `CONTAINER_HOST` is found + - `containers.conf` + +#### **--log-level**=*level* + +Log messages above specified level: debug, info, warn, error (default), fatal or panic + +#### **--url**=*value* + +URL to access Podman service (default from `containers.conf`, rootless "unix:///run/user/$UID/podman/podman.sock" or as root "unix:///run/podman/podman.sock). + + - `CONTAINER_HOST` is of the format `://[]@][:][]` + - `CONTAINER_PROXY` is of the format `://[]@][:]` + +Details: + - `schema` is one of: + * `ssh` (default): a local unix(7) socket on the named `host` and `port`, reachable via SSH + * `tcp`: an unencrypted, unauthenticated TCP connection to the named `host` and `port`, can work with proxy if `CONTAINER_PROXY` is set + * `unix`: a local unix(7) socket at the specified `path`, or the default for the user + - `user` defaults to either `root` or the current running user (`ssh` only) + - `password` has no default (`ssh` only) + - `host` must be provided and is either the IP or name of the machine hosting the Podman service (`ssh` and `tcp`) + - `port` defaults to 22 (`ssh` and `tcp`) + - `path` defaults to either `/run/podman/podman.sock`, or `/run/user/$UID/podman/podman.sock` if running rootless (`unix`), or must be explicitly specified (`ssh`) + - `CONTAINER_PROXY`: use proxy (`socks5` or `socks5h`) to access Podman service (`tcp` only) + +URL value resolution precedence: + - command line value + - environment variable `CONTAINER_HOST` + - `engine.service_destinations` table in containers.conf, excluding the /usr/share/containers directory + - `unix:///run/podman/podman.sock` + +Remote connections use local containers.conf for default. + +Some example URL values in valid formats: + - unix:///run/podman/podman.sock + - unix:///run/user/$UID/podman/podman.sock + - ssh://notroot@localhost:22/run/user/$UID/podman/podman.sock + - ssh://root@localhost:22/run/podman/podman.sock + - tcp://localhost:34451 + - tcp://127.0.0.1:34451 + +#### **--version** + +Print the version + +## Environment Variables + +Podman can set up environment variables from env of [engine] table in containers.conf. These variables can be overridden by passing environment variables before the `podman` commands. + +#### **CONTAINERS_CONF** + +Set default locations of containers.conf file + +#### **CONTAINER_CONNECTION** + +Set default `--connection` value to access Podman service. + +#### **CONTAINER_HOST** + +Set default `--url` value to access Podman service. + +#### **CONTAINER_SSHKEY** + +Set default `--identity` path to ssh key file value used to access Podman service. + +## Exit Status + +The exit code from `podman` gives information about why the container +failed to run or why it exited. When `podman` commands exit with a non-zero code, +the exit codes follow the `chroot` standard, see below: + + **125** The error is with podman itself + + $ podman run --foo busybox; echo $? + Error: unknown flag: --foo + 125 + + **126** Executing a _contained command_ and the _command_ cannot be invoked + + $ podman run busybox /etc; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error + 126 + + **127** Executing a _contained command_ and the _command_ cannot be found + $ podman run busybox foo; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error + 127 + + **Exit code** _contained command_ exit code + + $ podman run busybox /bin/sh -c 'exit 3'; echo $? + 3 + + +## COMMANDS + +| Command | Description | +| ------------------------------------------------ | --------------------------------------------------------------------------- | +| [podman-attach(1)](podman-attach.1.md) | Attach to a running container. | +| [podman-build(1)](podman-build.1.md) | Build a container image using a Dockerfile. | +| [podman-commit(1)](podman-commit.1.md) | Create new image based on the changed container. | +| [podman-container(1)](podman-container.1.md) | Manage containers. | +| [podman-cp(1)](podman-cp.1.md) | Copy files/folders between a container and the local filesystem. | +| [podman-create(1)](podman-create.1.md) | Create a new container. | +| [podman-diff(1)](podman-diff.1.md) | Inspect changes on a container or image's filesystem. | +| [podman-events(1)](podman-events.1.md) | Monitor Podman events | +| [podman-export(1)](podman-export.1.md) | Export a container's filesystem contents as a tar archive. | +| [podman-generate(1)](podman-generate.1.md) | Generate structured data based on containers and pods. | +| [podman-healthcheck(1)](podman-healthcheck.1.md) | Manage healthchecks for containers | +| [podman-history(1)](podman-history.1.md) | Show the history of an image. | +| [podman-image(1)](podman-image.1.md) | Manage images. | +| [podman-images(1)](podman-images.1.md) | List images in local storage. | +| [podman-import(1)](podman-import.1.md) | Import a tarball and save it as a filesystem image. | +| [podman-info(1)](podman-info.1.md) | Display Podman related system information. | +| [podman-init(1)](podman-init.1.md) | Initialize a container | +| [podman-inspect(1)](podman-inspect.1.md) | Display a container or image's configuration. | +| [podman-kill(1)](podman-kill.1.md) | Kill the main process in one or more containers. | +| [podman-load(1)](podman-load.1.md) | Load an image from a container image archive into container storage. | +| [podman-logs(1)](podman-logs.1.md) | Display the logs of a container. | +| [podman-pause(1)](podman-pause.1.md) | Pause one or more containers. | +| [podman-pod(1)](podman-pod.1.md) | Management tool for groups of containers, called pods. | +| [podman-port(1)](podman-port.1.md) | List port mappings for a container. | +| [podman-ps(1)](podman-ps.1.md) | Print out information about containers. | +| [podman-pull(1)](podman-pull.1.md) | Pull an image from a registry. | +| [podman-push(1)](podman-push.1.md) | Push an image from local storage to elsewhere. | +| [podman-restart(1)](podman-restart.1.md) | Restart one or more containers. | +| [podman-rm(1)](podman-rm.1.md) | Remove one or more containers. | +| [podman-rmi(1)](podman-rmi.1.md) | Remove one or more locally stored images. | +| [podman-run(1)](podman-run.1.md) | Run a command in a new container. | +| [podman-save(1)](podman-save.1.md) | Save an image to a container archive. | +| [podman-start(1)](podman-start.1.md) | Start one or more containers. | +| [podman-stop(1)](podman-stop.1.md) | Stop one or more running containers. | +| [podman-system(1)](podman-system.1.md) | Manage podman. | +| [podman-tag(1)](podman-tag.1.md) | Add an additional name to a local image. | +| [podman-top(1)](podman-top.1.md) | Display the running processes of a container. | +| [podman-unpause(1)](podman-unpause.1.md) | Unpause one or more containers. | +| [podman-version(1)](podman-version.1.md) | Display the Podman version information. | +| [podman-volume(1)](podman-volume.1.md) | Manage Volumes. | +## FILES + +**containers.conf** (`$HOME/.config/containers/containers.conf`) + +Podman has builtin defaults for command line options. These defaults can be overridden using the containers.conf configuration files. + +Users can modify defaults by creating the `$HOME/.config/containers/containers.conf` file. Podman merges its builtin defaults with the specified fields from this file, if it exists. Fields specified in the users file override the built-in defaults. + +Podman uses builtin defaults if no containers.conf file is found. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system-service(1)](podman-system-service.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-rename.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-rename.1.md new file mode 100644 index 000000000..2a639535f --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-rename.1.md @@ -0,0 +1,43 @@ +--- +title: podman-rename +version: v5.4.1 +--- + +% podman-rename 1 + +## NAME +podman\-rename - Rename an existing container + +## SYNOPSIS +**podman rename** *container* *newname* + +**podman container rename** *container* *newname* + +## DESCRIPTION +Rename changes the name of an existing container. +The old name is freed, and is available for use. +This command can be run on containers in any state. +However, running containers may not fully receive the effects until they are restarted - for example, a running container may still use the old name in its logs. +At present, only containers are supported; pods and volumes cannot be renamed. + +## OPTIONS + +## EXAMPLES + +Rename container with a given name. +``` +$ podman rename oldContainer aNewName +``` + +Rename container with a given ID. +``` +$ podman rename 717716c00a6b testcontainer +``` + +Create an alias for container with a given ID. +``` +$ podman container rename 6e7514b47180 databaseCtr +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-restart.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-restart.1.md new file mode 100644 index 000000000..ed661016e --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-restart.1.md @@ -0,0 +1,120 @@ +--- +title: podman-restart +version: v5.4.1 +--- + +% podman-restart 1 + +## NAME +podman\-restart - Restart one or more containers + +## SYNOPSIS +**podman restart** [*options*] *container* ... + +**podman container restart** [*options*] *container* ... + +## DESCRIPTION +The restart command allows containers to be restarted using their ID or name. +Running containers are stopped and restarted. Stopped containers are started. + +## OPTIONS + +#### **--all**, **-a** + +Restart all containers regardless of their current state. + +#### **--cidfile** + +Read container ID from the specified file and restart the container. Can be specified multiple times. + +#### **--filter**, **-f**=*filter* + +Filter what containers restart. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--running** + +Restart all containers that are already in the *running* state. + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping the container. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +## EXAMPLES + +Restart the latest container. +``` +$ podman restart -l +ec588fc80b05e19d3006bf2e8aa325f0a2e2ff1f609b7afb39176ca8e3e13467 +``` + +Restart a specific container by partial container ID. +``` +$ podman restart ff6cf1 +ff6cf1e5e77e6dba1efc7f3fcdb20e8b89ad8947bc0518be1fcb2c78681f226f +``` + +Restart two containers by name with a timeout of 4 seconds. +``` +$ podman restart --time 4 test1 test2 +c3bb026838c30e5097f079fa365c9a4769d52e1017588278fa00d5c68ebc1502 +17e13a63081a995136f907024bcfe50ff532917988a152da229db9d894c5a9ec +``` + +Restart all running containers. +``` +$ podman restart --running +``` + +Restart all containers. +``` +$ podman restart --all +``` + +Restart container using ID specified in a given files. +``` +$ podman restart --cidfile /home/user/cidfile-1 +$ podman restart --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +March 2018, Originally compiled by Matt Heon diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-rm.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-rm.1.md new file mode 100644 index 000000000..99add550c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-rm.1.md @@ -0,0 +1,162 @@ +--- +title: podman-rm +version: v5.4.1 +--- + +% podman-rm 1 + +## NAME +podman\-rm - Remove one or more containers + +## SYNOPSIS +**podman rm** [*options*] *container* + +**podman container rm** [*options*] *container* + +## DESCRIPTION +**podman rm** removes one or more containers from the host. The container name or ID can be used. This does not remove images. +Running or unusable containers are not removed without the **-f** option. + +## OPTIONS + +#### **--all**, **-a** + +Remove all containers. Can be used in conjunction with **-f** as well. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and rm the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + +Command does not fail when *file* is missing and user specified --ignore. + +#### **--depend** + +Remove selected container and recursively remove all containers that depend on it. + +#### **--filter**=*filter* + +Filter what containers remove. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | + +#### **--force**, **-f** + +Force the removal of running and paused containers. Forcing a container removal also +removes containers from container storage even if the container is not known to Podman. +For example, containers that are created by different container engines like Buildah. +In addition, forcing can be used to remove unusable containers, e.g. containers +whose OCI runtime has become unavailable. + + +[//]: # (BEGIN included file options/ignore.md) +#### **--ignore**, **-i** + +Ignore errors when specified containers are not in the container store. A user +might have decided to manually remove a container which leads to a failure +during the ExecStop directive of a systemd service referencing that container. + +[//]: # (END included file options/ignore.md) +Further ignore when the specified `--cidfile` does not exist as it may have +already been removed along with the container. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping the container. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +The --force option must be specified to use the --time option. + +#### **--volumes**, **-v** + +Remove anonymous volumes associated with the container. This does not include named volumes +created with **podman volume create**, or the **--volume** option of **podman run** and **podman create**. + +## EXAMPLE +Remove container with a given name: +``` +$ podman rm mywebserver +``` + +Remove container with a given name and all of the containers that depend on it: +``` +$ podman rm --depend mywebserver +``` + +Remove multiple containers with given names or IDs: +``` +$ podman rm mywebserver myflaskserver 860a4b23 +``` + +Remove multiple containers with IDs read from files: +``` +$ podman rm --cidfile ./cidfile-1 --cidfile /home/user/cidfile-2 +``` + +Forcibly remove container with a given ID: +``` +$ podman rm -f 860a4b23 +``` + +Remove all containers regardless of the run state: +``` +$ podman rm -f -a +``` + +Forcibly remove the last created container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +$ podman rm -f --latest +``` + +## Exit Status + **0** All specified containers removed + + **1** One of the specified containers did not exist, and no other failures + + **2** One of the specified containers is paused or running + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +August 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-rmi.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-rmi.1.md new file mode 100644 index 000000000..da8ac6d71 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-rmi.1.md @@ -0,0 +1,81 @@ +--- +title: podman-rmi +version: v5.4.1 +--- + +% podman-rmi 1 + +## NAME +podman\-rmi - Remove one or more locally stored images + +## SYNOPSIS +**podman rmi** [*options*] *image* [...] + +**podman image rm** [*options*] *image* [...] + +## DESCRIPTION +Removes one or more locally stored images. +Passing an argument _image_ deletes it, along with any of its dangling parent images. A dangling image is an image without a tag and without being referenced by another image. + +Note: To delete an image from a remote registry, use the [**skopeo delete**](https://github.com/containers/skopeo/blob/main/docs/skopeo-delete.1.md) command. Some registries do not allow users to delete an image via a CLI remotely. + +## OPTIONS + +#### **--all**, **-a** + +Remove all images in the local storage. + +#### **--force**, **-f** + +This option causes Podman to remove all containers that are using the image before removing the image from the system. + +#### **--ignore**, **-i** + +If a specified image does not exist in the local storage, ignore it and do not throw an error. + +#### **--no-prune** + +This option does not remove dangling parents of the specified image. + +Remove an image by its short ID +``` +$ podman rmi c0ed59d05ff7 +``` +Remove an image and its associated containers. +``` +$ podman rmi --force imageID +``` + +Remove multiple images by their shortened IDs. +``` +$ podman rmi c4dfb1609ee2 93fd78260bd1 c0ed59d05ff7 +``` + +Remove all images and containers. +``` +$ podman rmi -a -f +``` + +Remove an absent image with and without the `--ignore` flag. +``` +$ podman rmi --ignore nothing +$ podman rmi nothing +Error: nothing: image not known + +``` + + +## Exit Status + **0** All specified images removed + + **1** One of the specified images did not exist, and no other failures + + **2** One of the specified images has child images or is being used by a container + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[skopeo-delete(1)](https://github.com/containers/skopeo/blob/main/docs/skopeo-delete.1.md)** + +## HISTORY +March 2017, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-rootless.7.md b/versioned_docs/version-5.4.1/source/markdown/podman-rootless.7.md new file mode 100644 index 000000000..2c9d62ed0 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-rootless.7.md @@ -0,0 +1,54 @@ +--- +title: Shortcomings of Rootless Podman +version: v5.4.1 +--- + +% podman-rootless 7 + +# Shortcomings of Rootless Podman + +The following list categorizes the known issues and irregularities with running Podman as a non-root user. Although currently functional, there is still a number of work items that are under consideration to be added. These proposed changes are in varying degrees of design and development. + +Contributors are more than welcomed to help with this work. If you decide to carve off a piece and work on it, please create an issue in [GitHub](https://github.com/containers/podman/issues), and assign it to yourself. If you find other unexpected behavior with rootless Podman and feel it’s warranted, please feel free to update this document. + +* Podman can not create containers that bind to ports < 1024. + * The kernel does not allow processes without CAP_NET_BIND_SERVICE to bind to low ports. + * You can modify the `net.ipv4.ip_unprivileged_port_start` sysctl to change the lowest port. For example `sysctl net.ipv4.ip_unprivileged_port_start=443` allows rootless Podman containers to bind to ports >= 443. + * A proxy server, kernel firewall rule, or redirection tool such as [redir](https://github.com/troglobit/redir) may be used to redirect traffic from a privileged port to an unprivileged one (where a podman pod is bound) in a server scenario - where a user has access to the root account (or setuid on the binary would be an acceptable risk), but wants to run the containers as an unprivileged user for enhanced security and for a limited number of pre-known ports. +* As of Podman 5.0, pasta is the default networking tool. Since pasta copies the IP address of the main interface, connections to that IP from containers do not work. This means that unless you have more than one interface, inter-container connections cannot be made without explicitly passing a pasta network configuration, either in `containers.conf` or at runtime. + * If you previously had port forwards (ex. via -p 80:80) that other containers could access, you can either revert back to slirp4netns or use the solution (setting pasta options with 10.0.2.x IPs) posted [here](https://blog.podman.io/2024/03/podman-5-0-breaking-changes-in-detail/). +* “How To” documentation is patchy at best. +* If /etc/subuid and /etc/subgid are not set up for a user, then podman commands +can easily fail + * This can be a big issue on machines using Network Based Password information (FreeIPA, Active Directory, LDAP) + * We are working to get support for NSSWITCH on the /etc/subuid and /etc/subgid files. +* No cgroup V1 Support + * cgroup V1 does not safely support cgroup delegation. + * As of Fedora 31 defaults to cgroup V2, which has full support of rootless cgroup management. Note this requires the --cgroup-manager within rootless containers to use systemd, which new containers will get by default. +* Some system unit configuration options do not work in the rootless container + * systemd fails to apply several options and failures are silently ignored (e.g. CPUShares, MemoryLimit). Should work on cgroup V2. + * Use of certain options will cause service startup failures (e.g. PrivateNetwork). The systemd services requiring `PrivateNetwork` can be made to work by passing `--cap-add SYS_ADMIN`, but the security implications should be carefully evaluated. In most cases, it's better to create an override.conf drop-in that sets `PrivateNetwork=no`. This also applies to containers run by root. +* Can not share container images with CRI-O or other rootful users +* Difficult to use additional stores for sharing content +* Does not work on NFS or parallel filesystem homedirs (e.g. [GPFS](https://www.ibm.com/support/knowledgecenter/en/SSFKCN/gpfs_welcome.html)) + * NFS and parallel filesystems enforce file creation on different UIDs on the server side and does not understand User Namespace. + * When a container root process like YUM attempts to create a file owned by a different UID, NFS Server/GPFS denies the creation. +* Does not work with homedirs mounted with noexec/nodev + * User can set up storage to point to other directories they can write to that are not mounted noexec/nodev +* Support for using native overlayfs as an unprivileged user is only available for Podman version >= 3.1 on a Linux kernel version >= 5.12, otherwise the slower _fuse-overlayfs_ may be used. + * A few Linux distributions (e.g. Ubuntu) have supported even older Podman and Linux kernel versions by modifying the normal Linux kernel behaviour. +* Only other supported driver is VFS. +* Cannot use ping out of the box. + * [(Can be fixed by setting sysctl on host)](https://github.com/containers/podman/blob/main/troubleshooting.md#5-rootless-containers-cannot-ping-hosts) +* Requires new shadow-utils (not found in older (RHEL7/Centos7 distros) Should be fixed in RHEL7.7 release) +* A few commands do not work. + * mount/unmount (on fuse-overlay) + * Only works if you enter the mount namespace with podman unshare + * podman stats (Works with cgroup V2 support) + * Checkpoint and Restore (CRIU requires root) + * Pause and Unpause (Works with cgroup V2 support) +* Issues with higher UIDs can cause builds to fail + * If a build is attempting to use a UID that is not mapped into the user namespace mapping for a container, then builds will not be able to put the UID in an image. +* Making device nodes within a container fails, even when running --privileged. + * The kernel does not allow non root user processes (processes without CAP_MKNOD) to create device nodes. If a container needs to create device nodes, it must be run as root. +* When using --net=host with rootless containers, subsequent podman execs to that container will not join the host network namespace because it is owned by root. diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-run.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-run.1.md new file mode 100644 index 000000000..d5cd0e4d5 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-run.1.md @@ -0,0 +1,3258 @@ +--- +title: podman-run +version: v5.4.1 +--- + +% podman-run 1 + +## NAME +podman\-run - Run a command in a new container + +## SYNOPSIS +**podman run** [*options*] *image* [*command* [*arg* ...]] + +**podman container run** [*options*] *image* [*command* [*arg* ...]] + +## DESCRIPTION + +Run a process in a new container. **podman run** starts a process with its own +file system, its own networking, and its own isolated process tree. The _image_ +which starts the process may define defaults related to the process that will be +run in the container, the networking to expose, and more, but **podman run** +gives final control to the operator or administrator who starts the container +from the image. For that reason **podman run** has more options than any other +Podman command. + +If the _image_ is not already loaded then **podman run** will pull the _image_, and +all image dependencies, from the repository in the same way running **podman +pull** _image_, before it starts the container from that image. + +Several files will be automatically created within the container. These include +_/etc/hosts_, _/etc/hostname_, and _/etc/resolv.conf_ to manage networking. +These will be based on the host's version of the files, though they can be +customized with options (for example, **--dns** will override the host's DNS +servers in the created _resolv.conf_). Additionally, a container environment +file is created in each container to indicate to programs they are running in a +container. This file is located at _/run/.containerenv_ (or +_/var/run/.containerenv_ for FreeBSD containers). When using the +--privileged flag the .containerenv contains name/value pairs indicating the +container engine version, whether the engine is running in rootless mode, the +container name and ID, as well as the image name and ID that the container is based on. Note: _/run/.containerenv_ will not be created when a volume is mounted on /run. + +When running from a user defined network namespace, the _/etc/netns/NSNAME/resolv.conf_ +will be used if it exists, otherwise _/etc/resolv.conf_ will be used. + +Default settings are defined in `containers.conf`. Most settings for remote +connections use the servers containers.conf, except when documented in man +pages. + +## IMAGE + + The image is specified using transport\:path format. If no transport is specified, the `docker` (container registry) +transport is used by default. For remote Podman, including Mac and Windows (excluding WSL2) machines, `docker` is the only allowed transport. + + **dir:**_path_ + An existing local directory _path_ storing the manifest, layer tarballs and signatures as individual files. This +is a non-standardized format, primarily useful for debugging or noninvasive container inspection. + + $ podman save --format docker-dir fedora -o /tmp/fedora + $ podman run dir:/tmp/fedora echo hello + + **docker://**_docker-reference_ (Default) + An image reference stored in a remote container image registry. Example: "quay.io/podman/stable:latest". +The reference can include a path to a specific registry; if it does not, the +registries listed in registries.conf are queried to find a matching image. +By default, credentials from `podman login` (stored at +$XDG_RUNTIME_DIR/containers/auth.json by default) are used to authenticate; +otherwise it falls back to using credentials in $HOME/.docker/config.json. + + $ podman run registry.fedoraproject.org/fedora\:latest echo hello + + **docker-archive:**_path_[**:**_docker-reference_] +An image stored in the `docker save` formatted file. _docker-reference_ is only used when creating such a +file, and it must not contain a digest. + + $ podman save --format docker-archive fedora -o /tmp/fedora + $ podman run docker-archive:/tmp/fedora echo hello + + **docker-daemon:**_docker-reference_ + An image in _docker-reference_ format stored in the docker daemon internal storage. The _docker-reference_ can also be an image ID (docker-daemon\:algo\:digest). + + $ sudo docker pull fedora + $ sudo podman run docker-daemon\:docker.io/library/fedora echo hello + + **oci-archive:**_path_**:**_tag_ + An image in a directory compliant with the "Open Container Image Layout Specification" at the specified _path_ +and specified with a _tag_. + + $ podman save --format oci-archive fedora -o /tmp/fedora + $ podman run oci-archive:/tmp/fedora echo hello + +## OPTIONS + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the container's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + + +[//]: # (BEGIN included file options/annotation.container.md) +#### **--annotation**=*key=value* + +Add an annotation to the container. This option can be set multiple times. + +[//]: # (END included file options/annotation.container.md) + + +[//]: # (BEGIN included file options/arch.md) +#### **--arch**=*ARCH* +Override the architecture, defaults to hosts, of the image to be pulled. For example, `arm`. +Unless overridden, subsequent lookups of the same image in the local storage matches this architecture, regardless of the host. + +[//]: # (END included file options/arch.md) + + +[//]: # (BEGIN included file options/attach.md) +#### **--attach**, **-a**=*stdin* | *stdout* | *stderr* + +Attach to STDIN, STDOUT or STDERR. + +In foreground mode (the default when **-d** +is not specified), **podman run** can start the process in the container +and attach the console to the process's standard input, output, and +error. It can even pretend to be a TTY (this is what most command-line +executables expect) and pass along signals. The **-a** option can be set for +each of **stdin**, **stdout**, and **stderr**. + +[//]: # (END included file options/attach.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cap-add.md) +#### **--cap-add**=*capability* + +Add Linux capabilities. + +[//]: # (END included file options/cap-add.md) + + +[//]: # (BEGIN included file options/cap-drop.md) +#### **--cap-drop**=*capability* + +Drop Linux capabilities. + +[//]: # (END included file options/cap-drop.md) + + +[//]: # (BEGIN included file options/cgroup-conf.md) +#### **--cgroup-conf**=*KEY=VALUE* + +When running on cgroup v2, specify the cgroup file to write to and its value. For example **--cgroup-conf=memory.high=1073741824** sets the memory.high limit to 1GB. + +[//]: # (END included file options/cgroup-conf.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the container is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cgroupns.md) +#### **--cgroupns**=*mode* + +Set the cgroup namespace mode for the container. + +- **host**: use the host's cgroup namespace inside the container. +- **container:**_id_: join the namespace of the specified container. +- **private**: create a new cgroup namespace. +- **ns:**_path_: join the namespace at the specified path. + +If the host uses cgroups v1, the default is set to **host**. On cgroups v2, the default is **private**. + +[//]: # (END included file options/cgroupns.md) + + +[//]: # (BEGIN included file options/cgroups.md) +#### **--cgroups**=*how* + +Determines whether the container creates CGroups. + +Default is **enabled**. + +The **enabled** option creates a new cgroup under the cgroup-parent. +The **disabled** option forces the container to not create CGroups, and thus conflicts with CGroup options (**--cgroupns** and **--cgroup-parent**). +The **no-conmon** option disables a new CGroup only for the **conmon** process. +The **split** option splits the current CGroup in two sub-cgroups: one for conmon and one for the container payload. It is not possible to set **--cgroup-parent** with **split**. + +[//]: # (END included file options/cgroups.md) + + +[//]: # (BEGIN included file options/chrootdirs.md) +#### **--chrootdirs**=*path* + +Path to a directory inside the container that is treated as a `chroot` directory. +Any Podman managed file (e.g., /etc/resolv.conf, /etc/hosts, etc/hostname) that is mounted into the root directory is mounted into that location as well. +Multiple directories are separated with a comma. + +[//]: # (END included file options/chrootdirs.md) + + +[//]: # (BEGIN included file options/cidfile.write.md) +#### **--cidfile**=*file* + +Write the container ID to *file*. The file is removed along with the container, except +when used with podman --remote run on detached containers. + +[//]: # (END included file options/cidfile.write.md) + + +[//]: # (BEGIN included file options/conmon-pidfile.md) +#### **--conmon-pidfile**=*file* + +Write the pid of the **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to restart Podman containers. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/conmon-pidfile.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-rt-period.md) +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-period.md) + + +[//]: # (BEGIN included file options/cpu-rt-runtime.md) +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-runtime.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpus.container.md) +#### **--cpus**=*number* + +Number of CPUs. The default is *0.0* which means no limit. This is shorthand +for **--cpu-period** and **--cpu-quota**, therefore the option cannot be specified with +**--cpu-period** or **--cpu-quota**. + +On some systems, changing the CPU limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpus.container.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + +#### **--detach**, **-d** + +Detached mode: run the container in the background and print the new container ID. The default is *false*. + +At any time run **podman ps** in +the other shell to view a list of the running containers. Reattach to a +detached container with **podman attach** command. + +When attached via tty mode, detach from the container (and leave it +running) using a configurable key sequence. The default sequence is `ctrl-p,ctrl-q`. +Specify the key sequence using the **--detach-keys** option, or configure +it in the **containers.conf** file: see **containers.conf(5)** for more information. + + +[//]: # (BEGIN included file options/detach-keys.md) +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. + +[//]: # (END included file options/detach-keys.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the container. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The container only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: if the user only has access rights via a group, accessing the device +from inside a rootless container fails. Use the `--group-add keep-groups` +flag to pass the user's supplementary group access into the container. + + +[//]: # (BEGIN included file options/device-cgroup-rule.md) +#### **--device-cgroup-rule**=*"type major\:minor mode"* + +Add a rule to the cgroup allowed devices list. The rule is expected to be +in the format specified in the Linux kernel documentation +[admin-guide/cgroup-v1/devices](https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.html): +- *type*: `a` (all), `c` (char), or `b` (block); +- *major* and *minor*: either a number, or `*` for all; +- *mode*: a composition of `r` (read), `w` (write), and `m` (mknod(2)). + +[//]: # (END included file options/device-cgroup-rule.md) + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-read-iops.md) +#### **--device-read-iops**=*path:rate* + +Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-iops.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + + +[//]: # (BEGIN included file options/device-write-iops.md) +#### **--device-write-iops**=*path:rate* + +Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-iops.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + + +[//]: # (BEGIN included file options/dns.md) +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. + +[//]: # (END included file options/dns.md) + +This option cannot be combined with **--network** that is set to **none** or **container:**_id_. + + +[//]: # (BEGIN included file options/dns-option.container.md) +#### **--dns-option**=*option* + +Set custom DNS options. Invalid if using **--dns-option** with **--network** that is set to **none** or **container:**_id_. + +[//]: # (END included file options/dns-option.container.md) + + +[//]: # (BEGIN included file options/dns-search.container.md) +#### **--dns-search**=*domain* + +Set custom DNS search domains. Invalid if using **--dns-search** with **--network** that is set to **none** or **container:**_id_. +Use **--dns-search=.** to remove the search domain. + +[//]: # (END included file options/dns-search.container.md) + + +[//]: # (BEGIN included file options/entrypoint.md) +#### **--entrypoint**=*"command"* | *'["command", "arg1", ...]'* + +Override the default ENTRYPOINT from the image. + +The ENTRYPOINT of an image is similar to a COMMAND +because it specifies what executable to run when the container starts, but it is +(purposely) more difficult to override. The ENTRYPOINT gives a container its +default nature or behavior. When the ENTRYPOINT is set, the +container runs as if it were that binary, complete with default options. More options can be +passed in via the COMMAND. But, if a user wants to run +something else inside the container, the **--entrypoint** option allows a new +ENTRYPOINT to be specified. + +Specify multi option commands in the form of a json string. + +[//]: # (END included file options/entrypoint.md) + + +[//]: # (BEGIN included file options/env.md) +#### **--env**, **-e**=*env* + +Set environment variables. + +This option allows arbitrary environment variables that are available for the process to be launched inside of the container. If an environment variable is specified without a value, Podman checks the host environment for a value and set the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the container. + +[//]: # (END included file options/env.md) + +See [**Environment**](#environment) note below for precedence and examples. + + +[//]: # (BEGIN included file options/env-file.md) +#### **--env-file**=*file* + +Read in a line-delimited file of environment variables. + +[//]: # (END included file options/env-file.md) + +See [**Environment**](#environment) note below for precedence and examples. + + +[//]: # (BEGIN included file options/env-host.md) +#### **--env-host** + +Use host environment inside of the container. See **Environment** note below for precedence. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/env-host.md) + + +[//]: # (BEGIN included file options/env-merge.md) +#### **--env-merge**=*env* + +Preprocess default environment variables for the containers. For example +if image contains environment variable `hello=world` user can preprocess +it using `--env-merge hello=${hello}-some` so new value is `hello=world-some`. + +Please note that if the environment variable `hello` is not present in the image, +then it'll be replaced by an empty string and so using `--env-merge hello=${hello}-some` +would result in the new value of `hello=-some`, notice the leading `-` delimiter. + +[//]: # (END included file options/env-merge.md) + + +[//]: # (BEGIN included file options/expose.md) +#### **--expose**=*port[/protocol]* + +Expose a port or a range of ports (e.g. **--expose=3300-3310**). +The protocol can be `tcp`, `udp` or `sctp` and if not given `tcp` is assumed. +This option matches the EXPOSE instruction for image builds and has no effect on +the actual networking rules unless **-P/--publish-all** is used to forward to all +exposed ports from random host ports. To forward specific ports from the host +into the container use the **-p/--publish** option instead. + +[//]: # (END included file options/expose.md) + + +[//]: # (BEGIN included file options/gidmap.container.md) +#### **--gidmap**=*[flags]container_uid\:from_uid[\:amount]* + +Run the container in a new user namespace using the supplied GID mapping. This +option conflicts with the **--userns** and **--subgidname** options. This +option provides a way to map host GIDs to container GIDs in the same way as +__--uidmap__ maps host UIDs to container UIDs. For details see __--uidmap__. + +Note: the **--gidmap** option cannot be called in conjunction with the **--pod** option as a gidmap cannot be set on the container level when in a pod. + +[//]: # (END included file options/gidmap.container.md) + + +[//]: # (BEGIN included file options/gpus.md) +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. + +[//]: # (END included file options/gpus.md) + + +[//]: # (BEGIN included file options/group-add.md) +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/group-add.md) + + +[//]: # (BEGIN included file options/group-entry.md) +#### **--group-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/group` file within the container when `--user` is used. + +The variables $GROUPNAME, $GID, and $USERLIST are automatically replaced with their value at runtime if present. + +[//]: # (END included file options/group-entry.md) + + +[//]: # (BEGIN included file options/health-cmd.md) +#### **--health-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set or alter a healthcheck command for a container. The command is a command to be executed inside the +container that determines the container health. The command is required for other healthcheck options +to be applied. A value of **none** disables existing healthchecks. + +Multiple options can be passed in the form of a JSON array; otherwise, the command is interpreted +as an argument to **/bin/sh -c**. + +[//]: # (END included file options/health-cmd.md) + + +[//]: # (BEGIN included file options/health-interval.md) +#### **--health-interval**=*interval* + +Set an interval for the healthchecks. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-interval.md) + + +[//]: # (BEGIN included file options/health-log-destination.md) +#### **--health-log-destination**=*directory_path* + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) (Default: local) + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. + +[//]: # (END included file options/health-log-destination.md) + + +[//]: # (BEGIN included file options/health-max-log-count.md) +#### **--health-max-log-count**=*number of stored logs* + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) (Default: 5 attempts) + +[//]: # (END included file options/health-max-log-count.md) + + +[//]: # (BEGIN included file options/health-max-log-size.md) +#### **--health-max-log-size**=*size of stored logs* + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) (Default: 500 characters) + +[//]: # (END included file options/health-max-log-size.md) + + +[//]: # (BEGIN included file options/health-on-failure.md) +#### **--health-on-failure**=*action* + +Action to take once the container transitions to an unhealthy state. The default is **none**. + +- **none**: Take no action. +- **kill**: Kill the container. +- **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. +- **stop**: Stop the container. + +[//]: # (END included file options/health-on-failure.md) + + +[//]: # (BEGIN included file options/health-retries.md) +#### **--health-retries**=*retries* + +The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is **3**. + +[//]: # (END included file options/health-retries.md) + + +[//]: # (BEGIN included file options/health-start-period.md) +#### **--health-start-period**=*period* + +The initialization time needed for a container to bootstrap. The value can be expressed in time format like +**2m3s**. The default value is **0s**. + +Note: The health check command is executed as soon as a container is started, if the health check is successful +the container's health state will be updated to `healthy`. However, if the health check fails, the health state will +stay as `starting` until either the health check is successful or until the `--health-start-period` time is over. If the +health check command fails after the `--health-start-period` time is over, the health state will be updated to `unhealthy`. +The health check command is executed periodically based on the value of `--health-interval`. + +[//]: # (END included file options/health-start-period.md) + + +[//]: # (BEGIN included file options/health-startup-cmd.md) +#### **--health-startup-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set a startup healthcheck command for a container. This command is executed inside the container and is used to gate the regular +healthcheck. When the startup command succeeds, the regular healthcheck begins and the startup healthcheck ceases. Optionally, +if the command fails for a set number of attempts, the container is restarted. A startup healthcheck can be used to ensure that +containers with an extended startup period are not marked as unhealthy until they are fully started. Startup healthchecks can only be +used when a regular healthcheck (from the container's image or the **--health-cmd** option) is also set. + +[//]: # (END included file options/health-startup-cmd.md) + + +[//]: # (BEGIN included file options/health-startup-interval.md) +#### **--health-startup-interval**=*interval* + +Set an interval for the startup healthcheck. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-startup-interval.md) + + +[//]: # (BEGIN included file options/health-startup-retries.md) +#### **--health-startup-retries**=*retries* + +The number of attempts allowed before the startup healthcheck restarts the container. If set to **0**, the container is never restarted. The default is **0**. + +[//]: # (END included file options/health-startup-retries.md) + + +[//]: # (BEGIN included file options/health-startup-success.md) +#### **--health-startup-success**=*retries* + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value +of **0** means that any success begins the regular healthcheck. The default is **0**. + +[//]: # (END included file options/health-startup-success.md) + + +[//]: # (BEGIN included file options/health-startup-timeout.md) +#### **--health-startup-timeout**=*timeout* + +The maximum time a startup healthcheck command has to complete before it is marked as failed. The value can be expressed in a time +format like **2m3s**. The default value is **30s**. + +[//]: # (END included file options/health-startup-timeout.md) + + +[//]: # (BEGIN included file options/health-timeout.md) +#### **--health-timeout**=*timeout* + +The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the +value can be expressed in a time format such as **1m22s**. The default value is **30s**. + +[//]: # (END included file options/health-timeout.md) + +#### **--help** + +Print usage statement + + +[//]: # (BEGIN included file options/hostname.container.md) +#### **--hostname**, **-h**=*name* + +Set the container's hostname inside the container. + +This option can only be used with a private UTS namespace `--uts=private` +(default). If `--pod` is given and the pod shares the same UTS namespace +(default), the pod's hostname is used. The given hostname is also added to the +`/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). + +[//]: # (END included file options/hostname.container.md) + + +[//]: # (BEGIN included file options/hosts-file.md) +#### **--hosts-file**=*path* | *none* | *image* + +Base file to create the `/etc/hosts` file inside the container. This must either +be an absolute path to a file on the host system, or one of the following +special flags: + "" Follow the `base_hosts_file` configuration in _containers.conf_ (the default) + `none` Do not use a base file (i.e. start with an empty file) + `image` Use the container image's `/etc/hosts` file as base file + +[//]: # (END included file options/hosts-file.md) + + +[//]: # (BEGIN included file options/hostuser.md) +#### **--hostuser**=*name* + +Add a user account to /etc/passwd from the host to the container. The Username +or UID must exist on the host system. + +[//]: # (END included file options/hostuser.md) + + +[//]: # (BEGIN included file options/http-proxy.md) +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. + +[//]: # (END included file options/http-proxy.md) + + +[//]: # (BEGIN included file options/image-volume.md) +#### **--image-volume**=**bind** | *tmpfs* | *ignore* + +Tells Podman how to handle the builtin image volumes. Default is **bind**. + +- **bind**: An anonymous named volume is created and mounted into the container. +- **tmpfs**: The volume is mounted onto the container as a tmpfs, which allows the users to create +content that disappears when the container is stopped. +- **ignore**: All volumes are just ignored and no action is taken. + +[//]: # (END included file options/image-volume.md) + + +[//]: # (BEGIN included file options/init.md) +#### **--init** + +Run an init inside the container that forwards signals and reaps processes. +The container-init binary is mounted at `/run/podman-init`. +Mounting over `/run` breaks container execution. + +[//]: # (END included file options/init.md) + + +[//]: # (BEGIN included file options/init-path.md) +#### **--init-path**=*path* + +Path to the container-init binary. + +[//]: # (END included file options/init-path.md) + + +[//]: # (BEGIN included file options/interactive.md) +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. + +[//]: # (END included file options/interactive.md) + + +[//]: # (BEGIN included file options/ip.md) +#### **--ip**=*ipv4* + +Specify a static IPv4 address for the container, for example **10.88.64.128**. +This option can only be used if the container is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IP address pool (default **10.88.0.0/16**). + +To specify multiple static IP addresses per container, set multiple networks using the **--network** option with a static IP address specified for each using the `ip` mode for that option. + +[//]: # (END included file options/ip.md) + + +[//]: # (BEGIN included file options/ip6.md) +#### **--ip6**=*ipv6* + +Specify a static IPv6 address for the container, for example **fd46\:db93\:aa76\:ac37::10**. +This option can only be used if the container is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IPv6 address pool. + +To specify multiple static IPv6 addresses per container, set multiple networks using the **--network** option with a static IPv6 address specified for each using the `ip6` mode for that option. + +[//]: # (END included file options/ip6.md) + + +[//]: # (BEGIN included file options/ipc.md) +#### **--ipc**=*ipc* + +Set the IPC namespace mode for a container. The default is to create +a private IPC namespace. + +- "": Use Podman's default, defined in containers.conf. +- **container:**_id_: reuses another container's shared memory, semaphores, and message queues +- **host**: use the host's shared memory, semaphores, and message queues inside the container. Note: the host mode gives the container full access to local shared memory and is therefore considered insecure. +- **none**: private IPC namespace, with /dev/shm not mounted. +- **ns:**_path_: path to an IPC namespace to join. +- **private**: private IPC namespace. +- **shareable**: private IPC namespace with a possibility to share it with other containers. + +[//]: # (END included file options/ipc.md) + + +[//]: # (BEGIN included file options/label.md) +#### **--label**, **-l**=*key=value* + +Add metadata to a container. + +[//]: # (END included file options/label.md) + + +[//]: # (BEGIN included file options/label-file.md) +#### **--label-file**=*file* + +Read in a line-delimited file of labels. + +[//]: # (END included file options/label-file.md) + + +[//]: # (BEGIN included file options/link-local-ip.md) +#### **--link-local-ip**=*ip* + +Not implemented. + +[//]: # (END included file options/link-local-ip.md) + + +[//]: # (BEGIN included file options/log-driver.md) +#### **--log-driver**=*driver* + +Logging driver for the container. Currently available options are **k8s-file**, **journald**, **none**, **passthrough** and **passthrough-tty**, with **json-file** aliased to **k8s-file** for scripting compatibility. (Default **journald**). + +The podman info command below displays the default log-driver for the system. +``` +$ podman info --format '{{ .Host.LogDriver }}' +journald +``` +The **passthrough** driver passes down the standard streams (stdin, stdout, stderr) to the +container. It is not allowed with the remote Podman client, including Mac and Windows (excluding WSL2) machines, and on a tty, since it is +vulnerable to attacks via TIOCSTI. + +The **passthrough-tty** driver is the same as **passthrough** except that it also allows it to be used on a TTY if the user really wants it. + +[//]: # (END included file options/log-driver.md) + + +[//]: # (BEGIN included file options/log-opt.md) +#### **--log-opt**=*name=value* + +Logging driver specific options. + +Set custom logging configuration. The following *name*s are supported: + +**path**: specify a path to the log file + (e.g. **--log-opt path=/var/log/container/mycontainer.json**); + +**max-size**: specify a max size of the log file + (e.g. **--log-opt max-size=10mb**); + +**tag**: specify a custom log tag for the container + (e.g. **--log-opt tag="{{.ImageName}}"**. +It supports the same keys as **podman inspect --format**. +This option is currently supported only by the **journald** log driver. + +[//]: # (END included file options/log-opt.md) + + +[//]: # (BEGIN included file options/mac-address.md) +#### **--mac-address**=*address* + +Container network interface MAC address (e.g. 92\:d0\:c6:0a:29:33) +This option can only be used if the container is joined to only a single network - i.e., **--network=_network-name_** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. + +Remember that the MAC address in an Ethernet network must be unique. +The IPv6 link-local address is based on the device's MAC address +according to RFC4862. + +To specify multiple static MAC addresses per container, set multiple networks using the **--network** option with a static MAC address specified for each using the `mac` mode for that option. + +[//]: # (END included file options/mac-address.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-reservation.md) +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-reservation.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/memory-swappiness.md) +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/memory-swappiness.md) + + +[//]: # (BEGIN included file options/mount.md) +#### **--mount**=*type=TYPE,TYPE-SPECIFIC-OPTION[,...]* + +Attach a filesystem mount to the container + +Current supported mount TYPEs are **bind**, **devpts**, **glob**, **image**, **ramfs**, **tmpfs** and **volume**. + +Options common to all mount types: + +- *src*, *source*: mount source spec for **bind**, **glob**, and **volume**. + Mandatory for **bind** and **glob**. + +- *dst*, *destination*, *target*: mount destination spec. + +When source globs are specified without the destination directory, +the files and directories are mounted with their complete path +within the container. When the destination is specified, the +files and directories matching the glob on the base file name +on the destination directory are mounted. The option +`type=glob,src=/foo*,destination=/tmp/bar` tells container engines +to mount host files matching /foo* to the /tmp/bar/ +directory in the container. + +Options specific to type=**volume**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *idmap*: If specified, create an idmapped mount to the target user namespace in the container. + The idmap option is only supported by Podman in rootful mode. The Linux kernel does not allow the use of idmaped file systems for unprivileged users. + The idmap option supports a custom mapping that can be different than the user namespace used by the container. + The mapping can be specified after the idmap option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the first value is the + start of the backing file system IDs that are mapped to the second value on the host. The length of this mapping is given in the third value. + Multiple ranges are separated with #. If the specified mapping is prepended with a '@' then the mapping is considered relative to the container + user namespace. The host ID for the mapping is changed to account for the relative position of the container user in the container user namespace. + +Options specific to type=**image**: + +- *rw*, *readwrite*: *true* or *false* (default if unspecified: *false*). + +- *subpath*: Mount only a specific path within the image, instead of the whole image. + +Options specific to **bind** and **glob**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *bind-propagation*: *shared*, *slave*, *private*, *unbindable*, *rshared*, *rslave*, *runbindable*, or **rprivate** (default).[[1]](#Footnote1) See also mount(2). + +- *bind-nonrecursive*: do not set up a recursive bind mount. By default it is recursive. + +- *relabel*: *shared*, *private*. + +- *idmap*: *true* or *false* (default if unspecified: *false*). If true, create an idmapped mount to the target user namespace in the container. The idmap option is only supported by Podman in rootful mode. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *no-dereference*: do not dereference symlinks but copy the link source into the mount destination. + +Options specific to type=**tmpfs** and **ramfs**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *tmpfs-size*: Size of the tmpfs/ramfs mount, in bytes. Unlimited by default in Linux. + +- *tmpfs-mode*: Octal file mode of the tmpfs/ramfs (e.g. 700 or 0700.). + +- *tmpcopyup*: Enable copyup from the image directory at the same location to the tmpfs/ramfs. Used by default. + +- *notmpcopyup*: Disable copying files from the image to the tmpfs/ramfs. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +Options specific to type=**devpts**: + +- *uid*: numeric UID of the file owner (default: 0). + +- *gid*: numeric GID of the file owner (default: 0). + +- *mode*: octal permission mask for the file (default: 600). + +- *max*: maximum number of PTYs (default: 1048576). + +Examples: + +- `type=bind,source=/path/on/host,destination=/path/in/container` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared,U=true` + +- `type=devpts,destination=/dev/pts` + +- `type=glob,src=/usr/lib/libfoo*,destination=/usr/lib,ro=true` + +- `type=image,source=fedora,destination=/fedora-image,rw=true` + +- `type=ramfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,destination=/path/in/container,noswap` + +- `type=volume,source=vol1,destination=/path/in/container,ro=true` + +[//]: # (END included file options/mount.md) + + +[//]: # (BEGIN included file options/name.container.md) +#### **--name**=*name* + +Assign a name to the container. + +The operator can identify a container in three ways: + +- UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”); +- UUID short identifier (“f78375b1c487”); +- Name (“jonah”). + +Podman generates a UUID for each container, and if no name is assigned to the +container using **--name**, Podman generates a random string name. The name can +be useful as a more human-friendly way to identify containers. This works for +both background and foreground containers. The container's name is also added +to the `/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). + +[//]: # (END included file options/name.container.md) + + +[//]: # (BEGIN included file options/network.md) +#### **--network**=*mode*, **--net** + +Set the network mode for the container. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured, to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.md) + +Invalid if using **--dns**, **--dns-option**, or **--dns-search** with **--network** set to **none** or **container:**_id_. + +If used together with **--pod**, the container joins the pod's network namespace. + + +[//]: # (BEGIN included file options/network-alias.md) +#### **--network-alias**=*alias* + +Add a network-scoped alias for the container, setting the alias for all networks that the container joins. To set a +name only for a specific network, use the alias option as described under the **--network** option. +If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. This option can be specified multiple times. +NOTE: When using CNI a container only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. + +[//]: # (END included file options/network-alias.md) + + +[//]: # (BEGIN included file options/no-healthcheck.md) +#### **--no-healthcheck** + +Disable any defined healthchecks for container. + +[//]: # (END included file options/no-healthcheck.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the container. + +Podman assumes control over the container's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/oom-kill-disable.md) +#### **--oom-kill-disable** + +Whether to disable OOM Killer for the container or not. + +This flag is not supported on cgroups V2 systems. + +[//]: # (END included file options/oom-kill-disable.md) + + +[//]: # (BEGIN included file options/oom-score-adj.md) +#### **--oom-score-adj**=*num* + +Tune the host's OOM preferences for containers (accepts values from **-1000** to **1000**). + +When running in rootless mode, the specified value can't be lower than +the oom_score_adj for the current process. In this case, the +oom-score-adj is clamped to the current process value. + +[//]: # (END included file options/oom-score-adj.md) + + +[//]: # (BEGIN included file options/os.pull.md) +#### **--os**=*OS* + +Override the OS, defaults to hosts, of the image to be pulled. For example, `windows`. +Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. + +[//]: # (END included file options/os.pull.md) + +#### **--passwd** + +Allow Podman to add entries to /etc/passwd and /etc/group when used in conjunction with the --user option. +This is used to override the Podman provided user setup in favor of entrypoint configurations such as libnss-extrausers. + + +[//]: # (BEGIN included file options/passwd-entry.md) +#### **--passwd-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/passwd` file within the container when `--passwd` is used. + +The variables $USERNAME, $UID, $GID, $NAME, $HOME are automatically replaced with their value at runtime. + +[//]: # (END included file options/passwd-entry.md) + + +[//]: # (BEGIN included file options/personality.md) +#### **--personality**=*persona* + +Personality sets the execution domain via Linux personality(2). + +[//]: # (END included file options/personality.md) + + +[//]: # (BEGIN included file options/pid.container.md) +#### **--pid**=*mode* + +Set the PID namespace mode for the container. +The default is to create a private PID namespace for the container. + +- **container:**_id_: join another container's PID namespace; +- **host**: use the host's PID namespace for the container. Note the host mode gives the container full access to local PID and is therefore considered insecure; +- **ns:**_path_: join the specified PID namespace; +- **private**: create a new namespace for the container (default). + +[//]: # (END included file options/pid.container.md) + + +[//]: # (BEGIN included file options/pidfile.md) +#### **--pidfile**=*path* + +When the pidfile location is specified, the container process' PID is written to the pidfile. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +If the pidfile option is not specified, the container process' PID is written to /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile. + +After the container is started, the location for the pidfile can be discovered with the following `podman inspect` command: + + $ podman inspect --format '{{ .PidFile }}' $CID + /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile + +[//]: # (END included file options/pidfile.md) + + +[//]: # (BEGIN included file options/pids-limit.md) +#### **--pids-limit**=*limit* + +Tune the container's pids limit. Set to **-1** to have unlimited pids for the container. The default is **2048** on systems that support "pids" cgroup controller. + +[//]: # (END included file options/pids-limit.md) + + +[//]: # (BEGIN included file options/platform.md) +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with --arch and --os) +The `--platform` option can be used to override the current architecture and operating system. +Unless overridden, subsequent lookups of the same image in the local storage matches this platform, regardless of the host. + +[//]: # (END included file options/platform.md) + + +[//]: # (BEGIN included file options/pod.run.md) +#### **--pod**=*name* + +Run container in an existing pod. Podman makes the pod automatically if the pod name is prefixed with **new:**. +To make a pod with more granular options, use the **podman pod create** command before creating a container. +When a container is run with a pod with an infra-container, the infra-container is started first. + +[//]: # (END included file options/pod.run.md) + + +[//]: # (BEGIN included file options/pod-id-file.container.md) +#### **--pod-id-file**=*file* + +Run container in an existing pod and read the pod's ID from the specified *file*. +When a container is run within a pod which has an infra-container, the infra-container starts first. + +[//]: # (END included file options/pod-id-file.container.md) + + +[//]: # (BEGIN included file options/preserve-fd.md) +#### **--preserve-fd**=*FD1[,FD2,...]* + +Pass down to the process the additional file descriptors specified in the comma separated list. It can be specified multiple times. +This option is only supported with the crun OCI runtime. It might be a security risk to use this option with other OCI runtimes. + +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/preserve-fd.md) + + +[//]: # (BEGIN included file options/preserve-fds.md) +#### **--preserve-fds**=*N* + +Pass down to the process N additional file descriptors (in addition to 0, 1, 2). +The total FDs are 3+N. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/preserve-fds.md) + + +[//]: # (BEGIN included file options/privileged.md) +#### **--privileged** + +Give extended privileges to this container. The default is **false**. + +By default, Podman containers are unprivileged (**=false**) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read-only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. +Due to the disabled security features, the privileged field should almost never +be set as containers can easily break out of confinement. + +Containers running in a user namespace (e.g., rootless containers) cannot have +more privileges than the user that launched them. + +[//]: # (END included file options/privileged.md) + + +[//]: # (BEGIN included file options/publish.md) +#### **--publish**, **-p**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Publish a container's port, or range of ports, to the host. + +Both *hostPort* and *containerPort* can be specified as a range of ports. +When specifying ranges for both, the number of container ports in the +range must match the number of host ports in the range. + +If host IP is set to 0.0.0.0 or not set at all, the port is bound on all IPs on the host. + +By default, Podman publishes TCP ports. To publish a UDP port instead, give +`udp` as protocol. To publish both TCP and UDP ports, set `--publish` twice, +with `tcp`, and `udp` as protocols respectively. Rootful containers can also +publish ports using the `sctp` protocol. + +Host port does not have to be specified (e.g. `podman run -p 127.0.0.1::80`). +If it is not, the container port is randomly assigned a port on the host. + +Use **podman port** to see the actual mapping: `podman port $CONTAINER $CONTAINERPORT`. + +Note that the network drivers `macvlan` and `ipvlan` do not support port forwarding, +it will have no effect on these networks. + +[//]: # (END included file options/publish.md) + +**Note:** If a container runs within a pod, it is not necessary to publish the port for +the containers in the pod. The port must only be published by the pod itself. Pod network +stacks act like the network stack on the host - meaning a variety of containers in the pod +and programs in the container all share a single interface, IP address, and +associated ports. If one container binds to a port, no other container can use that port +within the pod while it is in use. Containers in the pod can also communicate over localhost +by having one container bind to localhost in the pod, and another connect to that port. + + +[//]: # (BEGIN included file options/publish-all.md) +#### **--publish-all**, **-P** + +Publish all exposed ports to random ports on the host interfaces. The default is **false**. + +When set to **true**, publish all exposed ports to the host interfaces. +If the operator uses **-P** (or **-p**) then Podman makes the +exposed port accessible on the host and the ports are available to any +client that can reach the host. + +When using this option, Podman binds any exposed port to a random port on the host +within an ephemeral port range defined by */proc/sys/net/ipv4/ip_local_port_range*. +To find the mapping between the host ports and the exposed ports, use **podman port**. + +[//]: # (END included file options/publish-all.md) + + +[//]: # (BEGIN included file options/pull.md) +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Pull the image only when the image is not in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error if no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. + +[//]: # (END included file options/pull.md) + +#### **--quiet**, **-q** + +Suppress output information when pulling images + + +[//]: # (BEGIN included file options/rdt-class.md) +#### **--rdt-class**=*intel-rdt-class-of-service* + +Rdt-class sets the class of service (CLOS or COS) for the container to run in. Based on the Cache Allocation Technology (CAT) feature that is part of Intel's Resource Director Technology (RDT) feature set, all container processes will run within the pre-configured COS, representing a part of the cache. The COS has to be created and configured using a pseudo file system (usually mounted at `/sys/fs/resctrl`) that the resctrl kernel driver provides. Assigning the container to a COS requires root privileges and thus doesn't work in a rootless environment. Currently, the feature is only supported using `runc` as a runtime. See for more details on creating a COS before a container can be assigned to it. + +[//]: # (END included file options/rdt-class.md) + + +[//]: # (BEGIN included file options/read-only.md) +#### **--read-only** + +Mount the container's root filesystem as read-only. + +By default, container root filesystems are writable, allowing processes +to write files anywhere. By specifying the **--read-only** flag, the containers root filesystem are mounted read-only prohibiting any writes. + +[//]: # (END included file options/read-only.md) + + +[//]: # (BEGIN included file options/read-only-tmpfs.md) +#### **--read-only-tmpfs** + +When running --read-only containers, mount a read-write tmpfs on _/dev_, _/dev/shm_, _/run_, _/tmp_, and _/var/tmp_. The default is **true**. + +| --read-only | --read-only-tmpfs | / | /run, /tmp, /var/tmp| +| ----------- | ----------------- | ---- | ----------------------------------- | +| true | true | r/o | r/w | +| true | false | r/o | r/o | +| false | false | r/w | r/w | +| false | true | r/w | r/w | + +When **--read-only=true** and **--read-only-tmpfs=true** additional tmpfs are mounted on +the /tmp, /run, and /var/tmp directories. + +When **--read-only=true** and **--read-only-tmpfs=false** /dev and /dev/shm are marked +Read/Only and no tmpfs are mounted on /tmp, /run and /var/tmp. The directories +are exposed from the underlying image, meaning they are read-only by default. +This makes the container totally read-only. No writable directories exist within +the container. In this mode writable directories need to be added via external +volumes or mounts. + +By default, when **--read-only=false**, the /dev and /dev/shm are read/write, and the /tmp, /run, and /var/tmp are read/write directories from the container image. + +[//]: # (END included file options/read-only-tmpfs.md) + + +[//]: # (BEGIN included file options/replace.md) +#### **--replace** + +If another container with the same name already exists, replace and remove it. The default is **false**. + +[//]: # (END included file options/replace.md) + + +[//]: # (BEGIN included file options/requires.md) +#### **--requires**=*container* + +Specify one or more requirements. +A requirement is a dependency container that is started before this container. +Containers can be specified by name or ID, with multiple containers being separated by commas. + +[//]: # (END included file options/requires.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + +#### **--rm** + +Automatically remove the container and any anonymous unnamed volume associated with +the container when it exits. The default is **false**. + +#### **--rmi** + +After exit of the container, remove the image unless another +container is using it. Implies --rm on the new container. The default is *false*. + + +[//]: # (BEGIN included file options/rootfs.md) +#### **--rootfs** + +If specified, the first argument refers to an exploded container on the file system. + +This is useful to run a container without requiring any image management, the rootfs +of the container is assumed to be managed externally. + + `Overlay Rootfs Mounts` + + The `\:O` flag tells Podman to mount the directory from the rootfs path as +storage using the `overlay file system`. The container processes +can modify content within the mount point which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +Note: On **SELinux** systems, the rootfs needs the correct label, which is by default +**unconfined_u\:object_r\:container_file_t\:s0**. + + `idmap` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. +The idmap option supports a custom mapping that can be different than the user +namespace used by the container. The mapping can be specified after the idmap +option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the +first value is the start of the backing file system IDs that are mapped to the +second value on the host. The length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/rootfs.md) + + +[//]: # (BEGIN included file options/sdnotify.md) +#### **--sdnotify**=**container** | *conmon* | *healthy* | *ignore* + +Determines how to use the NOTIFY_SOCKET, as passed with systemd and Type=notify. + +Default is **container**, which means allow the OCI runtime to proxy the socket into the +container to receive ready notification. Podman sets the MAINPID to conmon's pid. +The **conmon** option sets MAINPID to conmon's pid, and sends READY when the container +has started. The socket is never passed to the runtime or the container. +The **healthy** option sets MAINPID to conmon's pid, and sends READY when the container +has turned healthy; requires a healthcheck to be set. The socket is never passed to the runtime or the container. +The **ignore** option removes NOTIFY_SOCKET from the environment for itself and child processes, +for the case where some other process above Podman uses NOTIFY_SOCKET and Podman does not use it. + +[//]: # (END included file options/sdnotify.md) + + +[//]: # (BEGIN included file options/seccomp-policy.md) +#### **--seccomp-policy**=*policy* + +Specify the policy to select the seccomp profile. If set to *image*, Podman looks for a "io.containers.seccomp.profile" label in the container-image config and use its value as a seccomp profile. Otherwise, Podman follows the *default* policy by applying the default profile unless specified otherwise via *--security-opt seccomp* as described below. + +Note that this feature is experimental and may change in the future. + +[//]: # (END included file options/seccomp-policy.md) + + +[//]: # (BEGIN included file options/secret.md) +#### **--secret**=*secret[,opt=opt ...]* + +Give the container access to a secret. Can be specified multiple times. + +A secret is a blob of sensitive data which a container needs at runtime but +is not stored in the image or in source control, such as usernames and passwords, +TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 500 kb in size). + +When secrets are specified as type `mount`, the secrets are copied and mounted into the container when a container is created. +When secrets are specified as type `env`, the secret is set as an environment variable within the container. +Secrets are written in the container at the time of container creation, and modifying the secret using `podman secret` commands +after the container is created affects the secret inside the container. + +Secrets and its storage are managed using the `podman secret` command. + +Secret Options + +- `type=mount|env` : How the secret is exposed to the container. + `mount` mounts the secret into the container as a file. + `env` exposes the secret as an environment variable. + Defaults to `mount`. +- `target=target` : Target of secret. + For mounted secrets, this is the path to the secret inside the container. + If a fully qualified path is provided, the secret is mounted at that location. + Otherwise, the secret is mounted to + `/run/secrets/target` for linux containers or + `/var/run/secrets/target` for freebsd containers. + If the target is not set, the secret is mounted to `/run/secrets/secretname` by default. + For env secrets, this is the environment variable key. Defaults to `secretname`. +- `uid=0` : UID of secret. Defaults to 0. Mount secret type only. +- `gid=0` : GID of secret. Defaults to 0. Mount secret type only. +- `mode=0` : Mode of secret. Defaults to 0444. Mount secret type only. + + +Examples + +Mount at `/my/location/mysecret` with UID 1: +``` +--secret mysecret,target=/my/location/mysecret,uid=1 +``` + +Mount at `/run/secrets/customtarget` with mode 0777: +``` +--secret mysecret,target=customtarget,mode=0777 +``` + +Create a secret environment variable called `ENVSEC`: +``` +--secret mysecret,type=env,target=ENVSEC +``` + +[//]: # (END included file options/secret.md) + + +[//]: # (BEGIN included file options/security-opt.md) +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the container +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the container + +- **label=user:**_USER_: Set the label user for the container processes +- **label=role:**_ROLE_: Set the label role for the container processes +- **label=type:**_TYPE_: Set the label process type for the container processes +- **label=level:**_LEVEL_: Set the label level for the container processes +- **label=filetype:**_TYPE_: Set the label file type for the container files +- **label=disable**: Turn off label separation for the container + +Note: Labeling can be disabled for all containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the container. + +- **no-new-privileges**: Disable container processes from gaining additional privileges. + +- **seccomp=unconfined**: Turn off seccomp confinement for the container. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. + +[//]: # (END included file options/security-opt.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the container. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/shm-size-systemd.md) +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. + +[//]: # (END included file options/shm-size-systemd.md) + + +[//]: # (BEGIN included file options/sig-proxy.md) +#### **--sig-proxy** + +Proxy received signals to the container process. SIGCHLD, SIGURG, SIGSTOP, and SIGKILL are not proxied. + +[//]: # (END included file options/sig-proxy.md) + +The default is **true**. + + +[//]: # (BEGIN included file options/stop-signal.md) +#### **--stop-signal**=*signal* + +Signal to stop a container. Default is **SIGTERM**. + +[//]: # (END included file options/stop-signal.md) + + +[//]: # (BEGIN included file options/stop-timeout.md) +#### **--stop-timeout**=*seconds* + +Timeout to stop a container. Default is **10**. +Remote connections use local containers.conf for defaults. + +[//]: # (END included file options/stop-timeout.md) + + +[//]: # (BEGIN included file options/subgidname.md) +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. + +[//]: # (END included file options/subgidname.md) + + +[//]: # (BEGIN included file options/subuidname.md) +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. + +[//]: # (END included file options/subuidname.md) + + +[//]: # (BEGIN included file options/sysctl.md) +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters at runtime. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: if using the **--ipc=host** option, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: if using the **--network=host** option, the above sysctls are not allowed. + +[//]: # (END included file options/sysctl.md) + + +[//]: # (BEGIN included file options/systemd.md) +#### **--systemd**=*true* | *false* | *always* + +Run container in systemd mode. The default is **true**. + +- **true** enables systemd mode only when the command executed inside the container is *systemd*, */usr/sbin/init*, +*/sbin/init* or */usr/local/sbin/init*. + +- **false** disables systemd mode. + +- **always** enforces the systemd mode to be enabled. + +Running the container in systemd mode causes the following changes: + +* Podman mounts tmpfs file systems on the following directories + * _/run_ + * _/run/lock_ + * _/tmp_ + * _/sys/fs/cgroup/systemd_ (on a cgroup v1 system) + * _/var/lib/journal_ +* Podman sets the default stop signal to **SIGRTMIN+3**. +* Podman sets **container_uuid** environment variable in the container to the +first 32 characters of the container ID. +* Podman does not mount virtual consoles (_/dev/tty\d+_) when running with **--privileged**. +* On cgroup v2, */sys/fs/cgroup* is mounted writeable. + +This allows systemd to run in a confined container without any modifications. + +Note that on **SELinux** systems, systemd attempts to write to the cgroup +file system. Containers writing to the cgroup file system are denied by default. +The **container_manage_cgroup** boolean must be enabled for this to be allowed on an SELinux separated system. +``` +setsebool -P container_manage_cgroup true +``` + +[//]: # (END included file options/systemd.md) + + +[//]: # (BEGIN included file options/timeout.md) +#### **--timeout**=*seconds* + +Maximum time a container is allowed to run before conmon sends it the kill +signal. By default containers run until they exit or are stopped by +`podman stop`. + +[//]: # (END included file options/timeout.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/tmpfs.md) +#### **--tmpfs**=*fs* + +Create a tmpfs mount. + +Mount a temporary filesystem (**tmpfs**) mount into a container, for example: + +``` +$ podman run -d --tmpfs /tmp\:rw,size=787448k,mode=1777 my_image +``` + +This command mounts a **tmpfs** at _/tmp_ within the container. The supported mount +options are the same as the Linux default mount flags. If no options are specified, +the system uses the following options: +**rw,noexec,nosuid,nodev**. + +[//]: # (END included file options/tmpfs.md) + + +[//]: # (BEGIN included file options/tty.md) +#### **--tty**, **-t** + +Allocate a pseudo-TTY. The default is **false**. + +When set to **true**, Podman allocates a pseudo-tty and attach to the standard +input of the container. This can be used, for example, to run a throwaway +interactive shell. + +**NOTE**: The --tty flag prevents redirection of standard output. It combines STDOUT and STDERR, it can insert control characters, and it can hang pipes. This option is only used when run interactively in a terminal. When feeding input to Podman, use -i only, not -it. + +[//]: # (END included file options/tty.md) + +``` +echo "asdf" | podman run --rm -i someimage /bin/cat +``` + + +[//]: # (BEGIN included file options/tz.md) +#### **--tz**=*timezone* + +Set timezone in container. This flag takes area-based timezones, GMT time, as well as `local`, which sets the timezone in the container to match the host machine. See `/usr/share/zoneinfo/` for valid timezones. +Remote connections use local containers.conf for defaults + +[//]: # (END included file options/tz.md) + + +[//]: # (BEGIN included file options/uidmap.container.md) +#### **--uidmap**=*[flags]container_uid\:from_uid[\:amount]* + +Run the container in a new user namespace using the supplied UID mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +The possible values of the optional *flags* are discussed further down on this page. +The *amount* value is optional and assumed to be **1** if not given. + +The *from_uid* value is based upon the user running the command, either rootful or rootless users. + +* rootful user: [*flags*]*container_uid*:*host_uid*[:*amount*] +* rootless user: [*flags*]*container_uid*:*intermediate_uid*[:*amount*] + + `Rootful mappings` + + +When **podman run** is called by a privileged user, the option **--uidmap** +works as a direct mapping between host UIDs and container UIDs. + +host UID -> container UID + +The _amount_ specifies the number of consecutive UIDs that is mapped. +If for example _amount_ is **4** the mapping looks like: + +| host UID | container UID | +| ---------- | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | + + `Rootless mappings` + +When **podman run** is called by an unprivileged user (i.e. running rootless), +the value *from_uid* is interpreted as an "intermediate UID". In the rootless +case, host UIDs are not mapped directly to container UIDs. Instead the mapping +happens over two mapping steps: + +host UID -> intermediate UID -> container UID + +The **--uidmap** option only influences the second mapping step. + +The first mapping step is derived by Podman from the contents of the file +_/etc/subuid_ and the UID of the user calling Podman. + +First mapping step: + +| host UID | intermediate UID | +| -------- | ---------------- | +| UID for Podman user | 0 | +| 1st subordinate UID | 1 | +| 2nd subordinate UID | 2 | +| 3rd subordinate UID | 3 | +| nth subordinate UID | n | + +To be able to use intermediate UIDs greater than zero, the user needs to have +subordinate UIDs configured in _/etc/subuid_. See **subuid**(5). + +The second mapping step is configured with **--uidmap**. + +If for example _amount_ is **5** the second mapping step looks like: + +| intermediate UID | container UID | +| ------------------ | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | +| *from_uid* + 4 | *container_uid* + 4 | + +When running as rootless, Podman uses all the ranges configured in the _/etc/subuid_ file. + +The current user ID is mapped to UID=0 in the rootless user namespace. +Every additional range is added sequentially afterward: + +| host | rootless user namespace | length | +| ------ | ----------------------- | ------ | +| $UID | 0 | 1 | +| 1 | $FIRST_RANGE_ID | $FIRST_RANGE_LENGTH | +| 1+$FIRST_RANGE_LENGTH | $SECOND_RANGE_ID | $SECOND_RANGE_LENGTH| + + `Referencing a host ID from the parent namespace` + +As a rootless user, the given host ID in **--uidmap** or **--gidmap** +is mapped from the *intermediate namespace* generated by Podman. Sometimes +it is desirable to refer directly at the *host namespace*. It is possible +to manually do so, by running `podman unshare cat /proc/self/gid_map`, +finding the desired host id at the second column of the output, and getting +the corresponding intermediate id from the first column. + +Podman can perform all that by preceding the host id in the mapping +with the `@` symbol. For instance, by specifying `--gidmap 100000:@2000:1`, +podman will look up the intermediate id corresponding to host id `2000` and +it will map the found intermediate id to the container id `100000`. The +given host id must have been subordinated (otherwise it would not be mapped +into the intermediate space in the first place). + +If the length is greater than one, for instance with `--gidmap 100000:@2000:2`, +Podman will map host ids `2000` and `2001` to `100000` and `100001`, respectively, +regardless of how the intermediate mapping is defined. + + `Extending previous mappings` + +Some mapping modifications may be cumbersome. For instance, a user +starts with a mapping such as `--gidmap="0:0:65000"`, that needs to be +changed such as the parent id `1000` is mapped to container id `100000` +instead, leaving container id `1` unassigned. The corresponding `--gidmap` +becomes `--gidmap="0:0:1" --gidmap="2:2:65534" --gidmap="100000:1:1"`. + +This notation can be simplified using the `+` flag, that takes care of +breaking previous mappings removing any conflicting assignment with +the given mapping. The flag is given before the container id +as follows: `--gidmap="0:0:65000" --gidmap="+100000:1:1"` + + + Flag | Example | Description +-----------|---------------|------------- + `+` | `+100000:1:1` | Extend the previous mapping + +This notation leads to gaps in the assignment, so it may be convenient to +fill those gaps afterwards: `--gidmap="0:0:65000" --gidmap="+100000:1:1" --gidmap="1:65001:1"` + +One specific use case for this flag is in the context of rootless +users. A rootless user may specify mappings with the `+` flag as +in `--gidmap="+100000:1:1"`. Podman will then "fill the gaps" starting +from zero with all the remaining intermediate ids. This is convenient when +a user wants to map a specific intermediate id to a container id, leaving +the rest of subordinate ids to be mapped by Podman at will. + + `Passing only one of --uidmap or --gidmap` + +Usually, subordinated user and group ids are assigned simultaneously, and +for any user the subordinated user ids match the subordinated group ids. +For convenience, if only one of **--uidmap** or **--gidmap** is given, +podman assumes the mapping refers to both UIDs and GIDs and applies the +given mapping to both. If only one value of the two needs to be changed, +the mappings should include the `u` or the `g` flags to specify that +they only apply to UIDs or GIDs and should not be copied over. + + flag | Example | Description +---------|-----------------|----------------- + `u` | `u20000:2000:1` |The mapping only applies to UIDs + `g` | `g10000:1000:1` |The mapping only applies to GIDs + +For instance given the command + + podman run --gidmap "0:0:1000" --gidmap "g2000:2000:1" + +Since no **--uidmap** is given, the **--gidmap** is copied to **--uidmap**, +giving a command equivalent to + + podman run --gidmap "0:0:1000" --gidmap "2000:2000:1" --uidmap "0:0:1000" + +The `--gidmap "g2000:2000:1"` used the `g` flag and therefore it was +not copied to **--uidmap**. + + `Rootless mapping of additional host GIDs` + +A rootless user may desire to map a specific host group that has already been +subordinated within _/etc/subgid_ without specifying the rest of the mapping. + +This can be done with **--gidmap "+g*container_gid*:@*host_gid*"** + +Where: + +- The host GID is given through the `@` symbol +- The mapping of this GID is not copied over to **--usermap** thanks to the `g` flag. +- The rest of the container IDs will be mapped starting from 0 to n, + with all the remaining subordinated GIDs, thanks to the `+` flag. + +For instance, if a user belongs to the group `2000` and that group is +subordinated to that user (with `usermod --add-subgids 2000-2000 $USER`), +the user can map the group into the container with: **--gidmap=+g100000:@2000**. + +If this mapping is combined with the option, **--group-add=keep-groups**, the +process in the container will belong to group `100000`, and files belonging +to group `2000` in the host will appear as being owned by group `100000` +inside the container. + + podman run --group-add=keep-groups --gidmap="+g100000:@2000" ... + + `No subordinate UIDs` + +Even if a user does not have any subordinate UIDs in _/etc/subuid_, +**--uidmap** can be used to map the normal UID of the user to a +container UID by running `podman run --uidmap $container_uid:0:1 --user $container_uid ...`. + + `Pods` + +The **--uidmap** option cannot be called in conjunction with the **--pod** option as a uidmap cannot be set on the container level when in a pod. + +[//]: # (END included file options/uidmap.container.md) + + +[//]: # (BEGIN included file options/ulimit.md) +#### **--ulimit**=*option* + +Ulimit options. Sets the ulimits values inside of the container. + +--ulimit with a soft and hard limit in the format =[:]. For example: + +$ podman run --ulimit nofile=1024:1024 --rm ubi9 ulimit -n +1024 + +Set -1 for the soft or hard limit to set the limit to the maximum limit of the current +process. In rootful mode this is often unlimited. + + +If nofile and nproc are unset, a default value of 1048576 will be used, unless overridden +in containers.conf(5). However, if the default value exceeds the hard limit for the current +rootless user, the current hard limit will be applied instead. + +Use **host** to copy the current configuration from the host. + +Don't use nproc with the ulimit flag as Linux uses nproc to set the +maximum number of processes available to a user, not to a container. + +Use the --pids-limit option to modify the cgroup control to limit the number +of processes within a container. + +[//]: # (END included file options/ulimit.md) + + +[//]: # (BEGIN included file options/umask.md) +#### **--umask**=*umask* + +Set the umask inside the container. Defaults to `0022`. +Remote connections use local containers.conf for defaults + +[//]: # (END included file options/umask.md) + + +[//]: # (BEGIN included file options/unsetenv.md) +#### **--unsetenv**=*env* + +Unset default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. + +[//]: # (END included file options/unsetenv.md) + + +[//]: # (BEGIN included file options/unsetenv-all.md) +#### **--unsetenv-all** + +Unset all default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. + +[//]: # (END included file options/unsetenv-all.md) + + +[//]: # (BEGIN included file options/user.md) +#### **--user**, **-u**=*user[\:group]* + +Sets the username or UID used and, optionally, the groupname or GID for the specified command. Both *user* and *group* may be symbolic or numeric. + +Without this argument, the command runs as the user specified in the container image. Unless overridden by a `USER` command in the Containerfile or by a value passed to this option, this user generally defaults to root. + +When a user namespace is not in use, the UID and GID used within the container and on the host match. When user namespaces are in use, however, the UID and GID in the container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container by default corresponds to the UID and GID of the user invoking Podman. + +[//]: # (END included file options/user.md) + + +[//]: # (BEGIN included file options/userns.container.md) +#### **--userns**=*mode* + +Set the user namespace mode for the container. + +If `--userns` is not set, the default value is determined as follows. +- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used. +- If the environment variable **PODMAN_USERNS** is set its value is used. +- If `userns` is specified in `containers.conf` this value is used. +- Otherwise, `--userns=host` is assumed. + +`--userns=""` (i.e., an empty string) is an alias for `--userns=host`. + +This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +------------------------|-----------|--------------------- +auto | $UID | nil (Host User UID is not mapped into container.) +host | $UID | 0 (Default User account mapped to root user in container.) +keep-id | $UID | $UID (Map user account to same UID within container.) +keep-id\:uid=200,gid=210 | $UID | 200:210 (Map user account to specified UID, GID value within container.) +nomap | $UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + +**auto**[\:_OPTIONS,..._]: automatically create a unique user namespace. + +* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. + + Example: `containers:2147483647:2147483648`. + +* `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5). + +Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user IDs. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. + +The option `--userns=keep-id` uses all the subuids and subgids of the user. +The option `--userns=nomap` uses all the subuids and subgids of the user except the user's own ID. +Using `--userns=auto` when starting new containers does not work as long as any containers exist that were started with `--userns=nomap` or `--userns=keep-id` without limiting the user namespace size. + + Valid `auto` options: + + - *gidmapping*=_CONTAINER\_GID\:HOST\_GID\:SIZE_: to force a GID mapping to be present in the user namespace. + - *size*=_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates a size for the user namespace. + - *uidmapping*=_CONTAINER\_UID\:HOST\_UID\:SIZE_: to force a UID mapping to be present in the user namespace. + +The host UID and GID in *gidmapping* and *uidmapping* can optionally be prefixed with the `@` symbol. +In this case, podman will look up the intermediate ID corresponding to host ID and it will map the found intermediate ID to the container id. +For details see **--uidmap**. + +**container:**_id_: join the user namespace of the specified container. + +**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user. + +**keep-id**: creates a user namespace where the current user's UID\:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace. + + Valid `keep-id` options: + + - *uid*=UID: override the UID inside the container that is used to map the current user to. + - *gid*=GID: override the GID inside the container that is used to map the current user to. + - *size*=SIZE: override the size of the configured user namespace. It is useful to not saturate all the available IDs. Not supported when running as root. + +**nomap**: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +**ns:**_namespace_: run the container in the given existing user namespace. + +[//]: # (END included file options/userns.container.md) + + +[//]: # (BEGIN included file options/uts.container.md) +#### **--uts**=*mode* + +Set the UTS namespace mode for the container. The following values are supported: + +- **host**: use the host's UTS namespace inside the container. +- **private**: create a new namespace for the container (default). +- **ns:[path]**: run the container in the given existing UTS namespace. +- **container:[container]**: join the UTS namespace of the specified container. + +[//]: # (END included file options/uts.container.md) + + +[//]: # (BEGIN included file options/variant.container.md) +#### **--variant**=*VARIANT* + +Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. + +[//]: # (END included file options/variant.container.md) + + +[//]: # (BEGIN included file options/volume.md) +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the container is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +container. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a container is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the container, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the container. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system +might prevent the processes running inside the container from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the container context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +containers share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label Only the current container can use a private +volume. Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any of one the containers. Relabeling walks +the file system under the volume and changes the label on each file, if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the container. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually change with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the container. +For example if a user wanted to volume mount their entire home directory into a +container, they need to disable SELinux separation. + + $ podman run --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The container processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous container executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the container +to work. + +Do not modify the source directory mounted into the container with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the container are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the container +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +container, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +container. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the container. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the container. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless container fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/volume.md) + +Use the **--group-add keep-groups** option to pass the user's supplementary group access into the container. + + +[//]: # (BEGIN included file options/volumes-from.md) +#### **--volumes-from**=*CONTAINER[\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +container. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target container, then the volume hides +that data on the target. + +[//]: # (END included file options/volumes-from.md) + + +[//]: # (BEGIN included file options/workdir.md) +#### **--workdir**, **-w**=*dir* + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (**/**). +The image developer can set a different default with the WORKDIR instruction. The operator +can override the working directory by using the **-w** option. + +[//]: # (END included file options/workdir.md) + +## Exit Status + +The exit code from **podman run** gives information about why the container +failed to run or why it exited. When **podman run** exits with a non-zero code, +the exit codes follow the **chroot**(1) standard, see below: + + **125** The error is with Podman itself + + $ podman run --foo busybox; echo $? + Error: unknown flag: --foo + 125 + + **126** The _contained command_ cannot be invoked + + $ podman run busybox /etc; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error + 126 + + **127** The _contained command_ cannot be found + + $ podman run busybox foo; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error + 127 + + **Exit code** _contained command_ exit code + + $ podman run busybox /bin/sh -c 'exit 3'; echo $? + 3 + +## EXAMPLES + +### Running container in read-only mode + +During container image development, containers often need to write to the image +content. Installing packages into _/usr_, for example. In production, +applications seldom need to write to the image. Container applications write +to volumes if they need to write to file systems at all. Applications can be +made more secure by running them in read-only mode using the **--read-only** switch. +This protects the container's image from modification. By default read-only +containers can write to temporary data. Podman mounts a tmpfs on _/run_ and +_/tmp_ within the container. + +``` +$ podman run --read-only -i -t fedora /bin/bash +``` + +If the container does not write to any file +system within the container, including tmpfs, set --read-only-tmpfs=false. +``` +$ podman run --read-only --read-only-tmpfs=false --tmpfs /run -i -t fedora /bin/bash +``` + +### Exposing shared libraries inside of container as read-only using a glob + +``` +$ podman run --mount type=glob,src=/usr/lib64/libnvidia\*,ro=true -i -t fedora /bin/bash +``` + +### Exposing log messages from the container to the host's log + +Bind mount the _/dev/log_ directory to have messages that are logged in the container show up in the host's +syslog/journal. + +``` +$ podman run -v /dev/log:/dev/log -i -t fedora /bin/bash +``` + +From inside the container test this by sending a message to the log. + +``` +(bash)# logger "Hello from my container" +``` + +Then exit and check the journal. + +``` +(bash)# exit + +$ journalctl -b | grep Hello +``` + +This lists the message sent to the logger. + +### Attaching to one or more from STDIN, STDOUT, STDERR + +Without specifying the **-a** option, Podman attaches everything (stdin, stdout, stderr). +Override the default by specifying -a (stdin, stdout, stderr), as in: + +``` +$ podman run -a stdin -a stdout -i -t fedora /bin/bash +``` + +### Sharing IPC between containers + +Using **shm_server.c** available here: https://www.cs.cf.ac.uk/Dave/C/node27.html + +Testing **--ipc=host** mode: + +Host shows a shared memory segment with 7 pids attached, happens to be from httpd: + +``` +$ sudo ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +0x01128e25 0 root 600 1000 7 +``` + +Now run a regular container, and it correctly does NOT see the shared memory segment from the host: + +``` +$ podman run -it shm ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +``` + +Run a container with the new **--ipc=host** option, and it now sees the shared memory segment from the host httpd: + +``` +$ podman run -it --ipc=host shm ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +0x01128e25 0 root 600 1000 7 +``` +Testing **--ipc=container:**_id_ mode: + +Start a container with a program to create a shared memory segment: +``` +$ podman run -it shm bash +$ sudo shm/shm_server & +$ sudo ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +0x0000162e 0 root 666 27 1 +``` +Create a 2nd container correctly shows no shared memory segment from 1st container: +``` +$ podman run shm ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +``` + +Create a 3rd container using the **--ipc=container:**_id_ option, now it shows the shared memory segment from the first: + +``` +$ podman run -it --ipc=container\:ed735b2264ac shm ipcs -m +$ sudo ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +0x0000162e 0 root 666 27 1 +``` + +### Mapping Ports for External Usage + +The exposed port of an application can be mapped to a host port using the **-p** +flag. For example, an httpd port 80 can be mapped to the host port 8080 using the +following: + +``` +$ podman run -p 8080:80 -d -i -t fedora/httpd +``` + +### Mounting External Volumes + +To mount a host directory as a container volume, specify the absolute path to +the directory and the absolute path for the container directory separated by a +colon. If the source is a named volume maintained by Podman, it is recommended to +use its name rather than the path to the volume. Otherwise the volume is +considered an orphan and wiped by the **podman volume prune** command: + +``` +$ podman run -v /var/db:/data1 -i -t fedora bash + +$ podman run -v data:/data2 -i -t fedora bash + +$ podman run -v /var/cache/dnf:/var/cache/dnf\:O -ti fedora dnf -y update +``` + +If the container needs a writeable mounted volume by a non root user inside the container, use the **U** option. This option tells Podman to chown the source volume to match the default UID and GID used within the container. +``` +$ podman run -d -e MARIADB_ROOT_PASSWORD=root --user mysql --userns=keep-id -v ~/data:/var/lib/mysql:Z,U mariadb +``` + +Alternatively if the container needs a writable volume by a non root +user inside of the container, the --userns=keep-id option allows users to +specify the UID and GID of the user executing Podman to specific UIDs and GIDs +within the container. Since the processes running in the container run as the user's UID, they can read/write files owned by the user. +``` +$ podman run -d -e MARIADB_ROOT_PASSWORD=root --user mysql --userns=keep-id\:uid=999,gid=999 -v ~/data:/var/lib/mysql\:Z mariadb +``` + +Using **--mount** flags to mount a host directory as a container folder, specify +the absolute path to the directory or the volume name, and the absolute path +within the container directory: + +```` +$ podman run --mount type=bind,src=/var/db,target=/data1 busybox sh + +$ podman run --mount type=bind,src=volume-name,target=/data1 busybox sh +```` + +When using SELinux, be aware that the host has no knowledge of container SELinux +policy. Therefore, in the above example, if SELinux policy is enforced, the +_/var/db_ directory is not writable to the container. A "Permission Denied" +message occurs, and an **avc:** message is added to the host's syslog. + +To work around this, at time of writing this man page, the following command +needs to be run in order for the proper SELinux policy type label to be attached +to the host directory: + +``` +$ chcon -Rt svirt_sandbox_file_t /var/db +``` + +Now, writing to the _/data1_ volume in the container is allowed and the +changes are reflected on the host in _/var/db_. + +### Using alternative security labeling + +Override the default labeling scheme for each container by specifying +the **--security-opt** flag. For example, specify the MCS/MLS level, a +requirement for MLS systems. Specifying the level in the following command +allows the same content to be shared between containers. + +``` +podman run --security-opt label=level\:s0:c100,c200 -i -t fedora bash +``` + +An MLS example might be: + +``` +$ podman run --security-opt label=level\:TopSecret -i -t rhel7 bash +``` + +To disable the security labeling for this container versus running with the +#### **--permissive** flag, use the following command: + +``` +$ podman run --security-opt label=disable -i -t fedora bash +``` + +Tighten the security policy on the processes within a container by specifying an +alternate type for the container. For example, run a container +that is only allowed to listen on Apache ports by executing the following +command: + +``` +$ podman run --security-opt label=type\:svirt_apache_t -i -t centos bash +``` + +Note that an SELinux policy defining a **svirt_apache_t** type must be written. + +To mask additional specific paths in the container, specify the paths +separated by a colon using the **mask** option with the **--security-opt** +flag. + +``` +$ podman run --security-opt mask=/foo/bar:/second/path fedora bash +``` + +To unmask all the paths that are masked by default, set the **unmask** option to +**ALL**. Or to only unmask specific paths, specify the paths as shown above with +the **mask** option. + +``` +$ podman run --security-opt unmask=ALL fedora bash +``` + +To unmask all the paths that start with /proc, set the **unmask** option to +**/proc/***. + +``` +$ podman run --security-opt unmask=/proc/* fedora bash +``` + +``` +$ podman run --security-opt unmask=/foo/bar:/sys/firmware fedora bash +``` + +### Setting device weight via **--blkio-weight-device** flag. + +``` +$ podman run -it --blkio-weight-device "/dev/sda:200" ubuntu +``` + +### Using a podman container with input from a pipe + +``` +$ echo "asdf" | podman run --rm -i --entrypoint /bin/cat someimage +asdf +``` + +### Setting automatic user namespace separated containers + +``` +# podman run --userns=auto\:size=65536 ubi8-micro cat /proc/self/uid_map +0 2147483647 65536 +# podman run --userns=auto\:size=65536 ubi8-micro cat /proc/self/uid_map +0 2147549183 65536 +``` + +### Setting Namespaced Kernel Parameters (Sysctls) + +The **--sysctl** sets namespaced kernel parameters (sysctls) in the +container. For example, to turn on IP forwarding in the containers +network namespace, run this command: + +``` +$ podman run --sysctl net.ipv4.ip_forward=1 someimage +``` + +Note that not all sysctls are namespaced. Podman does not support changing sysctls +inside of a container that also modify the host system. As the kernel +evolves we expect to see more sysctls become namespaced. + +See the definition of the **--sysctl** option above for the current list of +supported sysctls. + +### Set UID/GID mapping in a new user namespace + +Running a container in a new user namespace requires a mapping of +the UIDs and GIDs from the host. + +``` +$ podman run --uidmap 0:30000:7000 --gidmap 0:30000:7000 fedora echo hello +``` + +### Configuring Storage Options from the command line + +Podman allows for the configuration of storage by changing the values +in the _/etc/container/storage.conf_ or by using global options. This +shows how to set up and use fuse-overlayfs for a one-time run of busybox +using global options. + +``` +podman --log-level=debug --storage-driver overlay --storage-opt "overlay.mount_program=/usr/bin/fuse-overlayfs" run busybox /bin/sh +``` + +### Configure timezone in a container + +``` +$ podman run --tz=local alpine date +$ podman run --tz=Asia/Shanghai alpine date +$ podman run --tz=US/Eastern alpine date +``` + +### Adding dependency containers + +The first container, container1, is not started initially, but must be running before container2 starts. +The `podman run` command starts the container automatically before starting container2. + +``` +$ podman create --name container1 -t -i fedora bash +$ podman run --name container2 --requires container1 -t -i fedora bash +``` + +Multiple containers can be required. + +``` +$ podman create --name container1 -t -i fedora bash +$ podman create --name container2 -t -i fedora bash +$ podman run --name container3 --requires container1,container2 -t -i fedora bash +``` + +### Configure keep supplemental groups for access to volume + +``` +$ podman run -v /var/lib/design:/var/lib/design --group-add keep-groups ubi8 +``` + +### Configure execution domain for containers using personality flag + +``` +$ podman run --name container1 --personality=LINUX32 fedora bash +``` + +### Run a container with external rootfs mounted as an overlay + +``` +$ podman run --name container1 --rootfs /path/to/rootfs:O bash +``` + +### Handling Timezones in java applications in a container. + +In order to use a timezone other than UTC when running a +Java application within a container, the `TZ` environment variable must be +set within the container. Java applications ignores the value set with the +`--tz` option. + +``` +# Example run +podman run -ti --rm -e TZ=EST mytzimage +lrwxrwxrwx. 1 root root 29 Nov 3 08:51 /etc/localtime -> ../usr/share/zoneinfo/Etc/UTC +Now with default timezone: +Fri Nov 19 18:10:55 EST 2021 +Java default sees the following timezone: +2021-11-19T18:10:55.651130-05:00 +Forcing UTC: +Fri Nov 19 23:10:55 UTC 2021 +``` + +### Run a container connected to two networks (called net1 and net2) with a static ip + +``` +$ podman run --network net1\:ip=10.89.1.5 --network net2\:ip=10.89.10.10 alpine ip addr +``` + +### Rootless Containers + +Podman runs as a non-root user on most systems. This feature requires that a new enough version of **shadow-utils** +be installed. The **shadow-utils** package must include the **newuidmap**(1) and **newgidmap**(1) executables. + +In order for users to run rootless, there must be an entry for their username in _/etc/subuid_ and _/etc/subgid_ which lists the UIDs for their user namespace. + +Rootless Podman works better if the fuse-overlayfs and slirp4netns packages are installed. +The **fuse-overlayfs** package provides a userspace overlay storage driver, otherwise users need to use +the **vfs** storage driver, which can be disk space expensive and less +performant than other drivers. + +To enable VPN on the container, slirp4netns or pasta needs to be specified; +without either, containers need to be run with the --network=host flag. + +## ENVIRONMENT + +Environment variables within containers can be set using multiple different options, +in the following order of precedence (later entries override earlier entries): + +- Container image: Any environment variables specified in the container image. +- **--http-proxy**: By default, several environment variables are passed in from the host, such as **http_proxy** and **no_proxy**. See **--http-proxy** for details. +- **--env-host**: Host environment of the process executing Podman is added. +- **--env-file**: Any environment variables specified via env-files. If multiple files are specified, then they override each other in order of entry. +- **--env**: Any environment variables specified overrides previous settings. + +Run containers and set the environment ending with a __*__. +The trailing __*__ glob functionality is only active when no value is specified: + +``` +$ export ENV1=a +$ podman run --env 'ENV*' alpine env | grep ENV +ENV1=a +$ podman run --env 'ENV*=b' alpine env | grep ENV +ENV*=b +``` + +## CONMON + +When Podman starts a container it actually executes the conmon program, which +then executes the OCI Runtime. Conmon is the container monitor. It is a small +program whose job is to watch the primary process of the container, and if the +container dies, save the exit code. It also holds open the tty of the +container, so that it can be attached to later. This is what allows Podman to +run in detached mode (backgrounded), so Podman can exit but conmon continues to +run. Each container has their own instance of conmon. Conmon waits for the +container to exit, gathers and saves the exit code, and then launches a Podman +process to complete the container cleanup, by shutting down the network and +storage. For more information about conmon, see the conmon(8) man +page. + +## FILES + +**/etc/subuid** + +**/etc/subgid** + +NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-save(1)](podman-save.1.md)**, **[podman-ps(1)](podman-ps.1.md)**, **[podman-attach(1)](podman-attach.1.md)**, **[podman-pod-create(1)](podman-pod-create.1.md)**, **[podman-port(1)](podman-port.1.md)**, **[podman-start(1)](podman-start.1.md)**, **[podman-kill(1)](podman-kill.1.md)**, **[podman-stop(1)](podman-stop.1.md)**, **[podman-generate-systemd(1)](podman-generate-systemd.1.md)**, **[podman-rm(1)](podman-rm.1.md)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)**, **[setsebool(8)](https://man7.org/linux/man-pages/man8/setsebool.8.html)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, **[pasta(1)](https://passt.top/builds/latest/web/passt.1.html)**, **[fuse-overlayfs(1)](https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md)**, **proc(5)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)**, **personality(2)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +See [podman-rootless(7)](https://github.com/containers/podman/blob/main/rootless.md) +for rootless issues. + +## HISTORY +September 2018, updated by Kunal Kushwaha `` + +October 2017, converted from Docker documentation to Podman by Dan Walsh for Podman `` + +November 2015, updated by Sally O'Malley `` + +June 2014, updated by Sven Dowideit `` + +April 2014, Originally compiled by William Henry `` based on docker.com source material and internal work. + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a core value of open source. The `master` and `slave` mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately. diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-save.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-save.1.md new file mode 100644 index 000000000..7ffd4124b --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-save.1.md @@ -0,0 +1,107 @@ +--- +title: podman-save +version: v5.4.1 +--- + +% podman-save 1 + +## NAME +podman\-save - Save image(s) to an archive + +## SYNOPSIS +**podman save** [*options*] *name*[:*tag*] + +**podman image save** [*options*] *name*[:*tag*] + +## DESCRIPTION +**podman save** saves an image to a local file or directory. +**podman save** writes to STDOUT by default and can be redirected to a +file using the **output** flag. The **quiet** flag suppresses the output when set. +**podman save** saves parent layers of the image(s) and the image(s) can be loaded using **podman load**. +To export the containers, use the **podman export**. +Note: `:` is a restricted character and cannot be part of the file name. + +**podman [GLOBAL OPTIONS]** + +**podman save [GLOBAL OPTIONS]** + +**podman save [OPTIONS] NAME[\:TAG]** + +## OPTIONS + + +[//]: # (BEGIN included file options/dir-compress.md) +#### **--compress** + +Compress tarball image layers when pushing to a directory using the 'dir' transport. (default is same compression type, compressed or uncompressed, as source) + +[//]: # (END included file options/dir-compress.md) + +Note: This flag can only be set with **--format=docker-dir**. + +#### **--format**=*format* + +An image format to produce, one of: + +| Format | Description | +| ------------------ | ---------------------------------------------------------------------------- | +| **docker-archive** | A tar archive interoperable with **docker load(1)** (the default) | +| **oci-archive** | A tar archive using the OCI Image Format | +| **oci-dir** | A directory using the OCI Image Format | +| **docker-dir** | **dir** transport (see **containers-transports(5)**) with v2s2 manifest type | + +#### **--help**, **-h** + +Print usage statement + +#### **--multi-image-archive**, **-m** + +Allow for creating archives with more than one image. Additional names are interpreted as images instead of tags. Only supported for **--format=docker-archive**. +The default for this option can be modified via the `multi_image_archive="true"|"false"` flag in containers.conf. + +#### **--output**, **-o**=*file* + +Write to a file, default is STDOUT + +#### **--quiet**, **-q** + +Suppress the output + +#### **--uncompressed** + +Accept uncompressed layers when using one of the OCI formats. + +## EXAMPLES + +Save image to a local file without displaying progress. +``` +$ podman save --quiet -o alpine.tar alpine:2.6 +``` + +Save image to stdout and redirect content via shell. +``` +$ podman save alpine > alpine-all.tar +``` + +Save image in oci-archive format to the local file. +``` +$ podman save -o oci-alpine.tar --format oci-archive alpine +``` + +Save image compressed in docker-dir format. +``` +$ podman save --compress --format docker-dir -o alp-dir alpine +Getting image source signatures +Copying blob sha256:2fdfe1cd78c20d05774f0919be19bc1a3e4729bce219968e4188e7e0f1af679d + 1.97 MB / 1.97 MB [========================================================] 0s +Copying config sha256:501d1a8f0487e93128df34ea349795bc324d5e0c0d5112e08386a9dfaff620be + 584 B / 584 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-load(1)](podman-load.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** + +## HISTORY +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-search.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-search.1.md new file mode 100644 index 000000000..e4123b8c8 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-search.1.md @@ -0,0 +1,191 @@ +--- +title: podman-search +version: v5.4.1 +--- + +% podman-search 1 + +## NAME +podman\-search - Search a registry for an image + +## SYNOPSIS +**podman search** [*options*] *term* + +## DESCRIPTION +**podman search** searches a registry or a list of registries for a matching image. +The user can specify which registry to search by prefixing the registry in the search term +(e.g., **registry.fedoraproject.org/fedora**). By default, all +unqualified-search registries in `containers-registries.conf(5)` are used. + +The default number of results is 25. The number of results can be limited using the **--limit** flag. +If more than one registry is being searched, the limit is applied to each registry. The output can be filtered +using the **--filter** flag. To get all available images in a registry without a specific +search term, the user can just enter the registry name with a trailing "/" (example **registry.fedoraproject.org/**). + +Note that **podman search** is not a reliable way to determine the presence or existence of an image. +The search behavior of the v1 and v2 Docker distribution API is specific to the implementation of each registry. +Some registries may not support searching at all. +Further note that searching without a search term only works for registries that implement the v2 API. + +**podman [GLOBAL OPTIONS]** + +**podman search [GLOBAL OPTIONS]** + +**podman search [OPTIONS] TERM** + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + +#### **--compatible** + +After the name and the description, also show the stars, official and automated descriptors as Docker does. +Podman does not show these descriptors by default since they are not supported by most public container registries. + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + +#### **--filter**, **-f**=*filter* + +Filter output based on conditions provided (default []) + +Supported filters are: + +* stars (int) - minimum number of stars required for images to show +* is-automated (boolean - true | false) - is the image automated or not +* is-official (boolean - true | false) - is the image official or not + +#### **--format**=*format* + +Change the output format to a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| --------------- | ---------------------------- | +| .Automated | "[OK]" if image is automated | +| .Description | Image description | +| .Index | Registry | +| .Name | Image name | +| .Official | "[OK]" if image is official | +| .Stars | Star count of image | +| .Tag | Repository tag | + +Note: use .Tag only if the --list-tags is set. + +#### **--help**, **-h** + +Print usage statement + +#### **--limit**=*limit* + +Limit the number of results (default 25). +Note: The results from each registry is limited to this value. +Example if limit is 10 and two registries are being searched, the total +number of results is 20, 10 from each (if there are at least 10 matches in each). +The order of the search results is the order in which the API endpoint returns the results. + +#### **--list-tags** + +List the available tags in the repository for the specified image. +**Note:** --list-tags requires the search term to be a fully specified image name. +The result contains the Image name and its tag, one line for every tag associated with the image. + +#### **--no-trunc** + +Do not truncate the output (default *false*). + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Search for images containing the specified name, returning the first three images from each defined registry. +``` +$ podman search --limit 3 fedora +NAME DESCRIPTION +NAME DESCRIPTION +registry.fedoraproject.org/f29/fedora-toolbox +registry.fedoraproject.org/f30/fedora-toolbox +registry.fedoraproject.org/f31/fedora-toolbox +docker.io/library/fedora Official Docker builds of Fedora +docker.io/kasmweb/fedora-37-desktop Fedora 37 desktop for Kasm Workspaces +docker.io/kasmweb/fedora-38-desktop Fedora 38 desktop for Kasm Workspaces +quay.io/fedora/fedora +quay.io/containerdisks/fedora # Fedora Containerdisk Images diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-secret-create.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-secret-create.1.md new file mode 100644 index 000000000..5dfb29e28 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-secret-create.1.md @@ -0,0 +1,112 @@ +--- +title: podman-secret-create +version: v5.4.1 +--- + +% podman-secret-create 1 + +## NAME +podman\-secret\-create - Create a new secret + +## SYNOPSIS +**podman secret create** [*options*] *name* *file|-* + +## DESCRIPTION + +Creates a secret using standard input or from a file for the secret content. + +Create accepts a path to a file, or `-`, which tells podman to read the secret from stdin + +A secret is a blob of sensitive data which a container needs at runtime but +is not stored in the image or in source control, such as usernames and passwords, +TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 500 kb in size). + +Secrets are not committed to an image with `podman commit`, and does not get committed in the archive created by a `podman export` command. + +Secrets can also be used to store passwords for `podman login` to authenticate against container registries. + +## OPTIONS + +#### **--driver**, **-d**=*driver* + +Specify the secret driver (default **file**). + +#### **--driver-opts**=*key1=val1,key2=val2* + +Specify driver specific options. + +#### **--env**=*false* + +Read secret data from environment variable. + +#### **--help** + +Print usage statement. + +#### **--label**, **-l**=*key=val1,key2=val2* + +Add label to secret. These labels can be viewed in podman secrete inspect or ls. + +#### **--replace**=*false* + +If existing secret with the same name already exists, update the secret. +The `--replace` option does not change secrets within existing containers, only newly created containers. + The default is **false**. + +## SECRET DRIVERS + +#### file + +Secret resides in a read-protected file. + +#### pass + +Secret resides in a GPG-encrypted file. + +#### shell + +Secret is managed by custom scripts. An environment variable **SECRET_ID** +is passed to the scripts (except for **list**), and secrets are communicated +via stdin/stdout (where applicable). Driver options **list**, **lookup**, +**store**, and **delete** serve to install the scripts: + +``` +[secrets] +driver = "shell" + +[secrets.opts] +list = +lookup = +store = +delete = +``` + +## EXAMPLES + +Create the specified secret based on local file. +``` +echo -n mysecret > ./secret.txt +$ podman secret create my_secret ./secret.txt +``` + +Create the specified secret via stdin. +``` +$ printf | podman secret create my_secret - +``` + +Create gpg encrypted secret based on local file using the pass driver. +``` +$ podman secret create --driver=pass my_secret ./secret.txt.gpg +``` + +Create a secret from an environment variable called 'MYSECRET'. +``` +$ podman secret create --env=true my_secret MYSECRET +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)**, **[podman-login(1)](podman-login.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui +February 2024, Added example showing secret creation from an environment variable by Brett Calliss diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-secret-exists.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-secret-exists.1.md new file mode 100644 index 000000000..d9de36f8f --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-secret-exists.1.md @@ -0,0 +1,48 @@ +--- +title: podman-secret-exists +version: v5.4.1 +--- + +% podman-secret-exists 1 + +## NAME +podman\-secret\-exists - Check if the given secret exists + +## SYNOPSIS +**podman secret exists** *secret* + +## DESCRIPTION +**podman secret exists** checks if a secret exists. Podman returns an exit code +of `0` when the secret is found. A `1` is returned otherwise. An exit code of +`125` indicates there was another issue. + + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLE + +Check if a secret called `mysecret` exists (the secret does actually exist). +``` +$ podman secret exists mysecret +$ echo $? +0 +$ +``` + +Check if a secret called `mypassword` exists (the secret does not actually exist). +``` +$ podman secret exists mypassword +$ echo $? +1 +$ +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)** + +## HISTORY +April 2023, Originally compiled by Ygal Blum `` diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-secret-inspect.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-secret-inspect.1.md new file mode 100644 index 000000000..d353b59e7 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-secret-inspect.1.md @@ -0,0 +1,73 @@ +--- +title: podman-secret-inspect +version: v5.4.1 +--- + +% podman-secret-inspect 1 + +## NAME +podman\-secret\-inspect - Display detailed information on one or more secrets + +## SYNOPSIS +**podman secret inspect** [*options*] *secret* [...] + +## DESCRIPTION + +Inspects the specified secret. + +By default, this renders all results in a JSON array. If a format is specified, the given template is executed for each result. +Secrets can be queried individually by providing their full name or a unique partial name. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Format secret output using Go template. + +| **Placeholder** | **Description** | +|--------------------------|-------------------------------------------------------------------| +| .CreatedAt ... | When secret was created (relative timestamp, human-readable) | +| .ID | ID of secret | +| .SecretData | Secret Data (Displayed only with --showsecret option) | +| .Spec ... | Details of secret | +| .Spec.Driver ... | Driver info | +| .Spec.Driver.Name | Driver name (string) | +| .Spec.Driver.Options ... | Driver options (map of driver-specific options) | +| .Spec.Labels ... | Labels for this secret | +| .Spec.Name | Name of secret | +| .UpdatedAt ... | When secret was last updated (relative timestamp, human-readable) | + +#### **--help** + +Print usage statement. + +#### **--pretty** + +Print inspect output in human-readable format + +#### **--showsecret** + +Display secret data + +## EXAMPLES + +Inspect the secret mysecret. +``` +$ podman secret inspect mysecret +``` + +Inspect the secret mysecret and display the Name and Labels field. +``` +$ podman secret inspect --format "{{.Spec.Name}} {{.Spec.Labels}}" mysecret +``` + +Inspect the secret mysecret and display the Name and SecretData fields. Note this will display the secret data to the screen. +``` +$ podman secret inspect --showsecret --format "{{.Spec.Name}} {{.SecretData}}" mysecret +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-secret-ls.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-secret-ls.1.md new file mode 100644 index 000000000..2233c9ae6 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-secret-ls.1.md @@ -0,0 +1,84 @@ +--- +title: podman-secret-ls +version: v5.4.1 +--- + +% podman-secret-ls 1 + +## NAME +podman\-secret\-ls - List all available secrets + +## SYNOPSIS +**podman secret ls** [*options*] + +## DESCRIPTION + +Lists all the secrets that exist. The output can be formatted to a Go template using the **--format** option. + +## OPTIONS + +#### **--filter**, **-f**=*filter=value* + +Filter output based on conditions given. +Multiple filters can be given with multiple uses of the --filter option. + +Valid filters are listed below: + +| **Filter** | **Description** | +| ---------- | ----------------------------------------------------------------- | +| name | [Name] Secret name (accepts regex) | +| id | [ID] Full or partial secret ID | + +#### **--format**=*format* + +Format secret output using Go template. + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------------ | ----------------------------------------------------------------- | +| .CreatedAt ... | When secret was created (relative timestamp, human-readable) | +| .ID | ID of secret | +| .SecretData | Secret Data (Displayed only with --showsecret option) | +| .Spec ... | Details of secret | +| .Spec.Driver ... | Driver info | +| .Spec.Driver.Name | Driver name (string) | +| .Spec.Driver.Options ... | Driver options (map of driver-specific options) | +| .Spec.Labels ... | Labels for this secret | +| .Spec.Name | Name of secret | +| .UpdatedAt ... | When secret was last updated (relative timestamp, human-readable) | + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Print secret IDs only. + +## EXAMPLES + +List all secrets. +``` +$ podman secret ls +``` + +List the name field of all secrets. +``` +$ podman secret ls --format "{{.Name}}" +``` + +List all secrets whose name includes the specified string. +``` +$ podman secret ls --filter name=confidential +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-secret-rm.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-secret-rm.1.md new file mode 100644 index 000000000..d9ec6798a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-secret-rm.1.md @@ -0,0 +1,48 @@ +--- +title: podman-secret-rm +version: v5.4.1 +--- + +% podman-secret-rm 1 + +## NAME +podman\-secret\-rm - Remove one or more secrets + +## SYNOPSIS +**podman secret rm** [*options*] *secret* [...] + +## DESCRIPTION + +Removes one or more secrets. + +`podman secret rm` is safe to use on secrets that are in use by a container. +The created container has access to the secret data because secrets are +copied and mounted into the container when a container is created. If a secret is deleted and +another secret is created with the same name, the secret inside the container does not change; +the old secret value still remains. + +## OPTIONS + +#### **--all**, **-a** + +Remove all existing secrets. + +#### **--help** + +Print usage statement. + +#### **--ignore**, **-i** +Ignore errors when specified secrets are not present. + +## EXAMPLES + +Remove secrets mysecret1 and mysecret2. +``` +$ podman secret rm mysecret1 mysecret2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-secret.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-secret.1.md new file mode 100644 index 000000000..6ec024f3a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-secret.1.md @@ -0,0 +1,31 @@ +--- +title: podman-secret +version: v5.4.1 +--- + +% podman-secret 1 + +## NAME +podman\-secret - Manage podman secrets + +## SYNOPSIS +**podman secret** *subcommand* + +## DESCRIPTION +podman secret is a set of subcommands that manage secrets. + +## SUBCOMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------------ | ------------------------------------------------------ | +| create | [podman-secret-create(1)](podman-secret-create.1.md) | Create a new secret | +| exists | [podman-secret-exists(1)](podman-secret-exists.1.md) | Check if the given secret exists | +| inspect | [podman-secret-inspect(1)](podman-secret-inspect.1.md) | Display detailed information on one or more secrets | +| ls | [podman-secret-ls(1)](podman-secret-ls.1.md) | List all available secrets | +| rm | [podman-secret-rm(1)](podman-secret-rm.1.md) | Remove one or more secrets | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-start.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-start.1.md new file mode 100644 index 000000000..23d4f9525 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-start.1.md @@ -0,0 +1,127 @@ +--- +title: podman-start +version: v5.4.1 +--- + +% podman-start 1 + +## NAME +podman\-start - Start one or more containers + +## SYNOPSIS +**podman start** [*options*] *container* ... + +**podman container start** [*options*] *container* ... + +## DESCRIPTION +Start one or more containers using container IDs or names as input. The *attach* and *interactive* +options cannot be used to override the *--tty* and *--interactive* options from when the container +was created. Starting an already running container with the *--attach* option, Podman simply +attaches to the container. + +## OPTIONS + +#### **--all** + +Start all the containers, default is only running containers. + +#### **--attach**, **-a** + +Attach container's STDOUT and STDERR. The default is false. This option cannot be used when +starting multiple containers. + + +[//]: # (BEGIN included file options/detach-keys.md) +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. + +[//]: # (END included file options/detach-keys.md) + +#### **--filter**, **-f** + +Filter what containers are going to be started from the given arguments. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | + + +[//]: # (BEGIN included file options/interactive.md) +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. + +[//]: # (END included file options/interactive.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/sig-proxy.md) +#### **--sig-proxy** + +Proxy received signals to the container process. SIGCHLD, SIGURG, SIGSTOP, and SIGKILL are not proxied. + +[//]: # (END included file options/sig-proxy.md) + +The default is **true** when attaching, **false** otherwise. + +## EXAMPLE + +Start specified container: +``` +podman start mywebserver +``` + +Start multiple containers: +``` +podman start 860a4b231279 5421ab43b45 +``` + +Start specified container in interactive mode with terminal attached: +``` +podman start --interactive --attach 860a4b231279 +``` + +Start last created container in interactive mode (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman start -i -l +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +November 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-stats.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-stats.1.md new file mode 100644 index 000000000..fee2098ae --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-stats.1.md @@ -0,0 +1,164 @@ +--- +title: podman-stats +version: v5.4.1 +--- + +% podman-stats 1 + +## NAME +podman\-stats - Display a live stream of one or more container's resource usage statistics + +## SYNOPSIS +**podman stats** [*options*] [*container*] + +**podman container stats** [*options*] [*container*] + +## DESCRIPTION +Display a live stream of one or more containers' resource usage statistics + +Note: Podman stats does not work in rootless environments that use CGroups V1. +Podman stats relies on CGroup information for statistics, and CGroup v1 is not +supported for rootless use cases. + +Note: Rootless environments that use CGroups V2 are not able to report statistics +about their networking usage. + +## OPTIONS + +#### **--all**, **-a** + +Show all containers. Only running containers are shown by default + +#### **--format**=*template* + +Pretty-print container statistics to JSON or using a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|---------------------|--------------------------------------------------| +| .AvgCPU | Average CPU, full precision float | +| .AVGCPU | Average CPU, formatted as a percent | +| .BlockInput | Total data read from block device | +| .BlockIO | Total data read/total data written to block device| +| .BlockOutput | Total data written to block device | +| .ContainerID | Container ID, full (untruncated) hash | +| .ContainerStats ... | Nested structure, for experts only | +| .CPU | Percent CPU, full precision float | +| .CPUNano | CPU Usage, total, in nanoseconds | +| .CPUPerc | Percentage of CPU used | +| .CPUSystemNano | CPU Usage, kernel, in nanoseconds | +| .Duration | Same as CPUNano | +| .ID | Container ID, truncated | +| .MemLimit | Memory limit, in bytes | +| .MemPerc | Memory percentage used | +| .MemUsage | Memory usage | +| .MemUsageBytes | Memory usage (IEC) | +| .Name | Container Name | +| .NetIO | Network IO | +| .Network ... | Network I/O, separated by network interface | +| .PerCPU | CPU time consumed by all tasks [1] | +| .PIDs | Number of PIDs | +| .PIDS | Number of PIDs (yes, we know this is a dup) | +| .SystemNano | Current system datetime, nanoseconds since epoch | +| .Up | Duration (CPUNano), in human-readable form | +| .UpTime | Same as Up | + +[1] Cgroups V1 only + +When using a Go template, precede the format with `table` to print headers. + +#### **--interval**, **-i**=*seconds* + +Time in seconds between stats reports, defaults to 5 seconds. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/no-reset.md) +#### **--no-reset** + +Do not clear the terminal/screen in between reporting intervals + +[//]: # (END included file options/no-reset.md) + + +[//]: # (BEGIN included file options/no-stream.md) +#### **--no-stream** + +Disable streaming stats and only pull the first result, default setting is false + +[//]: # (END included file options/no-stream.md) + +#### **--no-trunc** + +Do not truncate output + +## EXAMPLE + +List statistics about all running containers without streaming mode: +``` +# podman stats -a --no-stream +ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS +a9f807ffaacd frosty_hodgkin -- 3.092MB / 16.7GB 0.02% -- / -- -- / -- 2 +3b33001239ee sleepy_stallman -- -- / -- -- -- / -- -- / -- -- +``` + +List the specified container's statistics in streaming mode: +``` +# podman stats a9f80 +ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS +a9f807ffaacd frosty_hodgkin -- 3.092MB / 16.7GB 0.02% -- / -- -- / -- 2 +``` + +List the specified statistics about the specified container in table format: +``` +$ podman stats --no-trunc 3667 --format 'table {{ .ID }} {{ .MemUsage }}' +ID MEM USAGE / LIMIT +3667c6aacb06aac2eaffce914c01736420023d56ef9b0f4cfe58b6d6a78b7503 49.15kB / 67.17GB +``` + +List the specified container statistics in JSON format: +``` +# podman stats --no-stream --format=json a9f80 +[ + { + "id": "a9f807ffaacd", + "name": "frosty_hodgkin", + "cpu_percent": "--", + "mem_usage": "3.092MB / 16.7GB", + "mem_percent": "0.02%", + "netio": "-- / --", + "blocki": "-- / --", + "pids": "2" + } +] +``` + +List the specified container statistics in table format: +``` +# podman stats --no-stream --format "table {{.ID}} {{.Name}} {{.MemUsage}}" 6eae +ID NAME MEM USAGE / LIMIT +6eae9e25a564 clever_bassi 3.031MB / 16.7GB +``` + +Note: When using a slirp4netns network with the rootlesskit port +handler, the traffic sent via the port forwarding is accounted to +the `lo` device. Traffic accounted to `lo` is not accounted in the +stats output. + + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +July 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-stop.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-stop.1.md new file mode 100644 index 000000000..c8198edcd --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-stop.1.md @@ -0,0 +1,141 @@ +--- +title: podman-stop +version: v5.4.1 +--- + +% podman-stop 1 + +## NAME +podman\-stop - Stop one or more running containers + +## SYNOPSIS +**podman stop** [*options*] *container* ... + +**podman container stop** [*options*] *container* ... + +## DESCRIPTION +Stops one or more containers using container IDs or names as input. The **--time** option +specifies the number of seconds to wait before forcibly stopping the container after the stop command +is issued to the container. The default is 10 seconds. By default, containers are stopped with SIGTERM +and then SIGKILL after the timeout. The SIGTERM default can be overridden by the image used to create the +container and also via command line when creating the container. + +## OPTIONS + +#### **--all**, **-a** + +Stop all running containers. This does not include paused containers. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and stop the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + +Command does not fail when *file* is missing and user specified --ignore. + +#### **--filter**, **-f**=*filter* + +Filter what containers are going to be stopped. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | + + +[//]: # (BEGIN included file options/ignore.md) +#### **--ignore**, **-i** + +Ignore errors when specified containers are not in the container store. A user +might have decided to manually remove a container which leads to a failure +during the ExecStop directive of a systemd service referencing that container. + +[//]: # (END included file options/ignore.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping the container. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +## EXAMPLES + +Stop the specified container via its name. +``` +$ podman stop mywebserver +``` + +Stop the container via its id. +``` +$ podman stop 860a4b235279 +``` + +Stop multiple containers. +``` +$ podman stop mywebserver 860a4b235279 +``` + +Stop the container identified in the cidfile. +``` +$ podman stop --cidfile /home/user/cidfile-1 +``` + +Stop the containers identified in the cidfiles. +``` +$ podman stop --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +Stop the specified container in 2 seconds. +``` +$ podman stop --time 2 860a4b235279 +``` + +Stop all running containers. +``` +$ podman stop -a +``` + +Stop the last created container (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman stop --latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-rm(1)](podman-rm.1.md)** + +## HISTORY +September 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-system-check.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-system-check.1.md new file mode 100644 index 000000000..bc44be371 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-system-check.1.md @@ -0,0 +1,64 @@ +--- +title: podman-system-check +version: v5.4.1 +--- + +% podman-system-check 1 + +## NAME +podman\-system\-check - Perform consistency checks on image and container storage + +## SYNOPSIS +**podman system check** [*options*] + +## DESCRIPTION +Perform consistency checks on image and container storage, reporting images and +containers which have identified issues. + +## OPTIONS + +#### **--force**, **-f** + +When attempting to remove damaged images, also remove containers which depend +on those images. By default, damaged images which are being used by containers +are left alone. + +Containers which depend on damaged images do so regardless of which engine +created them, but because podman only "knows" how to shut down containers that +it started, the effect on still-running containers which were started by other +engines is difficult to predict. + +#### **--max**, **-m**=*duration* + +When considering layers which are not used by any images or containers, assume +that any layers which are more than *duration* old are the results of canceled +attempts to pull images, and should be treated as though they are damaged. + +#### **--quick**, **-q** + +Skip checks which are known to be time-consuming. This will prevent some types +of errors from being detected. + +#### **--repair**, **-r** + +Remove any images which are determined to have been damaged in some way, unless +they are in use by containers. Use **--force** to remove containers which +depend on damaged images, and those damaged images, as well. + +## EXAMPLE + +A reasonably quick check: +``` +podman system check --quick --repair --force +``` + +A more thorough check: +``` +podman system check --repair --max=1h --force +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)** + +## HISTORY +April 2024 diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-system-connection-add.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-system-connection-add.1.md new file mode 100644 index 000000000..cdc8fa6ea --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-system-connection-add.1.md @@ -0,0 +1,69 @@ +--- +title: podman-system-connection-add +version: v5.4.1 +--- + +% podman-system-connection-add 1 + +## NAME +podman\-system\-connection\-add - Record destination for the Podman service + +## SYNOPSIS +**podman system connection add** [*options*] *name* *destination* + +## DESCRIPTION +Record ssh destination for remote podman service(s). The ssh destination is given as one of: + - [user@]hostname[:port] + - ssh://[user@]hostname[:port] + - unix://path + - tcp://hostname\\:port + +The user is prompted for the remote ssh login password or key file passphrase as required. The `ssh-agent` is supported if it is running. + +## OPTIONS + +#### **--default**, **-d** + +Make the new destination the default for this user. The default is **false**. + +#### **--identity**=*path* + +Path to ssh identity file. If the identity file has been encrypted, Podman prompts the user for the passphrase. +If no identity file is provided and no user is given, Podman defaults to the user running the podman command. +Podman prompts for the login password on the remote server. + +#### **--port**, **-p**=*port* + +Port for ssh destination. The default value is `22`. + +#### **--socket-path**=*path* + +Path to the Podman service unix domain socket on the ssh destination host + +## EXAMPLE + +Add a named system connection: +``` +$ podman system connection add QA podman.example.com +``` + +Add a system connection using SSH data: +``` +$ podman system connection add --identity ~/.ssh/dev_rsa production ssh://root@server.example.com:2222 +``` + +Add a named system connection to local Unix domain socket: +``` +$ podman system connection add testing unix:///run/podman/podman.sock +``` + +Add a named system connection to local tcp socket: +``` +$ podman system connection add debug tcp://localhost:8080 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + + +## HISTORY +June 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-system-connection-default.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-system-connection-default.1.md new file mode 100644 index 000000000..4c34976e8 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-system-connection-default.1.md @@ -0,0 +1,27 @@ +--- +title: podman-system-connection-default +version: v5.4.1 +--- + +% podman-system-connection-default 1 + +## NAME +podman\-system\-connection\-default - Set named destination as default for the Podman service + +## SYNOPSIS +**podman system connection default** *name* + +## DESCRIPTION +Set named ssh destination as default destination for the Podman service. + +## EXAMPLE + +Set the specified connection as default: +``` +$ podman system connection default production +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + +## HISTORY +July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-system-connection-list.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-system-connection-list.1.md new file mode 100644 index 000000000..1c2f65b0a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-system-connection-list.1.md @@ -0,0 +1,51 @@ +--- +title: podman-system-connection-list +version: v5.4.1 +--- + +% podman-system-connection-list 1 + +## NAME +podman\-system\-connection\-list - List the destination for the Podman service(s) + +## SYNOPSIS +**podman system connection list** [*options*] + +**podman system connection ls** [*options*] + +## DESCRIPTION +List ssh destination(s) for podman service(s). + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change the default output format. This can be of a supported type like 'json' or a Go template. +Valid placeholders for the Go template listed below: + +| **Placeholder** | **Description** | +| --------------- | ----------------------------------------------------------------------------- | +| .Default | Indicates whether connection is the default | +| .Identity | Path to file containing SSH identity | +| .Name | Connection Name/Identifier | +| .ReadWrite | Indicates if this connection can be modified using the system connection commands | +| .URI | URI to podman service. Valid schemes are ssh://[user@]*host*[\:port]*Unix domain socket*[?secure=True], unix://*Unix domain socket*, and tcp://localhost[:*port*] | + +#### **--quiet**, **-q** + +Only show connection names + +## EXAMPLE + +List system connections: +``` +$ podman system connection list +Name URI Identity Default ReadWrite +deva ssh://root@example.com:/run/podman/podman.sock ~/.ssh/id_rsa true true +devb ssh://user@example.com:/run/user/1000/podman/podman.sock ~/.ssh/id_rsa false true +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + +## HISTORY +July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-system-connection-remove.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-system-connection-remove.1.md new file mode 100644 index 000000000..14bde81f9 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-system-connection-remove.1.md @@ -0,0 +1,33 @@ +--- +title: podman-system-connection-remove +version: v5.4.1 +--- + +% podman-system-connection-remove 1 + +## NAME +podman\-system\-connection\-remove - Delete named destination + +## SYNOPSIS +**podman system connection remove** [*options*] *name* + +## DESCRIPTION +Delete named ssh destination. + +## OPTIONS + +#### **--all**, **-a** + +Remove all connections. + +## EXAMPLE + +Remove the specified system connection: +``` +$ podman system connection remove production +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + +## HISTORY +July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-system-connection-rename.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-system-connection-rename.1.md new file mode 100644 index 000000000..7caf8e8eb --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-system-connection-rename.1.md @@ -0,0 +1,27 @@ +--- +title: podman-system-connection-rename +version: v5.4.1 +--- + +% podman-system-connection-rename 1 + +## NAME +podman\-system\-connection\-rename - Rename the destination for Podman service + +## SYNOPSIS +**podman system connection rename** *old* *new* + +## DESCRIPTION +Rename ssh destination from *old* to *new*. + +## EXAMPLE + +Rename the specified connection: +``` +$ podman system connection rename laptop devel +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + +## HISTORY +July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-system-connection.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-system-connection.1.md new file mode 100644 index 000000000..bbdf9f8e0 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-system-connection.1.md @@ -0,0 +1,52 @@ +--- +title: podman-system-connection +version: v5.4.1 +--- + +% podman-system-connection 1 + +## NAME +podman\-system\-connection - Manage the destination(s) for Podman service(s) + +## SYNOPSIS +**podman system connection** *subcommand* + +## DESCRIPTION +Manage the destination(s) for Podman service(s). + +The user is prompted for the ssh login password or key file passphrase as required. The `ssh-agent` is supported if it is running. + +Podman manages the system connection by writing and reading the `podman-connections.json` file located under +`$XDG_CONFIG_HOME/containers` or if the env is not set it defaults to `$HOME/.config/containers`. +Or the `PODMAN_CONNECTIONS_CONF` environment variable can be set to a full file path which podman +will use instead. +This file is managed by the podman commands and should never be edited by users directly. To manually +configure the connections use `service_destinations` in containers.conf. + +If the ReadWrite column in the **podman system connection list** output is set to true the connection is +stored in the `podman-connections.json` file otherwise it is stored in containers.conf and can therefore +not be edited with the **podman system connection** commands. + +## COMMANDS + +| Command | Man Page | Description | +| -------- | ----------------------------------------------------------------------------- | ---------------------------------------------------------- | +| add | [podman-system-connection\-add(1)](podman-system-connection-add.1.md) | Record destination for the Podman service | +| default | [podman-system-connection\-default(1)](podman-system-connection-default.1.md) | Set named destination as default for the Podman service | +| list | [podman-system-connection\-list(1)](podman-system-connection-list.1.md) | List the destination for the Podman service(s) | +| remove | [podman-system-connection\-remove(1)](podman-system-connection-remove.1.md) | Delete named destination | +| rename | [podman-system-connection\-rename(1)](podman-system-connection-rename.1.md) | Rename the destination for Podman service | + +## EXAMPLE + +List system connections: +``` +$ podman system connection list +Name URI Identity Default ReadWrite +devl ssh://root@example.com/run/podman/podman.sock ~/.ssh/id_rsa true true +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)** + +## HISTORY +June 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-system-df.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-system-df.1.md new file mode 100644 index 000000000..1c852dcb3 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-system-df.1.md @@ -0,0 +1,80 @@ +--- +title: podman-system-df +version: v5.4.1 +--- + +% podman-system-df 1 + +## NAME +podman\-system\-df - Show podman disk usage + +## SYNOPSIS +**podman system df** [*options*] + +## DESCRIPTION +Show podman disk usage + +## OPTIONS +#### **--format**=*format* + +Pretty-print images using a Go template or JSON. This flag is not allowed in combination with **--verbose** + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------------- | ------------------------------------------------ | +| .Active | Indicates whether volume is in use | +| .RawReclaimable | Raw reclaimable size of each Type | +| .RawSize | Raw size of each type | +| .Reclaimable | Reclaimable size or each type (human-readable) | +| .Size | Size of each type (human-readable) | +| .Total | Total items for each type | +| .Type | Type of data | + + +#### **--verbose**, **-v** +Show detailed information on space usage + +## EXAMPLE + +Show disk usage: +``` +$ podman system df +TYPE TOTAL ACTIVE SIZE RECLAIMABLE +Images 6 2 281MB 168MB (59%) +Containers 3 1 0B 0B (0%) +Local Volumes 1 1 22B 0B (0%) +``` + +Show disk usage in verbose mode: +``` +$ podman system df -v +Images space usage: + +REPOSITORY TAG IMAGE ID CREATED SIZE SHARED SIZE UNIQUE SIZE CONTAINERS +docker.io/library/alpine latest 5cb3aa00f899 2 weeks ago 5.79MB 0B 5.79MB 5 + +Containers space usage: + +CONTAINER ID IMAGE COMMAND LOCAL VOLUMES SIZE CREATED STATUS NAMES +073f7e62812d 5cb3 sleep 100 1 0B 20 hours ago exited zen_joliot +3f19f5bba242 5cb3 sleep 100 0 5.52kB 22 hours ago exited pedantic_archimedes +8cd89bf645cc 5cb3 ls foodir 0 58B 21 hours ago configured agitated_hamilton +a1d948a4b61d 5cb3 ls foodir 0 12B 21 hours ago exited laughing_wing +eafe3e3c5bb3 5cb3 sleep 10000 0 72B 21 hours ago exited priceless_liskov + +Local Volumes space usage: + +VOLUME NAME LINKS SIZE +data 1 0B + +$ podman system df --format "{{.Type}}\t{{.Total}}" +Images 1 +Containers 5 +Local Volumes 1 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)** + +## HISTORY +March 2019, Originally compiled by Qi Wang (qiwan at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-system-migrate.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-system-migrate.1.md new file mode 100644 index 000000000..1a6f96c21 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-system-migrate.1.md @@ -0,0 +1,44 @@ +--- +title: podman-system-migrate +version: v5.4.1 +--- + +% podman-system-migrate 1 + +## NAME +podman\-system\-migrate - Migrate existing containers to a new podman version + +## SYNOPSIS +**podman system migrate** [*options*] + +## DESCRIPTION +**podman system migrate** migrates containers to the latest podman version. + +**podman system migrate** takes care of migrating existing containers to the latest version of podman if any change is necessary. + +"Rootless Podman uses a pause process to keep the unprivileged +namespaces alive. This prevents any change to the `/etc/subuid` and +`/etc/subgid` files from being propagated to the rootless containers +while the pause process is running. + +For these changes to be propagated, it is necessary to first stop all +running containers associated with the user and to also stop the pause +process and delete its pid file. Instead of doing it manually, `podman +system migrate` can be used to stop both the running containers and the +pause process. The `/etc/subuid` and `/etc/subgid` files can then be +edited or changed with usermod to recreate the user namespace with the +newly configured mappings. + +## OPTIONS + +#### **--new-runtime**=*runtime* + +Set a new OCI runtime for all containers. +This can be used after a system upgrade which changes the default OCI runtime to move all containers to the new runtime. +There are no guarantees that the containers continue to work under the new runtime, as some runtimes support differing options and configurations. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **usermod(8)** + +## HISTORY +April 2019, Originally compiled by Giuseppe Scrivano (gscrivan at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-system-prune.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-system-prune.1.md new file mode 100644 index 000000000..cdc0b6800 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-system-prune.1.md @@ -0,0 +1,76 @@ +--- +title: podman-system-prune +version: v5.4.1 +--- + +% podman-system-prune 1 + +## NAME +podman\-system\-prune - Remove all unused pods, containers, images, networks, and volume data + +## SYNOPSIS +**podman system prune** [*options*] + +## DESCRIPTION +**podman system prune** removes all unused containers (both dangling and unreferenced), build containers, pods, networks, and optionally, volumes from local storage. + +Use the **--all** option to delete all unused images. Unused images are dangling images as well as any image that does not have any containers based on it. + +By default, volumes are not removed to prevent important data from being deleted if there is currently no container using the volume. Use the **--volumes** flag when running the command to prune volumes as well. + +By default, build containers are not removed to prevent interference with builds in progress. Use the **--build** flag when running the command to remove build containers as well. + +## OPTIONS +#### **--all**, **-a** + +Recursively remove all unused pods, containers, images, networks, and volume data. (Maximum 50 iterations.) + +#### **--build** + +Removes any build containers that were created during the build, but were not removed because the build was unexpectedly terminated. + +Note: **This is not safe operation and should be executed only when no builds are in progress. It can interfere with builds in progress.** + +#### **--external** + +Tries to clean up remainders of previous containers or layers that are not references in the storage json files. These can happen in the case of unclean shutdowns or regular restarts in transient storage mode. + +However, when using transient storage mode, the Podman database does not persist. This means containers leave the writable layers on disk after a reboot. When using a transient store, it is recommended that the **podman system prune --external** command is run during boot. + +This option is incompatible with **--all** and **--filter** and drops the default behaviour of removing unused resources. + +#### **--filter**=*filters* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------:|-----------------------------------------------------------------------------------------------------------------| +| label | Only remove containers and images, with (or without, in the case of label!=[...] is used) the specified labels. | +| until | Only remove containers and images created before given timestamp. | + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes containers and images with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes containers and images without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not prompt for confirmation + +#### **--help**, **-h** + +Print usage statement + +#### **--volumes** + +Prune volumes currently unused by any container + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)** + +## HISTORY +February 2019, Originally compiled by Dan Walsh (dwalsh at redhat dot com) +December 2020, converted filter information from docs.docker.com documentation by Dan Walsh (dwalsh at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-system-renumber.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-system-renumber.1.md new file mode 100644 index 000000000..f6b7f0651 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-system-renumber.1.md @@ -0,0 +1,31 @@ +--- +title: podman-system-renumber +version: v5.4.1 +--- + +% podman-system-renumber 1 + +## NAME +podman\-system\-renumber - Migrate lock numbers to handle a change in maximum number of locks + +## SYNOPSIS +**podman system renumber** + +## DESCRIPTION +**podman system renumber** renumbers locks used by containers and pods. + +Each Podman container and pod is allocated a lock at creation time, up to a maximum number controlled by the **num_locks** parameter in **containers.conf**. + +When all available locks are exhausted, no further containers and pods can be created until some existing containers and pods are removed. This can be avoided by increasing the number of locks available via modifying **containers.conf** and subsequently running **podman system renumber** to prepare the new locks (and reallocate lock numbers to fit the new struct). + +**podman system renumber** must be called after any changes to **num_locks** - failure to do so results in errors starting Podman as the number of locks available conflicts with the configured number of locks. + +**podman system renumber** can also be used to migrate 1.0 and earlier versions of Podman, which used a different locking scheme, to the new locking model. It is not strictly required to do this, but it is highly recommended to do so as deadlocks can occur otherwise. + +If possible, avoid calling **podman system renumber** while there are other Podman processes running. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +## HISTORY +February 2019, Originally compiled by Matt Heon (mheon at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-system-reset.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-system-reset.1.md new file mode 100644 index 000000000..a96d8fb85 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-system-reset.1.md @@ -0,0 +1,72 @@ +--- +title: podman-system-reset +version: v5.4.1 +--- + +% podman-system-reset 1 + +## NAME +podman\-system\-reset - Reset storage back to initial state + +## SYNOPSIS +**podman system reset** [*options*] + +## DESCRIPTION +**podman system reset** removes all pods, containers, images, networks and volumes, and machines. +It also removes the configured graphRoot and runRoot directories. Make sure these are not set to +some important directory. + +This command must be run **before** changing any of the following fields in the +`containers.conf` or `storage.conf` files: `driver`, `static_dir`, `tmp_dir` +or `volume_path`. + +`podman system reset` reads the current configuration and attempts to remove all +of the relevant configurations. If the administrator modified the configuration files first, +`podman system reset` might not be able to clean up the previous storage. + +## OPTIONS +#### **--force**, **-f** + +Do not prompt for confirmation + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Reset all storage back to a clean initialized state. +``` +$ podman system reset +WARNING! This will remove: + - all containers + - all pods + - all images + - all networks + - all build cache + - all machines + - all volumes + - the graphRoot directory: /var/lib/containers/storage + - the runRoot directory: /run/containers/storage +Are you sure you want to continue? [y/N] y +``` + +### Switching rootless user from VFS driver to overlay with fuse-overlayfs + +If the user ran rootless containers without having the `fuse-overlayfs` program +installed, podman defaults to the `vfs` storage in their home directory. If they +want to switch to use fuse-overlay, they must install the fuse-overlayfs +package. The user needs to reset the storage to use overlayfs by default. +Execute `podman system reset` as the user first to remove the VFS storage. Now +the user can edit the `/etc/containers/storage.conf` to make any changes if +necessary. If the system's default was already `overlay`, then no changes are +necessary to switch to fuse-overlayfs. Podman looks for the existence of +fuse-overlayfs to use it when set in the `overlay` driver, only falling back to vfs +if the program does not exist. Users can run `podman info` to ensure Podman is +using fuse-overlayfs and the overlay driver. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[fuse-overlayfs(1)](https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)** + +## HISTORY +November 2019, Originally compiled by Dan Walsh (dwalsh at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-system-service.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-system-service.1.md new file mode 100644 index 000000000..178fd58cf --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-system-service.1.md @@ -0,0 +1,146 @@ +--- +title: podman-system-service +version: v5.4.1 +--- + +% podman-system-service 1 + +## NAME +podman\-system\-service - Run an API service + +## SYNOPSIS +**podman system service** [*options*] + +## DESCRIPTION +The **podman system service** command creates a listening service that answers API calls for Podman. +The command is available on Linux systems and is usually executed in systemd services. +The command is not available when the Podman command is executed directly on a Windows or macOS +host or in other situations where the Podman command is accessing a remote Podman API service. + +The REST API provided by **podman system service** is split into two parts: a compatibility layer offering support for the Docker v1.40 API, and a Podman-native Libpod layer. +Documentation for the latter is available at *https://docs.podman.io/en/latest/_static/api.html*. +Both APIs are versioned, but the server does not reject requests with an unsupported version set. + +### Run the command in a systemd service + +The command **podman system service** supports systemd socket activation. +When the command is run in a systemd service, the API service can therefore be provided on demand. +If the systemd service is not already running, it will be activated as soon as +a client connects to the listening socket. Systemd then executes the +**podman system service** command. +After some time of inactivity, as defined by the __--time__ option, the command terminates. +Systemd sets the _podman.service_ state as inactive. At this point there is no +**podman system service** process running. No unnecessary compute resources are wasted. +As soon as another client connects, systemd activates the systemd service again. + +The systemd unit files that declares the Podman API service for users are + +* _/usr/lib/systemd/user/podman.service_ +* _/usr/lib/systemd/user/podman.socket_ + +In the file _podman.socket_ the path of the listening Unix socket is defined by + +``` +ListenStream=%t/podman/podman.sock +``` + +The path contains the systemd specifier `%t` which systemd expands to the value of the environment variable +`XDG_RUNTIME_DIR` (see systemd specifiers in the **systemd.unit(5)** man page). + +In addition to the systemd user services, there is also a systemd system service _podman.service_. +It runs rootful Podman and is accessed from the Unix socket _/run/podman/podman.sock_. See the systemd unit files + +* _/usr/lib/systemd/system/podman.service_ +* _/usr/lib/systemd/system/podman.socket_ + +The **podman system service** command does not support more than one listening socket for the API service. + +Note: The default systemd unit files (system and user) change the log-level option to *info* from *error*. This change provides additional information on each API call. + +### Run the command directly + +To support running an API service without using a systemd service, the command also takes an +optional endpoint argument for the API in URI form. For example, *unix:///tmp/foobar.sock* or *tcp://localhost:8080*. +If no endpoint is provided, defaults is used. The default endpoint for a rootful +service is *unix:///run/podman/podman.sock* and rootless is *unix://$XDG_RUNTIME_DIR/podman/podman.sock* (for +example *unix:///run/user/1000/podman/podman.sock*) + +### Access the Unix socket from inside a container + +To access the API service inside a container: +- mount the socket as a volume +- run the container with `--security-opt label=disable` + +### Security + +Please note that the API grants full access to all Podman functionality, and thus allows arbitrary code execution as the user running the API, with no ability to limit or audit this access. +The API's security model is built upon access via a Unix socket with access restricted via standard file permissions, ensuring that only the user running the service will be able to access it. +We *strongly* recommend against making the API socket available via the network (IE, bindings the service to a *tcp* URL). +Even access via Localhost carries risks - anyone with access to the system will be able to access the API. +If remote access is required, we instead recommend forwarding the API socket via SSH, and limiting access on the remote machine to the greatest extent possible. +If a *tcp* URL must be used, using the *--cors* option is recommended to improve security. + +## OPTIONS + +#### **--cors** + +CORS headers to inject to the HTTP response. The default value is empty string which disables CORS headers. + +#### **--help**, **-h** + +Print usage statement. + +#### **--time**, **-t** + +The time until the session expires in _seconds_. The default is 5 +seconds. A value of `0` means no timeout, therefore the session does not expire. + +The default timeout can be changed via the `service_timeout=VALUE` field in containers.conf. +See **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** for more information. + +## EXAMPLES + +Start the user systemd socket for a rootless service. +``` +systemctl --user start podman.socket +``` + +Configure DOCKER_HOST environment variable to point to the Podman socket so that +it can be used via Docker API tools like docker-compose. +``` +$ export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock +$ docker-compose up +``` + +Configure the systemd socket to be automatically started after reboots, and run as the specified user. +``` +systemctl --user enable podman.socket +loginctl enable-linger +``` + +Start the systemd socket for the rootful service. +``` +sudo systemctl start podman.socket +``` + +Configure the socket to be automatically started after reboots. +``` +sudo systemctl enable podman.socket +``` + +It is possible to run the API without using systemd socket activation. +In this case the API will not be available on demand because the command will +stay terminated after the inactivity timeout has passed. +Run an API with an inactivity timeout of 5 seconds without using socket activation. +``` +podman system service --time 5 +``` + +The default socket was used as no URI argument was provided. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +## HISTORY +January 2020, Originally compiled by Brent Baude `` +November 2020, Updated by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-system.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-system.1.md new file mode 100644 index 000000000..3f5427e2b --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-system.1.md @@ -0,0 +1,33 @@ +--- +title: podman-system +version: v5.4.1 +--- + +% podman-system 1 + +## NAME +podman\-system - Manage podman + +## SYNOPSIS +**podman system** *subcommand* + +## DESCRIPTION +The system command allows management of the podman systems + +## COMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------------------ | ------------------------------------------------------------------------ | +| check | [podman-system-check(1)](podman-system-check.1.md) | Perform consistency checks on image and container storage. +| connection | [podman-system-connection(1)](podman-system-connection.1.md) | Manage the destination(s) for Podman service(s) | +| df | [podman-system-df(1)](podman-system-df.1.md) | Show podman disk usage. | +| events | [podman-events(1)](podman-events.1.md) | Monitor Podman events | +| info | [podman-info(1)](podman-info.1.md) | Display Podman related system information. | +| migrate | [podman-system-migrate(1)](podman-system-migrate.1.md) | Migrate existing containers to a new podman version. | +| prune | [podman-system-prune(1)](podman-system-prune.1.md) | Remove all unused pods, containers, images, networks, and volume data. | +| renumber | [podman-system-renumber(1)](podman-system-renumber.1.md) | Migrate lock numbers to handle a change in maximum number of locks. | +| reset | [podman-system-reset(1)](podman-system-reset.1.md) | Reset storage back to initial state. | +| service | [podman-system-service(1)](podman-system-service.1.md) | Run an API service | + +## SEE ALSO +**[podman(1)](podman.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-systemd.unit.5.md b/versioned_docs/version-5.4.1/source/markdown/podman-systemd.unit.5.md new file mode 100644 index 000000000..e1b7827f5 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-systemd.unit.5.md @@ -0,0 +1,2105 @@ +--- +title: Restart service when sleep finishes +version: v5.4.1 +--- + +% podman-systemd.unit 5 + +## NAME + +podman\-systemd.unit - systemd units using Podman Quadlet + +## SYNOPSIS + +*name*.container, *name*.volume, *name*.network, *name*.kube *name*.image, *name*.build *name*.pod + +### Podman rootful unit search path + +Quadlet files for the root user can be placed in the following directories ordered in precedence. Meaning duplicate named quadlets found under /run take precedence over ones in /etc, as well as those in /usr: + +Temporary quadlets, usually used for testing: + +* /run/containers/systemd/ + +System administrator's defined quadlets: + +* /etc/containers/systemd/ + +Distribution defined quadlets: + +* /usr/share/containers/systemd/ + +### Podman rootless unit search path + +Quadlet files for non-root users can be placed in the following directories + + * $XDG_RUNTIME_DIR/containers/systemd/ + * $XDG_CONFIG_HOME/containers/systemd/ or ~/.config/containers/systemd/ + * /etc/containers/systemd/users/$(UID) + * /etc/containers/systemd/users/ + +### Using symbolic links + +Quadlet supports using symbolic links for the base of the search paths and inside them. + +## DESCRIPTION + +Podman supports building, and starting containers (and creating volumes) via systemd by using a +[systemd generator](https://www.freedesktop.org/software/systemd/man/systemd.generator.html). +These files are read during boot (and when `systemctl daemon-reload` is run) and generate +corresponding regular systemd service unit files. Both system and user systemd units are supported. +All options and tables available in standard systemd unit files are supported. For example, options defined in +the [Service] table and [Install] tables pass directly to systemd and are handled by it. +See systemd.unit(5) man page for more information. + +The Podman generator reads the search paths above and reads files with the extensions `.container` +`.volume`, `.network`, `.build`, `.pod` and `.kube`, and for each file generates a similarly named `.service` file. Be aware that +existing vendor services (i.e., in `/usr/`) are replaced if they have the same name. The generated unit files can +be started and managed with `systemctl` like any other systemd service. `systemctl {--user} list-unit-files` +lists existing unit files on the system. + +The Podman files use the same format as [regular systemd unit files](https://www.freedesktop.org/software/systemd/man/systemd.syntax.html). +Each file type has a custom section (for example, `[Container]`) that is handled by Podman, and all +other sections are passed on untouched, allowing the use of any normal systemd configuration options +like dependencies or cgroup limits. + +The source files also support drop-ins in the same [way systemd does](https://www.freedesktop.org/software/systemd/man/latest/systemd.unit.html). +For a given source file (`foo.container`), the corresponding `.d` directory (`foo.container.d`) will +be scanned for files with a `.conf` extension, which are then merged into the base file in alphabetical +order. Top-level type drop-ins (`container.d`) will also be included. If the unit contains dashes ("-") +in the name (`foo-bar-baz.container`), then the drop-in directories generated by truncating the name after +the dash are searched as well (`foo-.container.d` and `foo-bar-.container.d`). Drop-in files with the same name +further down the hierarchy override those further up (`foo-bar-baz.container.d/10-override.conf` overrides +`foo-bar-.container.d/10-override.conf`, which overrides `foo-.service.d/10-override.conf`, which overrides +`container.d/10-override.conf`). The format of these drop-in files is the same as the base file. This is useful +to alter or add configuration settings for a unit, without having to modify unit files. + +For rootless containers, when administrators place Quadlet files in the +/etc/containers/systemd/users directory, all users' sessions execute the +Quadlet when the login session begins. If the administrator places a Quadlet +file in the /etc/containers/systemd/users/${UID}/ directory, then only the +user with the matching UID execute the Quadlet when the login +session gets started. For unit files placed in subdirectories within +/etc/containers/systemd/user/${UID}/ and the other user unit search paths, +Quadlet will recursively search and run the unit files present in these subdirectories. + +Note: When a Quadlet is starting, Podman often pulls or builds one more container images which may take a considerable amount of time. +Systemd defaults service start time to 90 seconds, or fails the service. Pre-pulling the image or extending +the systemd timeout time for the service using the *TimeoutStartSec* Service option can fix the problem. +A word of caution: *TimeoutStartSec* is not available for `Type=oneshot` units. Refer to `systemd.service(5)` +for more information on how to handle long startup times for units which do not need to stay active +once their main process has finished. + +Adding the following snippet to a Quadlet file extends the systemd timeout to 15 minutes. + +``` +[Service] +TimeoutStartSec=900 +``` + +Quadlet requires the use of cgroup v2, use `podman info --format {{.Host.CgroupsVersion}}` to check on the system. + +### Service Type + +By default, the `Type` field of the `Service` section of the Quadlet file does not need to be set. +Quadlet will set it to `notify` for `.container` and `.kube` files, +`forking` for `.pod` files, and `oneshot` for `.volume`, `.network`, `.build`, and `.image` files. + +However, `Type` may be explicitly set to `oneshot` for `.container` and `.kube` files when no containers are expected +to run once `podman` exits. + +When setting `Type=oneshot`, it is recommended to also set `RemainAfterExit=yes` to prevent the service state +from becoming `inactive (dead)`. However, when activating a service via a timer unit, having `RemainAfterExit=yes` +leaves the job in a "started" state which prevents subsequent activations by the timer. For more information, see the +`systemd.service(5)` man page. + +Examples for such cases: +- `.container` file with an image that exits after their entrypoint has finished +`` +- `.kube` file pointing to a Kubernetes Yaml file that does not define any containers. E.g. PVCs only + +### Enabling unit files + +The services created by Podman are considered transient by systemd, which means they don't have the same +persistence rules as regular units. In particular, it is not possible to "systemctl enable" them +in order for them to become automatically enabled on the next boot. + +To compensate for this, the generator manually applies the `[Install]` section of the container definition +unit files during generation, in the same way `systemctl enable` does when run later. + +For example, to start a container on boot, add something like this to the file: + +``` +[Install] +WantedBy=default.target +``` + +Currently, only the `Alias`, `WantedBy` and `RequiredBy` keys are supported. + +The Install section can be part of the main file, or it can be in a +separate drop-in file as described above. The latter allows you to +install an non-enabled unit and then later enabling it by installing +the drop-in. + + +**NOTE:** To express dependencies between containers, use the generated names of the service. In other +words `WantedBy=other.service`, not `WantedBy=other.container`. The same is +true for other kinds of dependencies, too, like `After=other.service`. + +### Template files + +Systemd supports a concept of [template files](https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html#Service%20Templates). +They are units with names of the form "basename@instancename.service" +when they are running, but that can be instantiated multiple times +from a single "basename@.service" file. The individual instances can +also be different by using drop-in files with the full instance name. + +Quadlets support these in two ways. First of all, a quadlet unit with +a template form will generate a systemd service with a template form, +and the template systemd service can be used as a regular template. +For example, "foo@.container" will generate "foo@.service" and you can +then "systemctl start foo@bar.service". + +Secondly, if you make a symlink like "foo@instance.container", that +will generate an instantiated template file. When generating this file +quadlet will read drop-in files both from the instanced directory +(foo@instance.container.d) and the template directory +(foo@.container.d). This allows customization of individual instances. + +Instanced template files (like `foo@bar.container`) can be enabled +just like non-templated ones. However, templated ones +(`foo@.container`) are different, because they need to be +instantiated. If the `[Install]` section contains a `DefaultInstance=` +key, then that instance will be enabled, but if not, nothing will +happen and the options will only be used as the default for units +that are instantiated using symlinks. + +An example template file `sleep@.container` might look like this: + +``` +[Unit] +Description=A templated sleepy container + +[Container] +Image=quay.io/fedora/fedora +Exec=sleep %i + +[Service] +# Restart service when sleep finishes +Restart=always + +[Install] +WantedBy=multi-user.target +DefaultInstance=100 +``` + +If this is installed, then on boot there will be a `sleep@100.service` +running that sleeps for 100 seconds. You can then do something like +`systemctl start sleep@50.service` to start another instance that +sleeps 50 seconds, or alternatively another service can start it via a +dependency like `Wants=sleep@50.service`. + +In addition, if you do `ln -s sleep@.container sleep@10.container` you +will also have a 10 second sleep running at boot. And, if you want +that particular instance to be running with another image, you can +create a drop-in file like `sleep@10.container.d/10-image.conf`: +``` +[Container] +Image=quay.io/centos/centos +``` + +### Relative paths + +In order to support Systemd specifiers, Quadlet does not resolve relative paths that start with `%`. +To resolve such a path, prepend it with `./`. + +For example, instead of `EnvironmentFile=%n/env` use `EnvironmentFile=./%n/env` + +### Debugging unit files + +After placing the unit file in one of the unit search paths (mentioned +above), you can start it with `systemctl start {--user}`. If it fails +with "Failed to start example.service: Unit example.service not +found.", then it is possible that you used incorrect syntax or you +used an option from a newer version of Podman Quadlet and the +generator failed to create a service file. + +View the generated files and/or error messages with: +``` +/usr/lib/systemd/system-generators/podman-system-generator {--user} --dryrun +``` + +Alternatively, show only the errors with: +``` +systemd-analyze {--user} --generators=true verify example.service +``` + +That command also performs additional checks on the generated service unit. +For details, see systemd-analyze(1) man page. + +#### Debugging a limited set of unit files + +If you would like to debug a limited set of unit files, you can copy them to a separate directory and set the +`QUADLET_UNIT_DIRS` environment variable to this directory when running the command below: + +``` +QUADLET_UNIT_DIRS= /usr/lib/systemd/system-generators/podman-system-generator {--user} --dryrun +``` + +This will instruct Quadlet to look for units in this directory instead of the common ones and by +that limit the output to only the units you are debugging. + +### Implicit network dependencies + +Quadlet will add dependencies on the `network-online.target` (as root) or `podman-user-wait-network-online.service` +(as user) by adding `After=` and `Wants=` properties to the unit. This is to ensure that the network is reachable +if an image needs to be pulled and by the time the container is started. + +The special case `podman-user-wait-network-online.service` unit is needed as user because user units are unable to wait +for system (root) units so `network-online.target` doesn't do anything there and is instead ignored. As this caused +a significant amount of issues we decided to work around this with our own special purpose unit that simply checks if +the `network-online.target` unit is active with `systemctl is-active network-online.target`. + +This behavior can be disabled by adding `DefaultDependencies=false` in the `Quadlet` section. + +## Container units [Container] + +Container units are named with a `.container` extension and contain a `[Container]` section describing +the container that is run as a service. The resulting service file contains a line like +`ExecStart=podman run … image-name`, and most of the keys in this section control the command-line +options passed to Podman. However, some options also affect the details of how systemd is set up to run and +interact with the container. + +By default, the Podman container has the same name as the unit, but with a `systemd-` prefix, i.e. +a `$name.container` file creates a `$name.service` unit and a `systemd-$name` Podman container. The +`ContainerName` option allows for overriding this default name with a user-provided one. + +There is only one required key, `Image`, which defines the container image the service runs. + +Valid options for `[Container]` are listed below: + +| **[Container] options** | **podman run equivalent** | +|--------------------------------------|------------------------------------------------------| +| AddCapability=CAP | --cap-add CAP | +| AddDevice=/dev/foo | --device /dev/foo | +| AddHost=example\.com:192.168.10.11 | --add-host example.com:192.168.10.11 | +| Annotation="XYZ" | --annotation "XYZ" | +| AutoUpdate=registry | --label "io.containers.autoupdate=registry" | +| CgroupsMode=no-conmon | --cgroups=no-conmon | +| ContainerName=name | --name name | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| DNS=192.168.55.1 | --dns=192.168.55.1 | +| DNSOption=ndots:1 | --dns-option=ndots:1 | +| DNSSearch=example.com | --dns-search example.com | +| DropCapability=CAP | --cap-drop=CAP | +| Entrypoint=/foo.sh | --entrypoint=/foo.sh | +| Environment=foo=bar | --env foo=bar | +| EnvironmentFile=/tmp/env | --env-file /tmp/env | +| EnvironmentHost=true | --env-host | +| Exec=/usr/bin/command | Command after image specification - /usr/bin/command | +| ExposeHostPort=50-59 | --expose 50-59 | +| GIDMap=0:10000:10 | --gidmap=0:10000:10 | +| GlobalArgs=--log-level=debug | --log-level=debug | +| Group=1234 | --user UID:1234 | +| GroupAdd=keep-groups | --group-add=keep-groups | +| HealthCmd=/usr/bin/command | --health-cmd=/usr/bin/command | +| HealthInterval=2m | --health-interval=2m | +| HealthLogDestination=/foo/log | --health-log-destination=/foo/log | +| HealthMaxLogCount=5 | --health-max-log-count=5 | +| HealthMaxLogSize=500 | --health-max-log-size=500 | +| HealthOnFailure=kill | --health-on-failure=kill | +| HealthRetries=5 | --health-retries=5 | +| HealthStartPeriod=1m | --health-start-period=period=1m | +| HealthStartupCmd=command | --health-startup-cmd=command | +| HealthStartupInterval=1m | --health-startup-interval=1m | +| HealthStartupRetries=8 | --health-startup-retries=8 | +| HealthStartupSuccess=2 | --health-startup-success=2 | +| HealthStartupTimeout=1m33s | --health-startup-timeout=1m33s | +| HealthTimeout=20s | --health-timeout=20s | +| HostName=example.com | --hostname example.com | +| Image=ubi8 | Image specification - ubi8 | +| IP=192.5.0.1 | --ip 192.5.0.1 | +| IP6=2001:db8::1 | --ip6 2001:db8::1 | +| Label="XYZ" | --label "XYZ" | +| LogDriver=journald | --log-driver journald | +| LogOpt=path=/var/log/mykube\.json | --log-opt path=/var/log/mykube\.json | +| Mask=/proc/sys/foo\:/proc/sys/bar | --security-opt mask=/proc/sys/foo:/proc/sys/bar | +| Mount=type=... | --mount type=... | +| Network=host | --network host | +| NetworkAlias=name | --network-alias name | +| NoNewPrivileges=true | --security-opt no-new-privileges | +| Notify=true | --sdnotify container | +| PidsLimit=10000 | --pids-limit 10000 | +| Pod=pod-name | --pod=pod-name | +| PodmanArgs=--publish 8080:80 | --publish 8080:80 | +| PublishPort=8080:80 | --publish 8080:80 | +| Pull=never | --pull never | +| ReadOnly=true | --read-only | +| ReadOnlyTmpfs=true | --read-only-tmpfs | +| Rootfs=/var/lib/rootfs | --rootfs /var/lib/rootfs | +| RunInit=true | --init | +| SeccompProfile=/tmp/s.json | --security-opt seccomp=/tmp/s.json | +| Secret=secret | --secret=secret[,opt=opt ...] | +| SecurityLabelDisable=true | --security-opt label=disable | +| SecurityLabelFileType=usr_t | --security-opt label=filetype:usr_t | +| SecurityLabelLevel=s0:c1,c2 | --security-opt label=level\:s0\:c1,c2 | +| SecurityLabelNested=true | --security-opt label=nested | +| SecurityLabelType=spc_t | --security-opt label=type\:spc_t | +| ShmSize=100m | --shm-size=100m | +| StartWithPod=true | If Pod= is defined, container is started by pod | +| StopSignal=SIGINT | --stop-signal=SIGINT | +| StopTimeout=20 | --stop-timeout=20 | +| SubGIDMap=gtest | --subgidname=gtest | +| SubUIDMap=utest | --subuidname=utest | +| Sysctl=name=value | --sysctl=name=value | +| Timezone=local | --tz local | +| Tmpfs=/work | --tmpfs /work | +| UIDMap=0:10000:10 | --uidmap=0:10000:10 | +| Ulimit=nofile=1000:10000 | --ulimit nofile=1000:10000 | +| Unmask=ALL | --security-opt unmask=ALL | +| User=bin | --user bin | +| UserNS=keep-id\:uid=200,gid=210 | --userns keep-id:uid=200,gid=210 | +| Volume=/source:/dest | --volume /source:/dest | +| WorkingDir=$HOME | --workdir $HOME | + +Description of `[Container]` section are: + +### `AddCapability=` + +Add these capabilities, in addition to the default Podman capability set, to the container. + +This is a space separated list of capabilities. This key can be listed multiple times. + +For example: +``` +AddCapability=CAP_DAC_OVERRIDE CAP_IPC_OWNER +``` + +### `AddDevice=` + +Adds a device node from the host into the container. The format of this is +`HOST-DEVICE[\:CONTAINER-DEVICE][:PERMISSIONS]`, where `HOST-DEVICE` is the path of +the device node on the host, `CONTAINER-DEVICE` is the path of the device node in +the container, and `PERMISSIONS` is a list of permissions combining 'r' for read, +'w' for write, and 'm' for mknod(2). The `-` prefix tells Quadlet to add the device +only if it exists on the host. + +This key can be listed multiple times. + +### `AddHost=` + +Add host-to-IP mapping to /etc/hosts. +The format is `hostname\:ip`. + +Equivalent to the Podman `--add-host` option. +This key can be listed multiple times. + +### `Annotation=` + +Set one or more OCI annotations on the container. The format is a list of `key=value` items, +similar to `Environment`. + +This key can be listed multiple times. + +### `AutoUpdate=` + +Indicates whether the container will be auto-updated ([podman-auto-update(1)](podman-auto-update.1.md)). The following values are supported: + +* `registry`: Requires a fully-qualified image reference (e.g., quay.io/podman/stable:latest) to be used to create the container. This enforcement is necessary to know which image to actually check and pull. If an image ID was used, Podman does not know which image to check/pull anymore. + +* `local`: Tells Podman to compare the image a container is using to the image with its raw name in local storage. If an image is updated locally, Podman simply restarts the systemd unit executing the container. + +### `CgroupsMode=` + +The cgroups mode of the Podman container. Equivalent to the Podman `--cgroups` option. + +By default, the cgroups mode of the container created by Quadlet is `split`, +which differs from the default (`enabled`) used by the Podman CLI. + +If the container joins a pod (i.e. `Pod=` is specified), you may want to change this to +`no-conmon` or `enabled` so that pod level cgroup resource limits can take effect. + +### `ContainerName=` + +The (optional) name of the Podman container. If this is not specified, the default value +of `systemd-%N` is used, which is the same as the service name but with a `systemd-` +prefix to avoid conflicts with user-managed containers. + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `DNS=` + +Set network-scoped DNS resolver/nameserver for containers in this network. + +This key can be listed multiple times. + +### `DNSOption=` + +Set custom DNS options. + +This key can be listed multiple times. + +### `DNSSearch=` + +Set custom DNS search domains. Use **DNSSearch=.** to remove the search domain. + +This key can be listed multiple times. + +### `DropCapability=` + +Drop these capabilities from the default podman capability set, or `all` to drop all capabilities. + +This is a space separated list of capabilities. This key can be listed multiple times. + +For example: +``` +DropCapability=CAP_DAC_OVERRIDE CAP_IPC_OWNER +``` + +### `Entrypoint=` + +Override the default ENTRYPOINT from the image. +Equivalent to the Podman `--entrypoint` option. +Specify multi option commands in the form of a json string. + +### `Environment=` + +Set an environment variable in the container. This uses the same format as +[services in systemd](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Environment=) +and can be listed multiple times. + +### `EnvironmentFile=` + +Use a line-delimited file to set environment variables in the container. +The path may be absolute or relative to the location of the unit file. +This key may be used multiple times, and the order persists when passed to `podman run`. + +### `EnvironmentHost=` + +Use the host environment inside of the container. + +### `Exec=` + +Additional arguments for the container; this has exactly the same effect as passing +more arguments after a `podman run ` invocation. + +The format is the same as for [systemd command lines](https://www.freedesktop.org/software/systemd/man/systemd.service.html#Command%20lines), +However, unlike the usage scenario for similarly-named systemd `ExecStart=` verb +which operates on the ambient root filesystem, it is very common for container +images to have their own `ENTRYPOINT` or `CMD` metadata which this interacts with. + +The default expectation for many images is that the image will include an `ENTRYPOINT` +with a default binary, and this field will add arguments to that entrypoint. + +Another way to describe this is that it works the same way as the [args field in a Kubernetes pod](https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell). + +### `ExposeHostPort=` + +Exposes a port, or a range of ports (e.g. `50-59`), from the host to the container. Equivalent +to the Podman `--expose` option. + +This key can be listed multiple times. + +### `GIDMap=` + +Run the container in a new user namespace using the supplied GID mapping. +Equivalent to the Podman `--gidmap` option. + +This key can be listed multiple times. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `run` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Group=` + +The (numeric) GID to run as inside the container. This does not need to match the GID on the host, +which can be modified with `UsersNS`, but if that is not specified, this GID is also used on the host. + +### `GroupAdd=` + +Assign additional groups to the primary user running within the container process. Also supports the `keep-groups` special flag. +Equivalent to the Podman `--group-add` option. + +### `HealthCmd=` + +Set or alter a healthcheck command for a container. A value of none disables existing healthchecks. +Equivalent to the Podman `--health-cmd` option. + +### `HealthInterval=` + +Set an interval for the healthchecks. An interval of disable results in no automatic timer setup. +Equivalent to the Podman `--health-interval` option. + +### `HealthLogDestination=` + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) +(Default: local) +Equivalent to the Podman `--health-log-destination` option. + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. + +### `HealthMaxLogCount=` + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) +(Default: 5 attempts) +Equivalent to the Podman `--Health-max-log-count` option. + +### `HealthMaxLogSize=` + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) +(Default: 500 characters) +Equivalent to the Podman `--Health-max-log-size` option. + +### `HealthOnFailure=` + +Action to take once the container transitions to an unhealthy state. +The "kill" action in combination integrates best with systemd. Once +the container turns unhealthy, it gets killed, and systemd restarts the +service. +Equivalent to the Podman `--health-on-failure` option. + +### `HealthRetries=` + +The number of retries allowed before a healthcheck is considered to be unhealthy. +Equivalent to the Podman `--health-retries` option. + +### `HealthStartPeriod=` + +The initialization time needed for a container to bootstrap. +Equivalent to the Podman `--health-start-period` option. + +### `HealthStartupCmd=` + +Set a startup healthcheck command for a container. +Equivalent to the Podman `--health-startup-cmd` option. + +### `HealthStartupInterval=` + +Set an interval for the startup healthcheck. An interval of disable results in no automatic timer setup. +Equivalent to the Podman `--health-startup-interval` option. + +### `HealthStartupRetries=` + +The number of attempts allowed before the startup healthcheck restarts the container. +Equivalent to the Podman `--health-startup-retries` option. + +### `HealthStartupSuccess=` + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. +Equivalent to the Podman `--health-startup-success` option. + +### `HealthStartupTimeout=` + +The maximum time a startup healthcheck command has to complete before it is marked as failed. +Equivalent to the Podman `--health-startup-timeout` option. + +### `HealthTimeout=` + +The maximum time allowed to complete the healthcheck before an interval is considered failed. +Equivalent to the Podman `--health-timeout` option. + +### `HostName=` + +Sets the host name that is available inside the container. +Equivalent to the Podman `--hostname` option. + +### `Image=` + +The image to run in the container. +It is recommended to use a fully qualified image name rather than a short name, both for +performance and robustness reasons. + +The format of the name is the same as when passed to `podman pull`. So, it supports using +`\:tag` or digests to guarantee the specific image version. + +Special Cases: + +* If the `name` of the image ends with `.image`, Quadlet will use the image pulled by the corresponding `.image` file, and the generated systemd service contains a dependency on the `$name-image.service` (or the service name set in the .image file). Note that the corresponding `.image` file must exist. +* If the `name` of the image ends with `.build`, Quadlet will use the image built by the corresponding `.build` file, and the generated systemd service contains a dependency on the `$name-build.service`. Note: the corresponding `.build` file must exist. + +### `IP=` + +Specify a static IPv4 address for the container, for example **10.88.64.128**. +Equivalent to the Podman `--ip` option. + +### `IP6=` + +Specify a static IPv6 address for the container, for example **fd46\:db93\:aa76\:ac37::10**. +Equivalent to the Podman `--ip6` option. + +### `Label=` + +Set one or more OCI labels on the container. The format is a list of `key=value` items, +similar to `Environment`. + +This key can be listed multiple times. + +### `LogDriver=` + +Set the log-driver used by Podman when running the container. +Equivalent to the Podman `--log-driver` option. + +### `LogOpt=` + +Set the log-opt (logging options) used by Podman when running the container. +Equivalent to the Podman `--log-opt` option. +This key can be listed multiple times. + +### `Mask=` + +Specify the paths to mask separated by a colon. `Mask=/path/1:/path/2`. A masked path cannot be accessed inside the container. + +### `Mount=` + +Attach a filesystem mount to the container. +This is equivalent to the Podman `--mount` option, and +generally has the form `type=TYPE,TYPE-SPECIFIC-OPTION[,...]`. + +Special cases: + +* For `type=volume`, if `source` ends with `.volume`, the Podman named volume generated by the corresponding `.volume` file is used. +* For `type=image`, if `source` ends with `.image`, the image generated by the corresponding `.image` file is used. + +In both cases, the generated systemd service will contain a dependency on the service generated for the corresponding unit. Note: the corresponding `.volume` or `.image` file must exist. + +This key can be listed multiple times. + +### `Network=` + +Specify a custom network for the container. This has the same format as the `--network` option +to `podman run`. For example, use `host` to use the host network in the container, or `none` to +not set up networking in the container. + +Special cases: + +* If the `name` of the network ends with `.network`, a Podman network called +`systemd-$name` is used, and the generated systemd service contains +a dependency on the `$name-network.service`. Such a network can be automatically +created by using a `$name.network` Quadlet file. Note: the corresponding `.network` file must exist. + +* If the `name` ends with `.container`, +the container will reuse the network stack of another container created by `$name.container`. +The generated systemd service contains a dependency on `$name.service`. Note: the corresponding `.container` file must exist. + +This key can be listed multiple times. + +### `NetworkAlias=` + +Add a network-scoped alias for the container. This has the same format as the `--network-alias` +option to `podman run`. Aliases can be used to group containers together in DNS resolution: for +example, setting `NetworkAlias=web` on multiple containers will make a DNS query for `web` resolve +to all the containers with that alias. + +This key can be listed multiple times. + +### `NoNewPrivileges=` (defaults to `false`) + +If enabled, this disables the container processes from gaining additional privileges via things like +setuid and file capabilities. + +### `Notify=` (defaults to `false`) + +By default, Podman is run in such a way that the systemd startup notify command is handled by +the container runtime. In other words, the service is deemed started when the container runtime +starts the child in the container. However, if the container application supports +[sd_notify](https://www.freedesktop.org/software/systemd/man/sd_notify.html), then setting +`Notify` to true passes the notification details to the container allowing it to notify +of startup on its own. + +In addition, setting `Notify` to `healthy` will postpone startup notifications until such time as +the container is marked healthy, as determined by Podman healthchecks. Note that this requires +setting up a container healthcheck, see the `HealthCmd` option for more. + +### `PidsLimit=` + +Tune the container's pids limit. +This is equivalent to the Podman `--pids-limit` option. + +### `Pod=` + +Specify a Quadlet `.pod` unit to link the container to. +The value must take the form of `.pod` and the `.pod` unit must exist. + +Quadlet will add all the necessary parameters to link between the container and the pod and between their corresponding services. + + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman run` command +in the generated file (right before the image name in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `PublishPort=` + +Exposes a port, or a range of ports (e.g. `50-59`), from the container to the host. Equivalent +to the Podman `--publish` option. The format is similar to the Podman options, which is of +the form `ip\:hostPort:containerPort`, `ip::containerPort`, `hostPort:containerPort` or +`containerPort`, where the number of host and container ports must be the same (in the case +of a range). + +If the IP is set to 0.0.0.0 or not set at all, the port is bound on all IPv4 addresses on +the host; use [::] for IPv6. + +Note that not listing a host port means that Podman automatically selects one, and it +may be different for each invocation of service. This makes that a less useful option. The +allocated port can be found with the `podman port` command. + +This key can be listed multiple times. + +### `Pull=` + +Set the image pull policy. +This is equivalent to the Podman `--pull` option + +### `ReadOnly=` (defaults to `false`) + +If enabled, makes the image read-only. + +### `ReadOnlyTmpfs=` (defaults to `true`) + +If ReadOnly is set to `true`, mount a read-write tmpfs on /dev, /dev/shm, /run, /tmp, and /var/tmp. + +### `Rootfs=` + +The rootfs to use for the container. Rootfs points to a directory on the system that contains the content to be run within the container. This option conflicts with the `Image` option. + +The format of the rootfs is the same as when passed to `podman run --rootfs`, so it supports overlay mounts as well. + +Note: On SELinux systems, the rootfs needs the correct label, which is by default unconfined_u\:object_r\:container_file_t\:s0. + +### `RunInit=` (default to `false`) + +If enabled, the container has a minimal init process inside the +container that forwards signals and reaps processes. + +### `SeccompProfile=` + +Set the seccomp profile to use in the container. If unset, the default podman profile is used. +Set to either the pathname of a json file, or `unconfined` to disable the seccomp filters. + +### `Secret=` + +Use a Podman secret in the container either as a file or an environment variable. +This is equivalent to the Podman `--secret` option and generally has the form `secret[,opt=opt ...]` + +### `SecurityLabelDisable=` + +Turn off label separation for the container. + +### `SecurityLabelFileType=` + +Set the label file type for the container files. + +### `SecurityLabelLevel=` + +Set the label process level for the container processes. + +### `SecurityLabelNested=` + +Allow SecurityLabels to function within the container. This allows separation of containers created within the container. + +### `SecurityLabelType=` + +Set the label process type for the container processes. + +### `ShmSize=` + +Size of /dev/shm. + +This is equivalent to the Podman `--shm-size` option and generally has the form `number[unit]` + +### `StartWithPod=` + +Start the container after the associated pod is created. Default to **true**. + +If `true`, container will be started/stopped/restarted alongside the pod. + +If `false`, the container will not be started when the pod starts. The container will be stopped with the pod. Restarting the pod will also restart the container as long as the container was also running before. + +Note, the container can still be started manually or through a target by configuring the `[Install]` section. The pod will be started as needed in any case. + +### `StopSignal=` + +Signal to stop a container. Default is **SIGTERM**. + +This is equivalent to the Podman `--stop-signal` option + +### `StopTimeout=` + +Seconds to wait before forcibly stopping the container. + +Note, this value should be lower than the actual systemd unit timeout to make sure the podman rm command is not killed by systemd. + +This is equivalent to the Podman `--stop-timeout` option + +### `SubGIDMap=` + +Run the container in a new user namespace using the map with name in the /etc/subgid file. +Equivalent to the Podman `--subgidname` option. + +### `SubUIDMap=` + +Run the container in a new user namespace using the map with name in the /etc/subuid file. +Equivalent to the Podman `--subuidname` option. + +### `Sysctl=` + +Configures namespaced kernel parameters for the container. The format is `Sysctl=name=value`. + +This is a space separated list of kernel parameters. This key can be listed multiple times. + +For example: +``` +Sysctl=net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.all.use_tempaddr=1 +``` + +### `Timezone=` (if unset uses system-configured default) + +The timezone to run the container in. + +### `Tmpfs=` + +Mount a tmpfs in the container. This is equivalent to the Podman `--tmpfs` option, and +generally has the form `CONTAINER-DIR[\:OPTIONS]`. + +This key can be listed multiple times. + +### `UIDMap=` + +Run the container in a new user namespace using the supplied UID mapping. +Equivalent to the Podman `--uidmap` option. + +This key can be listed multiple times. + +### `Ulimit=` + +Ulimit options. Sets the ulimits values inside of the container. + +This key can be listed multiple times. + +### `Unmask=` + +Specify the paths to unmask separated by a colon. unmask=ALL or /path/1:/path/2, or shell expanded paths (/proc/*): + +If set to `ALL`, Podman will unmask all the paths that are masked or made read-only by default. + +The default masked paths are /proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux. + +The default paths that are read-only are /proc/asound, /proc/bus, /proc/fs, /proc/irq, /proc/sys, /proc/sysrq-trigger, /sys/fs/cgroup. + +### `User=` + +The (numeric) UID to run as inside the container. This does not need to match the UID on the host, +which can be modified with `UserNS`, but if that is not specified, this UID is also used on the host. + +### `UserNS=` + +Set the user namespace mode for the container. This is equivalent to the Podman `--userns` option and +generally has the form `MODE[:OPTIONS,...]`. + +### `Volume=` + +Mount a volume in the container. This is equivalent to the Podman `--volume` option, and +generally has the form `[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[:OPTIONS]]`. + +If `SOURCE-VOLUME` starts with `.`, Quadlet resolves the path relative to the location of the unit file. + +Special case: + +* If `SOURCE-VOLUME` ends with `.volume`, a Podman named volume called `systemd-$name` is used as the source, and the generated systemd service contains a dependency on the `$name-volume.service`. Note that the corresponding `.volume` file must exist. + +This key can be listed multiple times. + +### `WorkingDir=` + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (/). The image developer can set a different default with the WORKDIR instruction. This option overrides the working directory by using the -w option. + +## Pod units [Pod] + +Pod units are named with a `.pod` extension and contain a `[Pod]` section describing +the pod that is created and run as a service. The resulting service file contains a line like +`ExecStartPre=podman pod create …`, and most of the keys in this section control the command-line +options passed to Podman. + +By default, the Podman pod has the same name as the unit, but with a `systemd-` prefix, i.e. +a `$name.pod` file creates a `$name-pod.service` unit and a `systemd-$name` Podman pod. The +`PodName` option allows for overriding this default name with a user-provided one. + +Valid options for `[Pod]` are listed below: + +| **[Pod] options** | **podman container create equivalent** | +|-------------------------------------|----------------------------------------| +| AddHost=example\.com:192.168.10.11 | --add-host example.com:192.168.10.11 | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| DNS=192.168.55.1 | --dns=192.168.55.1 | +| DNSOption=ndots:1 | --dns-option=ndots:1 | +| DNSSearch=example.com | --dns-search example.com | +| GIDMap=0:10000:10 | --gidmap=0:10000:10 | +| GlobalArgs=--log-level=debug | --log-level=debug | +| IP=192.5.0.1 | --ip 192.5.0.1 | +| IP6=2001\:db8::1 | --ip6 2001:db8::1 | +| Network=host | --network host | +| NetworkAlias=name | --network-alias name | +| PodmanArgs=\-\-cpus=2 | --cpus=2 | +| PodName=name | --name=name | +| PublishPort=8080:80 | --publish 8080:80 | +| ServiceName=name | Name the systemd unit `name.service` | +| ShmSize=100m | --shm-size=100m | +| SubGIDMap=gtest | --subgidname=gtest | +| SubUIDMap=utest | --subuidname=utest | +| UIDMap=0:10000:10 | --uidmap=0:10000:10 | +| UserNS=keep-id\:uid=200,gid=210 | --userns keep-id:uid=200,gid=210 | +| Volume=/source:/dest | --volume /source:/dest | + +Supported keys in the `[Pod]` section are: + +### `AddHost=` + +Add host-to-IP mapping to /etc/hosts. +The format is `hostname\:ip`. + +Equivalent to the Podman `--add-host` option. +This key can be listed multiple times. + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `DNS=` + +Set network-scoped DNS resolver/nameserver for containers in this pod. + +This key can be listed multiple times. + +### `DNSOption=` + +Set custom DNS options. + +This key can be listed multiple times. + +### `DNSSearch=` + +Set custom DNS search domains. Use **DNSSearch=.** to remove the search domain. + +This key can be listed multiple times. + +### `GIDMap=` + +Create the pod in a new user namespace using the supplied GID mapping. +Equivalent to the Podman `--gidmap` option. + +This key can be listed multiple times. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `pod` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `IP=` + +Specify a static IPv4 address for the pod, for example **10.88.64.128**. +Equivalent to the Podman `--ip` option. + +### `IP6=` + +Specify a static IPv6 address for the pod, for example **fd46\:db93\:aa76\:ac37::10**. +Equivalent to the Podman `--ip6` option. + +### `Network=` + +Specify a custom network for the pod. +This has the same format as the `--network` option to `podman pod create`. +For example, use `host` to use the host network in the pod, or `none` to not set up networking in the pod. + +Special case: + +* If the `name` of the network ends with `.network`, Quadlet will look for the corresponding `.network` Quadlet unit. If found, Quadlet will use the name of the Network set in the Unit, otherwise, `systemd-$name` is used. + +The generated systemd service contains a dependency on the service unit generated for that `.network` unit. Note: the corresponding `.network` file must exist. + +This key can be listed multiple times. + +### `NetworkAlias=` + +Add a network-scoped alias for the pod. This has the same format as the `--network-alias` option to +`podman pod create`. Aliases can be used to group containers together in DNS resolution: for +example, setting `NetworkAlias=web` on multiple containers will make a DNS query for `web` resolve +to all the containers with that alias. + +This key can be listed multiple times. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman pod create` command +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `PodName=` + +The (optional) name of the Podman pod. If this is not specified, the default value +of `systemd-%N` is used, which is the same as the service name but with a `systemd-` +prefix to avoid conflicts with user-managed containers. + +Please note that pods and containers cannot have the same name. +So, if PodName is set, it must not conflict with any container. + +### `PublishPort=` + +Exposes a port, or a range of ports (e.g. `50-59`), from the pod to the host. Equivalent +to the Podman `--publish` option. The format is similar to the Podman options, which is of +the form `ip\:hostPort:containerPort`, `ip::containerPort`, `hostPort:containerPort` or +`containerPort`, where the number of host and container ports must be the same (in the case +of a range). + +If the IP is set to 0.0.0.0 or not set at all, the port is bound on all IPv4 addresses on +the host; use [::] for IPv6. + +Note that not listing a host port means that Podman automatically selects one, and it +may be different for each invocation of service. This makes that a less useful option. The +allocated port can be found with the `podman port` command. + +When using `host` networking via `Network=host`, the `PublishPort=` option cannot be used. + +This key can be listed multiple times. + + +### `ServiceName=` + +By default, Quadlet will name the systemd service unit by appending `-pod` to the name of the Quadlet. +Setting this key overrides this behavior by instructing Quadlet to use the provided name. + +Note, the name should not include the `.service` file extension + +### `ShmSize=` + +Size of /dev/shm. + +This is equivalent to the Podman `--shm-size` option and generally has the form `number[unit]` + +### `SubGIDMap=` + +Create the pod in a new user namespace using the map with name in the /etc/subgid file. +Equivalent to the Podman `--subgidname` option. + +### `SubUIDMap=` + +Create the pod in a new user namespace using the map with name in the /etc/subuid file. +Equivalent to the Podman `--subuidname` option. + +### `UIDMap=` + +Create the pod in a new user namespace using the supplied UID mapping. +Equivalent to the Podman `--uidmap` option. + +This key can be listed multiple times. + +### `UserNS=` + +Set the user namespace mode for the pod. This is equivalent to the Podman `--userns` option and +generally has the form `MODE[:OPTIONS,...]`. + +### `Volume=` + +Mount a volume in the pod. This is equivalent to the Podman `--volume` option, and +generally has the form `[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]`. + +If `SOURCE-VOLUME` starts with `.`, Quadlet resolves the path relative to the location of the unit file. + +Special case: + +* If `SOURCE-VOLUME` ends with `.volume`, Quadlet will look for the corresponding `.volume` Quadlet unit. If found, Quadlet will use the name of the Volume set in the Unit, otherwise, `systemd-$name` is used. Note: the corresponding `.volume` file must exist. + +The generated systemd service contains a dependency on the service unit generated for that `.volume` unit, +or on `$name-volume.service` if the `.volume` unit is not found. + +This key can be listed multiple times. + +## Kube units [Kube] + +Kube units are named with a `.kube` extension and contain a `[Kube]` section describing +how `podman kube play` runs as a service. The resulting service file contains a line like +`ExecStart=podman kube play … file.yml`, and most of the keys in this section control the command-line +options passed to Podman. However, some options also affect the details of how systemd is set up to run and +interact with the container. + +There is only one required key, `Yaml`, which defines the path to the Kubernetes YAML file. + +Valid options for `[Kube]` are listed below: + +| **[Kube] options** | **podman kube play equivalent** | +| ------------------------------------| -----------------------------------------------------------------| +| AutoUpdate=registry | --annotation "io.containers.autoupdate=registry" | +| ConfigMap=/tmp/config.map | --config-map /tmp/config.map | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| ExitCodePropagation=how | How to propagate container error status | +| GlobalArgs=--log-level=debug | --log-level=debug | +| KubeDownForce=true | --force (for `podman kube down`) | +| LogDriver=journald | --log-driver journald | +| Network=host | --network host | +| PodmanArgs=\-\-annotation=key=value | --annotation=key=value | +| PublishPort=8080:80 | --publish 8080:80 | +| SetWorkingDirectory=yaml | Set `WorkingDirectory` of unit file to location of the YAML file | +| UserNS=keep-id\:uid=200,gid=210 | --userns keep-id\:uid=200,gid=210 | +| Yaml=/tmp/kube.yaml | podman kube play /tmp/kube.yaml | + +Supported keys in the `[Kube]` section are: + +### `AutoUpdate=` + +Indicates whether containers will be auto-updated ([podman-auto-update(1)](podman-auto-update.1.md)). AutoUpdate can be specified multiple times. The following values are supported: + +* `registry`: Requires a fully-qualified image reference (e.g., quay.io/podman/stable:latest) to be used to create the container. This enforcement is necessary to know which images to actually check and pull. If an image ID was used, Podman does not know which image to check/pull anymore. + +* `local`: Tells Podman to compare the image a container is using to the image with its raw name in local storage. If an image is updated locally, Podman simply restarts the systemd unit executing the Kubernetes Quadlet. + +* `name/(local|registry)`: Tells Podman to perform the `local` or `registry` autoupdate on the specified container name. + +### `ConfigMap=` + +Pass the Kubernetes ConfigMap YAML path to `podman kube play` via the `--configmap` argument. +Unlike the `configmap` argument, the value may contain only one path but +it may be absolute or relative to the location of the unit file. + +This key may be used multiple times + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `ExitCodePropagation=` + +Control how the main PID of the systemd service should exit. The following values are supported: +- `all`: exit non-zero if all containers have failed (i.e., exited non-zero) +- `any`: exit non-zero if any container has failed +- `none`: exit zero and ignore failed containers + +The current default value is `none`. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `kube` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `KubeDownForce=` + +Remove all resources, including volumes, when calling `podman kube down`. +Equivalent to the Podman `--force` option. + +### `LogDriver=` + +Set the log-driver Podman uses when running the container. +Equivalent to the Podman `--log-driver` option. + +### `Network=` + +Specify a custom network for the container. This has the same format as the `--network` option +to `podman kube play`. For example, use `host` to use the host network in the container, or `none` to +not set up networking in the container. + +Special case: + +* If the `name` of the network ends with `.network`, a Podman network called `systemd-$name` is used, and the generated systemd service contains a dependency on the `$name-network.service`. Such a network can be automatically created by using a `$name.network` Quadlet file. Note: the corresponding `.network` file must exist. + +This key can be listed multiple times. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman kube play` command +in the generated file (right before the path to the yaml file in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `PublishPort=` + +Exposes a port, or a range of ports (e.g. `50-59`), from the container to the host. Equivalent +to the `podman kube play`'s `--publish` option. The format is similar to the Podman options, which is of +the form `ip\:hostPort:containerPort`, `ip::containerPort`, `hostPort:containerPort` or +`containerPort`, where the number of host and container ports must be the same (in the case +of a range). + +If the IP is set to 0.0.0.0 or not set at all, the port is bound on all IPv4 addresses on +the host; use [::] for IPv6. + +The list of published ports specified in the unit file is merged with the list of ports specified +in the Kubernetes YAML file. If the same container port and protocol is specified in both, the +entry from the unit file takes precedence + +This key can be listed multiple times. + +### `SetWorkingDirectory=` + +Set the `WorkingDirectory` field of the `Service` group of the Systemd service unit file. +Used to allow `podman kube play` to correctly resolve relative paths. +Supported values are `yaml` and `unit` to set the working directory to that of the YAML or Quadlet Unit file respectively. + +Alternatively, users can explicitly set the `WorkingDirectory` field of the `Service` group in the `.kube` file. +Please note that if the `WorkingDirectory` field of the `Service` group is set, +Quadlet will not set it even if `SetWorkingDirectory` is set + +### `UserNS=` + +Set the user namespace mode for the container. This is equivalent to the Podman `--userns` option and +generally has the form `MODE[\:OPTIONS,...]`. + +### `Yaml=` + +The path, absolute or relative to the location of the unit file, to the Kubernetes YAML file to use. + +## Network units [Network] + +Network files are named with a `.network` extension and contain a section `[Network]` describing the +named Podman network. The generated service is a one-time command that ensures that the network +exists on the host, creating it if needed. + +By default, the Podman network has the same name as the unit, but with a `systemd-` prefix, i.e. for +a network file named `$NAME.network`, the generated Podman network is called `systemd-$NAME`, and +the generated service file is `$NAME-network.service`. The `NetworkName` option allows for +overriding this default name with a user-provided one. + +Please note that stopping the corresponding service will not remove the podman network. +In addition, updating an existing network is not supported. +In order to update the network parameters you will first need to manually remove the podman network and then restart the service. + +Using network units allows containers to depend on networks being automatically pre-created. This is +particularly interesting when using special options to control network creation, as Podman otherwise creates networks with the default options. + +Valid options for `[Network]` are listed below: + +| **[Network] options** | **podman network create equivalent** | +|-------------------------------------|--------------------------------------| +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| DisableDNS=true | --disable-dns | +| DNS=192.168.55.1 | --dns=192.168.55.1 | +| Driver=bridge | --driver bridge | +| Gateway=192.168.55.3 | --gateway 192.168.55.3 | +| GlobalArgs=--log-level=debug | --log-level=debug | +| Internal=true | --internal | +| IPAMDriver=dhcp | --ipam-driver dhcp | +| IPRange=192.168.55.128/25 | --ip-range 192.168.55.128/25 | +| IPv6=true | --ipv6 | +| Label="XYZ" | --label "XYZ" | +| NetworkName=foo | podman network create foo | +| Options=isolate=true | --opt isolate=true | +| PodmanArgs=--dns=192.168.55.1 | --dns=192.168.55.1 | +| Subnet=192.5.0.0/16 | --subnet 192.5.0.0/16 | + +Supported keys in `[Network]` section are: + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `DisableDNS=` (defaults to `false`) + +If enabled, disables the DNS plugin for this network. + +This is equivalent to the Podman `--disable-dns` option + +### `DNS=` + +Set network-scoped DNS resolver/nameserver for containers in this network. + +This key can be listed multiple times. + +### `Driver=` (defaults to `bridge`) + +Driver to manage the network. Currently `bridge`, `macvlan` and `ipvlan` are supported. + +This is equivalent to the Podman `--driver` option + +### `Gateway=` + +Define a gateway for the subnet. If you want to provide a gateway address, you must also provide a subnet option. + +This is equivalent to the Podman `--gateway` option + +This key can be listed multiple times. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `network` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Internal=` (defaults to `false`) + +Restrict external access of this network. + +This is equivalent to the Podman `--internal` option + +### `IPAMDriver=` + +Set the ipam driver (IP Address Management Driver) for the network. Currently `host-local`, `dhcp` and `none` are supported. + +This is equivalent to the Podman `--ipam-driver` option + +### `IPRange=` + +Allocate container IP from a range. The range must be a either a complete subnet in CIDR notation or be +in the `-` syntax which allows for a more flexible range compared to the CIDR subnet. +The ip-range option must be used with a subnet option. + +This is equivalent to the Podman `--ip-range` option + +This key can be listed multiple times. + +### `IPv6=` + +Enable IPv6 (Dual Stack) networking. + +This is equivalent to the Podman `--ipv6` option + +### `Label=` + +Set one or more OCI labels on the network. The format is a list of +`key=value` items, similar to `Environment`. + +This key can be listed multiple times. + +### `NetworkName=` + +The (optional) name of the Podman network. If this is not specified, the default value of +`systemd-%N` is used, which is the same as the unit name but with a `systemd-` prefix to avoid +conflicts with user-managed networks. + +### `Options=` + +Set driver specific options. + +This is equivalent to the Podman `--opt` option + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman network create` command +in the generated file (right before the name of the network in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Subnet=` + +The subnet in CIDR notation. + +This is equivalent to the Podman `--subnet` option + +This key can be listed multiple times. + +## Volume units [Volume] + +Volume files are named with a `.volume` extension and contain a section `[Volume]` describing the +named Podman volume. The generated service is a one-time command that ensures that the volume +exists on the host, creating it if needed. + +By default, the Podman volume has the same name as the unit, but with a `systemd-` prefix, i.e. for +a volume file named `$NAME.volume`, the generated Podman volume is called `systemd-$NAME`, and the +generated service file is `$NAME-volume.service`. The `VolumeName` option allows for overriding this +default name with a user-provided one. + +Using volume units allows containers to depend on volumes being automatically pre-created. This is +particularly interesting when using special options to control volume creation, +as Podman otherwise creates volumes with the default options. + +Valid options for `[Volume]` are listed below: + +| **[Volume] options** | **podman volume create equivalent** | +|-------------------------------------|-------------------------------------------| +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| Copy=true | --opt copy | +| Device=tmpfs | --opt device=tmpfs | +| Driver=image | --driver=image | +| GlobalArgs=--log-level=debug | --log-level=debug | +| Group=192 | --opt group=192 | +| Image=quay.io/centos/centos\:latest | --opt image=quay.io/centos/centos:latest | +| Label="foo=bar" | --label "foo=bar" | +| Options=XYZ | --opt "o=XYZ" | +| PodmanArgs=--driver=image | --driver=image | +| Type=type | Filesystem type of Device | +| User=123 | --opt uid=123 | +| VolumeName=foo | podman volume create foo | + +Supported keys in `[Volume]` section are: + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `Copy=` (default to `true`) + +If enabled, the content of the image located at the mountpoint of the volume is copied into the +volume on the first run. + +### `Device=` + +The path of a device which is mounted for the volume. + +### `Driver=` + +Specify the volume driver name. When set to `image`, the `Image` key must also be set. + +This is equivalent to the Podman `--driver` option. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `volume` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Group=` + +The host (numeric) GID, or group name to use as the group for the volume + +### `Image=` + +Specifies the image the volume is based on when `Driver` is set to the `image`. +It is recommended to use a fully qualified image name rather than a short name, both for +performance and robustness reasons. + +The format of the name is the same as when passed to `podman pull`. So, it supports using +`\:tag` or digests to guarantee the specific image version. + +Special case: + +* If the `name` of the image ends with `.image`, Quadlet will use the image +pulled by the corresponding `.image` file, and the generated systemd service contains a dependency on the `$name-image.service` (or the service name set in the .image file). Note: the corresponding `.image` file must exist. + +### `Label=` + +Set one or more OCI labels on the volume. The format is a list of +`key=value` items, similar to `Environment`. + +This key can be listed multiple times. + +### `Options=` + +The mount options to use for a filesystem as used by the **mount(8)** command `-o` option. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman volume create` command +in the generated file (right before the name of the volume in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Type=` + +The filesystem type of `Device` as used by the **mount(8)** commands `-t` option. + +### `User=` + +The host (numeric) UID, or user name to use as the owner for the volume + +### `VolumeName=` + +The (optional) name of the Podman volume. If this is not specified, the default value of +`systemd-%N` is used, which is the same as the unit name but with a `systemd-` prefix to avoid +conflicts with user-managed volumes. + +## Build units [Build] + +Build files are named with a `.build` extension and contain a section `[Build]` describing the image +build command. The generated service is a one-time command that ensures that the image is built on +the host from a supplied Containerfile and context directory. Subsequent (re-)starts of the +generated built service will usually finish quickly, as image layer caching will skip unchanged +build steps. + +A minimal `.build` unit needs at least the `ImageTag=` key, and either of `File=` or +`SetWorkingDirectory=` keys. + +Using build units allows containers and volumes to depend on images being built locally. This can be +interesting for creating container images not available on container registries, or for local +testing and development. + +Valid options for `[Build]` are listed below: + +| **[Build] options** | **podman build equivalent** | +|-------------------------------------|---------------------------------------------| +| Annotation=annotation=value | --annotation=annotation=value | +| Arch=aarch64 | --arch=aarch64 | +| AuthFile=/etc/registry/auth\.json | --authfile=/etc/registry/auth\.json | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| DNS=192.168.55.1 | --dns=192.168.55.1 | +| DNSOption=ndots:1 | --dns-option=ndots:1 | +| DNSSearch=example.com | --dns-search example.com | +| Environment=foo=bar | --env foo=bar | +| File=/path/to/Containerfile | --file=/path/to/Containerfile | +| ForceRM=false | --force-rm=false | +| GlobalArgs=--log-level=debug | --log-level=debug | +| GroupAdd=keep-groups | --group-add=keep-groups | +| ImageTag=localhost/imagename | --tag=localhost/imagename | +| Label=label | --label=label | +| Network=host | --network=host | +| PodmanArgs=--pull never | --pull never | +| Pull=never | --pull never | +| Secret=secret | --secret=id=mysecret,src=path | +| SetWorkingDirectory=unit | Set `WorkingDirectory` of systemd unit file | +| Target=my-app | --target=my-app | +| TLSVerify=false | --tls-verify=false | +| Variant=arm/v7 | --variant=arm/v7 | +| Volume=/source:/dest | --volume /source:/dest | + +### `Annotation=` + +Add an image *annotation* (e.g. annotation=*value*) to the image metadata. Can be used multiple +times. + +This is equivalent to the `--annotation` option of `podman build`. + +### `Arch=` + +Override the architecture, defaults to hosts', of the image to be built. + +This is equivalent to the `--arch` option of `podman build`. + +### `AuthFile=` + +Path of the authentication file. + +This is equivalent to the `--authfile` option of `podman build`. + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `DNS=` + +Set network-scoped DNS resolver/nameserver for the build container. + +This key can be listed multiple times. + +This is equivalent to the `--dns` option of `podman build`. + +### `DNSOption=` + +Set custom DNS options. + +This key can be listed multiple times. + +This is equivalent to the `--dns-option` option of `podman build`. + +### `DNSSearch=` + +Set custom DNS search domains. Use **DNSSearch=.** to remove the search domain. + +This key can be listed multiple times. + +This is equivalent to the `--dns-search` option of `podman build`. + +### `Environment=` + +Add a value (e.g. env=*value*) to the built image. This uses the same format as [services in +systemd](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Environment=) and can be +listed multiple times. + +### `File=` + +Specifies a Containerfile which contains instructions for building the image. A URL starting with +`http(s)://` allows you to specify a remote Containerfile to be downloaded. Note that for a given +relative path to a Containerfile, or when using a `http(s)://` URL, you also must set +`SetWorkingDirectory=` in order for `podman build` to find a valid context directory for the +resources specified in the Containerfile. + +Note that setting a `File=` field is mandatory for a `.build` file, unless `SetWorkingDirectory` (or +a `WorkingDirectory` in the `Service` group) has also been set. + +This is equivalent to the `--file` option of `podman build`. + +### `ForceRM=` + +Always remove intermediate containers after a build, even if the build fails (default true). + +This is equivalent to the `--force-rm` option of `podman build`. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `build` in the generated +file. It can be used to access Podman features otherwise unsupported by the generator. Since the +generator is unaware of what unexpected interactions can be caused by these arguments, it is not +recommended to use this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `GroupAdd=` + +Assign additional groups to the primary user running within the container process. Also supports the +`keep-groups` special flag. + +This is equivalent to the `--group-add` option of `podman build`. + +### `ImageTag=` + +Specifies the name which is assigned to the resulting image if the build process completes +successfully. + +This is equivalent to the `--tag` option of `podman build`. + +This key can be listed multiple times. The first instance will be used as the name of the created artifact when the `.build` file is referenced by another Quadlet unit. + +### `Label=` + +Add an image *label* (e.g. label=*value*) to the image metadata. Can be used multiple times. + +This is equivalent to the `--label` option of `podman build`. + +### `Network=` + +Sets the configuration for network namespaces when handling RUN instructions. This has the same +format as the `--network` option to `podman build`. For example, use `host` to use the host network, +or `none` to not set up networking. + +Special case: + +* If the `name` of the network ends with `.network`, Quadlet will look for the corresponding `.network` Quadlet unit. If found, Quadlet will use the name of the Network set in the Unit, otherwise, `systemd-$name` is used. The generated systemd service contains a dependency on the service unit generated for that `.network` unit, or on `$name-network.service` if the `.network` unit is not found. Note: the corresponding `.network` file must exist. + +This key can be listed multiple times. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman build` command +in the generated file (right before the image name in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Pull=` + +Set the image pull policy. + +This is equivalent to the `--pull` option of `podman build`. + +### `Secret=` + +Pass secret information used in Containerfile build stages in a safe way. + +This is equivalent to the `--secret` option of `podman build` and generally has the form +`secret[,opt=opt ...]`. + +### `SetWorkingDirectory=` + +Provide context (a working directory) to `podman build`. Supported values are a path, a URL, or the +special keys `file` or `unit` to set the context directory to the parent directory of the file from +the `File=` key or to that of the Quadlet `.build` unit file, respectively. This allows Quadlet to +resolve relative paths. + +When using one of the special keys (`file` or `unit`), the `WorkingDirectory` field of the `Service` +group of the Systemd service unit will also be set to accordingly. Alternatively, users can +explicitly set the `WorkingDirectory` field of the `Service` group in the `.build` file. Please note +that if the `WorkingDirectory` field of the `Service` group is set by the user, Quadlet will not +overwrite it even if `SetWorkingDirectory` is set to `file` or `unit`. + +By providing a URL to `SetWorkingDirectory=` you can instruct `podman build` to clone a Git +repository or download an archive file extracted to a temporary location by `podman build` as build +context. Note that in this case, the `WorkingDirectory` of the Systemd service unit is left +untouched by Quadlet. + +Note that providing context directory is mandatory for a `.build` file, unless a `File=` key has +also been provided. + +### `Target=` + +Set the target build stage to build. Commands in the Containerfile after the target stage are +skipped. + +This is equivalent to the `--target` option of `podman build`. + +### `TLSVerify=` + +Require HTTPS and verification of certificates when contacting registries. + +This is equivalent to the `--tls-verify` option of `podman build`. + +### `Variant=` + +Override the default architecture variant of the container image to be built. + +This is equivalent to the `--variant` option of `podman build`. + +### `Volume=` + +Mount a volume to containers when executing RUN instructions during the build. This is equivalent to +the `--volume` option of `podman build`, and generally has the form +`[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]`. + +If `SOURCE-VOLUME` starts with `.`, Quadlet resolves the path relative to the location of the unit file. + +Special case: + +* If `SOURCE-VOLUME` ends with `.volume`, Quadlet will look for the corresponding `.volume` Quadlet unit. If found, Quadlet will use the name of the Volume set in the Unit, otherwise, `systemd-$name` is used. The generated systemd service contains a dependency on the service unit generated for that `.volume` unit, or on `$name-volume.service` if the `.volume` unit is not found. Note: the corresponding `.volume` file must exist. + +This key can be listed multiple times. + +## Image units [Image] + +Image files are named with a `.image` extension and contain a section `[Image]` describing the +container image pull command. The generated service is a one-time command that ensures that the image +exists on the host, pulling it if needed. + +Using image units allows containers and volumes to depend on images being automatically pulled. This is +particularly interesting when using special options to control image pulls. + +Valid options for `[Image]` are listed below: + +| **[Image] options** | **podman image pull equivalent** | +|----------------------------------------|--------------------------------------------------| +| AllTags=true | --all-tags | +| Arch=aarch64 | --arch=aarch64 | +| AuthFile=/etc/registry/auth\.json | --authfile=/etc/registry/auth\.json | +| CertDir=/etc/registry/certs | --cert-dir=/etc/registry/certs | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| Creds=myname\:mypassword | --creds=myname\:mypassword | +| DecryptionKey=/etc/registry\.key | --decryption-key=/etc/registry\.key | +| GlobalArgs=--log-level=debug | --log-level=debug | +| Image=quay\.io/centos/centos\:latest | podman image pull quay.io/centos/centos\:latest | +| ImageTag=quay\.io/centos/centos\:latest | Use this name when resolving `.image` references | +| OS=windows | --os=windows | +| PodmanArgs=--os=linux | --os=linux | +| TLSVerify=false | --tls-verify=false | +| Variant=arm/v7 | --variant=arm/v7 | + +### `AllTags=` + +All tagged images in the repository are pulled. + +This is equivalent to the Podman `--all-tags` option. + +### `Arch=` + +Override the architecture, defaults to hosts, of the image to be pulled. + +This is equivalent to the Podman `--arch` option. + +### `AuthFile=` + +Path of the authentication file. + +This is equivalent to the Podman `--authfile` option. + +### `CertDir=` + +Use certificates at path (*.crt, *.cert, *.key) to connect to the registry. + +This is equivalent to the Podman `--cert-dir` option. + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `Creds=` + +The `[username[:password]]` to use to authenticate with the registry, if required. + +This is equivalent to the Podman `--creds` option. + +### `DecryptionKey=` + +The `[key[:passphrase]]` to be used for decryption of images. + +This is equivalent to the Podman `--decryption-key` option. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `image` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Image=` + +The image to pull. +It is recommended to use a fully qualified image name rather than a short name, both for +performance and robustness reasons. + +The format of the name is the same as when passed to `podman pull`. So, it supports using +`:tag` or digests to guarantee the specific image version. + +### `ImageTag=` + +Actual FQIN of the referenced `Image`. +Only meaningful when source is a file or directory archive. + +For example, an image saved into a `docker-archive` with the following Podman command: + +`podman image save --format docker-archive --output /tmp/archive-file.tar quay.io/podman/stable:latest` + +requires setting +- `Image=docker-archive:/tmp/archive-file.tar` +- `ImageTag=quay.io/podman/stable\:latest` + +### `OS=` + +Override the OS, defaults to hosts, of the image to be pulled. + +This is equivalent to the Podman `--os` option. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman image pull` command +in the generated file (right before the image name in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `TLSVerify=` + +Require HTTPS and verification of certificates when contacting registries. + +This is equivalent to the Podman `--tls-verify` option. + +### `Variant=` + +Override the default architecture variant of the container image. + +This is equivalent to the Podman `--variant` option. + +## Quadlet section [Quadlet] +Some quadlet specific configuration is shared between different unit types. Those settings +can be configured in the `[Quadlet]` section. + +Valid options for `[Quadlet]` are listed below: + +| **[Quadlet] options** | **Description** | +|----------------------------|---------------------------------------------------| +| DefaultDependencies=false | Disable implicit network dependencies to the unit | + +### `DefaultDependencies=` + +Add Quadlet's default network dependencies to the unit (default is `true`). + +When set to false, Quadlet will **not** add a dependency (After=, Wants=) to +`network-online.target`/`podman-user-wait-network-online.service` to the generated unit. + +## EXAMPLES + +Example `test.container`: + +``` +[Unit] +Description=A minimal container + +[Container] +# Use the centos image +Image=quay.io/centos/centos:latest + +# Use volume and network defined below +Volume=test.volume:/data +Network=test.network + +# In the container we just run sleep +Exec=sleep 60 + +[Service] +# Restart service when sleep finishes +Restart=always +# Extend Timeout to allow time to pull the image +TimeoutStartSec=900 +# ExecStartPre flag and other systemd commands can go here, see systemd.unit(5) man page. +ExecStartPre=/usr/share/mincontainer/setup.sh + +[Install] +# Start by default on boot +WantedBy=multi-user.target default.target +``` + +Example `test.kube`: +``` +[Unit] +Description=A kubernetes yaml based service +Before=local-fs.target + +[Kube] +Yaml=/opt/k8s/deployment.yml + +[Install] +# Start by default on boot +WantedBy=multi-user.target default.target +``` + +Example for locally built image to be used in a container: + +`test.build` +``` +[Build] +# Tag the image to be built +ImageTag=localhost/imagename + +# Set the working directory to the path of the unit file, +# expecting to find a Containerfile/Dockerfile +# + other files needed to build the image +SetWorkingDirectory=unit +``` + +`test.container` +``` +[Container] +Image=test.build +``` + +Example `test.volume`: + +``` +[Volume] +User=root +Group=root +Label=org.test.Key=value +``` + +Example `test.network`: +``` +[Network] +Subnet=172.16.0.0/24 +Gateway=172.16.0.1 +IPRange=172.16.0.0/28 +Label=org.test.Key=value +``` + +Example for Container in a Pod: + +`test.pod` +``` +[Pod] +PodName=test +``` + +`centos.container` +``` +[Container] +Image=quay.io/centos/centos\:latest +Exec=sh -c "sleep inf" +Pod=test.pod +``` + +Example `s3fs.volume`: + +For further details, please see the [s3fs-fuse](https://github.com/s3fs-fuse/s3fs-fuse) project. +Remember to read the [FAQ](https://github.com/s3fs-fuse/s3fs-fuse/wiki/FAQ) + +> NOTE: Enabling the cache massively speeds up access and write times on static files/objects. + +> However, `use_cache` is [UNBOUNDED](https://github.com/s3fs-fuse/s3fs-fuse/wiki/FAQ#q-how-does-the-local-file-cache-work)! + +> Be careful, it will fill up with any files accessed on the s3 bucket through the file system. + +Please remember to set `S3_BUCKET`, `PATH`, `AWS_REGION`. `CACHE_DIRECTORY` should be set up by [systemd](https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#RuntimeDirectory=) + +``` +[Service] +CacheDirectory=s3fs +ExecStartPre=/usr/local/bin/aws s3api put-object --bucket ${S3_BUCKET} --key ${PATH}/ + +[Volume] +Device=${S3_BUCKET}:/${PATH} +Type=fuse.s3fs +VolumeName=s3fs-volume +Options=iam_role,endpoint=${AWS_REGION},use_xattr,listobjectsv2,del_cache,use_cache=${CACHE_DIRECTORY} +# `iam_role` assumes inside EC2, if not, Use `profile=` instead +``` + +## SEE ALSO +**[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)**, +**[systemd.service(5)](https://www.freedesktop.org/software/systemd/man/systemd.service.html)**, +**[systemd-analyze(1)](https://www.freedesktop.org/software/systemd/man/latest/systemd-analyze.html)**, +**[podman-run(1)](podman-run.1.md)**, +**[podman-network-create(1)](podman-network-create.1.md)**, +**[podman-auto-update(1)](podman-auto-update.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-tag.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-tag.1.md new file mode 100644 index 000000000..be965d482 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-tag.1.md @@ -0,0 +1,51 @@ +--- +title: podman-tag +version: v5.4.1 +--- + +% podman-tag 1 + +## NAME +podman\-tag - Add an additional name to a local image + +## SYNOPSIS +**podman tag** *image*[:*tag*] [*target-name*[:*tag*]...] [*options*] + +**podman image tag** *image*[:*tag*] [*target-name*[:*tag*]...] [*options*] + +## DESCRIPTION +Assigns a new image name to an existing image. A full name refers to the entire +image name, including the optional *tag* after the `:`. If there is no *tag* +provided, then Podman defaults to `latest` for both the *image* and the +*target-name*. + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Tag specified image with an image name defaulting to :latest. +``` +$ podman tag 0e3bbc2 fedora:latest +``` + +Tag specified image with fully specified image name. +``` +$ podman tag httpd myregistryhost:5000/fedora/httpd\:v2 +``` + +Tag specified image with multiple tags. +``` +$ podman tag mymariadb mycontainerregistry.io/namespace/mariadb:10 mycontainerregistry.io/namespace/mariadb:10.11 mycontainerregistry.io/namespace/mariadb:10.11.12 +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +December 2019, Update description to refer to 'name' instead of 'alias' by Sascha Grunert +July 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-top.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-top.1.md new file mode 100644 index 000000000..10ee87875 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-top.1.md @@ -0,0 +1,125 @@ +--- +title: podman-top +version: v5.4.1 +--- + +% podman-top 1 + +## NAME +podman\-top - Display the running processes of a container + +## SYNOPSIS +**podman top** [*options*] *container* [*format-descriptors*] + +**podman container top** [*options*] *container* [*format-descriptors*] + +## DESCRIPTION +Display the running processes of the container. The *format-descriptors* are ps (1) compatible AIX format +descriptors but extended to print additional information, such as the seccomp mode or the effective capabilities +of a given process. The descriptors can either be passed as separated arguments or as a single comma-separated +argument. Note that options and or flags of ps(1) can also be specified; in this case, Podman falls back to +executing ps(1) from the host with the specified arguments and flags in the container namespace. If the container +has the `CAP_SYS_PTRACE` capability then we will execute ps(1) in the container so it must be installed there. +To extract host-related information, use the "h*" descriptors. For instance, `podman top $name hpid huser` +to display the PID and user of the processes in the host context. + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## FORMAT DESCRIPTORS + +The following descriptors are supported in addition to the AIX format descriptors mentioned in ps (1): + +**args, capbnd, capeff, capinh, capprm, comm, etime, group, hgroup, hpid, huser, label, nice, pcpu, pgid, pid, ppid, rgroup, ruser, seccomp, state, time, tty, user, vsz** + +**capbnd** + + Set of bounding capabilities. See capabilities (7) for more information. + +**capeff** + + Set of effective capabilities. See capabilities (7) for more information. + +**capinh** + + Set of inheritable capabilities. See capabilities (7) for more information. + +**capprm** + + Set of permitted capabilities. See capabilities (7) for more information. + +**hgroup** + + The corresponding effective group of a container process on the host. + +**hpid** + + The corresponding host PID of a container process. + +**huser** + + The corresponding effective user of a container process on the host. + +**label** + + Current security attributes of the process. + +**seccomp** + + Seccomp mode of the process (i.e., disabled, strict or filter). See seccomp (2) for more information. + +**state** + + Process state codes (e.g, **R** for *running*, **S** for *sleeping*). See proc(5) for more information. + +**stime** + + Process start time (e.g, "2019-12-09 10:50:36 +0100 CET). + +## EXAMPLES + +By default, `podman-top` prints data similar to `ps -ef`. +``` +$ podman top f5a62a71b07 +USER PID PPID %CPU ELAPSED TTY TIME COMMAND +root 1 0 0.000 20.386825206s pts/0 0s sh +root 7 1 0.000 16.386882887s pts/0 0s sleep +root 8 1 0.000 11.386886562s pts/0 0s vi +``` + +The output can be controlled by specifying format descriptors as arguments after the container. +``` +$ podman top -l pid seccomp args %C +PID SECCOMP COMMAND %CPU +1 filter sh 0.000 +8 filter vi /etc/ 0.000 +``` + +Podman falls back to executing ps(1) from the host in the container namespace if an unknown descriptor is specified. +``` +$ podman top -l -- aux +USER PID PPID %CPU ELAPSED TTY TIME COMMAND +root 1 0 0.000 1h2m12.497061672s ? 0s sleep 100000 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **ps(1)**, **seccomp(2)**, **proc(5)**, **capabilities(7)** + +## HISTORY +July 2018, Introduce format descriptors by Valentin Rothberg + +December 2017, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-troubleshooting.7.md b/versioned_docs/version-5.4.1/source/markdown/podman-troubleshooting.7.md new file mode 100644 index 000000000..ddb713e8c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-troubleshooting.7.md @@ -0,0 +1,1552 @@ +--- +title: Troubleshooting +version: v5.4.1 +--- + +% podman-troubleshooting 7 + + +# Troubleshooting + +## A list of common issues and solutions for Podman + +--- +### 1) Variety of issues - Validate Version + +A large number of issues reported against Podman are often found to already be fixed +in more current versions of the project. Before reporting an issue, please verify the +version you are running with `podman version` and compare it to the latest release +documented on the top of Podman's [README.md](README.md). + +If they differ, please update your version of PODMAN to the latest possible +and retry your command before reporting the issue. + +--- +### 2) Can't use volume mount, get permission denied + +```console +$ podman run -v ~/mycontent:/content fedora touch /content/file +touch: cannot touch '/content/file': Permission denied +``` + +#### Solution + +This is sometimes caused by SELinux, and sometimes by user namespaces. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, you can add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two containers +share the volume content. As a result, Podman labels the content with a shared +content label. Shared volume labels allow all containers to read/write content. +The **Z** option tells Podman to label the content with a private unshared label. +Only the current container can use a private volume. + +```console +$ podman run -v ~/mycontent:/content\:Z fedora touch /content/file +``` + +Make sure the content is private for the container. Do not relabel system directories and content. +Relabeling system content might cause other confined services on your machine to fail. For these +types of containers we recommend having SELinux separation disabled. The option `--security-opt label=disable` +will disable SELinux separation for the container. + +```console +$ podman run --security-opt label=disable -v ~:/home/user fedora touch /home/user/file +``` + +In cases where the container image runs as a specific, non-root user, though, the +solution is to fix the user namespace. This would include container images such as +the Jupyter Notebook image (which runs as "jovyan") and the Postgres image (which runs +as "postgres"). In either case, use the `--userns` switch to map user namespaces, +most of the time by using the **keep-id** option. + +```console +$ podman run -v "$PWD":/home/jovyan/work --userns=keep-id jupyter/scipy-notebook +``` + +--- +### 3) No such image or Bare keys cannot contain ':' + +When doing a `podman pull` or `podman build` command and a "common" image cannot be pulled, +it is likely that the `/etc/containers/registries.conf` file is either not installed or possibly +misconfigured. + +#### Symptom + +```console +$ sudo podman build -f Dockerfile +STEP 1: FROM alpine +error building: error creating build container: no such image "alpine" in registry: image not known +``` + +or + +```console +$ sudo podman pull fedora +error pulling image "fedora": unable to pull fedora: error getting default registries to try: Near line 9 (last key parsed ''): Bare keys cannot contain ':'. +``` + +#### Solution + + * Verify that the `/etc/containers/registries.conf` file exists. If not, verify that the containers-common package is installed. + * Verify that the entries in the `unqualified-search-registries` list of the `/etc/containers/registries.conf` file are valid and reachable. + * i.e. `unqualified-search-registries = ["registry.fedoraproject.org", "quay.io", "registry.access.redhat.com"]` + +--- +### 4) http: server gave HTTP response to HTTPS client + +When doing a Podman command such as `build`, `commit`, `pull`, or `push` to a registry, +TLS verification is turned on by default. If encryption is not used with +those commands, this error can occur. + +#### Symptom + +```console +$ sudo podman push alpine docker://localhost:5000/myalpine\:latest +Getting image source signatures +Get https://localhost:5000/v2/: http: server gave HTTP response to HTTPS client +``` + +#### Solution + +By default TLS verification is turned on when communicating to registries from +Podman. If the registry does not require encryption the Podman commands +such as `build`, `commit`, `pull` and `push` will fail unless TLS verification is turned +off using the `--tls-verify` option. **NOTE:** It is not at all recommended to +communicate with a registry and not use TLS verification. + + * Turn off TLS verification by passing false to the tls-verify option. + * I.e. `podman push --tls-verify=false alpine docker://localhost:5000/myalpine\:latest` + + +For a global workaround, users[1] can create the file `/etc/containers/registries.conf.d/registry-NAME.conf` +(replacing NAME with the name of this registry) with the following content (replacing FULLY.QUALIFIED.NAME.OF.REGISTRY with the address of this registry): + +``` +[[registry]] +location = "FULLY.QUALIFIED.NAME.OF.REGISTRY" +insecure = true +``` + +[1] If you are using a Mac / Windows, you should execute `podman machine ssh` to login into podman machine before adding the insecure entry to the registry—conf file. + +**This is an insecure method and should be used cautiously.** + +--- +### 5) rootless containers cannot ping hosts + +When using the ping command from a non-root container, the command may +fail because of a lack of privileges. + +#### Symptom + +```console +$ podman run --rm fedora ping -W10 -c1 redhat.com +PING redhat.com (209.132.183.105): 56 data bytes + +--- redhat.com ping statistics --- +1 packets transmitted, 0 packets received, 100% packet loss +``` + +#### Solution + +It is most likely necessary to enable unprivileged pings on the host. +Be sure the UID of the user is part of the range in the +`/proc/sys/net/ipv4/ping_group_range` file. + +To change its value you can use something like: + +```console +# sysctl -w "net.ipv4.ping_group_range=0 2000000" +``` + +To make the change persistent, you'll need to add a file in +`/etc/sysctl.d` that contains `net.ipv4.ping_group_range=0 $MAX_UID`. + +--- +### 6) Build hangs when the Dockerfile contains the useradd command + +When the Dockerfile contains a command like `RUN useradd -u 99999000 -g users newuser` the build can hang. + +#### Symptom + +If you are using a useradd command within a Dockerfile with a large UID/GID, it will create a large sparse file `/var/log/lastlog`. This can cause the build to hang forever. Go language does not support sparse files correctly, which can lead to some huge files being created in your container image. + +#### Solution + +If the entry in the Dockerfile looked like: RUN useradd -u 99999000 -g users newuser then add the `--no-log-init` parameter to change it to: `RUN useradd --no-log-init -u 99999000 -g users newuser`. This option tells useradd to stop creating the lastlog file. + +### 7) Permission denied when running Podman commands + +When rootless Podman attempts to execute a container on a non exec home directory a permission error will be raised. + +#### Symptom + +If you are running Podman or Buildah on a home directory that is mounted noexec, +then they will fail with a message like: + +```console +$ podman run centos:7 +standard_init_linux.go:203: exec user process caused "permission denied" +``` + +#### Solution + +Since the administrator of the system set up your home directory to be noexec, you will not be allowed to execute containers from storage in your home directory. It is possible to work around this by manually specifying a container storage path that is not on a noexec mount. Simply copy the file /etc/containers/storage.conf to ~/.config/containers/ (creating the directory if necessary). Specify a graphroot directory which is not on a noexec mount point and to which you have read/write privileges. You will need to modify other fields to writable directories as well. + +For example + +```console +$ cat ~/.config/containers/storage.conf +[storage] + driver = "overlay" + runroot = "/run/user/1000" + graphroot = "/execdir/myuser/storage" + [storage.options] + mount_program = "/bin/fuse-overlayfs" +``` + +### 8) Permission denied when running systemd within a Podman container + +When running systemd as PID 1 inside of a container on an SELinux +separated machine, it needs to write to the cgroup file system. + +#### Symptom + +Systemd gets permission denied when attempting to write to the cgroup file +system, and AVC messages start to show up in the audit.log file or journal on +the system. + +#### Solution + +Newer versions of Podman (2.0 or greater) support running init based containers +with a different SELinux labels, which allow the container process access to the +cgroup file system. This feature requires container-selinux-2.132 or newer +versions. + +Prior to Podman 2.0, the SELinux boolean `container_manage_cgroup` allows +container processes to write to the cgroup file system. Turn on this boolean, +on SELinux separated systems, to allow systemd to run properly in the container. +Only do this on systems running older versions of Podman. + +```console +# setsebool -P container_manage_cgroup true +``` + +### 9) Newuidmap missing when running rootless Podman commands + +Rootless Podman requires the newuidmap and newgidmap programs to be installed. + +#### Symptom + +If you are running Podman or Buildah as a rootless user, you get an error complaining about +a missing newuidmap executable. + +```console +$ podman run -ti fedora sh +command required for rootless mode with multiple IDs: exec: "newuidmap": executable file not found in $PATH +``` + +#### Solution + +Install a version of shadow-utils that includes these executables. Note that for RHEL and CentOS 7, at least the 7.7 release must be installed for support to be available. + +### 10) rootless setup user: invalid argument + +Rootless Podman requires the user running it to have a range of UIDs listed in /etc/subuid and /etc/subgid. + +#### Symptom + +A user, either via --user or through the default configured for the image, is not mapped inside the namespace. + +```console +$ podman run --rm -ti --user 1000000 alpine echo hi +Error: container create failed: container_linux.go:344: starting container process caused "setup user: invalid argument" +``` + +#### Solution + +Update the /etc/subuid and /etc/subgid with fields for users that look like: + +```console +$ cat /etc/subuid +johndoe:100000:65536 +test:165536:65536 +``` + +The format of this file is `USERNAME\:UID\:RANGE` + +* username as listed in `/etc/passwd` or `getpwent`. +* The initial uid allocated for the user. +* The size of the range of UIDs allocated for the user. + +This means johndoe is allocated UIDs 100000-165535 as well as his standard UID in the +`/etc/passwd` file. + +You should ensure that each user has a unique range of UIDs, because overlapping UIDs, +would potentially allow one user to attack another user. In addition, make sure +that the range of UIDs you allocate can cover all UIDs that the container +requires. For example, if the container has a user with UID 10000, ensure you +have at least 10000 subuids, and if the container needs to be run as a user with +UID 1000000, ensure you have at least 1000000 subuids. + +You could also use the `usermod` program to assign UIDs to a user. + +If you update either the `/etc/subuid` or `/etc/subgid` file, you need to +stop all running containers and kill the pause process. This is done +automatically by the `system migrate` command, which can also be used +to stop all the containers and kill the pause process. + +```console +# usermod --add-subuids 200000-201000 --add-subgids 200000-201000 johndoe +# grep johndoe /etc/subuid /etc/subgid +/etc/subuid:johndoe:200000:1001 +/etc/subgid:johndoe:200000:1001 +``` + +### 11) Changing the location of the Graphroot leads to permission denied + +When I change the graphroot storage location in storage.conf, the next time I +run Podman, I get an error like: + +```console +# podman run -p 5000:5000 -it centos bash + +bash: error while loading shared libraries: /lib64/libc.so.6: cannot apply additional memory protection after relocation: Permission denied +``` + +For example, the admin sets up a spare disk to be mounted at `/src/containers`, +and points storage.conf at this directory. + + +#### Symptom + +SELinux blocks containers from using arbitrary locations for overlay storage. +These directories need to be labeled with the same labels as if the content was +under `/var/lib/containers/storage`. + +#### Solution + +Tell SELinux about the new containers storage by setting up an equivalence record. +This tells SELinux to label content under the new path, as if it was stored +under `/var/lib/containers/storage`. + +```console +# semanage fcontext -a -e /var/lib/containers /srv/containers +# restorecon -R -v /srv/containers +``` + +The semanage command above tells SELinux to set up the default labeling of +`/srv/containers` to match `/var/lib/containers`. The `restorecon` command +tells SELinux to apply the labels to the actual content. + +Now all new content created in these directories will automatically be created +with the correct label. + +### 12) Anonymous image pull fails with 'invalid username/password' + +Pulling an anonymous image that doesn't require authentication can result in an +`invalid username/password` error. + +#### Symptom + +If you pull an anonymous image, one that should not require credentials, you can receive +an `invalid username/password` error if you have credentials established in the +authentication file for the target container registry that are no longer valid. + +```console +$ podman run -it --rm docker://docker.io/library/alpine:latest ls +Trying to pull docker://docker.io/library/alpine:latest...ERRO[0000] Error pulling image ref //alpine:latest: Error determining manifest MIME type for docker://alpine:latest: unable to retrieve auth token: invalid username/password +Failed +Error: unable to pull docker://docker.io/library/alpine:latest: unable to pull image: Error determining manifest MIME type for docker://alpine:latest: unable to retrieve auth token: invalid username/password +``` + +This can happen if the authentication file is modified 'by hand' or if the credentials +are established locally and then the password is updated later in the container registry. + +#### Solution + +Depending upon which container tool was used to establish the credentials, use `podman logout` +or `docker logout` to remove the credentials from the authentication file. + +### 13) Running Podman inside a container causes container crashes and inconsistent states + +Running Podman in a container and forwarding some, but not all, of the required host directories can cause inconsistent container behavior. + +#### Symptom + +After creating a container with Podman's storage directories mounted in from the host and running Podman inside a container, all containers show their state as "configured" or "created", even if they were running or stopped. + +#### Solution + +When running Podman inside a container, it is recommended to mount at a minimum `/var/lib/containers/storage/` as a volume. +Typically, you will not mount in the host version of the directory, but if you wish to share containers with the host, you can do so. +If you do mount in the host's `/var/lib/containers/storage`, however, you must also mount in the host's `/run/libpod` and `/run/containers/storage` directories. +Not doing this will cause Podman in the container to detect that temporary files have been cleared, leading it to assume a system restart has taken place. +This can cause Podman to reset container states and lose track of running containers. + +For running containers on the host from inside a container, we also recommend the [Podman remote client](docs/tutorials/remote_client.md), which only requires a single socket to be mounted into the container. + +### 14) Rootless 'podman build' fails EPERM on NFS: + +NFS enforces file creation on different UIDs on the server side and does not understand user namespace, which rootless Podman requires. +When a container root process like YUM attempts to create a file owned by a different UID, NFS Server denies the creation. +NFS is also a problem for the file locks when the storage is on it. Other distributed file systems (for example: Lustre, Spectrum Scale, the General Parallel File System (GPFS)) are also not supported when running in rootless mode as these file systems do not understand user namespace. + +#### Symptom +```console +$ podman build . +ERRO[0014] Error while applying layer: ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied +error creating build container: Error committing the finished image: error adding layer with blob "sha256\:a02a4930cb5d36f3290eb84f4bfa30668ef2e9fe3a1fb73ec015fc58b9958b17": ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied +``` + +#### Solution +Choose one of the following: + * Set up containers/storage in a different directory, not on an NFS share. + * Create a directory on a local file system. + * Edit `~/.config/containers/containers.conf` and point the `volume_path` option to that local directory. (Copy `/usr/share/containers/containers.conf` if `~/.config/containers/containers.conf` does not exist) + * Otherwise just run Podman as root, via `sudo podman` + +### 15) Rootless 'podman build' fails when using OverlayFS: + +The Overlay file system (OverlayFS) requires the ability to call the `mknod` command when creating whiteout files +when extracting an image. However, a rootless user does not have the privileges to use `mknod` in this capacity. + +#### Symptom +```console +$ podman build --storage-driver overlay . +STEP 1: FROM docker.io/ubuntu\:xenial +Getting image source signatures +Copying blob edf72af6d627 done +Copying blob 3e4f86211d23 done +Copying blob 8d3eac894db4 done +Copying blob f7277927d38a done +Copying config 5e13f8dd4c done +Writing manifest to image destination +Storing signatures +Error: creating build container: Error committing the finished image: error adding layer with blob "sha256:8d3eac894db4dc4154377ad28643dfe6625ff0e54bcfa63e0d04921f1a8ef7f8": Error processing tar file(exit status 1): operation not permitted +$ podman build . +ERRO[0014] Error while applying layer: ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied +error creating build container: Error committing the finished image: error adding layer with blob "sha256\:a02a4930cb5d36f3290eb84f4bfa30668ef2e9fe3a1fb73ec015fc58b9958b17": ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied +``` + +#### Solution +Choose one of the following: + * Complete the build operation as a privileged user. + * Install and configure fuse-overlayfs. + * Install the fuse-overlayfs package for your Linux Distribution. + * Add `mount_program = "/usr/bin/fuse-overlayfs"` under `[storage.options]` in your `~/.config/containers/storage.conf` file. + +### 16) RHEL 7 and CentOS 7 based `init` images don't work with cgroup v2 + +The systemd version shipped in RHEL 7 and CentOS 7 doesn't have support for cgroup v2. Support for cgroup v2 requires version 230 of systemd or newer, which +was never shipped or supported on RHEL 7 or CentOS 7. + +#### Symptom +```console +# podman run --name test -d registry.access.redhat.com/rhel7-init\:latest && sleep 10 && podman exec test systemctl status +c8567461948439bce72fad3076a91ececfb7b14d469bfa5fbc32c6403185beff +Failed to get D-Bus connection: Operation not permitted +Error: non zero exit code: 1: OCI runtime error +``` + +#### Solution +You'll need to either: + +* configure the host to use cgroup v1. On Fedora you can do: + +```console +# dnf install -y grubby +# grubby --update-kernel=ALL --args=”systemd.unified_cgroup_hierarchy=0" +# reboot +``` + +* update the image to use an updated version of systemd. + +### 17) rootless containers exit once the user session exits + +You need to set lingering mode through loginctl to prevent user processes to be killed once +the user session completed. + +#### Symptom + +Once the user logs out all the containers exit. + +#### Solution + +```console +# loginctl enable-linger $UID +``` + +### 18) `podman run` fails with "bpf create: permission denied error" + +The Kernel Lockdown patches deny eBPF programs when Secure Boot is enabled in the BIOS. [Matthew Garrett's post](https://mjg59.dreamwidth.org/50577.html) describes the relationship between Lockdown and Secure Boot and [Jan-Philip Gehrcke's](https://gehrcke.de/2019/09/running-an-ebpf-program-may-require-lifting-the-kernel-lockdown/) connects this with eBPF. [RH bug 1768125](https://bugzilla.redhat.com/show_bug.cgi?id=1768125) contains some additional details. + +#### Symptom + +Attempts to run podman result in + +```Error: bpf create : Operation not permitted: OCI runtime permission denied error``` + +#### Solution + +One workaround is to disable Secure Boot in your BIOS. + +### 19) error creating libpod runtime: there might not be enough IDs available in the namespace + +Unable to pull images + +#### Symptom + +```console +$ podman unshare cat /proc/self/uid_map + 0 1000 1 +``` + +#### Solution + +```console +$ podman system migrate +``` + +Original command now returns + +```console +$ podman unshare cat /proc/self/uid_map + 0 1000 1 + 1 100000 65536 +``` + +Reference [subuid](https://man7.org/linux/man-pages/man5/subuid.5.html) and [subgid](https://man7.org/linux/man-pages/man5/subgid.5.html) man pages for more detail. + +### 20) Passed-in devices or files can't be accessed in rootless container + +As a non-root user you have group access rights to a device or files that you +want to pass into a rootless container with `--device=...` or `--volume=...` + +#### Symptom + +Any access inside the container is rejected with "Permission denied". + +#### Solution + +The runtime uses `setgroups(2)` hence the process loses all additional groups +the non-root user has. Use the `--group-add keep-groups` flag to pass the +user's supplementary group access into the container. Currently only available +with the `crun` OCI runtime. + +### 21) A rootless container running in detached mode is closed at logout + + +When running a container with a command like `podman run --detach httpd` as +a rootless user, the container is closed upon logout and is not kept running. + +#### Symptom + +When logging out of a rootless user session, all containers that were started +in detached mode are stopped and are not kept running. As the root user, these +same containers would survive the logout and continue running. + +#### Solution + +When systemd notes that a session that started a Podman container has exited, +it will also stop any containers that have been associated with it. To avoid +this, use the following command before logging out: `loginctl enable-linger`. +To later revert the linger functionality, use `loginctl disable-linger`. + +LOGINCTL(1), SYSTEMD(1) + +### 22) Containers default detach keys conflict with shell history navigation + +Podman defaults to `ctrl-p,ctrl-q` to detach from a running containers. The +bash and zsh shells default to `ctrl-p` for the displaying of the previous +command. This causes issues when running a shell inside of a container. + +#### Symptom + +With the default detach key combo ctrl-p,ctrl-q, shell history navigation +(tested in bash and zsh) using ctrl-p to access the previous command will not +display this previous command, or anything else. Conmon is waiting for an +additional character to see if the user wants to detach from the container. +Adding additional characters to the command will cause it to be displayed along +with the additional character. If the user types ctrl-p a second time the shell +display the 2nd to last command. + +#### Solution + +The solution to this is to change the default detach_keys. For example in order +to change the defaults to `ctrl-q,ctrl-q` use the `--detach-keys` option. + +```console +$ podman run -ti --detach-keys ctrl-q,ctrl-q fedora sh +``` + +To make this change the default for all containers, users can modify the +containers.conf file. This can be done simply in your home directory, but adding the +following lines to users containers.conf + +```console +$ cat >> ~/.config/containers/containers.conf << _eof +[engine] +detach_keys="ctrl-q,ctrl-q" +_eof +``` + +In order to effect root running containers and all users, modify the system +wide defaults in `/etc/containers/containers.conf`. + + +### 23) Container with exposed ports won't run in a pod + +A container with ports that have been published with the `--publish` or `-p` option +can not be run within a pod. + +#### Symptom + +```console +$ podman pod create --name srcview -p 127.0.0.1:3434:3434 -p 127.0.0.1:7080:7080 -p 127.0.0.1:3370:3370 4b2f4611fa2cbd60b3899b936368c2b3f4f0f68bc8e6593416e0ab8ecb0a3f1d + +$ podman run --pod srcview --name src-expose -p 3434:3434 -v "${PWD}:/var/opt/localrepo":Z,ro sourcegraph/src-expose:latest serve /var/opt/localrepo +Error: cannot set port bindings on an existing container network namespace +``` + +#### Solution + +This is a known limitation. If a container will be run within a pod, it is not necessary +to publish the port for the containers in the pod. The port must only be published by the +pod itself. Pod network stacks act like the network stack on the host - you have a +variety of containers in the pod, and programs in the container, all sharing a single +interface and IP address, and associated ports. If one container binds to a port, no other +container can use that port within the pod while it is in use. Containers in the pod can +also communicate over localhost by having one container bind to localhost in the pod, and +another connect to that port. + +In the example from the symptom section, dropping the `-p 3434:3434` would allow the +`podman run` command to complete, and the container as part of the pod would still have +access to that port. For example: + +```console +$ podman run --pod srcview --name src-expose -v "${PWD}:/var/opt/localrepo":Z,ro sourcegraph/src-expose:latest serve /var/opt/localrepo +``` + +### 24) Podman container images fail with `fuse: device not found` when run + +Some container images require that the fuse kernel module is loaded in the kernel +before they will run with the fuse filesystem in play. + +#### Symptom + +When trying to run the container images found at quay.io/podman, quay.io/containers +registry.access.redhat.com/ubi8 or other locations, an error will sometimes be returned: + + +``` +ERRO error unmounting /var/lib/containers/storage/overlay/30c058cdadc888177361dd14a7ed7edab441c58525b341df321f07bc11440e68/merged: invalid argument +error mounting container "1ae176ca72b3da7c70af31db7434bcf6f94b07dbc0328bc7e4e8fc9579d0dc2e": error mounting build container "1ae176ca72b3da7c70af31db7434bcf6f94b07dbc0328bc7e4e8fc9579d0dc2e": error creating overlay mount to /var/lib/containers/storage/overlay/30c058cdadc888177361dd14a7ed7edab441c58525b341df321f07bc11440e68/merged: using mount program /usr/bin/fuse-overlayfs: fuse: device not found, try 'modprobe fuse' first +fuse-overlayfs: cannot mount: No such device +: exit status 1 +ERRO exit status 1 +``` + +#### Solution + +If you encounter a `fuse: device not found` error when running the container image, it is likely that +the fuse kernel module has not been loaded on your host system. Use the command `modprobe fuse` to load the +module and then run the container image afterwards. To enable this automatically at boot time, you can add a configuration +file to `/etc/modules.load.d`. See `man modules-load.d` for more details. + +### 25) podman run --rootfs link/to//read/only/dir does not work + +An error such as "OCI runtime error" on a read-only filesystem or the error "{image} is not an absolute path or is a symlink" are often times indicators for this issue. For more details, review this [issue]( +https://github.com/containers/podman/issues/5895). + +#### Symptom + +Rootless Podman requires certain files to exist in a file system in order to run. +Podman will create /etc/resolv.conf, /etc/hosts and other file descriptors on the rootfs in order +to mount volumes on them. + +#### Solution + +Run the container once in read/write mode, Podman will generate all of the FDs on the rootfs, and +from that point forward you can run with a read-only rootfs. + +```console +$ podman run --rm --rootfs /path/to/rootfs true +``` + +The command above will create all the missing directories needed to run the container. + +After that, it can be used in read-only mode, by multiple containers at the same time: + +```console +$ podman run --read-only --rootfs /path/to/rootfs .... +``` + +Another option is to use an Overlay Rootfs Mount: + +```console +$ podman run --rootfs /path/to/rootfs\:O .... +``` + +Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +### 26) Running containers with resource limits fails with a permissions error + +On some systemd-based systems, non-root users do not have resource limit delegation +permissions. This causes setting resource limits to fail. + +#### Symptom + +Running a container with a resource limit options will fail with an error similar to the following: + +`--cpus`, `--cpu-period`, `--cpu-quota`, `--cpu-shares`: + + Error: OCI runtime error: crun: the requested cgroup controller `cpu` is not available + +`--cpuset-cpus`, `--cpuset-mems`: + + Error: OCI runtime error: crun: the requested cgroup controller `cpuset` is not available + +This means that resource limit delegation is not enabled for the current user. + +#### Solution + +You can verify whether resource limit delegation is enabled by running the following command: + +```console +$ cat "/sys/fs/cgroup/user.slice/user-$(id -u).slice/user@$(id -u).service/cgroup.controllers" +``` + +Example output might be: + + memory pids + +In the above example, `cpu` and `cpuset` are not listed, which means the current user does +not have permission to set CPU or CPUSET limits. + +If you want to enable CPU or CPUSET limit delegation for all users, you can create the +file `/etc/systemd/system/user@.service.d/delegate.conf` with the contents: + +```ini +[Service] +Delegate=memory pids cpu cpuset +``` + +After logging out and logging back in, you should have permission to set +CPU and CPUSET limits. + +### 27) `exec container process '/bin/sh': Exec format error` (or another binary than `bin/sh`) + +This can happen when running a container from an image for another architecture than the one you are running on. + +For example, if a remote repository only has, and thus send you, a `linux/arm64` _OS/ARCH_ but you run on `linux/amd64` (as happened in https://github.com/openMF/community-app/issues/3323 due to https://github.com/timbru31/docker-ruby-node/issues/564). + +### 28) `Error: failed to create sshClient: Connection to bastion host (ssh://user@host:22/run/user/.../podman/podman.sock) failed.: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain` + +In some situations where the client is not on the same machine as where the podman daemon is running the client key could be using a cipher not supported by the host. This indicates an issue with one's SSH config. Until remedied using podman over ssh +with a pre-shared key will be impossible. + +#### Symptom + +The accepted ciphers per `/etc/crypto-policies/back-ends/openssh.config` are not one that was used to create the public/private key pair that was transferred over to the host for ssh authentication. + +You can confirm this is the case by attempting to connect to the host via `podman-remote info` from the client and simultaneously on the host running `journalctl -f` and watching for the error `userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]`. + +#### Solution + +Create a new key using a supported algorithm e.g. ecdsa: + +```console +$ ssh-keygen -t ecdsa -f ~/.ssh/podman +``` + +Then copy the new id over: + +```console +$ ssh-copy-id -i ~/.ssh/podman.pub user@host +``` + +And then re-add the connection (removing the old one if necessary): + +```console +$ podman-remote system connection add myuser --identity ~/.ssh/podman ssh://user@host/run/user/1000/podman/podman.sock +``` + +And now this should work: + +```console +$ podman-remote info +``` + +### 29) Rootless CNI networking fails in RHEL with Podman v2.2.1 to v3.0.1. + +A failure is encountered when trying to use networking on a rootless +container in Podman v2.2.1 through v3.0.1 on RHEL. This error does not +occur on other Linux distributions. + +#### Symptom + +A rootless container is created using a CNI network, but the `podman run` command +returns an error that an image must be built. + +#### Solution + +In order to use a CNI network in a rootless container on RHEL, +an Infra container image for CNI-in-slirp4netns must be created. The +instructions for building the Infra container image can be found for +v2.2.1 [here](https://github.com/containers/podman/tree/v2.2.1-rhel/contrib/rootless-cni-infra), +and for v3.0.1 [here](https://github.com/containers/podman/tree/v3.0.1-rhel/contrib/rootless-cni-infra). + +### 30) Container related firewall rules are lost after reloading firewalld +Container network can't be reached after `firewall-cmd --reload` and `systemctl restart firewalld` Running `podman network reload` will fix it but it has to be done manually. + +#### Symptom +The firewall rules created by podman are lost when the firewall is reloaded. + +#### Solution +[@ranjithrajaram](https://github.com/containers/podman/issues/5431#issuecomment-847758377) has created a systemd-hook to fix this issue + +1) For "firewall-cmd --reload", create a systemd unit file with the following +```ini +[Unit] +Description=firewalld reload hook - run a hook script on firewalld reload +Wants=dbus.service +After=dbus.service + +[Service] +Type=simple +ExecStart=/bin/bash -c '/bin/busctl monitor --system --match "interface=org.fedoraproject.FirewallD1,member=Reloaded" --match "interface=org.fedoraproject.FirewallD1,member=PropertiesChanged" | while read -r line ; do podman network reload --all ; done' + +[Install] +WantedBy=default.target +``` + +2) For "systemctl restart firewalld", create a systemd unit file with the following +```ini +[Unit] +Description=podman network reload +Wants=firewalld.service +After=firewalld.service +PartOf=firewalld.service + +[Service] +Type=simple +RemainAfterExit=yes +ExecStart=/usr/bin/podman network reload --all + +[Install] +WantedBy=default.target +``` + +However, If you use busctl monitor then you can't get machine-readable output on RHEL 8. +Since it doesn't have `busctl -j` as mentioned here by [@yrro](https://github.com/containers/podman/issues/5431#issuecomment-896943018). + +For RHEL 8, you can use the following one-liner bash script. +```ini +[Unit] +Description=Redo podman NAT rules after firewalld starts or reloads +Wants=dbus.service +After=dbus.service +Requires=firewalld.service + +[Service] +Type=simple +ExecStart=/bin/bash -c "dbus-monitor --profile --system 'type=signal,sender=org.freedesktop.DBus,path=/org/freedesktop/DBus,interface=org.freedesktop.DBus,member=NameAcquired,arg0=org.fedoraproject.FirewallD1' 'type=signal,path=/org/fedoraproject/FirewallD1,interface=org.fedoraproject.FirewallD1,member=Reloaded' | sed -u '/^#/d' | while read -r type timestamp serial sender destination path interface member _junk; do if [[ $type = '#'* ]]; then continue; elif [[ $interface = org.freedesktop.DBus && $member = NameAcquired ]]; then echo 'firewalld started'; podman network reload --all; elif [[ $interface = org.fedoraproject.FirewallD1 && $member = Reloaded ]]; then echo 'firewalld reloaded'; podman network reload --all; fi; done" +Restart=Always + +[Install] +WantedBy=default.target +``` +`busctl-monitor` is almost usable in RHEL 8, except that it always outputs two bogus events when it starts up, +one of which is (in its only machine-readable format) indistinguishable from the `NameOwnerChanged` that you get when firewalld starts up. +This means you would get an extra `podman network reload --all` when this unit starts. + +Apart from this, you can use the following systemd service with the python3 code. + +```ini +[Unit] +Description=Redo podman NAT rules after firewalld starts or reloads +Wants=dbus.service +Requires=firewalld.service +After=dbus.service + +[Service] +Type=simple +ExecStart=/usr/bin/python /path/to/python/code/podman-redo-nat.py +Restart=always + +[Install] +WantedBy=default.target +``` +The code reloads podman network twice when you use `systemctl restart firewalld`. +```python3 +import dbus +from gi.repository import GLib +from dbus.mainloop.glib import DBusGMainLoop +import subprocess +import sys + +# I'm a bit confused on the return values in the code +# Not sure if they are needed. + +def reload_podman_network(): + try: + subprocess.run(["podman","network","reload","--all"],timeout=90) + # I'm not sure about this part + sys.stdout.write("podman network reload done\n") + sys.stdout.flush() + except subprocess.TimeoutExpired as t: + sys.stderr.write(f"Podman reload failed due to Timeout {t}") + except subprocess.CalledProcessError as e: + sys.stderr.write(f"Podman reload failed due to {e}") + except Exception as e: + sys.stderr.write(f"Podman reload failed with an Unhandled Exception {e}") + + return False + +def signal_handler(*args, **kwargs): + if kwargs.get('member') == "Reloaded": + reload_podman_network() + elif kwargs.get('member') == "NameOwnerChanged": + reload_podman_network() + else: + return None + return None + +def signal_listener(): + try: + DBusGMainLoop(set_as_default=True)# Define the loop. + loop = GLib.MainLoop() + system_bus = dbus.SystemBus() + # Listens to systemctl restart firewalld with a filter added, will cause podman network to be reloaded twice + system_bus.add_signal_receiver(signal_handler,dbus_interface='org.freedesktop.DBus',arg0='org.fedoraproject.FirewallD1',member_keyword='member') + # Listens to firewall-cmd --reload + system_bus.add_signal_receiver(signal_handler,dbus_interface='org.fedoraproject.FirewallD1',signal_name='Reloaded',member_keyword='member') + loop.run() + except KeyboardInterrupt: + loop.quit() + sys.exit(0) + except Exception as e: + loop.quit() + sys.stderr.write(f"Error occurred {e}") + sys.exit(1) + +if __name__ == "__main__": + signal_listener() +``` + +### 31) Podman run fails with `ERRO[0000] XDG_RUNTIME_DIR directory "/run/user/0" is not owned by the current user` or `Error: creating tmpdir: mkdir /run/user/1000: permission denied`. + +A failure is encountered when performing `podman run` with a warning `XDG_RUNTIME_DIR is pointing to a path which is not writable. Most likely podman will fail.` + +#### Symptom + +A rootless container is being invoked with cgroup configuration as `cgroupv2` for user with missing or invalid **systemd session**. + +Example cases +```console +# su user1 -c 'podman images' +ERRO[0000] XDG_RUNTIME_DIR directory "/run/user/0" is not owned by the current user +``` +```console +# su - user1 -c 'podman images' +Error: creating tmpdir: mkdir /run/user/1000: permission denied +``` + +#### Solution + +Podman expects a valid login session for the `rootless+cgroupv2` use-case. Podman execution is expected to fail if the login session is not present. In most cases, podman will figure out a solution on its own but if `XDG_RUNTIME_DIR` is pointing to a path that is not writable execution will most likely fail. Typical scenarios of such cases are seen when users are trying to use Podman with `su - -c ''`, or `sudo -l` and badly configured systemd session. + +Alternatives: + +* Execute Podman via __systemd-run__ that will first start a systemd login session: + + ```console + $ sudo systemd-run --machine=username@ --quiet --user --collect --pipe --wait podman run --rm docker.io/library/alpine echo hello + ``` +* Start an interactive shell in a systemd login session with the command `machinectl shell @` + and then run Podman + + ```console + $ sudo -i + # machinectl shell username@ + Connected to the local host. Press ^] three times within 1s to exit session. + $ podman run --rm docker.io/library/alpine echo hello + ``` +* Start a new systemd login session by logging in with `ssh` i.e. `ssh @localhost` and then run Podman. + +* Before invoking Podman command create a valid login session for your rootless user using `loginctl enable-linger ` + +### 32) 127.0.0.1:7777 port already bound + +After deleting a VM on macOS, the initialization of subsequent VMs fails. + +#### Symptom + +After deleting a client VM on macOS via `podman machine stop` && `podman machine rm`, attempting to `podman machine init` a new client VM leads to an error with the 127.0.0.1:7777 port already bound. + +#### Solution + +You will need to remove the hanging gv-proxy process bound to the port in question. For example, if the port mentioned in the error message is 127.0.0.1:7777, you can use the command `kill -9 $(lsof -i:7777)` in order to identify and remove the hanging process which prevents you from starting a new VM on that default port. + +### 33) The sshd process fails to run inside of the container. + +#### Symptom + +The sshd process running inside the container fails with the error +"Error writing /proc/self/loginuid". + +### Solution + +If the `/proc/self/loginuid` file is already initialized then the +`CAP_AUDIT_CONTROL` capability is required to override it. + +This happens when running Podman from a user session since the +`/proc/self/loginuid` file is already initialized. The solution is to +run Podman from a system service, either using the Podman service, and +then using podman -remote to start the container or simply by running +something like `systemd-run podman run ...`. In this case the +container will only need `CAP_AUDIT_WRITE`. + +### 34) Container creates a file that is not owned by the user's regular UID + +After running a container with rootless Podman, the non-root user sees a numerical UID and GID instead of a username and groupname. + +#### Symptom + +When listing file permissions with `ls -l` on the host in a directory that was passed as `--volume /some/dir` to `podman run`, +the UID and GID are displayed rather than the corresponding username and groupname. The UID and GID numbers displayed are +from the user's subordinate UID and GID ranges on the host system. + +An example + +```console +$ mkdir dir1 +$ chmod 777 dir1 +$ podman run --rm -v ./dir1:/dir1\:Z \ + --user 2003:2003 \ + docker.io/library/ubuntu bash -c "touch /dir1/a; chmod 600 /dir1/a" +$ ls -l dir1/a +-rw-------. 1 102002 102002 0 Jan 19 19:35 dir1/a +$ less dir1/a +less: dir1/a: Permission denied +``` + +#### Solution + +If you want to read, chown, or remove such a file, enter a user +namespace. Instead of running commands such as `less dir1/a` or `rm dir1/a`, you +need to prepend the command-line with `podman unshare`, i.e., +`podman unshare less dir1/a` or `podman unshare rm dir1/a`. To change the ownership +of the file `dir1/a` to your regular user's UID and GID, run `podman unshare chown 0:0 dir1/a`. +A file having the ownership `0:0` in the user namespace is owned by the regular +user on the host. To use Bash features, such as variable expansion and +globbing, you need to wrap the command with `bash -c`, e.g. +`podman unshare bash -c 'ls $HOME/dir1/a*'`. + +Would it have been possible to run Podman in another way so that your regular +user would have become the owner of the file? Yes, you can use the option +`--userns keep-id:uid=$uid,gid=$gid` to change how UIDs and GIDs are mapped +between the container and the host. Let's try it out. + +In the example above `ls -l` shows the UID 102002 and GID 102002. Set shell variables + +```console +$ uid_from_ls=102002 +$ gid_from_ls=102002 +``` + +Set shell variables to the lowest subordinate UID and GID + +```console +$ lowest_subuid=$(podman info --format "{{ (index .Host.IDMappings.UIDMap 1).HostID }}") +$ lowest_subgid=$(podman info --format "{{ (index .Host.IDMappings.GIDMap 1).HostID }}") +``` + +Compute the UID and GID inside the container that map to the owner of the created file on the host. + +```console +$ uid=$(( $uid_from_ls - $lowest_subuid + 1)) +$ gid=$(( $gid_from_ls - $lowest_subgid + 1)) +``` +(In the computation it was assumed that there is only one subuid range and one subgid range) + +```console +$ echo $uid +2003 +$ echo $gid +2003 +``` + +The computation shows that the UID is `2003` and the GID is `2003` inside the container. +This comes as no surprise as this is what was specified before with `--user=2003:2003`, +but the same computation could be used whenever a username is specified +or the `--user` option is not used. + +Run the container again but now with UIDs and GIDs mapped + +```console +$ mkdir dir1 +$ chmod 777 dir1 +$ podman run --rm + -v ./dir1:/dir1:Z \ + --user $uid:$gid \ + --userns keep-id:uid=$uid,gid=$gid \ + docker.io/library/ubuntu bash -c "touch /dir1/a; chmod 600 /dir1/a" +$ id -u +tester +$ id -g +tester +$ ls -l dir1/a +-rw-------. 1 tester tester 0 Jan 19 20:31 dir1/a +$ +``` + +In this example the `--user` option specified a rootless user in the container. +As the rootless user could also have been specified in the container image, e.g. + +```console +$ podman image inspect --format "user: {{.User}}" IMAGE +user: hpc +``` +the same problem could also occur even without specifying `--user`. + +Another variant of the same problem could occur when using +`--user=root:root` (the default), but where the root user creates non-root owned files +in some way (e.g by creating them themselves, or switching the effective UID to +a rootless user and then creates files). + +See also the troubleshooting tip: + +[_Podman run fails with "Error: unrecognized namespace mode keep-id\:uid=1000,gid=1000 passed"_](#39-podman-run-fails-with-error-unrecognized-namespace-mode-keep-iduid1000gid1000-passed) + +### 35) Passed-in devices or files can't be accessed in rootless container (UID/GID mapping problem) + +As a non-root user you have access rights to devices, files and directories that you +want to pass into a rootless container with `--device=...`, `--volume=...` or `--mount=..`. + +Podman by default maps a non-root user inside a container to one of the user's +subordinate UIDs and subordinate GIDs on the host. When the container user tries to access a +file, a "Permission denied" error could occur because the container user does not have the +permissions of the regular user of the host. + +#### Symptom + +* Any access inside the container is rejected with "Permission denied" +for files, directories or devices passed in to the container +with `--device=..`,`--volume=..` or `--mount=..`, e.g. + +```console +$ mkdir dir1 +$ chmod 700 dir1 +$ podman run --rm -v ./dir1:/dir1:Z \ + --user 2003:2003 \ + docker.io/library/ubuntu ls /dir1 +ls: cannot open directory '/dir1': Permission denied +``` + +#### Solution + +We follow essentially the same solution as in the previous +troubleshooting tip: + +[_Container creates a file that is not owned by the user's regular UID_](#34-container-creates-a-file-that-is-not-owned-by-the-users-regular-uid) + +but for this problem the container UID and GID can't be as +easily computed by mere addition and subtraction. + +In other words, it might be more challenging to find out the UID and +the GID inside the container that we want to map to the regular +user on the host. + +If the `--user` option is used together with a numerical UID and GID +to specify a rootless user, we already know the answer. + +If the `--user` option is used together with a username and groupname, +we could look up the UID and GID in the file `/etc/passwd` of the container. + +If the container user is not set via `--user` but instead from the +container image, we could inspect the container image + +```console +$ podman image inspect --format "user: {{.User}}" IMAGE +user: hpc +``` + +and then look it up in `/etc/passwd` of the container. + +If the problem occurs in a container that is started to run as root but later +switches to an effictive UID of a rootless user, it might be less +straightforward to find out the UID and the GID. Reading the +`Containerfile`, `Dockerfile` or the `/etc/passwd` could give a clue. + +To run the container with the rootless container UID and GID mapped to the +user's regular UID and GID on the host follow these steps: + +Set the `uid` and `gid` shell variables in a Bash shell to the UID and GID +of the user that will be running inside the container, e.g. + +```console +$ uid=2003 +$ gid=2003 +``` + +and run + +```console +$ mkdir dir1 +$ echo hello > dir1/file.txt +$ chmod 700 dir1/file.txt +$ podman run --rm \ + -v ./dir1:/dir1:Z \ + --user $uid:$gid \ + --userns keep-id:uid=$uid,gid=$gid \ + docker.io/library/alpine cat /dir1/file.txt +hello +``` + +See also the troubleshooting tip: + +[_Podman run fails with "Error: unrecognized namespace mode keep-id:uid=1000,gid=1000 passed"_](#39-podman-run-fails-with-error-unrecognized-namespace-mode-keep-iduid1000gid1000-passed) + +### 36) Images in the additional stores can be deleted even if there are containers using them + +When an image in an additional store is used, it is not locked thus it +can be deleted even if there are containers using it. + +#### Symptom + +WARN[0000] Can't stat lower layer "/var/lib/containers/storage/overlay/l/7HS76F2P5N73FDUKUQAOJA3WI5" because it does not exist. Going through storage to recreate the missing symlinks. + +#### Solution + +It is the user responsibility to make sure images in an additional +store are not deleted while being used by containers in another +store. + +### 37) Syncing bugfixes for podman-remote or setups using Podman API + +After upgrading Podman to a newer version an issue with the earlier version of Podman still presents itself while using podman-remote. + +#### Symptom + +While running podman remote commands with the most updated Podman, issues that were fixed in a prior version of Podman can arise either on the Podman client side or the Podman server side. + +#### Solution + +When upgrading Podman to a particular version for the required fixes, users often make the mistake of only upgrading the Podman client. However, suppose a setup uses `podman-remote` or uses a client that communicates with the Podman server on a remote machine via the REST API. In that case, it is required to upgrade both the Podman client and the Podman server running on the remote machine. Both the Podman client and server must be upgraded to the same version. + +Example: If a particular bug was fixed in `v4.1.0` then the Podman client must have version `v4.1.0` as well the Podman server must have version `v4.1.0`. + +### 38) Unexpected carriage returns are outputted on the terminal + +When using the __--tty__ (__-t__) flag, unexpected carriage returns are outputted on the terminal. + +#### Symptom + +The container program prints a newline (`\n`) but the terminal outputs a carriage return and a newline (`\r\n`). + +``` +$ podman run --rm -t fedora echo abc | od -c +0000000 a b c \r \n +0000005 +``` + +When run directly on the host, the result is as expected. + +``` +$ echo abc | od -c +0000000 a b c \n +0000004 +``` + +Extra carriage returns can also shift the prompt to the right. + +``` +$ podman run --rm -t fedora sh -c "echo 1; echo 2; echo 3" | cat -A +1^M$ + 2^M$ + 3^M$ + $ +``` + +#### Solution + +Run Podman without the __--tty__ (__-t__) flag. + +``` +$ podman run --rm fedora echo abc | od -c +0000000 a b c \n +0000004 +``` + +The __--tty__ (__-t__) flag should only be used when the program requires user interaction in the termainal, for instance expecting +the user to type an answer to a question. + +Where does the extra carriage return `\r` come from? + +The extra `\r` is not outputted by Podman but by the terminal. In fact, a reconfiguration of the terminal can make the extra `\r` go away. + +``` +$ podman run --rm -t fedora /bin/sh -c "stty -onlcr && echo abc" | od -c +0000000 a b c \n +0000004 +``` + +### 39) Podman run fails with "Error: unrecognized namespace mode keep-id:uid=1000,gid=1000 passed" + +Podman 4.3.0 introduced the options _uid_ and _gid_ that can be given to `--userns keep-id` which are not recognized by older versions of Podman. + +#### Symptom + +When using a Podman version older than 4.3.0, the options _uid_ and _gid_ are not recognized, and an "unrecognized namespace mode" error is raised. + +``` +$ uid=1000 +$ gid=1000 +$ podman run --rm + --user $uid:$gid \ + --userns keep-id:uid=$uid,gid=$gid \ + docker.io/library/ubuntu /bin/cat /proc/self/uid_map +Error: unrecognized namespace mode keep-id:uid=1000,gid=1000 passed +$ +``` + +#### Solution + +Use __--uidmap__ and __--gidmap__ options to describe the same UID and GID mapping. + +Run + +``` +$ uid=1000 +$ gid=1000 +$ subuidSize=$(( $(podman info --format "{{ range \ + .Host.IDMappings.UIDMap }}+{{.Size }}{{end }}" ) - 1 )) +$ subgidSize=$(( $(podman info --format "{{ range \ + .Host.IDMappings.GIDMap }}+{{.Size }}{{end }}" ) - 1 )) +$ podman run --rm \ + --user $uid:$gid \ + --uidmap 0:1:$uid \ + --uidmap $uid:0:1 \ + --uidmap $(($uid+1)):$(($uid+1)):$(($subuidSize-$uid)) \ + --gidmap 0:1:$gid \ + --gidmap $gid:0:1 \ + --gidmap $(($gid+1)):$(($gid+1)):$(($subgidSize-$gid)) \ + docker.io/library/ubuntu /bin/cat /proc/self/uid_map + 0 1 1000 + 1000 0 1 + 1001 1001 64536 +``` + +which uses the same UID and GID mapping as when specifying +`--userns keep-id:uid=$uid,gid=$gid` with Podman 4.3.0 (or greater) + +``` +$ uid=1000 +$ gid=1000 +$ podman run --rm \ + --user $uid:$gid \ + --userns keep-id:uid=$uid,gid=$gid \ + docker.io/library/ubuntu /bin/cat /proc/self/uid_map + 0 1 1000 + 1000 0 1 + 1001 1001 64536 +``` + +Replace `/bin/cat /proc/self/uid_map` with +`/bin/cat /proc/self/gid_map` to show the GID mapping. + +### 40) Podman fails to find expected image with "error locating pulled image", "image not known" + +When trying to do a Podman command that pulls an image from local storage or a remote repository, +an error is raised saying "image not known" or "error locating pulled image". Even though the image +had been verified before the Podman command was invoked. + +#### Symptom + +After verifying that an image is in place either locally or on a remote repository, a Podman command +referencing that image will fail in a manner like: +``` +# ls Containerfile +FROM registry.access.redhat.com/ubi8-minimal:latest +MAINTAINER Podman Community +USER root + +# podman build . +STEP 1/2: FROM registry.access.redhat.com/ubi8-minimal +Trying to pull registry.access.redhat.com/ubi8-minimal:latest... +Getting image source signatures +Checking if image destination supports signatures +Copying blob a6577091999b done +Copying config abb1ba1bce done +Writing manifest to image destination +Storing signatures +Error: error creating build container: error locating pulled image "registry.access.redhat.com/ubi8-minimal:latest" name in containers storage: registry.access.redhat.com/ubi8-minimal\:latest: image not known +``` + +#### Solution +The general cause for this is a timing issue. To make Podman commands as +efficient as possible, read and write locks are only established for critical +sections within the code. When pulling an image from a repository, a copy of +that image is first written to local storage using a write lock. This lock is +released before the image is then acquired/read. If another process does a +harmful command such as `podman system prune --all` or `podman system reset` +or `podman rmi --all`, between the time the image is written and before the +first process can acquire it, this type of `image not known` error can arise. + +The maintainers of Podman have considered heavier-duty locks to close this +timing window. However, the slowdown that all Podman commands would encounter +was not considered worth the cost of completely closing this small timing window. + +### 41) A podman build step with `--mount=type=secret` fails with "operation not permitted" + +Executing a step in a `Dockerfile`/`Containerfile` which mounts secrets using `--mount=type=secret` fails with "operation not permitted" when running on a host filesystem mounted with `nosuid` and when using the `runc` runtime. + +#### Symptom + +A `RUN` line in the `Dockerfile`/`Containerfile` contains a [secret mount](https://github.com/containers/common/blob/main/docs/Containerfile.5.md) such as `--mount=type=secret,id=MY_USER,target=/etc/dnf/vars/MY_USER`. +When running `podman build` the process fails with an error message like: + +``` +STEP 3/13: RUN --mount=type=secret,id=MY_USER,target=/etc/dnf/vars/MY_USER --mount=type=secret,id=MY_USER,target=/etc/dnf/vars/MY_USER ...: time="2023-06-13T18:04:59+02:00" level=error msg="runc create failed: unable to start container process: error during container init: error mounting \"/var/tmp/buildah2251989386/mnt/buildah-bind-target-11\" to rootfs at \"/etc/dnf/vars/MY_USER\": mount /var/tmp/buildah2251989386/mnt/buildah-bind-target-11:/etc/dnf/vars/MY_USER (via /proc/self/fd/7), flags: 0x1021: operation not permitted" +: exit status 1 +ERRO[0002] did not get container create message from subprocess: EOF +``` + +#### Solution + +* Install `crun`, e.g. with `dnf install crun`. +* Use the `crun` runtime by passing `--runtime /usr/bin/crun` to `podman build`. + +See also [Buildah issue 4228](https://github.com/containers/buildah/issues/4228) for a full discussion of the problem. + +### 42) podman-in-podman builds that are file I/0 intensive are very slow + +When using the `overlay` storage driver to do a nested `podman build` inside a running container, file I/O operations such as `COPY` of a large amount of data is very slow or can hang completely. + +#### Symptom + +Using the default `overlay` storage driver, a `COPY`, `ADD`, or an I/O intensive `RUN` line in a `Containerfile` that is run inside another container is very slow or hangs completely when running a `podman build` inside the running parent container. + +#### Solution + +This could be caused by the child container using `fuse-overlayfs` for writing to `/var/lib/containers/storage`. Writes can be slow with `fuse-overlayfs`. The solution is to use the native `overlay` filesystem by using a local directory on the host system as a volume to `/var/lib/containers/storage` like so: `podman run --privileged --rm -it -v ./nested_storage:/var/lib/containers/storage parent:latest`. Ensure that the base image of `parent:latest` in this example has no contents in `/var/lib/containers/storage` in the image itself for this to work. Once using the native volume, the nested container should not fall back to `fuse-overlayfs` to write files and the nested build will complete much faster. + +If you don't have access to the parent run process, such as in a CI environment, then the second option is to change the storage driver to `vfs` in the parent image by changing changing this line in your `storage.conf` file: `driver = "vfs"`. You may have to run `podman system reset` for this to take effect. You know it's changed when `podman info |grep graphDriverName` outputs `graphDriverName: vfs`. This method is slower performance than using the volume method above but is significantly faster than `fuse-overlayfs` + +### 43) `podman run --userns=auto` fails with "Error: creating container storage: not enough unused IDs in user namespace" + +Using `--userns=auto` when creating new containers does not work as long as any containers exist that were created with `--userns=keep-id` or `--userns=nomap` + +#### Symptom + +1. Run with `--userns=auto` + ``` + $ podman run --rm -d --userns=auto alpine sleep 3600 + ``` + The command succeeds. +2. Run with `--userns=auto` + ``` + $ podman run --rm -d --userns=auto alpine sleep 3600 + ``` + The command succeeds. +3. Run with `--userns=keep-id` + ``` + $ podman run --rm -d --userns=keep-id alpine sleep 3600 + ``` + The command succeeds. +4. Run with `--userns=auto` + ``` + $ podman run --rm -d --userns=auto alpine sleep 3600 + ``` + The command fails with the error message + ``` + Error: creating container storage: not enough unused IDs in user namespace + ``` + +#### Solution + +Any existing containers that were created using `--userns=keep-id` or `--userns=nomap` must first be deleted before any new container can be created with `--userns=auto` + +### 44) `sudo podman run --userns=auto` fails with `Cannot find mappings for user "containers"` + +When rootful podman is invoked with `--userns=auto`, podman needs to +pick subranges of subuids and subgids for the user namespace of the container. +Rootful podman ensures that the subuid and subgid ranges for such containers +do not overlap, but how can rootful podman prevent other tools +from accidentally using these IDs? + +It's not possible to block other tools that are running as root from using these IDs, +but such tools would normally not use subuids and subgids that have already +been assigned to a user in _/etc/subuid_ and _/etc/subgid_. + +The username _containers_ on the host has a special function for rootful Podman. +Rootful podman uses the subuids and subgids of the user _containers_ when +running `--userns=auto` containers. The user _containers_ has no need for these +subuids and subgids because no processes should be started as the user _containers_. +In other words, the user _containers_ is a special user that only exists on the system +to reserve _subuids_ and _subgids_ for rootful podman. + +_containers_ is the default username but it can be changed by setting the +option `root-auto-userns-user` in the file _/etc/containers/storage.conf_ + +#### Symptom + +Run rootful podman with `--userns=auto` +``` +sudo podman run --rm --userns=auto alpine echo hello +``` +The command fails with the error message: +``` +ERRO[0000] Cannot find mappings for user "containers": no subuid ranges found for user "containers" in /etc/subuid +Error: creating container storage: not enough unused IDs in user namespace +``` + +The files _/etc/subuid_ and _/etc/subgid_ do not have any lines that start with `containers:` + +#### Solution + +Add subuid and subgid ranges for the user _containers_ in _/etc/subuid_ and _/etc/subgid_ +or provide such ranges with _/etc/nsswitch.conf_. +For details, see [subid(5)](https://man7.org/linux/man-pages/man5/subuid.5.html). + +The following steps create the user _containers_ and assigns big subuid and subgid ranges to it: + +1. Create the user _containers_ + ``` + sudo useradd --comment "Helper user to reserve subuids and subgids for Podman" \ + --no-create-home \ + --shell /usr/sbin/nologin \ + containers + ``` +2. Check the subuid and subgid ranges of the user _containers_ + ``` + $ grep ^containers: /etc/subuid + containers:720896:65536 + $ grep ^containers: /etc/subgid + containers:720896:65536 + ``` + By default __useradd__ assigns 65536 subuids and 65536 subgids to a new user. + Typically you would like the reserved pool to be bigger than that. The bigger + the size, the more containers could be started with `sudo podman run --userns=auto ...` +3. Edit the line for the user _containers_ in the files _/etc/subuid_ and _/etc/subgid_ + to make the ranges bigger. Ensure that the subuid range of the user _containers_ do + not overlap with any other subuid ranges in the files _/etc/subuid_. Ensure that the + subgid range of the user _containers_ do not overlap with any other subgid ranges in + the files _/etc/subgid_. + +Test the echo command again + +``` +sudo podman run --rm --userns=auto alpine echo hello +``` + +The command succeeds and prints `hello` diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-unmount.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-unmount.1.md new file mode 100644 index 000000000..1a0828dfe --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-unmount.1.md @@ -0,0 +1,75 @@ +--- +title: podman-unmount +version: v5.4.1 +--- + +% podman-unmount 1 + +## NAME +podman\-unmount - Unmount a working container's root filesystem + +## SYNOPSIS +**podman unmount** [*options*] *container* [...] + +**podman umount** [*options*] *container* [...] + +**podman container unmount** [*options*] *container* [...] + +**podman container umount** [*options*] *container* [...] + +## DESCRIPTION +Unmounts the specified containers' root file system, if no other processes +are using it. + +Container storage increments a mount counter each time a container is mounted. +When a container is unmounted, the mount counter is decremented, and the +container's root filesystem is physically unmounted only when the mount +counter reaches zero indicating no other processes are using the mount. +An unmount can be forced with the --force flag. + +Note: Podman can be used to unmount Podman containers as well as external containers. +External containers are containers created in container/storage by other tools like +Buildah and CRI-O. + +## OPTIONS +#### **--all**, **-a** + +All of the currently mounted containers are unmounted. + +#### **--force**, **-f** + +Force the unmounting of specified containers' root file system, even if other +processes have mounted it. + +Note: Other processes can fail if the mount point they are using is removed without their knowledge. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Unmount container with a given ID: +``` +podman container unmount containerID +``` + +Unmount multiple containers with given IDs: +``` +podman unmount containerID1 containerID2 containerID3 +``` + +Unmount all containers: +``` +podman unmount --all +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-mount(1)](podman-mount.1.md)**, **[podman-image-mount(1)](podman-image-mount.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-unpause.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-unpause.1.md new file mode 100644 index 000000000..5929a18a7 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-unpause.1.md @@ -0,0 +1,102 @@ +--- +title: podman-unpause +version: v5.4.1 +--- + +% podman-unpause 1 + +## NAME +podman\-unpause - Unpause one or more containers + +## SYNOPSIS +**podman unpause** [*options*]|[*container* ...] + +**podman container unpause** [*options*]|[*container* ...] + +## DESCRIPTION +Unpauses the processes in one or more containers. Container IDs or names can be used as input. + +## OPTIONS + +#### **--all**, **-a** + +Unpause all paused containers. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and unpause the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + +#### **--filter**, **-f**=*filter* + +Filter what containers unpause. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Unpause specified container: +``` +podman unpause mywebserver +``` + +Unpause container by a partial container ID: +``` +podman unpause 860a4b23 +``` + +Unpause all **paused** containers: +``` +podman unpause --all +``` + +Unpause container using ID specified in given files: +``` +podman unpause --cidfile /home/user/cidfile-1 +podman unpause --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +Unpause the latest container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman unpause --latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pause(1)](podman-pause.1.md)** + +## HISTORY +September 2017, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-unshare.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-unshare.1.md new file mode 100644 index 000000000..a552d5824 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-unshare.1.md @@ -0,0 +1,114 @@ +--- +title: podman-unshare +version: v5.4.1 +--- + +% podman-unshare 1 + +## NAME +podman\-unshare - Run a command inside of a modified user namespace + +## SYNOPSIS +**podman unshare** [*options*] [*command*] + +## DESCRIPTION +Launches a process (by default, *$SHELL*) in a new user namespace. The user +namespace is configured so that the invoking user's UID and primary GID appear +to be UID 0 and GID 0, respectively. Any ranges which match that user and +group in `/etc/subuid` and `/etc/subgid` are also mapped in as themselves with the +help of the *newuidmap(1)* and *newgidmap(1)* helpers. + +**podman unshare** is useful for troubleshooting unprivileged operations and for +manually clearing storage and other data related to images and containers. + +It is also useful to use the **podman mount** command. If an unprivileged user wants to mount and work with a container, then they need to execute +**podman unshare**. Executing **podman mount** fails for unprivileged users unless the user is running inside a **podman unshare** session. + +The unshare session defines two environment variables: + +- **CONTAINERS_GRAPHROOT**: the path to the persistent container's data. +- **CONTAINERS_RUNROOT**: the path to the volatile container's data. + +*IMPORTANT: This command is not available with the remote Podman client.* + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--rootless-netns** + +Join the rootless network namespace used for netavark networking. It can be used to +connect to a rootless container via IP address (bridge networking). This is otherwise +not possible from the host network namespace. + +## Exit Codes + +The exit code from `podman unshare` gives information about why the container +failed to run or why it exited. When `podman unshare` commands exit with a non-zero code, +the exit codes follow the `chroot` standard, see below: + + **125** The error is with podman **_itself_** + + $ podman unshare --foo; echo $? + Error: unknown flag: --foo + 125 + + **126** Executing a _contained command_ and the _command_ cannot be invoked + + $ podman unshare /etc; echo $? + Error: fork/exec /etc: permission denied + 126 + + **127** Executing a _contained command_ and the _command_ cannot be found + + $ podman unshare foo; echo $? + Error: fork/exec /usr/bin/bogus: no such file or directory + 127 + + **Exit code** _contained command_ exit code + + $ podman unshare /bin/sh -c 'exit 3'; echo $? + 3 + +## EXAMPLE + +Execute specified command in rootless user namespace: +``` +$ podman unshare id +uid=0(root) gid=0(root) groups=0(root),65534(nobody) +``` + +Show user namespace mappings for rootless containers: +``` +$ podman unshare cat /proc/self/uid_map /proc/self/gid_map + 0 1000 1 + 1 10000 65536 + 0 1000 1 + 1 10000 65536 +``` + + +Show rootless netns information in user namespace for rootless containers: +``` +$ podman unshare --rootless-netns ip addr +1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 + link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 + inet 127.0.0.1/8 scope host lo + valid_lft forever preferred_lft forever + inet6 ::1/128 scope host + valid_lft forever preferred_lft forever +2: tap0: mtu 65520 qdisc fq_codel state UNKNOWN group default qlen 1000 + link/ether aa:8c:0b:73:98:f6 brd ff:ff:ff:ff:ff:ff + inet 10.0.2.100/24 brd 10.0.2.255 scope global tap0 + valid_lft forever preferred_lft forever + inet6 fd00::a88c:bff:fe73:98f6/64 scope global dynamic mngtmpaddr + valid_lft 86389sec preferred_lft 14389sec + inet6 fe80::a88c:bff:fe73:98f6/64 scope link + valid_lft forever preferred_lft forever +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-mount(1)](podman-mount.1.md)**, **namespaces(7)**, **newuidmap(1)**, **newgidmap(1)**, **user\_namespaces(7)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-untag.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-untag.1.md new file mode 100644 index 000000000..ab14a9e08 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-untag.1.md @@ -0,0 +1,46 @@ +--- +title: podman-untag +version: v5.4.1 +--- + +% podman-untag 1 + +## NAME +podman\-untag - Remove one or more names from a locally-stored image + +## SYNOPSIS +**podman untag** *image* [*name*[:*tag*]...] + +**podman image untag** *image* [*name*[:*tag*]...] + +## DESCRIPTION +Remove one or more names from an image in the local storage. The image can be referred to by ID or reference. If no name is specified, all names are removed from the image. If a specified name is a short name and does not include a registry, `localhost/` is prefixed (e.g., `fedora` -> `localhost/fedora`). If a specified name does not include a tag, `:latest` is appended (e.g., `localhost/fedora` -> `localhost/fedora\\:latest`). + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Remove all tags from the specified image. +``` +$ podman untag 0e3bbc2 +``` + +Remove tag from specified image. +``` +$ podman untag imageName:latest otherImageName:latest +``` + +Remove multiple tags from the specified image. +``` +$ podman untag httpd myhttpd myregistryhost:5000/fedora/httpd\\:v2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +December 2019, Originally compiled by Sascha Grunert diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-update.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-update.1.md new file mode 100644 index 000000000..ff46c725b --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-update.1.md @@ -0,0 +1,523 @@ +--- +title: podman-update +version: v5.4.1 +--- + +% podman-update 1 + +## NAME +podman\-update - Update the configuration of a given container + +## SYNOPSIS +**podman update** [*options*] *container* + +**podman container update** [*options*] *container* + +## DESCRIPTION + +Updates the configuration of an existing container, allowing changes to resource limits and healthchecks. + +## OPTIONS + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-rt-period.md) +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-period.md) + + +[//]: # (BEGIN included file options/cpu-rt-runtime.md) +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-runtime.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpus.container.md) +#### **--cpus**=*number* + +Number of CPUs. The default is *0.0* which means no limit. This is shorthand +for **--cpu-period** and **--cpu-quota**, therefore the option cannot be specified with +**--cpu-period** or **--cpu-quota**. + +On some systems, changing the CPU limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpus.container.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-read-iops.md) +#### **--device-read-iops**=*path:rate* + +Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-iops.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + + +[//]: # (BEGIN included file options/device-write-iops.md) +#### **--device-write-iops**=*path:rate* + +Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-iops.md) + + +[//]: # (BEGIN included file options/health-cmd.md) +#### **--health-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set or alter a healthcheck command for a container. The command is a command to be executed inside the +container that determines the container health. The command is required for other healthcheck options +to be applied. A value of **none** disables existing healthchecks. + +Multiple options can be passed in the form of a JSON array; otherwise, the command is interpreted +as an argument to **/bin/sh -c**. + +[//]: # (END included file options/health-cmd.md) + + +[//]: # (BEGIN included file options/health-interval.md) +#### **--health-interval**=*interval* + +Set an interval for the healthchecks. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-interval.md) + +Changing this setting resets the timer. + + +[//]: # (BEGIN included file options/health-log-destination.md) +#### **--health-log-destination**=*directory_path* + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) (Default: local) + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. + +[//]: # (END included file options/health-log-destination.md) + +Warning: Changing this setting may cause the loss of previous logs. + + +[//]: # (BEGIN included file options/health-max-log-count.md) +#### **--health-max-log-count**=*number of stored logs* + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) (Default: 5 attempts) + +[//]: # (END included file options/health-max-log-count.md) + + +[//]: # (BEGIN included file options/health-max-log-size.md) +#### **--health-max-log-size**=*size of stored logs* + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) (Default: 500 characters) + +[//]: # (END included file options/health-max-log-size.md) + + +[//]: # (BEGIN included file options/health-on-failure.md) +#### **--health-on-failure**=*action* + +Action to take once the container transitions to an unhealthy state. The default is **none**. + +- **none**: Take no action. +- **kill**: Kill the container. +- **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. +- **stop**: Stop the container. + +[//]: # (END included file options/health-on-failure.md) + + +[//]: # (BEGIN included file options/health-retries.md) +#### **--health-retries**=*retries* + +The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is **3**. + +[//]: # (END included file options/health-retries.md) + + +[//]: # (BEGIN included file options/health-start-period.md) +#### **--health-start-period**=*period* + +The initialization time needed for a container to bootstrap. The value can be expressed in time format like +**2m3s**. The default value is **0s**. + +Note: The health check command is executed as soon as a container is started, if the health check is successful +the container's health state will be updated to `healthy`. However, if the health check fails, the health state will +stay as `starting` until either the health check is successful or until the `--health-start-period` time is over. If the +health check command fails after the `--health-start-period` time is over, the health state will be updated to `unhealthy`. +The health check command is executed periodically based on the value of `--health-interval`. + +[//]: # (END included file options/health-start-period.md) + + +[//]: # (BEGIN included file options/health-startup-cmd.md) +#### **--health-startup-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set a startup healthcheck command for a container. This command is executed inside the container and is used to gate the regular +healthcheck. When the startup command succeeds, the regular healthcheck begins and the startup healthcheck ceases. Optionally, +if the command fails for a set number of attempts, the container is restarted. A startup healthcheck can be used to ensure that +containers with an extended startup period are not marked as unhealthy until they are fully started. Startup healthchecks can only be +used when a regular healthcheck (from the container's image or the **--health-cmd** option) is also set. + +[//]: # (END included file options/health-startup-cmd.md) + + +[//]: # (BEGIN included file options/health-startup-interval.md) +#### **--health-startup-interval**=*interval* + +Set an interval for the startup healthcheck. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-startup-interval.md) + +Changing this setting resets the timer, depending on the state of the container. + + +[//]: # (BEGIN included file options/health-startup-retries.md) +#### **--health-startup-retries**=*retries* + +The number of attempts allowed before the startup healthcheck restarts the container. If set to **0**, the container is never restarted. The default is **0**. + +[//]: # (END included file options/health-startup-retries.md) + + +[//]: # (BEGIN included file options/health-startup-success.md) +#### **--health-startup-success**=*retries* + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value +of **0** means that any success begins the regular healthcheck. The default is **0**. + +[//]: # (END included file options/health-startup-success.md) + + +[//]: # (BEGIN included file options/health-startup-timeout.md) +#### **--health-startup-timeout**=*timeout* + +The maximum time a startup healthcheck command has to complete before it is marked as failed. The value can be expressed in a time +format like **2m3s**. The default value is **30s**. + +[//]: # (END included file options/health-startup-timeout.md) + + +[//]: # (BEGIN included file options/health-timeout.md) +#### **--health-timeout**=*timeout* + +The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the +value can be expressed in a time format such as **1m22s**. The default value is **30s**. + +[//]: # (END included file options/health-timeout.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-reservation.md) +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-reservation.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/memory-swappiness.md) +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/memory-swappiness.md) + + +[//]: # (BEGIN included file options/no-healthcheck.md) +#### **--no-healthcheck** + +Disable any defined healthchecks for container. + +[//]: # (END included file options/no-healthcheck.md) + + +[//]: # (BEGIN included file options/pids-limit.md) +#### **--pids-limit**=*limit* + +Tune the container's pids limit. Set to **-1** to have unlimited pids for the container. The default is **2048** on systems that support "pids" cgroup controller. + +[//]: # (END included file options/pids-limit.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + + +## EXAMPLEs + +Update a container with a new cpu quota and period. +``` +podman update --cpus=5 myCtr +``` + +Update a container with all available options for cgroups v2. +``` +podman update --cpus 5 --cpuset-cpus 0 --cpu-shares 123 --cpuset-mems 0 --memory 1G --memory-swap 2G --memory-reservation 2G --blkio-weight-device /dev/zero:123 --blkio-weight 123 --device-read-bps /dev/zero:10mb --device-write-bps /dev/zero:10mb --device-read-iops /dev/zero:1000 --device-write-iops /dev/zero:1000 --pids-limit 123 ctrID +``` + +Update a container with all available options for cgroups v1. +``` +podman update --cpus 5 --cpuset-cpus 0 --cpu-shares 123 --cpuset-mems 0 --memory 1G --memory-swap 2G --memory-reservation 2G --memory-swappiness 50 --pids-limit 123 ctrID +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-create(1)](podman-create.1.md)**, **[podman-run(1)](podman-run.1.md)** + +## HISTORY +August 2022, Originally written by Charlie Doern diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-version.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-version.1.md new file mode 100644 index 000000000..cbdc77a5a --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-version.1.md @@ -0,0 +1,60 @@ +--- +title: podman-version +version: v5.4.1 +--- + +% podman-version 1 + +## NAME +podman\-version - Display the Podman version information + +## SYNOPSIS +**podman version** [*options*] + +## DESCRIPTION +Shows the following information: Remote API Version, Version, Go Version, Git Commit, Build Time, +OS, and Architecture. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change output format to "json" or a Go template. + +| **Placeholder** | **Description** | +| ------------------- | ------------------------ | +| .Client ... | Version of local podman | +| .Server ... | Version of remote podman | + +Each of the above fields branch deeper into further subfields +such as .Version, .APIVersion, .GoVersion, and more. + +## Example + +A sample output of the `version` command: +``` +$ podman version +Version: 2.0.0 +API Version: 1 +Go Version: go1.14.2 +Git Commit: 4520664f63c3a7f9a80227715359e20069d95542 +Built: Tue May 19 10:48:59 2020 +OS/Arch: linux/amd64 +``` + +Filtering out only the version: +``` +$ podman version --format '{{.Client.Version}}' +2.0.0 +``` + +#### **--help**, **-h** + +Print usage statement + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +November 2018, Added --format flag by Tomas Tomecek +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-volume-create.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-volume-create.1.md new file mode 100644 index 000000000..42a568057 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-volume-create.1.md @@ -0,0 +1,213 @@ +--- +title: podman-volume-create +version: v5.4.1 +--- + +% podman-volume-create 1 + +## NAME +podman\-volume\-create - Create a new volume + +## SYNOPSIS +**podman volume create** [*options*] [*name*] + +## DESCRIPTION + +Creates an empty volume and prepares it to be used by containers. The volume +can be created with a specific name, if a name is not given a random name is +generated. You can add metadata to the volume by using the **--label** flag and +driver options can be set using the **--opt** flag. + +## OPTIONS + +#### **--driver**, **-d**=*driver* + +Specify the volume driver name (default **local**). +There are two drivers supported by Podman itself: **local** and **image**. + +The **local** driver uses a directory on disk as the backend by default, but can also use the **mount(8)** command to mount a filesystem as the volume if **--opt** is specified. + +The **image** driver uses an image as the backing store of for the volume. +An overlay filesystem is created, which allows changes to the volume to be committed as a new layer on top of the image. + +Using a value other than **local** or **image**, Podman attempts to create the volume using a volume plugin with the given name. +Such plugins must be defined in the **volume_plugins** section of the **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** configuration file. + +#### **--help** + +Print usage statement + +#### **--ignore** + +Don't fail if the named volume already exists, instead just print the name. Note that the new options are not applied to the existing volume. + +#### **--label**, **-l**=*label* + +Set metadata for a volume (e.g., --label mykey=value). + +#### **--opt**, **-o**=*option* + +Set driver specific options. +For the default driver, **local**, this allows a volume to be configured to mount a filesystem on the host. + +For the `local` driver the following options are supported: `type`, `device`, `o`, and `[no]copy`. + + - The `type` option sets the type of the filesystem to be mounted, and is equivalent to the `-t` flag to **mount(8)**. + - The `device` option sets the device to be mounted, and is equivalent to the `device` argument to **mount(8)**. + - The `copy` option enables copying files from the container image path where the mount is created to the newly created volume on the first run. `copy` is the default. + +The `o` option sets options for the mount, and is equivalent to the filesystem +options (also `-o`) passed to **mount(8)** with the following exceptions: + + - The `o` option supports `uid` and `gid` options to set the UID and GID of the created volume that are not normally supported by **mount(8)**. + - The `o` option supports the `size` option to set the maximum size of the created volume, the `inodes` option to set the maximum number of inodes for the volume, and `noquota` to completely disable quota support even for tracking of disk usage. + The `size` option is supported on the "tmpfs" and "xfs[note]" file systems. + The `inodes` option is supported on the "xfs[note]" file systems. + Note: xfs filesystems must be mounted with the `prjquota` flag described in the **xfs_quota(8)** man page. Podman will throw an error if they're not. + - The `o` option supports using volume options other than the UID/GID options with the **local** driver and requires root privileges. + - The `o` options supports the `timeout` option which allows users to set a driver specific timeout in seconds before volume creation fails. For example, **--opt=o=timeout=10** sets a driver timeout of 10 seconds. + +***Note*** Do not confuse the `--opt,-o` create option with the `-o` mount option. For example, with `podman volume create`, use `-o=o=uid=1000` *not* `-o=uid=1000`. + +For the **image** driver, the only supported option is `image`, which specifies the image the volume is based on. +This option is mandatory when using the **image** driver. + +When not using the **local** and **image** drivers, the given options are passed directly to the volume plugin. In this case, supported options are dictated by the plugin in question, not Podman. + +## EXAMPLES + +Create empty volume. +``` +$ podman volume create +``` + +Create empty named volume. +``` +$ podman volume create myvol +``` + +Create empty named volume with specified label. +``` +$ podman volume create --label foo=bar myvol +``` + +Create tmpfs named volume with specified size and mount options. +``` +# podman volume create --opt device=tmpfs --opt type=tmpfs --opt o=size=2M,nodev,noexec myvol +``` + +Create tmpfs named volume testvol with specified options. +``` +# podman volume create --opt device=tmpfs --opt type=tmpfs --opt o=uid=1000,gid=1000 testvol +``` + +Create image named volume using the specified local image in containers/storage. +``` +# podman volume create --driver image --opt image=fedora\:latest fedoraVol +``` + +## QUOTAS + +`podman volume create` uses `XFS project quota controls` for controlling the size and the number of inodes of builtin volumes. The directory used to store the volumes must be an `XFS` file system and be mounted with the `pquota` option. + +Example /etc/fstab entry: +``` +/dev/podman/podman-var /var xfs defaults,x-systemd.device-timeout=0,pquota 1 2 +``` + +Podman generates project IDs for each builtin volume, but these project IDs need to be unique for the XFS file system. These project IDs by default are generated randomly, with a potential for overlap with other quotas on the same file +system. + +The xfs_quota tool can be used to assign a project ID to the storage driver directory, e.g.: + +``` +echo 100000:/var/lib/containers/storage/overlay >> /etc/projects +echo 200000:/var/lib/containers/storage/volumes >> /etc/projects +echo storage:100000 >> /etc/projid +echo volumes:200000 >> /etc/projid +xfs_quota -x -c 'project -s storage volumes' / +``` + +In the example above we are configuring the overlay storage driver for newly +created containers as well as volumes to use project IDs with a **start offset**. +All containers are assigned larger project IDs (e.g. >= 100000). +All volume assigned project IDs larger project IDs starting with 200000. +This prevents xfs_quota management conflicts with containers/storage. + +## MOUNT EXAMPLES + +`podman volume create` allows the `type`, `device`, and `o` options to be passed to `mount(8)` when using the `local` driver. + +## [s3fs-fuse](https://github.com/s3fs-fuse/s3fs-fuse) + +[s3fs-fuse](https://github.com/s3fs-fuse/s3fs-fuse) or just `s3fs`, is a [fuse](https://github.com/libfuse/libfuse) filesystem that allows s3 prefixes to be mounted as filesystem mounts. + +**Installing:** +```shell +$ doas dnf install s3fs-fuse +``` + +**Simple usage:** +```shell +$ s3fs --help +$ s3fs -o use_xattr,endpoint=aq-central-1 bucket:/prefix /mnt +``` + +**Equivalent through `mount(8)`** +```shell +$ mount -t fuse.s3fs -o use_xattr,endpoint=aq-central-1 bucket:/prefix /mnt +``` + +**Equivalent through `podman volume create`** +```shell +$ podman volume create s3fs-fuse-volume -o type=fuse.s3fs -o device=bucket:/prefix -o o=use_xattr,endpoint=aq-central-1 +``` + +**The volume can then be mounted in a container with** +```shell +$ podman run -v s3fs-fuse-volume:/s3:z --rm -it fedora:latest +``` + +Please see the available [options](https://github.com/s3fs-fuse/s3fs-fuse/wiki/Fuse-Over-Amazon#options) on their wiki. + +### Using with other container users + +The above example works because the volume is mounted as the host user and inside the container `root` is mapped to the user in the host. + +If the mount is accessed by a different user inside the container, a "Permission denied" error will be raised. + +```shell +$ podman run --user bin:bin -v s3fs-fuse-volume:/s3:z,U --rm -it fedora:latest +$ ls /s3 +# ls: /s3: Permission denied +``` + +In FUSE-land, mounts are protected for the user who mounted them; specify the `allow_other` mount option if other users need access. +> Note: This will remove the normal fuse [security measures](https://github.com/libfuse/libfuse/wiki/FAQ#why-dont-other-users-have-access-to-the-mounted-filesystem) on the mount point, after which, the normal filesystem permissions will have to protect it + +```shell +$ podman volume create s3fs-fuse-other-volume -o type=fuse.s3fs -o device=bucket:/prefix -o o=allow_other,use_xattr,endpoint=aq-central-1 +$ podman run --user bin:bin -v s3fs-fuse-volume:/s3:z,U --rm -it fedora\:latest +$ ls /s3 +``` + +### The Prefix must exist + +`s3fs` will fail to mount if the prefix does not exist in the bucket. + +Create a s3-directory by putting an empty object at the desired `prefix/` key +```shell +$ aws s3api put-object --bucket bucket --key prefix/ +``` + +If performance is the priority, please check out the more performant [goofys](https://github.com/kahing/goofys). + +> FUSE filesystems exist for [Google Cloud Storage](https://github.com/GoogleCloudPlatform/gcsfuse) and [Azure Blob Storage](https://github.com/Azure/azure-storage-fuse) + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[podman-volume(1)](podman-volume.1.md)**, **mount(8)**, **xfs_quota(8)**, **xfs_quota(8)**, **projects(5)**, **projid(5)** + +## HISTORY +January 2020, updated with information on volume plugins by Matthew Heon +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-volume-exists.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-volume-exists.1.md new file mode 100644 index 000000000..d6040cd6c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-volume-exists.1.md @@ -0,0 +1,48 @@ +--- +title: podman-volume-exists +version: v5.4.1 +--- + +% podman-volume-exists 1 + +## NAME +podman\-volume\-exists - Check if the given volume exists + +## SYNOPSIS +**podman volume exists** *volume* + +## DESCRIPTION +**podman volume exists** checks if a volume exists. Podman returns an exit code +of `0` when the volume is found. A `1` is returned otherwise. An exit code of +`125` indicates there was another issue. + + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLE + +Check if a volume called `myvol` exists (the volume does actually exist). +``` +$ podman volume exists myvol +$ echo $? +0 +$ +``` + +Check if a volume called `mysql` exists (the volume does not actually exist). +``` +$ podman volume exists mysql +$ echo $? +1 +$ +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** + +## HISTORY +January 2021, Originally compiled by Paul Holzinger `` diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-volume-export.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-volume-export.1.md new file mode 100644 index 000000000..4a78fee91 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-volume-export.1.md @@ -0,0 +1,43 @@ +--- +title: podman-volume-export +version: v5.4.1 +--- + +% podman-volume-export 1 + +## NAME +podman\-volume\-export - Export volume to external tar + +## SYNOPSIS +**podman volume export** [*options*] *volume* + +## DESCRIPTION + +**podman volume export** exports the contents of a podman volume and saves it as a tarball +on the local machine. **podman volume export** writes to STDOUT by default and can be +redirected to a file using the `--output` flag. + +Note: Following command is not supported by podman-remote. + +**podman volume export [OPTIONS] VOLUME** + +## OPTIONS + +#### **--help** + +Print usage statement + +#### **--output**, **-o**=*file* + +Write to a file, default is STDOUT + +## EXAMPLES + +Export named volume content into the specified file. +``` +$ podman volume export myvol --output myvol.tar + +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-volume-import(1)](podman-volume-import.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-volume-import.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-volume-import.1.md new file mode 100644 index 000000000..ff7878b10 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-volume-import.1.md @@ -0,0 +1,46 @@ +--- +title: podman-volume-import +version: v5.4.1 +--- + +% podman-volume-import 1 + +## NAME +podman\-volume\-import - Import tarball contents into an existing podman volume + +## SYNOPSIS +**podman volume import** *volume* [*source*] + +## DESCRIPTION + +**podman volume import** imports the contents of a tarball into the podman volume's mount point. +The contents of the volume is merged with the content of the tarball with the latter taking precedence. +**podman volume import** can consume piped input when using `-` as source path. + +The given volume must already exist and is not created by podman volume import. + +Note: Following command is not supported by podman-remote. + +#### **--help** + +Print usage statement + +## EXAMPLES + +Import named volume content from the specified file. +``` +$ podman volume import myvol test.tar +``` + +Import named volume content from stdin. +``` +$ gunzip -c hello.tar.gz | podman volume import myvol - +``` + +Export the content from named volume and pipe it into the named volume via stdin. +``` +$ podman volume export oldmyvol | podman volume import myvol - +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-volume-export(1)](podman-volume-export.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-volume-inspect.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-volume-inspect.1.md new file mode 100644 index 000000000..4ba976f7c --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-volume-inspect.1.md @@ -0,0 +1,109 @@ +--- +title: podman-volume-inspect +version: v5.4.1 +--- + +% podman-volume-inspect 1 + +## NAME +podman\-volume\-inspect - Get detailed information on one or more volumes + +## SYNOPSIS +**podman volume inspect** [*options*] *volume* [...] + +## DESCRIPTION + +Display detailed information on one or more volumes. The output can be formatted using +the **--format** flag and a Go template. To get detailed information about all the +existing volumes, use the **--all** flag. +Volumes can be queried individually by providing their full name or a unique partial name. + + +## OPTIONS + +#### **--all**, **-a** + +Inspect all volumes. + +#### **--format**, **-f**=*format* + +Format volume output using Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------- | --------------------------------------------------------------------------- | +| .Anonymous | Indicates whether volume is anonymous | +| .CreatedAt ... | Volume creation time | +| .Driver | Volume driver | +| .GID | GID the volume was created with | +| .Labels ... | Label information associated with the volume | +| .LockNumber | Number of the volume's Libpod lock | +| .MountCount | Number of times the volume is mounted | +| .Mountpoint | Source of volume mount point | +| .Name | Volume name | +| .NeedsChown | Indicates volume will be chowned on next use | +| .NeedsCopyUp | Indicates data at the destination will be copied into the volume on next use| +| .Options ... | Volume options | +| .Scope | Volume scope | +| .Status ... | Status of the volume | +| .StorageID | StorageID of the volume | +| .Timeout | Timeout of the volume | +| .UID | UID the volume was created with | + +#### **--help** + +Print usage statement + + +## EXAMPLES + +Inspect named volume. +``` +$ podman volume inspect myvol +[ + { + "Name": "myvol", + "Driver": "local", + "Mountpoint": "/home/myusername/.local/share/containers/storage/volumes/myvol/_data", + "CreatedAt": "2023-03-13T16:26:48.423069028-04:00", + "Labels": {}, + "Scope": "local", + "Options": {}, + "MountCount": 0, + "NeedsCopyUp": true, + "NeedsChown": true + } +] +``` + +Inspect all volumes. +``` +$ podman volume inspect --all +[ + { + "Name": "myvol", + "Driver": "local", + "Mountpoint": "/home/myusername/.local/share/containers/storage/volumes/myvol/_data", + "CreatedAt": "2023-03-13T16:26:48.423069028-04:00", + "Labels": {}, + "Scope": "local", + "Options": {}, + "MountCount": 0, + "NeedsCopyUp": true, + "NeedsChown": true + } +] +``` + +Inspect named volume and display its Driver and Scope field. +``` +$ podman volume inspect --format "{{.Driver}} {{.Scope}}" myvol +local local +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-volume-ls.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-volume-ls.1.md new file mode 100644 index 000000000..a9c598fcd --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-volume-ls.1.md @@ -0,0 +1,117 @@ +--- +title: podman-volume-ls +version: v5.4.1 +--- + +% podman-volume-ls 1 + +## NAME +podman\-volume\-ls - List all the available volumes + +## SYNOPSIS +**podman volume ls** [*options*] + +## DESCRIPTION + +Lists all the volumes that exist. The output can be filtered using the **--filter** +flag and can be formatted to either JSON or a Go template using the **--format** +flag. Use the **--quiet** flag to print only the volume names. + +## OPTIONS + +#### **--filter**, **-f**=*filter* + +Filter what volumes are shown in the output. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive, with the only exception being `label` +which is exclusive. Filters with different keys always work exclusive. + +Volumes can be filtered by the following attributes: + +| **Filter** | **Description** | +| ---------- | ------------------------------------------------------------------------------------- | +| dangling | [Dangling] Matches all volumes not referenced by any containers | +| driver | [Driver] Matches volumes based on their driver | +| label | [Key] or [Key=Value] Label assigned to a volume | +| name | [Name] Volume name (accepts regex) | +| opt | Matches a storage driver options | +| scope | Filters volume by scope | +| after/since | Filter by volumes created after the given VOLUME (name or tag) | +| until | Only remove volumes created before given timestamp | + +#### **--format**=*format* + +Format volume output using Go template. + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------------- | -------------------------------------------- | +| .Anonymous | Indicates whether volume is anonymous | +| .CreatedAt ... | Volume creation time | +| .Driver | Volume driver | +| .GID | GID of volume | +| .InspectVolumeData ... | Don't use | +| .Labels ... | Label information associated with the volume | +| .LockNumber | Number of the volume's Libpod lock | +| .MountCount | Number of times the volume is mounted | +| .Mountpoint | Source of volume mount point | +| .Name | Volume name | +| .NeedsChown | Indicates whether volume needs to be chowned | +| .NeedsCopyUp | Indicates if volume needs to be copied up to | +| .Options ... | Volume options | +| .Scope | Volume scope | +| .Status ... | Status of the volume | +| .StorageID | StorageID of the volume | +| .Timeout | Timeout of the volume | +| .UID | UID of volume | +| .VolumeConfigResponse ... | Don't use | + +#### **--help** + +Print usage statement. + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Print volume output in quiet mode. Only print the volume names. + +## EXAMPLES + +List all volumes. +``` +$ podman volume ls +``` + +List all volumes and display content as json format. +``` +$ podman volume ls --format json +``` + +List all volumes and display their Driver and Scope fields +``` +$ podman volume ls --format "{{.Driver}} {{.Scope}}" +``` + +List volumes with the name foo and label blue. +``` +$ podman volume ls --filter name=foo,label=blue +``` + +List volumes with the label key=value. +``` +$ podman volume ls --filter label=key=value +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-volume-mount.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-volume-mount.1.md new file mode 100644 index 000000000..c20e56969 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-volume-mount.1.md @@ -0,0 +1,41 @@ +--- +title: podman-volume-mount +version: v5.4.1 +--- + +% podman-volume-mount 1 + +## NAME +podman\-volume\-mount - Mount a volume filesystem + +## SYNOPSIS +**podman volume mount** [*volume* ...] + +## DESCRIPTION +Mounts the specified volumes' file system in a location which can be +accessed from the host, and returns its location. + +Rootless mode only supports mounting file volumes unless Podman is run within the user namespace +via the `podman unshare` command. All other volume types fail to mount. + +## RETURN VALUE +The location of the mounted file system. On error an empty string and errno is +returned. + +## EXAMPLE + +Mount specified volume. As Root: +``` +# podman volume mount foo +/home/dwalsh/.local/share/containers/storage/volumes/foo/_data +``` + +In rootless mode, volume mounting only works after executing the podman unshare command to enter the user namespace. +``` +$ podman unshare +# podman volume mount foo +/home/dwalsh/.local/share/containers/storage/volumes/foo/_data +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-volume-unmount(1)](podman-volume-unmount.1.md)**, **[podman-unshare(1)](podman-unshare.1.md)**, **mount(8)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-volume-prune.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-volume-prune.1.md new file mode 100644 index 000000000..fd02a3466 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-volume-prune.1.md @@ -0,0 +1,77 @@ +--- +title: podman-volume-prune +version: v5.4.1 +--- + +% podman-volume-prune 1 + +## NAME +podman\-volume\-prune - Remove all unused volumes + +## SYNOPSIS +**podman volume prune** [*options*] + +## DESCRIPTION + +Removes unused volumes. By default all unused volumes are removed, the **--filter** flag can +be used to filter specific volumes. Users are prompted to confirm the removal of all the +unused volumes. To bypass the confirmation, use the **--force** flag. + + +## OPTIONS + +#### **--filter** + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:-----------:|------------------------------------------------------------------------------------------------------------| +| dangling | [Bool] Only remove volumes not referenced by any containers | +| driver | [String] Only remove volumes with the given driver | +| label | [String] Only remove volumes, with (or without, in the case of label!=[...] is used) the specified labels. | +| name | [String] Only remove volume with the given name | +| opt | [String] Only remove volumes created with the given options | +| scope | [String] Only remove volumes with the given scope | +| until | [DateTime] Only remove volumes created before given timestamp. | +| after/since | [Volume] Filter by volumes created after the given VOLUME (name or tag) | + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes volumes with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes volumes without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not prompt for confirmation. + +#### **--help** + +Print usage statement + + +## EXAMPLES + + +Prune all unused volumes. +``` +$ podman volume prune +``` + +Prune all volumes. Note: this command will also remove all containers that are using a volume. +``` +$ podman volume prune --force +``` + +Prune all volumes that contain the specified label. +``` +$ podman volume prune --filter label=mylabel=mylabelvalue +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-volume-reload.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-volume-reload.1.md new file mode 100644 index 000000000..eb0b5ebaa --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-volume-reload.1.md @@ -0,0 +1,35 @@ +--- +title: podman-volume-reload +version: v5.4.1 +--- + +% podman-volume-reload 1 + +## NAME +podman\-volume\-reload - Reload all volumes from volumes plugins + +## SYNOPSIS +**podman volume reload** + +## DESCRIPTION + +**podman volume reload** checks all configured volume plugins and updates the libpod database with all available volumes. +Existing volumes are also removed from the database when they are no longer present in the plugin. + +This command it is best effort and cannot guarantee a perfect state because plugins can be modified from the outside at any time. + +Note: This command is not supported with podman-remote. + +## EXAMPLES + +Reload the volume plugins. +``` +$ podman volume reload +Added: +vol6 +Removed: +t3 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-volume-rm.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-volume-rm.1.md new file mode 100644 index 000000000..109909f1d --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-volume-rm.1.md @@ -0,0 +1,70 @@ +--- +title: podman-volume-rm +version: v5.4.1 +--- + +% podman-volume-rm 1 + +## NAME +podman\-volume\-rm - Remove one or more volumes + +## SYNOPSIS +**podman volume rm** [*options*] *volume* [...] + +## DESCRIPTION + +Removes one or more volumes. Only volumes that are not being used are removed. +If a volume is being used by a container, an error is returned unless the **--force** +flag is being used. To remove all volumes, use the **--all** flag. +Volumes can be removed individually by providing their full name or a unique partial name. + +## OPTIONS + +#### **--all**, **-a** + +Remove all volumes. + +#### **--force**, **-f** + +Remove a volume by force. +If it is being used by containers, the containers are removed first. + +#### **--help** + +Print usage statement + +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping running containers that are using the specified volume. The --force option must be specified to use the --time option. Use -1 for infinite wait. + +## EXAMPLES + +Remove multiple specified volumes. +``` +$ podman volume rm myvol1 myvol2 +``` + +Remove all volumes. +``` +$ podman volume rm --all +``` + +Remove the specified volume even if it is in use. Note, this removes all containers using the volume. +``` +$ podman volume rm --force myvol +``` + +## Exit Status + **0** All specified volumes removed + + **1** One of the specified volumes did not exist, and no other failures + + **2** One of the specified volumes is being used by a container + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-volume-unmount.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-volume-unmount.1.md new file mode 100644 index 000000000..ad6cf22bd --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-volume-unmount.1.md @@ -0,0 +1,37 @@ +--- +title: podman-volume-unmount +version: v5.4.1 +--- + +% podman-volume-unmount 1 + +## NAME +podman\-volume\-unmount - Unmount a volume + +## SYNOPSIS +**podman volume unmount** *volume* [...] + +**podman volume umount** *volume* [...] + +## DESCRIPTION +Unmounts the specified volume, if there are no other containers +using it. + +Volume storage increments a mount counter each time a volume is mounted. +When a volume is unmounted, the mount counter is decremented, and the +volume's filesystem is physically unmounted only when the mount +counter reaches zero indicating no other processes are using the mount. + +## EXAMPLE + +Unmount volume with a given ID: +``` +podman volume unmount volumeID +``` + +Unmount multiple volumes with given IDs: +``` +podman volume unmount volumeID1 volumeID2 volumeID3 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-volume-mount(1)](podman-volume-mount.1.md)** diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-volume.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-volume.1.md new file mode 100644 index 000000000..61ba31fc6 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-volume.1.md @@ -0,0 +1,37 @@ +--- +title: podman-volume +version: v5.4.1 +--- + +% podman-volume 1 + +## NAME +podman\-volume - Simple management tool for volumes + +## SYNOPSIS +**podman volume** *subcommand* + +## DESCRIPTION +podman volume is a set of subcommands that manage volumes. + +## SUBCOMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------------ | ------------------------------------------------------------------------------ | +| create | [podman-volume-create(1)](podman-volume-create.1.md) | Create a new volume. | +| exists | [podman-volume-exists(1)](podman-volume-exists.1.md) | Check if the given volume exists. | +| export | [podman-volume-export(1)](podman-volume-export.1.md) | Export volume to external tar. | +| import | [podman-volume-import(1)](podman-volume-import.1.md) | Import tarball contents into an existing podman volume. | +| inspect | [podman-volume-inspect(1)](podman-volume-inspect.1.md) | Get detailed information on one or more volumes. | +| ls | [podman-volume-ls(1)](podman-volume-ls.1.md) | List all the available volumes. | +| mount | [podman-volume-mount(1)](podman-volume-mount.1.md) | Mount a volume filesystem. | +| prune | [podman-volume-prune(1)](podman-volume-prune.1.md) | Remove all unused volumes. | +| reload | [podman-volume-reload(1)](podman-volume-reload.1.md) | Reload all volumes from volumes plugins. | +| rm | [podman-volume-rm(1)](podman-volume-rm.1.md) | Remove one or more volumes. | +| unmount | [podman-volume-unmount(1)](podman-volume-unmount.1.md) | Unmount a volume. | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.1/source/markdown/podman-wait.1.md b/versioned_docs/version-5.4.1/source/markdown/podman-wait.1.md new file mode 100644 index 000000000..f3ed0e8b0 --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman-wait.1.md @@ -0,0 +1,103 @@ +--- +title: podman-wait +version: v5.4.1 +--- + +% podman-wait 1 + +## NAME +podman\-wait - Wait on one or more containers to stop and print their exit codes + +## SYNOPSIS +**podman wait** [*options*] *container* [...] + +**podman container wait** [*options*] *container* [...] + +## DESCRIPTION +Waits on one or more containers to stop. The container can be referred to by its +name or ID. In the case of multiple containers, Podman waits on each consecutively. +After all conditions are satisfied, the containers' return codes are printed +separated by newline in the same order as they were given to the command. An +exit code of -1 is emitted for all conditions other than "stopped" and +"exited". + +When waiting for containers with a restart policy of `always` or `on-failure`, +such as those created by `podman kube play`, the containers may be repeatedly +exiting and restarting, possibly with different exit codes. `podman wait` will +only display and detect the first exit after the wait command was started. + +When running a container with podman run --rm wait does not wait for the +container to be fully removed. To wait for the removal of a container use +`--condition=removing`. + +## OPTIONS + +#### **--condition**=*state* +Container state or condition to wait for. Can be specified multiple times where at least one condition must match for the command to return. Supported values are "configured", "created", "exited", "healthy", "initialized", "paused", "removing", "running", "stopped", "stopping", "unhealthy". The default condition is "stopped". + +#### **--help**, **-h** + + Print usage statement + + +#### **--ignore** +Ignore errors when a specified container is missing and mark its return code as -1. + +#### **--interval**, **-i**=*duration* + Time interval to wait before polling for completion. A duration string is a sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". Time unit defaults to "ms". + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLES + +Wait for the specified container to exit. +``` +$ podman wait mywebserver +0 +``` + +Wait for the latest container to exit. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman wait --latest +0 +``` + +Wait for the container to exit, checking every two seconds. +``` +$ podman wait --interval 2s mywebserver +0 +``` + +Wait for the container by ID. This container exits with error status 1: +``` +$ podman wait 860a4b23 +1 +``` + +Wait for both specified containers to exit. +``` +$ podman wait mywebserver myftpserver +0 +125 +``` + +Wait for the named container to exit, but do not fail if the container does not exist. +``` +$ podman wait --ignore does-not-exist +-1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +September 2017, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.1/source/markdown/podman.1.md b/versioned_docs/version-5.4.1/source/markdown/podman.1.md new file mode 100644 index 000000000..282cea5cc --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podman.1.md @@ -0,0 +1,487 @@ +--- +title: podman +version: v5.4.1 +--- + +% podman 1 + +## NAME +podman - Simple management tool for pods, containers and images + +## SYNOPSIS +**podman** [*options*] *command* + +## DESCRIPTION +Podman (Pod Manager) is a fully featured container engine that is a simple daemonless tool. +Podman provides a Docker-CLI comparable command line that eases the transition from other +container engines and allows the management of pods, containers and images. Simply put: `alias docker=podman`. +Most Podman commands can be run as a regular user, without requiring additional +privileges. + +Podman uses Buildah(1) internally to create container images. Both tools share image +(not container) storage, hence each can use or manipulate images (but not containers) +created by the other. + +Default settings for flags are defined in `containers.conf`. Most settings for +Remote connections use the server's containers.conf, except when documented in +man pages. + +**podman [GLOBAL OPTIONS]** + +## GLOBAL OPTIONS + +#### **--cgroup-manager**=*manager* + +The CGroup manager to use for container cgroups. Supported values are __cgroupfs__ or __systemd__. Default is _systemd_ unless overridden in the containers.conf file. + +Note: Setting this flag can cause certain commands to break when called on containers previously created by the other CGroup manager type. +Note: CGroup manager is not supported in rootless mode when using CGroups Version V1. + +#### **--config** +Location of config file. Mainly for docker compatibility, only the authentication parts of the config are supported. + +#### **--conmon** +Path of the conmon binary (Default path is configured in `containers.conf`) + +#### **--connection**, **-c** +Connection to use for remote podman, including Mac and Windows (excluding WSL2) machines, (Default connection is configured in `containers.conf`) +Setting this option switches the **--remote** option to true. +Remote connections use local containers.conf for default. + +#### **--events-backend**=*type* + +Backend to use for storing events. Allowed values are **file**, **journald**, and +**none**. When *file* is specified, the events are stored under +`/events/events.log` (see **--tmpdir** below). + +#### **--help**, **-h** + +Print usage statement + +#### **--hooks-dir**=*path* + +Each `*.json` file in the path configures a hook for Podman containers. For more details on the syntax of the JSON files and the semantics of hook injection, see `oci-hooks(5)`. Podman and libpod currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. + +This option may be set multiple times; paths from later options have higher precedence (`oci-hooks(5)` discusses directory precedence). + +For the annotation conditions, libpod uses any annotations set in the generated OCI configuration. + +For the bind-mount conditions, only mounts explicitly requested by the caller via `--volume` are considered. Bind mounts that libpod inserts by default (e.g. `/dev/shm`) are not considered. + +If `--hooks-dir` is unset for root callers, Podman and libpod currently default to `/usr/share/containers/oci/hooks.d` and `/etc/containers/oci/hooks.d` in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting `--hooks-dir`. + +Podman and libpod currently support an additional `precreate` state which is called before the runtime's `create` operation. Unlike the other stages, which receive the container state on their standard input, `precreate` hooks receive the proposed runtime configuration on their standard input. They may alter that configuration as they see fit, and write the altered form to their standard output. + +**WARNING**: the `precreate` hook allows powerful changes to occur, such as adding additional mounts to the runtime configuration. That power also makes it easy to break things. Before reporting libpod errors, try running a container with `precreate` hooks disabled to see if the problem is due to one of the hooks. + +#### **--identity**=*path* + +Path to ssh identity file. If the identity file has been encrypted, podman prompts the user for the passphrase. +If no identity file is provided and no user is given, podman defaults to the user running the podman command. +Podman prompts for the login password on the remote server. + +Identity value resolution precedence: + - command line value + - environment variable `CONTAINER_SSHKEY`, if `CONTAINER_HOST` is found + - `containers.conf` +Remote connections use local containers.conf for default. + +#### **--imagestore**=*path* + +Path of the imagestore where images are stored. By default, the storage library stores all the images in the graphroot but if an imagestore is provided, then the storage library will store newly pulled images in the provided imagestore and keep using the graphroot for everything else. If the user is using the overlay driver, then the images which were already part of the graphroot will still be accessible. + +This will override *imagestore* option in `containers-storage.conf(5)`, refer to `containers-storage.conf(5)` for more details. + +#### **--log-level**=*level* + +Log messages at and above specified level: __debug__, __info__, __warn__, __error__, __fatal__ or __panic__ (default: _warn_) + +#### **--module**=*path* + +Load the specified `containers.conf(5)` module. Can be an absolute or relative path. Please refer to `containers.conf(5)` for details. + +This flag is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. +Further note that the flag is a root-level flag and must be specified before any Podman sub-command. + +#### **--network-cmd-path**=*path* +Path to the `slirp4netns(1)` command binary to use for setting up a slirp4netns network. +If "" is used, then the binary will first be searched using the `helper_binaries_dir` option in `containers.conf`, and second using the `$PATH` environment variable. +**Note:** This option is deprecated and will be removed with Podman 6.0. Use the `helper_binaries_dir` option in `containers.conf` instead. + +#### **--network-config-dir**=*directory* + +Path to the directory where network configuration files are located. +For the netavark backend "/etc/containers/networks" is used as root +and "$graphroot/networks" as rootless. +For the CNI backend the default is "/etc/cni/net.d" as root +and "$HOME/.config/cni/net.d" as rootless. +CNI is deprecated and will be removed in the next major Podman version 5.0 in preference of Netavark. + +#### **--out**=*path* +Redirect the output of podman to the specified path without affecting the container output or its logs. This parameter can be used to capture the output from any of podman's commands directly into a file and enable suppression of podman's output by specifying /dev/null as the path. To explicitly disable the container logging, the **--log-driver** option should be used. + +#### **--remote**, **-r** +When true, access to the Podman service is remote. Defaults to false. +Settings can be modified in the containers.conf file. If the CONTAINER_HOST +environment variable is set, the **--remote** option defaults to true. + +#### **--root**=*value* + +Storage root dir in which data, including images, is stored (default: "/var/lib/containers/storage" for UID 0, "$HOME/.local/share/containers/storage" for other users). +Default root dir configured in `containers-storage.conf(5)`. + +Overriding this option causes the *storage-opt* settings in `containers-storage.conf(5)` to be ignored. The user must specify additional options via the `--storage-opt` flag. + +#### **--runroot**=*value* + +Storage state directory where all state information is stored (default: "/run/containers/storage" for UID 0, "/run/user/$UID/run" for other users). +Default state dir configured in `containers-storage.conf(5)`. + +#### **--runtime**=*value* + +Name of the OCI runtime as specified in containers.conf or absolute path to the OCI compatible binary used to run containers. + +#### **--runtime-flag**=*flag* + +Adds global flags for the container runtime. To list the supported flags, please +consult the manpages of the selected container runtime (`runc` is the default +runtime, the manpage to consult is `runc(8)`. When the machine is configured +for cgroup V2, the default runtime is `crun`, the manpage to consult is `crun(8)`.). + +Note: Do not pass the leading `--` to the flag. To pass the runc flag `--log-format json` +to podman build, the option given can be `--runtime-flag log-format=json`. + + +#### **--ssh**=*value* + +This option allows the user to change the ssh mode, meaning that rather than using the default **golang** mode, one can instead use **--ssh=native** +to use the installed ssh binary and config file declared in containers.conf. + +#### **--storage-driver**=*value* + +Storage driver. The default storage driver for UID 0 is configured in `containers-storage.conf(5)` in rootless mode), and is *vfs* for non-root users when *fuse-overlayfs* is not available. The `STORAGE_DRIVER` environment variable overrides the default. The --storage-driver specified driver overrides all. + +Overriding this option causes the *storage-opt* settings in `containers-storage.conf(5)` to be ignored. The user must +specify additional options via the `--storage-opt` flag. + +#### **--storage-opt**=*value* + +Specify a storage driver option. Default storage driver options are configured in `containers-storage.conf(5)`. The `STORAGE_OPTS` environment variable overrides the default. The --storage-opt specified options override all. Specify --storage-opt="" so no storage options is used. + +#### **--syslog** + +Output logging information to syslog as well as the console (default *false*). + +On remote clients, including Mac and Windows (excluding WSL2) machines, logging is directed to the file $HOME/.config/containers/podman.log. + +#### **--tmpdir**=*path* + +Path to the tmp directory, for libpod runtime content. Defaults to `$XDG_RUNTIME_DIR/libpod/tmp` as rootless and `/run/libpod/tmp` as rootful. + +NOTE --tmpdir is not used for the temporary storage of downloaded images. Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + +#### **--transient-store** + +Enables a global transient storage mode where all container metadata is stored on non-persistent media (i.e. in the location specified by `--runroot`). +This mode allows starting containers faster, as well as guaranteeing a fresh state on boot in case of unclean shutdowns or other problems. However +it is not compatible with a traditional model where containers persist across reboots. + +Default value for this is configured in `containers-storage.conf(5)`. + +#### **--url**=*value* +URL to access Podman service (default from `containers.conf`, rootless `unix:///run/user/$UID/podman/podman.sock` or as root `unix:///run/podman/podman.sock`). +Setting this option switches the **--remote** option to true. + + - `CONTAINER_HOST` is of the format `://[]@][:][]` + +Details: + - `schema` is one of: + * `ssh` (default): a local unix(7) socket on the named `host` and `port`, reachable via SSH + * `tcp`: an unencrypted, unauthenticated TCP connection to the named `host` and `port` + * `unix`: a local unix(7) socket at the specified `path`, or the default for the user + - `user` defaults to either `root` or the current running user (`ssh` only) + - `password` has no default (`ssh` only) + - `host` must be provided and is either the IP or name of the machine hosting the Podman service (`ssh` and `tcp`) + - `port` defaults to 22 (`ssh` and `tcp`) + - `path` defaults to either `/run/podman/podman.sock`, or `/run/user/$UID/podman/podman.sock` if running rootless (`unix`), or must be explicitly specified (`ssh`) + +URL value resolution precedence: + - command line value + - environment variable `CONTAINER_HOST` + - `engine.service_destinations` table in containers.conf, excluding the /usr/share/containers directory + - `unix:///run/podman/podman.sock` + +Remote connections use local containers.conf for default. + +Some example URL values in valid formats: + - unix:///run/podman/podman.sock + - unix:///run/user/$UID/podman/podman.sock + - ssh://notroot@localhost:22/run/user/$UID/podman/podman.sock + - ssh://root@localhost:22/run/podman/podman.sock + - tcp://localhost:34451 + - tcp://127.0.0.1:34451 + +#### **--version**, **-v** + +Print the version + +#### **--volumepath**=*value* + +Volume directory where builtin volume information is stored (default: "/var/lib/containers/storage/volumes" for UID 0, "$HOME/.local/share/containers/storage/volumes" for other users). Default volume path can be overridden in `containers.conf`. + +## Environment Variables + +Podman can set up environment variables from env of [engine] table in containers.conf. These variables can be overridden by passing environment variables before the `podman` commands. + +#### **CONTAINERS_CONF** + +Set default locations of containers.conf file + +#### **CONTAINERS_REGISTRIES_CONF** + +Set default location of the registries.conf file. + +#### **CONTAINERS_STORAGE_CONF** + +Set default location of the storage.conf file. + +#### **CONTAINER_CONNECTION** + +Override default `--connection` value to access Podman service. Automatically enables the --remote option. + +#### **CONTAINER_HOST** + +Set default `--url` value to access Podman service. Automatically enables --remote option. + +#### **CONTAINER_SSHKEY** + +Set default `--identity` path to ssh key file value used to access Podman service. + +#### **PODMAN_CONNECTIONS_CONF** + +The path to the file where the system connections and farms created with `podman system connection add` +and `podman farm add` are stored, by default it uses `~/.config/containers/podman-connections.json`. + +#### **STORAGE_DRIVER** + +Set default `--storage-driver` value. + +#### **STORAGE_OPTS** + +Set default `--storage-opt` value. + +#### **TMPDIR** + +Set the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + +#### **XDG_CONFIG_HOME** + +In Rootless mode configuration files are read from `XDG_CONFIG_HOME` when +specified, otherwise in the home directory of the user under +`$HOME/.config/containers`. + +#### **XDG_DATA_HOME** + +In Rootless mode images are pulled under `XDG_DATA_HOME` when specified, +otherwise in the home directory of the user under +`$HOME/.local/share/containers/storage`. + +#### **XDG_RUNTIME_DIR** + +In Rootless mode temporary configuration data is stored in `${XDG_RUNTIME_DIR}/containers`. + +## Remote Access + +The Podman command can be used with remote services using the `--remote` flag. Connections can +be made using local unix domain sockets, ssh or directly to tcp sockets. When specifying the +podman --remote flag, only the global options `--url`, `--identity`, `--log-level`, `--connection` are used. + +Connection information can also be managed using the containers.conf file. + +## Exit Codes + +The exit code from `podman` gives information about why the container +failed to run or why it exited. When `podman` commands exit with a non-zero code, +the exit codes follow the `chroot` standard, see below: + + **125** The error is with podman **_itself_** + + $ podman run --foo busybox; echo $? + Error: unknown flag: --foo + 125 + + **126** Executing a _container command_ and the _command_ cannot be invoked + + $ podman run busybox /etc; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error + 126 + + **127** Executing a _container command_ and the _command_ cannot be found + + $ podman run busybox foo; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error + 127 + + **Exit code** otherwise, `podman` returns the exit code of the _container command_ + + $ podman run busybox /bin/sh -c 'exit 3'; echo $? + 3 + + +## COMMANDS + +| Command | Description | +|--------------------------------------------------|------------------------------------------------------------------------------| +| [podman-artifact(1)](podman-artifact.1.md) | Manage OCI artifacts. | +| [podman-attach(1)](podman-attach.1.md) | Attach to a running container. | +| [podman-auto-update(1)](podman-auto-update.1.md) | Auto update containers according to their auto-update policy | +| [podman-build(1)](podman-build.1.md) | Build a container image using a Containerfile. | +| [podman-farm(1)](podman-farm.1.md) | Farm out builds to machines running podman for different architectures | +| [podman-commit(1)](podman-commit.1.md) | Create new image based on the changed container. | +| [podman-completion(1)](podman-completion.1.md) | Generate shell completion scripts | +| [podman-compose(1)](podman-compose.1.md) | Run Compose workloads via an external compose provider. | +| [podman-container(1)](podman-container.1.md) | Manage containers. | +| [podman-cp(1)](podman-cp.1.md) | Copy files/folders between a container and the local filesystem. | +| [podman-create(1)](podman-create.1.md) | Create a new container. | +| [podman-diff(1)](podman-diff.1.md) | Inspect changes on a container or image's filesystem. | +| [podman-events(1)](podman-events.1.md) | Monitor Podman events | +| [podman-exec(1)](podman-exec.1.md) | Execute a command in a running container. | +| [podman-export(1)](podman-export.1.md) | Export a container's filesystem contents as a tar archive. | +| [podman-generate(1)](podman-generate.1.md) | Generate structured data based on containers, pods or volumes. | +| [podman-healthcheck(1)](podman-healthcheck.1.md) | Manage healthchecks for containers | +| [podman-history(1)](podman-history.1.md) | Show the history of an image. | +| [podman-image(1)](podman-image.1.md) | Manage images. | +| [podman-images(1)](podman-images.1.md) | List images in local storage. | +| [podman-import(1)](podman-import.1.md) | Import a tarball and save it as a filesystem image. | +| [podman-info(1)](podman-info.1.md) | Display Podman related system information. | +| [podman-init(1)](podman-init.1.md) | Initialize one or more containers | +| [podman-inspect(1)](podman-inspect.1.md) | Display a container, image, volume, network, or pod's configuration. | +| [podman-kill(1)](podman-kill.1.md) | Kill the main process in one or more containers. | +| [podman-load(1)](podman-load.1.md) | Load image(s) from a tar archive into container storage. | +| [podman-login(1)](podman-login.1.md) | Log in to a container registry. | +| [podman-logout(1)](podman-logout.1.md) | Log out of a container registry. | +| [podman-logs(1)](podman-logs.1.md) | Display the logs of one or more containers. | +| [podman-machine(1)](podman-machine.1.md) | Manage Podman's virtual machine | +| [podman-manifest(1)](podman-manifest.1.md) | Create and manipulate manifest lists and image indexes. | +| [podman-mount(1)](podman-mount.1.md) | Mount a working container's root filesystem. | +| [podman-network(1)](podman-network.1.md) | Manage Podman networks. | +| [podman-pause(1)](podman-pause.1.md) | Pause one or more containers. | +| [podman-kube(1)](podman-kube.1.md) | Play containers, pods or volumes based on a structured input file. | +| [podman-pod(1)](podman-pod.1.md) | Management tool for groups of containers, called pods. | +| [podman-port(1)](podman-port.1.md) | List port mappings for a container. | +| [podman-ps(1)](podman-ps.1.md) | Print out information about containers. | +| [podman-pull(1)](podman-pull.1.md) | Pull an image from a registry. | +| [podman-push(1)](podman-push.1.md) | Push an image, manifest list or image index from local storage to elsewhere. | +| [podman-rename(1)](podman-rename.1.md) | Rename an existing container. | +| [podman-restart(1)](podman-restart.1.md) | Restart one or more containers. | +| [podman-rm(1)](podman-rm.1.md) | Remove one or more containers. | +| [podman-rmi(1)](podman-rmi.1.md) | Remove one or more locally stored images. | +| [podman-run(1)](podman-run.1.md) | Run a command in a new container. | +| [podman-save(1)](podman-save.1.md) | Save image(s) to an archive. | +| [podman-search(1)](podman-search.1.md) | Search a registry for an image. | +| [podman-secret(1)](podman-secret.1.md) | Manage podman secrets. | +| [podman-start(1)](podman-start.1.md) | Start one or more containers. | +| [podman-stats(1)](podman-stats.1.md) | Display a live stream of one or more container's resource usage statistics. | +| [podman-stop(1)](podman-stop.1.md) | Stop one or more running containers. | +| [podman-system(1)](podman-system.1.md) | Manage podman. | +| [podman-tag(1)](podman-tag.1.md) | Add an additional name to a local image. | +| [podman-top(1)](podman-top.1.md) | Display the running processes of a container. | +| [podman-unmount(1)](podman-unmount.1.md) | Unmount a working container's root filesystem. | +| [podman-unpause(1)](podman-unpause.1.md) | Unpause one or more containers. | +| [podman-unshare(1)](podman-unshare.1.md) | Run a command inside of a modified user namespace. | +| [podman-untag(1)](podman-untag.1.md) | Remove one or more names from a locally-stored image. | +| [podman-update(1)](podman-update.1.md) | Update the configuration of a given container. | +| [podman-version(1)](podman-version.1.md) | Display the Podman version information. | +| [podman-volume(1)](podman-volume.1.md) | Simple management tool for volumes. | +| [podman-wait(1)](podman-wait.1.md) | Wait on one or more containers to stop and print their exit codes. | + +## CONFIGURATION FILES + +**containers.conf** (`/usr/share/containers/containers.conf`, `/etc/containers/containers.conf`, `$HOME/.config/containers/containers.conf`) + +Podman has builtin defaults for command line options. These defaults can be overridden using the containers.conf configuration files. + +Distributions ship the `/usr/share/containers/containers.conf` file with their default settings. Administrators can override fields in this file by creating the `/etc/containers/containers.conf` file. Users can further modify defaults by creating the `$HOME/.config/containers/containers.conf` file. Podman merges its builtin defaults with the specified fields from these files, if they exist. Fields specified in the users file override the administrator's file, which overrides the distribution's file, which override the built-in defaults. + +Podman uses builtin defaults if no containers.conf file is found. + +If the **CONTAINERS_CONF** environment variable is set, then its value is used for the containers.conf file rather than the default. + +**mounts.conf** (`/usr/share/containers/mounts.conf`) + +The mounts.conf file specifies volume mount directories that are automatically mounted inside containers when executing the `podman run` or `podman start` commands. Administrators can override the defaults file by creating `/etc/containers/mounts.conf`. + +When Podman runs in rootless mode, the file `$HOME/.config/containers/mounts.conf` overrides the default if it exists. For details, see containers-mounts.conf(5). + +**policy.json** (`/etc/containers/policy.json`, `$HOME/.config/containers/policy.json`) + +Signature verification policy files are used to specify policy, e.g. trusted keys, applicable when deciding whether to accept an image, or individual signatures of that image, as valid. For details, see containers-policy.json(5). + +**registries.conf** (`/etc/containers/registries.conf`, `$HOME/.config/containers/registries.conf`) + +registries.conf is the configuration file which specifies which container registries is consulted when completing image names which do not include a registry or domain portion. + +Non root users of Podman can create the `$HOME/.config/containers/registries.conf` file to be used instead of the system defaults. + +If the **CONTAINERS_REGISTRIES_CONF** environment variable is set, then its value is used for the registries.conf file rather than the default. + +**storage.conf** (`/etc/containers/storage.conf`, `$HOME/.config/containers/storage.conf`) + +storage.conf is the storage configuration file for all tools using containers/storage + +The storage configuration file specifies all of the available container storage options for tools using shared container storage. + +When Podman runs in rootless mode, the file `$HOME/.config/containers/storage.conf` is used instead of the system defaults. + +If the **CONTAINERS_STORAGE_CONF** environment variable is set, then its value is used for the storage.conf file rather than the default. + +## Rootless mode +Podman can also be used as non-root user. When podman runs in rootless mode, a user namespace is automatically created for the user, defined in /etc/subuid and /etc/subgid. + +Containers created by a non-root user are not visible to other users and are not seen or managed by Podman running as root. + +It is required to have multiple UIDS/GIDS set for a user. Be sure the user is present in the files `/etc/subuid` and `/etc/subgid`. + +Execute the following commands to add the ranges to the files + + $ sudo usermod --add-subuids 10000-75535 USERNAME + $ sudo usermod --add-subgids 10000-75535 USERNAME + +Or just add the content manually. + + $ echo USERNAME:10000:65536 >> /etc/subuid + $ echo USERNAME:10000:65536 >> /etc/subgid + +See the `subuid(5)` and `subgid(5)` man pages for more information. + + + +Note: whitespace in any row of /etc/subuid or /etc/subgid, including trailing blanks, may result in no entry failures. + +Images are pulled under `XDG_DATA_HOME` when specified, otherwise in the home directory of the user under `.local/share/containers/storage`. + +Currently slirp4netns or pasta is required to be installed to create a network +device, otherwise rootless containers need to run in the network namespace of +the host. + +In certain environments like HPC (High Performance Computing), users cannot take advantage of the additional UIDs and GIDs from the /etc/subuid and /etc/subgid systems. However, in this environment, rootless Podman can operate with a single UID. To make this work, set the `ignore_chown_errors` option in the `containers-storage.conf(5)` file. This option tells Podman when pulling an image to ignore chown errors when attempting to change a file in a container image to match the non-root UID in the image. This means all files get saved as the user's UID. Note this can cause issues when running the container. + +### **NOTE:** Unsupported file systems in rootless mode + +The Overlay file system (OverlayFS) is not supported with kernels prior to 5.12.9 in rootless mode. The fuse-overlayfs package is a tool that provides the functionality of OverlayFS in user namespace that allows mounting file systems in rootless environments. It is recommended to install the fuse-overlayfs package. In rootless mode, Podman automatically uses the fuse-overlayfs program as the mount_program if installed, as long as the $HOME/.config/containers/storage.conf file was not previously created. If storage.conf exists in the homedir, add `mount_program = "/usr/bin/fuse-overlayfs"` under `[storage.options.overlay]` to enable this feature. + +The Network File System (NFS) and other distributed file systems (for example: Lustre, Spectrum Scale, the General Parallel File System (GPFS)) are not supported when running in rootless mode as these file systems do not understand user namespace. However, rootless Podman can make use of an NFS Homedir by modifying the `$HOME/.config/containers/storage.conf` to have the `graphroot` option point to a directory stored on local (Non NFS) storage. + +## SEE ALSO +**[containers-mounts.conf(5)](https://github.com/containers/common/blob/main/docs/containers-mounts.conf.5.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **oci-hooks(5)**, **[containers-policy.json(5)](https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/main/man/runc.8.md)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, **[pasta(1)](https://passt.top/builds/latest/web/passt.1.html)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +See [podman-rootless(7)](https://github.com/containers/podman/blob/main/rootless.md) +for rootless issues. + +## HISTORY +Dec 2016, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.4.1/source/markdown/podmansh.1.md b/versioned_docs/version-5.4.1/source/markdown/podmansh.1.md new file mode 100644 index 000000000..64752dbea --- /dev/null +++ b/versioned_docs/version-5.4.1/source/markdown/podmansh.1.md @@ -0,0 +1,138 @@ +--- +title: podmansh +version: v5.4.1 +--- + +% podmansh 1 + +## NAME +podmansh - Execute login shell within the Podman `podmansh` container + +## SYNOPSIS +**podmansh** + +## DESCRIPTION + +Execute a user shell within a container when the user logs into the system. The container that the users get added to can be defined via a Podman Quadlet file. This user only has access to volumes and capabilities configured into the Quadlet file. + +Administrators can create a Quadlet in /etc/containers/systemd/users, which systemd will start for all users when they log in. The administrator can create a specific Quadlet with the container name `podmansh`, then enable users to use the login shell /usr/bin/podmansh. These user login shells are automatically executed inside the `podmansh` container via Podman. + +Optionally, the administrator can place Quadlet files in the /etc/containers/systemd/users/${UID} directory for a user. Only this UID will execute these Quadlet services when that user logs in. + +The user is confined to the container environment via all of the security mechanisms, including SELinux. The only information that will be available from the system comes from volumes leaked into the container. + +Systemd will automatically create the container when the user session is started. Systemd will take down the container when all connections to the user session are removed. This means users can log in to the system multiple times, with each session connected to the same container. + +Administrators can use volumes to expose specific host data from the host system to the user, without the user being exposed to other parts of the system. + +Timeout for podmansh can be set using the `podmansh_timeout` option in containers.conf. + +## Setup +Create user login session using useradd while running as root. + +``` +# useradd -s /usr/bin/podmansh lockedu +# grep lockedu /etc/passwd +lockedu:x:4008:4008::/home/lockedu:/usr/bin/podmansh +``` + +Create a Podman Quadlet file that looks something like one of the following. + +Fully locked down container, no access to host OS. + +``` +# USERID=$(id -u lockedu) +# mkdir -p /etc/containers/systemd/users/${USERID} +# cat > /etc/containers/systemd/users/${USERID}/podmansh.container << _EOF +[Unit] +Description=The podmansh container +After=local-fs.target + +[Container] +Image=registry.fedoraproject.org/fedora +ContainerName=podmansh +RemapUsers=keep-id +RunInit=yes +DropCapability=all +NoNewPrivileges=true + +Exec=sleep infinity + +[Install] +RequiredBy=default.target +_EOF +``` + +Alternatively, while running as root, create a Quadlet where the user is allowed to become root within the user namespace. They can also permanently read/write content from their home directory which is volume mounted from the actual host's users account, rather than being inside of the container. + +``` +# useradd -s /usr/bin/podmansh confinedu +# grep confinedu /etc/passwd +confinedu:x:4009:4009::/home/confinedu:/usr/bin/podmansh +# USERID=$(id -u confinedu) +# mkdir -p /etc/containers/systemd/users/${USERID} +# cat > /etc/containers/systemd/users/${USERID}/podmansh.container << _EOF +[Unit] +Description=The podmansh container +After=local-fs.target + +[Container] +Image=registry.fedoraproject.org/fedora +ContainerName=podmansh +RemapUsers=keep-id +RunInit=yes + +Volume=%h/data:%h:Z +Exec=sleep infinity + +[Service] +ExecStartPre=/usr/bin/mkdir -p %h/data + +[Install] +RequiredBy=default.target +_EOF +``` + +Another example, while running as root, create a Quadlet where the users inside this container are allowed to execute containers with SELinux separation and able to read and write content in the $HOME/data directory. + +``` +# useradd -s /usr/bin/podmansh fullu +# grep fullu /etc/passwd +fullu:x:4010:4010::/home/fullu:/usr/bin/podmansh +# USERID=$(id -u fullu) +# mkdir -p /etc/containers/systemd/users/${USERID} +# cat > /etc/containers/systemd/users/${USERID}/podmansh.container << _EOF +[Unit] +Description=The podmansh container +After=local-fs.target + +[Container] +Image=registry.fedoraproject.org/fedora +ContainerName=podmansh +RemapUsers=keep-id +RunInit=yes +PodmanArgs=--security-opt=unmask=/sys/fs/selinux \ + --security-opt=label=nested \ + --security-opt=label=user:container_user_u \ + --security-opt=label=type:container_user_t \ + --security-opt=label=role:container_user_r \ + --security-opt=label=level:s0-s0:c0.c1023 + +Volume=%h/data:%h:Z +WorkingDir=%h +Volume=/sys/fs/selinux:/sys/fs/selinux +Exec=sleep infinity + +[Service] +ExecStartPre=/usr/bin/mkdir -p %h/data + +[Install] +RequiredBy=default.target +_EOF +``` + +## SEE ALSO +**[containers.conf(5)](containers.conf.5.md)**, **[podman(1)](podman.1.md)**, **[podman-exec(1)](podman-exec.1.md)**, **[podman-systemd.unit(5)](podman-systemd.unit.5.md)** + +## HISTORY +May 2023, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.4.1/tutorials/README.md b/versioned_docs/version-5.4.1/tutorials/README.md new file mode 100644 index 000000000..f02353f4b --- /dev/null +++ b/versioned_docs/version-5.4.1/tutorials/README.md @@ -0,0 +1,46 @@ +--- +title: Podman Tutorials +version: v5.4.1 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +# Podman Tutorials + +## Links to a number of useful tutorials for the Podman utility. + +**[Introduction Tutorial](podman_tutorial.md)** + +Learn how to set up Podman and perform some basic commands with the utility. + +**[Basic Setup and Use of Podman in a Rootless environment](rootless_tutorial.md)** + +The steps required to set up rootless Podman are enumerated. + +**[Setup Mac/Windows](mac_win_client.md)** + +Special setup for running the Podman remote client on a Mac or Windows PC and connecting to Podman running on a Linux VM are documented. + +**[Remote Client](remote_client.md)** + +A brief how-to on using the Podman remote-client. + +**[How to use libpod for custom/derivative projects](podman-derivative-api.md)** + +How the libpod API can be used within your own project. + +**[Image Signing](image_signing.md)** + +Learn how to set up and use image signing with Podman. + +**[Basic Networking](basic_networking.md)** + +A basic guide to common network setups with Podman + +**[Socket activation](socket_activation.md)** + +Learn how to run containers that support socket activation. + +**[Performance](performance.md)** + +Performance guide regarding Podman configuration and usage. diff --git a/versioned_docs/version-5.4.1/tutorials/basic_networking.md b/versioned_docs/version-5.4.1/tutorials/basic_networking.md new file mode 100644 index 000000000..cbf3866e2 --- /dev/null +++ b/versioned_docs/version-5.4.1/tutorials/basic_networking.md @@ -0,0 +1,336 @@ +--- +title: Basic Networking Guide for Podman +version: v5.4.1 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + + +# Basic Networking Guide for Podman + + +It seems once people understand the basics of containers, networking is one of the first +aspects they begin experimenting with. And regarding networking, it takes very +little experimentation before ending up on the deep end of the pool. The following +guide shows the most common network setups for Podman rootful and rootless containers. +Each setup is supported with an example. + + +## Differences between rootful and rootless container networking + +One of the guiding factors on networking for containers with Podman is going to +be whether or not the container is run by a root user or not. This is because +unprivileged users cannot create networking interfaces on the host. Therefore, +for rootless containers, the default network mode is slirp4netns. Because of the +limited privileges, slirp4netns lacks some of the features of networking +compared to rootful Podman's networking; for example, slirp4netns cannot give +containers a routable IP address. The default networking mode for rootful +containers on the other side is netavark, which allows a container to have a +routable IP address. + +## Firewalls + +The role of a firewall will not impact the setup and configuration of networking, +but it will impact traffic on those networks. The most obvious is inbound network +traffic to the container host, which is being passed onto containers usually with +port mapping. Depending on the firewall implementation, we have observed firewall +ports being opened automatically due to running a container with a port mapping (for +example). If container traffic does not seem to work properly, check the firewall +and allow traffic on ports the container is using. A common problem is that +reloading the firewall deletes the netavark iptables rules resulting in a loss of +network connectivity for rootful containers. Podman v3 provides the podman +network reload command to restore this without having to restart the container. + +## Basic Network Setups + +Most containers and pods being run with Podman adhere to a couple of simple scenarios. +By default, rootful Podman will create a bridged network. This is the most straightforward +and preferred network setup for Podman. Bridge networking creates an interface for +the container on an internal bridge network, which is then connected to the internet +via Network Address Translation(NAT). We also see users wanting to use `macvlan` +for networking as well. The `macvlan` plugin forwards an entire network interface +from the host into the container, allowing it access to the network the host is connected +to. And finally, the default network configuration for rootless containers is slirp4netns. +The slirp4netns network mode has limited capabilities but can be run on users without +root privileges. It creates a tunnel from the host into the container to forward +traffic. + +### Bridge + +A bridge network is defined as an internal network is created where both the +container and host are attached. Then this network is capable of allowing the containers +to communicate outside the host. + + +*[Image: bridge_network]* + +Consider the above illustration. It depicts a laptop user running two containers: +a web and db instance. These two containers are on the virtual network with the +host. Additionally, by default, these containers can initiate communications outside +the laptop (to the Internet for example). The containers on the virtual network +typically have non-routable, also known as private IP addresses. + +When dealing with communication that is being initiated outside the host, the outside +client typically must address the laptop’s external network interface and given port +number. Assuming the host allows incoming traffic, the host will know to forward +the incoming traffic on that port to the specific container. To accomplish this, +firewall rules are added to forward traffic when a container requests a specific +port be forwarded. + +Bridge networking is the default for Podman containers created as root. Podman provides +a default bridge network, but you can create others using the `podman network create` +command. Containers can be joined to a network when they are created with the +`--network` flag, or after they are created via the `podman network connect` and +`podman network disconnect` commands. + +As mentioned earlier, slirp4netns is the default network configuration for rootless +users. But as of Podman version 4.0, rootless users can also use netavark. +The user experience of rootless netavark is very akin to a rootful netavark, except that +there is no default network configuration provided. You simply need to create a +network, and the one will be created as a bridge network. If you would like to switch from +CNI networking to netavark, you must issue the `podman system reset --force` command. +This will delete all of your images, containers, and custom networks. + +``` +$ podman network create +``` + +When rootless containers are run, network operations +will be executed inside an extra network namespace. To join this namespace, use +`podman unshare --rootless-netns`. + +#### Default Network + +The default network `podman` with netavark is memory-only. It does not support dns resolution because of backwards compatibility with Docker. To change settings, export the in-memory network and change the file. + +For the default rootful network use +``` +podman network inspect podman | jq .[] > /etc/containers/networks/podman.json +``` + +And for the rootless network use + +``` +podman network inspect podman | jq .[] > ~/.local/share/containers/storage/networks/podman.json +``` + + +#### Example + +By default, rootful containers use the netavark for its default network if +you have not migrated from Podman v3. +In this case, no network name must be passed to Podman. However, you can create +additional bridged networks with the podman create command. + +The following example shows how to set up a web server and expose it to the network +outside the host as both rootful and rootless. It will also show how an outside +client can connect to the container. + +``` +(rootful) $ sudo podman run -dt --name webserver -p 8080:80 quay.io/libpod/banner +00f3440c7576aae2d5b193c40513c29c7964e96bf797cf0cc352c2b68ccbe66a +``` + +Now run the container. +``` +$ podman run -dt --name webserver --network podman1 -p 8081:80 quay.io/libpod/banner +269fd0d6b2c8ed60f2ca41d7beceec2471d72fb9a33aa8ca45b81dc9a0abbb12 +``` +Note in the above run command, the container’s port 80 (where the Nginx server is +running) was mapped to the host’s port 8080. Port 8080 was chosen to demonstrate +how the host and container ports can be mapped for external access. The port could +very well have been 80 as well (except for rootless users). + +To connect from an outside client to the webserver, simply point an HTTP client to +the host’s IP address at port 8080 for rootful and port 8081 for rootless. +``` +(outside_host): $ curl 192.168.99.109:8080 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ + +(outside_host): $ curl 192.168.99.109:8081 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ +``` + +### Macvlan + +With macvlan, the container is given access to a physical network interface on the +host. This interface can configure multiple subinterfaces. And each subinterface +is capable of having its own MAC and IP address. In the case of Podman containers, +the container will present itself as if it is on the same network as the host. + +*[Image: macvlan_network]* + +In the illustration, outside clients will be able to access the web container by +its IP address directly. Usually the network information, including IP address, +is leased from a DHCP server like most other network clients on the network. If +the laptop is running a firewall, such as firewalld, then accommodations will need +to be made for proper access. + +Note that Podman has to be run as root in order to use macvlan. + +#### Example + +The following example demonstrates how to set up a web container on a macvlan and +how to access that container from outside the host. First, create the macvlan network. + You need to know the network interface on the host that connects to the routable +network. In the example case, it is eth0. + +``` +$ sudo podman network create -d macvlan -o parent=eth0 webnetwork +webnetwork +``` + +The next step is to ensure that the DHCP service is running. This handles +the DHCP leases from the network. If DHCP is not needed, the `--subnet` option +can be used to assign a static subnet in the `network create` command above. + +CNI and netavark both use their own DHCP service; therefore, you need to know +what backend you are using. To see what you are using, run this command: +``` +$ sudo podman info --format {{.Host.NetworkBackend}} +``` +If this command does not work, you are using an older version prior to Podman +v4.0 which means you are using CNI. +If the netavark backend is used, at least Podman v4.5 with netavark v1.6 is +required to use DHCP. + +For netavark use: +``` +$ sudo systemctl enable --now netavark-dhcp-proxy.socket +``` +Or if the system doesn't use systemd, start the daemon manually: +``` +$ /usr/libexec/podman/netavark dhcp-proxy --activity-timeout 0 +``` + +With CNI use: +``` +$ sudo systemctl enable --now cni-dhcp.socket +``` +Or if the system doesn't use systemd, start the daemon manually: +``` +$ sudo /usr/libexec/cni/dhcp daemon +``` +Note that depending on the distribution, the binary location may differ. + +Now run the container and be certain to attach it to the network we created earlier. +``` +$ sudo podman run -dt --name webserver --network webnetwork quay.io/libpod/banner +03d82083c434d7e937fc0b87c25401f46ab5050007df403bf988e25e52c5cc40 +[baude@localhost ~]$ sudo podman exec webserver ip address show eth0 +2: eth0@if3: mtu 1500 qdisc noqueue state +UP +link/ether 0a:3c:e2:eb:87:0f brd ff:ff:ff:ff:ff:ff +inet 192.168.99.186/24 brd 192.168.99.255 scope global eth0 +valid_lft forever preferred_lft forever +inet6 fe80::83c:e2ff:feeb:870f/64 scope link +valid_lft forever preferred_lft forever +``` +Because the container has a routable IP address (on this network) and is not being +managed by firewalld, no change to the firewall is needed. +``` +(outside_host): $ curl http://192.168.99.186 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ +``` + + + +### Slirp4netns + +Slirp4netns is the default network setup for rootless containers and pods. It was +invented because unprivileged users are not allowed to make network interfaces on +the host. Slirp4netns creates a TAP device in the container’s network namespace +and connects to the usermode TCP/IP stack. Consider the following illustration. + +*[Image: slirp_network]* + +The unprivileged user on this laptop has created two containers: a DB container and +a web container. Both of these containers have the ability to access content on +networks outside the laptop. And outside clients can access the containers if the +container is bound to a host port and the laptop firewall allows it. Remember, unprivileged +users must use ports 1024 through 65535 as lower ports require root privileges. (CAP_NET_BIND_SERVICE) +Note: this can be adjusted using the `sysctl net.ipv4.ip_unprivileged_port_start` + +One of the drawbacks of slirp4netns is that the containers are completely isolated +from each other. Unlike the bridge approach, there is no virtual network. For containers +to communicate with each other, they can use the port mappings with the host system, +or they can be put into a Pod where they share the same network namespace. See [Communicating +between containers and pods](#Communicating-between-containers-and-pods) for more information. + +#### Example + +The following example will show how two rootless containers can communicate with +each other where one is a web server. Then it will show how a client on the host’s +network can communicate with the rootless web server. + +First, run the rootless web server and map port 80 from the container to a non-privileged +port like 8080. +``` +$ podman run -dt --name webserver -p 8080:80 quay.io/libpod/banner +17ea33ccd7f55ff45766b3ec596b990a5f2ba66eb9159cb89748a85dc3cebfe0 +``` +Because rootless containers cannot communicate with each other directly with TCP/IP +via IP addresses, the host and the port mapping are used. To do so, the IP address +of the host (interface) must be known. +``` +$ ip address show eth0 +3: eth0: mtu 1500 qdisc fq_codel state UP group +default qlen 1000 +link/ether 3c:e1:a1:c1:7a:3f brd ff:ff:ff:ff:ff:ff +altname eth0 +inet 192.168.99.109/24 brd 192.168.99.255 scope global dynamic noprefixroute eth0 +valid_lft 78808sec preferred_lft 78808sec +inet6 fe80::5632:6f10:9e76:c33/64 scope link noprefixroute +valid_lft forever preferred_lft forever +``` +From another rootless container, use the host’s IP address and port to communicate +between the two rootless containers successfully. +``` +$ podman run -it quay.io/libpod/banner curl http://192.168.99.109:8080 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ +``` + +From a client outside the host, the IP address and port can also be used: +``` +(outside_host): $ curl http://192.168.99.109:8080 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ +``` + +## Communicating between containers and pods + +Most users of containers have a decent understanding of how containers communicate +with each other and the rest of the world. Usually each container has its own IP +address and networking information. They communicate amongst each other using regular +TCP/IP means like IP addresses or, in many cases, using DNS names often based on +the container name. But pods are a collection of one or more containers, and with +that, some uniqueness is inherited. + +By definition, all containers in a Podman pod share the same network namespace. This +fact means that they will have the same IP address, MAC addresses, and port mappings. +You can conveniently communicate between containers in a pod by using localhost. + +*[Image: slirp_network]* + +The above illustration describes a Pod on a bridged network. As depicted, the Pod +has two containers “inside” it: a DB and a Web container. Because they share the +same network namespace, the DB and Web container can communicate with each other +using localhost (127.0.0.1). Furthermore, they are also both addressable by the +IP address (and DNS name if applicable) assigned to the Pod itself. + +For more information on container to container networking, see [Configuring container +networking with Podman](https://www.redhat.com/sysadmin/container-networking-podman). diff --git a/versioned_docs/version-5.4.1/tutorials/image_signing.md b/versioned_docs/version-5.4.1/tutorials/image_signing.md new file mode 100644 index 000000000..edbdd4636 --- /dev/null +++ b/versioned_docs/version-5.4.1/tutorials/image_signing.md @@ -0,0 +1,199 @@ +--- +title: How to sign and distribute container images using Podman +version: v5.4.1 +--- + +# How to sign and distribute container images using Podman + +Signing container images originates from the motivation of trusting only +dedicated image providers to mitigate man-in-the-middle (MITM) attacks or +attacks on container registries. One way to sign images is to utilize a GNU +Privacy Guard ([GPG][0]) key. This technique is generally compatible with any +OCI compliant container registry like [Quay.io][1]. It is worth mentioning that +the OpenShift integrated container registry supports this signing mechanism out +of the box, which makes separate signature storage unnecessary. + +[0]: https://gnupg.org +[1]: https://quay.io + +From a technical perspective, we can utilize Podman to sign the image before +pushing it into a remote registry. After that, all systems running Podman have +to be configured to retrieve the signatures from a remote server, which can +be any simple web server. This means that every unsigned image will be rejected +during an image pull operation. But how does this work? + +First of all, we have to create a GPG key pair or select an already locally +available one. To generate a new GPG key, just run `gpg --full-gen-key` and +follow the interactive dialog. Now we should be able to verify that the key +exists locally: + +```bash +> gpg --list-keys sgrunert@suse.com +pub rsa2048 2018-11-26 [SC] [expires: 2020-11-25] + XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX +uid [ultimate] Sascha Grunert +sub rsa2048 2018-11-26 [E] [expires: 2020-11-25] +``` + +Now let’s assume that we run a container registry. For example we could simply +start one on our local machine: + +```bash +sudo podman run -d -p 5000:5000 docker.io/registry +``` + +The registry does not know anything about image signing, it just provides the remote +storage for the container images. This means if we want to sign an image, we +have to take care of how to distribute the signatures. + +Let’s choose a standard `alpine` image for our signing experiment: + +```bash +sudo podman pull docker://docker.io/alpine:latest +``` + +```bash +sudo podman images alpine +REPOSITORY TAG IMAGE ID CREATED SIZE +docker.io/library/alpine latest e7d92cdc71fe 6 weeks ago 5.86 MB +``` + +Now we can re-tag the image to point it to our local registry: + +```bash +sudo podman tag alpine localhost:5000/alpine +``` + +```bash +sudo podman images alpine +REPOSITORY TAG IMAGE ID CREATED SIZE +localhost:5000/alpine latest e7d92cdc71fe 6 weeks ago 5.86 MB +docker.io/library/alpine latest e7d92cdc71fe 6 weeks ago 5.86 MB +``` + +Podman would now be able to push the image and sign it in one command. But to +let this work, we have to modify our system-wide registries configuration at +`/etc/containers/registries.d/default.yaml`: + +```yaml +default-docker: + sigstore: http://localhost:8000 # Added by us + sigstore-staging: file:///var/lib/containers/sigstore +``` + +We can see that we have two signature stores configured: + +- `sigstore`: referencing a web server for signature reading +- `sigstore-staging`: referencing a file path for signature writing + +Now, let’s push and sign the image: + +```bash +sudo -E GNUPGHOME=$HOME/.gnupg \ + podman push \ + --tls-verify=false \ + --sign-by sgrunert@suse.com \ + localhost:5000/alpine +… +Storing signatures +``` + +If we now take a look at the systems signature storage, then we see that there +is a new signature available, which was caused by the image push: + +```bash +sudo ls /var/lib/containers/sigstore +'alpine@sha256=e9b65ef660a3ff91d28cc50eba84f21798a6c5c39b4dd165047db49e84ae1fb9' +``` + +The default signature store in our edited version of +`/etc/containers/registries.d/default.yaml` references a web server listening at +`http://localhost:8000`. For our experiment, we simply start a new server inside +the local staging signature store: + +```bash +sudo bash -c 'cd /var/lib/containers/sigstore && python3 -m http.server' +Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ... +``` + +Let’s remove the local images for our verification test: + +``` +sudo podman rmi docker.io/alpine localhost:5000/alpine +``` + +We have to write a policy to enforce that the signature has to be valid. This +can be done by adding a new rule in `/etc/containers/policy.json`. From the +below example, copy the `"docker"` entry into the `"transports"` section of your +`policy.json`. + +```json +{ + "default": [{ "type": "insecureAcceptAnything" }], + "transports": { + "docker": { + "localhost:5000": [ + { + "type": "signedBy", + "keyType": "GPGKeys", + "keyPath": "/tmp/key.gpg" + } + ] + } + } +} +``` + +The `keyPath` does not exist yet, so we have to put the GPG key there: + +```bash +gpg --output /tmp/key.gpg --armor --export sgrunert@suse.com +``` + +If we now pull the image: + +```bash +sudo podman pull --tls-verify=false localhost:5000/alpine +… +Storing signatures +e7d92cdc71feacf90708cb59182d0df1b911f8ae022d29e8e95d75ca6a99776a +``` + +Then we can see in the logs of the web server that the signature has been +accessed: + +``` +127.0.0.1 - - [04/Mar/2020 11:18:21] "GET /alpine@sha256=e9b65ef660a3ff91d28cc50eba84f21798a6c5c39b4dd165047db49e84ae1fb9/signature-1 HTTP/1.1" 200 - +``` + +As a counterpart example, if we specify the wrong key at `/tmp/key.gpg`: + +```bash +gpg --output /tmp/key.gpg --armor --export mail@saschagrunert.de +File '/tmp/key.gpg' exists. Overwrite? (y/N) y +``` + +Then a pull is not possible any more: + +```bash +sudo podman pull --tls-verify=false localhost:5000/alpine +Trying to pull localhost:5000/alpine... +Error: pulling image "localhost:5000/alpine": unable to pull localhost:5000/alpine: unable to pull image: Source image rejected: Invalid GPG signature: … +``` + +So in general there are four main things to be taken into consideration when +signing container images with Podman and GPG: + +1. We need a valid private GPG key on the signing machine and corresponding + public keys on every system which would pull the image +2. A web server has to run somewhere which has access to the signature storage +3. The web server has to be configured in any + `/etc/containers/registries.d/*.yaml` file +4. Every image pulling system has to be configured to contain the enforcing + policy configuration via `policy.conf` + +That’s it for image signing and GPG. The cool thing is that this setup works out +of the box with [CRI-O][2] as well and can be used to sign container images in +Kubernetes environments. + +[2]: https://cri-o.io diff --git a/versioned_docs/version-5.4.1/tutorials/mac_client.md b/versioned_docs/version-5.4.1/tutorials/mac_client.md new file mode 100644 index 000000000..e2351e675 --- /dev/null +++ b/versioned_docs/version-5.4.1/tutorials/mac_client.md @@ -0,0 +1,7 @@ +--- +title: "[Podman Mac Client tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md)" +version: v5.4.1 +--- + +# [Podman Mac Client tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) +This tutorial has moved! You can find out how to set up Podman on macOS (as well as Windows) [here](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) diff --git a/versioned_docs/version-5.4.1/tutorials/mac_win_client.md b/versioned_docs/version-5.4.1/tutorials/mac_win_client.md new file mode 100644 index 000000000..cfe08d0ab --- /dev/null +++ b/versioned_docs/version-5.4.1/tutorials/mac_win_client.md @@ -0,0 +1,120 @@ +--- +title: Podman Remote clients for macOS and Windows +version: v5.4.1 +--- + +# Podman Remote clients for macOS and Windows + +*** +**_NOTE:_** For running Podman on Windows, refer to the [Podman for Windows](podman-for-windows.md) guide, which uses the recommended approach of a Podman-managed Linux backend. For Mac, see the [Podman installation instructions](https://podman.io/getting-started/installation). This guide covers the advanced usage of Podman with a custom Linux VM or a remote external Linux system. +*** + +## Introduction + +The core Podman runtime environment can only run on Linux operating systems. But other operating systems can use the “remote client” to manage their containers to a Linux backend. This remote client is nearly identical to the standard Podman program. Certain functions that do not make sense for remote clients have been removed. For example, the “--latest” switch for container commands has been removed. + +### Brief architecture + +The remote client uses a client-server model. You need Podman installed on a Linux machine or VM that also has the SSH daemon running. On the local operating system, when you execute a Podman command, Podman connects to the server via SSH. It then connects to the Podman service by using systemd socket activation. The Podman commands are executed on the server. From the client's point of view, it seems like Podman runs locally. + +## Obtaining and installing Podman + +### Windows + +Installing the Windows Podman client begins by downloading the Podman Windows installer. The Windows installer is built with each Podman release and is downloadable from its [release description page](https://github.com/containers/podman/releases/latest). The Windows installer file is named `podman-#.#.#-setup.exe`, where the `#` symbols represent the version number of Podman. + +Once you have downloaded the installer to your Windows host, simply double click the installer and Podman will be installed. The path is also set to put `podman` in the default user path. + +Podman must be run at a command prompt using the Windows Command Prompt (`cmd.exe`) or PowerShell (`pwsh.exe`) applications. + +### macOS + +The Mac Client is available through [Homebrew](https://brew.sh/). You can download homebrew via the instructions on their site. Install podman using: +``` +$ brew install podman +``` + +## Creating the first connection + +### Enable the Podman service on the server machine. + +Before performing any Podman client commands, you must enable the podman.sock SystemD service on the Linux server. In these examples, we are running Podman as a normal, unprivileged user, also known as a rootless user. By default, the rootless socket listens at `/run/user/${UID}/podman/podman.sock`. You can enable and start this socket permanently, using the following commands: +``` +$ systemctl --user enable --now podman.socket +``` +You will need to enable linger for this user in order for the socket to work when the user is not logged in. + +``` +sudo loginctl enable-linger $USER +``` + +You can verify that the socket is listening with a simple Podman command. + +``` +$ podman --remote info +host: + arch: amd64 + buildahVersion: 1.16.0-dev + cgroupVersion: v2 + conmon: + package: conmon-2.0.19-1.fc32.x86_64 +``` + +#### Enable sshd + +In order for the client to communicate with the server you need to enable and start the SSH daemon on your Linux machine, if it is not currently enabled. +``` +sudo systemctl enable --now sshd +``` + +#### Setting up SSH +Remote podman uses SSH to communicate between the client and server. The remote client works considerably smoother using SSH keys. To set up your ssh connection, you need to generate an ssh key pair from your client machine. +``` +$ ssh-keygen +``` +Your public key by default should be in your home directory under .ssh\id_rsa.pub. You then need to copy the contents of id_rsa.pub and append it into ~/.ssh/authorized_keys on the Linux server. On a Mac, you can automate this using ssh-copy-id. + +If you do not wish to use SSH keys, you will be prompted with each Podman command for your login password. + +## Using the client + +The first step in using the Podman remote client is to configure a connection.. + +You can add a connection by using the `podman system connection add` command. + +``` +C:\Users\baude> podman system connection add baude --identity c:\Users\baude\.ssh\id_rsa ssh://192.168.122.1/run/user/1000/podman/podman.sock +``` + +This will add a remote connection to Podman and if it is the first connection added, it will mark the connection as the default. You can observe your connections with `podman system connection list` + +``` +C:\Users\baude> podman system connection list +Name Identity URI +baude* id_rsa ssh://baude@192.168.122.1/run/user/1000/podman/podman.sock +``` + +Now we can test the connection with `podman info`. + +``` +C:\Users\baude> podman info +host: + arch: amd64 + buildahVersion: 1.16.0-dev + cgroupVersion: v2 + conmon: + package: conmon-2.0.19-1.fc32.x86_64 +``` + +Podman has also introduced a “--connection” flag where you can use other connections you have defined. If no connection is provided, the default connection will be used. + +``` +C:\Users\baude> podman system connection --help +``` + +## Wrap up + +You can use the podman remote clients to manage your containers running on a Linux server. The communication between client and server relies heavily on SSH connections and the use of SSH keys are encouraged. Once you have Podman installed on your remote client, you should set up a connection using `podman system connection add` which will then be used by subsequent Podman commands. + +## History +Originally published on [Red Hat Enable Sysadmin](https://www.redhat.com/sysadmin/podman-clients-macos-windows) diff --git a/versioned_docs/version-5.4.1/tutorials/performance.md b/versioned_docs/version-5.4.1/tutorials/performance.md new file mode 100644 index 000000000..0d7f36941 --- /dev/null +++ b/versioned_docs/version-5.4.1/tutorials/performance.md @@ -0,0 +1,249 @@ +--- +title: Podman performance guide +version: v5.4.1 +--- + +# Podman performance guide + +The performance of Podman may be influenced by a number of factors, such as, + +* the specified Podman command-line options and configuration +* the OCI runtime +* the host file system +* the container image + +Changing any of these may or may not have any noticeable effect on the performance of Podman on your system. + +## Using a separate user account for benchmarking + +Some performance tips, such as using a different storage driver would require the user to run `podman system reset`, +which erases all containers and container images for the user. +Instead of benchmarking different alternatives in your own home directory, you could create a new user +that afterwards can be removed. + +### Example: Specify the storage driver _vfs_ and run `/bin/true` in an Alpine container + +Interactively + +``` +sudo useradd testuser +sudo machinectl shell testuser@ +podman pull docker.io/library/alpine +/usr/bin/time -v podman --storage-driver=vfs run --rm docker.io/library/alpine /bin/true +exit +``` + +Noninteractively + +``` +sudo useradd testuser +systemd-run --machine=testuser@ --quiet --user --collect --pipe --wait \ + podman --storage-driver=vfs pull docker.io/library/alpine +systemd-run --machine=testuser@ --quiet --user --collect --pipe --wait \ + /usr/bin/time -v podman --storage-driver=vfs run --rm docker.io/library/alpine /bin/true +``` + +The command `/usr/bin/time -v` measures and displays benchmarking information. + +## Performance considerations + +### Use a fast OCI runtime + +Podman uses an OCI runtime when running containers. +The fastest OCI runtime is probably [__crun__](https://github.com/containers/crun). + +Check that you are using crun + +``` +$ podman info --format={{.Host.OCIRuntime.Name}} +crun +``` + +To benchmark an OCI runtime, create a test user account and +specify the OCI runtime path with [__--runtime__](https://docs.podman.io/en/latest/markdown/podman.1.html#runtime-value). + +### Choosing a storage driver + +The following storage drivers are listed from fastest to slowest: + +1. native overlayfs +2. fuse-overlayfs +3. vfs + +There is one notable exception to this speed ranking. +Creating a container takes significantly longer with _native overlayfs_ than _fuse-overlayfs_ +when these conditions are all met: + +* rootless Podman is used +* a modified UID/GID mapping is used +* _native overlayfs_ is used +* no container has yet been created with the specified container image and UID/GID mapping + +Runtime speed is not affected. Only __podman create__ and the container creation phases of +__podman run__ and __podman build__ are affected. +For more details, see [GitHub comment](https://github.com/containers/podman/issues/16541#issuecomment-1352790422). +Command-line options that modify the UID/GID mapping are for example __--userns__, __--uidmap__ and __--gidmap__. +The command-line option `--userns auto` is particularly affected by this performance penalty, +because different UID/GID mappings could potentially be used on each invocation. For other uses of +__--userns__, __--uidmap__ and __--gidmap__ the performance penalty is a one-time cost +that only occurs the first time the command is run. + +Using native overlayfs as an unprivileged user is available for Podman version >= 3.1 on a Linux kernel version >= 5.13. +If SELinux is not used, then Linux kernel version 5.11 or later is sufficient. +Native overlayfs support is included in RHEL >= 8.5, see [release notes](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/8.5_release_notes/index). + +To show the current storage driver + +``` +$ podman info -f {{.Store.GraphDriverName}} +overlay +$ podman info -f '{{index .Store.GraphStatus "Native Overlay Diff"}}' +true +``` + +Storage driver | Result of `podman info -f {{.Store.GraphDriverName}}` | Result of `podman info -f '{{index .Store.GraphStatus "Native Overlay Diff"}}` +---- | ------ | ----- +native overlayfs | overlay | true +fuse-overlayfs | overlay | false +VFS | vfs | false + +Before changing the storage driver, running `podman system reset` is required. +The command erases all containers and container images for the user. +See the example above "_Using a separate user account for benchmarking_" for how to benchmark a storage driver in a separate test account. + +#### Specifying the storage driver with command-line options + +Storage driver | Podman command +---- | ------ +native overlayfs | `podman --storage-driver=overlay run ...` +fuse-overlayfs | `podman --storage-driver=overlay --storage-opt overlay.mount_program=/usr/bin/fuse-overlayfs run ...` +VFS | `podman --storage-driver=vfs run ...` + +#### Configuring the default storage driver + +The default storage driver can be configured in +_/etc/containers/storage.conf_ and overridden by a user in +_~/.config/containers/storage.conf_ + +To configure native overlayfs: +``` +[storage] +driver = "overlay" +``` + +To configure fuse-overlayfs: +``` +[storage] +driver = "overlay" +[storage.options.overlay] +mount_program = "/usr/bin/fuse-overlayfs" +``` + +To configure VFS: +``` +[storage] +driver = "vfs" +``` + +See storage.conf(5) for all available configuration settings. + +### Network performance for rootless Podman + +When using rootless Podman, network traffic is normally passed through the network driver +[pasta](https://passt.top/passt/about/#pasta). This comes with a performance penalty. + +You can avoid using _pasta_ in the following ways: + +* Use socket activation for listening network sockets. Communication over the activated socket does not pass through + pasta, so it has the same performance characteristics as the normal network on the host. + Socket-activated services can be started and stopped in different ways: + + Let systemd start the service when the first client connects. Let the service terminate by itself after some time of inactivity. + Using a service on demand, can free up compute resources. + + Start the service explicitly (`systemctl --user enable foobar.service`). If the service is already + running when the first client connects, there will be no delay due to container startup. + The [socket activation tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/socket_activation.md) + provides more information about socket activation support in Podman. + +* Set up the network manually as root. Create a bridge and virtual ethernet pair (VETH). Note: compared to other methods, + this setup doesn't provide any network isolation. In containers granted CAP_NET_ADMIN or CAP_NET_RAW, processes can + open packet or raw sockets directly facing the host, which allows them to send arbitrary frames, including + crafted Ethernet and IP packets, as well as receiving packets that were not originally intended for the container, + by means of ARP spoofing. + For more information, see + + An [example](https://lists.podman.io/archives/list/podman@lists.podman.io/thread/W6MCYO6RY5YFRTSUDAOEZA7SC2EFXRZE/) posted on the Podman mailing list + + The section _DIY networking_ in [Podman-Rootless-Networking.pdf](https://containers.github.io/podman.io_old/old/community/meeting/notes/2021-10-05/Podman-Rootless-Networking.pdf) + +* Use `--network=host`. No network namespace is created. The container will use the host’s network. + Note: By using `--network=host`, the container is given full access to local system services such as D-bus and is therefore considered insecure. + +Side note: Pasta is faster than the network driver [slirp4netns](https://github.com/containers/podman/blob/main/docs/tutorials/basic_networking.md#slirp4netns). +Pasta is the default network driver since Podman 5.0.0. + +Since Podman 5.1.0 the default network driver can be shown with + +``` +$ podman info -f '{{.Host.RootlessNetworkCmd}}' +pasta +``` + +### Lazy pulling of container images + +Podman supports lazy pulling for the following container image formats: + +* __zstd:chunked__ + +* __eStargz__ + +__zstd:chunked__ has better performance than __eStargz__. + +See the article [_Pull container images faster with partial pulls_](https://www.redhat.com/sysadmin/faster-container-image-pulls) by Giuseppe Scrivano and Dan Walsh. + +### Choosing a host file system + +Lazy pulling of container images can run more efficiently when the file system has reflink support. The file systems XFS and BTRFS have reflink support. + +### Option --log-driver + +The `podman run` option [__--log-driver__](https://docs.podman.io/en/latest/markdown/podman-run.1.html#log-driver-driver) specifies the logging driver for the container. + +If logging is not needed, consider using `--log-driver=none` to disable logging. + +### Reuse the package repository cache when building container images + +The first step of a container build is often to download metadata from +the package repositories and post-process that data. + +To speed up container builds, you could prepare a directory on the host +that contains the package metadata and then make the directory available +to the container build by using an _overlay mount_. + +#### Example : Speed up _podman build_ by reusing the DNF metadata cache + +In this example the containers are based on Fedora 36. + +First create an empty directory on the host, for example *$HOME/dnf_cache_f36*. + +``` +$ mkdir $HOME/dnf_cache_f36 +``` + +Fill the directory with the most recent __dnf__ metadata cache. + +``` +$ podman run --rm -v $HOME/dnf_cache_f36:/var/cache/dnf:Z registry.fedoraproject.org/fedora:36 dnf makecache +``` + +Create a new directory, for example, _$HOME/ctr_ and a file _$HOME/ctr/Containerfile_ with these contents + +``` +FROM registry.fedoraproject.org/fedora:36 +RUN dnf -y update && dnf -y install cowsay && dnf clean all +``` + +To build the Containerfile using the prepared metadata cache, provide the directory _$HOME/dnf_cache_f36_ as an _overlay mount_ (volume option `:O`) + +``` +$ podman build -v $HOME/dnf_cache_f36:/var/cache/dnf:O -t cowsay $HOME/ctr +``` + +The article [_Speeding up container image builds with Buildah_](https://www.redhat.com/sysadmin/speeding-container-buildah) by Dan Walsh provides more details. diff --git a/versioned_docs/version-5.4.1/tutorials/podman-derivative-api.md b/versioned_docs/version-5.4.1/tutorials/podman-derivative-api.md new file mode 100644 index 000000000..9b8fc4d5c --- /dev/null +++ b/versioned_docs/version-5.4.1/tutorials/podman-derivative-api.md @@ -0,0 +1,60 @@ +--- +title: How to use libpod for custom/derivative projects +version: v5.4.1 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +# How to use libpod for custom/derivative projects + +libpod today is a Golang library and a CLI. The choice of interface you make has advantages and disadvantages. + +Using the REST API +--- + +Advantages: + + - Stable, versioned API + - Language-agnostic + - [Well-documented](http://docs.podman.io/en/latest/_static/api.html) API + +Disadvantages: + + - Error handling is less verbose than Golang API + - May be slower + +Running as a subprocess +--- + +Advantages: + + - Many commands output JSON + - Works with languages other than Golang + - Easy to get started + +Disadvantages: + + - Error handling is harder + - May be slower + - Can't hook into or control low-level things like how images are pulled + +Vendoring into a Go project +--- + +Advantages: + + - Significant power and control + +Disadvantages: + + - You are now on the hook for container runtime security updates (partially, `runc`/`crun` are separate) + - Binary size + - Potential skew between multiple libpod versions operating on the same storage can cause problems + +Making the choice +--- + +A good question to ask first is: Do you want users to be able to use `podman` to manipulate the containers created by your project? +If so, that makes it more likely that you want to run `podman` as a subprocess or using the HTTP API. If you want a separate image store and a fundamentally +different experience; if what you're doing with containers is quite different from those created by the `podman` CLI, +that may drive you towards vendoring. diff --git a/versioned_docs/version-5.4.1/tutorials/podman-for-windows.md b/versioned_docs/version-5.4.1/tutorials/podman-for-windows.md new file mode 100644 index 000000000..ff50f9e8b --- /dev/null +++ b/versioned_docs/version-5.4.1/tutorials/podman-for-windows.md @@ -0,0 +1,426 @@ +--- +title: Documentation +version: v5.4.1 +--- + +![](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +Podman for Windows +================== + +While "containers are Linux," Podman also runs on Mac and Windows, where it +provides a native CLI and embeds a guest Linux system to launch your +containers. This guest is referred to as a Podman machine and is managed with +the `podman machine` command. On Windows, each Podman machine is backed by a +virtualized Windows Subsystem for Linux (WSLv2) distribution. The podman command +can be run directly from your Windows PowerShell (or CMD) prompt, where it +remotely communicates with the podman service running in the WSL environment. +Alternatively, you can access Podman directly from the WSL instance if you +prefer a Linux prompt and Linux tooling. In addition to command-line access, +Podman also listens for Docker API clients, supporting direct usage of +Docker-based tools and programmatic access from your language of choice. + +Prerequisites +------------- + +Since Podman uses WSL, you need a recent release of Windows 10 or Windows 11. +On x64, WSL requires build 18362 or later, and 19041 or later is required for +arm64 systems. Internally, WSL uses virtualization, so your system must +support and have hardware virtualization enabled. If you are running Windows +on a VM, you must have a VM that supports nested virtualization. + +It is also recommended to install the modern "Windows Terminal," which +provides a superior user experience to the standard PowerShell and CMD +prompts, as well as a WSL prompt, should you want it. + +You can install it by searching the Windows Store or by running the following +`winget` command: + +`winget install Microsoft.WindowsTerminal` + + +Installing Podman +----------------- + +Installing the Windows Podman client begins by downloading the Podman Windows +installer. The Windows installer is built with each Podman release and can be +downloaded from the official + [GitHub release page](https://github.com/containers/podman/releases). +Be sure to download a 4.1 or later release for the capabilities discussed +in this guide. + +*[Image: Installing Podman 4.1.0]* + +Once downloaded, simply run the EXE file, and relaunch a new terminal. After +this point, podman.exe will be present on your PATH, and you will be able to run +the `podman machine init` command to create your first machine. + +`PS C:\Users\User> podman machine init` + +Automatic WSL Installation +-------------------------- + +If WSL has not been installed on your system, the first machine init command +will prompt a dialog to begin an automated install. If accepted, this process +will install the necessary Windows components, restart the system, and after +login, relaunch the machine creation process in a terminal window. Be sure to +wait a minute or two for the relaunch to occur, as Windows has a delay before +executing startup items. Alternatively, you can decline automatic installation +and install WSL manually. However, this will require additional download and +setup time. + +Machine Init Process +-------------------- + +After WSL is installed, the init command will install a minimal installation +of Fedora, customizing it to run podman. + +``` +PS C:\Users\User> podman machine init +Extracting compressed file +Importing operating system into WSL (this may take 5+ minutes on a new WSL install)... +Installing packages (this will take a while)... +Complete! +Configuring system... +Generating public/private ed25519 key pair. +Your identification has been saved in podman-machine-default +Your public key has been saved in podman-machine-default.pub +The key fingerprint is: +SHA256:RGTGg2Q/LX7ijN+mzu8+BzcS3cEWP6Hir6pYllJtceA root@WINPC +Machine init complete +To start your machine run: + + podman machine start +``` + + +Starting Machine +---------------- + +After the machine init process completes, it can then be started and stopped +as desired: + +``` +PS C:\Users\User> podman machine start + +Starting machine "podman-machine-default" + +This machine is currently configured in rootless mode. If your containers +require root permissions (e.g. ports < 1024), or if you run into compatibility +issues with non-podman clients, you can switch using the following command: + + podman machine set --rootful + +API forwarding listening on: npipe:////./pipe/docker_engine + +Docker API clients default to this address. You do not need to set DOCKER_HOST. +Machine "podman-machine-default" started successfully +``` + +First Podman Command +-------------------- + +From this point on, podman commands operate similarly to how they would on +Linux. + +For a quick working example with a small image, you can run the Linux date +command on PowerShell. + +``` +PS C:\Users\User> podman run ubi8-micro date +Thu May 5 21:56:42 UTC 2022 +``` + +Port Forwarding +--------------- + +Port forwarding also works as expected; ports will be bound against localhost +(127.0.0.1). Note: When running as rootless (the default), you must use a port +greater than 1023. See the Rootful and Rootless section for more details. + +To launch httpd, you can run: + +``` +PS C:\Users\User> podman run --rm -d -p 8080:80 --name httpd docker.io/library/httpd +f708641300564a6caf90c145e64cd852e76f77f6a41699478bb83a162dceada9 +``` + +A curl command against localhost on the PowerShell prompt will return a +successful HTTP response: + +``` +PS C:\Users\User> curl http://localhost:8080/ -UseBasicParsing + +StatusCode : 200 +StatusDescription : OK +Content :

It works!

+``` + +As with Linux, to stop, run: + +`podman stop httpd` + + +Using API Forwarding +-------------------- + +API forwarding allows Docker API tools and clients to use podman as if it was +Docker. Provided there is no other service listening on the Docker API pipe; +no special settings will be required. + +``` +PS C:\Users\User> .\docker.exe run -it fedora echo "Hello Podman!" +Hello Podman! +``` + +Otherwise, after starting the machine, you will be notified of an environment +variable you can set for tools to point to podman. Alternatively, you can shut +down both the conflicting service and podman, then finally run `podman machine +start` to restart, which should grab the Docker API address. + + +``` +Another process was listening on the default Docker API pipe address. +You can still connect Docker API clients by setting DOCKER HOST using the +following PowerShell command in your terminal session: + + $Env:DOCKER_HOST = 'npipe:////./pipe/podman-machine-default' + +Or in a classic CMD prompt: + + set DOCKER_HOST=npipe:////./pipe/podman-machine-default + +Alternatively, terminate the other process and restart podman machine. +Machine "podman-machine-default" started successfully + +PS C:\Users\User> $Env:DOCKER_HOST = 'npipe:////./pipe/podman-machine-default' +PS C:\Users\User>.\docker.exe version --format '{{(index .Server.Components 0).Name}}' +Podman Engine +``` + +Rootful & Rootless +------------------ + +On the embedded WSL Linux distro, podman can either be run under the root user +(rootful) or a non-privileged user (rootless). For behavioral consistency with +Podman on Linux, rootless is the default. Note: Rootful and Rootless +containers are distinct and isolated from one another. Podman commands against +one (e.g., podman ps) will not represent results/state for the other. + +While most containers run fine in a rootless setting, you may find a case +where the container only functions with root privileges. If this is the case, +you can switch the machine to rootful by stopping it and using the set +command: + +``` +podman machine stop +podman machine set --rootful +``` + +To restore rootless execution, set rootful to false: + +``` +podman machine stop +podman machine set --rootful=false +``` + +Another case in which you may wish to use rootful execution is binding a port +less than 1024. However, future versions of podman will likely drop this to a +lower number to improve compatibility with defaults on system port services (such +as MySQL) + +Volume Mounting +--------------- + +New in Podman v4.1 is the ability to perform volume mounts from Windows paths into a +Linux container. This supports several notation schemes, including: + +Windows Style Paths: + +`podman run --rm -v c:\Users\User\myfolder:/myfolder ubi8-micro ls /myfolder` + +Unixy Windows Paths: + +`podman run --rm -v /c/Users/User/myfolder:/myfolder ubi8-micro ls /myfolder` + +Linux paths local to the WSL filesystem: + +`podman run --rm -v /var/myfolder:/myfolder ubi-micro ls /myfolder` + +All of the above conventions work, whether running on a Windows prompt or the +WSL Linux shell. Although when using Windows paths on Linux, appropriately quote +or escape the Windows path portion of the argument. + + +Listing Podman Machine(s) +------------------------- + +To list the available podman machine instances and their current resource +usage, use the `podman machine ls` command: + +``` +PS C:\Users\User> podman machine ls + + +NAME VM TYPE CREATED LAST UP CPUS MEMORY DISK SIZE +podman-machine-default wsl 2 hours ago Currently running 4 331.1MB 768MB +``` + +Since WSL shares the same virtual machine and Linux kernel across multiple +distributions, the CPU and Memory values represent the total resources shared +across running systems. The opposite applies to the Disk value. It is +independent and represents the amount of storage for each individual +distribution. + + +Accessing the Podman Linux Environment +-------------------------------------- + +While using the podman.exe client on the Windows environment provides a +seamless native experience supporting the usage of local desktop tools and +APIs, there are a few scenarios in which you may wish to access the Linux +environment: + ++ Updating to the latest stable packages on the embedded Fedora instance ++ Using Linux development tools directly ++ Using a workflow that relies on EXT4 filesystem performance or behavior + semantics + +There are three mechanisms to access the embedded WSL distribution: +1. SSH using `podman machine ssh` +2. WSL command on the Windows PowerShell prompt +3. Windows Terminal Integration + +### Using SSH + +SSH access provides a similar experience as Podman on Mac. It immediately +drops you into the appropriate user based on your machine's rootful/rootless +configuration (root in the former, 'user' in the latter). The --username +option can be used to override with a specific user. + +An example task using SSH is updating your Linux environment to pull down the +latest OS bugfixes: + +`podman machine ssh sudo dnf upgrade -y` + +### Using the WSL Command + +The `wsl` command provides direct access to the Linux system but enters the +shell as root first. This is due to design limitations of WSL, where running +systemd (Linux's system services) requires the usage of a privileged process +namespace. + +Unless you have no other distributions of WSL installed, it's recommended to +use the `-d` option with the name of your podman machine (podman-machine-default +is the default) + +``` +PS C:\Users\User> wsl -d podman-machine-default +``` + +You will be automatically entered into a nested process namespace where +systemd is running. If you need to access the parent namespace, hit `ctrl-d` +or type exit. This also means to log out, you need to exit twice. + +``` +[root@WINPC /]# podman --version +podman version 4.1.0 +``` + + +To access commands as the non-privileged user (rootless podman), you must +first type `su user`. Alternatively, you can prefix the `wsl` command to use the +special `enterns`: + +``` +wsl -d podman-machine-default enterns su user +[user@WINPC /]$ id +uid=1000(user) gid=1000(user) groups=1000(user),10(wheel) +``` + +Likewise, running commands as root without entering a prompt should also be +prefixed with `enterns`. + +`wsl -d podman-machine-default enterns systemctl status` + +Accessing the WSL instance as a specific user using `wsl -u` or using inline +commands without `enterns` is not recommended since commands will execute +against the incorrect namespace. + +### Using Windows Terminal Integration + +Entering WSL as root is a 2-click operation. Simply click the drop-down tag, +and pick 'podman-machine-default,' where you will be entered directly as root. + +*[Image: Using WSL in Windows Terminal]* + +As before, to switch to a non-privileged user for rootless podman commands, +type `su user`. + +``` +[root@WINPC /]# su user +[user@WINPC /]$ podman info --format '{{.Store.RunRoot}}' +/run/user/1000/containers +``` + +Stopping a Podman Machine +------------------------- + +To stop a running podman machine, use the `podman machine stop` command: + +``` +PS C:\Users\User> podman machine stop +Machine "podman-machine-default" stopped successfully +``` + +Removing a Podman Machine +------------------------- + +To remove a machine, use the `podman machine rm` command: + +``` +PS C:\Users\User> podman machine rm + +The following files will be deleted: + +C:\Users\User\.ssh\podman-machine-default +C:\Users\User\.ssh\podman-machine-default.pub +C:\Users\User\.local\share\containers\podman\machine\wsl\podman-machine-default_fedora-35-x86_64.tar +C:\Users\User\.config\containers\podman\machine\wsl\podman-machine-default.json +C:\Users\User\.local\share\containers\podman\machine\wsl\wsldist\podman-machine-default + + +Are you sure you want to continue? [y/N] y +``` + + + +Troubleshooting +--------------- + +Recovering from a failed auto-installation of WSL + +If auto-install fails and retrying is unsuccessful, you can attempt to reset +your WSL system state and perform a manual WSL installation using the `wsl +--install` command. To do so, perform the following steps: + +1. Launch PowerShell as administrator + ``` + Start-Process powershell -Verb RunAs + ``` +2. Disable WSL Features + ``` + dism.exe /online /disable-feature /featurename:Microsoft-Windows-Subsystem-Linux /norestart + dism.exe /online /disable-feature /featurename:VirtualMachinePlatform /norestart + ``` +3. Reboot +4. Run manual WSL install + ``` + wsl --install + ``` +5. Continue with podman machine init + +Install Certificate Authority +============================= + +Instructions for installing a CA certificate can be found [here](podman-install-certificate-authority.md). diff --git a/versioned_docs/version-5.4.1/tutorials/podman-install-certificate-authority.md b/versioned_docs/version-5.4.1/tutorials/podman-install-certificate-authority.md new file mode 100644 index 000000000..f33b32581 --- /dev/null +++ b/versioned_docs/version-5.4.1/tutorials/podman-install-certificate-authority.md @@ -0,0 +1,114 @@ +--- +title: Documentation +version: v5.4.1 +--- + +*[Image: PODMAN logo]* + +Install Certificate Authority +============================= + +Organizations may create their own local certificate authority (CA) or acquire one from a third party. This may mean more than one certificate, such as one or more intermediate certificates and a root certificate, for example. In any case, it is necessary to add the certificate authority (CA) certificate(s) so that it can be employed for various use cases. + +### Method one + +Certificates may be either individual or concatenated (bundles). The following steps are one method to add such certificates to Podman. It is assumed that Podman is running and the certificate(s) to be installed are available on an accessible server via curl. If such access is not possible, an alternative method follows. + +First, assuming a running Podman machine, ssh into the machine: +``` +podman machine ssh +``` + +If Podman is running in the default rootless mode, an additional command is required to get to a root shell: + +``` +[core@localhost ~]$ sudo su - +``` + +After issuing the above command, the prompt should change to indicate the "root" instead of the "core" user. + +Next, while in the machine, change to the directory where the certificate(s) should be installed: +``` +[root@localhost ~]# cd /etc/pki/ca-trust/source/anchors +``` + +Then use curl to download the certificate. Notes: +* The -k is only necessary if connecting securely to a server for which the certificate is not yet trusted +* The MY-SERVER.COM/SOME-CERTIFICATE.pem should be replaced as appropriate +``` +[root@localhost anchors]# curl -k -o some-certificate.pem https://MY-SERVER.COM/SOME-CERTIFICATE.pem +``` + +Repeat as necessary for multiple certificates. + +Once all of the certificates have been downloaded, run the command to add the certificates to the list of trusted CAs: +``` +[root@localhost anchors]# update-ca-trust +``` + +Exit the machine: +``` +[root@localhost anchors]# exit +``` + +If the "sudo su -" command was used to switch to a root shell as described above, an additional exit command is needed to exit the machine: + +``` +[core@localhost ~]$ exit +``` + +If the certificates are still not accepted, it might be necessary to restart the Podman machine. To do this, issue the following commands on the host (and not inside the Podman machine): + +``` +podman machine stop +podman machine start +``` + +### Alternative Method + +If the above method is for some reason not practical or desirable, the certificate may be created using vi. + +As above, assuming a running Podman machine, ssh into the machine: + +``` +podman machine ssh +``` + +If the prompt starts with "core" instead of "root", switch to a root shell: + +``` +[core@localhost ~]$ sudo su - +``` + +Next, change to the directory where the certificate(s) should be installed: +``` +[root@localhost ~]# cd /etc/pki/ca-trust/source/anchors +``` + +Then use vi to create the certificate. +``` +[root@localhost ~]# vi SOME-CERTIFICATE.pem +``` +After vi opens, copy the certificate to the clipboard, then in insert mode, paste the clipboard contents to vi. Lastly, save the file and close vi. + +Repeat as necessary for multiple certificates. + +Once all of the certificates have been created, run the command to add the certificates to the list of trusted CAs: +``` +[root@localhost anchors]# update-ca-trust +``` + +Exit the machine: +``` +[root@localhost anchors]# exit +``` + +If the "sudo su -" command described above was used, an additional exit command is needed: + +``` +[core@localhost ~]$ exit +``` + +### Final Notes + +The certificate installation will persist during machine restarts. There is no need to stop and start the machine to begin using the certificate. diff --git a/versioned_docs/version-5.4.1/tutorials/podman_tutorial.md b/versioned_docs/version-5.4.1/tutorials/podman_tutorial.md new file mode 100644 index 000000000..bfc1bf5c1 --- /dev/null +++ b/versioned_docs/version-5.4.1/tutorials/podman_tutorial.md @@ -0,0 +1,149 @@ +--- +title: Basic Setup and Use of Podman +version: v5.4.1 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +# Basic Setup and Use of Podman +Podman is a utility provided as part of the libpod library. It can be used to create and maintain +containers. The following tutorial will teach you how to set up Podman and perform some basic +commands with Podman. + +If you are running on a Mac or Windows PC, you should instead follow the [Mac and Windows tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) +to set up the remote Podman client. + +**NOTE**: the code samples are intended to be run as a non-root user, and use `sudo` where +root escalation is required. + +## Installing Podman + +For installing or building Podman, see the [installation instructions](https://podman.io/getting-started/installation). + +## Familiarizing yourself with Podman + +### Running a sample container +This sample container will run a very basic httpd server (named basic_httpd) that serves only its index +page. +```console +podman run --name basic_httpd -dt -p 8080:80/tcp docker.io/nginx +``` +Because the container is being run in detached mode, represented by the *-d* in the `podman run` command, Podman +will print the container ID after it has run. Note that we use port forwarding to be able to +access the HTTP server. For successful running at least slirp4netns v0.3.0 is needed. + +### Listing running containers +The Podman *ps* command is used to list creating and running containers. +```console +podman ps +``` + +Note: If you add *-a* to the *ps* command, Podman will show all containers. +### Inspecting a running container +You can "inspect" a running container for metadata and details about itself. We can even use +the inspect subcommand to see what IP address was assigned to the container. As the container is running in rootless mode, an IP address is not assigned and the value will be listed as "none" in the output from inspect. +```console +podman inspect basic_httpd | grep IPAddress\": + "SecondaryIPAddresses": null, + "IPAddress": "", +``` + +### Testing the httpd server +As we do not have the IP address of the container, we can test the network communication between the host +operating system and the container using curl. The following command should display the index page of our +containerized httpd server. +```console +curl http://localhost:8080 +``` + +### Viewing the container's logs +You can view the container's logs with Podman as well: +```console +podman logs +10.88.0.1 - - [07/Feb/2018:15:22:11 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:30 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:30 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:31 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:31 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +``` + +### Viewing the container's pids +And you can observe the httpd pid in the container with *top*. +```console +podman top + UID PID PPID C STIME TTY TIME CMD + 0 31873 31863 0 09:21 ? 00:00:00 nginx: master process nginx -g daemon off; + 101 31889 31873 0 09:21 ? 00:00:00 nginx: worker process +``` + +### Checkpointing the container +Checkpointing a container stops the container while writing the state of all processes in the container to disk. +With this a container can later be restored and continue running at exactly the same point in time as the +checkpoint. This capability requires CRIU 3.11 or later installed on the system. +This feature is not supported as rootless; as such, if you wish to try it, you'll need to re-create your container as root, using the same command but with sudo. + +To checkpoint the container use: +```console +sudo podman container checkpoint +``` + +### Restoring the container +Restoring a container is only possible for a previously checkpointed container. The restored container will +continue to run at exactly the same point in time it was checkpointed. +To restore the container use: +```console +sudo podman container restore +``` + +After being restored, the container will answer requests again as it did before checkpointing. +```console +curl http://:8080 +``` + +### Migrate the container +To live migrate a container from one host to another the container is checkpointed on the source +system of the migration, transferred to the destination system and then restored on the destination +system. When transferring the checkpoint, it is possible to specify an output-file. + +On the source system: +```console +sudo podman container checkpoint -e /tmp/checkpoint.tar.gz +scp /tmp/checkpoint.tar.gz :/tmp +``` + +On the destination system: +```console +sudo podman container restore -i /tmp/checkpoint.tar.gz +``` + +After being restored, the container will answer requests again as it did before checkpointing. This +time the container will continue to run on the destination system. +```console +curl http://:8080 +``` + +### Stopping the container +To stop the httpd container: +```console +podman stop +``` +You can also check the status of one or more containers using the *ps* subcommand. In this case, we should +use the *-a* argument to list all containers. +```console +podman ps -a +``` + +### Removing the container +To remove the httpd container: +```console +podman rm +``` +You can verify the deletion of the container by running *podman ps -a*. + +## Integration Tests +For more information on how to set up and run the integration tests in your environment, checkout the Integration Tests [README.md](https://github.com/containers/podman/blob/main/test/README.md) + +## More information + +For more information on Podman and its subcommands, checkout the asciiart demos on the [README.md](https://github.com/containers/podman/blob/main/README.md#commands) +page. diff --git a/versioned_docs/version-5.4.1/tutorials/podman_tutorial_cn.md b/versioned_docs/version-5.4.1/tutorials/podman_tutorial_cn.md new file mode 100644 index 000000000..801cc59b5 --- /dev/null +++ b/versioned_docs/version-5.4.1/tutorials/podman_tutorial_cn.md @@ -0,0 +1,175 @@ +--- +title: Documentation +version: v5.4.1 +--- + +> - 译文出自：[掘金翻译计划](https://juejin.cn/translate) + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +Podman是由libpod库提供一个实用的程序，可以被用于创建和管理容器。 + +下面的教程会教你如何启动 Podman 并使用 Podman 执行一些基本的命令。 + +如果你正在使用 Mac 或者 Windows +，你应该先查看[Mac 和 Windows 使用说明](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md)来设置 Podman +远程客户端。 + +**注意**：示例中所有命令皆以非 root 的用户运行，必要的时候通过 `sudo` 命令来获取 root 权限。 + +## 安装Podman + +安装或者编译 Podman ，请参照[安装说明](https://podman.io/getting-started/installation)。 + +## 熟悉podman + +### 运行一个示例容器 + +这个示例容器会运行一个简单的只有主页的 httpd 服务器。 + +```console +podman run --name basic_httpd -dt -p 8080:80/tcp docker.io/nginx +``` + +因为命令中的 *-d* 参数表明容器以 "detached" 模式运行，所以 Podman 会在容器运行后打印容器的 ID。 + +注意为了访问这个 HTTP 服务器，我们将使用端口转发。成功运行需要 slirp4netns 的 v0.3.0+ 版本。 + +Podman 的 *ps* 命令用于列出正在创建和运行的容器。 + +```console +podman ps +``` + +**注意**：如果为 *ps* 命令添加 *-a* 参数，Podman 将展示所有的容器。 + +### 查看正在运行的容器 + +你可以 "inspect" (查看)一个正在运行的容器的元数据以及其他详细信息。我们甚至可以使用 inspect 的子命令查看分配给容器的 IP 地址。由于容器以非 root 模式运行，没有分配 IP 地址，inspect 的输出会是 " +none" 。 + +```console +podman inspect -l | grep IPAddress\": + "SecondaryIPAddresses": null, + "IPAddress": "", +``` + +**注意**：*-l* 参数是**最近的容器**的指代，你也可以使用容器的ID 代替 *-l* + +### 测试httpd服务器 + +由于我们没有容器的 IP 地址，我们可以使用 curl 测试主机和容器之间的网络通信。下面的命令应该显示我们的容器化 httpd 服务器 的主页。 + +```console +curl http://localhost:8080 +``` + +### 查看容器的日志 + +你也可以使用 podman 查看容器的日志 + +```console +podman logs --latest +10.88.0.1 - - [07/Feb/2018:15:22:11 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:30 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:30 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:31 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:31 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +``` + +### 查看容器中的进程pid + +你可以使用 *top* 命令查看容器中 httpd 的 pid + +```console +podman top + UID PID PPID C STIME TTY TIME CMD + 0 31873 31863 0 09:21 ? 00:00:00 nginx: master process nginx -g daemon off; + 101 31889 31873 0 09:21 ? 00:00:00 nginx: worker process +``` + +### 设置容器的检查点 + +设置检查点会在停止容器的同时把容器中所有进程的状态写入磁盘。 + +有了它，容器后续可以被恢复，并在与检查点完全相同的时间点继续运行。 这个功能需要在系统上安装 CRIU 的 3.11+ 版本。 + +这个功能不支持非 root 模式，因此，如果你想尝试使用它，你需要使用 sudo 方式重新创建容器。 + +设置容器检查点请使用： + +```console +sudo podman container checkpoint +``` + +### 恢复容器 + +恢复容器只能在以前设置过检查点的容器上使用。恢复的容器会在与设置检查点时完全相同的时间点继续运行。 + +恢复容器请使用： + +```console +sudo podman container restore +``` + +恢复之后。容器会像设置检查点之前一样回复请求 + +```console +curl http://:8080 +``` + +### 迁移容器 + +为了将容器从一个主机上热迁移到另一个主机，容器可以在在源系统上创建检查点，传输到目的系统，然后再在目的系统上恢复。 +为了便于传输容器的检查点，可以将其存储在一个指定的输出文件中。 + +在源系统上： + +```console +sudo podman container checkpoint -e /tmp/checkpoint.tar.gz +scp /tmp/checkpoint.tar.gz :/tmp +``` + +在目标系统上： + +```console +sudo podman container restore -i /tmp/checkpoint.tar.gz +``` + +恢复之后，容器会像设置检查点之前一样回复请求。这时，容器会在目标系统上继续运行。 + +```console +curl http://:8080 +``` + +### 停止容器 + +停止 httpd 容器 + +```console +podman stop --latest +``` + +你还可以使用 *ps* 命令检查一个或多个容器的状态，在这个例子中，我们使用 *-a* 参数列出所有的容器。 + +```console +podman ps -a +``` + +### 移除容器 + +移除 httpd 容器 + +```console +podman rm --latest +``` + +你可以使用 *podman ps -a* 验证容器的删除。 + +## 集成测试 + +在环境中如何设置并运行集成测试请查看集成测试的[自述页面](https://github.com/containers/podman/blob/main/test/README.md) + +## 更多信息 + +有关podman 和它的子命令的更多信息请查看 podman 的[自述页面](https://github.com/containers/podman/blob/main/README.md#commands) diff --git a/versioned_docs/version-5.4.1/tutorials/qemu-remote-tutorial.md b/versioned_docs/version-5.4.1/tutorials/qemu-remote-tutorial.md new file mode 100644 index 000000000..339ff72e4 --- /dev/null +++ b/versioned_docs/version-5.4.1/tutorials/qemu-remote-tutorial.md @@ -0,0 +1,137 @@ +--- +title: Podman-remote client for Windows with QEMU VM +version: v5.4.1 +--- + +# Podman-remote client for Windows with QEMU VM + +*** +**_NOTE:_** For running Podman on Windows, refer to the [Podman for Windows](podman-for-windows.md) guide, which uses the recommended approach of a Podman-managed Linux backend. For Mac, see the [Podman installation instructions](https://podman.io/getting-started/installation). This guide covers the advanced usage of Podman with a custom Linux VM. +*** + +## Introduction + +This is an experimental setup using QEMU VM for running Podman for the already supported [Podman-remote](https://docs.podman.io/en/latest/markdown/podman-remote.1.html) client on Windows. +The officially supported and recommended way of running Podman on Windows is using [Podman machine](https://docs.podman.io/en/latest/markdown/podman-machine.1.html). + +## Prerequisites + +* Windows 10 Build 18362 or later (Build 19044/Version 21H2 or later recommended) +* SSH client feature installed on the machine +* Hyper-V acceleration should be operational on the machine +* Directory `C:\qemu-remote\` will be used for storing needed assets +* Port `57561` is free to use for ssh over a loopback interface + +## Obtaining and installing + +### QEMU + +Download QEMU (7.2.0 minimal) from https://qemu.weilnetz.de/w64/ + +Then download the Fedora CoreOS (FCOS) image for QEMU from https://getfedora.org/coreos/download?tab=metal_virtualized&stream=testing&arch=x86_64 + +One will need `.xz` format extraction tool like xz itself or 7-zip. Use it to extract the `.qcow2` image to C:\qemu-remote\fedora-coreos-37.20221127.2.0-qemu.x86_64.qcow2 + +With xz the command line (when run from the same directory) will be +``` +xz -d fedora-coreos-37.20221127.2.0-qemu.x86_64.qcow2.xz +``` + +### Podman + +Download and install the latest release of Podman for Windows. Podman releases can be obtained from the official Podman GitHub release page: https://github.com/containers/podman/releases + +#### Older Podman releases + +When using older Podman releases (4.3.x and earlier), where `gvproxy.exe` is missing from the installation directory, +it could be obtained from the official releases https://github.com/containers/gvisor-tap-vsock/releases +One would need version `0.5.0` or a more recent release. Download `gvproxy-windows.exe` and copy it to +the Podman installation directory (or any other location, which is added to the PATH environment variable) +renaming the binary to `gvproxy.exe`. + +### SSH + +Generate ssh keys with an empty passphrase + +ssh-keygen -t ed25519 -f C:\qemu-remote\remote + +### Ignition for FCOS + +Create ignition file C:\qemu-remote\remote.ign with the content of +``` +{"ignition":{"config":{"replace":{"verification":{}}},"proxy":{},"security":{"tls":{}},"timeouts":{},"version":"3.2.0"},"passwd":{"users":[{"name":"core","sshAuthorizedKeys":["YOURSSHKEYHERE"],"uid":501},{"name":"root","sshAuthorizedKeys":["YOURSSHKEYHERE"]}]},"storage":{"directories":[{"group":{"name":"core"},"path":"/home/core/.config","user":{"name":"core"},"mode":493},{"group":{"name":"core"},"path":"/home/core/.config/containers","user":{"name":"core"},"mode":493},{"group":{"name":"core"},"path":"/home/core/.config/systemd","user":{"name":"core"},"mode":493},{"group":{"name":"core"},"path":"/home/core/.config/systemd/user","user":{"name":"core"},"mode":493},{"group":{"name":"core"},"path":"/home/core/.config/systemd/user/default.target.wants","user":{"name":"core"},"mode":493},{"group":{"name":"root"},"path":"/etc/containers/registries.conf.d","user":{"name":"root"},"mode":493},{"group":{"name":"root"},"path":"/etc/systemd/system.conf.d","user":{"name":"root"},"mode":493},{"group":{"name":"root"},"path":"/etc/environment.d","user":{"name":"root"},"mode":493}],"files":[{"group":{"name":"core"},"path":"/home/core/.config/systemd/user/linger-example.service","user":{"name":"core"},"contents":{"source":"data:,%5BUnit%5D%0ADescription=A%20systemd%20user%20unit%20demo%0AAfter=network-online.target%0AWants=network-online.target%20podman.socket%0A%5BService%5D%0AExecStart=%2Fusr%2Fbin%2Fsleep%20infinity%0A","verification":{}},"mode":484},{"group":{"name":"core"},"path":"/home/core/.config/containers/containers.conf","user":{"name":"core"},"contents":{"source":"data:,%5Bcontainers%5D%0Anetns=%22bridge%22%0A","verification":{}},"mode":484},{"group":{"name":"root"},"overwrite":true,"path":"/etc/subuid","user":{"name":"root"},"contents":{"source":"data:,core:100000:1000000","verification":{}},"mode":484},{"group":{"name":"root"},"overwrite":true,"path":"/etc/subgid","user":{"name":"root"},"contents":{"source":"data:,core:100000:1000000","verification":{}},"mode":484},{"group":{"name":"root"},"path":"/etc/systemd/system/user@.service.d/delegate.conf","user":{"name":"root"},"contents":{"source":"data:,%5BService%5D%0ADelegate=memory%20pids%20cpu%20io%0A","verification":{}},"mode":420},{"group":{"name":"core"},"path":"/var/lib/systemd/linger/core","user":{"name":"core"},"contents":{"verification":{}},"mode":420},{"group":{"name":"root"},"path":"/etc/containers/containers.conf","user":{"name":"root"},"contents":{"source":"data:,%5Bengine%5D%0Amachine_enabled=true%0A","verification":{}},"mode":420},{"group":{"name":"root"},"path":"/etc/containers/podman-machine","user":{"name":"root"},"contents":{"source":"data:,qemu%0A","verification":{}},"mode":420},{"group":{"name":"root"},"path":"/etc/containers/registries.conf.d/999-podman-machine.conf","user":{"name":"root"},"contents":{"source":"data:,unqualified-search-registries=%5B%22docker.io%22%5D%0A","verification":{}},"mode":420},{"group":{},"path":"/etc/tmpfiles.d/podman-docker.conf","user":{},"contents":{"source":"data:,L+%20%20%2Frun%2Fdocker.sock%20%20%20-%20%20%20%20-%20%20%20%20-%20%20%20%20%20-%20%20%20%2Frun%2Fpodman%2Fpodman.sock%0A","verification":{}},"mode":420},{"group":{"name":"root"},"path":"/etc/profile.d/docker-host.sh","user":{"name":"root"},"contents":{"source":"data:,export%20DOCKER_HOST=%22unix:%2F%2F$%28podman%20info%20-f%20%22%7B%7B.Host.RemoteSocket.Path%7D%7D%22%29%22%0A","verification":{}},"mode":420}],"links":[{"group":{"name":"core"},"path":"/home/core/.config/systemd/user/default.target.wants/linger-example.service","user":{"name":"core"},"hard":false,"target":"/home/core/.config/systemd/user/linger-example.service"},{"group":{"name":"root"},"overwrite":true,"path":"/usr/local/bin/docker","user":{"name":"root"},"hard":false,"target":"/usr/bin/podman"},{"group":{"name":"root"},"overwrite":false,"path":"/etc/localtime","user":{"name":"root"},"hard":false,"target":"\\usr\\share\\zoneinfo"}]},"systemd":{"units":[{"enabled":true,"name":"podman.socket"},{"contents":"[Unit]\nRequires=dev-virtio\\\\x2dports-vport1p1.device\nAfter=remove-moby.service sshd.socket sshd.service\nOnFailure=emergency.target\nOnFailureJobMode=isolate\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/bin/sh -c '/usr/bin/echo Ready \u003e/dev/vport1p1'\n[Install]\nRequiredBy=default.target\n","enabled":true,"name":"ready.service"},{"enabled":false,"mask":true,"name":"docker.service"},{"enabled":false,"mask":true,"name":"docker.socket"},{"contents":"[Unit]\nDescription=Remove moby-engine\n# Run once for the machine\nAfter=systemd-machine-id-commit.service\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/rpm-ostree override remove moby-engine\nExecStart=/usr/bin/rpm-ostree ex apply-live --allow-replacement\nExecStartPost=/bin/touch /var/lib/%N.stamp\n\n[Install]\nWantedBy=default.target\n","enabled":true,"name":"remove-moby.service"},{"contents":"[Unit]\nDescription=Environment setter from QEMU FW_CFG\n[Service]\nType=oneshot\nRemainAfterExit=yes\nEnvironment=FWCFGRAW=/sys/firmware/qemu_fw_cfg/by_name/opt/com.coreos/environment/raw\nEnvironment=SYSTEMD_CONF=/etc/systemd/system.conf.d/default-env.conf\nEnvironment=ENVD_CONF=/etc/environment.d/default-env.conf\nEnvironment=PROFILE_CONF=/etc/profile.d/default-env.sh\nExecStart=/usr/bin/bash -c '/usr/bin/test -f ${FWCFGRAW} \u0026\u0026\\\n\techo \"[Manager]\\n#Got from QEMU FW_CFG\\nDefaultEnvironment=$(/usr/bin/base64 -d ${FWCFGRAW} | sed -e \"s+|+ +g\")\\n\" \u003e ${SYSTEMD_CONF} ||\\\n\techo \"[Manager]\\n#Got nothing from QEMU FW_CFG\\n#DefaultEnvironment=\\n\" \u003e ${SYSTEMD_CONF}'\nExecStart=/usr/bin/bash -c '/usr/bin/test -f ${FWCFGRAW} \u0026\u0026 (\\\n\techo \"#Got from QEMU FW_CFG\"\u003e ${ENVD_CONF};\\\n\tIFS=\"|\";\\\n\tfor iprxy in $(/usr/bin/base64 -d ${FWCFGRAW}); do\\\n\t\techo \"$iprxy\" \u003e\u003e ${ENVD_CONF}; done ) || \\\n\techo \"#Got nothing from QEMU FW_CFG\"\u003e ${ENVD_CONF}'\nExecStart=/usr/bin/bash -c '/usr/bin/test -f ${FWCFGRAW} \u0026\u0026 (\\\n\techo \"#Got from QEMU FW_CFG\"\u003e ${PROFILE_CONF};\\\n\tIFS=\"|\";\\\n\tfor iprxy in $(/usr/bin/base64 -d ${FWCFGRAW}); do\\\n\t\techo \"export $iprxy\" \u003e\u003e ${PROFILE_CONF}; done ) || \\\n\techo \"#Got nothing from QEMU FW_CFG\"\u003e ${PROFILE_CONF}'\nExecStartPost=/usr/bin/systemctl daemon-reload\n[Install]\nWantedBy=sysinit.target\n","enabled":true,"name":"envset-fwcfg.service"}]}} +``` + +Replace "YOURSSHKEYHERE" with the actual pub keys you generated. + +## Launching + +### gvproxy + +One needs to run gvproxy first to make it ready for the QEMU VM launched afterward. Run it with the command below: +``` +gvproxy.exe -listen-qemu unix://C:/qemu-remote/vlan_remote.sock -pid-file C:\qemu-remote\proxy.pid -ssh-port 57561 -forward-sock C:\qemu-remote\podman.sock -forward-dest /run/user/501/podman/podman.sock -forward-user core -forward-identity C:\qemu-remote\remote +``` + +### QEMU + +Launch QEMU with the following command (the following configures it to use 4 CPUs and 8 GB RAM, but it could be adjusted for less): + +``` +qemu-system-x86_64w.exe -m 8192 -smp 4 -fw_cfg name=opt/com.coreos/config,file=C:\qemu-remote\remote.ign -netdev stream,id=vlan,server=off,addr.type=unix,addr.path=C:\qemu-remote\vlan_remote.sock -device virtio-net-pci,netdev=vlan,mac=5a:94:ef:e4:0c:ee -device virtio-serial -chardev socket,path=C:\qemu-remote\ready.sock,server=on,wait=off,id=apodman-machine-default_ready -device virtserialport,chardev=apodman-machine-default_ready,name=org.fedoraproject.port.0 -pidfile C:\qemu-remote\vm.pid -machine q35,accel=whpx:tcg -cpu max,vmx=off,monitor=off -drive if=virtio,file=C:\qemu-remote\fedora-coreos-37.20221127.2.0-qemu.x86_64.qcow2 +``` + +### First time launch extras + +Observe QEMU loading and wait for the message of SSH keys being provisioned to the machine. Next, before making the first ssh connection, one would need to add it to known hosts. +We are using `127.0.0.1` instead of `localhost` to force IPv4. + +``` +ssh-keyscan -p 57561 127.0.0.1 >> %USERPROFILE%\.ssh\known_hosts +``` + +### Add new connection to Podman + +Create a connection named "qemuremote" + +``` +podman system connection add --identity C:\qemu-remote\remote -p 57561 qemuremote ssh://core@127.0.0.1 +``` + +#### Optional + +Make it default for simplicity of operation/testing + +``` +podman system connection default qemuremote +``` + +## Using Podman + +Choose the active connection to be "qemuremote" (not needed if one made it default). + +Run some basic network enabled workload: + +``` +podman run -d --rm -p 8080:80 nginx +``` + +Test it with + +``` +curl http -v http://localhost:8080 +``` + +## Shutting down the machine + +The built-in machinery of Podman machine will not work for a custom machine. One needs to gracefully shut it down by connecting via SSH: + +``` +ssh -i C:\qemu-remote\remote -p 57561 core@127.0.0.1 +``` + +And then executing + +``` +sudo poweroff +``` diff --git a/versioned_docs/version-5.4.1/tutorials/remote_client.md b/versioned_docs/version-5.4.1/tutorials/remote_client.md new file mode 100644 index 000000000..159f2841d --- /dev/null +++ b/versioned_docs/version-5.4.1/tutorials/remote_client.md @@ -0,0 +1,124 @@ +--- +title: Podman remote-client tutorial +version: v5.4.1 +--- + +# Podman remote-client tutorial + +## Introduction +The purpose of the Podman remote-client is to allow users to interact with a Podman "backend" while on a separate client. The command line interface of the remote client is exactly the same as the regular Podman commands with the exception of some flags being removed as they do not apply to the remote-client. + +The remote client takes advantage of a client-server model. You need Podman installed on a Linux machine or VM that also has the SSH daemon running. On the local operating system, when you execute a Podman command, Podman connects to the server via SSH. It then connects to the Podman service by using systemd socket activation, and hitting our [Rest API](https://docs.podman.io/en/latest/_static/api.html). The Podman commands are executed on the server. From the client's point of view, it seems like Podman runs locally. + +This tutorial is for running Podman remotely on Linux. If you are using a Mac or a Windows PC, please follow the [Mac and Windows tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) + +## Obtaining and installing Podman + +### Client machine +You will need either Podman or the podman-remote client. The difference between the two is that the compiled podman-remote client can only act as a remote client connecting to a backend, while Podman can run local, standard Podman commands, as well as act as a remote client (using `podman --remote`) + +If you already have Podman installed, you do not need to install podman-remote. + +You can find out how to [install Podman here](https://podman.io/getting-started/installation) + +If you would like to install only the podman-remote client, it is downloadable from its [release description page](https://github.com/containers/podman/releases/latest). You can also build it from source using the `make podman-remote` + + +### Server Machine +You will need to [install Podman](https://podman.io/getting-started/installation) on your server machine. + + +## Creating the first connection + +### Enable the Podman service on the server machine. + +Before performing any Podman client commands, you must enable the podman.sock SystemD service on the Linux server. In these examples, we are running Podman as a normal, unprivileged user, also known as a rootless user. By default, the rootless socket listens at `/run/user/${UID}/podman/podman.sock`. You can enable this socket permanently using the following command: +``` +systemctl --user enable --now podman.socket +``` +You will need to enable linger for this user in order for the socket to work when the user is not logged in: + +``` +sudo loginctl enable-linger $USER +``` +This is only required if you are not running Podman as root. + +You can verify that the socket is listening with a simple Podman command. + +``` +podman --remote info +host: + arch: amd64 + buildahVersion: 1.16.0-dev + cgroupVersion: v2 + conmon: + package: conmon-2.0.19-1.fc32.x86_64 +``` + +#### Enable sshd + +In order for the Podman client to communicate with the server you need to enable and start the SSH daemon on your Linux machine, if it is not currently enabled. +``` +sudo systemctl enable --now sshd +``` + +#### Setting up SSH +Remote Podman uses SSH to communicate between the client and server. The remote client works considerably smoother using SSH keys. To set up your ssh connection, you need to generate an ssh key pair from your client machine. *NOTE:* in some instances, using a `rsa` key will cause connection issues, be sure to create an `ed25519` key. +``` +ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 +``` +Your public key by default should be in your home directory under `~/.ssh/id_ed25519.pub`. You then need to copy the contents of `id_ed25519.pub` and append it into `~/.ssh/authorized_keys` on the Linux server. You can automate this using `ssh-copy-id`: +``` +ssh-copy-id -i ~/.ssh/id_ed25519.pub 192.168.122.1 +``` + +If you do not wish to use SSH keys, you will be prompted with each Podman command for your login password. + +## Using the client + +Note: `podman-remote` is equivalent to `podman --remote` here, depending on what you have chosen to install. + +The first step in using the Podman remote client is to configure a connection. + +You can add a connection by using the `podman-remote system connection add` command. + +``` +podman-remote system connection add myuser --identity ~/.ssh/id_ed25519 ssh://myuser@192.168.122.1/run/user/1000/podman/podman.sock +``` + +This will add a remote connection to Podman and if it is the first connection added, it will mark the connection as the default. You can observe your connections with `podman-remote system connection list`: + +``` +podman-remote system connection list +Name Identity URI +myuser* id_ed25519 ssh://myuser@192.168.122.1/run/user/1000/podman/podman.sock +``` + +Now we can test the connection with `podman info`: + +``` +podman-remote info +host: + arch: amd64 + buildahVersion: 1.16.0-dev + cgroupVersion: v2 + conmon: + package: conmon-2.0.19-1.fc32.x86_64 +``` + +Podman-remote has also introduced a “--connection” flag where you can use other connections you have defined. If no connection is provided, the default connection will be used. + +``` +podman-remote system connection --help +``` + +## Wrap up + +You can use the Podman remote clients to manage your containers running on a Linux server. The communication between client and server relies heavily on SSH connections and the use of SSH keys are encouraged. Once you have Podman installed on your remote client, you should set up a connection using `podman-remote system connection add` which will then be used by subsequent Podman commands. + +# Troubleshooting + +See the [Troubleshooting](https://github.com/containers/podman/blob/main/troubleshooting.md) document if you run into issues. + +## History +Adapted from the [Mac and Windows tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) diff --git a/versioned_docs/version-5.4.1/tutorials/rootless_tutorial.md b/versioned_docs/version-5.4.1/tutorials/rootless_tutorial.md new file mode 100644 index 000000000..d6b9d676e --- /dev/null +++ b/versioned_docs/version-5.4.1/tutorials/rootless_tutorial.md @@ -0,0 +1,221 @@ +--- +title: Basic Setup and Use of Podman in a Rootless environment. +version: v5.4.1 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +# Basic Setup and Use of Podman in a Rootless environment. + +Prior to allowing users without root privileges to run Podman, the administrator must install or build Podman and complete the following configurations. + +## Administrator Actions + +### Installing Podman + +For installing Podman, see the [installation instructions](https://podman.io/getting-started/installation). + +### Building Podman + +For building Podman, see the [build instructions](https://podman.io/getting-started/installation#building-from-scratch). + +### Networking configuration + +A user-mode networking tool for unprivileged network namespaces must be installed on the machine in order for Podman to run in a rootless environment. + +Podman supports two rootless networking tools: [pasta](https://passt.top/passt/about/#pasta) (provided by [passt](https://passt.top/passt/about/)) and [slirp4netns](https://github.com/rootless-containers/slirp4netns). + +pasta is the default since Podman 5.0, while slirp4netns was the default for previous versions. Passt is a more modern replacement for SLIRP that amongst other things fully supports IPv6 and is more secure architecturally (runs in a separate process, uses modern Linux mechanisms for isolation etc). + +Passt is [available on most Linux distributions](https://passt.top/passt/about/#availability) via their package distribution software such as `yum`, `dnf`, `apt`, `zypper`, etc. under the name `passt`. If the package is not available, you can build and install `passt` from [its upstream](https://passt.top/passt/about/#try-it). + +Alternatively, slirp4netns can be installed in the same fashion either from your distribution's repositories or by following [the instructions](https://github.com/rootless-containers/slirp4netns?tab=readme-ov-file#install) provided on its GitHub. + +The major user-facing difference between the two is outlined in [Shortcomings of Rootless Podman](https://github.com/containers/podman/blob/main/rootless.md?plain=1#L11) and expanded upon in **[podman-network(1)](https://github.com/containers/podman/blob/main/docs/source/markdown/podman-network.1.md#pasta)**. + +> [!note] +> pasta's default situation of not being being able to communicate between the container and the host has been fixed in Podman 5.3: see [Podman 5.3 changes for improved networking experience with pasta](https://blog.podman.io/2024/10/podman-5-3-changes-for-improved-networking-experience-with-pasta/). + +The default rootless networking tool can be selected in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** under the `[network]` section with `default_rootless_network_cmd`, which can be set to `pasta` (default) or `slirp4netns`. + +### `/etc/subuid` and `/etc/subgid` configuration + +Rootless Podman requires the user running it to have a range of UIDs listed in the files `/etc/subuid` and `/etc/subgid`. The `shadow-utils` or `newuid` package provides these files on different distributions and they must be installed on the system. Root privileges are required to add or update entries within these files. The following is a summary from the [How does rootless Podman work?](https://opensource.com/article/19/2/how-does-rootless-podman-work) article by Dan Walsh on [opensource.com](https://opensource.com) + +For each user that will be allowed to create containers, update `/etc/subuid` and `/etc/subgid` for the user with fields that look like the following. Note that the values for each user must be unique. If there is overlap, there is a potential for a user to use another user's namespace and they could corrupt it. + +``` +# cat /etc/subuid +johndoe:100000:65536 +test:165536:65536 +``` + +The format of this file is `USERNAME:UID:RANGE` + +* username as listed in `/etc/passwd` or in the output of [`getpwent`](https://man7.org/linux/man-pages/man3/getpwent.3.html). +* The initial UID allocated for the user. +* The size of the range of UIDs allocated for the user. + +This means the user `johndoe` is allocated UIDs 100000-165535 as well as their standard UID in the `/etc/passwd` file. NOTE: this is not currently supported with network installs; these files must be available locally to the host machine. It is not possible to configure this with LDAP or Active Directory. + +Rather than updating the files directly, the `usermod` program can be used to assign UIDs and GIDs to a user. + +``` +# usermod --add-subuids 100000-165535 --add-subgids 100000-165535 johndoe +grep johndoe /etc/subuid /etc/subgid +/etc/subuid:johndoe:100000:65536 +/etc/subgid:johndoe:100000:65536 +``` + +If you update either `/etc/subuid` or `/etc/subgid`, you need to stop all the running containers owned by the user and kill the pause process that is running on the system for that user. This can be done automatically by running [`podman system migrate`](https://github.com/containers/podman/blob/main/docs/source/markdown/podman-system-migrate.1.md) as that user. + +#### Giving access to additional groups + +Users can fully map additional groups to a container namespace if +those groups subordinated to the user: + +``` +# usermod --add-subgids 2000-2000 johndoe +grep johndoe /etc/subgid +``` + +This means the user `johndoe` can "impersonate" the group `2000` inside the +container. Note that it is usually not a good idea to subordinate active +user ids to other users, because it would allow user impersonation. + +`johndoe` can use `--group-add keep-groups` to preserve the additional +groups, and `--gidmap="+g102000:@2000"` to map the group `2000` in the host +to the group `102000` in the container: + +``` +$ podman run \ + --rm \ + --group-add keep-groups \ + --gidmap="+g102000:@2000" \ + --volume "$PWD:/data:ro" \ + --workdir /data \ + alpine ls -lisa +``` + +### Enable unprivileged `ping` + +(It is very unlikely that you will need to do this on a modern distro). + +Users running in a non-privileged container may not be able to use the `ping` utility from that container. + +If this is required, the administrator must verify that the UID of the user is part of the range in the `/proc/sys/net/ipv4/ping_group_range` file. + +To change its value the administrator can use a call similar to: `sysctl -w "net.ipv4.ping_group_range=0 2000000"`. + +To make the change persist, the administrator will need to add a file with the `.conf` file extension in `/etc/sysctl.d` that contains `net.ipv4.ping_group_range=0 $MAX_GID`, where `$MAX_GID` is the highest assignable GID of the user running the container. + + +## User Actions + +The majority of the work necessary to run Podman in a rootless environment is on the shoulders of the machine’s administrator. + +Once the Administrator has completed the setup on the machine and then the configurations for the user in `/etc/subuid` and `/etc/subgid`, the user can just start using any Podman command that they wish. + +### User Configuration Files + +The Podman configuration files for root reside in `/usr/share/containers` with overrides in `/etc/containers`. In the rootless environment they reside in `${XDG_CONFIG_HOME}/containers` and are owned by each individual user. + +Note: in environments without `XDG` environment variables, Podman internally sets the following defaults: + +- `$XDG_CONFIG_HOME` = `$HOME/.config` +- `$XDG_DATA_HOME` = `$HOME/.local/share` +- `$XDG_RUNTIME_DIR` = + - `/run/user/$UID` on `systemd` environments + - `$TMPDIR/podman-run-$UID` otherwise + +The three main configuration files are [containers.conf](https://github.com/containers/common/blob/main/docs/containers.conf.5.md), [storage.conf](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md) and [registries.conf](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md). The user can modify these files as they wish. + +#### containers.conf +Podman reads + +1. `/usr/share/containers/containers.conf` +2. `/etc/containers/containers.conf` +3. `${XDG_CONFIG_HOME}/containers/containers.conf` + +if they exist, in that order. Each file can override the previous for particular fields. + +#### storage.conf +For `storage.conf` the order is + +1. `/etc/containers/storage.conf` +2. `${XDG_CONFIG_HOME}/containers/storage.conf` + +In rootless Podman, certain fields in `/etc/containers/storage.conf` are ignored. These fields are: +``` +graphroot="" + container storage graph dir (default: "/var/lib/containers/storage") + Default directory to store all writable content created by container storage programs. + +runroot="" + container storage run dir (default: "/run/containers/storage") + Default directory to store all temporary writable content created by container storage programs. +``` +In rootless Podman these fields default to +``` +graphroot="${XDG_DATA_HOME}/containers/storage" +runroot="${XDG_RUNTIME_DIR}/containers" +``` +[\$XDG_RUNTIME_DIR](https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html#variables) defaults on most systems to `/run/user/$UID`. + +#### registries +Registry configuration is read in this order + +1. `/etc/containers/registries.conf` +2. `/etc/containers/registries.d/*` +3. `${XDG_CONFIG_HOME}/containers/registries.conf` + +The files in the home directory should be used to configure rootless Podman for personal needs. These files are not created by default. Users can copy the files from `/usr/share/containers` or `/etc/containers` and modify them. + +#### Authorization files +The default authorization file used by the `podman login` and `podman logout` commands is `${XDG_RUNTIME_DIR}/containers/auth.json`. + +### Using volumes + +Rootless Podman is not, and will never be, root; it's not a `setuid` binary, and gains no privileges when it runs. Instead, Podman makes use of a user namespace to shift the UIDs and GIDs of a block of users it is given access to on the host (via the `newuidmap` and `newgidmap` executables) and your own user within the containers that Podman creates. + +If your container runs with the root user, then `root` in the container is actually your user on the host. UID/GID 1 is the first UID/GID specified in your user's mapping in `/etc/subuid` and `/etc/subgid`, etc. If you mount a directory from the host into a container as a rootless user, and create a file in that directory as root in the container, you'll see it's actually owned by your user on the host. + +So, for example, + +``` +host$ whoami +john + +# a folder which is empty +host$ ls /home/john/folder +host$ podman run -it -v /home/john/folder:/container/volume mycontainer /bin/bash + +# Now I'm in the container +root@container# whoami +root +root@container# touch /container/volume/test +root@container# ls -l /container/volume +total 0 +-rw-r--r-- 1 root root 0 May 20 21:47 test +root@container# exit + +# I check again +host$ ls -l /home/john/folder +total 0 +-rw-r--r-- 1 john john 0 May 20 21:47 test +``` + +We do recognize that this doesn't really match how many people intend to use rootless Podman - they want their UID inside and outside the container to match. Thus, we provide the `--userns=keep-id` flag, which ensures that your user is mapped to its own UID and GID inside the container. + +It is also helpful to distinguish between running Podman as a rootless user, and a container which is built to run rootless. If the container you're trying to run has a `USER` which is not root, then when mounting volumes you **must** use `--userns=keep-id`. This is because the container user would not be able to become `root` and access the mounted volumes. + +Another consideration in regards to volumes: + +- When providing the path of a directory you'd like to bind-mount, the path needs to be provided as an absolute path + or a relative path that starts with `.` (a dot), otherwise the string will be interpreted as the name of a named volume. + +## More information + +If you are still experiencing problems running Podman in a rootless environment, please refer to the [Shortcomings of Rootless Podman](https://github.com/containers/podman/blob/main/rootless.md) page which lists known issues and solutions to known issues in this environment. + +For more information on Podman and its subcommands, follow the links on the main [README.md](https://github.com/containers/podman/blob/main/README.md#podman-information-for-developers) page or the [podman.io](https://podman.io) web site. diff --git a/versioned_docs/version-5.4.1/tutorials/socket_activation.md b/versioned_docs/version-5.4.1/tutorials/socket_activation.md new file mode 100644 index 000000000..797952782 --- /dev/null +++ b/versioned_docs/version-5.4.1/tutorials/socket_activation.md @@ -0,0 +1,289 @@ +--- +title: Podman socket activation +version: v5.4.1 +--- + +# Podman socket activation + +Socket activation conceptually works by having systemd create a socket (e.g. TCP, UDP or Unix +socket). As soon as a client connects to the socket, systemd will start the systemd service that is +configured for the socket. The newly started program inherits the file descriptor of the socket +and can then accept the incoming connection (in other words run the system call `accept()`). +This description corresponds to the default systemd socket configuration +[`Accept=no`](https://www.freedesktop.org/software/systemd/man/systemd.socket.html#Accept=) +that lets the service accept the socket. + +Podman supports two forms of socket activation: + +* Socket activation of the API service +* Socket activation of containers + +## Socket activation of the API service + +The architecture looks like this + +``` mermaid +stateDiagram-v2 + [*] --> systemd: first client connects + systemd --> podman: socket inherited via fork/exec +``` + +The file _/usr/lib/systemd/user/podman.socket_ on a Fedora system defines the Podman API socket for +rootless users: + +``` +$ cat /usr/lib/systemd/user/podman.socket +[Unit] +Description=Podman API Socket +Documentation=man:podman-system-service(1) + +[Socket] +ListenStream=%t/podman/podman.sock +SocketMode=0660 + +[Install] +WantedBy=sockets.target +``` + +The socket is configured to be a Unix socket and can be started like this + +``` +$ systemctl --user start podman.socket +$ ls $XDG_RUNTIME_DIR/podman/podman.sock +/run/user/1000/podman/podman.sock +$ +``` +The socket can later be used by for instance __docker-compose__ that needs a Docker-compatible API + +``` +$ export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock +$ docker-compose up +``` + +When __docker-compose__ or any other client connects to the UNIX socket `$XDG_RUNTIME_DIR/podman/podman.sock`, +the service _podman.service_ is started. See its definition in the file _/usr/lib/systemd/user/podman.service_. + +## Socket activation of containers + +Since version 3.4.0 Podman supports socket activation of containers, i.e., passing +a socket-activated socket to the container. Thanks to the fork/exec model of Podman, the socket will be first +inherited by conmon and then by the OCI runtime and finally by the container +as can be seen in the following diagram: + + +``` mermaid +stateDiagram-v2 + [*] --> systemd: first client connects + systemd --> podman: socket inherited via fork/exec + state "OCI runtime" as s2 + podman --> conmon: socket inherited via double fork/exec + conmon --> s2: socket inherited via fork/exec + s2 --> container: socket inherited via exec +``` + +This type of socket activation can be used in systemd services that are generated from container unit files (see [podman-systemd.unit(5)](https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html)) (Note, quadlet requires the use of cgroup v2) or from the command [`podman generate systemd`](https://docs.podman.io/en/latest/markdown/podman-generate-systemd.1.html). +The container must also support socket activation. Not all software daemons support socket activation +but it's getting more popular. For instance Apache HTTP server, MariaDB, DBUS, PipeWire, Gunicorn, CUPS +all have socket activation support. + +### Example: socket-activated echo server container in a systemd service + +This example shows how to run the socket-activated echo server +[socket-activate-echo](https://github.com/eriksjolund/socket-activate-echo/pkgs/container/socket-activate-echo) +in a systemd user service. Podman version 4.4.0 or higher is required. + +Enable lingering for your regular user + +``` +$ loginctl enable-linger $USER +``` + +The command has these effects on your enabled systemd user units: + +* the units are automatically started after a reboot +* the units are not automatically stopped after you log out + +Create directories + +``` +$ mkdir -p ~/.config/systemd/user +$ mkdir -p ~/.config/containers/systemd +``` + +Create the file _~/.config/containers/systemd/echo.container_ with the file contents: + +``` +[Unit] +Description=Example echo service +Requires=echo.socket +After=echo.socket + +[Container] +Image=ghcr.io/eriksjolund/socket-activate-echo +Network=none + +[Install] +WantedBy=default.target +``` + +The file follows the syntax described in [__podman-systemd.unit__(5)](https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html). + +The `[Install]` section is optional. If you remove the two last lines, the _echo.service_ will not +be automatically started after a reboot. Instead, the _echo.service_ is started when the first +client connects to the socket. + +The line `Network=none` is optional. It improves security by removing network connectivity for the container. +The container can still be serving the internet because `Network=none` has no effect on activated sockets. + +A socket-activated service also requires a systemd socket unit. +Create the file _~/.config/systemd/user/echo.socket_ that defines the +sockets that the container should use + +``` +[Unit] +Description=Example echo socket + +[Socket] +ListenStream=127.0.0.1:3000 +ListenDatagram=127.0.0.1:3000 +ListenStream=[::1]:3000 +ListenDatagram=[::1]:3000 +ListenStream=%h/echo_stream_sock + +# VMADDR_CID_ANY (-1U) = 2^32 -1 = 4294967295 +# See "man vsock" +ListenStream=vsock:4294967295:3000 + +[Install] +WantedBy=sockets.target +``` + +`%h` is a systemd specifier that expands to the user's home directory. + +After editing the unit files, systemd needs to reload its configuration. + +``` +$ systemctl --user daemon-reload +``` + +While reloading its configuration systemd generates the unit _echo.service_ +from the file _~/.config/containers/systemd/echo.container_ +by executing the unit generator `/usr/lib/systemd/system-generators/podman-system-generator`. + +Optional: View the generated _echo.service_ to see the `podman run` command that +will be run. + +``` +$ systemctl --user cat echo.service +``` + +Configure systemd to automatically start _echo.socket_ after reboots. + +``` +$ systemctl --user enable echo.socket +``` + +Pull the container image beforehand + +``` +$ podman pull ghcr.io/eriksjolund/socket-activate-echo +``` + +Start the socket unit + +``` +$ systemctl --user start echo.socket +``` + +Test the echo server with the program __socat__ + +``` +$ echo hello | socat -t 30 - tcp4:127.0.0.1:3000 +hello +$ echo hello | socat -t 30 - tcp6:[::1]:3000 +hello +$ echo hello | socat -t 30 - udp4:127.0.0.1:3000 +hello +$ echo hello | socat -t 30 - udp6:[::1]:3000 +hello +$ echo hello | socat -t 30 - unix:$HOME/echo_stream_sock +hello +$ echo hello | socat -t 30 - VSOCK-CONNECT:1:3000 +hello +``` + +The option `-t 30` configures socat to use a timeout of 30 seconds when socat reads from the socket awaiting to get an EOF (End-Of-File). +As the container image has already been pulled, such a long timeout is not really needed. + +The echo server works as expected. It replies _"hello"_ after receiving the text _"hello"_. + +### Example: socket activate an Apache HTTP server with systemd-socket-activate + +Instead of setting up a systemd service to test out socket activation, an alternative is to use the command-line +tool [__systemd-socket-activate__](https://www.freedesktop.org/software/systemd/man/systemd-socket-activate.html#). + +Let's build a container image for the Apache HTTP server that is configured to support socket activation on port 8080. + +Create a new directory _ctr_ and a file _ctr/Containerfile_ with this contents + +``` +FROM docker.io/library/fedora +RUN dnf -y update && dnf install -y httpd && dnf clean all +RUN sed -i "s/Listen 80/Listen 127.0.0.1:8080/g" /etc/httpd/conf/httpd.conf +CMD ["/usr/sbin/httpd", "-DFOREGROUND"] +``` + +Build the container image + +``` +$ podman build -t socket-activate-httpd ctr +``` + +In one shell, start __systemd-socket-activate__. + +``` +$ systemd-socket-activate -l 8080 podman run --rm --network=none localhost/socket-activate-httpd +``` + +The TCP port number 8080 is given as an option to __systemd-socket-activate__. The __--publish__ (__-p__) +option for `podman run` is not used. + +In another shell, fetch a web page from _localhost:8080_ + +``` +$ curl -s localhost:8080 | head -6 + + + + + +Test Page for the HTTP Server on Fedora +$ +``` + +### Disabling the network with _--network=none_ + +If the container only needs to communicate over the socket-activated socket, it's possible to disable +the network by passing __--network=none__ to `podman run`. This improves security because the +container then runs with less privileges. + +### Native network performance over the socket-activated socket + +When using rootless Podman, network traffic is normally passed through slirp4netns. This comes with +a performance penalty. Fortunately, communication over the socket-activated socket does not pass through +slirp4netns so it has the same performance characteristics as the normal network on the host. + +### Starting a socket-activated service + +There is a delay when the first connection is made because the container needs to +start up. To minimize this delay, consider passing __--pull=never__ to `podman run` and instead +pull the container image beforehand. Instead of waiting for the start of the service to be triggered by the +first client connecting to it, the service can also be explicitly started (`systemctl --user start echo.service`). + +### Stopping a socket-activated service + +Some services run a command (configured by the systemd directive __ExecStart__) that exits after some time of inactivity. +Depending on the restart configuration for the service +(systemd directive [__Restart__](https://www.freedesktop.org/software/systemd/man/systemd.service.html#Restart=)), +it may then be stopped. An example of this is _podman.service_ that stops after some time of inactivity. +The service will be started again when the next client connects to the socket. diff --git a/versioned_docs/version-5.4.2/MANPAGE_SYNTAX.md b/versioned_docs/version-5.4.2/MANPAGE_SYNTAX.md new file mode 100644 index 000000000..c6d846306 --- /dev/null +++ b/versioned_docs/version-5.4.2/MANPAGE_SYNTAX.md @@ -0,0 +1,147 @@ +--- +title: podman-command +version: v5.4.2 +--- + +% podman-command(1) + +## NAME +podman\-command - short description + +## SYNOPSIS +(Shows the command structure. If the command can be written in two different ways, both of them have to be shown.\ +Many manpages include the OPTIONS **--all**, **-a** and/or **--latest**, **-l**. In this case, there is no `container name` or `ID` needed after the initial command. Because most of the other OPTIONS still need the `container name` or ` ID`, it is defined that the *container* argument in the command should **not** be put in brackets. It should also be noted in the *IMPORTANT* section in the description of the OPTION with the following sentence: *IMPORTANT: This OPTION does not need a container name or ID as input argument.*.) + +**podman command** [*optional*] *mandatory value* + +**podman subcommand command** [*optional*] *mandatory value* + +(If there is the possibility to chose between two or more mandatory command values. There should also always be a space before and after a vertical bar to ensure better readability.) + +**podman command** [*optional*] *value1* | *value2* + +**podman subcommand command** [*optional*] *value1* | *value2* + +(If an optional value follows a mandatory one.) + +**podman command** [*optional*] *value1* | *value2* [*optional*] + +**podman subcommand command** [*optional*] *value1* | *value2* [*optional*] + +(If the command accepts an infinite number of values.) + +**podman command** [*optional*] *value* [*value* ...] + +**podman subcommand command** [*optional*] *value* [*value* ...] + +## DESCRIPTION +**podman command** is always the beginning of the DESCRIPTION section. Putting the command as the first part of the DESCRIPTION ensures uniformity. All commands mentioned in the text retain their appearance and form.\ +Example for the first sentence: **podman command** is an example command. + +Commands or files that are quoted from other podman manpages or podman repositories have to be linked to those. Non-podman commands are not to be linked.\ +Example sentence: Use **[podman-run](podman-run.1.md)** or **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** for the problem. + +It should also be specified if the command can only be run as root. In addition, it should be described when a command, OPTION, or other content cannot be executed with the remote client or in combination with other commands, OPTIONS, or content. In this case, the following sentence is put at the end of a command, OPTION, or content:\ +*IMPORTANT: This command/OPTION/content is not available with the command/OPTION/content/on the remote Podman client.*\ +For a command, this should be done in the DESCRIPTION section. For the OPTIONS, it should be done in the DESCRIPTION of the specified OPTION. + +Do not use pronouns in the man pages, especially the word `you`. + +There should be **no** new line after H2-headers (`##`). + +## OPTIONS +All flags are referred to as OPTIONS. The term flags should not be used. All OPTIONS are listed in this section. OPTIONS that appear in descriptions of other OPTIONS and sections retain their appearance, for example: **--exit**. + +OPTIONS that are quoted from other podman manpages or podman repositories have to be linked to those.\ +Example sentence: Use **[podman-generate-systemd --new](./source/markdown/podman-generate-systemd.1.md#--new)** for the problem. + + Each OPTION should be explained to the fullest extent below the OPTION itself. Each OPTION is behind an H4-header (`####`). If the OPTION has a default argument, it has to be explained in the description of the OPTION. If the OPTION is also not available with a command/OPTION/content/ on the remote Podman client, the sentence about the default argument should the second to last sentence. The sentence about the default argument should be in a new line as well as the *IMPORTANT* sentence. + + All OPTIONS are to be sorted in alphabetical order. + + Tables should be used when there is a different definition for multiple arguments, and these have to be explained. This is shown with the OPTION **--test**.\ + Lists should be used when arguments are used that do not need a definition for each argument and a single description explains them. An example is shown with **[podman-commit --change](./source/markdown/podman-commit.1.md#--change--cinstruction)** + + +#### **--version**, **-v** + +OPTIONS can be put after the command in two different ways. Either the long version with **--option** or as the short version **-o**. If there are two ways to write an OPTION they are separated by a comma. If there are two versions of one command the long version is always shown in front. If OPTION is boolean, *true/false* are not enumerated. The default boolean argument is shown in the same way normal default arguments are displayed.\ +Example: The default is **false**.\ +*IMPORTANT: This OPTION is not available with the remote Podman client.* + +#### **--exit** + +An example of a boolean OPTION that is only available in long form. + +#### **--answer**, **-a**=**active** | *disable* + +The **--answer** OPTION above is an example of an OPTION that accepts two possible arguments as inputs. If a default argument is selected when the OPTION is not used in the command, it is shown in **bold**. If the OPTION is used, it must include an argument afterward. It must always be ensured that the standard argument is in the first position after the OPTION. In this example, there are two different ways to execute the command. Both possible OPTIONS have to be shown with the arguments following them.\ +The default value is shown as **active**. + +#### **--status**=**good** | *better* | *best* + +This is an example of three arguments following an OPTION. If the number of arguments is greater than three, the arguments are **not** listed after the equal sign. The arguments must be shown in a table like in **--test**=**_test_**. This form should also be used if the understanding of the content is in danger of becoming incomprehensible. An example for this is **[podman-container-prune --filters](./source/markdown/podman-container-prune.1.md#--filterfilters)**.\ +The default value is shown as **good**. + +#### **--test**=**test** + +OPTIONS that are followed by an equal sign include an argument after the equal sign in **bold** or *italic*. If there is a default argument that is used if the OPTION is not specified in the command, the argument after the equal sign is displayed in **bold**. All arguments must be listed and explained in the text below the OPTION. + +| Argument | Description | +| ------------------ | --------------------------------------------------------------------------- | +| **example one** | This argument is the default argument if the OPTION is not specified. | +| *example two* | If one refers to a command, one should use **bold** marks. | +| *example three* | Example: In combination with **podman command** highly effective. | +| *example four* | Example: Can be combined with **--exit**. | +| *example five* | The fifth description | + +The table shows an example for a listing of arguments. The contents in the table should be aligned left. If the content in the table conflicts with this, it can be aligned to support the understanding of the content. If there is a default argument, it **must** be listed as the first entry in the table.\ +The default value is shown as **example one**. + +If the number of arguments is smaller than four they have to be listed behind the OPTION as seen in the OPTION **--status**. + +#### **--problem**=*problem* + +OPTIONS that are followed by an equal sign that is then followed by an unspecified argument, have no default argument. If this OPTION is written with an equal sign and the argument is left empty, there will be no error, but the OPTION will be ignored. The meaning of the argument is described preferably in `one` word after the equal sign in *italic* format. + +## SUBCHAPTER +For chapters that are made specifically as an individual SUBCHAPTER in a man page, the previous conditions regarding formatting apply. + +There are no restrictions for the use of paragraphs and tables. Within these paragraphs and tables the previous conditions regarding formatting apply. + +Strings of characters or numbers can be highlighted with `backticks`. Paths of any kind **must** be highlighted. + +IMPORTANT: Only characters that are **not** part of categories mentioned before can be highlighted. This includes headers. For example it is not advised to highlight an OPTION or a **command**. + +SUBHEADINGS are displayed as follows: +### SUBHEADING +Text for SUBHEADINGS. + +## EXAMPLES +All EXAMPLES are listed in this section. This section should be at the end of each man page. Each EXAMPLE is always in one box. The box starts and ends with the last written line, **not** with a blank line. The `$` in front of the commands indicates that it can be run as a normal user, while the commands starting with `#` can only be run as root. If there is the need for a comment in a box the comment should have `###` in front of it. + +Description of the EXAMPLE +``` +### Example comment +$ podman command +$ podman command -o +$ cat $HOME/Dockerfile | podman command --option +``` + +Description of the EXAMPLE two +``` +# podman command --status=better +``` +## SEE ALSO +All commands, including commands with OPTIONS, and config-files mentioned in the manpage have to be listed here. Podman commands, including commands with OPTIONS, and config-files have to be linked. If a command is mentioned several times with different OPTIONS it just have to be linked once. All other commands, including commands with OPTIONS, and config-files just have to be mentioned. If a command is mentioned several times with different OPTIONS it just has to be linked once. + +Example: +**[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-create(1)](podman-create.1.md)** + +## HISTORY +Normally, the dates of changes, the content of the changes and the person who provided them is listed here. Most manpages don't keep this record. + +Example:\ +December 2021, Originally compiled by Alexander Richter + +`Every manpage should end with an empty line.` diff --git a/versioned_docs/version-5.4.2/index.md b/versioned_docs/version-5.4.2/index.md new file mode 100644 index 000000000..3b3e44a11 --- /dev/null +++ b/versioned_docs/version-5.4.2/index.md @@ -0,0 +1,42 @@ +--- +title: Podman Documentation +version: v5.4.2 +--- + +# Podman Documentation (v5.4.2) + +Welcome to the Podman documentation for version v5.4.2. + +## Getting Started + +- [Installation Instructions](https://podman.io/get-started) +- [Basic Tutorial](tutorials/podman_tutorial.md) +- [Rootless Containers](tutorials/rootless_tutorial.md) + +## Commands + +- [podman](source/markdown/podman.1.md) +- [podman-build](source/markdown/podman-build.1.md) +- [podman-run](source/markdown/podman-run.1.md) +- [podman-ps](source/markdown/podman-ps.1.md) + +## Tutorials + +- [Basic Networking](tutorials/basic_networking.md) +- [Rootless Tutorial](tutorials/rootless_tutorial.md) +- [Podman Tutorial](tutorials/podman_tutorial.md) +- [Performance](tutorials/performance.md) + +## System & Management + +- [System Commands](source/markdown/podman-system.1.md) +- [Machine Commands](source/markdown/podman-machine.1.md) +- [Pod Management](source/markdown/podman-pod.1.md) +- [Volume Management](source/markdown/podman-volume.1.md) + +## Advanced Features + +- [Systemd Integration](source/markdown/podman-systemd.unit.5.md) +- [Kubernetes Support](source/markdown/podman-kube.1.md) +- [Secret Management](source/markdown/podman-secret.1.md) +- [Code Generation](source/markdown/podman-generate.1.md) diff --git a/versioned_docs/version-5.4.2/kubernetes_support.md b/versioned_docs/version-5.4.2/kubernetes_support.md new file mode 100644 index 000000000..a673358de --- /dev/null +++ b/versioned_docs/version-5.4.2/kubernetes_support.md @@ -0,0 +1,208 @@ +--- +title: Podman Kube Play Support +version: v5.4.2 +--- + +# Podman Kube Play Support + +This document outlines the kube yaml fields that are currently supported by the **podman kube play** command. + +Note: **N/A** means that the option cannot be supported in a single-node Podman environment. + +## Pod Fields + +| Field | Support | +|-----------------------------------------------------|---------| +| containers | ✅ | +| initContainers | ✅ | +| imagePullSecrets | no | +| enableServiceLinks | no | +| os\.name | no | +| volumes | ✅ | +| nodeSelector | N/A | +| nodeName | N/A | +| affinity\.nodeAffinity | N/A | +| affinity\.podAffinity | N/A | +| affinity\.podAntiAffinity | N/A | +| tolerations\.key | N/A | +| tolerations\.operator | N/A | +| tolerations\.effect | N/A | +| tolerations\.tolerationSeconds | N/A | +| schedulerName | N/A | +| runtimeClassName | no | +| priorityClassName | no | +| priority | no | +| topologySpreadConstraints\.maxSkew | N/A | +| topologySpreadConstraints\.topologyKey | N/A | +| topologySpreadConstraints\.whenUnsatisfiable | N/A | +| topologySpreadConstraints\.labelSelector | N/A | +| topologySpreadConstraints\.minDomains | N/A | +| restartPolicy | ✅ | +| terminationGracePeriodSeconds | ✅ | +| activeDeadlineSeconds | no | +| readinessGates\.conditionType | no | +| hostname | ✅ | +| setHostnameAsFQDN | no | +| subdomain | no | +| hostAliases\.hostnames | ✅ | +| hostAliases\.ip | ✅ | +| dnsConfig\.nameservers | ✅ | +| dnsConfig\.options\.name | ✅ | +| dnsConfig\.options\.value | ✅ | +| dnsConfig\.searches | ✅ | +| dnsPolicy | no | +| hostNetwork | ✅ | +| hostPID | ✅ | +| hostIPC | ✅ | +| shareProcessNamespace | ✅ | +| serviceAccountName | no | +| automountServiceAccountToken | no | +| securityContext\.runAsUser | ✅ | +| securityContext\.runAsNonRoot | no | +| securityContext\.runAsGroup | ✅ | +| securityContext\.supplementalGroups | ✅ | +| securityContext\.fsGroup | no | +| securityContext\.fsGroupChangePolicy | no | +| securityContext\.seccompProfile\.type | no | +| securityContext\.seccompProfile\.localhostProfile | no | +| securityContext\.seLinuxOptions\.level | ✅ | +| securityContext\.seLinuxOptions\.role | ✅ | +| securityContext\.seLinuxOptions\.type | ✅ | +| securityContext\.seLinuxOptions\.user | ✅ | +| securityContext\.sysctls\.name | ✅ | +| securityContext\.sysctls\.value | ✅ | +| securityContext\.windowsOptions\.gmsaCredentialSpec | no | +| securityContext\.windowsOptions\.hostProcess | no | +| securityContext\.windowsOptions\.runAsUserName | no | + +## Container Fields + +| Field | Support | +|-----------------------------------------------------|---------| +| name | ✅ | +| image | ✅ | +| imagePullPolicy | ✅ | +| command | ✅ | +| args | ✅ | +| workingDir | ✅ | +| ports\.containerPort | ✅ | +| ports\.hostIP | ✅ | +| ports\.hostPort | ✅ | +| ports\.name | ✅ | +| ports\.protocol | ✅ | +| env\.name | ✅ | +| env\.value | ✅ | +| env\.valueFrom\.configMapKeyRef\.key | ✅ | +| env\.valueFrom\.configMapKeyRef\.name | ✅ | +| env\.valueFrom\.configMapKeyRef\.optional | ✅ | +| env\.valueFrom\.fieldRef | ✅ | +| env\.valueFrom\.resourceFieldRef | ✅ | +| env\.valueFrom\.secretKeyRef\.key | ✅ | +| env\.valueFrom\.secretKeyRef\.name | ✅ | +| env\.valueFrom\.secretKeyRef\.optional | ✅ | +| envFrom\.configMapRef\.name | ✅ | +| envFrom\.configMapRef\.optional | ✅ | +| envFrom\.prefix | no | +| envFrom\.secretRef\.name | ✅ | +| envFrom\.secretRef\.optional | ✅ | +| volumeMounts\.mountPath | ✅ | +| volumeMounts\.name | ✅ | +| volumeMounts\.mountPropagation | no | +| volumeMounts\.readOnly | ✅ | +| volumeMounts\.subPath | ✅ | +| volumeMounts\.subPathExpr | no | +| volumeDevices\.devicePath | no | +| volumeDevices\.name | no | +| resources\.limits | ✅ | +| resources\.requests | ✅ | +| lifecycle\.postStart | no | +| lifecycle\.preStop | no | +| terminationMessagePath | no | +| terminationMessagePolicy | no | +| livenessProbe | ✅ | +| readinessProbe | no | +| startupProbe | no | +| securityContext\.runAsUser | ✅ | +| securityContext\.runAsNonRoot | no | +| securityContext\.runAsGroup | ✅ | +| securityContext\.readOnlyRootFilesystem | ✅ | +| securityContext\.procMount | ✅ | +| securityContext\.privileged | ✅ | +| securityContext\.allowPrivilegeEscalation | ✅ | +| securityContext\.capabilities\.add | ✅ | +| securityContext\.capabilities\.drop | ✅ | +| securityContext\.seccompProfile\.type | no | +| securityContext\.seccompProfile\.localhostProfile | no | +| securityContext\.seLinuxOptions\.level | ✅ | +| securityContext\.seLinuxOptions\.role | ✅ | +| securityContext\.seLinuxOptions\.type | ✅ | +| securityContext\.seLinuxOptions\.user | ✅ | +| securityContext\.windowsOptions\.gmsaCredentialSpec | no | +| securityContext\.windowsOptions\.hostProcess | no | +| securityContext\.windowsOptions\.runAsUserName | no | +| stdin | no | +| stdinOnce | no | +| tty | no | + +## PersistentVolumeClaim Fields + +| Field | Support | +|---------------------|---------| +| volumeName | no | +| storageClassName | ✅ | +| volumeMode | no | +| accessModes | ✅ | +| selector | no | +| resources\.limits | no | +| resources\.requests | ✅ | + +## ConfigMap Fields + +| Field | Support | +|------------|---------| +| binaryData | ✅ | +| data | ✅ | +| immutable | no | + +## Deployment Fields + +| Field | Support | +|-----------------------------------------|-------------------------------------------------------| +| replicas | ✅ (the actual replica count is ignored and set to 1) | +| selector | ✅ | +| template | ✅ | +| minReadySeconds | no | +| strategy\.type | no | +| strategy\.rollingUpdate\.maxSurge | no | +| strategy\.rollingUpdate\.maxUnavailable | no | +| revisionHistoryLimit | no | +| progressDeadlineSeconds | no | +| paused | no | + +## DaemonSet Fields + +| Field | Support | +|-----------------------------------------|---------| +| selector | ✅ | +| template | ✅ | +| minReadySeconds | no | +| strategy\.type | no | +| strategy\.rollingUpdate\.maxSurge | no | +| strategy\.rollingUpdate\.maxUnavailable | no | +| revisionHistoryLimit | no | + +## Job Fields + +| Field | Support | +|-------------------------|----------------------------------| +| activeDeadlineSeconds | no | +| selector | no (automatically set by k8s) | +| template | ✅ | +| backoffLimit | no | +| completionMode | no | +| completions | no (set to 1 with kube generate) | +| manualSelector | no | +| parallelism | no (set to 1 with kube generate) | +| podFailurePolicy | no | +| suspend | no | +| ttlSecondsAfterFinished | no | diff --git a/versioned_docs/version-5.4.2/source/markdown/options/README.md b/versioned_docs/version-5.4.2/source/markdown/options/README.md new file mode 100644 index 000000000..012a5812a --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/README.md @@ -0,0 +1,68 @@ +--- +title: Documentation +version: v5.4.2 +--- + +Common Man Page Options +======================= + +This subdirectory contains option (flag) names and descriptions +common to multiple podman man pages. Each file is one option. The +filename does not necessarily need to be identical to the option +name: for instance, `hostname.container.md` and `hostname.pod.md` +exist because the **--hostname** option is sufficiently different +between `podman-{create,run}` and `podman-pod-{create,run}` to +warrant living separately. + +How +=== + +The files here are included in `podman-*.md.in` files using the `@@option` +mechanism: + +``` +@@option foo ! includes options/foo.md +``` + +The tool that does this is `hack/markdown-preprocess`. It is a python +script because it needs to run on `readthedocs.io`. From a given `.md.in` +file, this script creates a `.md` file that can then be read by +`go-md2man`, `sphinx`, anything that groks markdown. This runs as +part of `make docs`. + +Special Substitutions +===================== + +Some options are almost identical except for 'pod' vs 'container' +differences. For those, use `<>`. +Order is immaterial: the important thing is the presence of the +string "`pod`" in one half but not the other. The correct string +is chosen based on the filename: if the file contains `-pod`, +such as `podman-pod-create`, the string with `pod` (case-insensitive) +in it is chosen. + +The string `<>` is replaced with the podman subcommand +as determined from the filename, e.g., `create` for `podman-create.1.md.in`. +This allows the shared use of examples in the option file: +``` + Example: podman <> --foo --bar +``` +As a special case, `podman-pod-X` becomes just `X` (the "pod" is removed). +This makes the `pod-id-file` man page more useful. To get the full +subcommand including 'pod', use `<>`. + +Restrictions +============ + +There is a restriction for having a single text line with three +back-ticks in the front and the end of the line. For instance: + +\`\`\`Some man page text\`\`\` + +This is currently not allowed and causes a corruption of the +compiled man page. Instead, put the three back-ticks on separate +lines like: + +\`\`\` +Some man page text +\`\`\` diff --git a/versioned_docs/version-5.4.2/source/markdown/options/add-host.md b/versioned_docs/version-5.4.2/source/markdown/options/add-host.md new file mode 100644 index 000000000..dac9405cd --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/add-host.md @@ -0,0 +1,44 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, create, farm build, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the <>'s `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/annotation.container.md b/versioned_docs/version-5.4.2/source/markdown/options/annotation.container.md new file mode 100644 index 000000000..4c824f827 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/annotation.container.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, kube play, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--annotation**=*key=value* + +Add an annotation to the container<<| or pod>>. This option can be set multiple times. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/annotation.image.md b/versioned_docs/version-5.4.2/source/markdown/options/annotation.image.md new file mode 100644 index 000000000..1fef249bf --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/annotation.image.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--annotation**=*annotation=value* + +Add an image *annotation* (e.g. annotation=*value*) to the image metadata. Can +be used multiple times. + +Note: this information is not present in Docker image formats, so it is +discarded when writing images in Docker formats. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/annotation.manifest.md b/versioned_docs/version-5.4.2/source/markdown/options/annotation.manifest.md new file mode 100644 index 000000000..61ddd800b --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/annotation.manifest.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman artifact add, manifest add, manifest annotate +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--annotation**=*annotation=value* + +Set an annotation on the entry for the specified image or artifact. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/arch.md b/versioned_docs/version-5.4.2/source/markdown/options/arch.md new file mode 100644 index 000000000..7c7dbeb14 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/arch.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--arch**=*ARCH* +Override the architecture, defaults to hosts, of the image to be pulled. For example, `arm`. +Unless overridden, subsequent lookups of the same image in the local storage matches this architecture, regardless of the host. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/attach.md b/versioned_docs/version-5.4.2/source/markdown/options/attach.md new file mode 100644 index 000000000..737383973 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/attach.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--attach**, **-a**=*stdin* | *stdout* | *stderr* + +Attach to STDIN, STDOUT or STDERR. + +In foreground mode (the default when **-d** +is not specified), **podman run** can start the process in the container +and attach the console to the process's standard input, output, and +error. It can even pretend to be a TTY (this is what most command-line +executables expect) and pass along signals. The **-a** option can be set for +each of **stdin**, **stdout**, and **stderr**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/authfile.md b/versioned_docs/version-5.4.2/source/markdown/options/authfile.md new file mode 100644 index 000000000..288a04886 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/authfile.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, auto update, build, container runlabel, create, farm build, image sign, kube play, login, logout, manifest add, manifest inspect, manifest push, pull, push, run, search +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/blkio-weight-device.md b/versioned_docs/version-5.4.2/source/markdown/options/blkio-weight-device.md new file mode 100644 index 000000000..99941a589 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/blkio-weight-device.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman container clone, create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/blkio-weight.md b/versioned_docs/version-5.4.2/source/markdown/options/blkio-weight.md new file mode 100644 index 000000000..cbc35f6ff --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/blkio-weight.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman container clone, create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/build-arg-file.md b/versioned_docs/version-5.4.2/source/markdown/options/build-arg-file.md new file mode 100644 index 000000000..731348b00 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/build-arg-file.md @@ -0,0 +1,27 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--build-arg-file**=*path* + +Specifies a file containing lines of build arguments of the form `arg=value`. +The suggested file name is `argfile.conf`. + +Comment lines beginning with `#` are ignored, along with blank lines. +All others must be of the `arg=value` format passed to `--build-arg`. + +If several arguments are provided via the `--build-arg-file` +and `--build-arg` options, the build arguments are merged across all +of the provided files and command line arguments. + +Any file provided in a `--build-arg-file` option is read before +the arguments supplied via the `--build-arg` option. + +When a given argument name is specified several times, the last instance +is the one that is passed to the resulting builds. This means `--build-arg` +values always override those in a `--build-arg-file`. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/build-arg.md b/versioned_docs/version-5.4.2/source/markdown/options/build-arg.md new file mode 100644 index 000000000..1e2cb05f9 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/build-arg.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--build-arg**=*arg=value* + +Specifies a build argument and its value, which is interpolated in +instructions read from the Containerfiles in the same way that environment variables are, but which are not added to environment variable list in the resulting image's configuration. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/build-context.md b/versioned_docs/version-5.4.2/source/markdown/options/build-context.md new file mode 100644 index 000000000..052c0c0c3 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/build-context.md @@ -0,0 +1,35 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--build-context**=*name=value* + +Specify an additional build context using its short name and its location. +Additional build contexts can be referenced in the same manner as we access +different stages in COPY instruction. + +Valid values are: + +* Local directory – e.g. --build-context project2=../path/to/project2/src (This option is not available with the remote Podman client. On Podman machine setup (i.e macOS and Windows) path must exists on the machine VM) +* HTTP URL to a tarball – e.g. --build-context src=https://example.org/releases/src.tar +* Container image – specified with a container-image:// prefix, e.g. --build-context alpine=container-image://alpine:3.15, (also accepts docker://, docker-image://) + +On the Containerfile side, reference the build context on all +commands that accept the “from” parameter. Here’s how that might look: + +```dockerfile +FROM [name] +COPY --from=[name] ... +RUN --mount=from=[name] … +``` + +The value of [name] is matched with the following priority order: + +* Named build context defined with --build-context [name]=.. +* Stage defined with AS [name] inside Containerfile +* Image [name], either local or in a remote registry diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cache-from.md b/versioned_docs/version-5.4.2/source/markdown/options/cache-from.md new file mode 100644 index 000000000..8e5e2300c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cache-from.md @@ -0,0 +1,26 @@ +--- +title: populate a cache and also consult it +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cache-from**=*image* + +Repository to utilize as a potential cache source. When specified, Buildah tries to look for +cache images in the specified repository and attempts to pull cache images instead of actually +executing the build steps locally. Buildah only attempts to pull previously cached images if they +are considered as valid cache hits. + +Use the `--cache-to` option to populate a remote repository with cache content. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-from` option is ignored unless `--layers` is specified. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cache-to.md b/versioned_docs/version-5.4.2/source/markdown/options/cache-to.md new file mode 100644 index 000000000..47aa47c58 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cache-to.md @@ -0,0 +1,24 @@ +--- +title: populate a cache and also consult it +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cache-to**=*image* + +Set this flag to specify a remote repository that is used to store cache images. Buildah attempts to +push newly built cache image to the remote repository. + +Note: Use the `--cache-from` option in order to use cache content in a remote repository. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-to` option is ignored unless `--layers` is specified. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cache-ttl.md b/versioned_docs/version-5.4.2/source/markdown/options/cache-ttl.md new file mode 100644 index 000000000..905b3cc86 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cache-ttl.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cache-ttl** + +Limit the use of cached images to only consider images with created timestamps less than *duration* ago. +For example if `--cache-ttl=1h` is specified, Buildah considers intermediate cache images which are created +under the duration of one hour, and intermediate cache images outside this duration is ignored. + +Note: Setting `--cache-ttl=0` manually is equivalent to using `--no-cache` in the +implementation since this means that the user does not want to use cache at all. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cap-add.image.md b/versioned_docs/version-5.4.2/source/markdown/options/cap-add.image.md new file mode 100644 index 000000000..831e58058 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cap-add.image.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cap-add**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability added to its capability set. +Certain capabilities are granted by default; this option can be used to add +more. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cap-add.md b/versioned_docs/version-5.4.2/source/markdown/options/cap-add.md new file mode 100644 index 000000000..4171f8ba4 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cap-add.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cap-add**=*capability* + +Add Linux capabilities. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cap-drop.image.md b/versioned_docs/version-5.4.2/source/markdown/options/cap-drop.image.md new file mode 100644 index 000000000..bc80de36b --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cap-drop.image.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cap-drop**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability removed from its capability set. +The CAP\_CHOWN, CAP\_DAC\_OVERRIDE, CAP\_FOWNER, +CAP\_FSETID, CAP\_KILL, CAP\_NET\_BIND\_SERVICE, CAP\_SETFCAP, +CAP\_SETGID, CAP\_SETPCAP, and CAP\_SETUID capabilities are +granted by default; this option can be used to remove them. + +If a capability is specified to both the **--cap-add** and **--cap-drop** +options, it is dropped, regardless of the order in which the options were +given. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cap-drop.md b/versioned_docs/version-5.4.2/source/markdown/options/cap-drop.md new file mode 100644 index 000000000..92959e6d4 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cap-drop.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cap-drop**=*capability* + +Drop Linux capabilities. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cert-dir.md b/versioned_docs/version-5.4.2/source/markdown/options/cert-dir.md new file mode 100644 index 000000000..7cf3120c1 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cert-dir.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, build, container runlabel, farm build, image sign, kube play, login, manifest add, manifest push, pull, push, search +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cgroup-conf.md b/versioned_docs/version-5.4.2/source/markdown/options/cgroup-conf.md new file mode 100644 index 000000000..624a5fef0 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cgroup-conf.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroup-conf**=*KEY=VALUE* + +When running on cgroup v2, specify the cgroup file to write to and its value. For example **--cgroup-conf=memory.high=1073741824** sets the memory.high limit to 1GB. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cgroup-parent.md b/versioned_docs/version-5.4.2/source/markdown/options/cgroup-parent.md new file mode 100644 index 000000000..41f3ad537 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cgroup-parent.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, create, farm build, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the <> is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cgroupns.image.md b/versioned_docs/version-5.4.2/source/markdown/options/cgroupns.image.md new file mode 100644 index 000000000..840ef8f8b --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cgroupns.image.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroupns**=*how* + +Sets the configuration for cgroup namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "private" to indicate +that a new cgroup namespace is created, or it can be "host" to indicate +that the cgroup namespace in which `buildah` itself is being run is reused. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cgroupns.md b/versioned_docs/version-5.4.2/source/markdown/options/cgroupns.md new file mode 100644 index 000000000..bb7b1658a --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cgroupns.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroupns**=*mode* + +Set the cgroup namespace mode for the container. + +- **host**: use the host's cgroup namespace inside the container. +- **container:**_id_: join the namespace of the specified container. +- **private**: create a new cgroup namespace. +- **ns:**_path_: join the namespace at the specified path. + +If the host uses cgroups v1, the default is set to **host**. On cgroups v2, the default is **private**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cgroups.md b/versioned_docs/version-5.4.2/source/markdown/options/cgroups.md new file mode 100644 index 000000000..5482149df --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cgroups.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroups**=*how* + +Determines whether the container creates CGroups. + +Default is **enabled**. + +The **enabled** option creates a new cgroup under the cgroup-parent. +The **disabled** option forces the container to not create CGroups, and thus conflicts with CGroup options (**--cgroupns** and **--cgroup-parent**). +The **no-conmon** option disables a new CGroup only for the **conmon** process. +The **split** option splits the current CGroup in two sub-cgroups: one for conmon and one for the container payload. It is not possible to set **--cgroup-parent** with **split**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/chrootdirs.md b/versioned_docs/version-5.4.2/source/markdown/options/chrootdirs.md new file mode 100644 index 000000000..a39c8fb7c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/chrootdirs.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--chrootdirs**=*path* + +Path to a directory inside the container that is treated as a `chroot` directory. +Any Podman managed file (e.g., /etc/resolv.conf, /etc/hosts, etc/hostname) that is mounted into the root directory is mounted into that location as well. +Multiple directories are separated with a comma. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cidfile.read.md b/versioned_docs/version-5.4.2/source/markdown/options/cidfile.read.md new file mode 100644 index 000000000..ced8a39a2 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cidfile.read.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman kill, pause, rm, stop, unpause +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cidfile**=*file* + +Read container ID from the specified *file* and <> the container. +Can be specified multiple times. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cidfile.write.md b/versioned_docs/version-5.4.2/source/markdown/options/cidfile.write.md new file mode 100644 index 000000000..583bb914f --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cidfile.write.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cidfile**=*file* + +Write the container ID to *file*. The file is removed along with the container, except +when used with podman --remote run on detached containers. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/color.md b/versioned_docs/version-5.4.2/source/markdown/options/color.md new file mode 100644 index 000000000..28f676abf --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/color.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--color** + +Output the containers with different colors in the log. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/compat-auth-file.md b/versioned_docs/version-5.4.2/source/markdown/options/compat-auth-file.md new file mode 100644 index 000000000..a6ef42832 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/compat-auth-file.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman login, logout +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compat-auth-file**=*path* + +Instead of updating the default credentials file, update the one at *path*, and use a Docker-compatible format. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/compat-volumes.md b/versioned_docs/version-5.4.2/source/markdown/options/compat-volumes.md new file mode 100644 index 000000000..2fe93e2ad --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/compat-volumes.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compat-volumes** + +Handle directories marked using the VOLUME instruction (both in this build, and +those inherited from base images) such that their contents can only be modified +by ADD and COPY instructions. Any changes made in those locations by RUN +instructions will be reverted. Before the introduction of this option, this +behavior was the default, but it is now disabled by default. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/compression-format.md b/versioned_docs/version-5.4.2/source/markdown/options/compression-format.md new file mode 100644 index 000000000..790bc89ba --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/compression-format.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compression-format**=**gzip** | *zstd* | *zstd:chunked* + +Specifies the compression format to use. Supported values are: `gzip`, `zstd` and `zstd:chunked`. The default is `gzip` unless overridden in the containers.conf file. +`zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning in that case. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/compression-level.md b/versioned_docs/version-5.4.2/source/markdown/options/compression-level.md new file mode 100644 index 000000000..e5811e9f5 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/compression-level.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compression-level**=*level* + +Specifies the compression level to use. The value is specific to the compression algorithm used, e.g. for zstd the accepted values are in the range 1-20 (inclusive) with a default of 3, while for gzip it is 1-9 (inclusive) and has a default of 5. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/conmon-pidfile.md b/versioned_docs/version-5.4.2/source/markdown/options/conmon-pidfile.md new file mode 100644 index 000000000..f46304cf5 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/conmon-pidfile.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--conmon-pidfile**=*file* + +Write the pid of the **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to restart Podman containers. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cpp-flag.md b/versioned_docs/version-5.4.2/source/markdown/options/cpp-flag.md new file mode 100644 index 000000000..5f0ab7d8d --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cpp-flag.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpp-flag**=*flags* + +Set additional flags to pass to the C Preprocessor cpp(1). Containerfiles ending with a ".in" suffix is preprocessed via cpp(1). This option can be used to pass additional flags to cpp.Note: You can also set default CPPFLAGS by setting the BUILDAH_CPPFLAGS environment variable (e.g., export BUILDAH_CPPFLAGS="-DDEBUG"). diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cpu-period.md b/versioned_docs/version-5.4.2/source/markdown/options/cpu-period.md new file mode 100644 index 000000000..489f1939c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cpu-period.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cpu-quota.md b/versioned_docs/version-5.4.2/source/markdown/options/cpu-quota.md new file mode 100644 index 000000000..96ca8fe05 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cpu-quota.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cpu-rt-period.md b/versioned_docs/version-5.4.2/source/markdown/options/cpu-rt-period.md new file mode 100644 index 000000000..956bb8a6e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cpu-rt-period.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman container clone, create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cpu-rt-runtime.md b/versioned_docs/version-5.4.2/source/markdown/options/cpu-rt-runtime.md new file mode 100644 index 000000000..0fc77544f --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cpu-rt-runtime.md @@ -0,0 +1,19 @@ +--- +title: of +version: v5.4.2 +--- + +####> This option file is used in: +####> podman container clone, create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cpu-shares.md b/versioned_docs/version-5.4.2/source/markdown/options/cpu-shares.md new file mode 100644 index 000000000..d94fe0a72 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cpu-shares.md @@ -0,0 +1,50 @@ +--- +title: of +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cpus.container.md b/versioned_docs/version-5.4.2/source/markdown/options/cpus.container.md new file mode 100644 index 000000000..37deec165 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cpus.container.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpus**=*number* + +Number of CPUs. The default is *0.0* which means no limit. This is shorthand +for **--cpu-period** and **--cpu-quota**, therefore the option cannot be specified with +**--cpu-period** or **--cpu-quota**. + +On some systems, changing the CPU limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cpuset-cpus.md b/versioned_docs/version-5.4.2/source/markdown/options/cpuset-cpus.md new file mode 100644 index 000000000..99d7dbee0 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cpuset-cpus.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/cpuset-mems.md b/versioned_docs/version-5.4.2/source/markdown/options/cpuset-mems.md new file mode 100644 index 000000000..f011e3093 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/cpuset-mems.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/creds.md b/versioned_docs/version-5.4.2/source/markdown/options/creds.md new file mode 100644 index 000000000..9621f1a46 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/creds.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, build, container runlabel, farm build, kube play, manifest add, manifest push, pull, push, search +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--creds**=*[username[\\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/decryption-key.md b/versioned_docs/version-5.4.2/source/markdown/options/decryption-key.md new file mode 100644 index 000000000..c257a2444 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/decryption-key.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman artifact pull, build, create, farm build, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--decryption-key**=*key[\\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/destroy.md b/versioned_docs/version-5.4.2/source/markdown/options/destroy.md new file mode 100644 index 000000000..e759893ef --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/destroy.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman container clone, pod clone +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--destroy** + +Remove the original <> that we are cloning once used to mimic the configuration. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/detach-keys.md b/versioned_docs/version-5.4.2/source/markdown/options/detach-keys.md new file mode 100644 index 000000000..3079da27e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/detach-keys.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman attach, exec, run, start +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/device-cgroup-rule.md b/versioned_docs/version-5.4.2/source/markdown/options/device-cgroup-rule.md new file mode 100644 index 000000000..57450dfe1 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/device-cgroup-rule.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-cgroup-rule**=*"type major\\:minor mode"* + +Add a rule to the cgroup allowed devices list. The rule is expected to be +in the format specified in the Linux kernel documentation +[admin-guide/cgroup-v1/devices](https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.html): +- *type*: `a` (all), `c` (char), or `b` (block); +- *major* and *minor*: either a number, or `*` for all; +- *mode*: a composition of `r` (read), `w` (write), and `m` (mknod(2)). diff --git a/versioned_docs/version-5.4.2/source/markdown/options/device-read-bps.md b/versioned_docs/version-5.4.2/source/markdown/options/device-read-bps.md new file mode 100644 index 000000000..aeae83f01 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/device-read-bps.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman container clone, create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/device-read-iops.md b/versioned_docs/version-5.4.2/source/markdown/options/device-read-iops.md new file mode 100644 index 000000000..b559c44f8 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/device-read-iops.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-read-iops**=*path:rate* + +Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/device-write-bps.md b/versioned_docs/version-5.4.2/source/markdown/options/device-write-bps.md new file mode 100644 index 000000000..4d583d2b2 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/device-write-bps.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman container clone, create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/device-write-iops.md b/versioned_docs/version-5.4.2/source/markdown/options/device-write-iops.md new file mode 100644 index 000000000..460ae2920 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/device-write-iops.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-write-iops**=*path:rate* + +Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/device.md b/versioned_docs/version-5.4.2/source/markdown/options/device.md new file mode 100644 index 000000000..9950ddc5d --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/device.md @@ -0,0 +1,31 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, create, farm build, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device**=*host-device[:container-device][\\\:permissions]* + +Add a host device to the <>. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The <> only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true diff --git a/versioned_docs/version-5.4.2/source/markdown/options/digestfile.md b/versioned_docs/version-5.4.2/source/markdown/options/digestfile.md new file mode 100644 index 000000000..876a3a810 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/digestfile.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman artifact push, manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--digestfile**=*Digestfile* + +After copying the image, write the digest of the resulting image to the file. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/dir-compress.md b/versioned_docs/version-5.4.2/source/markdown/options/dir-compress.md new file mode 100644 index 000000000..5629b6810 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/dir-compress.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman push, save +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compress** + +Compress tarball image layers when pushing to a directory using the 'dir' transport. (default is same compression type, compressed or uncompressed, as source) diff --git a/versioned_docs/version-5.4.2/source/markdown/options/disable-compression.md b/versioned_docs/version-5.4.2/source/markdown/options/disable-compression.md new file mode 100644 index 000000000..de6555e17 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/disable-compression.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--disable-compression**, **-D** + +Don't compress filesystem layers when building the image unless it is required +by the location where the image is being written. This is the default setting, +because image layers are compressed automatically when they are pushed to +registries, and images being written to local storage only need to be +decompressed again to be stored. Compression can be forced in all cases by +specifying **--disable-compression=false**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/disable-content-trust.md b/versioned_docs/version-5.4.2/source/markdown/options/disable-content-trust.md new file mode 100644 index 000000000..c44bca8cc --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/disable-content-trust.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, create, pull, push, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/dns-option.container.md b/versioned_docs/version-5.4.2/source/markdown/options/dns-option.container.md new file mode 100644 index 000000000..463e7fe3b --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/dns-option.container.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns-option**=*option* + +Set custom DNS options. Invalid if using **--dns-option** with **--network** that is set to **none** or **container:**_id_. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/dns-option.image.md b/versioned_docs/version-5.4.2/source/markdown/options/dns-option.image.md new file mode 100644 index 000000000..9a7de2129 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/dns-option.image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns-option**=*option* + +Set custom DNS options to be used during the build. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/dns-search.container.md b/versioned_docs/version-5.4.2/source/markdown/options/dns-search.container.md new file mode 100644 index 000000000..5d316b947 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/dns-search.container.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns-search**=*domain* + +Set custom DNS search domains. Invalid if using **--dns-search** with **--network** that is set to **none** or **container:**_id_. +Use **--dns-search=.** to remove the search domain. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/dns-search.image.md b/versioned_docs/version-5.4.2/source/markdown/options/dns-search.image.md new file mode 100644 index 000000000..0ebf2cedd --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/dns-search.image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns-search**=*domain* + +Set custom DNS search domains to be used during the build. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/dns.md b/versioned_docs/version-5.4.2/source/markdown/options/dns.md new file mode 100644 index 000000000..4a412b7d0 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/dns.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, create, farm build, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/entrypoint.md b/versioned_docs/version-5.4.2/source/markdown/options/entrypoint.md new file mode 100644 index 000000000..ce178f2f2 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/entrypoint.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--entrypoint**=*"command"* | *'["command", "arg1", ...]'* + +Override the default ENTRYPOINT from the image. + +The ENTRYPOINT of an image is similar to a COMMAND +because it specifies what executable to run when the container starts, but it is +(purposely) more difficult to override. The ENTRYPOINT gives a container its +default nature or behavior. When the ENTRYPOINT is set, the +container runs as if it were that binary, complete with default options. More options can be +passed in via the COMMAND. But, if a user wants to run +something else inside the container, the **--entrypoint** option allows a new +ENTRYPOINT to be specified. + +Specify multi option commands in the form of a json string. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/env-file.md b/versioned_docs/version-5.4.2/source/markdown/options/env-file.md new file mode 100644 index 000000000..9582aa8ca --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/env-file.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env-file**=*file* + +Read in a line-delimited file of environment variables. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/env-host.md b/versioned_docs/version-5.4.2/source/markdown/options/env-host.md new file mode 100644 index 000000000..dbedc850d --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/env-host.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env-host** + +Use host environment inside of the container. See **Environment** note below for precedence. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.4.2/source/markdown/options/env-merge.md b/versioned_docs/version-5.4.2/source/markdown/options/env-merge.md new file mode 100644 index 000000000..5658484c4 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/env-merge.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env-merge**=*env* + +Preprocess default environment variables for the containers. For example +if image contains environment variable `hello=world` user can preprocess +it using `--env-merge hello=${hello}-some` so new value is `hello=world-some`. + +Please note that if the environment variable `hello` is not present in the image, +then it'll be replaced by an empty string and so using `--env-merge hello=${hello}-some` +would result in the new value of `hello=-some`, notice the leading `-` delimiter. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/env.image.md b/versioned_docs/version-5.4.2/source/markdown/options/env.image.md new file mode 100644 index 000000000..c2c17a52c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/env.image.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env**=*env[=value]* + +Add a value (e.g. env=*value*) to the built image. Can be used multiple times. +If neither `=` nor a *value* are specified, but *env* is set in the current +environment, the value from the current environment is added to the image. +To remove an environment variable from the built image, use the `--unsetenv` +option. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/env.md b/versioned_docs/version-5.4.2/source/markdown/options/env.md new file mode 100644 index 000000000..18652e45b --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/env.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env**, **-e**=*env* + +Set environment variables. + +This option allows arbitrary environment variables that are available for the process to be launched inside of the container. If an environment variable is specified without a value, Podman checks the host environment for a value and set the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the container. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/expose.md b/versioned_docs/version-5.4.2/source/markdown/options/expose.md new file mode 100644 index 000000000..8f59f702a --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/expose.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--expose**=*port[/protocol]* + +Expose a port or a range of ports (e.g. **--expose=3300-3310**). +The protocol can be `tcp`, `udp` or `sctp` and if not given `tcp` is assumed. +This option matches the EXPOSE instruction for image builds and has no effect on +the actual networking rules unless **-P/--publish-all** is used to forward to all +exposed ports from random host ports. To forward specific ports from the host +into the container use the **-p/--publish** option instead. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/farm.md b/versioned_docs/version-5.4.2/source/markdown/options/farm.md new file mode 100644 index 000000000..1f817362b --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/farm.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--farm** + +This option specifies the name of the farm to be used in the build process. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/features.md b/versioned_docs/version-5.4.2/source/markdown/options/features.md new file mode 100644 index 000000000..738e25ec7 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/features.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman manifest add, manifest annotate +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--features**=*feature* + +Specify the features list which the list or index records as requirements for +the image. This option is rarely used. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/file.md b/versioned_docs/version-5.4.2/source/markdown/options/file.md new file mode 100644 index 000000000..7a1001c10 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/file.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--file**, **-f**=*Containerfile* + +Specifies a Containerfile which contains instructions for building the image, +either a local file or an **http** or **https** URL. If more than one +Containerfile is specified, *FROM* instructions are only be accepted from the +last specified file. + +If a build context is not specified, and at least one Containerfile is a +local file, the directory in which it resides is used as the build +context. + +Specifying the option `-f -` causes the Containerfile contents to be read from stdin. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/follow.md b/versioned_docs/version-5.4.2/source/markdown/options/follow.md new file mode 100644 index 000000000..ac3ec4507 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/follow.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--follow**, **-f** + +Follow log output. Default is false. + +Note: When following a <> which is removed by `podman <> rm` +or removed on exit (`podman run --rm ...`), there is a chance that the log +file is removed before `podman<< pod|>> logs` reads the final content. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/force-compression.md b/versioned_docs/version-5.4.2/source/markdown/options/force-compression.md new file mode 100644 index 000000000..35c839b5d --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/force-compression.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--force-compression** + +If set, push uses the specified compression algorithm even if the destination contains a differently-compressed variant already. +Defaults to `true` if `--compression-format` is explicitly specified on the command-line, `false` otherwise. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/force-rm.md b/versioned_docs/version-5.4.2/source/markdown/options/force-rm.md new file mode 100644 index 000000000..30559d8bf --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/force-rm.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--force-rm** + +Always remove intermediate containers after a build, even if the build fails (default true). diff --git a/versioned_docs/version-5.4.2/source/markdown/options/format.md b/versioned_docs/version-5.4.2/source/markdown/options/format.md new file mode 100644 index 000000000..a289a19c4 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/format.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--format** + +Control the format for the built image's manifest and configuration data. +Recognized formats include *oci* (OCI image-spec v1.0, the default) and +*docker* (version 2, using schema format 2 for the manifest). + +Note: You can also override the default format by setting the BUILDAH\_FORMAT +environment variable. `export BUILDAH_FORMAT=docker` diff --git a/versioned_docs/version-5.4.2/source/markdown/options/from.md b/versioned_docs/version-5.4.2/source/markdown/options/from.md new file mode 100644 index 000000000..e59278bf5 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/from.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--from** + +Overrides the first `FROM` instruction within the Containerfile. If there are multiple +FROM instructions in a Containerfile, only the first is changed. + +With the remote podman client, not all container transports work as +expected. For example, oci-archive:/x.tar references /x.tar on the remote +machine instead of on the client. When using podman remote clients it is +best to restrict use to *containers-storage*, and *docker:// transports*. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/gidmap.container.md b/versioned_docs/version-5.4.2/source/markdown/options/gidmap.container.md new file mode 100644 index 000000000..bae232049 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/gidmap.container.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--gidmap**=*[flags]container_uid\:from_uid[\\:amount]* + +Run the container in a new user namespace using the supplied GID mapping. This +option conflicts with the **--userns** and **--subgidname** options. This +option provides a way to map host GIDs to container GIDs in the same way as +__--uidmap__ maps host UIDs to container UIDs. For details see __--uidmap__. + +Note: the **--gidmap** option cannot be called in conjunction with the **--pod** option as a gidmap cannot be set on the container level when in a pod. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/gidmap.pod.md b/versioned_docs/version-5.4.2/source/markdown/options/gidmap.pod.md new file mode 100644 index 000000000..46ed37aa4 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/gidmap.pod.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--gidmap**=*pod_gid\:host_gid\\:amount* + +GID map for the user namespace. Using this flag runs all containers in the pod with user namespace enabled. +It conflicts with the **--userns** and **--subgidname** flags. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/gpus.md b/versioned_docs/version-5.4.2/source/markdown/options/gpus.md new file mode 100644 index 000000000..e8d07178f --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/gpus.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/group-add.md b/versioned_docs/version-5.4.2/source/markdown/options/group-add.md new file mode 100644 index 000000000..ffc0c433e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/group-add.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, create, farm build, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.4.2/source/markdown/options/group-entry.md b/versioned_docs/version-5.4.2/source/markdown/options/group-entry.md new file mode 100644 index 000000000..0607ca3af --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/group-entry.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--group-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/group` file within the container when `--user` is used. + +The variables $GROUPNAME, $GID, and $USERLIST are automatically replaced with their value at runtime if present. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/health-cmd.md b/versioned_docs/version-5.4.2/source/markdown/options/health-cmd.md new file mode 100644 index 000000000..6df307e15 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/health-cmd.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set or alter a healthcheck command for a container. The command is a command to be executed inside the +container that determines the container health. The command is required for other healthcheck options +to be applied. A value of **none** disables existing healthchecks. + +Multiple options can be passed in the form of a JSON array; otherwise, the command is interpreted +as an argument to **/bin/sh -c**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/health-interval.md b/versioned_docs/version-5.4.2/source/markdown/options/health-interval.md new file mode 100644 index 000000000..38630b579 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/health-interval.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-interval**=*interval* + +Set an interval for the healthchecks. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/health-log-destination.md b/versioned_docs/version-5.4.2/source/markdown/options/health-log-destination.md new file mode 100644 index 000000000..a78d7c9c5 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/health-log-destination.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-log-destination**=*directory_path* + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) (Default: local) + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/health-max-log-count.md b/versioned_docs/version-5.4.2/source/markdown/options/health-max-log-count.md new file mode 100644 index 000000000..e6c7181ed --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/health-max-log-count.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-max-log-count**=*number of stored logs* + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) (Default: 5 attempts) diff --git a/versioned_docs/version-5.4.2/source/markdown/options/health-max-log-size.md b/versioned_docs/version-5.4.2/source/markdown/options/health-max-log-size.md new file mode 100644 index 000000000..5249a17c9 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/health-max-log-size.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-max-log-size**=*size of stored logs* + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) (Default: 500 characters) diff --git a/versioned_docs/version-5.4.2/source/markdown/options/health-on-failure.md b/versioned_docs/version-5.4.2/source/markdown/options/health-on-failure.md new file mode 100644 index 000000000..14874e75b --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/health-on-failure.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-on-failure**=*action* + +Action to take once the container transitions to an unhealthy state. The default is **none**. + +- **none**: Take no action. +- **kill**: Kill the container. +- **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. +- **stop**: Stop the container. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/health-retries.md b/versioned_docs/version-5.4.2/source/markdown/options/health-retries.md new file mode 100644 index 000000000..1fd6b19d2 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/health-retries.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-retries**=*retries* + +The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is **3**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/health-start-period.md b/versioned_docs/version-5.4.2/source/markdown/options/health-start-period.md new file mode 100644 index 000000000..83f6d5c40 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/health-start-period.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-start-period**=*period* + +The initialization time needed for a container to bootstrap. The value can be expressed in time format like +**2m3s**. The default value is **0s**. + +Note: The health check command is executed as soon as a container is started, if the health check is successful +the container's health state will be updated to `healthy`. However, if the health check fails, the health state will +stay as `starting` until either the health check is successful or until the `--health-start-period` time is over. If the +health check command fails after the `--health-start-period` time is over, the health state will be updated to `unhealthy`. +The health check command is executed periodically based on the value of `--health-interval`. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/health-startup-cmd.md b/versioned_docs/version-5.4.2/source/markdown/options/health-startup-cmd.md new file mode 100644 index 000000000..8ab3d115f --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/health-startup-cmd.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set a startup healthcheck command for a container. This command is executed inside the container and is used to gate the regular +healthcheck. When the startup command succeeds, the regular healthcheck begins and the startup healthcheck ceases. Optionally, +if the command fails for a set number of attempts, the container is restarted. A startup healthcheck can be used to ensure that +containers with an extended startup period are not marked as unhealthy until they are fully started. Startup healthchecks can only be +used when a regular healthcheck (from the container's image or the **--health-cmd** option) is also set. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/health-startup-interval.md b/versioned_docs/version-5.4.2/source/markdown/options/health-startup-interval.md new file mode 100644 index 000000000..201027b57 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/health-startup-interval.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-interval**=*interval* + +Set an interval for the startup healthcheck. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/health-startup-retries.md b/versioned_docs/version-5.4.2/source/markdown/options/health-startup-retries.md new file mode 100644 index 000000000..a96351cee --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/health-startup-retries.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-retries**=*retries* + +The number of attempts allowed before the startup healthcheck restarts the container. If set to **0**, the container is never restarted. The default is **0**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/health-startup-success.md b/versioned_docs/version-5.4.2/source/markdown/options/health-startup-success.md new file mode 100644 index 000000000..774034872 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/health-startup-success.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-success**=*retries* + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value +of **0** means that any success begins the regular healthcheck. The default is **0**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/health-startup-timeout.md b/versioned_docs/version-5.4.2/source/markdown/options/health-startup-timeout.md new file mode 100644 index 000000000..e03c62ebe --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/health-startup-timeout.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-timeout**=*timeout* + +The maximum time a startup healthcheck command has to complete before it is marked as failed. The value can be expressed in a time +format like **2m3s**. The default value is **30s**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/health-timeout.md b/versioned_docs/version-5.4.2/source/markdown/options/health-timeout.md new file mode 100644 index 000000000..bcf048dfe --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/health-timeout.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-timeout**=*timeout* + +The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the +value can be expressed in a time format such as **1m22s**. The default value is **30s**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/help.md b/versioned_docs/version-5.4.2/source/markdown/options/help.md new file mode 100644 index 000000000..f7ca25bef --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/help.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--help**, **-h** + +Print usage statement diff --git a/versioned_docs/version-5.4.2/source/markdown/options/hooks-dir.md b/versioned_docs/version-5.4.2/source/markdown/options/hooks-dir.md new file mode 100644 index 000000000..570b01dbc --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/hooks-dir.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hooks-dir**=*path* + +Each *.json file in the path configures a hook for buildah build containers. For more details on the syntax of the JSON files and the semantics of hook injection. Buildah currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. + +This option may be set multiple times; paths from later options have higher precedence. + +For the annotation conditions, buildah uses any annotations set in the generated OCI configuration. + +For the bind-mount conditions, only mounts explicitly requested by the caller via --volume are considered. Bind mounts that buildah inserts by default (e.g. /dev/shm) are not considered. + +If --hooks-dir is unset for root callers, Buildah currently defaults to /usr/share/containers/oci/hooks.d and /etc/containers/oci/hooks.d in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting --hooks-dir. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/hostname.container.md b/versioned_docs/version-5.4.2/source/markdown/options/hostname.container.md new file mode 100644 index 000000000..b4c87f66e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/hostname.container.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hostname**, **-h**=*name* + +Set the container's hostname inside the container. + +This option can only be used with a private UTS namespace `--uts=private` +(default). If `--pod` is given and the pod shares the same UTS namespace +(default), the pod's hostname is used. The given hostname is also added to the +`/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). diff --git a/versioned_docs/version-5.4.2/source/markdown/options/hostname.pod.md b/versioned_docs/version-5.4.2/source/markdown/options/hostname.pod.md new file mode 100644 index 000000000..231b8e31d --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/hostname.pod.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hostname**=*name* + +Set the pod's hostname inside all containers. + +The given hostname is also added to the `/etc/hosts` file using the container's +primary IP address (also see the **--add-host** option). diff --git a/versioned_docs/version-5.4.2/source/markdown/options/hosts-file.md b/versioned_docs/version-5.4.2/source/markdown/options/hosts-file.md new file mode 100644 index 000000000..a0a89f69d --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/hosts-file.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hosts-file**=*path* | *none* | *image* + +Base file to create the `/etc/hosts` file inside the container. This must either +be an absolute path to a file on the host system, or one of the following +special flags: + "" Follow the `base_hosts_file` configuration in _containers.conf_ (the default) + `none` Do not use a base file (i.e. start with an empty file) + `image` Use the container image's `/etc/hosts` file as base file diff --git a/versioned_docs/version-5.4.2/source/markdown/options/hostuser.md b/versioned_docs/version-5.4.2/source/markdown/options/hostuser.md new file mode 100644 index 000000000..29b74a630 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/hostuser.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hostuser**=*name* + +Add a user account to /etc/passwd from the host to the container. The Username +or UID must exist on the host system. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/http-proxy.md b/versioned_docs/version-5.4.2/source/markdown/options/http-proxy.md new file mode 100644 index 000000000..aae1e626e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/http-proxy.md @@ -0,0 +1,25 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, create, farm build, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/identity-label.md b/versioned_docs/version-5.4.2/source/markdown/options/identity-label.md new file mode 100644 index 000000000..8ef6f4cf3 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/identity-label.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--identity-label** + +Adds default identity label `io.buildah.version` if set. (default true). diff --git a/versioned_docs/version-5.4.2/source/markdown/options/ignore.md b/versioned_docs/version-5.4.2/source/markdown/options/ignore.md new file mode 100644 index 000000000..6289aa7a5 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/ignore.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman pod rm, pod stop, rm, stop +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ignore**, **-i** + +Ignore errors when specified <> are not in the container store. A user +might have decided to manually remove a <> which leads to a failure +during the ExecStop directive of a systemd service referencing that <>. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/ignorefile.md b/versioned_docs/version-5.4.2/source/markdown/options/ignorefile.md new file mode 100644 index 000000000..5a4f585eb --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/ignorefile.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ignorefile** + +Path to an alternative .containerignore file. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/iidfile.md b/versioned_docs/version-5.4.2/source/markdown/options/iidfile.md new file mode 100644 index 000000000..e3e740d08 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/iidfile.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--iidfile**=*ImageIDfile* + +Write the built image's ID to the file. When `--platform` is specified more than once, attempting to use this option triggers an error. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/image-volume.md b/versioned_docs/version-5.4.2/source/markdown/options/image-volume.md new file mode 100644 index 000000000..1a4237869 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/image-volume.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--image-volume**=**bind** | *tmpfs* | *ignore* + +Tells Podman how to handle the builtin image volumes. Default is **bind**. + +- **bind**: An anonymous named volume is created and mounted into the container. +- **tmpfs**: The volume is mounted onto the container as a tmpfs, which allows the users to create +content that disappears when the container is stopped. +- **ignore**: All volumes are just ignored and no action is taken. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/infra-command.md b/versioned_docs/version-5.4.2/source/markdown/options/infra-command.md new file mode 100644 index 000000000..656071eb0 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/infra-command.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--infra-command**=*command* + +The command that is run to start the infra container. Default: "/pause". diff --git a/versioned_docs/version-5.4.2/source/markdown/options/infra-conmon-pidfile.md b/versioned_docs/version-5.4.2/source/markdown/options/infra-conmon-pidfile.md new file mode 100644 index 000000000..cada9e7fb --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/infra-conmon-pidfile.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--infra-conmon-pidfile**=*file* + +Write the pid of the infra container's **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to manage Podman containers and pods. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/infra-name.md b/versioned_docs/version-5.4.2/source/markdown/options/infra-name.md new file mode 100644 index 000000000..5ba3ef67a --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/infra-name.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--infra-name**=*name* + +The name that is used for the pod's infra container. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/init-path.md b/versioned_docs/version-5.4.2/source/markdown/options/init-path.md new file mode 100644 index 000000000..38ef5ac5b --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/init-path.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--init-path**=*path* + +Path to the container-init binary. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/init.md b/versioned_docs/version-5.4.2/source/markdown/options/init.md new file mode 100644 index 000000000..0535ab0d6 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/init.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--init** + +Run an init inside the container that forwards signals and reaps processes. +The container-init binary is mounted at `/run/podman-init`. +Mounting over `/run` breaks container execution. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/interactive.md b/versioned_docs/version-5.4.2/source/markdown/options/interactive.md new file mode 100644 index 000000000..46ce1871a --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/interactive.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, exec, run, start +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/ip.md b/versioned_docs/version-5.4.2/source/markdown/options/ip.md new file mode 100644 index 000000000..c79cd1dca --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/ip.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ip**=*ipv4* + +Specify a static IPv4 address for the <>, for example **10.88.64.128**. +This option can only be used if the <> is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the <> is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IP address pool (default **10.88.0.0/16**). + +To specify multiple static IP addresses per <>, set multiple networks using the **--network** option with a static IP address specified for each using the `ip` mode for that option. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/ip6.md b/versioned_docs/version-5.4.2/source/markdown/options/ip6.md new file mode 100644 index 000000000..3eabd50dc --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/ip6.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ip6**=*ipv6* + +Specify a static IPv6 address for the <>, for example **fd46:db93:aa76\:ac37::10**. +This option can only be used if the <> is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the <> is not joining another container's network namespace via **--network=container\\:_id_**. +The address must be within the network's IPv6 address pool. + +To specify multiple static IPv6 addresses per <>, set multiple networks using the **--network** option with a static IPv6 address specified for each using the `ip6` mode for that option. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/ipc.image.md b/versioned_docs/version-5.4.2/source/markdown/options/ipc.image.md new file mode 100644 index 000000000..35dc61a1c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/ipc.image.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ipc**=*how* + +Sets the configuration for IPC namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate +that a new IPC namespace is created, or it can be "host" to indicate +that the IPC namespace in which `podman` itself is being run is reused, +or it can be the path to an IPC namespace which is already in use by +another process. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/ipc.md b/versioned_docs/version-5.4.2/source/markdown/options/ipc.md new file mode 100644 index 000000000..49119b7fb --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/ipc.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ipc**=*ipc* + +Set the IPC namespace mode for a container. The default is to create +a private IPC namespace. + +- "": Use Podman's default, defined in containers.conf. +- **container:**_id_: reuses another container's shared memory, semaphores, and message queues +- **host**: use the host's shared memory, semaphores, and message queues inside the container. Note: the host mode gives the container full access to local shared memory and is therefore considered insecure. +- **none**: private IPC namespace, with /dev/shm not mounted. +- **ns:**_path_: path to an IPC namespace to join. +- **private**: private IPC namespace. +- **shareable**: private IPC namespace with a possibility to share it with other containers. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/isolation.md b/versioned_docs/version-5.4.2/source/markdown/options/isolation.md new file mode 100644 index 000000000..8a4b35e41 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/isolation.md @@ -0,0 +1,22 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--isolation**=*type* + +Controls what type of isolation is used for running processes as part of `RUN` +instructions. Recognized types include *oci* (OCI-compatible runtime, the +default), *rootless* (OCI-compatible runtime invoked using a modified +configuration and its --rootless option enabled, with *--no-new-keyring +--no-pivot* added to its *create* invocation, with network and UTS namespaces +disabled, and IPC, PID, and user namespaces enabled; the default for +unprivileged users), and *chroot* (an internal wrapper that leans more toward +chroot(1) than container technology). + +Note: You can also override the default isolation type by setting the +BUILDAH\_ISOLATION environment variable. `export BUILDAH_ISOLATION=oci` diff --git a/versioned_docs/version-5.4.2/source/markdown/options/jobs.md b/versioned_docs/version-5.4.2/source/markdown/options/jobs.md new file mode 100644 index 000000000..3528150ab --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/jobs.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--jobs**=*number* + +Run up to N concurrent stages in parallel. If the number of jobs is greater +than 1, stdin is read from /dev/null. If 0 is specified, then there is +no limit in the number of jobs that run in parallel. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/label-file.md b/versioned_docs/version-5.4.2/source/markdown/options/label-file.md new file mode 100644 index 000000000..ab57daf33 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/label-file.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--label-file**=*file* + +Read in a line-delimited file of labels. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/label.image.md b/versioned_docs/version-5.4.2/source/markdown/options/label.image.md new file mode 100644 index 000000000..b61d60f07 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/label.image.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--label**=*label* + +Add an image *label* (e.g. label=*value*) to the image metadata. Can be used +multiple times. + +Users can set a special LABEL **io.containers.capabilities=CAP1,CAP2,CAP3** in +a Containerfile that specifies the list of Linux capabilities required for the +container to run properly. This label specified in a container image tells +Podman to run the container with just these capabilities. Podman launches the +container with just the specified capabilities, as long as this list of +capabilities is a subset of the default list. + +If the specified capabilities are not in the default set, Podman prints an error +message and runs the container with the default capabilities. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/label.md b/versioned_docs/version-5.4.2/source/markdown/options/label.md new file mode 100644 index 000000000..08c005efb --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/label.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--label**, **-l**=*key=value* + +Add metadata to a <>. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/latest.md b/versioned_docs/version-5.4.2/source/markdown/options/latest.md new file mode 100644 index 000000000..03393c66f --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/latest.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman attach, container diff, container inspect, diff, exec, init, inspect, kill, logs, mount, network reload, pause, pod inspect, pod kill, pod logs, pod rm, pod start, pod stats, pod stop, pod top, port, restart, rm, start, stats, stop, top, unmount, unpause, wait +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--latest**, **-l** + +Instead of providing the <> name or ID, use the last created <>. +Note: the last started <> can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) diff --git a/versioned_docs/version-5.4.2/source/markdown/options/layer-label.md b/versioned_docs/version-5.4.2/source/markdown/options/layer-label.md new file mode 100644 index 000000000..df2ddc58c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/layer-label.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--layer-label**=*label[=value]* + +Add an intermediate image *label* (e.g. label=*value*) to the intermediate +image metadata. It can be used multiple times. + +If *label* is named, but neither `=` nor a `value` is provided, then +the *label* is set to an empty value. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/layers.md b/versioned_docs/version-5.4.2/source/markdown/options/layers.md new file mode 100644 index 000000000..79e083067 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/layers.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--layers** + +Cache intermediate images during the build process (Default is `true`). + +Note: You can also override the default value of layers by setting the +BUILDAH\_LAYERS environment variable. `export BUILDAH_LAYERS=true` diff --git a/versioned_docs/version-5.4.2/source/markdown/options/link-local-ip.md b/versioned_docs/version-5.4.2/source/markdown/options/link-local-ip.md new file mode 100644 index 000000000..a1fd096f0 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/link-local-ip.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--link-local-ip**=*ip* + +Not implemented. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/log-driver.md b/versioned_docs/version-5.4.2/source/markdown/options/log-driver.md new file mode 100644 index 000000000..d1380f080 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/log-driver.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--log-driver**=*driver* + +Logging driver for the container. Currently available options are **k8s-file**, **journald**, **none**, **passthrough** and **passthrough-tty**, with **json-file** aliased to **k8s-file** for scripting compatibility. (Default **journald**). + +The podman info command below displays the default log-driver for the system. +``` +$ podman info --format '{{ .Host.LogDriver }}' +journald +``` +The **passthrough** driver passes down the standard streams (stdin, stdout, stderr) to the +container. It is not allowed with the remote Podman client, including Mac and Windows (excluding WSL2) machines, and on a tty, since it is +vulnerable to attacks via TIOCSTI. + +The **passthrough-tty** driver is the same as **passthrough** except that it also allows it to be used on a TTY if the user really wants it. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/log-opt.md b/versioned_docs/version-5.4.2/source/markdown/options/log-opt.md new file mode 100644 index 000000000..19fad9d43 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/log-opt.md @@ -0,0 +1,25 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, kube play, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--log-opt**=*name=value* + +Logging driver specific options. + +Set custom logging configuration. The following *name*s are supported: + +**path**: specify a path to the log file + (e.g. **--log-opt path=/var/log/container/mycontainer.json**); + +**max-size**: specify a max size of the log file + (e.g. **--log-opt max-size=10mb**); + +**tag**: specify a custom log tag for the container + (e.g. **--log-opt tag="{{.ImageName}}"**. +It supports the same keys as **podman inspect --format**. +This option is currently supported only by the **journald** log driver. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/logfile.md b/versioned_docs/version-5.4.2/source/markdown/options/logfile.md new file mode 100644 index 000000000..71f801bab --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/logfile.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--logfile**=*filename* + +Log output which is sent to standard output and standard error to the +specified file instead of to standard output and standard error. +This option is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/mac-address.md b/versioned_docs/version-5.4.2/source/markdown/options/mac-address.md new file mode 100644 index 000000000..19f07f4ed --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/mac-address.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--mac-address**=*address* + +<> network interface MAC address (e.g. 92:d0\:c6:0a:29:33) +This option can only be used if the <> is joined to only a single network - i.e., **--network=_network-name_** is used at most once - +and if the <> is not joining another container's network namespace via **--network=container\:_id_**. + +Remember that the MAC address in an Ethernet network must be unique. +The IPv6 link-local address is based on the device's MAC address +according to RFC4862. + +To specify multiple static MAC addresses per <>, set multiple networks using the **--network** option with a static MAC address specified for each using the `mac` mode for that option. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/manifest.md b/versioned_docs/version-5.4.2/source/markdown/options/manifest.md new file mode 100644 index 000000000..2efd56604 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/manifest.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--manifest**=*manifest* + +Name of the manifest list to which the image is added. Creates the manifest list if it does not exist. This option is useful for building multi architecture images. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/memory-reservation.md b/versioned_docs/version-5.4.2/source/markdown/options/memory-reservation.md new file mode 100644 index 000000000..0665e4aab --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/memory-reservation.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman container clone, create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/memory-swap.md b/versioned_docs/version-5.4.2/source/markdown/options/memory-swap.md new file mode 100644 index 000000000..c32b9e082 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/memory-swap.md @@ -0,0 +1,22 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/memory-swappiness.md b/versioned_docs/version-5.4.2/source/markdown/options/memory-swappiness.md new file mode 100644 index 000000000..2dd79cb03 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/memory-swappiness.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman container clone, create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/memory.md b/versioned_docs/version-5.4.2/source/markdown/options/memory.md new file mode 100644 index 000000000..d964ec918 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/memory.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/mount.md b/versioned_docs/version-5.4.2/source/markdown/options/mount.md new file mode 100644 index 000000000..92f322103 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/mount.md @@ -0,0 +1,112 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--mount**=*type=TYPE,TYPE-SPECIFIC-OPTION[,...]* + +Attach a filesystem mount to the container + +Current supported mount TYPEs are **bind**, **devpts**, **glob**, **image**, **ramfs**, **tmpfs** and **volume**. + +Options common to all mount types: + +- *src*, *source*: mount source spec for **bind**, **glob**, and **volume**. + Mandatory for **bind** and **glob**. + +- *dst*, *destination*, *target*: mount destination spec. + +When source globs are specified without the destination directory, +the files and directories are mounted with their complete path +within the container. When the destination is specified, the +files and directories matching the glob on the base file name +on the destination directory are mounted. The option +`type=glob,src=/foo*,destination=/tmp/bar` tells container engines +to mount host files matching /foo* to the /tmp/bar/ +directory in the container. + +Options specific to type=**volume**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *idmap*: If specified, create an idmapped mount to the target user namespace in the container. + The idmap option is only supported by Podman in rootful mode. The Linux kernel does not allow the use of idmaped file systems for unprivileged users. + The idmap option supports a custom mapping that can be different than the user namespace used by the container. + The mapping can be specified after the idmap option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the first value is the + start of the backing file system IDs that are mapped to the second value on the host. The length of this mapping is given in the third value. + Multiple ranges are separated with #. If the specified mapping is prepended with a '@' then the mapping is considered relative to the container + user namespace. The host ID for the mapping is changed to account for the relative position of the container user in the container user namespace. + +Options specific to type=**image**: + +- *rw*, *readwrite*: *true* or *false* (default if unspecified: *false*). + +- *subpath*: Mount only a specific path within the image, instead of the whole image. + +Options specific to **bind** and **glob**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *bind-propagation*: *shared*, *slave*, *private*, *unbindable*, *rshared*, *rslave*, *runbindable*, or **rprivate** (default).[[1]](#Footnote1) See also mount(2). + +- *bind-nonrecursive*: do not set up a recursive bind mount. By default it is recursive. + +- *relabel*: *shared*, *private*. + +- *idmap*: *true* or *false* (default if unspecified: *false*). If true, create an idmapped mount to the target user namespace in the container. The idmap option is only supported by Podman in rootful mode. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *no-dereference*: do not dereference symlinks but copy the link source into the mount destination. + +Options specific to type=**tmpfs** and **ramfs**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *tmpfs-size*: Size of the tmpfs/ramfs mount, in bytes. Unlimited by default in Linux. + +- *tmpfs-mode*: Octal file mode of the tmpfs/ramfs (e.g. 700 or 0700.). + +- *tmpcopyup*: Enable copyup from the image directory at the same location to the tmpfs/ramfs. Used by default. + +- *notmpcopyup*: Disable copying files from the image to the tmpfs/ramfs. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +Options specific to type=**devpts**: + +- *uid*: numeric UID of the file owner (default: 0). + +- *gid*: numeric GID of the file owner (default: 0). + +- *mode*: octal permission mask for the file (default: 600). + +- *max*: maximum number of PTYs (default: 1048576). + +Examples: + +- `type=bind,source=/path/on/host,destination=/path/in/container` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared,U=true` + +- `type=devpts,destination=/dev/pts` + +- `type=glob,src=/usr/lib/libfoo*,destination=/usr/lib,ro=true` + +- `type=image,source=fedora,destination=/fedora-image,rw=true` + +- `type=ramfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,destination=/path/in/container,noswap` + +- `type=volume,source=vol1,destination=/path/in/container,ro=true` diff --git a/versioned_docs/version-5.4.2/source/markdown/options/name.container.md b/versioned_docs/version-5.4.2/source/markdown/options/name.container.md new file mode 100644 index 000000000..b159bd10d --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/name.container.md @@ -0,0 +1,25 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--name**=*name* + +Assign a name to the container. + +The operator can identify a container in three ways: + +- UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”); +- UUID short identifier (“f78375b1c487”); +- Name (“jonah”). + +Podman generates a UUID for each container, and if no name is assigned to the +container using **--name**, Podman generates a random string name. The name can +be useful as a more human-friendly way to identify containers. This works for +both background and foreground containers. The container's name is also added +to the `/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). diff --git a/versioned_docs/version-5.4.2/source/markdown/options/names.md b/versioned_docs/version-5.4.2/source/markdown/options/names.md new file mode 100644 index 000000000..1ef98a68c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/names.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--names**, **-n** + +Output the container names instead of the container IDs in the log. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/network-alias.md b/versioned_docs/version-5.4.2/source/markdown/options/network-alias.md new file mode 100644 index 000000000..650e03104 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/network-alias.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--network-alias**=*alias* + +Add a network-scoped alias for the <>, setting the alias for all networks that the container joins. To set a +name only for a specific network, use the alias option as described under the **--network** option. +If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. This option can be specified multiple times. +NOTE: When using CNI a <> only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/network.image.md b/versioned_docs/version-5.4.2/source/markdown/options/network.image.md new file mode 100644 index 000000000..9a2204352 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/network.image.md @@ -0,0 +1,68 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--network**=*mode*, **--net** + +Sets the configuration for network namespaces when handling `RUN` instructions. + +Valid _mode_ values are: + +- **none**: no networking. +- **host**: use the Podman host network stack. Note: the host mode gives the +container full access to local system services such as D-bus and is therefore +considered insecure. +- **ns:**_path_: path to a network namespace to join. +- **private**: create a new namespace for the container (default) +- **\**: Join the network with the given name or ID, e.g. use `--network mynet` to join the network with the name mynet. Only supported for rootful users. +- **slirp4netns[\\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=MTU**: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=CIDR**: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=INTERFACE**: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=IPv4**: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=INTERFACE**: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=IPv6**: Specify the outbound ipv6 address slirp binds to. +- **pasta[\\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance diff --git a/versioned_docs/version-5.4.2/source/markdown/options/network.md b/versioned_docs/version-5.4.2/source/markdown/options/network.md new file mode 100644 index 000000000..d15bd7654 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/network.md @@ -0,0 +1,92 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, kube play, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--network**=*mode*, **--net** + +Set the network mode for the <>. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured, to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance diff --git a/versioned_docs/version-5.4.2/source/markdown/options/no-cache.md b/versioned_docs/version-5.4.2/source/markdown/options/no-cache.md new file mode 100644 index 000000000..2a195fb79 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/no-cache.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-cache** + +Do not use existing cached images for the container build. Build from the start with a new set of cached layers. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/no-healthcheck.md b/versioned_docs/version-5.4.2/source/markdown/options/no-healthcheck.md new file mode 100644 index 000000000..a02c30cd8 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/no-healthcheck.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-healthcheck** + +Disable any defined healthchecks for container. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/no-hostname.md b/versioned_docs/version-5.4.2/source/markdown/options/no-hostname.md new file mode 100644 index 000000000..cc7fef891 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/no-hostname.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, create, farm build, kube play, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/no-hosts.md b/versioned_docs/version-5.4.2/source/markdown/options/no-hosts.md new file mode 100644 index 000000000..f3d45e169 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/no-hosts.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, create, farm build, kube play, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the <>. + +Podman assumes control over the <>'s `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/no-reset.md b/versioned_docs/version-5.4.2/source/markdown/options/no-reset.md new file mode 100644 index 000000000..0a65e8f1c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/no-reset.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman pod stats, stats +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-reset** + +Do not clear the terminal/screen in between reporting intervals diff --git a/versioned_docs/version-5.4.2/source/markdown/options/no-stream.md b/versioned_docs/version-5.4.2/source/markdown/options/no-stream.md new file mode 100644 index 000000000..0f00b5df1 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/no-stream.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman pod stats, stats +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-stream** + +Disable streaming <<|pod >>stats and only pull the first result, default setting is false diff --git a/versioned_docs/version-5.4.2/source/markdown/options/no-trunc.md b/versioned_docs/version-5.4.2/source/markdown/options/no-trunc.md new file mode 100644 index 000000000..4b3d9bf0d --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/no-trunc.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman artifact ls, images +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-trunc** + +Do not truncate the output (default *false*). diff --git a/versioned_docs/version-5.4.2/source/markdown/options/noheading.md b/versioned_docs/version-5.4.2/source/markdown/options/noheading.md new file mode 100644 index 000000000..b977c5b6c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/noheading.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman artifact ls, image trust, images, machine list, network ls, pod ps, secret ls, volume ls +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--noheading**, **-n** + +Omit the table headings from the listing. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/omit-history.md b/versioned_docs/version-5.4.2/source/markdown/options/omit-history.md new file mode 100644 index 000000000..d988ff3b2 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/omit-history.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--omit-history** + +Omit build history information in the built image. (default false). + +This option is useful for the cases where end users explicitly +want to set `--omit-history` to omit the optional `History` from +built images or when working with images built using build tools that +do not include `History` information in their images. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/oom-kill-disable.md b/versioned_docs/version-5.4.2/source/markdown/options/oom-kill-disable.md new file mode 100644 index 000000000..8c7420f60 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/oom-kill-disable.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--oom-kill-disable** + +Whether to disable OOM Killer for the container or not. + +This flag is not supported on cgroups V2 systems. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/oom-score-adj.md b/versioned_docs/version-5.4.2/source/markdown/options/oom-score-adj.md new file mode 100644 index 000000000..5e279e1c4 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/oom-score-adj.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--oom-score-adj**=*num* + +Tune the host's OOM preferences for containers (accepts values from **-1000** to **1000**). + +When running in rootless mode, the specified value can't be lower than +the oom_score_adj for the current process. In this case, the +oom-score-adj is clamped to the current process value. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/os-feature.md b/versioned_docs/version-5.4.2/source/markdown/options/os-feature.md new file mode 100644 index 000000000..1a241914a --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/os-feature.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os-feature**=*feature* + +Set the name of a required operating system *feature* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS feature list is kept, if the base image specified any. This option is typically only meaningful when the image's OS is Windows. + +If *feature* has a trailing `-`, then the *feature* is removed from the set of required features which is listed in the image. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/os-version.image.md b/versioned_docs/version-5.4.2/source/markdown/options/os-version.image.md new file mode 100644 index 000000000..aac3ed43c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/os-version.image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os-version**=*version* + +Set the exact required operating system *version* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS version is kept, if the base image specified one. This option is typically only meaningful when the image's OS is Windows, and is typically set in Windows base images, so using this option is usually unnecessary. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/os-version.md b/versioned_docs/version-5.4.2/source/markdown/options/os-version.md new file mode 100644 index 000000000..0e63f0767 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/os-version.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman manifest add, manifest annotate +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os-version**=*version* + +Specify the OS version which the list or index records as a requirement for the +image. This option is rarely used. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/os.md b/versioned_docs/version-5.4.2/source/markdown/options/os.md new file mode 100644 index 000000000..8041b2aaf --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/os.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os**=*string* + +Set the OS of the image to be built, and that of the base image to be pulled, if the build uses one, instead of using the current operating system of the build host. Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/os.pull.md b/versioned_docs/version-5.4.2/source/markdown/options/os.pull.md new file mode 100644 index 000000000..41d5c68fc --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/os.pull.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os**=*OS* + +Override the OS, defaults to hosts, of the image to be pulled. For example, `windows`. +Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/passwd-entry.md b/versioned_docs/version-5.4.2/source/markdown/options/passwd-entry.md new file mode 100644 index 000000000..c30996bfe --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/passwd-entry.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--passwd-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/passwd` file within the container when `--passwd` is used. + +The variables $USERNAME, $UID, $GID, $NAME, $HOME are automatically replaced with their value at runtime. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/personality.md b/versioned_docs/version-5.4.2/source/markdown/options/personality.md new file mode 100644 index 000000000..c3904214b --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/personality.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--personality**=*persona* + +Personality sets the execution domain via Linux personality(2). diff --git a/versioned_docs/version-5.4.2/source/markdown/options/pid.container.md b/versioned_docs/version-5.4.2/source/markdown/options/pid.container.md new file mode 100644 index 000000000..37227bd80 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/pid.container.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pid**=*mode* + +Set the PID namespace mode for the container. +The default is to create a private PID namespace for the container. + +- **container:**_id_: join another container's PID namespace; +- **host**: use the host's PID namespace for the container. Note the host mode gives the container full access to local PID and is therefore considered insecure; +- **ns:**_path_: join the specified PID namespace; +- **private**: create a new namespace for the container (default). diff --git a/versioned_docs/version-5.4.2/source/markdown/options/pid.image.md b/versioned_docs/version-5.4.2/source/markdown/options/pid.image.md new file mode 100644 index 000000000..a5a7fe198 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/pid.image.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pid**=*pid* + +Sets the configuration for PID namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new PID namespace is created, or it can be "host" to indicate that the PID namespace in which `podman` itself is being run is reused, or it can be the path to a PID namespace which is already in use by another +process. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/pid.pod.md b/versioned_docs/version-5.4.2/source/markdown/options/pid.pod.md new file mode 100644 index 000000000..311e2e52c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/pid.pod.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pid**=*pid* + +Set the PID mode for the pod. The default is to create a private PID namespace for the pod. Requires the PID namespace to be shared via --share. + + host: use the host’s PID namespace for the pod + ns: join the specified PID namespace + private: create a new namespace for the pod (default) diff --git a/versioned_docs/version-5.4.2/source/markdown/options/pidfile.md b/versioned_docs/version-5.4.2/source/markdown/options/pidfile.md new file mode 100644 index 000000000..08cc30863 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/pidfile.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pidfile**=*path* + +When the pidfile location is specified, the container process' PID is written to the pidfile. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +If the pidfile option is not specified, the container process' PID is written to /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile. + +After the container is started, the location for the pidfile can be discovered with the following `podman inspect` command: + + $ podman inspect --format '{{ .PidFile }}' $CID + /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile diff --git a/versioned_docs/version-5.4.2/source/markdown/options/pids-limit.md b/versioned_docs/version-5.4.2/source/markdown/options/pids-limit.md new file mode 100644 index 000000000..6b1d0840c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/pids-limit.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pids-limit**=*limit* + +Tune the container's pids limit. Set to **-1** to have unlimited pids for the container. The default is **2048** on systems that support "pids" cgroup controller. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/platform.md b/versioned_docs/version-5.4.2/source/markdown/options/platform.md new file mode 100644 index 000000000..f1eee1d84 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/platform.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with --arch and --os) +The `--platform` option can be used to override the current architecture and operating system. +Unless overridden, subsequent lookups of the same image in the local storage matches this platform, regardless of the host. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/pod-id-file.container.md b/versioned_docs/version-5.4.2/source/markdown/options/pod-id-file.container.md new file mode 100644 index 000000000..22409ecf6 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/pod-id-file.container.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pod-id-file**=*file* + +Run container in an existing pod and read the pod's ID from the specified *file*. +When a container is run within a pod which has an infra-container, the infra-container starts first. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/pod-id-file.pod.md b/versioned_docs/version-5.4.2/source/markdown/options/pod-id-file.pod.md new file mode 100644 index 000000000..1c85c426e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/pod-id-file.pod.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman pod rm, pod start, pod stop +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pod-id-file**=*file* + +Read pod ID from the specified *file* and <> the pod. Can be specified multiple times. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/pod.run.md b/versioned_docs/version-5.4.2/source/markdown/options/pod.run.md new file mode 100644 index 000000000..e1ca33ab2 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/pod.run.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pod**=*name* + +Run container in an existing pod. Podman makes the pod automatically if the pod name is prefixed with **new:**. +To make a pod with more granular options, use the **podman pod create** command before creating a container. +When a container is run with a pod with an infra-container, the infra-container is started first. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/preserve-fd.md b/versioned_docs/version-5.4.2/source/markdown/options/preserve-fd.md new file mode 100644 index 000000000..1219742a6 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/preserve-fd.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--preserve-fd**=*FD1[,FD2,...]* + +Pass down to the process the additional file descriptors specified in the comma separated list. It can be specified multiple times. +This option is only supported with the crun OCI runtime. It might be a security risk to use this option with other OCI runtimes. + +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.4.2/source/markdown/options/preserve-fds.md b/versioned_docs/version-5.4.2/source/markdown/options/preserve-fds.md new file mode 100644 index 000000000..ba779973e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/preserve-fds.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--preserve-fds**=*N* + +Pass down to the process N additional file descriptors (in addition to 0, 1, 2). +The total FDs are 3+N. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.4.2/source/markdown/options/privileged.md b/versioned_docs/version-5.4.2/source/markdown/options/privileged.md new file mode 100644 index 000000000..cfe3ca3fa --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/privileged.md @@ -0,0 +1,28 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--privileged** + +Give extended privileges to this container. The default is **false**. + +By default, Podman containers are unprivileged (**=false**) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read-only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. +Due to the disabled security features, the privileged field should almost never +be set as containers can easily break out of confinement. + +Containers running in a user namespace (e.g., rootless containers) cannot have +more privileges than the user that launched them. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/publish-all.md b/versioned_docs/version-5.4.2/source/markdown/options/publish-all.md new file mode 100644 index 000000000..491773470 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/publish-all.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--publish-all**, **-P** + +Publish all exposed ports to random ports on the host interfaces. The default is **false**. + +When set to **true**, publish all exposed ports to the host interfaces. +If the operator uses **-P** (or **-p**) then Podman makes the +exposed port accessible on the host and the ports are available to any +client that can reach the host. + +When using this option, Podman binds any exposed port to a random port on the host +within an ephemeral port range defined by */proc/sys/net/ipv4/ip_local_port_range*. +To find the mapping between the host ports and the exposed ports, use **podman port**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/publish.md b/versioned_docs/version-5.4.2/source/markdown/options/publish.md new file mode 100644 index 000000000..abc0147f2 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/publish.md @@ -0,0 +1,31 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--publish**, **-p**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Publish a container's port, or range of ports,<<| within this pod>> to the host. + +Both *hostPort* and *containerPort* can be specified as a range of ports. +When specifying ranges for both, the number of container ports in the +range must match the number of host ports in the range. + +If host IP is set to 0.0.0.0 or not set at all, the port is bound on all IPs on the host. + +By default, Podman publishes TCP ports. To publish a UDP port instead, give +`udp` as protocol. To publish both TCP and UDP ports, set `--publish` twice, +with `tcp`, and `udp` as protocols respectively. Rootful containers can also +publish ports using the `sctp` protocol. + +Host port does not have to be specified (e.g. `podman run -p 127.0.0.1::80`). +If it is not, the container port is randomly assigned a port on the host. + +Use **podman port** to see the actual mapping: `podman port $CONTAINER $CONTAINERPORT`. + +Note that the network drivers `macvlan` and `ipvlan` do not support port forwarding, +it will have no effect on these networks. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/pull.image.md b/versioned_docs/version-5.4.2/source/markdown/options/pull.image.md new file mode 100644 index 000000000..d31295641 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/pull.image.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Only pull the image when it does not exist in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error when no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/pull.md b/versioned_docs/version-5.4.2/source/markdown/options/pull.md new file mode 100644 index 000000000..b6e94f9cf --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/pull.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Pull the image only when the image is not in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error if no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/quiet.md b/versioned_docs/version-5.4.2/source/markdown/options/quiet.md new file mode 100644 index 000000000..d03f2f6d8 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/quiet.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--quiet**, **-q** + +Suppress output messages which indicate which instruction is being processed, and of progress when pulling images from a registry, and when writing the output image. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/rdt-class.md b/versioned_docs/version-5.4.2/source/markdown/options/rdt-class.md new file mode 100644 index 000000000..241978121 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/rdt-class.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--rdt-class**=*intel-rdt-class-of-service* + +Rdt-class sets the class of service (CLOS or COS) for the container to run in. Based on the Cache Allocation Technology (CAT) feature that is part of Intel's Resource Director Technology (RDT) feature set, all container processes will run within the pre-configured COS, representing a part of the cache. The COS has to be created and configured using a pseudo file system (usually mounted at `/sys/fs/resctrl`) that the resctrl kernel driver provides. Assigning the container to a COS requires root privileges and thus doesn't work in a rootless environment. Currently, the feature is only supported using `runc` as a runtime. See for more details on creating a COS before a container can be assigned to it. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/read-only-tmpfs.md b/versioned_docs/version-5.4.2/source/markdown/options/read-only-tmpfs.md new file mode 100644 index 000000000..da1234fa9 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/read-only-tmpfs.md @@ -0,0 +1,31 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--read-only-tmpfs** + +When running --read-only containers, mount a read-write tmpfs on _/dev_, _/dev/shm_, _/run_, _/tmp_, and _/var/tmp_. The default is **true**. + +| --read-only | --read-only-tmpfs | / | /run, /tmp, /var/tmp| +| ----------- | ----------------- | ---- | ----------------------------------- | +| true | true | r/o | r/w | +| true | false | r/o | r/o | +| false | false | r/w | r/w | +| false | true | r/w | r/w | + +When **--read-only=true** and **--read-only-tmpfs=true** additional tmpfs are mounted on +the /tmp, /run, and /var/tmp directories. + +When **--read-only=true** and **--read-only-tmpfs=false** /dev and /dev/shm are marked +Read/Only and no tmpfs are mounted on /tmp, /run and /var/tmp. The directories +are exposed from the underlying image, meaning they are read-only by default. +This makes the container totally read-only. No writable directories exist within +the container. In this mode writable directories need to be added via external +volumes or mounts. + +By default, when **--read-only=false**, the /dev and /dev/shm are read/write, and the /tmp, /run, and /var/tmp are read/write directories from the container image. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/read-only.md b/versioned_docs/version-5.4.2/source/markdown/options/read-only.md new file mode 100644 index 000000000..37eebfe76 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/read-only.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--read-only** + +Mount the container's root filesystem as read-only. + +By default, container root filesystems are writable, allowing processes +to write files anywhere. By specifying the **--read-only** flag, the containers root filesystem are mounted read-only prohibiting any writes. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/replace.md b/versioned_docs/version-5.4.2/source/markdown/options/replace.md new file mode 100644 index 000000000..0d60f93e5 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/replace.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--replace** + +If another <> with the same name already exists, replace and remove it. The default is **false**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/requires.md b/versioned_docs/version-5.4.2/source/markdown/options/requires.md new file mode 100644 index 000000000..b7b703fa4 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/requires.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--requires**=*container* + +Specify one or more requirements. +A requirement is a dependency container that is started before this container. +Containers can be specified by name or ID, with multiple containers being separated by commas. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/restart.md b/versioned_docs/version-5.4.2/source/markdown/options/restart.md new file mode 100644 index 000000000..3c5b05ecb --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/restart.md @@ -0,0 +1,27 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). diff --git a/versioned_docs/version-5.4.2/source/markdown/options/retry-delay.md b/versioned_docs/version-5.4.2/source/markdown/options/retry-delay.md new file mode 100644 index 000000000..1ba30d244 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/retry-delay.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, build, create, farm build, pull, push, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/retry.md b/versioned_docs/version-5.4.2/source/markdown/options/retry.md new file mode 100644 index 000000000..3c1693977 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/retry.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, build, create, farm build, pull, push, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/rm.md b/versioned_docs/version-5.4.2/source/markdown/options/rm.md new file mode 100644 index 000000000..cb6035cae --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/rm.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--rm** + +Remove intermediate containers after a successful build (default true). diff --git a/versioned_docs/version-5.4.2/source/markdown/options/rootfs.md b/versioned_docs/version-5.4.2/source/markdown/options/rootfs.md new file mode 100644 index 000000000..29cf3e175 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/rootfs.md @@ -0,0 +1,39 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--rootfs** + +If specified, the first argument refers to an exploded container on the file system. + +This is useful to run a container without requiring any image management, the rootfs +of the container is assumed to be managed externally. + + `Overlay Rootfs Mounts` + + The `\:O` flag tells Podman to mount the directory from the rootfs path as +storage using the `overlay file system`. The container processes +can modify content within the mount point which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +Note: On **SELinux** systems, the rootfs needs the correct label, which is by default +**unconfined_u:object_r:container_file_t\\:s0**. + + `idmap` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. +The idmap option supports a custom mapping that can be different than the user +namespace used by the container. The mapping can be specified after the idmap +option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the +first value is the start of the backing file system IDs that are mapped to the +second value on the host. The length of this mapping is given in the third value. +Multiple ranges are separated with #. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/runtime-flag.md b/versioned_docs/version-5.4.2/source/markdown/options/runtime-flag.md new file mode 100644 index 000000000..5c540430d --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/runtime-flag.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--runtime-flag**=*flag* + +Adds global flags for the container runtime. To list the supported flags, please consult the manpages of the selected container runtime. + +Note: Do not pass the leading -- to the flag. To pass the runc flag --log-format json to buildah build, the option given is --runtime-flag log-format=json. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/runtime.md b/versioned_docs/version-5.4.2/source/markdown/options/runtime.md new file mode 100644 index 000000000..d59389165 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/runtime.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--runtime**=*path* + +The *path* to an alternate OCI-compatible runtime, which is used to run +commands specified by the **RUN** instruction. + +Note: You can also override the default runtime by setting the BUILDAH\_RUNTIME environment variable. `export BUILDAH_RUNTIME=/usr/local/bin/runc` diff --git a/versioned_docs/version-5.4.2/source/markdown/options/sbom-image-output.md b/versioned_docs/version-5.4.2/source/markdown/options/sbom-image-output.md new file mode 100644 index 000000000..9886763b2 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/sbom-image-output.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-image-output**=*path* + +When generating SBOMs, store the generated SBOM in the specified path in the +output image. There is no default. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/sbom-image-purl-output.md b/versioned_docs/version-5.4.2/source/markdown/options/sbom-image-purl-output.md new file mode 100644 index 000000000..a66e75ecf --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/sbom-image-purl-output.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-image-purl-output**=*path* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the specified path in the output +image. There is no default. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/sbom-merge-strategy.md b/versioned_docs/version-5.4.2/source/markdown/options/sbom-merge-strategy.md new file mode 100644 index 000000000..8bb86f630 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/sbom-merge-strategy.md @@ -0,0 +1,29 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-merge-strategy**=*method* + +If more than one **--sbom-scanner-command** value is being used, use the +specified method to merge the output from later commands with output from +earlier commands. Recognized values include: + + - cat + Concatenate the files. + - merge-cyclonedx-by-component-name-and-version + Merge the "component" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "version" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + - merge-spdx-by-package-name-and-versioninfo + Merge the "package" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "versionInfo" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/sbom-output.md b/versioned_docs/version-5.4.2/source/markdown/options/sbom-output.md new file mode 100644 index 000000000..9c9f6f9eb --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/sbom-output.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-output**=*file* + +When generating SBOMs, store the generated SBOM in the named file on the local +filesystem. There is no default. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/sbom-purl-output.md b/versioned_docs/version-5.4.2/source/markdown/options/sbom-purl-output.md new file mode 100644 index 000000000..db6718a25 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/sbom-purl-output.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-purl-output**=*file* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the named file in the local +filesystem. There is no default. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/sbom-scanner-command.md b/versioned_docs/version-5.4.2/source/markdown/options/sbom-scanner-command.md new file mode 100644 index 000000000..1dca20e54 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/sbom-scanner-command.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-scanner-command**=*image* + +Generate SBOMs by running the specified command from the scanner image. If +multiple commands are specified, they are run in the order in which they are +specified. These text substitutions are performed: + - {ROOTFS} + The root of the built image's filesystem, bind mounted. + - {CONTEXT} + The build context and additional build contexts, bind mounted. + - {OUTPUT} + The name of a temporary output file, to be read and merged with others or copied elsewhere. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/sbom-scanner-image.md b/versioned_docs/version-5.4.2/source/markdown/options/sbom-scanner-image.md new file mode 100644 index 000000000..22a998ba9 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/sbom-scanner-image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-scanner-image**=*image* + +Generate SBOMs using the specified scanner image. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/sbom.md b/versioned_docs/version-5.4.2/source/markdown/options/sbom.md new file mode 100644 index 000000000..4718b7ad6 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/sbom.md @@ -0,0 +1,38 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom**=*preset* + +Generate SBOMs (Software Bills Of Materials) for the output image by scanning +the working container and build contexts using the named combination of scanner +image, scanner commands, and merge strategy. Must be specified with one or +more of **--sbom-image-output**, **--sbom-image-purl-output**, **--sbom-output**, +and **--sbom-purl-output**. Recognized presets, and the set of options which +they equate to: + + - "syft", "syft-cyclonedx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output cyclonedx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output cyclonedx-json={OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "syft-spdx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output spdx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output spdx-json={OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + - "trivy", "trivy-cyclonedx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "trivy-spdx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo diff --git a/versioned_docs/version-5.4.2/source/markdown/options/sdnotify.md b/versioned_docs/version-5.4.2/source/markdown/options/sdnotify.md new file mode 100644 index 000000000..28f71db37 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/sdnotify.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sdnotify**=**container** | *conmon* | *healthy* | *ignore* + +Determines how to use the NOTIFY_SOCKET, as passed with systemd and Type=notify. + +Default is **container**, which means allow the OCI runtime to proxy the socket into the +container to receive ready notification. Podman sets the MAINPID to conmon's pid. +The **conmon** option sets MAINPID to conmon's pid, and sends READY when the container +has started. The socket is never passed to the runtime or the container. +The **healthy** option sets MAINPID to conmon's pid, and sends READY when the container +has turned healthy; requires a healthcheck to be set. The socket is never passed to the runtime or the container. +The **ignore** option removes NOTIFY_SOCKET from the environment for itself and child processes, +for the case where some other process above Podman uses NOTIFY_SOCKET and Podman does not use it. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/seccomp-policy.md b/versioned_docs/version-5.4.2/source/markdown/options/seccomp-policy.md new file mode 100644 index 000000000..b0b1a278e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/seccomp-policy.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--seccomp-policy**=*policy* + +Specify the policy to select the seccomp profile. If set to *image*, Podman looks for a "io.containers.seccomp.profile" label in the container-image config and use its value as a seccomp profile. Otherwise, Podman follows the *default* policy by applying the default profile unless specified otherwise via *--security-opt seccomp* as described below. + +Note that this feature is experimental and may change in the future. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/secret.image.md b/versioned_docs/version-5.4.2/source/markdown/options/secret.image.md new file mode 100644 index 000000000..414424529 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/secret.image.md @@ -0,0 +1,28 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--secret**=**id=id[,src=*envOrFile*][,env=*ENV*][,type=*file* | *env*]** + +Pass secret information to be used in the Containerfile for building images +in a safe way that will not end up stored in the final image, or be seen in other stages. +The value of the secret will be read from an environment variable or file named +by the "id" option, or named by the "src" option if it is specified, or from an +environment variable specified by the "env" option. See [EXAMPLES](#examples). +The secret will be mounted in the container at `/run/secrets/id` by default. + +To later use the secret, use the --mount flag in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret` + +The location of the secret in the container can be overridden using the +"target", "dst", or "destination" option of the `RUN --mount` flag. + +`RUN --mount=type=secret,id=mysecret,target=/run/secrets/myothersecret cat /run/secrets/myothersecret` + +Note: changing the contents of secret files will not trigger a rebuild of layers that use said secrets. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/secret.md b/versioned_docs/version-5.4.2/source/markdown/options/secret.md new file mode 100644 index 000000000..c44312512 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/secret.md @@ -0,0 +1,59 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--secret**=*secret[,opt=opt ...]* + +Give the container access to a secret. Can be specified multiple times. + +A secret is a blob of sensitive data which a container needs at runtime but +is not stored in the image or in source control, such as usernames and passwords, +TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 500 kb in size). + +When secrets are specified as type `mount`, the secrets are copied and mounted into the container when a container is created. +When secrets are specified as type `env`, the secret is set as an environment variable within the container. +Secrets are written in the container at the time of container creation, and modifying the secret using `podman secret` commands +after the container is created affects the secret inside the container. + +Secrets and its storage are managed using the `podman secret` command. + +Secret Options + +- `type=mount|env` : How the secret is exposed to the container. + `mount` mounts the secret into the container as a file. + `env` exposes the secret as an environment variable. + Defaults to `mount`. +- `target=target` : Target of secret. + For mounted secrets, this is the path to the secret inside the container. + If a fully qualified path is provided, the secret is mounted at that location. + Otherwise, the secret is mounted to + `/run/secrets/target` for linux containers or + `/var/run/secrets/target` for freebsd containers. + If the target is not set, the secret is mounted to `/run/secrets/secretname` by default. + For env secrets, this is the environment variable key. Defaults to `secretname`. +- `uid=0` : UID of secret. Defaults to 0. Mount secret type only. +- `gid=0` : GID of secret. Defaults to 0. Mount secret type only. +- `mode=0` : Mode of secret. Defaults to 0444. Mount secret type only. + + +Examples + +Mount at `/my/location/mysecret` with UID 1: +``` +--secret mysecret,target=/my/location/mysecret,uid=1 +``` + +Mount at `/run/secrets/customtarget` with mode 0777: +``` +--secret mysecret,target=customtarget,mode=0777 +``` + +Create a secret environment variable called `ENVSEC`: +``` +--secret mysecret,type=env,target=ENVSEC +``` diff --git a/versioned_docs/version-5.4.2/source/markdown/options/security-opt.image.md b/versioned_docs/version-5.4.2/source/markdown/options/security-opt.image.md new file mode 100644 index 000000000..ec336b81b --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/security-opt.image.md @@ -0,0 +1,27 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--security-opt**=*option* + +Security Options + +- `apparmor=unconfined` : Turn off apparmor confinement for the container +- `apparmor=alternate-profile` : Set the apparmor confinement profile for the +container + +- `label=user:USER` : Set the label user for the container processes +- `label=role:ROLE` : Set the label role for the container processes +- `label=type:TYPE` : Set the label process type for the container processes +- `label=level:LEVEL` : Set the label level for the container processes +- `label=filetype:TYPE` : Set the label file type for the container files +- `label=disable` : Turn off label separation for the container +- `no-new-privileges` : Not supported + +- `seccomp=unconfined` : Turn off seccomp confinement for the container +- `seccomp=profile.json` : JSON file to be used as the seccomp filter for the container. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/security-opt.md b/versioned_docs/version-5.4.2/source/markdown/options/security-opt.md new file mode 100644 index 000000000..8576f77d3 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/security-opt.md @@ -0,0 +1,41 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the <> +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the <> + +- **label=user:**_USER_: Set the label user for the <> processes +- **label=role:**_ROLE_: Set the label role for the <> processes +- **label=type:**_TYPE_: Set the label process type for the <> processes +- **label=level:**_LEVEL_: Set the label level for the <> processes +- **label=filetype:**_TYPE_: Set the label file type for the <> files +- **label=disable**: Turn off label separation for the <> + +Note: Labeling can be disabled for all <<|pods/>>containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the container<>. + +- **no-new-privileges**: Disable container processes from gaining additional privileges. + +- **seccomp=unconfined**: Turn off seccomp confinement for the <>. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/shm-size-systemd.md b/versioned_docs/version-5.4.2/source/markdown/options/shm-size-systemd.md new file mode 100644 index 000000000..e59a2f43c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/shm-size-systemd.md @@ -0,0 +1,15 @@ +--- +title: of +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/shm-size.md b/versioned_docs/version-5.4.2/source/markdown/options/shm-size.md new file mode 100644 index 000000000..a06e58b6a --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/shm-size.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, create, farm build, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the <>. +This option conflicts with **--ipc=host**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/sig-proxy.md b/versioned_docs/version-5.4.2/source/markdown/options/sig-proxy.md new file mode 100644 index 000000000..9d111318d --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/sig-proxy.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman attach, run, start +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sig-proxy** + +Proxy received signals to the container process. SIGCHLD, SIGURG, SIGSTOP, and SIGKILL are not proxied. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/sign-by-sigstore.md b/versioned_docs/version-5.4.2/source/markdown/options/sign-by-sigstore.md new file mode 100644 index 000000000..63cceaddf --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/sign-by-sigstore.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman artifact push, manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sign-by-sigstore**=*param-file* + +Add a sigstore signature based on further options specified in a container's sigstore signing parameter file *param-file*. +See containers-sigstore-signing-params.yaml(5) for details about the file format. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/sign-passphrase-file.md b/versioned_docs/version-5.4.2/source/markdown/options/sign-passphrase-file.md new file mode 100644 index 000000000..5410d113c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/sign-passphrase-file.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman artifact push, manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sign-passphrase-file**=*path* + +If signing the image (using either **--sign-by** or **--sign-by-sigstore-private-key**), read the passphrase to use from the specified path. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/signal.md b/versioned_docs/version-5.4.2/source/markdown/options/signal.md new file mode 100644 index 000000000..a676ee2a5 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/signal.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman kill, pod kill +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--signal**, **-s**=**signal** + +Signal to send to the container<<|s in the pod>>. For more information on Linux signals, refer to *signal(7)*. +The default is **SIGKILL**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/since.md b/versioned_docs/version-5.4.2/source/markdown/options/since.md new file mode 100644 index 000000000..49f4fb9d1 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/since.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--since**=*TIMESTAMP* + +Show logs since TIMESTAMP. The --since option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/skip-unused-stages.md b/versioned_docs/version-5.4.2/source/markdown/options/skip-unused-stages.md new file mode 100644 index 000000000..8d520b826 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/skip-unused-stages.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--skip-unused-stages** + +Skip stages in multi-stage builds which don't affect the target stage. (Default: **true**). diff --git a/versioned_docs/version-5.4.2/source/markdown/options/squash-all.md b/versioned_docs/version-5.4.2/source/markdown/options/squash-all.md new file mode 100644 index 000000000..be27f42d6 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/squash-all.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--squash-all** + +Squash all of the new image's layers (including those inherited from a base image) into a single new layer. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/squash.md b/versioned_docs/version-5.4.2/source/markdown/options/squash.md new file mode 100644 index 000000000..ccce4f8ec --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/squash.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--squash** + +Squash all of the image's new layers into a single new layer; any preexisting layers are not squashed. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/ssh.md b/versioned_docs/version-5.4.2/source/markdown/options/ssh.md new file mode 100644 index 000000000..c9b29ce3e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/ssh.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ssh**=*default* | *id[=socket>* + +SSH agent socket or keys to expose to the build. +The socket path can be left empty to use the value of `default=$SSH_AUTH_SOCK` + +To later use the ssh agent, use the --mount option in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=ssh,id=id mycmd` diff --git a/versioned_docs/version-5.4.2/source/markdown/options/stop-signal.md b/versioned_docs/version-5.4.2/source/markdown/options/stop-signal.md new file mode 100644 index 000000000..902b0bd8c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/stop-signal.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--stop-signal**=*signal* + +Signal to stop a container. Default is **SIGTERM**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/stop-timeout.md b/versioned_docs/version-5.4.2/source/markdown/options/stop-timeout.md new file mode 100644 index 000000000..dfe2105bd --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/stop-timeout.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--stop-timeout**=*seconds* + +Timeout to stop a container. Default is **10**. +Remote connections use local containers.conf for defaults. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/subgidname.md b/versioned_docs/version-5.4.2/source/markdown/options/subgidname.md new file mode 100644 index 000000000..8c198bc66 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/subgidname.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/subuidname.md b/versioned_docs/version-5.4.2/source/markdown/options/subuidname.md new file mode 100644 index 000000000..589a93191 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/subuidname.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/sysctl.md b/versioned_docs/version-5.4.2/source/markdown/options/sysctl.md new file mode 100644 index 000000000..e77bc7672 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/sysctl.md @@ -0,0 +1,30 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters <>. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: <>, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: <>, the above sysctls are not allowed. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/systemd.md b/versioned_docs/version-5.4.2/source/markdown/options/systemd.md new file mode 100644 index 000000000..af9dcae0c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/systemd.md @@ -0,0 +1,42 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--systemd**=*true* | *false* | *always* + +Run container in systemd mode. The default is **true**. + +- **true** enables systemd mode only when the command executed inside the container is *systemd*, */usr/sbin/init*, +*/sbin/init* or */usr/local/sbin/init*. + +- **false** disables systemd mode. + +- **always** enforces the systemd mode to be enabled. + +Running the container in systemd mode causes the following changes: + +* Podman mounts tmpfs file systems on the following directories + * _/run_ + * _/run/lock_ + * _/tmp_ + * _/sys/fs/cgroup/systemd_ (on a cgroup v1 system) + * _/var/lib/journal_ +* Podman sets the default stop signal to **SIGRTMIN+3**. +* Podman sets **container_uuid** environment variable in the container to the +first 32 characters of the container ID. +* Podman does not mount virtual consoles (_/dev/tty\d+_) when running with **--privileged**. +* On cgroup v2, */sys/fs/cgroup* is mounted writeable. + +This allows systemd to run in a confined container without any modifications. + +Note that on **SELinux** systems, systemd attempts to write to the cgroup +file system. Containers writing to the cgroup file system are denied by default. +The **container_manage_cgroup** boolean must be enabled for this to be allowed on an SELinux separated system. +``` +setsebool -P container_manage_cgroup true +``` diff --git a/versioned_docs/version-5.4.2/source/markdown/options/tag.md b/versioned_docs/version-5.4.2/source/markdown/options/tag.md new file mode 100644 index 000000000..c8907c9ea --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/tag.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tag**, **-t**=*imageName* + +Specifies the name which is assigned to the resulting image if the build process completes successfully. +If _imageName_ does not include a registry name, the registry name *localhost* is prepended to the image name. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/tail.md b/versioned_docs/version-5.4.2/source/markdown/options/tail.md new file mode 100644 index 000000000..6b0d861b0 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/tail.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tail**=*LINES* + +Output the specified number of LINES at the end of the logs. LINES must be an integer. Defaults to -1, +which prints all lines diff --git a/versioned_docs/version-5.4.2/source/markdown/options/target.md b/versioned_docs/version-5.4.2/source/markdown/options/target.md new file mode 100644 index 000000000..162aee3b1 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/target.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--target**=*stageName* + +Set the target build stage to build. When building a Containerfile with multiple build stages, --target can be used to specify an intermediate build stage by name as the final stage for the resulting image. Commands after the target stage is skipped. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/time.md b/versioned_docs/version-5.4.2/source/markdown/options/time.md new file mode 100644 index 000000000..094df8985 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/time.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman pod rm, pod stop, restart, rm, stop +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping <>. +Use -1 for infinite wait. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/timeout.md b/versioned_docs/version-5.4.2/source/markdown/options/timeout.md new file mode 100644 index 000000000..b63e7c0c4 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/timeout.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--timeout**=*seconds* + +Maximum time a container is allowed to run before conmon sends it the kill +signal. By default containers run until they exit or are stopped by +`podman stop`. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/timestamp.md b/versioned_docs/version-5.4.2/source/markdown/options/timestamp.md new file mode 100644 index 000000000..ee5585fb9 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/timestamp.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--timestamp**=*seconds* + +Set the create timestamp to seconds since epoch to allow for deterministic builds (defaults to current time). By default, the created timestamp is changed and written into the image manifest with every commit, causing the image's sha256 hash to be different even if the sources are exactly the same otherwise. +When --timestamp is set, the created timestamp is always set to the time specified and therefore not changed, allowing the image's sha256 hash to remain the same. All files committed to the layers of the image is created with the timestamp. + +If the only instruction in a Containerfile is `FROM`, this flag has no effect. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/timestamps.md b/versioned_docs/version-5.4.2/source/markdown/options/timestamps.md new file mode 100644 index 000000000..a0d4c2071 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/timestamps.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--timestamps**, **-t** + +Show timestamps in the log outputs. The default is false diff --git a/versioned_docs/version-5.4.2/source/markdown/options/tls-verify.md b/versioned_docs/version-5.4.2/source/markdown/options/tls-verify.md new file mode 100644 index 000000000..ee2de338d --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/tls-verify.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, auto update, build, container runlabel, create, farm build, kube play, login, manifest add, manifest create, manifest inspect, manifest push, pull, push, run, search +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/options/tmpfs.md b/versioned_docs/version-5.4.2/source/markdown/options/tmpfs.md new file mode 100644 index 000000000..849c83ad0 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/tmpfs.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tmpfs**=*fs* + +Create a tmpfs mount. + +Mount a temporary filesystem (**tmpfs**) mount into a container, for example: + +``` +$ podman <> -d --tmpfs /tmp\:rw,size=787448k,mode=1777 my_image +``` + +This command mounts a **tmpfs** at _/tmp_ within the container. The supported mount +options are the same as the Linux default mount flags. If no options are specified, +the system uses the following options: +**rw,noexec,nosuid,nodev**. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/tty.md b/versioned_docs/version-5.4.2/source/markdown/options/tty.md new file mode 100644 index 000000000..d1479e8e7 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/tty.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tty**, **-t** + +Allocate a pseudo-TTY. The default is **false**. + +When set to **true**, Podman allocates a pseudo-tty and attach to the standard +input of the container. This can be used, for example, to run a throwaway +interactive shell. + +**NOTE**: The --tty flag prevents redirection of standard output. It combines STDOUT and STDERR, it can insert control characters, and it can hang pipes. This option is only used when run interactively in a terminal. When feeding input to Podman, use -i only, not -it. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/tz.md b/versioned_docs/version-5.4.2/source/markdown/options/tz.md new file mode 100644 index 000000000..8d998053f --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/tz.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tz**=*timezone* + +Set timezone in container. This flag takes area-based timezones, GMT time, as well as `local`, which sets the timezone in the container to match the host machine. See `/usr/share/zoneinfo/` for valid timezones. +Remote connections use local containers.conf for defaults diff --git a/versioned_docs/version-5.4.2/source/markdown/options/uidmap.container.md b/versioned_docs/version-5.4.2/source/markdown/options/uidmap.container.md new file mode 100644 index 000000000..dd1d03564 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/uidmap.container.md @@ -0,0 +1,201 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uidmap**=*[flags]container_uid\:from_uid[\\:amount]* + +Run the container in a new user namespace using the supplied UID mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +The possible values of the optional *flags* are discussed further down on this page. +The *amount* value is optional and assumed to be **1** if not given. + +The *from_uid* value is based upon the user running the command, either rootful or rootless users. + +* rootful user: [*flags*]*container_uid*:*host_uid*[:*amount*] +* rootless user: [*flags*]*container_uid*:*intermediate_uid*[:*amount*] + + `Rootful mappings` + + +When **podman <>** is called by a privileged user, the option **--uidmap** +works as a direct mapping between host UIDs and container UIDs. + +host UID -> container UID + +The _amount_ specifies the number of consecutive UIDs that is mapped. +If for example _amount_ is **4** the mapping looks like: + +| host UID | container UID | +| ---------- | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | + + `Rootless mappings` + +When **podman <>** is called by an unprivileged user (i.e. running rootless), +the value *from_uid* is interpreted as an "intermediate UID". In the rootless +case, host UIDs are not mapped directly to container UIDs. Instead the mapping +happens over two mapping steps: + +host UID -> intermediate UID -> container UID + +The **--uidmap** option only influences the second mapping step. + +The first mapping step is derived by Podman from the contents of the file +_/etc/subuid_ and the UID of the user calling Podman. + +First mapping step: + +| host UID | intermediate UID | +| -------- | ---------------- | +| UID for Podman user | 0 | +| 1st subordinate UID | 1 | +| 2nd subordinate UID | 2 | +| 3rd subordinate UID | 3 | +| nth subordinate UID | n | + +To be able to use intermediate UIDs greater than zero, the user needs to have +subordinate UIDs configured in _/etc/subuid_. See **subuid**(5). + +The second mapping step is configured with **--uidmap**. + +If for example _amount_ is **5** the second mapping step looks like: + +| intermediate UID | container UID | +| ------------------ | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | +| *from_uid* + 4 | *container_uid* + 4 | + +When running as rootless, Podman uses all the ranges configured in the _/etc/subuid_ file. + +The current user ID is mapped to UID=0 in the rootless user namespace. +Every additional range is added sequentially afterward: + +| host | rootless user namespace | length | +| ------ | ----------------------- | ------ | +| $UID | 0 | 1 | +| 1 | $FIRST_RANGE_ID | $FIRST_RANGE_LENGTH | +| 1+$FIRST_RANGE_LENGTH | $SECOND_RANGE_ID | $SECOND_RANGE_LENGTH| + + `Referencing a host ID from the parent namespace` + +As a rootless user, the given host ID in **--uidmap** or **--gidmap** +is mapped from the *intermediate namespace* generated by Podman. Sometimes +it is desirable to refer directly at the *host namespace*. It is possible +to manually do so, by running `podman unshare cat /proc/self/gid_map`, +finding the desired host id at the second column of the output, and getting +the corresponding intermediate id from the first column. + +Podman can perform all that by preceding the host id in the mapping +with the `@` symbol. For instance, by specifying `--gidmap 100000:@2000:1`, +podman will look up the intermediate id corresponding to host id `2000` and +it will map the found intermediate id to the container id `100000`. The +given host id must have been subordinated (otherwise it would not be mapped +into the intermediate space in the first place). + +If the length is greater than one, for instance with `--gidmap 100000:@2000:2`, +Podman will map host ids `2000` and `2001` to `100000` and `100001`, respectively, +regardless of how the intermediate mapping is defined. + + `Extending previous mappings` + +Some mapping modifications may be cumbersome. For instance, a user +starts with a mapping such as `--gidmap="0:0:65000"`, that needs to be +changed such as the parent id `1000` is mapped to container id `100000` +instead, leaving container id `1` unassigned. The corresponding `--gidmap` +becomes `--gidmap="0:0:1" --gidmap="2:2:65534" --gidmap="100000:1:1"`. + +This notation can be simplified using the `+` flag, that takes care of +breaking previous mappings removing any conflicting assignment with +the given mapping. The flag is given before the container id +as follows: `--gidmap="0:0:65000" --gidmap="+100000:1:1"` + + + Flag | Example | Description +-----------|---------------|------------- + `+` | `+100000:1:1` | Extend the previous mapping + +This notation leads to gaps in the assignment, so it may be convenient to +fill those gaps afterwards: `--gidmap="0:0:65000" --gidmap="+100000:1:1" --gidmap="1:65001:1"` + +One specific use case for this flag is in the context of rootless +users. A rootless user may specify mappings with the `+` flag as +in `--gidmap="+100000:1:1"`. Podman will then "fill the gaps" starting +from zero with all the remaining intermediate ids. This is convenient when +a user wants to map a specific intermediate id to a container id, leaving +the rest of subordinate ids to be mapped by Podman at will. + + `Passing only one of --uidmap or --gidmap` + +Usually, subordinated user and group ids are assigned simultaneously, and +for any user the subordinated user ids match the subordinated group ids. +For convenience, if only one of **--uidmap** or **--gidmap** is given, +podman assumes the mapping refers to both UIDs and GIDs and applies the +given mapping to both. If only one value of the two needs to be changed, +the mappings should include the `u` or the `g` flags to specify that +they only apply to UIDs or GIDs and should not be copied over. + + flag | Example | Description +---------|-----------------|----------------- + `u` | `u20000:2000:1` |The mapping only applies to UIDs + `g` | `g10000:1000:1` |The mapping only applies to GIDs + +For instance given the command + + podman <> --gidmap "0:0:1000" --gidmap "g2000:2000:1" + +Since no **--uidmap** is given, the **--gidmap** is copied to **--uidmap**, +giving a command equivalent to + + podman <> --gidmap "0:0:1000" --gidmap "2000:2000:1" --uidmap "0:0:1000" + +The `--gidmap "g2000:2000:1"` used the `g` flag and therefore it was +not copied to **--uidmap**. + + `Rootless mapping of additional host GIDs` + +A rootless user may desire to map a specific host group that has already been +subordinated within _/etc/subgid_ without specifying the rest of the mapping. + +This can be done with **--gidmap "+g*container_gid*:@*host_gid*"** + +Where: + +- The host GID is given through the `@` symbol +- The mapping of this GID is not copied over to **--usermap** thanks to the `g` flag. +- The rest of the container IDs will be mapped starting from 0 to n, + with all the remaining subordinated GIDs, thanks to the `+` flag. + +For instance, if a user belongs to the group `2000` and that group is +subordinated to that user (with `usermod --add-subgids 2000-2000 $USER`), +the user can map the group into the container with: **--gidmap=+g100000:@2000**. + +If this mapping is combined with the option, **--group-add=keep-groups**, the +process in the container will belong to group `100000`, and files belonging +to group `2000` in the host will appear as being owned by group `100000` +inside the container. + + podman run --group-add=keep-groups --gidmap="+g100000:@2000" ... + + `No subordinate UIDs` + +Even if a user does not have any subordinate UIDs in _/etc/subuid_, +**--uidmap** can be used to map the normal UID of the user to a +container UID by running `podman <> --uidmap $container_uid:0:1 --user $container_uid ...`. + + `Pods` + +The **--uidmap** option cannot be called in conjunction with the **--pod** option as a uidmap cannot be set on the container level when in a pod. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/uidmap.pod.md b/versioned_docs/version-5.4.2/source/markdown/options/uidmap.pod.md new file mode 100644 index 000000000..d472321f7 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/uidmap.pod.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uidmap**=*container_uid\:from_uid\\:amount* + +Run all containers in the pod in a new user namespace using the supplied mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/ulimit.image.md b/versioned_docs/version-5.4.2/source/markdown/options/ulimit.image.md new file mode 100644 index 000000000..4c8a390fe --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/ulimit.image.md @@ -0,0 +1,27 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ulimit**=*type=soft-limit[\\:hard-limit]* + +Specifies resource limits to apply to processes launched when processing `RUN` instructions. This option can be specified multiple times. Recognized resource types include: + "core": maximum core dump size (ulimit -c) + "cpu": maximum CPU time (ulimit -t) + "data": maximum size of a process's data segment (ulimit -d) + "fsize": maximum size of new files (ulimit -f) + "locks": maximum number of file locks (ulimit -x) + "memlock": maximum amount of locked memory (ulimit -l) + "msgqueue": maximum amount of data in message queues (ulimit -q) + "nice": niceness adjustment (nice -n, ulimit -e) + "nofile": maximum number of open files (ulimit -n) + "nproc": maximum number of processes (ulimit -u) + "rss": maximum size of a process's (ulimit -m) + "rtprio": maximum real-time scheduling priority (ulimit -r) + "rttime": maximum amount of real-time execution between blocking syscalls + "sigpending": maximum number of pending signals (ulimit -i) + "stack": maximum stack size (ulimit -s) diff --git a/versioned_docs/version-5.4.2/source/markdown/options/ulimit.md b/versioned_docs/version-5.4.2/source/markdown/options/ulimit.md new file mode 100644 index 000000000..adb3facac --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/ulimit.md @@ -0,0 +1,33 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ulimit**=*option* + +Ulimit options. Sets the ulimits values inside of the container. + +--ulimit with a soft and hard limit in the format =[:]. For example: + +$ podman run --ulimit nofile=1024:1024 --rm ubi9 ulimit -n +1024 + +Set -1 for the soft or hard limit to set the limit to the maximum limit of the current +process. In rootful mode this is often unlimited. + + +If nofile and nproc are unset, a default value of 1048576 will be used, unless overridden +in containers.conf(5). However, if the default value exceeds the hard limit for the current +rootless user, the current hard limit will be applied instead. + +Use **host** to copy the current configuration from the host. + +Don't use nproc with the ulimit flag as Linux uses nproc to set the +maximum number of processes available to a user, not to a container. + +Use the --pids-limit option to modify the cgroup control to limit the number +of processes within a container. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/umask.md b/versioned_docs/version-5.4.2/source/markdown/options/umask.md new file mode 100644 index 000000000..b76d7747d --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/umask.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--umask**=*umask* + +Set the umask inside the container. Defaults to `0022`. +Remote connections use local containers.conf for defaults diff --git a/versioned_docs/version-5.4.2/source/markdown/options/unsetenv-all.md b/versioned_docs/version-5.4.2/source/markdown/options/unsetenv-all.md new file mode 100644 index 000000000..4fdbfc56d --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/unsetenv-all.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetenv-all** + +Unset all default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/unsetenv.image.md b/versioned_docs/version-5.4.2/source/markdown/options/unsetenv.image.md new file mode 100644 index 000000000..dc7c36eff --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/unsetenv.image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetenv**=*env* + +Unset environment variables from the final image. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/unsetenv.md b/versioned_docs/version-5.4.2/source/markdown/options/unsetenv.md new file mode 100644 index 000000000..782ada9fd --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/unsetenv.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetenv**=*env* + +Unset default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/unsetlabel.md b/versioned_docs/version-5.4.2/source/markdown/options/unsetlabel.md new file mode 100644 index 000000000..b4dcd013e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/unsetlabel.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetlabel**=*label* + +Unset the image label, causing the label not to be inherited from the base image. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/until.md b/versioned_docs/version-5.4.2/source/markdown/options/until.md new file mode 100644 index 000000000..a7e92e139 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/until.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--until**=*TIMESTAMP* + +Show logs until TIMESTAMP. The --until option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/user-mode-networking.md b/versioned_docs/version-5.4.2/source/markdown/options/user-mode-networking.md new file mode 100644 index 000000000..153a50ec8 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/user-mode-networking.md @@ -0,0 +1,26 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman machine init, machine set +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--user-mode-networking** + +Indicates that this machine relays traffic from the guest through a user-space +process running on the host. In some VPN configurations the VPN may drop +traffic from alternate network interfaces, including VM network devices. By +enabling user-mode networking (a setting of `true`), VPNs observe all +podman machine traffic as coming from the host, bypassing the problem. + +When the qemu backend is used (Linux, Mac), user-mode networking is +mandatory and the only allowed value is `true`. In contrast, The Windows/WSL +backend defaults to `false`, and follows the standard WSL network setup. +Changing this setting to `true` on Windows/WSL informs Podman to replace +the WSL networking setup on start of this machine instance with a user-mode +networking distribution. Since WSL shares the same kernel across +distributions, all other running distributions reuses this network. +Likewise, when the last machine instance with a `true` setting stops, the +original networking setup is restored. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/user.md b/versioned_docs/version-5.4.2/source/markdown/options/user.md new file mode 100644 index 000000000..50c19b53b --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/user.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--user**, **-u**=*user[\:group]* + +Sets the username or UID used and, optionally, the groupname or GID for the specified command. Both *user* and *group* may be symbolic or numeric. + +Without this argument, the command runs as the user specified in the container image. Unless overridden by a `USER` command in the Containerfile or by a value passed to this option, this user generally defaults to root. + +When a user namespace is not in use, the UID and GID used within the container and on the host match. When user namespaces are in use, however, the UID and GID in the container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container by default corresponds to the UID and GID of the user invoking Podman. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/userns-gid-map-group.md b/versioned_docs/version-5.4.2/source/markdown/options/userns-gid-map-group.md new file mode 100644 index 000000000..7c79a15c8 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/userns-gid-map-group.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns-gid-map-group**=*group* + +Specifies that a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subgid` file which correspond to the specified group. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-uid-map-user is specified, but --userns-gid-map-group is not specified, `podman` assumes that the specified user name is also a +suitable group name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/userns-gid-map.md b/versioned_docs/version-5.4.2/source/markdown/options/userns-gid-map.md new file mode 100644 index 000000000..776451c94 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/userns-gid-map.md @@ -0,0 +1,24 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns-gid-map**=*mapping* + +Directly specifies a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container GID, a corresponding starting host-level GID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-gids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-gid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-gid-map are specified, but --userns-uid-map is specified, the GID map is set to use the same numeric values as the UID map. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/userns-uid-map-user.md b/versioned_docs/version-5.4.2/source/markdown/options/userns-uid-map-user.md new file mode 100644 index 000000000..4d09ce61e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/userns-uid-map-user.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns-uid-map-user**=*user* + +Specifies that a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subuid` file which correspond to the specified user. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-gid-map-group is specified, but --userns-uid-map-user is not specified, `podman` assumes that the specified group name is also a +suitable user name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/userns-uid-map.md b/versioned_docs/version-5.4.2/source/markdown/options/userns-uid-map.md new file mode 100644 index 000000000..0be56c056 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/userns-uid-map.md @@ -0,0 +1,24 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns-uid-map**=*mapping* + +Directly specifies a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions default to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container UID, a corresponding starting host-level UID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-uids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-uid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-uid-map are specified, but --userns-gid-map is specified, the UID map is set to use the same numeric values as the GID map. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/userns.container.md b/versioned_docs/version-5.4.2/source/markdown/options/userns.container.md new file mode 100644 index 000000000..ac5c4b30e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/userns.container.md @@ -0,0 +1,74 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, kube play, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns**=*mode* + +Set the user namespace mode for the container. + +If `--userns` is not set, the default value is determined as follows. +- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used. +- If the environment variable **PODMAN_USERNS** is set its value is used. +- If `userns` is specified in `containers.conf` this value is used. +- Otherwise, `--userns=host` is assumed. + +`--userns=""` (i.e., an empty string) is an alias for `--userns=host`. + +This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +------------------------|-----------|--------------------- +auto | $UID | nil (Host User UID is not mapped into container.) +host | $UID | 0 (Default User account mapped to root user in container.) +keep-id | $UID | $UID (Map user account to same UID within container.) +keep-id\:uid=200,gid=210 | $UID | 200:210 (Map user account to specified UID, GID value within container.) +nomap | $UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + +**auto**[\:_OPTIONS,..._]: automatically create a unique user namespace. + +* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. + + Example: `containers:2147483647:2147483648`. + +* `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5). + +Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user IDs. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. + +The option `--userns=keep-id` uses all the subuids and subgids of the user. +The option `--userns=nomap` uses all the subuids and subgids of the user except the user's own ID. +Using `--userns=auto` when starting new containers does not work as long as any containers exist that were started with `--userns=nomap` or `--userns=keep-id` without limiting the user namespace size. + + Valid `auto` options: + + - *gidmapping*=_CONTAINER\_GID\:HOST\_GID\:SIZE_: to force a GID mapping to be present in the user namespace. + - *size*=_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates a size for the user namespace. + - *uidmapping*=_CONTAINER\_UID\:HOST\_UID\:SIZE_: to force a UID mapping to be present in the user namespace. + +The host UID and GID in *gidmapping* and *uidmapping* can optionally be prefixed with the `@` symbol. +In this case, podman will look up the intermediate ID corresponding to host ID and it will map the found intermediate ID to the container id. +For details see **--uidmap**. + +**container:**_id_: join the user namespace of the specified container. + +**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user. + +**keep-id**: creates a user namespace where the current user's UID\:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace. + + Valid `keep-id` options: + + - *uid*=UID: override the UID inside the container that is used to map the current user to. + - *gid*=GID: override the GID inside the container that is used to map the current user to. + - *size*=SIZE: override the size of the configured user namespace. It is useful to not saturate all the available IDs. Not supported when running as root. + +**nomap**: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +**ns:**_namespace_: run the <> in the given existing user namespace. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/userns.image.md b/versioned_docs/version-5.4.2/source/markdown/options/userns.image.md new file mode 100644 index 000000000..7a0897006 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/userns.image.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns**=*how* + +Sets the configuration for user namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new user namespace is created, it can be "host" to indicate that the user namespace in which `podman` itself is being run is reused, or it can be the path to a user namespace which is already in use by another process. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/userns.pod.md b/versioned_docs/version-5.4.2/source/markdown/options/userns.pod.md new file mode 100644 index 000000000..d61f3847e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/userns.pod.md @@ -0,0 +1,38 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns**=*mode* + +Set the user namespace mode for all the containers in a pod. It defaults to the `PODMAN_USERNS` environment variable. An empty value ("") means user namespaces are disabled. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +----------|---------------|--------------------- +"" |$UID |0 (Default User account mapped to root user in container.) +host |$UID |0 (Default User account mapped to root user in container.) +keep-id |$UID |$UID (Map user account to same UID within container.) +auto |$UID | nil (Host User UID is not mapped into container.) +nomap |$UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + + - *auto[:*_OPTIONS,..._*]*: automatically create a namespace. It is possible to specify these options to `auto`: + + - *gidmapping=*_CONTAINER\_GID\:HOST\_GID\:SIZE_ to force a GID mapping to be present in the user namespace. + + - *size=*_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates the size for the user namespace. + + - *uidmapping=*_CONTAINER\_UID\:HOST\_UID\:SIZE_ to force a UID mapping to be present in the user namespace. + + - *host*: run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user (default). + + - *keep-id*: creates a user namespace where the current rootless user's UID\:GID are mapped to the same values in the container. This option is not allowed for containers created by the root user. + + - *nomap*: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/uts.container.md b/versioned_docs/version-5.4.2/source/markdown/options/uts.container.md new file mode 100644 index 000000000..1d5661102 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/uts.container.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uts**=*mode* + +Set the UTS namespace mode for the container. The following values are supported: + +- **host**: use the host's UTS namespace inside the container. +- **private**: create a new namespace for the container (default). +- **ns:[path]**: run the container in the given existing UTS namespace. +- **container:[container]**: join the UTS namespace of the specified container. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/uts.md b/versioned_docs/version-5.4.2/source/markdown/options/uts.md new file mode 100644 index 000000000..46f2fba20 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/uts.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uts**=*how* + +Sets the configuration for UTS namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new UTS namespace to be created, or it can be "host" to indicate that the UTS namespace in which `podman` itself is being run is reused, or it can be the path to a UTS namespace which is already in use by another process. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/uts.pod.md b/versioned_docs/version-5.4.2/source/markdown/options/uts.pod.md new file mode 100644 index 000000000..2e4505162 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/uts.pod.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uts**=*mode* + +Set the UTS namespace mode for the pod. The following values are supported: + +- **host**: use the host's UTS namespace inside the pod. +- **private**: create a new namespace for the pod (default). +- **ns:[path]**: run the pod in the given existing UTS namespace. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/variant.container.md b/versioned_docs/version-5.4.2/source/markdown/options/variant.container.md new file mode 100644 index 000000000..db2682290 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/variant.container.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--variant**=*VARIANT* + +Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/variant.manifest.md b/versioned_docs/version-5.4.2/source/markdown/options/variant.manifest.md new file mode 100644 index 000000000..94b0b7410 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/variant.manifest.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman manifest add, manifest annotate +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--variant** + +Specify the variant which the list or index records for the image. This option +is typically used to distinguish between multiple entries which share the same +architecture value, but which expect different versions of its instruction set. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/volume.image.md b/versioned_docs/version-5.4.2/source/markdown/options/volume.image.md new file mode 100644 index 000000000..8133051b5 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/volume.image.md @@ -0,0 +1,125 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--volume**, **-v**=*[HOST-DIR\:CONTAINER-DIR[\\\:OPTIONS]]* + +Mount a host directory into containers when executing RUN instructions during +the build. + +The `OPTIONS` are a comma-separated list and can be one or more of: + + * [rw|ro] + * [z|Z|O] + * [U] + * [`[r]shared`|`[r]slave`|`[r]private`][[1]](#Footnote1) + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR` +must be an absolute path as well. Podman bind-mounts the `HOST-DIR` to the +specified path when processing RUN instructions. + +You can specify multiple **-v** options to mount one or more mounts. + +You can add the `:ro` or `:rw` suffix to a volume to mount it read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted. When running using user namespaces, the UID and GID inside +the namespace may correspond to another UID and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the namespace, to change recursively the owner and group of +the source volume. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add one of these two suffixes +`:z` or `:Z` to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The `z` option tells Podman that two containers +share the volume content. As a result, Podman labels the content with a shared +content label. Shared volume labels allow all containers to read/write content. +The `Z` option tells Podman to label the content with a private unshared label. +Only the current container can use a private volume. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the host machine to fail. For these types +of containers, disabling SELinux separation is recommended. The option +`--security-opt label=disable` disables SELinux separation for the container. +For example, if a user wanted to volume mount their entire home directory into the build containers, they need to disable SELinux separation. + + $ podman build --security-opt label=disable -v $HOME:/home/user . + +`Overlay Volume Mounts` + +The `:O` flag tells Podman to mount the directory from the host as a +temporary storage using the Overlay file system. The `RUN` command containers +are allowed to modify contents within the mountpoint and are stored in the +container storage in a separate directory. In Overlay FS terms the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the `RUN` command +finishes executing, similar to a tmpfs mount point. + +Any subsequent execution of `RUN` commands sees the original source directory +content, any changes from previous RUN commands no longer exists. + +One use case of the `overlay` mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: + +- Overlay mounts are not currently supported in rootless mode. +- The `O` flag is not allowed to be specified with the `Z` or `z` flags. + Content mounted into the container is labeled with the private label. + On SELinux systems, labels in the source directory needs to be readable + by the container label. If not, SELinux container separation must be disabled + for the container to work. +- Modification of the directory volume mounted into the container with an + overlay mount can cause unexpected failures. Do not modify the directory until + the container finishes running. + +By default bind mounted volumes are `private`. That means any mounts done +inside containers are not be visible on the host and vice versa. This behavior +can be changed by specifying a volume mount propagation property. + +When the mount propagation policy is set to `shared`, any mounts completed +inside the container on that volume is visible to both the host and +container. When the mount propagation policy is set to `slave`, one way mount +propagation is enabled and any mounts completed on the host for that volume is +visible only inside of the container. To control the mount propagation +property of volume use the `:[r]shared`, `:[r]slave` or `:[r]private` +propagation flag. For mount propagation to work on the source mount point (mount +point where source dir is mounted on) has to have the right propagation properties. +For shared volumes, the source mount point has to be shared. And for slave volumes, +the source mount has to be either shared or slave. [[1]](#Footnote1) + +Use `df ` to determine the source mount and then use +`findmnt -o TARGET,PROPAGATION ` to determine propagation +properties of source mount, if `findmnt` utility is not available, the source +mount point can be determined by looking at the mount entry in +`/proc/self/mountinfo`. Look at `optional fields` and see if any propagation +properties are specified. +`shared:X` means the mount is `shared`, `master:X` means the mount is `slave` +and if nothing is there that means the mount is `private`. [[1]](#Footnote1) + +To change propagation properties of a mount point use the `mount` command. For +example, to bind mount the source directory `/foo` do +`mount --bind /foo /foo` and `mount --make-private --make-shared /foo`. This +converts /foo into a `shared` mount point. The propagation properties of +the source mount can be changed directly. For instance if `/` is the source +mount for `/foo`, then use `mount --make-shared /` to convert `/` into a +`shared` mount. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/volume.md b/versioned_docs/version-5.4.2/source/markdown/options/volume.md new file mode 100644 index 000000000..cf8ea9d89 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/volume.md @@ -0,0 +1,214 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the <> is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +<>. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a <> is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the <>, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the <>. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a <>. Without a label, the security system +might prevent the processes running inside the <> from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the <> context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +<> share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label Only the current <> can use a private +volume. Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any of one the containers. Relabeling walks +the file system under the volume and changes the label on each file, if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the <>. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually change with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the <>. +For example if a user wanted to volume mount their entire home directory into a +<>, they need to disable SELinux separation. + + $ podman <> --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The <> processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the <> +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous <> executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the <<|pod infra>> container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the <<|pod or infra>> container +to work. + +Do not modify the source directory mounted into the <> with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the <> are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the <> +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +<>, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +<>. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the <>. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the <>. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless <> fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/volumes-from.md b/versioned_docs/version-5.4.2/source/markdown/options/volumes-from.md new file mode 100644 index 000000000..6becb95f4 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/volumes-from.md @@ -0,0 +1,41 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--volumes-from**=*CONTAINER[\\\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers<<| and pods>>. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +<>. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a <>. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the <> context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target <>, then the volume hides +that data on the target. diff --git a/versioned_docs/version-5.4.2/source/markdown/options/workdir.md b/versioned_docs/version-5.4.2/source/markdown/options/workdir.md new file mode 100644 index 000000000..6a29b8d4c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/options/workdir.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.4.2 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--workdir**, **-w**=*dir* + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (**/**). +The image developer can set a different default with the WORKDIR instruction. The operator +can override the working directory by using the **-w** option. diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-artifact-add.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-artifact-add.1.md new file mode 100644 index 000000000..6389055ee --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-artifact-add.1.md @@ -0,0 +1,68 @@ +--- +title: podman-artifact-add +version: v5.4.2 +--- + +% podman-artifact-add 1 + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-add - Add an OCI artifact to the local store + +## SYNOPSIS +**podman artifact add** *name* *file* [*file*]... + +## DESCRIPTION + +Add an OCI artifact to the local store from the local filesystem. You must +provide at least one file to create the artifact, but several can also be +added. + + +## OPTIONS + + +[//]: # (BEGIN included file options/annotation.manifest.md) +#### **--annotation**=*annotation=value* + +Set an annotation on the entry for the specified image or artifact. + +[//]: # (END included file options/annotation.manifest.md) + +#### **--help** + +Print usage statement. + +#### **--type** + +Set a type for the artifact being added. + +## EXAMPLES + +Add a single file to an artifact + +``` +$ podman artifact add quay.io/myartifact/myml:latest /tmp/foobar.ml +0fe1488ecdef8cc4093e11a55bc048d9fc3e13a4ba846efd24b5a715006c95b3 +``` + +Add multiple files to an artifact +``` +$ podman artifact add quay.io/myartifact/myml:latest /tmp/foobar1.ml /tmp/foobar2.ml +1487acae11b5a30948c50762882036b41ac91a7b9514be8012d98015c95ddb78 +``` + +Set an annotation for an artifact +``` +$ podman artifact add --annotation date=2025-01-30 quay.io/myartifact/myml\:latest /tmp/foobar1.ml +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-artifact-inspect.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-artifact-inspect.1.md new file mode 100644 index 000000000..d409eb60b --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-artifact-inspect.1.md @@ -0,0 +1,43 @@ +--- +title: podman-artifact-inspect +version: v5.4.2 +--- + +% podman-artifact-inspect 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-inspect - Inspect an OCI artifact + +## SYNOPSIS +**podman artifact inspect** [*name*] ... + +## DESCRIPTION + +Inspect an artifact in the local store. The artifact can be referred to with either: + +1. Fully qualified artifact name +2. Full or partial digest of the artifact's manifest + +## OPTIONS + +#### **--help** + +Print usage statement. + +## EXAMPLES + +Inspect an OCI image in the local store. +``` +$ podman artifact inspect quay.io/myartifact/myml\:latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Sept 2024, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-artifact-ls.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-artifact-ls.1.md new file mode 100644 index 000000000..a5f48e16e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-artifact-ls.1.md @@ -0,0 +1,90 @@ +--- +title: podman-artifact-ls +version: v5.4.2 +--- + +% podman-artifact-ls 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-ls - List OCI artifacts in local store + +## SYNOPSIS +**podman artifact ls** [*options*] + +## DESCRIPTION + +List all local artifacts in your local store. + +## OPTIONS + +#### **--format** + +Print results with a Go template. + +| **Placeholder** | **Description** | +|-----------------|------------------------------------------------| +| .Digest | The computed digest of the artifact's manifest | +| .Repository | Repository name of the artifact | +| .Size | Size artifact in human readable units | +| .Tag | Tag of the artifact name | + + +[//]: # (BEGIN included file options/no-trunc.md) +#### **--no-trunc** + +Do not truncate the output (default *false*). + +[//]: # (END included file options/no-trunc.md) + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +## EXAMPLES + +List artifacts in the local store +``` +$ podman artifact ls +REPOSITORY TAG DIGEST SIZE +quay.io/artifact/foobar1 latest ab609fad386d 2.097GB +quay.io/artifact/foobar2 special cd734b558ceb 12.58MB +``` + +List artifacts in the local store without truncating the digest +``` +$ podman artifact ls --no-trunc +REPOSITORY TAG DIGEST SIZE +quay.io/artifact/foobar1 latest ab609fad386df1433f461b0643d9cf575560baf633809dcc9c190da6cc3a3c29 2.097GB +quay.io/artifact/foobar2 special cd734b558ceb8ccc0281ca76530e1dea1eb479407d3163f75fb601bffb6f73d0 12.58MB +``` + +List artifacts in the local store without the title header +``` +$ podman artifact ls --noheading +quay.io/artifact/foobar1 latest ab609fad386d 2.097GB +quay.io/artifact/foobar2 special cd734b558ceb 12.58MB +``` + +List artifact digests and size using a --format +``` +$ podman artifact ls --format "{{.Digest}} {{.Size}}" +ab609fad386d 2.097GB +cd734b558ceb 12.58MB +``` + + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-artifact-pull.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-artifact-pull.1.md new file mode 100644 index 000000000..c8125720a --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-artifact-pull.1.md @@ -0,0 +1,140 @@ +--- +title: podman-artifact-pull +version: v5.4.2 +--- + +% podman-artifact-pull 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-pull - Pulls an artifact from a registry and stores it locally + +## SYNOPSIS +**podman artifact pull** [*options*] *source* + + +## DESCRIPTION +podman artifact pull copies an artifact from a registry onto the local machine. + + +## SOURCE +SOURCE is the location from which the artifact image is obtained. + +``` +# Pull from a registry +$ podman artifact pull quay.io/foobar/artifact\:special +``` + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +#### **--help**, **-h** + +Print the usage statement. + +#### **--quiet**, **-q** + +Suppress output information when pulling images + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## FILES + +## EXAMPLES +Pull an artifact from a registry + +``` +podman artifact pull quay.io/baude/artifact\:josey +Getting image source signatures +Copying blob e741c35a27bb done | +Copying config 44136fa355 done | +Writing manifest to image destination + +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-artifact-push.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-artifact-push.1.md new file mode 100644 index 000000000..f541918bf --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-artifact-push.1.md @@ -0,0 +1,149 @@ +--- +title: podman-artifact-push +version: v5.4.2 +--- + +% podman-artifact-push 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-push - Push an OCI artifact from local storage to an image registry + +## SYNOPSIS +**podman artifact push** [*options*] *image* + +## DESCRIPTION +Pushes an artifact from the local artifact store to an image registry. + +``` +# Push artifact to a container registry +$ podman artifact push quay.io/artifact/foobar1\:latest +``` + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\\\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/digestfile.md) +#### **--digestfile**=*Digestfile* + +After copying the image, write the digest of the resulting image to the file. + +[//]: # (END included file options/digestfile.md) + +#### **--quiet**, **-q** + +When writing the output image, suppress progress output + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + +#### **--sign-by**=*key* + +Add a “simple signing” signature at the destination using the specified key. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-by-sigstore.md) +#### **--sign-by-sigstore**=*param-file* + +Add a sigstore signature based on further options specified in a container's sigstore signing parameter file *param-file*. +See containers-sigstore-signing-params.yaml(5) for details about the file format. + +[//]: # (END included file options/sign-by-sigstore.md) + + +#### **--sign-by-sigstore-private-key**=*path* + +Add a sigstore signature at the destination using a private key at the specified path. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-passphrase-file.md) +#### **--sign-passphrase-file**=*path* + +If signing the image (using either **--sign-by** or **--sign-by-sigstore-private-key**), read the passphrase to use from the specified path. + +[//]: # (END included file options/sign-passphrase-file.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLE + +Push the specified iage to a container registry: +``` +$ podman artifact push quay.io/baude/artifact\:single +Getting image source signatures +Copying blob 3ddc0a3cdb61 done | +Copying config 44136fa355 done | +Writing manifest to image destination +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)**, **[podman-pull(1)](podman-pull.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** + + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-artifact-rm.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-artifact-rm.1.md new file mode 100644 index 000000000..7e1157811 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-artifact-rm.1.md @@ -0,0 +1,51 @@ +--- +title: podman-artifact-rm +version: v5.4.2 +--- + +% podman-artifact-rm 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-rm - Remove an OCI from local storage + +## SYNOPSIS +**podman artifact rm** *name* + +## DESCRIPTION + +Remove an artifact from the local artifact store. The input may be the fully +qualified artifact name or a full or partial artifact digest. + +## OPTIONS + +#### **--help** + +Print usage statement. + + +## EXAMPLES + +Remove an artifact by name + +``` +$ podman artifact rm quay.io/artifact/foobar2\:test +e7b417f49fc24fc7ead6485da0ebd5bc4419d8a3f394c169fee5a6f38faa4056 +``` + +Remove an artifact by partial digest + +``` +$ podman artifact rm e7b417f49fc +e7b417f49fc24fc7ead6485da0ebd5bc4419d8a3f394c169fee5a6f38faa4056 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-artifact.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-artifact.1.md new file mode 100644 index 000000000..37e56d2f3 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-artifact.1.md @@ -0,0 +1,41 @@ +--- +title: podman-artifact +version: v5.4.2 +--- + +% podman-artifact 1 + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact - Manage OCI artifacts + +## SYNOPSIS +**podman artifact** *subcommand* + +## DESCRIPTION +`podman artifact` is a set of subcommands that manage OCI artifacts. + +OCI artifacts are a common way to distribute files that are associated with OCI images and +containers. Podman is capable of managing (pulling, inspecting, pushing) these artifacts +from its local "artifact store". + +## SUBCOMMANDS + +| Command | Man Page | Description | +|---------|------------------------------------------------------------|--------------------------------------------------------------| +| add | [podman-artifact-add(1)](podman-artifact-add.1.md) | Add an OCI artifact to the local store | +| inspect | [podman-artifact-inspect(1)](podman-artifact-inspect.1.md) | Inspect an OCI artifact | +| ls | [podman-artifact-ls(1)](podman-artifact-ls.1.md) | List OCI artifacts in local store | +| pull | [podman-artifact-pull(1)](podman-artifact-pull.1.md) | Pulls an artifact from a registry and stores it locally | +| push | [podman-artifact-push(1)](podman-artifact-push.1.md) | Push an OCI artifact from local storage to an image registry | +| rm | [podman-artifact-rm(1)](podman-artifact-rm.1.md) | Remove an OCI from local storage | + + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +Sept 2024, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-attach.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-attach.1.md new file mode 100644 index 000000000..15936421c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-attach.1.md @@ -0,0 +1,78 @@ +--- +title: podman-attach +version: v5.4.2 +--- + +% podman-attach 1 + +## NAME +podman\-attach - Attach to a running container + +## SYNOPSIS +**podman attach** [*options*] *container* + +**podman container attach** [*options*] *container* + +## DESCRIPTION +**podman attach** attaches to a running *container* using the *container's name* or *ID*, to either view its ongoing output or to control it interactively.\ +The *container* can be detached from (and leave it running) using a configurable key sequence. The default sequence is `ctrl-p,ctrl-q`. Configure the keys sequence using the **--detach-keys** OPTION, or specifying it in the `containers.conf` file: see **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** for more information. + +## OPTIONS + +[//]: # (BEGIN included file options/detach-keys.md) +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. + +[//]: # (END included file options/detach-keys.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--no-stdin** + +Do not attach STDIN. The default is **false**. + + +[//]: # (BEGIN included file options/sig-proxy.md) +#### **--sig-proxy** + +Proxy received signals to the container process. SIGCHLD, SIGURG, SIGSTOP, and SIGKILL are not proxied. + +[//]: # (END included file options/sig-proxy.md) + +The default is **true**. + +## EXAMPLES +Attach to a container called "foobar". +``` +$ podman attach foobar +``` + +Attach to the latest created container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman attach --latest +``` + +Attach to a container that start with the ID "1234". +``` +$ podman attach 1234 +``` + +Attach to a container without attaching STDIN. +``` +$ podman attach --no-stdin foobar +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-exec(1)](podman-exec.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-auto-update.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-auto-update.1.md new file mode 100644 index 000000000..d0e379c84 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-auto-update.1.md @@ -0,0 +1,146 @@ +--- +title: podman-auto-update +version: v5.4.2 +--- + +% podman-auto-update 1 + +## NAME +podman\-auto-update - Auto update containers according to their auto-update policy + +## SYNOPSIS +**podman auto-update** [*options*] + +## DESCRIPTION +**podman auto-update** pulls down new container images and restarts containers configured for auto updates. +To make use of auto updates, the container or Kubernetes workloads must run inside a systemd unit. +After a successful update of an image, the containers using the image get updated by restarting the systemd units they run in. +Please refer to `podman-systemd.unit(5)` on how to run Podman under systemd. + +To configure a container for auto updates, it must be created with the `io.containers.autoupdate` label or the `AutoUpdate` field in `podman-systemd.unit(5)` with one of the following two values: + +* `registry`: If the label is present and set to `registry`, Podman reaches out to the corresponding registry to check if the image has been updated. +The label `image` is an alternative to `registry` maintained for backwards compatibility. +An image is considered updated if the digest in the local storage is different than the one of the remote image. +If an image must be updated, Podman pulls it down and restarts the systemd unit executing the container. +The registry policy requires a fully-qualified image reference (e.g., quay.io/podman/stable\\:latest) to be used to create the container. +This enforcement is necessary to know which image to actually check and pull. +If an image ID was used, Podman would not know which image to check/pull anymore. + +* `local`: If the autoupdate label is set to `local`, Podman compares the image digest of the container to the one in the local container storage. +If they differ, the local image is considered to be newer and the systemd unit gets restarted. + +### Auto Updates and Kubernetes YAML + +Podman supports auto updates for Kubernetes workloads. The auto-update policy can be configured directly via `podman-systemd.unit(5)` or inside the Kubernetes YAML with the Podman-specific annotations mentioned below: + +* `io.containers.autoupdate`: "registry|local" to apply the auto-update policy to all containers +* `io.containers.autoupdate/$container`: "registry|local" to apply the auto-update policy to `$container` only +* `io.containers.sdnotify`: "conmon|container" to apply the sdnotify policy to all containers +* `io.containers.sdnotify/$container`: "conmon|container" to apply the sdnotify policy to `$container` only + +By default, the autoupdate policy is set to "disabled", the sdnotify policy is set to "conmon". + +### Systemd Unit and Timer + +Podman ships with a `podman-auto-update.service` systemd unit. This unit is triggered daily at midnight by the `podman-auto-update.timer` systemd timer. +The timer can be altered for custom time-based updates if desired. +The unit can further be invoked by other systemd units (e.g., via the dependency tree) or manually via **systemctl start podman-auto-update.service**. + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + +Alternatively, the `io.containers.autoupdate.authfile` container label can be configured. In that case, Podman will use the specified label's value instead. + +#### **--dry-run** + +Check for the availability of new images but do not perform any pull operation or restart any service or container. +The `UPDATED` field indicates the availability of a new image with "pending". + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| --------------- | -------------------------------------- | +| .Container | ID and name of the container | +| .ContainerID | ID of the container | +| .ContainerName | Name of the container | +| .Image | Name of the image | +| .Policy | Auto-update policy of the container | +| .Unit | Name of the systemd unit | +| .Updated | Update status: true,false,failed | + +#### **--rollback** + +If restarting a systemd unit after updating the image has failed, rollback to using the previous image and restart the unit another time. Default is true. + +Note that detecting if a systemd unit has failed is best done by the container sending the READY message via SDNOTIFY. +This way, restarting the unit waits until having received the message or a timeout kicked in. +Without that, restarting the systemd unit may succeed even if the container has failed shortly after. + +For a container to send the READY message via SDNOTIFY it must be created with the `--sdnotify=container` option (see podman-run(1)). +The application running inside the container can then execute `systemd-notify --ready` when ready or use the sdnotify bindings of the specific programming language (e.g., sd_notify(3)). + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Create a Quadlet file configured for auto updates: +``` +$ cat ~/.config/containers/systemd/sleep.container +[Container] +Image=registry.fedoraproject.org/fedora:latest +Exec=sleep infinity +AutoUpdate=registry +``` + +Generate a systemd service from the Quadlet file by reloading the systemd user daemon: +``` +$ systemctl --user daemon-reload +``` + +Start the systemd service and make sure the container is running +``` +$ systemctl --user start sleep.service +$ podman ps +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +f8e4759798d4 registry.fedoraproject.org/fedora:latest sleep infinity 2 seconds ago Up 2 seconds systemd-sleep +``` + +Check if a new image is available via `--dry-run`: +``` +$ podman auto-update --dry-run --format "{{.Image}} {{.Updated}}" +registry.fedoraproject.org/fedora:latest pending +``` + +Update the service: +``` +$ podman auto-update +UNIT CONTAINER IMAGE POLICY UPDATED +sleep.service f8e4759798d4 (systemd-sleep) registry.fedoraproject.org/fedora\\:latest registry true +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-generate-systemd(1)](podman-generate-systemd.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-systemd.unit(5)](podman-systemd.unit.5.md)**, **sd_notify(3)**, **[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-build.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-build.1.md new file mode 100644 index 000000000..6eb290dbe --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-build.1.md @@ -0,0 +1,1943 @@ +--- +title: podman-build +version: v5.4.2 +--- + +% podman-build 1 + +## NAME +podman\-build - Build a container image using a Containerfile + +## SYNOPSIS +**podman build** [*options*] [*context*] + +**podman image build** [*options*] [*context*] + +## DESCRIPTION +**podman build** Builds an image using instructions from one or more +Containerfiles or Dockerfiles and a specified build context directory. A +Containerfile uses the same syntax as a Dockerfile internally. For this +document, a file referred to as a Containerfile can be a file named +either 'Containerfile' or 'Dockerfile' exclusively. Any file that has additional +extension attached will not be recognized by `podman build .` unless a `-f` flag is +used to specify the file. + +The build context directory can be specified as the http(s) URL of an archive, +git repository or Containerfile. + +When invoked with `-f` and a path to a Containerfile, with no explicit CONTEXT +directory, Podman uses the Containerfile's parent directory as its build context. + +Containerfiles ending with a ".in" suffix are preprocessed via CPP(1). This +can be useful to decompose Containerfiles into several reusable parts that can +be used via CPP's **#include** directive. Containerfiles ending in .in are +restricted to no comment lines unless they are CPP commands. +Note, a Containerfile.in file can still be used by other tools when manually +preprocessing them via `cpp -E`. + +When the URL is an archive, the contents of the URL is downloaded to a temporary +location and extracted before execution. + +When the URL is a Containerfile, the Containerfile is downloaded to a temporary +location. + +When a Git repository is set as the URL, the repository is cloned locally and +then set as the context. A URL is treated as a Git repository if it +has a `git://` prefix or a `.git` suffix. + +NOTE: `podman build` uses code sourced from the `Buildah` project to build +container images. This `Buildah` code creates `Buildah` containers for the +`RUN` options in container storage. In certain situations, when the +`podman build` crashes or users kill the `podman build` process, these external +containers can be left in container storage. Use the `podman ps --all --external` +command to see these containers. + +`podman buildx build` command is an alias of `podman build`. Not all `buildx build` features are available in Podman. The `buildx build` option is provided for scripting compatibility. + +## OPTIONS + + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the container's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + +#### **--all-platforms** + +Instead of building for a set of platforms specified using the **--platform** option, inspect the build's base images, and build for all of the platforms for which they are all available. Stages that use *scratch* as a starting point can not be inspected, so at least one non-*scratch* stage must be present for detection to work usefully. + + +[//]: # (BEGIN included file options/annotation.image.md) +#### **--annotation**=*annotation=value* + +Add an image *annotation* (e.g. annotation=*value*) to the image metadata. Can +be used multiple times. + +Note: this information is not present in Docker image formats, so it is +discarded when writing images in Docker formats. + +[//]: # (END included file options/annotation.image.md) + +#### **--arch**=*arch* + +Set the architecture of the image to be built, and that of the base image to be +pulled, if the build uses one, to the provided value instead of using the +architecture of the build host. Unless overridden, subsequent lookups of the +same image in the local storage matches this architecture, regardless of the +host. (Examples: arm, arm64, 386, amd64, ppc64le, s390x) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/build-arg.md) +#### **--build-arg**=*arg=value* + +Specifies a build argument and its value, which is interpolated in +instructions read from the Containerfiles in the same way that environment variables are, but which are not added to environment variable list in the resulting image's configuration. + +[//]: # (END included file options/build-arg.md) + + +[//]: # (BEGIN included file options/build-arg-file.md) +#### **--build-arg-file**=*path* + +Specifies a file containing lines of build arguments of the form `arg=value`. +The suggested file name is `argfile.conf`. + +Comment lines beginning with `#` are ignored, along with blank lines. +All others must be of the `arg=value` format passed to `--build-arg`. + +If several arguments are provided via the `--build-arg-file` +and `--build-arg` options, the build arguments are merged across all +of the provided files and command line arguments. + +Any file provided in a `--build-arg-file` option is read before +the arguments supplied via the `--build-arg` option. + +When a given argument name is specified several times, the last instance +is the one that is passed to the resulting builds. This means `--build-arg` +values always override those in a `--build-arg-file`. + +[//]: # (END included file options/build-arg-file.md) + + +[//]: # (BEGIN included file options/build-context.md) +#### **--build-context**=*name=value* + +Specify an additional build context using its short name and its location. +Additional build contexts can be referenced in the same manner as we access +different stages in COPY instruction. + +Valid values are: + +* Local directory – e.g. --build-context project2=../path/to/project2/src (This option is not available with the remote Podman client. On Podman machine setup (i.e macOS and Windows) path must exists on the machine VM) +* HTTP URL to a tarball – e.g. --build-context src=https://example.org/releases/src.tar +* Container image – specified with a container-image:// prefix, e.g. --build-context alpine=container-image://alpine:3.15, (also accepts docker://, docker-image://) + +On the Containerfile side, reference the build context on all +commands that accept the “from” parameter. Here’s how that might look: + +```dockerfile +FROM [name] +COPY --from=[name] ... +RUN --mount=from=[name] … +``` + +The value of [name] is matched with the following priority order: + +* Named build context defined with --build-context [name]=.. +* Stage defined with AS [name] inside Containerfile +* Image [name], either local or in a remote registry + +[//]: # (END included file options/build-context.md) + + +[//]: # (BEGIN included file options/cache-from.md) +#### **--cache-from**=*image* + +Repository to utilize as a potential cache source. When specified, Buildah tries to look for +cache images in the specified repository and attempts to pull cache images instead of actually +executing the build steps locally. Buildah only attempts to pull previously cached images if they +are considered as valid cache hits. + +Use the `--cache-to` option to populate a remote repository with cache content. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-from` option is ignored unless `--layers` is specified. + +[//]: # (END included file options/cache-from.md) + + +[//]: # (BEGIN included file options/cache-to.md) +#### **--cache-to**=*image* + +Set this flag to specify a remote repository that is used to store cache images. Buildah attempts to +push newly built cache image to the remote repository. + +Note: Use the `--cache-from` option in order to use cache content in a remote repository. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-to` option is ignored unless `--layers` is specified. + +[//]: # (END included file options/cache-to.md) + + +[//]: # (BEGIN included file options/cache-ttl.md) +#### **--cache-ttl** + +Limit the use of cached images to only consider images with created timestamps less than *duration* ago. +For example if `--cache-ttl=1h` is specified, Buildah considers intermediate cache images which are created +under the duration of one hour, and intermediate cache images outside this duration is ignored. + +Note: Setting `--cache-ttl=0` manually is equivalent to using `--no-cache` in the +implementation since this means that the user does not want to use cache at all. + +[//]: # (END included file options/cache-ttl.md) + + +[//]: # (BEGIN included file options/cap-add.image.md) +#### **--cap-add**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability added to its capability set. +Certain capabilities are granted by default; this option can be used to add +more. + +[//]: # (END included file options/cap-add.image.md) + + +[//]: # (BEGIN included file options/cap-drop.image.md) +#### **--cap-drop**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability removed from its capability set. +The CAP\_CHOWN, CAP\_DAC\_OVERRIDE, CAP\_FOWNER, +CAP\_FSETID, CAP\_KILL, CAP\_NET\_BIND\_SERVICE, CAP\_SETFCAP, +CAP\_SETGID, CAP\_SETPCAP, and CAP\_SETUID capabilities are +granted by default; this option can be used to remove them. + +If a capability is specified to both the **--cap-add** and **--cap-drop** +options, it is dropped, regardless of the order in which the options were +given. + +[//]: # (END included file options/cap-drop.image.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the container is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cgroupns.image.md) +#### **--cgroupns**=*how* + +Sets the configuration for cgroup namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "private" to indicate +that a new cgroup namespace is created, or it can be "host" to indicate +that the cgroup namespace in which `buildah` itself is being run is reused. + +[//]: # (END included file options/cgroupns.image.md) + + +[//]: # (BEGIN included file options/compat-volumes.md) +#### **--compat-volumes** + +Handle directories marked using the VOLUME instruction (both in this build, and +those inherited from base images) such that their contents can only be modified +by ADD and COPY instructions. Any changes made in those locations by RUN +instructions will be reverted. Before the introduction of this option, this +behavior was the default, but it is now disabled by default. + +[//]: # (END included file options/compat-volumes.md) + +#### **--compress** + +This option is added to be aligned with other containers CLIs. +Podman doesn't communicate with a daemon or a remote server. +Thus, compressing the data before sending it is irrelevant to Podman. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/cpp-flag.md) +#### **--cpp-flag**=*flags* + +Set additional flags to pass to the C Preprocessor cpp(1). Containerfiles ending with a ".in" suffix is preprocessed via cpp(1). This option can be used to pass additional flags to cpp.Note: You can also set default CPPFLAGS by setting the BUILDAH_CPPFLAGS environment variable (e.g., export BUILDAH_CPPFLAGS="-DDEBUG"). + +[//]: # (END included file options/cpp-flag.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + +#### **--cw**=*options* + +Produce an image suitable for use as a confidential workload running in a +trusted execution environment (TEE) using krun (i.e., *crun* built with the +libkrun feature enabled and invoked as *krun*). Instead of the conventional +contents, the root filesystem of the image will contain an encrypted disk image +and configuration information for krun. + +The value for *options* is a comma-separated list of key=value pairs, supplying +configuration information which is needed for producing the additional data +which will be included in the container image. + +Recognized _keys_ are: + +*attestation_url*: The location of a key broker / attestation server. +If a value is specified, the new image's workload ID, along with the passphrase +used to encrypt the disk image, will be registered with the server, and the +server's location will be stored in the container image. +At run-time, krun is expected to contact the server to retrieve the passphrase +using the workload ID, which is also stored in the container image. +If no value is specified, a *passphrase* value *must* be specified. + +*cpus*: The number of virtual CPUs which the image expects to be run with at +run-time. If not specified, a default value will be supplied. + +*firmware_library*: The location of the libkrunfw-sev shared library. If not +specified, `buildah` checks for its presence in a number of hard-coded +locations. + +*memory*: The amount of memory which the image expects to be run with at +run-time, as a number of megabytes. If not specified, a default value will be +supplied. + +*passphrase*: The passphrase to use to encrypt the disk image which will be +included in the container image. +If no value is specified, but an *attestation_url* value is specified, a +randomly-generated passphrase will be used. +The authors recommend setting an *attestation_url* but not a *passphrase*. + +*slop*: Extra space to allocate for the disk image compared to the size of the +container image's contents, expressed either as a percentage (..%) or a size +value (bytes, or larger units if suffixes like KB or MB are present), or a sum +of two or more such specifications. If not specified, `buildah` guesses that +25% more space than the contents will be enough, but this option is provided in +case its guess is wrong. + +*type*: The type of trusted execution environment (TEE) which the image should +be marked for use with. Accepted values are "SEV" (AMD Secure Encrypted +Virtualization - Encrypted State) and "SNP" (AMD Secure Encrypted +Virtualization - Secure Nested Paging). If not specified, defaults to "SNP". + +*workload_id*: A workload identifier which will be recorded in the container +image, to be used at run-time for retrieving the passphrase which was used to +encrypt the disk image. If not specified, a semi-random value will be derived +from the base image's image ID. + +This option is not supported on the remote client, including Mac and Windows +(excluding WSL2) machines. + + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the container. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The container only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: if the user only has access rights via a group, accessing the device +from inside a rootless container fails. The **[crun(1)](https://github.com/containers/crun/tree/main/crun.1.md)** runtime offers a +workaround for this by adding the option +**--annotation run.oci.keep_original_groups=1**. + + +[//]: # (BEGIN included file options/disable-compression.md) +#### **--disable-compression**, **-D** + +Don't compress filesystem layers when building the image unless it is required +by the location where the image is being written. This is the default setting, +because image layers are compressed automatically when they are pushed to +registries, and images being written to local storage only need to be +decompressed again to be stored. Compression can be forced in all cases by +specifying **--disable-compression=false**. + +[//]: # (END included file options/disable-compression.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + + +[//]: # (BEGIN included file options/dns.md) +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. + +[//]: # (END included file options/dns.md) + +This option cannot be combined with **--network** that is set to **none**. + +Note: this option takes effect only during *RUN* instructions in the build. +It does not affect _/etc/resolv.conf_ in the final image. + + +[//]: # (BEGIN included file options/dns-option.image.md) +#### **--dns-option**=*option* + +Set custom DNS options to be used during the build. + +[//]: # (END included file options/dns-option.image.md) + + +[//]: # (BEGIN included file options/dns-search.image.md) +#### **--dns-search**=*domain* + +Set custom DNS search domains to be used during the build. + +[//]: # (END included file options/dns-search.image.md) + + +[//]: # (BEGIN included file options/env.image.md) +#### **--env**=*env[=value]* + +Add a value (e.g. env=*value*) to the built image. Can be used multiple times. +If neither `=` nor a *value* are specified, but *env* is set in the current +environment, the value from the current environment is added to the image. +To remove an environment variable from the built image, use the `--unsetenv` +option. + +[//]: # (END included file options/env.image.md) + + +[//]: # (BEGIN included file options/file.md) +#### **--file**, **-f**=*Containerfile* + +Specifies a Containerfile which contains instructions for building the image, +either a local file or an **http** or **https** URL. If more than one +Containerfile is specified, *FROM* instructions are only be accepted from the +last specified file. + +If a build context is not specified, and at least one Containerfile is a +local file, the directory in which it resides is used as the build +context. + +Specifying the option `-f -` causes the Containerfile contents to be read from stdin. + +[//]: # (END included file options/file.md) + + +[//]: # (BEGIN included file options/force-rm.md) +#### **--force-rm** + +Always remove intermediate containers after a build, even if the build fails (default true). + +[//]: # (END included file options/force-rm.md) + + +[//]: # (BEGIN included file options/format.md) +#### **--format** + +Control the format for the built image's manifest and configuration data. +Recognized formats include *oci* (OCI image-spec v1.0, the default) and +*docker* (version 2, using schema format 2 for the manifest). + +Note: You can also override the default format by setting the BUILDAH\_FORMAT +environment variable. `export BUILDAH_FORMAT=docker` + +[//]: # (END included file options/format.md) + + +[//]: # (BEGIN included file options/from.md) +#### **--from** + +Overrides the first `FROM` instruction within the Containerfile. If there are multiple +FROM instructions in a Containerfile, only the first is changed. + +With the remote podman client, not all container transports work as +expected. For example, oci-archive:/x.tar references /x.tar on the remote +machine instead of on the client. When using podman remote clients it is +best to restrict use to *containers-storage*, and *docker:// transports*. + +[//]: # (END included file options/from.md) + + +[//]: # (BEGIN included file options/group-add.md) +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/group-add.md) + + +[//]: # (BEGIN included file options/help.md) +#### **--help**, **-h** + +Print usage statement + +[//]: # (END included file options/help.md) + + +[//]: # (BEGIN included file options/hooks-dir.md) +#### **--hooks-dir**=*path* + +Each *.json file in the path configures a hook for buildah build containers. For more details on the syntax of the JSON files and the semantics of hook injection. Buildah currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. + +This option may be set multiple times; paths from later options have higher precedence. + +For the annotation conditions, buildah uses any annotations set in the generated OCI configuration. + +For the bind-mount conditions, only mounts explicitly requested by the caller via --volume are considered. Bind mounts that buildah inserts by default (e.g. /dev/shm) are not considered. + +If --hooks-dir is unset for root callers, Buildah currently defaults to /usr/share/containers/oci/hooks.d and /etc/containers/oci/hooks.d in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting --hooks-dir. + +[//]: # (END included file options/hooks-dir.md) + + +[//]: # (BEGIN included file options/http-proxy.md) +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. + +[//]: # (END included file options/http-proxy.md) + + +[//]: # (BEGIN included file options/identity-label.md) +#### **--identity-label** + +Adds default identity label `io.buildah.version` if set. (default true). + +[//]: # (END included file options/identity-label.md) + + +[//]: # (BEGIN included file options/ignorefile.md) +#### **--ignorefile** + +Path to an alternative .containerignore file. + +[//]: # (END included file options/ignorefile.md) + + +[//]: # (BEGIN included file options/iidfile.md) +#### **--iidfile**=*ImageIDfile* + +Write the built image's ID to the file. When `--platform` is specified more than once, attempting to use this option triggers an error. + +[//]: # (END included file options/iidfile.md) + + +[//]: # (BEGIN included file options/ipc.image.md) +#### **--ipc**=*how* + +Sets the configuration for IPC namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate +that a new IPC namespace is created, or it can be "host" to indicate +that the IPC namespace in which `podman` itself is being run is reused, +or it can be the path to an IPC namespace which is already in use by +another process. + +[//]: # (END included file options/ipc.image.md) + + +[//]: # (BEGIN included file options/isolation.md) +#### **--isolation**=*type* + +Controls what type of isolation is used for running processes as part of `RUN` +instructions. Recognized types include *oci* (OCI-compatible runtime, the +default), *rootless* (OCI-compatible runtime invoked using a modified +configuration and its --rootless option enabled, with *--no-new-keyring +--no-pivot* added to its *create* invocation, with network and UTS namespaces +disabled, and IPC, PID, and user namespaces enabled; the default for +unprivileged users), and *chroot* (an internal wrapper that leans more toward +chroot(1) than container technology). + +Note: You can also override the default isolation type by setting the +BUILDAH\_ISOLATION environment variable. `export BUILDAH_ISOLATION=oci` + +[//]: # (END included file options/isolation.md) + + +[//]: # (BEGIN included file options/jobs.md) +#### **--jobs**=*number* + +Run up to N concurrent stages in parallel. If the number of jobs is greater +than 1, stdin is read from /dev/null. If 0 is specified, then there is +no limit in the number of jobs that run in parallel. + +[//]: # (END included file options/jobs.md) + + +[//]: # (BEGIN included file options/label.image.md) +#### **--label**=*label* + +Add an image *label* (e.g. label=*value*) to the image metadata. Can be used +multiple times. + +Users can set a special LABEL **io.containers.capabilities=CAP1,CAP2,CAP3** in +a Containerfile that specifies the list of Linux capabilities required for the +container to run properly. This label specified in a container image tells +Podman to run the container with just these capabilities. Podman launches the +container with just the specified capabilities, as long as this list of +capabilities is a subset of the default list. + +If the specified capabilities are not in the default set, Podman prints an error +message and runs the container with the default capabilities. + +[//]: # (END included file options/label.image.md) + + +[//]: # (BEGIN included file options/layer-label.md) +#### **--layer-label**=*label[=value]* + +Add an intermediate image *label* (e.g. label=*value*) to the intermediate +image metadata. It can be used multiple times. + +If *label* is named, but neither `=` nor a `value` is provided, then +the *label* is set to an empty value. + +[//]: # (END included file options/layer-label.md) + + +[//]: # (BEGIN included file options/layers.md) +#### **--layers** + +Cache intermediate images during the build process (Default is `true`). + +Note: You can also override the default value of layers by setting the +BUILDAH\_LAYERS environment variable. `export BUILDAH_LAYERS=true` + +[//]: # (END included file options/layers.md) + + +[//]: # (BEGIN included file options/logfile.md) +#### **--logfile**=*filename* + +Log output which is sent to standard output and standard error to the +specified file instead of to standard output and standard error. +This option is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. + +[//]: # (END included file options/logfile.md) + +#### **--logsplit**=*bool-value* + +If `--logfile` and `--platform` are specified, the `--logsplit` option allows +end-users to split the log file for each platform into different files in the +following format: `${logfile}_${platform-os}_${platform-arch}`. +This option is not supported on the remote client, including Mac and Windows +(excluding WSL2) machines. + + +[//]: # (BEGIN included file options/manifest.md) +#### **--manifest**=*manifest* + +Name of the manifest list to which the image is added. Creates the manifest list if it does not exist. This option is useful for building multi architecture images. + +[//]: # (END included file options/manifest.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/network.image.md) +#### **--network**=*mode*, **--net** + +Sets the configuration for network namespaces when handling `RUN` instructions. + +Valid _mode_ values are: + +- **none**: no networking. +- **host**: use the Podman host network stack. Note: the host mode gives the +container full access to local system services such as D-bus and is therefore +considered insecure. +- **ns:**_path_: path to a network namespace to join. +- **private**: create a new namespace for the container (default) +- **\**: Join the network with the given name or ID, e.g. use `--network mynet` to join the network with the name mynet. Only supported for rootful users. +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=MTU**: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=CIDR**: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=INTERFACE**: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=IPv4**: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=INTERFACE**: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=IPv6**: Specify the outbound ipv6 address slirp binds to. +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.image.md) + + +[//]: # (BEGIN included file options/no-cache.md) +#### **--no-cache** + +Do not use existing cached images for the container build. Build from the start with a new set of cached layers. + +[//]: # (END included file options/no-cache.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the container. + +Podman assumes control over the container's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/omit-history.md) +#### **--omit-history** + +Omit build history information in the built image. (default false). + +This option is useful for the cases where end users explicitly +want to set `--omit-history` to omit the optional `History` from +built images or when working with images built using build tools that +do not include `History` information in their images. + +[//]: # (END included file options/omit-history.md) + + +[//]: # (BEGIN included file options/os.md) +#### **--os**=*string* + +Set the OS of the image to be built, and that of the base image to be pulled, if the build uses one, instead of using the current operating system of the build host. Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. + +[//]: # (END included file options/os.md) + + +[//]: # (BEGIN included file options/os-feature.md) +#### **--os-feature**=*feature* + +Set the name of a required operating system *feature* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS feature list is kept, if the base image specified any. This option is typically only meaningful when the image's OS is Windows. + +If *feature* has a trailing `-`, then the *feature* is removed from the set of required features which is listed in the image. + +[//]: # (END included file options/os-feature.md) + + +[//]: # (BEGIN included file options/os-version.image.md) +#### **--os-version**=*version* + +Set the exact required operating system *version* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS version is kept, if the base image specified one. This option is typically only meaningful when the image's OS is Windows, and is typically set in Windows base images, so using this option is usually unnecessary. + +[//]: # (END included file options/os-version.image.md) + +#### **--output**, **-o**=*output-opts* + +Output destination (format: type=local,dest=path) + +The --output (or -o) option extends the default behavior of building a container image by allowing users to export the contents of the image as files on the local filesystem, which can be useful for generating local binaries, code generation, etc. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +The value for --output is a comma-separated sequence of key=value pairs, defining the output type and options. + +Supported _keys_ are: +- **dest**: Destination path for exported output. Valid value is absolute or relative path, `-` means the standard output. +- **type**: Defines the type of output to be used. Valid values is documented below. + +Valid _type_ values are: +- **local**: write the resulting build files to a directory on the client-side. +- **tar**: write the resulting files as a single tarball (.tar). + +If no type is specified, the value defaults to **local**. +Alternatively, instead of a comma-separated sequence, the value of **--output** can be just a destination (in the **dest** format) (e.g. `--output some-path`, `--output -`) where `--output some-path` is treated as if **type=local** and `--output -` is treated as if **type=tar**. + + +[//]: # (BEGIN included file options/pid.image.md) +#### **--pid**=*pid* + +Sets the configuration for PID namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new PID namespace is created, or it can be "host" to indicate that the PID namespace in which `podman` itself is being run is reused, or it can be the path to a PID namespace which is already in use by another +process. + +[//]: # (END included file options/pid.image.md) + +#### **--platform**=*os/arch[/variant][,...]* + +Set the *os/arch* of the built image (and its base image, when using one) +to the provided value instead of using the current operating system and +architecture of the host (for example `linux/arm`). Unless overridden, +subsequent lookups of the same image in the local storage matches this +platform, regardless of the host. + +If `--platform` is set, then the values of the `--arch`, `--os`, and +`--variant` options is overridden. + +The `--platform` option can be specified more than once, or given a +comma-separated list of values as its argument. When more than one platform is +specified, the `--manifest` option is used instead of the `--tag` +option. + +Os/arch pairs are those used by the Go Programming Language. In several cases +the *arch* value for a platform differs from one produced by other tools such as +the `arch` command. Valid OS and architecture name combinations are listed as +values for $GOOS and $GOARCH at https://golang.org/doc/install/source#environment, +and can also be found by running `go tool dist list`. + +While `podman build` is happy to use base images and build images for any +platform that exists, `RUN` instructions are unable to succeed without +the help of emulation provided by packages like `qemu-user-static`. + + +[//]: # (BEGIN included file options/pull.image.md) +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Only pull the image when it does not exist in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error when no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. + +[//]: # (END included file options/pull.image.md) + + +[//]: # (BEGIN included file options/quiet.md) +#### **--quiet**, **-q** + +Suppress output messages which indicate which instruction is being processed, and of progress when pulling images from a registry, and when writing the output image. + +[//]: # (END included file options/quiet.md) + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + + +[//]: # (BEGIN included file options/rm.md) +#### **--rm** + +Remove intermediate containers after a successful build (default true). + +[//]: # (END included file options/rm.md) + + +[//]: # (BEGIN included file options/runtime.md) +#### **--runtime**=*path* + +The *path* to an alternate OCI-compatible runtime, which is used to run +commands specified by the **RUN** instruction. + +Note: You can also override the default runtime by setting the BUILDAH\_RUNTIME environment variable. `export BUILDAH_RUNTIME=/usr/local/bin/runc` + +[//]: # (END included file options/runtime.md) + + +[//]: # (BEGIN included file options/runtime-flag.md) +#### **--runtime-flag**=*flag* + +Adds global flags for the container runtime. To list the supported flags, please consult the manpages of the selected container runtime. + +Note: Do not pass the leading -- to the flag. To pass the runc flag --log-format json to buildah build, the option given is --runtime-flag log-format=json. + +[//]: # (END included file options/runtime-flag.md) + +#### **--sbom**=*preset* + +Generate SBOMs (Software Bills Of Materials) for the output image by scanning +the working container and build contexts using the named combination of scanner +image, scanner commands, and merge strategy. Must be specified with one or +more of **--sbom-image-output**, **--sbom-image-purl-output**, **--sbom-output**, +and **--sbom-purl-output**. Recognized presets, and the set of options which +they equate to: + + - "syft", "syft-cyclonedx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output cyclonedx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output cyclonedx-json={OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "syft-spdx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output spdx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output spdx-json={OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + - "trivy", "trivy-cyclonedx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "trivy-spdx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + +#### **--sbom-image-output**=*path* + +When generating SBOMs, store the generated SBOM in the specified path in the +output image. There is no default. + +#### **--sbom-image-purl-output**=*path* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the specified path in the output +image. There is no default. + +#### **--sbom-merge-strategy**=*method* + +If more than one **--sbom-scanner-command** value is being used, use the +specified method to merge the output from later commands with output from +earlier commands. Recognized values include: + + - cat + Concatenate the files. + - merge-cyclonedx-by-component-name-and-version + Merge the "component" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "version" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + - merge-spdx-by-package-name-and-versioninfo + Merge the "package" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "versionInfo" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + +#### **--sbom-output**=*file* + +When generating SBOMs, store the generated SBOM in the named file on the local +filesystem. There is no default. + +#### **--sbom-purl-output**=*file* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the named file in the local +filesystem. There is no default. + +#### **--sbom-scanner-command**=*image* + +Generate SBOMs by running the specified command from the scanner image. If +multiple commands are specified, they are run in the order in which they are +specified. These text substitutions are performed: + - {ROOTFS} + The root of the built image's filesystem, bind mounted. + - {CONTEXT} + The build context and additional build contexts, bind mounted. + - {OUTPUT} + The name of a temporary output file, to be read and merged with others or copied elsewhere. + +#### **--sbom-scanner-image**=*image* + +Generate SBOMs using the specified scanner image. + + +[//]: # (BEGIN included file options/secret.image.md) +#### **--secret**=**id=id[,src=*envOrFile*][,env=*ENV*][,type=*file* | *env*]** + +Pass secret information to be used in the Containerfile for building images +in a safe way that will not end up stored in the final image, or be seen in other stages. +The value of the secret will be read from an environment variable or file named +by the "id" option, or named by the "src" option if it is specified, or from an +environment variable specified by the "env" option. See [EXAMPLES](#examples). +The secret will be mounted in the container at `/run/secrets/id` by default. + +To later use the secret, use the --mount flag in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret` + +The location of the secret in the container can be overridden using the +"target", "dst", or "destination" option of the `RUN --mount` flag. + +`RUN --mount=type=secret,id=mysecret,target=/run/secrets/myothersecret cat /run/secrets/myothersecret` + +Note: changing the contents of secret files will not trigger a rebuild of layers that use said secrets. + +[//]: # (END included file options/secret.image.md) + + +[//]: # (BEGIN included file options/security-opt.image.md) +#### **--security-opt**=*option* + +Security Options + +- `apparmor=unconfined` : Turn off apparmor confinement for the container +- `apparmor=alternate-profile` : Set the apparmor confinement profile for the +container + +- `label=user:USER` : Set the label user for the container processes +- `label=role:ROLE` : Set the label role for the container processes +- `label=type:TYPE` : Set the label process type for the container processes +- `label=level:LEVEL` : Set the label level for the container processes +- `label=filetype\:TYPE` : Set the label file type for the container files +- `label=disable` : Turn off label separation for the container +- `no-new-privileges` : Not supported + +- `seccomp=unconfined` : Turn off seccomp confinement for the container +- `seccomp=profile.json` : JSON file to be used as the seccomp filter for the container. + +[//]: # (END included file options/security-opt.image.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the container. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + +#### **--sign-by**=*fingerprint* + +Sign the image using a GPG key with the specified FINGERPRINT. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines,) + + +[//]: # (BEGIN included file options/skip-unused-stages.md) +#### **--skip-unused-stages** + +Skip stages in multi-stage builds which don't affect the target stage. (Default: **true**). + +[//]: # (END included file options/skip-unused-stages.md) + + +[//]: # (BEGIN included file options/squash.md) +#### **--squash** + +Squash all of the image's new layers into a single new layer; any preexisting layers are not squashed. + +[//]: # (END included file options/squash.md) + + +[//]: # (BEGIN included file options/squash-all.md) +#### **--squash-all** + +Squash all of the new image's layers (including those inherited from a base image) into a single new layer. + +[//]: # (END included file options/squash-all.md) + + +[//]: # (BEGIN included file options/ssh.md) +#### **--ssh**=*default* | *id[=socket>* + +SSH agent socket or keys to expose to the build. +The socket path can be left empty to use the value of `default=$SSH_AUTH_SOCK` + +To later use the ssh agent, use the --mount option in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=ssh,id=id mycmd` + +[//]: # (END included file options/ssh.md) + +#### **--stdin** + +Pass stdin into the RUN containers. Sometime commands being RUN within a Containerfile +want to request information from the user. For example apt asking for a confirmation for install. +Use --stdin to be able to interact from the terminal during the build. + + +[//]: # (BEGIN included file options/tag.md) +#### **--tag**, **-t**=*imageName* + +Specifies the name which is assigned to the resulting image if the build process completes successfully. +If _imageName_ does not include a registry name, the registry name *localhost* is prepended to the image name. + +[//]: # (END included file options/tag.md) + + +[//]: # (BEGIN included file options/target.md) +#### **--target**=*stageName* + +Set the target build stage to build. When building a Containerfile with multiple build stages, --target can be used to specify an intermediate build stage by name as the final stage for the resulting image. Commands after the target stage is skipped. + +[//]: # (END included file options/target.md) + + +[//]: # (BEGIN included file options/timestamp.md) +#### **--timestamp**=*seconds* + +Set the create timestamp to seconds since epoch to allow for deterministic builds (defaults to current time). By default, the created timestamp is changed and written into the image manifest with every commit, causing the image's sha256 hash to be different even if the sources are exactly the same otherwise. +When --timestamp is set, the created timestamp is always set to the time specified and therefore not changed, allowing the image's sha256 hash to remain the same. All files committed to the layers of the image is created with the timestamp. + +If the only instruction in a Containerfile is `FROM`, this flag has no effect. + +[//]: # (END included file options/timestamp.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/ulimit.image.md) +#### **--ulimit**=*type=soft-limit[\:hard-limit]* + +Specifies resource limits to apply to processes launched when processing `RUN` instructions. This option can be specified multiple times. Recognized resource types include: + "core": maximum core dump size (ulimit -c) + "cpu": maximum CPU time (ulimit -t) + "data": maximum size of a process's data segment (ulimit -d) + "fsize": maximum size of new files (ulimit -f) + "locks": maximum number of file locks (ulimit -x) + "memlock": maximum amount of locked memory (ulimit -l) + "msgqueue": maximum amount of data in message queues (ulimit -q) + "nice": niceness adjustment (nice -n, ulimit -e) + "nofile": maximum number of open files (ulimit -n) + "nproc": maximum number of processes (ulimit -u) + "rss": maximum size of a process's (ulimit -m) + "rtprio": maximum real-time scheduling priority (ulimit -r) + "rttime": maximum amount of real-time execution between blocking syscalls + "sigpending": maximum number of pending signals (ulimit -i) + "stack": maximum stack size (ulimit -s) + +[//]: # (END included file options/ulimit.image.md) + + +[//]: # (BEGIN included file options/unsetenv.image.md) +#### **--unsetenv**=*env* + +Unset environment variables from the final image. + +[//]: # (END included file options/unsetenv.image.md) + + +[//]: # (BEGIN included file options/unsetlabel.md) +#### **--unsetlabel**=*label* + +Unset the image label, causing the label not to be inherited from the base image. + +[//]: # (END included file options/unsetlabel.md) + + +[//]: # (BEGIN included file options/userns.image.md) +#### **--userns**=*how* + +Sets the configuration for user namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new user namespace is created, it can be "host" to indicate that the user namespace in which `podman` itself is being run is reused, or it can be the path to a user namespace which is already in use by another process. + +[//]: # (END included file options/userns.image.md) + + +[//]: # (BEGIN included file options/userns-gid-map.md) +#### **--userns-gid-map**=*mapping* + +Directly specifies a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container GID, a corresponding starting host-level GID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-gids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-gid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-gid-map are specified, but --userns-uid-map is specified, the GID map is set to use the same numeric values as the UID map. + +[//]: # (END included file options/userns-gid-map.md) + + +[//]: # (BEGIN included file options/userns-gid-map-group.md) +#### **--userns-gid-map-group**=*group* + +Specifies that a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subgid` file which correspond to the specified group. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-uid-map-user is specified, but --userns-gid-map-group is not specified, `podman` assumes that the specified user name is also a +suitable group name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. + +[//]: # (END included file options/userns-gid-map-group.md) + + +[//]: # (BEGIN included file options/userns-uid-map.md) +#### **--userns-uid-map**=*mapping* + +Directly specifies a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions default to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container UID, a corresponding starting host-level UID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-uids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-uid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-uid-map are specified, but --userns-gid-map is specified, the UID map is set to use the same numeric values as the GID map. + +[//]: # (END included file options/userns-uid-map.md) + + +[//]: # (BEGIN included file options/userns-uid-map-user.md) +#### **--userns-uid-map-user**=*user* + +Specifies that a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subuid` file which correspond to the specified user. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-gid-map-group is specified, but --userns-uid-map-user is not specified, `podman` assumes that the specified group name is also a +suitable user name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. + +[//]: # (END included file options/userns-uid-map-user.md) + + +[//]: # (BEGIN included file options/uts.md) +#### **--uts**=*how* + +Sets the configuration for UTS namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new UTS namespace to be created, or it can be "host" to indicate that the UTS namespace in which `podman` itself is being run is reused, or it can be the path to a UTS namespace which is already in use by another process. + +[//]: # (END included file options/uts.md) + +#### **--variant**=*variant* + +Set the architecture variant of the image to be built, and that of the base +image to be pulled, if the build uses one, to the provided value instead of +using the architecture variant of the build host. + + +[//]: # (BEGIN included file options/volume.image.md) +#### **--volume**, **-v**=*[HOST-DIR\:CONTAINER-DIR[\:OPTIONS]]* + +Mount a host directory into containers when executing RUN instructions during +the build. + +The `OPTIONS` are a comma-separated list and can be one or more of: + + * [rw|ro] + * [z|Z|O] + * [U] + * [`[r]shared`|`[r]slave`|`[r]private`][[1]](#Footnote1) + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR` +must be an absolute path as well. Podman bind-mounts the `HOST-DIR` to the +specified path when processing RUN instructions. + +You can specify multiple **-v** options to mount one or more mounts. + +You can add the `:ro` or `:rw` suffix to a volume to mount it read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted. When running using user namespaces, the UID and GID inside +the namespace may correspond to another UID and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the namespace, to change recursively the owner and group of +the source volume. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add one of these two suffixes +`:z` or `:Z` to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The `z` option tells Podman that two containers +share the volume content. As a result, Podman labels the content with a shared +content label. Shared volume labels allow all containers to read/write content. +The `Z` option tells Podman to label the content with a private unshared label. +Only the current container can use a private volume. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the host machine to fail. For these types +of containers, disabling SELinux separation is recommended. The option +`--security-opt label=disable` disables SELinux separation for the container. +For example, if a user wanted to volume mount their entire home directory into the build containers, they need to disable SELinux separation. + + $ podman build --security-opt label=disable -v $HOME:/home/user . + +`Overlay Volume Mounts` + +The `:O` flag tells Podman to mount the directory from the host as a +temporary storage using the Overlay file system. The `RUN` command containers +are allowed to modify contents within the mountpoint and are stored in the +container storage in a separate directory. In Overlay FS terms the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the `RUN` command +finishes executing, similar to a tmpfs mount point. + +Any subsequent execution of `RUN` commands sees the original source directory +content, any changes from previous RUN commands no longer exists. + +One use case of the `overlay` mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: + +- Overlay mounts are not currently supported in rootless mode. +- The `O` flag is not allowed to be specified with the `Z` or `z` flags. + Content mounted into the container is labeled with the private label. + On SELinux systems, labels in the source directory needs to be readable + by the container label. If not, SELinux container separation must be disabled + for the container to work. +- Modification of the directory volume mounted into the container with an + overlay mount can cause unexpected failures. Do not modify the directory until + the container finishes running. + +By default bind mounted volumes are `private`. That means any mounts done +inside containers are not be visible on the host and vice versa. This behavior +can be changed by specifying a volume mount propagation property. + +When the mount propagation policy is set to `shared`, any mounts completed +inside the container on that volume is visible to both the host and +container. When the mount propagation policy is set to `slave`, one way mount +propagation is enabled and any mounts completed on the host for that volume is +visible only inside of the container. To control the mount propagation +property of volume use the `:[r]shared`, `:[r]slave` or `:[r]private` +propagation flag. For mount propagation to work on the source mount point (mount +point where source dir is mounted on) has to have the right propagation properties. +For shared volumes, the source mount point has to be shared. And for slave volumes, +the source mount has to be either shared or slave. [[1]](#Footnote1) + +Use `df ` to determine the source mount and then use +`findmnt -o TARGET,PROPAGATION ` to determine propagation +properties of source mount, if `findmnt` utility is not available, the source +mount point can be determined by looking at the mount entry in +`/proc/self/mountinfo`. Look at `optional fields` and see if any propagation +properties are specified. +`shared:X` means the mount is `shared`, `master:X` means the mount is `slave` +and if nothing is there that means the mount is `private`. [[1]](#Footnote1) + +To change propagation properties of a mount point use the `mount` command. For +example, to bind mount the source directory `/foo` do +`mount --bind /foo /foo` and `mount --make-private --make-shared /foo`. This +converts /foo into a `shared` mount point. The propagation properties of +the source mount can be changed directly. For instance if `/` is the source +mount for `/foo`, then use `mount --make-shared /` to convert `/` into a +`shared` mount. + +[//]: # (END included file options/volume.image.md) + +## EXAMPLES + +### Build an image using local Containerfiles + +Build image using Containerfile with content from current directory: +``` +$ podman build . +``` + +Build image using specified Containerfile with content from current directory: +``` +$ podman build -f Containerfile.simple . +``` + +Build image using Containerfile from stdin with content from current directory: +``` +$ cat $HOME/Containerfile | podman build -f - . +``` + +Build image using multiple Containerfiles with content from current directory: +``` +$ podman build -f Containerfile.simple -f Containerfile.notsosimple . +``` + +Build image with specified Containerfile with content from $HOME directory. Note `cpp` is applied to Containerfile.in before processing as Containerfile: +``` +$ podman build -f Containerfile.in $HOME +``` + +Build image with the specified tag with Containerfile and content from current directory: +``` +$ podman build -t imageName . +``` + +Build image ignoring registry verification for any images pulled via the Containerfile: +``` +$ podman build --tls-verify=false -t imageName . +``` + +Build image with the specified logging format: +``` +$ podman build --runtime-flag log-format=json . +``` + +Build image using debug mode for logging: +``` +$ podman build --runtime-flag debug . +``` + +Build image using specified registry attributes when pulling images from the selected Containerfile: +``` +$ podman build --authfile /tmp/auths/myauths.json --cert-dir $HOME/auth --tls-verify=true --creds=username:password -t imageName -f Containerfile.simple . +``` + +Build image using specified resource controls when running containers during the build: +``` +$ podman build --memory 40m --cpu-period 10000 --cpu-quota 50000 --ulimit nofile=1024:1028 -t imageName . +``` + +Build image using specified SELinux labels and cgroup config running containers during the build: +``` +$ podman build --security-opt label=level:s0:c100,c200 --cgroup-parent /path/to/cgroup/parent -t imageName . +``` + +Build image with read-only and SELinux relabeled volume mounted from the host into running containers during the build: +``` +$ podman build --volume /home/test:/myvol:ro,Z -t imageName . +``` + +Build image with overlay volume mounted from the host into running containers during the build: +``` +$ podman build -v /var/lib/yum:/var/lib/yum\:O -t imageName . +``` + +Build image using layers and then removing intermediate containers even if the build fails. +``` +$ podman build --layers --force-rm -t imageName . +``` + +Build image ignoring cache and not removing intermediate containers even if the build succeeds: +``` +$ podman build --no-cache --rm=false -t imageName . +``` + +Build image using the specified network when running containers during the build: +``` +$ podman build --network mynet . +``` + +Build an image using a secret stored in an environment variable or file named `mysecret` to be used with the instruction `RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret`: +``` +$ podman build --secret=id=mysecret . +``` + +Build an image using a secret stored in an environment variable named `MYSECRET` to be used with the instruction `RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret`: +``` +$ podman build --secret=id=mysecret,env=MYSECRET . +$ podman build --secret=id=mysecret,src=MYSECRET,type=env . +``` + +Build an image using a secret stored in a file named `.mysecret` to be used with the instruction `RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret`: +``` +$ podman build --secret=id=mysecret,src=.mysecret . +$ podman build --secret=id=mysecret,src=.mysecret,type=file . +``` + +### Building a multi-architecture image using the --manifest option (requires emulation software) + +Build image using the specified architectures and link to a single manifest on successful completion: +``` +$ podman build --arch arm --manifest myimage /tmp/mysrc +$ podman build --arch amd64 --manifest myimage /tmp/mysrc +$ podman build --arch s390x --manifest myimage /tmp/mysrc +``` + +Similarly build using a single command +``` +$ podman build --platform linux/s390x,linux/ppc64le,linux/amd64 --manifest myimage /tmp/mysrc +``` + +Build image using multiple specified architectures and link to single manifest on successful completion: +``` +$ podman build --platform linux/arm64 --platform linux/amd64 --manifest myimage /tmp/mysrc +``` + +### Building an image using a URL, Git repo, or archive + + The build context directory can be specified as a URL to a Containerfile, a +Git repository, or URL to an archive. If the URL is a Containerfile, it is +downloaded to a temporary location and used as the context. When a Git +repository is set as the URL, the repository is cloned locally to a temporary +location and then used as the context. Lastly, if the URL is an archive, it is +downloaded to a temporary location and extracted before being used as the +context. + +#### Building an image using a URL to a Containerfile + +Build image from Containerfile downloaded into temporary location used as the build context: +``` +$ podman build https://10.10.10.1/podman/Containerfile +``` + +#### Building an image using a Git repository + + Podman clones the specified GitHub repository to a temporary location and +uses it as the context. The Containerfile at the root of the repository is used +and it only works if the GitHub repository is a dedicated repository. + +Build image from specified git repository downloaded into temporary location used as the build context: +``` +$ podman build -t hello https://github.com/containers/PodmanHello.git +$ podman run hello +``` + + Note: GitHub does not support using `git://` for performing `clone` operation due to recent changes in their security guidance (https://github.blog/2021-09-01-improving-git-protocol-security-github/). Use an `https://` URL if the source repository is hosted on GitHub. + +#### Building an image using a URL to an archive + + Podman fetches the archive file, decompresses it, and uses its contents as the +build context. The Containerfile at the root of the archive and the rest of the +archive are used as the context of the build. Passing the +`-f PATH/Containerfile` option as well tells the system to look for that file +inside the contents of the archive. + +``` +$ podman build -f dev/Containerfile https://10.10.10.1/podman/context.tar.gz +``` + + Note: supported compression formats are 'xz', 'bzip2', 'gzip' and 'identity' +(no compression). + +## Files + +### .containerignore/.dockerignore + +If the file *.containerignore* or *.dockerignore* exists in the context directory, +`podman build` reads its contents. Use the `--ignorefile` option to override the +.containerignore path location. +Podman uses the content to exclude files and directories from the context +directory, when executing COPY and ADD directives in the +Containerfile/Dockerfile + +The .containerignore and .dockerignore files use the same syntax; if both +are in the context directory, podman build only uses .containerignore. + +Users can specify a series of Unix shell globs in a .containerignore file to +identify files/directories to exclude. + +Podman supports a special wildcard string `**` which matches any number of +directories (including zero). For example, **/*.go excludes all files that +end with .go that are found in all directories. + +Example .containerignore file: + +``` +# exclude this content for image +*/*.c +**/output* +src +``` + +`*/*.c` +Excludes files and directories whose names ends with .c in any top level +subdirectory. For example, the source file include/rootless.c. + +`**/output*` +Excludes files and directories starting with `output` from any directory. + +`src` +Excludes files named src and the directory src as well as any content in it. + +Lines starting with ! (exclamation mark) can be used to make exceptions to +exclusions. The following is an example .containerignore file that uses this +mechanism: +``` +*.doc +!Help.doc +``` + +Exclude all doc files except Help.doc from the image. + +This functionality is compatible with the handling of .containerignore files +described here: + +https://github.com/containers/common/blob/main/docs/containerignore.5.md + +**registries.conf** (`/etc/containers/registries.conf`) + +registries.conf is the configuration file which specifies which container +registries is consulted when completing image names which do not include +a registry or domain portion. + +## Troubleshooting + +### lastlog sparse file + +Using a useradd command within a Containerfile with a large UID/GID creates +a large sparse file `/var/log/lastlog`. This can cause the +build to hang forever. Go language does not support sparse files correctly, +which can lead to some huge files being created in the container image. + +When using the `useradd` command within the build script, pass the +`--no-log-init or -l` option to the `useradd` command. This option tells +useradd to stop creating the lastlog file. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/main/man/runc.8.md)**, **[useradd(8)](https://www.unix.com/man-page/redhat/8/useradd)**, **[podman-ps(1)](podman-ps.1.md)**, **[podman-rm(1)](podman-rm.1.md)**, **[Containerfile(5)](https://github.com/containers/common/blob/main/docs/Containerfile.5.md)**, **[containerignore(5)](https://github.com/containers/common/blob/main/docs/containerignore.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +See [podman-rootless(7)](https://github.com/containers/podman/blob/main/rootless.md) +for rootless issues. + +## HISTORY +Aug 2020, Additional options and .containerignore added by Dan Walsh `` + +May 2018, Minor revisions added by Joe Doss `` + +December 2017, Originally compiled by Tom Sweeney `` + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a +core value of open source. The `master` and `slave` mount propagation +terminology used here is problematic and divisive, and needs to be changed. +However, these terms are currently used within the Linux kernel and must be +used as-is at this time. When the kernel maintainers rectify this usage, +Podman will follow suit immediately. diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-commit.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-commit.1.md new file mode 100644 index 000000000..5ae3c284a --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-commit.1.md @@ -0,0 +1,139 @@ +--- +title: podman-commit +version: v5.4.2 +--- + +% podman-commit 1 + +## NAME +podman\-commit - Create new image based on the changed container + +## SYNOPSIS +**podman commit** [*options*] *container* [*image*] + +**podman container commit** [*options*] *container* [*image*] + +## DESCRIPTION +**podman commit** creates an image based on a changed *container*. The author of the image can be set using the **--author** OPTION. Various image instructions can be configured with the **--change** OPTION and a commit message can be set using the **--message** OPTION. The *container* and its processes aren't paused while the image is committed. If this is not desired, the **--pause** OPTION can be set to *true*. When the commit is complete, Podman prints out the ID of the new image. + +If `image` does not begin with a registry name component, `localhost` is added to the name. +If `image` is not provided, the values for the `REPOSITORY` and `TAG` values of the created image is set to ``. + +## OPTIONS +#### **--author**, **-a**=*author* + +Set the author for the committed image. + +#### **--change**, **-c**=*instruction* + +Apply the following possible instructions to the created image: + +- *CMD* +- *ENTRYPOINT* +- *ENV* +- *EXPOSE* +- *LABEL* +- *ONBUILD* +- *STOPSIGNAL* +- *USER* +- *VOLUME* +- *WORKDIR* + +Can be set multiple times. + +#### **--config**=*ConfigBlobFile* + +Merge the container configuration from the specified file into the configuration for the image +as it is being committed. The file contents should be a JSON-encoded version of +a Schema2Config structure, which is defined at +https://github.com/containers/image/blob/v5.29.0/manifest/docker_schema2.go#L67. + +#### **--format**, **-f**=**oci** | *docker* + +Set the format of the image manifest and metadata. The currently supported formats are **oci** and *docker*.\ +The default is **oci**. + +#### **--iidfile**=*ImageIDfile* + +Write the image ID to the file. + +#### **--include-volumes** + +Include in the committed image any volumes added to the container by the **--volume** or **--mount** OPTIONS to the **[podman create](podman-create.1.md)** and **[podman run](podman-run.1.md)** commands.\ +The default is **false**. + +#### **--message**, **-m**=*message* + +Set commit message for committed image.\ +*IMPORTANT: The message field is not supported in `oci` format.* + +#### **--pause**, **-p** + +Pause the container when creating an image.\ +The default is **false**. + +#### **--quiet**, **-q** + +Suppresses output.\ +The default is **false**. + +#### **--squash**, **-s** + +Squash newly built layers into a single new layer.\ +The default is **false**. + +## EXAMPLES +Create image from container with entrypoint and label: +``` +$ podman commit --change CMD=/bin/bash --change ENTRYPOINT=/bin/sh --change "LABEL blue=image" reverent_golick image-committed +Getting image source signatures +Copying blob sha256:b41deda5a2feb1f03a5c1bb38c598cbc12c9ccd675f438edc6acd815f7585b86 + 25.80 MB / 25.80 MB [======================================================] 0s +Copying config sha256\:c16a6d30f3782288ec4e7521c754acc29d37155629cb39149756f486dae2d4cd + 448 B / 448 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Create image from container with commit message: +``` +$ podman commit -q --message "committing container to image" +reverent_golick image-committed +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Create image from container with author: +``` +$ podman commit -q --author "firstName lastName" reverent_golick image-committed +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Pause running container while creating image: +``` +$ podman commit -q --pause=true containerID image-committed +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Create image from container with default image tag: +``` +$ podman commit containerID +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Create image from container with default required capabilities: +``` +$ podman commit -q --change LABEL=io.containers.capabilities=setuid,setgid epic_nobel privimage +400d31a3f36dca751435e80a0e16da4859beb51ff84670ce6bdc5edb30b94066 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-create(1)](podman-create.1.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +December 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-completion.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-completion.1.md new file mode 100644 index 000000000..c02ffbfee --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-completion.1.md @@ -0,0 +1,83 @@ +--- +title: podman-completion +version: v5.4.2 +--- + +% podman-completion 1 + +## NAME +podman\-completion - Generate shell completion scripts + +## SYNOPSIS +**podman completion** [*options*] *bash* | *zsh* | *fish* | *powershell* + +## DESCRIPTION +**podman completion** generates shell completion scripts for a variety of shells. Supported shells are *bash*, *zsh*, *fish* and *powershell*. + +These script are used by the shell to provide suggestions and complete commands when the command is typed and `[TAB]` is pressed. + +Usually these scripts are automatically installed via the package manager. + +## OPTIONS +#### **--file**, **-f**=*file* + +Write the generated output to a file. + +#### **--no-desc** + +Do not provide description in the completions.\ +The default is **false**. + +## Installation + +### BASH +`bash-completion` has to be installed on the system. + +To load the completion script into the current session run: +``` +source <(podman completion bash) +``` + +To make it available for all bash sessions run: +``` +podman completion -f /etc/bash_completion.d/podman bash +``` + + +### ZSH +Shell completion needs to be already enabled in the environment. The following can be executed: +``` +echo "autoload -U compinit; compinit" >> ~/.zshrc +``` + +To make it available for all zsh sessions run: +``` +podman completion -f "${fpath[1]}/_podman" zsh +``` + +Once the shell is reloaded the auto-completion works. + + +### FISH +To load the completion script into the current session run: +``` +podman completion fish | source +``` + +To make it available for all fish sessions run: +``` +podman completion -f ~/.config/fish/completions/podman.fish fish +``` + +### POWERSHELL +To load the completion script into the current session run: +``` +podman.exe completion powershell | Out-String | Invoke-Expression +``` + +To make it available in all powershell sessions that a user has, write the +completion output to a file and source that to the user's powershell profile. +More information about profiles is available with **Get-Help about_Profiles**. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **zsh(1)**, **fish(1)**, **powershell(1)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-compose.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-compose.1.md new file mode 100644 index 000000000..bec767179 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-compose.1.md @@ -0,0 +1,28 @@ +--- +title: podman-compose +version: v5.4.2 +--- + +% podman-compose 1 + +## NAME +podman\-compose - Run Compose workloads via an external compose provider + +## SYNOPSIS +**podman compose** [*options*] [*command* [*arg* ...]] + +## DESCRIPTION +**podman compose** is a thin wrapper around an external compose provider such as docker-compose or podman-compose. This means that `podman compose` is executing another tool that implements the compose functionality but sets up the environment in a way to let the compose provider communicate transparently with the local Podman socket. The specified options as well the command and argument are passed directly to the compose provider. + +The default compose providers are `docker-compose` and `podman-compose`. If installed, `docker-compose` takes precedence since it is the original implementation of the Compose specification and is widely used on the supported platforms (i.e., Linux, Mac OS, Windows). + +If you want to change the default behavior or have a custom installation path for your provider of choice, please change the `compose_providers` field in `containers.conf(5)` to `compose_providers = ["/path/to/provider"]`. You may also set the `PODMAN_COMPOSE_PROVIDER` environment variable. + +By default, `podman compose` will emit a warning saying that it executes an external command. This warning can be disabled by setting `compose_warning_logs` to false in `containers.conf(5)` or setting the `PODMAN_COMPOSE_WARNING_LOGS` environment variable to false. See the man page for `containers.conf(5)` for more information. + +## OPTIONS + +To see supported options of the installed compose provider, please run `podman compose --help`. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-container-checkpoint.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-container-checkpoint.1.md new file mode 100644 index 000000000..da91a396f --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-container-checkpoint.1.md @@ -0,0 +1,231 @@ +--- +title: podman-container-checkpoint +version: v5.4.2 +--- + +% podman-container-checkpoint 1 + +## NAME +podman\-container\-checkpoint - Checkpoint one or more running containers + +## SYNOPSIS +**podman container checkpoint** [*options*] *container* [*container* ...] + +## DESCRIPTION +**podman container checkpoint** checkpoints all the processes in one or more *containers*. A *container* can be restored from a checkpoint with **[podman-container-restore](podman-container-restore.1.md)**. The *container IDs* or *names* are used as input. + +*IMPORTANT: If the container is using __systemd__ as __entrypoint__ checkpointing the container might not be possible.* + +## OPTIONS +#### **--all**, **-a** + +Checkpoint all running *containers*.\ +The default is **false**.\ +*IMPORTANT: This OPTION does not need a container name or ID as input argument.* + +#### **--compress**, **-c**=**zstd** | *none* | *gzip* + +Specify the compression algorithm used for the checkpoint archive created +with the **--export, -e** OPTION. Possible algorithms are **zstd**, *none* +and *gzip*.\ +One possible reason to use *none* is to enable faster creation of checkpoint +archives. Not compressing the checkpoint archive can result in faster checkpoint +archive creation.\ +The default is **zstd**. + +#### **--create-image**=*image* + +Create a checkpoint image from a running container. This is a standard OCI image +created in the local image store. It consists of a single layer that contains +all of the checkpoint files. The content of this image layer is in the same format as a +checkpoint created with **--export**. A checkpoint image can be pushed to a +standard container registry and pulled on a different system to enable container +migration. In addition, the image can be exported with **podman image save** and +inspected with **podman inspect**. Inspecting a checkpoint image displays +additional information, stored as annotations, about the host environment used +to do the checkpoint: + +- **io.podman.annotations.checkpoint.name**: Human-readable name of the original + container. + +- **io.podman.annotations.checkpoint.rawImageName**: Unprocessed name of the + image used to create the original container (as specified by the user). + +- **io.podman.annotations.checkpoint.rootfsImageID**: ID of the image used to + create the original container. + +- **io.podman.annotations.checkpoint.rootfsImageName**: Image name used to + create the original container. + +- **io.podman.annotations.checkpoint.podman.version**: Version of Podman used to + create the checkpoint. + +- **io.podman.annotations.checkpoint.criu.version**: Version of CRIU used to + create the checkpoint. + +- **io.podman.annotations.checkpoint.runtime.name**: Container runtime (e.g., + runc, crun) used to create the checkpoint. + +- **io.podman.annotations.checkpoint.runtime.version**: Version of the container + runtime used to create the checkpoint. + +- **io.podman.annotations.checkpoint.conmon.version**: Version of conmon used + with the original container. + +- **io.podman.annotations.checkpoint.host.arch**: CPU architecture of the host + on which the checkpoint was created. + +- **io.podman.annotations.checkpoint.host.kernel**: Version of Linux kernel + of the host where the checkpoint was created. + +- **io.podman.annotations.checkpoint.cgroups.version**: cgroup version used by + the host where the checkpoint was created. + +- **io.podman.annotations.checkpoint.distribution.version**: Version of host + distribution on which the checkpoint was created. + +- **io.podman.annotations.checkpoint.distribution.name**: Name of host + distribution on which the checkpoint was created. + +#### **--export**, **-e**=*archive* + +Export the checkpoint to a tar.gz file. The exported checkpoint can be used +to import the *container* on another system and thus enabling container live +migration. This checkpoint archive also includes all changes to the *container's* +root file-system, if not explicitly disabled using **--ignore-rootfs**. + +#### **--file-locks** + +Checkpoint a *container* with file locks. If an application running in the container +is using file locks, this OPTION is required during checkpoint and restore. Otherwise +checkpointing *containers* with file locks is expected to fail. If file locks are not +used, this option is ignored.\ +The default is **false**. + +#### **--ignore-rootfs** + +If a checkpoint is exported to a tar.gz file it is possible with the help of **--ignore-rootfs** to explicitly disable including changes to the root file-system into the checkpoint archive file.\ +The default is **false**.\ +*IMPORTANT: This OPTION only works in combination with __--export, -e__.* + +#### **--ignore-volumes** + +This OPTION must be used in combination with the **--export, -e** OPTION. +When this OPTION is specified, the content of volumes associated with +the *container* is not included into the checkpoint tar.gz file.\ +The default is **false**. + +#### **--keep**, **-k** + +Keep all temporary log and statistics files created by CRIU during checkpointing. These files are not deleted if checkpointing fails for further debugging. If checkpointing succeeds these files are theoretically not needed, but if these files are needed Podman can keep the files for further analysis.\ +The default is **false**. + +#### **--latest**, **-l** + +Instead of providing the *container ID* or *name*, use the last created *container*. The default is **false**. +*IMPORTANT: This OPTION is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines. This OPTION does not need a container name or ID as input argument.* + +#### **--leave-running**, **-R** + +Leave the *container* running after checkpointing instead of stopping it.\ +The default is **false**. + +#### **--pre-checkpoint**, **-P** + +Dump the *container's* memory information only, leaving the *container* running. Later +operations supersedes prior dumps. It only works on `runc 1.0-rc3` or `higher`.\ +The default is **false**. + +The functionality to only checkpoint the memory of the container and in a second +checkpoint only write out the memory pages which have changed since the first +checkpoint relies on the Linux kernel's soft-dirty bit, which is not available +on all systems as it depends on the system architecture and the configuration +of the Linux kernel. Podman verifies if the current system supports this +functionality and return an error if the current system does not support it. + +#### **--print-stats** + +Print out statistics about checkpointing the container(s). The output is +rendered in a JSON array and contains information about how much time different +checkpoint operations required. Many of the checkpoint statistics are created +by CRIU and just passed through to Podman. The following information is provided +in the JSON array: + +- **podman_checkpoint_duration**: Overall time (in microseconds) needed to create + all checkpoints. + +- **runtime_checkpoint_duration**: Time (in microseconds) the container runtime + needed to create the checkpoint. + +- **freezing_time**: Time (in microseconds) CRIU needed to pause (freeze) all + processes in the container (measured by CRIU). + +- **frozen_time**: Time (in microseconds) all processes in the container were + paused (measured by CRIU). + +- **memdump_time**: Time (in microseconds) needed to extract all required memory + pages from all container processes (measured by CRIU). + +- **memwrite_time**: Time (in microseconds) needed to write all required memory + pages to the corresponding checkpoint image files (measured by CRIU). + +- **pages_scanned**: Number of memory pages scanned to determine if they need + to be checkpointed (measured by CRIU). + +- **pages_written**: Number of memory pages actually written to the checkpoint + image files (measured by CRIU). + +The default is **false**. + +#### **--tcp-established** + +Checkpoint a *container* with established TCP connections. If the checkpoint +image contains established TCP connections, this OPTION is required during +restore. Defaults to not checkpointing *containers* with established TCP +connections.\ +The default is **false**. + +#### **--with-previous** + +Check out the *container* with previous criu image files in pre-dump. It only works on `runc 1.0-rc3` or `higher`.\ +The default is **false**.\ +*IMPORTANT: This OPTION is not available with __--pre-checkpoint__*. + +This option requires that the option __--pre-checkpoint__ has been used before on the +same container. Without an existing pre-checkpoint, this option fails. + +Also see __--pre-checkpoint__ for additional information about __--pre-checkpoint__ +availability on different systems. + +## EXAMPLES +Make a checkpoint for the container "mywebserver". +``` +# podman container checkpoint mywebserver +``` + +Create a checkpoint image for the container "mywebserver". +``` +# podman container checkpoint --create-image mywebserver-checkpoint-1 mywebserver +``` + +Dumps the container's memory information of the latest container into an archive. +``` +# podman container checkpoint -P -e pre-checkpoint.tar.gz -l +``` + +Keep the container's memory information from an older dump and add the new container's memory information. +``` +# podman container checkpoint --with-previous -e checkpoint.tar.gz -l +``` + +Dump the container's memory information of the latest container into an archive with the specified compress method. +``` +# podman container checkpoint -l --compress=none --export=dump.tar +# podman container checkpoint -l --compress=gzip --export=dump.tar.gz +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container-restore(1)](podman-container-restore.1.md)**, **criu(8)** + +## HISTORY +September 2018, Originally compiled by Adrian Reber diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-container-cleanup.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-container-cleanup.1.md new file mode 100644 index 000000000..9a53a1797 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-container-cleanup.1.md @@ -0,0 +1,61 @@ +--- +title: podman-container-cleanup +version: v5.4.2 +--- + +% podman-container-cleanup 1 + +## NAME +podman\-container\-cleanup - Clean up the container's network and mountpoints + +## SYNOPSIS +**podman container cleanup** [*options*] *container* [*container* ...] + +## DESCRIPTION +**podman container cleanup** cleans up exited *containers* by removing all mountpoints and network configurations from the host. The *container name* or *ID* can be used. The cleanup command does not remove the *containers*. Running *containers* are not cleaned up.\ +Sometimes container mount points and network stacks can remain if the podman command was killed or the *container* ran in daemon mode. This command is automatically executed when *containers* are run in daemon mode by the `conmon process` when the *container* exits. + +## OPTIONS +#### **--all**, **-a** + +Clean up all *containers*.\ +The default is **false**.\ +*IMPORTANT: This OPTION does not need a container name or ID as input argument.* + +#### **--exec**=*session* + +Clean up an exec session for a single *container*. +It can only be specified if a single *container* is being cleaned up (conflicts with **--all** as such). If **--rm** is not specified, temporary files for the exec session are cleaned up; if it is, the exec session is removed from the *container*.\ +*IMPORTANT: Conflicts with **--rmi** as the container is not being cleaned up so the image cannot be removed.* + +#### **--latest**, **-l** + +Instead of providing the *container ID* or *name*, use the last created *container*. The default is **false**. +*IMPORTANT: This OPTION is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines. This OPTION does not need a container name or ID as input argument.* + +#### **--rm** + +After cleanup, remove the *container* entirely.\ +The default is **false**. + +#### **--rmi** + +After cleanup, remove the image entirely.\ +The default is **false**. + +## EXAMPLES +Clean up the container "mywebserver". +``` +$ podman container cleanup mywebserver +``` + +Clean up the containers with the names "mywebserver", "myflaskserver", "860a4b23". +``` +$ podman container cleanup mywebserver myflaskserver 860a4b23 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)** + +## HISTORY +Jun 2018, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-container-clone.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-container-clone.1.md new file mode 100644 index 000000000..e955d30a9 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-container-clone.1.md @@ -0,0 +1,362 @@ +--- +title: podman-container-clone +version: v5.4.2 +--- + +% podman-container-clone 1 + +## NAME +podman\-container\-clone - Create a copy of an existing container + +## SYNOPSIS +**podman container clone** [*options*] *container* *name* *image* + +## DESCRIPTION +**podman container clone** creates a copy of a container, recreating the original with an identical configuration. This command takes three arguments: the first being the container ID or name to clone, the second argument in this command can change the name of the clone from the default of $ORIGINAL_NAME-clone, and the third is a new image to use in the cloned container. + +## OPTIONS + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + +If none is specified, the original container's cpu period is used + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + +If none is specified, the original container's CPU quota are used. + + +[//]: # (BEGIN included file options/cpu-rt-period.md) +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-period.md) + +If none is specified, the original container's CPU runtime period is used. + + +[//]: # (BEGIN included file options/cpu-rt-runtime.md) +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-runtime.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + +If none are specified, the original container's CPU shares are used. + +#### **--cpus** + +Set a number of CPUs for the container that overrides the original containers CPU limits. If none are specified, the original container's Nano CPUs are used. + +This is shorthand +for **--cpu-period** and **--cpu-quota**, so only **--cpus** or either both the **--cpu-period** and **--cpu-quota** options can be set. + +This option is not supported on cgroups V1 rootless systems. + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + +If none are specified, the original container's CPUset is used. + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + +If none are specified, the original container's CPU memory nodes are used. + + +[//]: # (BEGIN included file options/destroy.md) +#### **--destroy** + +Remove the original container that we are cloning once used to mimic the configuration. + +[//]: # (END included file options/destroy.md) + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + +#### **--force**, **-f** + +Force removal of the original container that we are cloning. Can only be used in conjunction with **--destroy**. + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + +If no memory limits are specified, the original container's memory limits are used. + + +[//]: # (BEGIN included file options/memory-reservation.md) +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-reservation.md) + +If unspecified, memory reservation is the same as memory limit from the +container being cloned. + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + +If unspecified, the container being cloned is used to derive +the swap value. + + +[//]: # (BEGIN included file options/memory-swappiness.md) +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/memory-swappiness.md) + +#### **--name** + +Set a custom name for the cloned container. The default if not specified is of the syntax: **\-clone** + +#### **--pod**=*name* + +Clone the container in an existing pod. It is helpful to move a container to an +existing pod. The container joins the pod shared namespaces, losing its configuration +that conflicts with the shared namespaces. + +#### **--run** + +When set to true, this flag runs the newly created container after the +clone process has completed, this specifies a detached running mode. + +## EXAMPLES + +Clone specified container into a new container: +``` +# podman container clone d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone specified container into a newly named container: +``` +# podman container clone --name=clone d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Replace specified container with selected resource constraints into a new container, removing original container: +``` +# podman container clone --destroy --cpus=5 d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone specified container giving a new name and then replacing the image of the original container with the specified image name: +``` +# podman container clone 2d4d4fca7219b4437e0d74fcdc272c4f031426a6eacd207372691207079551de new_name fedora +Resolved "fedora" as an alias (/etc/containers/registries.conf.d/shortnames.conf) +Trying to pull registry.fedoraproject.org/fedora\:latest... +Getting image source signatures +Copying blob c6183d119aa8 done +Copying config e417cd49a8 done +Writing manifest to image destination +Storing signatures +5a9b7851013d326aa4ac4565726765901b3ecc01fcbc0f237bc7fd95588a24f9 +``` + +## SEE ALSO +**[podman-create(1)](podman-create.1.md)**, **[cgroups(7)](https://man7.org/linux/man-pages/man7/cgroups.7.html)** + +## HISTORY +January 2022, Originally written by Charlie Doern diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-container-diff.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-container-diff.1.md new file mode 100644 index 000000000..42147fd4a --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-container-diff.1.md @@ -0,0 +1,65 @@ +--- +title: podman-container-diff +version: v5.4.2 +--- + +% podman-container-diff 1 + +## NAME +podman\-container\-diff - Inspect changes on a container's filesystem + +## SYNOPSIS +**podman container diff** [*options*] *container* [*container*] + +## DESCRIPTION +Displays changes on a container's filesystem. The container is compared to its parent layer or the second argument when given. + +The output is prefixed with the following symbols: + +| Symbol | Description | +|--------|-------------| +| A | A file or directory was added. | +| D | A file or directory was deleted. | +| C | A file or directory was changed. | + +## OPTIONS + +#### **--format** + +Alter the output into a different format. The only valid format for **podman container diff** is `json`. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +``` +# podman container diff container1 +C /usr +C /usr/local +C /usr/local/bin +A /usr/local/bin/docker-entrypoint.sh +``` + +``` +$ podman container diff --format json container1 container2 +{ + "added": [ + "/test" + ] +} +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)** + +## HISTORY +July 2021, Originally compiled by Paul Holzinger diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-container-exists.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-container-exists.1.md new file mode 100644 index 000000000..5628b803b --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-container-exists.1.md @@ -0,0 +1,56 @@ +--- +title: podman-container-exists +version: v5.4.2 +--- + +% podman-container-exists 1 + +## NAME +podman\-container\-exists - Check if a container exists in local storage + +## SYNOPSIS +**podman container exists** [*options*] *container* + +## DESCRIPTION +**podman container exists** checks if a container exists in local storage. The *container ID* or *name* is used as input. Podman returns an exit code +of `0` when the container is found. A `1` is returned otherwise. An exit code of `125` indicates there was an issue accessing the local storage. + +## OPTIONS +#### **--external** + +Check for external *containers* as well as Podman *containers*. These external *containers* are generally created via other container technology such as `Buildah` or `CRI-O`.\ +The default is **false**. + +**-h**, **--help** + +Prints usage statement.\ +The default is **false**. + +## EXAMPLES + +Check if a container called "webclient" exists in local storage. Here, the container does exist. +``` +$ podman container exists webclient +$ echo $? +0 +``` + +Check if a container called "webbackend" exists in local storage. Here, the container does not exist. +``` +$ podman container exists webbackend +$ echo $? +1 +``` + +Check if a container called "ubi8-working-container" created via Buildah exists in local storage. Here, the container does not exist. +``` +$ podman container exists --external ubi8-working-container +$ echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +November 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-container-inspect.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-container-inspect.1.md new file mode 100644 index 000000000..a01bdd5dd --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-container-inspect.1.md @@ -0,0 +1,349 @@ +--- +title: podman-container-inspect +version: v5.4.2 +--- + +% podman-container-inspect 1 + +## NAME +podman\-container\-inspect - Display a container's configuration + +## SYNOPSIS +**podman container inspect** [*options*] *container* [*container* ...] + +## DESCRIPTION + +This displays the low-level information on containers identified by name or ID. By default, this renders +all results in a JSON array. If a format is specified, the given template is executed for each result. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Format the output using the given Go template. +The keys of the returned JSON can be used as the values for the --format flag (see examples below). + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------------ | -------------------------------------------------- | +| .AppArmorProfile | AppArmor profile (string) | +| .Args | Command-line arguments (array of strings) | +| .BoundingCaps | Bounding capability set (array of strings) | +| .Config ... | Structure with config info | +| .ConmonPidFile | Path to file containing conmon pid (string) | +| .Created ... | Container creation time (string, ISO3601) | +| .Dependencies | Dependencies (array of strings) | +| .Driver | Storage driver (string) | +| .EffectiveCaps | Effective capability set (array of strings) | +| .ExecIDs | Exec IDs (array of strings) | +| .GraphDriver ... | Further details of graph driver (struct) | +| .HostConfig ... | Host config details (struct) | +| .HostnamePath | Path to file containing hostname (string) | +| .HostsPath | Path to container /etc/hosts file (string) | +| .ID | Container ID (full 64-char hash) | +| .Image | Container image ID (64-char hash) | +| .ImageDigest | Container image digest (sha256:+64-char hash) | +| .ImageName | Container image name (string) | +| .IsInfra | Is this an infra container? (string: true/false) | +| .IsService | Is this a service container? (string: true/false) | +| .KubeExitCodePropagation | Kube exit-code propagation (string) | +| .LockNumber | Number of the container's Libpod lock | +| .MountLabel | SELinux label of mount (string) | +| .Mounts | Mounts (array of strings) | +| .Name | Container name (string) | +| .Namespace | Container namespace (string) | +| .NetworkSettings ... | Network settings (struct) | +| .OCIConfigPath | Path to OCI config file (string) | +| .OCIRuntime | OCI runtime name (string) | +| .Path | Path to container command (string) | +| .PidFile | Path to file containing container PID (string) | +| .Pod | Parent pod (string) | +| .ProcessLabel | SELinux label of process (string) | +| .ResolvConfPath | Path to container's resolv.conf file (string) | +| .RestartCount | Number of times container has been restarted (int) | +| .Rootfs | Container rootfs (string) | +| .SizeRootFs | Size of rootfs, in bytes [1] | +| .SizeRw | Size of upper (R/W) container layer, in bytes [1] | +| .State ... | Container state info (struct) | +| .StaticDir | Path to container metadata dir (string) | +| .UseImageHostname | Use /etc/hostname from the image if it exists? (string: true/false) +| +| .UseImageHosts | Use /etc/hosts from the image? (string: true/false) +| + +[1] This format specifier requires the **--size** option + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--size**, **-s** + +In addition to normal output, display the total file size if the type is a container. + + +## EXAMPLE + +Inspect the specified container and print its information in json format. +``` +$ podman container inspect foobar +[ + { + "Id": "99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6", + "Created": "2021-09-16T06:09:08.936623325-04:00", + "Path": "echo", + "Args": [ + "hi" + ], + "State": { + "OciVersion": "1.0.2-dev", + "Status": "exited", + "Running": false, + "Paused": false, + "Restarting": false, + "OOMKilled": false, + "Dead": false, + "Pid": 0, + "ExitCode": 0, + "Error": "", + "StartedAt": "2021-09-16T06:09:09.033564436-04:00", + "FinishedAt": "2021-09-16T06:09:09.036184314-04:00", + "Healthcheck": { + "Status": "", + "FailingStreak": 0, + "Log": null + } + }, + "Image": "14119a10abf4669e8cdbdff324a9f9605d99697215a0d21c360fe8dfa8471bab", + "ImageName": "docker.io/library/alpine:latest", + "Rootfs": "", + "Pod": "", + "ResolvConfPath": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/resolv.conf", + "HostnamePath": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/hostname", + "HostsPath": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/hosts", + "StaticDir": "/home/dwalsh/.local/share/containers/storage/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata", + "OCIConfigPath": "/home/dwalsh/.local/share/containers/storage/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/config.json", + "OCIRuntime": "crun", + "ConmonPidFile": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/conmon.pid", + "PidFile": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/pidfile", + "Name": "foobar", + "RestartCount": 0, + "Driver": "overlay", + "MountLabel": "system_u:object_r:container_file_t:s0:c25,c695", + "ProcessLabel": "system_u:system_r:container_t:s0:c25,c695", + "AppArmorProfile": "", + "EffectiveCaps": [ + "CAP_CHOWN", + "CAP_DAC_OVERRIDE", + "CAP_FOWNER", + "CAP_FSETID", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_SETFCAP", + "CAP_SETGID", + "CAP_SETPCAP", + "CAP_SETUID", + ], + "BoundingCaps": [ + "CAP_CHOWN", + "CAP_DAC_OVERRIDE", + "CAP_FOWNER", + "CAP_FSETID", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_SETFCAP", + "CAP_SETGID", + "CAP_SETPCAP", + "CAP_SETUID", + ], + "ExecIDs": [], + "GraphDriver": { + "Name": "overlay", + "Data": { + "LowerDir": "/home/dwalsh/.local/share/containers/storage/overlay/e2eb06d8af8218cfec8210147357a68b7e13f7c485b991c288c2d01dc228bb68/diff", + "UpperDir": "/home/dwalsh/.local/share/containers/storage/overlay/8f3d70434a3db17410ec4710caf4f251f3e4ed0a96a08124e4b3d4af0a0ea300/diff", + "WorkDir": "/home/dwalsh/.local/share/containers/storage/overlay/8f3d70434a3db17410ec4710caf4f251f3e4ed0a96a08124e4b3d4af0a0ea300/work" + } + }, + "Mounts": [], + "Dependencies": [], + "NetworkSettings": { + "EndpointID": "", + "Gateway": "", + "IPAddress": "", + "IPPrefixLen": 0, + "IPv6Gateway": "", + "GlobalIPv6Address": "", + "GlobalIPv6PrefixLen": 0, + "MacAddress": "", + "Bridge": "", + "SandboxID": "", + "HairpinMode": false, + "LinkLocalIPv6Address": "", + "LinkLocalIPv6PrefixLen": 0, + "Ports": {}, + "SandboxKey": "" + }, + "Namespace": "", + "IsInfra": false, + "Config": { + "Hostname": "99f66530fe9c", + "Domainname": "", + "User": "", + "AttachStdin": false, + "AttachStdout": false, + "AttachStderr": false, + "Tty": false, + "OpenStdin": false, + "StdinOnce": false, + "Env": [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "TERM=xterm", + "container=podman", + "HOME=/root", + "HOSTNAME=99f66530fe9c" + ], + "Cmd": [ + "echo", + "hi" + ], + "Image": "docker.io/library/alpine:latest", + "Volumes": null, + "WorkingDir": "/", + "Entrypoint": "", + "OnBuild": null, + "Labels": null, + "Annotations": { + "io.container.manager": "libpod", + "io.kubernetes.cri-o.Created": "2021-09-16T06:09:08.936623325-04:00", + "org.opencontainers.image.stopSignal": "15" + }, + "StopSignal": 15, + "CreateCommand": [ + "podman", + "run", + "--name", + "foobar", + "alpine", + "echo", + "hi" + ], + "Timezone": "local", + "Umask": "0022", + "Timeout": 0, + "StopTimeout": 10 + }, + "HostConfig": { + "Binds": [], + "CgroupManager": "systemd", + "CgroupMode": "private", + "ContainerIDFile": "", + "LogConfig": { + "Type": "journald", + "Config": null, + "Path": "", + "Tag": "", + "Size": "0B" + }, + "NetworkMode": "slirp4netns", + "PortBindings": {}, + "RestartPolicy": { + "Name": "", + "MaximumRetryCount": 0 + }, + "AutoRemove": false, + "VolumeDriver": "", + "VolumesFrom": null, + "CapAdd": [], + "CapDrop": [], + "Dns": [], + "DnsOptions": [], + "DnsSearch": [], + "ExtraHosts": [], + "GroupAdd": [], + "IpcMode": "shareable", + "Cgroup": "", + "Cgroups": "default", + "Links": null, + "OomScoreAdj": 0, + "PidMode": "private", + "Privileged": false, + "PublishAllPorts": false, + "ReadonlyRootfs": false, + "SecurityOpt": [], + "Tmpfs": {}, + "UTSMode": "private", + "UsernsMode": "", + "ShmSize": 65536000, + "Runtime": "oci", + "ConsoleSize": [ + 0, + 0 + ], + "Isolation": "", + "CpuShares": 0, + "Memory": 0, + "NanoCpus": 0, + "CgroupParent": "user.slice", + "BlkioWeight": 0, + "BlkioWeightDevice": null, + "BlkioDeviceReadBps": null, + "BlkioDeviceWriteBps": null, + "BlkioDeviceReadIOps": null, + "BlkioDeviceWriteIOps": null, + "CpuPeriod": 0, + "CpuQuota": 0, + "CpuRealtimePeriod": 0, + "CpuRealtimeRuntime": 0, + "CpusetCpus": "", + "CpusetMems": "", + "Devices": [], + "DiskQuota": 0, + "KernelMemory": 0, + "MemoryReservation": 0, + "MemorySwap": 0, + "MemorySwappiness": 0, + "OomKillDisable": false, + "PidsLimit": 2048, + "Ulimits": [], + "CpuCount": 0, + "CpuPercent": 0, + "IOMaximumIOps": 0, + "IOMaximumBandwidth": 0, + "CgroupConf": null + } + } +] +``` + +Inspect the specified container for the Image Name it is based on. +``` +$ podman container inspect nervous_fermi --format "{{.ImageName}}" +registry.access.redhat.com/ubi8:latest +``` + +Inspect the specified container for the GraphDriver Name it is running with. +``` +$ podman container inspect foobar --format "{{.GraphDriver.Name}}" +overlay +``` + +Inspect the latest container created for its EffectiveCaps field. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman container inspect --latest --format {{.EffectiveCaps}} +[CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_FSETID CAP_KILL CAP_NET_BIND_SERVICE CAP_SETFCAP CAP_SETGID CAP_SETPCAP CAP_SETUID] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +Sep 2021, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-container-prune.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-container-prune.1.md new file mode 100644 index 000000000..e3ee7b234 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-container-prune.1.md @@ -0,0 +1,83 @@ +--- +title: podman-container-prune +version: v5.4.2 +--- + +% podman-container-prune 1 + +## NAME +podman\-container\-prune - Remove all stopped containers from local storage + +## SYNOPSIS +**podman container prune** [*options*] + +## DESCRIPTION +**podman container prune** removes all stopped containers from local storage. + +## OPTIONS +#### **--filter**=*filters* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------:|------------------------------------------------------------------------------------------------------| +| label | Only remove containers, with (or without, in the case of label!=[...] is used) the specified labels. | +| until | Only remove containers created before given timestamp. | + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes containers with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes containers without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not provide an interactive prompt for container removal.\ +The default is **false**. + +**-h**, **--help** + +Print usage statement.\ +The default is **false**. + +## EXAMPLES +Remove all stopped containers from local storage: +``` +$ podman container prune +WARNING! This will remove all stopped containers. +Are you sure you want to continue? [y/N] y +878392adf2e6c5c9bb1fc19b69d37d2e98c8abf9d539c0bce4b15b46bbcce471 +37664467fbe3618bf9479c34393ac29c02696675addf1750f9e346581636cde7 +ed0c6468b8e1cb641b4621d1fe30cb477e1fefc5c0bceb66feaf2f7cb50e5962 +6ac6c8f0067b7a4682e6b8e18902665b57d1a0e07e885d9abcd382232a543ccd +fff1c5b6c3631746055ec40598ce8ecaa4b82aef122f9e3a85b03b55c0d06c23 +602d343cd47e7cb3dfc808282a9900a3e4555747787ec6723bb68cedab8384d5 +``` + +Remove all stopped containers from local storage without confirmation: +``` +$ podman container prune -f +878392adf2e6c5c9bb1fc19b69d37d2e98c8abf9d539c0bce4b15b46bbcce471 +37664467fbe3618bf9479c34393ac29c02696675addf1750f9e346581636cde7 +ed0c6468b8e1cb641b4621d1fe30cb477e1fefc5c0bceb66feaf2f7cb50e5962 +6ac6c8f0067b7a4682e6b8e18902665b57d1a0e07e885d9abcd382232a543ccd +fff1c5b6c3631746055ec40598ce8ecaa4b82aef122f9e3a85b03b55c0d06c23 +602d343cd47e7cb3dfc808282a9900a3e4555747787ec6723bb68cedab8384d5 +``` + +Remove all stopped containers from local storage created before the last 10 minutes: +``` +$ podman container prune --filter until="10m" +WARNING! This will remove all stopped containers. +Are you sure you want to continue? [y/N] y +3d366295e33d8cc612c4d873199bacadd55088d90d17dcafaa9a2d317ad50b4e +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-ps(1)](podman-ps.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude \ +December 2020, converted filter information from docs.docker.com documentation by Dan Walsh diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-container-restore.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-container-restore.1.md new file mode 100644 index 000000000..a5fb3f68f --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-container-restore.1.md @@ -0,0 +1,198 @@ +--- +title: podman-container-restore +version: v5.4.2 +--- + +% podman-container-restore 1 + +## NAME +podman\-container\-restore - Restore one or more containers from a checkpoint + +## SYNOPSIS +**podman container restore** [*options*] *name* [...] + +## DESCRIPTION +**podman container restore** restores a container from a container checkpoint or +checkpoint image. The *container IDs*, *image IDs* or *names* are used as input. + +## OPTIONS +#### **--all**, **-a** + +Restore all checkpointed *containers*.\ +The default is **false**.\ +*IMPORTANT: This OPTION does not need a container name or ID as input argument.* + +#### **--file-locks** + +Restore a *container* with file locks. This option is required to +restore file locks from a checkpoint image. If the checkpoint image +does not contain file locks, this option is ignored. Defaults to not +restoring file locks.\ +The default is **false**. + +#### **--ignore-rootfs** + +If a *container* is restored from a checkpoint tar.gz file it is possible that it also contains all root file-system changes. With **--ignore-rootfs** it is possible to explicitly disable applying these root file-system changes to the restored *container*.\ +The default is **false**.\ +*IMPORTANT: This OPTION is only available in combination with __--import, -i__.* + +#### **--ignore-static-ip** + +If the *container* was started with **--ip** the restored *container* also tries to use that +IP address and restore fails if that IP address is already in use. This can happen, if +a *container* is restored multiple times from an exported checkpoint with **--name, -n**. + +Using **--ignore-static-ip** tells Podman to ignore the IP address if it was configured +with **--ip** during *container* creation. + +The default is **false**. + +#### **--ignore-static-mac** + +If the *container* was started with **--mac-address** the restored *container* also +tries to use that MAC address and restore fails if that MAC address is already +in use. This can happen, if a *container* is restored multiple times from an +exported checkpoint with **--name, -n**. + +Using **--ignore-static-mac** tells Podman to ignore the MAC address if it was +configured with **--mac-address** during *container* creation. + +The default is **false**. + +#### **--ignore-volumes** + +This option must be used in combination with the **--import, -i** option. +When restoring *containers* from a checkpoint tar.gz file with this option, +the content of associated volumes are not restored.\ +The default is **false**. + +#### **--import**, **-i**=*file* + +Import a checkpoint tar.gz file, which was exported by Podman. This can be used +to import a checkpointed *container* from another host.\ +*IMPORTANT: This OPTION does not need a container name or ID as input argument.* + +During the import of a checkpoint file Podman selects the same container runtime +which was used during checkpointing. This is especially important if a specific +(non-default) container runtime was specified during container creation. Podman +also aborts the restore if the container runtime specified during restore does +not much the container runtime used for container creation. + +#### **--import-previous**=*file* + +Import a pre-checkpoint tar.gz file which was exported by Podman. This option +must be used with **-i** or **--import**. It only works on `runc 1.0-rc3` or `higher`. +*IMPORTANT: This OPTION is not supported on the remote client, including Mac and Windows (excluding WSL2) machines.* + +#### **--keep**, **-k** + +Keep all temporary log and statistics files created by `CRIU` during +checkpointing as well as restoring. These files are not deleted if restoring +fails for further debugging. If restoring succeeds these files are +theoretically not needed, but if these files are needed Podman can keep the +files for further analysis. This includes the checkpoint directory with all +files created during checkpointing. The size required by the checkpoint +directory is roughly the same as the amount of memory required by the +processes in the checkpointed *container*.\ +Without the **--keep**, **-k** option, the checkpoint is consumed and cannot be used again.\ +The default is **false**. + +#### **--latest**, **-l** + +Instead of providing the *container ID* or *name*, use the last created *container*. The default is **false**. +*IMPORTANT: This OPTION is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines. This OPTION does not need a container name or ID as input argument.* + +#### **--name**, **-n**=*name* + +If a *container* is restored from a checkpoint tar.gz file it is possible to rename it with **--name, -n**. This way it is possible to restore a *container* from a checkpoint multiple times with different +names. + +If the **--name, -n** option is used, Podman does not attempt to assign the same IP +address to the *container* it was using before checkpointing as each IP address can only +be used once, and the restored *container* has another IP address. This also means +that **--name, -n** cannot be used in combination with **--tcp-established**.\ +*IMPORTANT: This OPTION is only available for a checkpoint image or in combination +with __--import, -i__.* + +#### **--pod**=*name* + +Restore a container into the pod *name*. The destination pod for this restore +has to have the same namespaces shared as the pod this container was checkpointed +from (see **[podman pod create --share](podman-pod-create.1.md#--share)**).\ +*IMPORTANT: This OPTION is only available for a checkpoint image or in combination +with __--import, -i__.* + +This option requires at least CRIU 3.16. + +#### **--print-stats** + +Print out statistics about restoring the container(s). The output is +rendered in a JSON array and contains information about how much time different +restore operations required. Many of the restore statistics are created +by CRIU and just passed through to Podman. The following information is provided +in the JSON array: + +- **podman_restore_duration**: Overall time (in microseconds) needed to restore + all checkpoints. + +- **runtime_restore_duration**: Time (in microseconds) the container runtime + needed to restore the checkpoint. + +- **forking_time**: Time (in microseconds) CRIU needed to create (fork) all + processes in the restored container (measured by CRIU). + +- **restore_time**: Time (in microseconds) CRIU needed to restore all processes + in the container (measured by CRIU). + +- **pages_restored**: Number of memory pages restored (measured by CRIU). + +The default is **false**. + +#### **--publish**, **-p**=*port* + +Replaces the ports that the *container* publishes, as configured during the +initial *container* start, with a new set of port forwarding rules. + +For more details, see **[podman run --publish](podman-run.1.md#--publish)**. + +#### **--tcp-established** + +Restore a *container* with established TCP connections. If the checkpoint image +contains established TCP connections, this option is required during restore. +If the checkpoint image does not contain established TCP connections this +option is ignored. Defaults to not restoring *containers* with established TCP +connections.\ +The default is **false**. + +## EXAMPLE +Restore the container "mywebserver". +``` +# podman container restore mywebserver +``` + +Import a checkpoint file and a pre-checkpoint file. +``` +# podman container restore --import-previous pre-checkpoint.tar.gz --import checkpoint.tar.gz +``` + +Start the container "mywebserver". Make a checkpoint of the container and export it. Restore the container with other port ranges from the exported file. +``` +$ podman run --rm -p 2345:80 -d webserver +# podman container checkpoint -l --export=dump.tar +# podman container restore -p 5432:8080 --import=dump.tar +``` + +Start a container with the name "foobar-1". Create a checkpoint image "foobar-checkpoint". Restore the container from the checkpoint image with a different name. +``` +# podman run --name foobar-1 -d webserver +# podman container checkpoint --create-image foobar-checkpoint foobar-1 +# podman inspect foobar-checkpoint +# podman container restore --name foobar-2 foobar-checkpoint +# podman container restore --name foobar-3 foobar-checkpoint +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container-checkpoint(1)](podman-container-checkpoint.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-pod-create(1)](podman-pod-create.1.md)**, **criu(8)** + +## HISTORY +September 2018, Originally compiled by Adrian Reber diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-container-runlabel.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-container-runlabel.1.md new file mode 100644 index 000000000..2d7874b0b --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-container-runlabel.1.md @@ -0,0 +1,128 @@ +--- +title: podman-container-runlabel +version: v5.4.2 +--- + +% podman-container-runlabel 1 + +## NAME +podman-container-runlabel - Execute a command as described by a container-image label + +## SYNOPSIS +**podman container runlabel** [*options*] *label* *image* [*arg...*] + +## DESCRIPTION +**podman container runlabel** reads the specified `label` of the `image` and executes it as command on the host. If the label does not exist, Podman exits with an error. Additional arguments are appended to the command. + +Historically, container images describe the contents (e.g., layers) and how a container runtime (e.g., crun(1) or runc(1)) executes the container. For instance, an image may set the environment and the command in its configuration. However, a container image cannot directly specify how a container engine such as Podman executes it. For instance, an image configuration does not include information about log drivers, namespaces, or which capabilities it needs to run correctly. + +`podman container runlabel` addresses the limitation of container images in a simple yet efficient way. Podman reads the contents of the label and interpret it as a command that is executed on the host. This way an image can describe exactly how it is executed by Podman. For instance, a label with the content `/usr/bin/podman run -d --pid=host --privileged \${IMAGE}` instructs the image to be executed in a detached, privileged container that is using the PID namespace of the host. This lifts the self-description of a container image from "what" to "how". + +Note that the `runlabel` command is intended to be run in trusted environments exclusively. Using the command on untrusted images is not recommended. + +## VARIABLES + +The contents of a label may refer to the following variables which is substituted while processing the label. + +**IMAGE** +The name of the image. When executing `podman container runlabel label fedora` the `IMAGE` variable is replaced with `fedora`. Valid formats are `IMAGE`, `$IMAGE`, `${IMAGE}` and `=IMAGE`. + +**NAME** +As specified by the `--name` option. The format is identical to the one of the IMAGE attribute. + +**PWD** +Will be replaced with the current working directory. + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + +#### **--display** + +Display the label's value of the image having populated its environment variables. The runlabel command is not executed if --display is specified. + +#### **--help**, **-h** +Print usage statement + +#### **--name**, **-n**=*name* + +Use this name for creating content for the container. If not specified, name defaults to the name of the image. + +#### **--quiet**, **-q** + +Suppress output information when pulling images + +#### **--replace** + +If a container exists with the current name, it is stopped, deleted and a new container is created from this image. + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Execute the `run` label of an image called foobar. +``` +$ podman container runlabel run foobar +``` + +Execute the `install` label of an image called foobar with additional arguments. +``` +$ podman container runlabel install foobar apples oranges +``` + +Display the contents of the `run` label of image foobar. +``` +$ podman container runlabel --display run foobar +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/main/man/runc.8.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-auth.json(5)](https://github.com/containers/image/blob/main/docs/containers-auth.json.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +## HISTORY +August 2021, Refinements by Valentin Rothberg (rothberg at redhat dot com) + +September 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-container.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-container.1.md new file mode 100644 index 000000000..cb9217b9c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-container.1.md @@ -0,0 +1,58 @@ +--- +title: podman-container +version: v5.4.2 +--- + +% podman-container 1 + +## NAME +podman\-container - Manage containers + +## SYNOPSIS +**podman container** *subcommand* + +## DESCRIPTION +The container command allows management of containers + +## COMMANDS + +| Command | Man Page | Description | +| --------- | --------------------------------------------------- | ---------------------------------------------------------------------------- | +| attach | [podman-attach(1)](podman-attach.1.md) | Attach to a running container. | +| checkpoint | [podman-container-checkpoint(1)](podman-container-checkpoint.1.md) | Checkpoint one or more running containers. | +| cleanup | [podman-container-cleanup(1)](podman-container-cleanup.1.md) | Clean up the container's network and mountpoints. | +| clone | [podman-container-clone(1)](podman-container-clone.1.md) | Create a copy of an existing container. | +| commit | [podman-commit(1)](podman-commit.1.md) | Create new image based on the changed container. | +| cp | [podman-cp(1)](podman-cp.1.md) | Copy files/folders between a container and the local filesystem. | +| create | [podman-create(1)](podman-create.1.md) | Create a new container. | +| diff | [podman-container-diff(1)](podman-container-diff.1.md) | Inspect changes on a container's filesystem | +| exec | [podman-exec(1)](podman-exec.1.md) | Execute a command in a running container. | +| exists | [podman-container-exists(1)](podman-container-exists.1.md) | Check if a container exists in local storage | +| export | [podman-export(1)](podman-export.1.md) | Export a container's filesystem contents as a tar archive. | +| init | [podman-init(1)](podman-init.1.md) | Initialize a container | +| inspect | [podman-container-inspect(1)](podman-container-inspect.1.md)| Display a container's configuration. | +| kill | [podman-kill(1)](podman-kill.1.md) | Kill the main process in one or more containers. | +| list | [podman-ps(1)](podman-ps.1.md) | List the containers on the system.(alias ls) | +| logs | [podman-logs(1)](podman-logs.1.md) | Display the logs of a container. | +| mount | [podman-mount(1)](podman-mount.1.md) | Mount a working container's root filesystem. | +| pause | [podman-pause(1)](podman-pause.1.md) | Pause one or more containers. | +| port | [podman-port(1)](podman-port.1.md) | List port mappings for the container. | +| prune | [podman-container-prune(1)](podman-container-prune.1.md)| Remove all stopped containers from local storage. | +| ps | [podman-ps(1)](podman-ps.1.md) | Print out information about containers. | +| rename | [podman-rename(1)](podman-rename.1.md) | Rename an existing container. | +| restart | [podman-restart(1)](podman-restart.1.md) | Restart one or more containers. | +| restore | [podman-container-restore(1)](podman-container-restore.1.md) | Restore one or more containers from a checkpoint. | +| rm | [podman-rm(1)](podman-rm.1.md) | Remove one or more containers. | +| run | [podman-run(1)](podman-run.1.md) | Run a command in a container. | +| runlabel | [podman-container-runlabel(1)](podman-container-runlabel.1.md) | Execute a command as described by a container-image label. | +| start | [podman-start(1)](podman-start.1.md) | Start one or more containers. | +| stats | [podman-stats(1)](podman-stats.1.md) | Display a live stream of one or more container's resource usage statistics. | +| stop | [podman-stop(1)](podman-stop.1.md) | Stop one or more running containers. | +| top | [podman-top(1)](podman-top.1.md) | Display the running processes of a container. | +| unmount | [podman-unmount(1)](podman-unmount.1.md) | Unmount a working container's root filesystem.(Alias unmount) | +| unpause | [podman-unpause(1)](podman-unpause.1.md) | Unpause one or more containers. | +| update | [podman-update(1)](podman-update.1.md) | Update the cgroup configuration of a given container. | +| wait | [podman-wait(1)](podman-wait.1.md) | Wait on one or more containers to stop and print their exit codes. | + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-exec(1)](podman-exec.1.md)**, **[podman-run(1)](podman-run.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-cp.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-cp.1.md new file mode 100644 index 000000000..52d82f02d --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-cp.1.md @@ -0,0 +1,140 @@ +--- +title: podman-cp +version: v5.4.2 +--- + +% podman-cp 1 + +## NAME +podman\-cp - Copy files/folders between a container and the local filesystem + +## SYNOPSIS +**podman cp** [*options*] [*container*:]*src_path* [*container*:]*dest_path* + +**podman container cp** [*options*] [*container*:]*src_path* [*container*:]*dest_path* + +## DESCRIPTION +**podman cp** allows copying the contents of **src_path** to the **dest_path**. Files can be copied from a container to the local machine and vice versa or between two containers. +If `-` is specified for either the `SRC_PATH` or `DEST_PATH`, one can also stream a tar archive from `STDIN` or to `STDOUT`. + +The containers can be either running or stopped and the *src_path* or *dest_path* can be a file or directory. + +*IMPORTANT: The **podman cp** command assumes container paths are relative to the container's root directory (`/`), which means supplying the initial forward slash is optional and therefore sees `compassionate_darwin:/tmp/foo/myfile.txt` and `compassionate_darwin\:tmp/foo/myfile.txt` as identical.* + +Local machine paths can be an absolute or relative value. +The command interprets a local machine's relative paths as relative to the current working directory where **podman cp** is run. + +Assuming a path separator of `/`, a first argument of **src_path** and second argument of **dest_path**, the behavior is as follows: + +**src_path** specifies a file: + - **dest_path** does not exist + - the file is saved to a file created at **dest_path** (note that parent directory must exist). + - **dest_path** exists and is a file + - the destination is overwritten with the source file's contents. + - **dest_path** exists and is a directory + - the file is copied into this directory using the base name from **src_path**. + +**src_path** specifies a directory: + - **dest_path** does not exist + - **dest_path** is created as a directory and the contents of the source directory are copied into this directory. + - **dest_path** exists and is a file + - Error condition: cannot copy a directory to a file. + - **dest_path** exists and is a directory + - **src_path** ends with `/` + - the source directory is copied into this directory. + - **src_path** ends with `/.` (i.e., slash followed by dot) + - the content of the source directory is copied into this directory. + +The command requires **src_path** and **dest_path** to exist according to the above rules. + +If **src_path** is local and is a symbolic link, the symbolic target, is copied by default. + +A *colon* ( : ) is used as a delimiter between a container and its path, it can also be used when specifying paths to a **src_path** or **dest_path** on a local machine, for example, `file:name.txt`. + +*IMPORTANT: while using a *colon* ( : ) in a local machine path, one must be explicit with a relative or absolute path, for example: `/path/to/file:name.txt` or `./file:name.txt`* + +Using `-` as the **src_path** streams the contents of `STDIN` as a tar archive. The command extracts the content of the tar to the `DEST_PATH` in the container. In this case, **dest_path** must specify a directory. Using `-` as the **dest_path** streams the contents of the resource (can be a directory) as a tar archive to `STDOUT`. + +Note that `podman cp` ignores permission errors when copying from a running rootless container. The TTY devices inside a rootless container are owned by the host's root user and hence cannot be read inside the container's user namespace. + +Further note that `podman cp` does not support globbing (e.g., `cp dir/*.txt`). To copy multiple files from the host to the container use xargs(1) or find(1) (or similar tools for chaining commands) in conjunction with `podman cp`. To copy multiple files from the container to the host, use `podman mount CONTAINER` and operate on the returned mount point instead (see ALTERNATIVES below). + +## OPTIONS + +#### **--archive**, **-a** + +Archive mode (copy all UID/GID information). +When set to true, files copied to a container have changed ownership to the primary UID/GID of the container. +When set to false, maintain UID/GID from archive sources instead of changing them to the primary UID/GID of the destination container. +The default is **true**. + +#### **--overwrite** + +Allow directories to be overwritten with non-directories and vice versa. By default, `podman cp` errors out when attempting to overwrite, for instance, a regular file with a directory. + +## ALTERNATIVES + +Podman has much stronger capabilities than just `podman cp` to achieve copying files between the host and containers. + +Using standard **[podman-mount(1)](podman-mount.1.md)** and **[podman-unmount(1)](podman-unmount.1.md)** takes advantage of the entire linux tool chain, rather than just cp. + +copying contents out of a container or into a container, can be achieved with a few simple commands. For example: + +To copy the `/etc/foobar` directory out of a container and onto `/tmp` on the host, the following commands can be executed: + + mnt=$(podman mount CONTAINERID) + cp -R ${mnt}/etc/foobar /tmp + podman umount CONTAINERID + +To untar a tar ball into a container, following commands can be executed: + + mnt=$(podman mount CONTAINERID) + tar xf content.tgz -C ${mnt} + podman umount CONTAINERID + +To install a package into a container that +does not have dnf installed, following commands can be executed: + + mnt=$(podman mount CONTAINERID) + dnf install --installroot=${mnt} httpd + chroot ${mnt} rm -rf /var/log/dnf /var/cache/dnf + podman umount CONTAINERID + +By using `podman mount` and `podman unmount`, one can use all of the +standard linux tools for moving files into and out of containers, not just +the cp command. + +## EXAMPLES + +Copy a file from the host to a container: +``` +podman cp /myapp/app.conf containerID:/myapp/app.conf +``` + +Copy a file from a container to a directory on another container: +``` +podman cp containerID1:/myfile.txt containerID2:/tmp +``` + +Copy a directory on a container to a directory on the host: +``` +podman cp containerID:/myapp/ /myapp/ +``` + +Copy the contents of a directory on a container to a directory on the host: +``` +podman cp containerID:/home/myuser/. /home/myuser/ +``` + +Copy a directory on a container into a directory on another: +``` +podman cp containerA:/myapp containerB:/newapp +``` + +Stream a tar archive from `STDIN` to a container: +``` +podman cp - containerID:/myfiles.tar.gz < myfiles.tar.gz +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-mount(1)](podman-mount.1.md)**, **[podman-unmount(1)](podman-unmount.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-create.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-create.1.md new file mode 100644 index 000000000..2f08d244e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-create.1.md @@ -0,0 +1,2849 @@ +--- +title: podman-create +version: v5.4.2 +--- + +% podman-create 1 + +## NAME +podman\-create - Create a new container + +## SYNOPSIS +**podman create** [*options*] *image* [*command* [*arg* ...]] + +**podman container create** [*options*] *image* [*command* [*arg* ...]] + +## DESCRIPTION + +Creates a writable container layer over the specified image and prepares it for +running the specified command. The container ID is then printed to STDOUT. This +is similar to **podman run -d** except the container is never started. Use the +**podman start** *container* command to start the container at any point. + +The initial status of the container created with **podman create** is 'created'. + +Default settings for flags are defined in `containers.conf`. Most settings for +remote connections use the server's containers.conf, except when documented in +man pages. + +## IMAGE + + The image is specified using transport\:path format. If no transport is specified, the `docker` (container registry) +transport is used by default. For remote Podman, including Mac and Windows (excluding WSL2) machines, `docker` is the only allowed transport. + + **dir:**_path_ + An existing local directory _path_ storing the manifest, layer tarballs and signatures as individual files. This +is a non-standardized format, primarily useful for debugging or noninvasive container inspection. + + $ podman save --format docker-dir fedora -o /tmp/fedora + $ podman create dir:/tmp/fedora echo hello + + **docker://**_docker-reference_ (Default) + An image reference stored in a remote container image registry. Example: "quay.io/podman/stable:latest". +The reference can include a path to a specific registry; if it does not, the +registries listed in registries.conf is queried to find a matching image. +By default, credentials from `podman login` (stored at +$XDG_RUNTIME_DIR/containers/auth.json by default) is used to authenticate; +otherwise it falls back to using credentials in $HOME/.docker/config.json. + + $ podman create registry.fedoraproject.org/fedora\:latest echo hello + + **docker-archive:**_path_[**:**_docker-reference_] +An image stored in the `docker save` formatted file. _docker-reference_ is only used when creating such a +file, and it must not contain a digest. + + $ podman save --format docker-archive fedora -o /tmp/fedora + $ podman create docker-archive:/tmp/fedora echo hello + + **docker-daemon:**_docker-reference_ + An image in _docker-reference_ format stored in the docker daemon internal storage. The _docker-reference_ can also be an image ID (docker-daemon\:algo\:digest). + + $ sudo docker pull fedora + $ sudo podman create docker-daemon\:docker.io/library/fedora echo hello + + **oci-archive:**_path_**:**_tag_ + An image in a directory compliant with the "Open Container Image Layout Specification" at the specified _path_ +and specified with a _tag_. + + $ podman save --format oci-archive fedora -o /tmp/fedora + $ podman create oci-archive:/tmp/fedora echo hello + +## OPTIONS + + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the container's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + + +[//]: # (BEGIN included file options/annotation.container.md) +#### **--annotation**=*key=value* + +Add an annotation to the container. This option can be set multiple times. + +[//]: # (END included file options/annotation.container.md) + + +[//]: # (BEGIN included file options/arch.md) +#### **--arch**=*ARCH* +Override the architecture, defaults to hosts, of the image to be pulled. For example, `arm`. +Unless overridden, subsequent lookups of the same image in the local storage matches this architecture, regardless of the host. + +[//]: # (END included file options/arch.md) + + +[//]: # (BEGIN included file options/attach.md) +#### **--attach**, **-a**=*stdin* | *stdout* | *stderr* + +Attach to STDIN, STDOUT or STDERR. + +In foreground mode (the default when **-d** +is not specified), **podman run** can start the process in the container +and attach the console to the process's standard input, output, and +error. It can even pretend to be a TTY (this is what most command-line +executables expect) and pass along signals. The **-a** option can be set for +each of **stdin**, **stdout**, and **stderr**. + +[//]: # (END included file options/attach.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cap-add.md) +#### **--cap-add**=*capability* + +Add Linux capabilities. + +[//]: # (END included file options/cap-add.md) + + +[//]: # (BEGIN included file options/cap-drop.md) +#### **--cap-drop**=*capability* + +Drop Linux capabilities. + +[//]: # (END included file options/cap-drop.md) + + +[//]: # (BEGIN included file options/cgroup-conf.md) +#### **--cgroup-conf**=*KEY=VALUE* + +When running on cgroup v2, specify the cgroup file to write to and its value. For example **--cgroup-conf=memory.high=1073741824** sets the memory.high limit to 1GB. + +[//]: # (END included file options/cgroup-conf.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the container is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cgroupns.md) +#### **--cgroupns**=*mode* + +Set the cgroup namespace mode for the container. + +- **host**: use the host's cgroup namespace inside the container. +- **container:**_id_: join the namespace of the specified container. +- **private**: create a new cgroup namespace. +- **ns:**_path_: join the namespace at the specified path. + +If the host uses cgroups v1, the default is set to **host**. On cgroups v2, the default is **private**. + +[//]: # (END included file options/cgroupns.md) + + +[//]: # (BEGIN included file options/cgroups.md) +#### **--cgroups**=*how* + +Determines whether the container creates CGroups. + +Default is **enabled**. + +The **enabled** option creates a new cgroup under the cgroup-parent. +The **disabled** option forces the container to not create CGroups, and thus conflicts with CGroup options (**--cgroupns** and **--cgroup-parent**). +The **no-conmon** option disables a new CGroup only for the **conmon** process. +The **split** option splits the current CGroup in two sub-cgroups: one for conmon and one for the container payload. It is not possible to set **--cgroup-parent** with **split**. + +[//]: # (END included file options/cgroups.md) + + +[//]: # (BEGIN included file options/chrootdirs.md) +#### **--chrootdirs**=*path* + +Path to a directory inside the container that is treated as a `chroot` directory. +Any Podman managed file (e.g., /etc/resolv.conf, /etc/hosts, etc/hostname) that is mounted into the root directory is mounted into that location as well. +Multiple directories are separated with a comma. + +[//]: # (END included file options/chrootdirs.md) + + +[//]: # (BEGIN included file options/cidfile.write.md) +#### **--cidfile**=*file* + +Write the container ID to *file*. The file is removed along with the container, except +when used with podman --remote run on detached containers. + +[//]: # (END included file options/cidfile.write.md) + + +[//]: # (BEGIN included file options/conmon-pidfile.md) +#### **--conmon-pidfile**=*file* + +Write the pid of the **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to restart Podman containers. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/conmon-pidfile.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-rt-period.md) +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-period.md) + + +[//]: # (BEGIN included file options/cpu-rt-runtime.md) +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-runtime.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpus.container.md) +#### **--cpus**=*number* + +Number of CPUs. The default is *0.0* which means no limit. This is shorthand +for **--cpu-period** and **--cpu-quota**, therefore the option cannot be specified with +**--cpu-period** or **--cpu-quota**. + +On some systems, changing the CPU limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpus.container.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the container. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The container only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: if the user only has access rights via a group, accessing the device +from inside a rootless container fails. Use the `--group-add keep-groups` +flag to pass the user's supplementary group access into the container. + + +[//]: # (BEGIN included file options/device-cgroup-rule.md) +#### **--device-cgroup-rule**=*"type major\:minor mode"* + +Add a rule to the cgroup allowed devices list. The rule is expected to be +in the format specified in the Linux kernel documentation +[admin-guide/cgroup-v1/devices](https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.html): +- *type*: `a` (all), `c` (char), or `b` (block); +- *major* and *minor*: either a number, or `*` for all; +- *mode*: a composition of `r` (read), `w` (write), and `m` (mknod(2)). + +[//]: # (END included file options/device-cgroup-rule.md) + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-read-iops.md) +#### **--device-read-iops**=*path:rate* + +Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-iops.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + + +[//]: # (BEGIN included file options/device-write-iops.md) +#### **--device-write-iops**=*path:rate* + +Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-iops.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + + +[//]: # (BEGIN included file options/dns.md) +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. + +[//]: # (END included file options/dns.md) + +This option cannot be combined with **--network** that is set to **none** or **container:**_id_. + + +[//]: # (BEGIN included file options/dns-option.container.md) +#### **--dns-option**=*option* + +Set custom DNS options. Invalid if using **--dns-option** with **--network** that is set to **none** or **container:**_id_. + +[//]: # (END included file options/dns-option.container.md) + + +[//]: # (BEGIN included file options/dns-search.container.md) +#### **--dns-search**=*domain* + +Set custom DNS search domains. Invalid if using **--dns-search** with **--network** that is set to **none** or **container:**_id_. +Use **--dns-search=.** to remove the search domain. + +[//]: # (END included file options/dns-search.container.md) + + +[//]: # (BEGIN included file options/entrypoint.md) +#### **--entrypoint**=*"command"* | *'["command", "arg1", ...]'* + +Override the default ENTRYPOINT from the image. + +The ENTRYPOINT of an image is similar to a COMMAND +because it specifies what executable to run when the container starts, but it is +(purposely) more difficult to override. The ENTRYPOINT gives a container its +default nature or behavior. When the ENTRYPOINT is set, the +container runs as if it were that binary, complete with default options. More options can be +passed in via the COMMAND. But, if a user wants to run +something else inside the container, the **--entrypoint** option allows a new +ENTRYPOINT to be specified. + +Specify multi option commands in the form of a json string. + +[//]: # (END included file options/entrypoint.md) + + +[//]: # (BEGIN included file options/env.md) +#### **--env**, **-e**=*env* + +Set environment variables. + +This option allows arbitrary environment variables that are available for the process to be launched inside of the container. If an environment variable is specified without a value, Podman checks the host environment for a value and set the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the container. + +[//]: # (END included file options/env.md) + +See [**Environment**](#environment) note below for precedence and examples. + + +[//]: # (BEGIN included file options/env-file.md) +#### **--env-file**=*file* + +Read in a line-delimited file of environment variables. + +[//]: # (END included file options/env-file.md) + +See [**Environment**](#environment) note below for precedence and examples. + + +[//]: # (BEGIN included file options/env-host.md) +#### **--env-host** + +Use host environment inside of the container. See **Environment** note below for precedence. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/env-host.md) + + +[//]: # (BEGIN included file options/env-merge.md) +#### **--env-merge**=*env* + +Preprocess default environment variables for the containers. For example +if image contains environment variable `hello=world` user can preprocess +it using `--env-merge hello=${hello}-some` so new value is `hello=world-some`. + +Please note that if the environment variable `hello` is not present in the image, +then it'll be replaced by an empty string and so using `--env-merge hello=${hello}-some` +would result in the new value of `hello=-some`, notice the leading `-` delimiter. + +[//]: # (END included file options/env-merge.md) + + +[//]: # (BEGIN included file options/expose.md) +#### **--expose**=*port[/protocol]* + +Expose a port or a range of ports (e.g. **--expose=3300-3310**). +The protocol can be `tcp`, `udp` or `sctp` and if not given `tcp` is assumed. +This option matches the EXPOSE instruction for image builds and has no effect on +the actual networking rules unless **-P/--publish-all** is used to forward to all +exposed ports from random host ports. To forward specific ports from the host +into the container use the **-p/--publish** option instead. + +[//]: # (END included file options/expose.md) + + +[//]: # (BEGIN included file options/gidmap.container.md) +#### **--gidmap**=*[flags]container_uid\:from_uid[\:amount]* + +Run the container in a new user namespace using the supplied GID mapping. This +option conflicts with the **--userns** and **--subgidname** options. This +option provides a way to map host GIDs to container GIDs in the same way as +__--uidmap__ maps host UIDs to container UIDs. For details see __--uidmap__. + +Note: the **--gidmap** option cannot be called in conjunction with the **--pod** option as a gidmap cannot be set on the container level when in a pod. + +[//]: # (END included file options/gidmap.container.md) + + +[//]: # (BEGIN included file options/gpus.md) +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. + +[//]: # (END included file options/gpus.md) + + +[//]: # (BEGIN included file options/group-add.md) +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/group-add.md) + + +[//]: # (BEGIN included file options/group-entry.md) +#### **--group-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/group` file within the container when `--user` is used. + +The variables $GROUPNAME, $GID, and $USERLIST are automatically replaced with their value at runtime if present. + +[//]: # (END included file options/group-entry.md) + + +[//]: # (BEGIN included file options/health-cmd.md) +#### **--health-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set or alter a healthcheck command for a container. The command is a command to be executed inside the +container that determines the container health. The command is required for other healthcheck options +to be applied. A value of **none** disables existing healthchecks. + +Multiple options can be passed in the form of a JSON array; otherwise, the command is interpreted +as an argument to **/bin/sh -c**. + +[//]: # (END included file options/health-cmd.md) + + +[//]: # (BEGIN included file options/health-interval.md) +#### **--health-interval**=*interval* + +Set an interval for the healthchecks. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-interval.md) + + +[//]: # (BEGIN included file options/health-log-destination.md) +#### **--health-log-destination**=*directory_path* + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) (Default: local) + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. + +[//]: # (END included file options/health-log-destination.md) + + +[//]: # (BEGIN included file options/health-max-log-count.md) +#### **--health-max-log-count**=*number of stored logs* + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) (Default: 5 attempts) + +[//]: # (END included file options/health-max-log-count.md) + + +[//]: # (BEGIN included file options/health-max-log-size.md) +#### **--health-max-log-size**=*size of stored logs* + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) (Default: 500 characters) + +[//]: # (END included file options/health-max-log-size.md) + + +[//]: # (BEGIN included file options/health-on-failure.md) +#### **--health-on-failure**=*action* + +Action to take once the container transitions to an unhealthy state. The default is **none**. + +- **none**: Take no action. +- **kill**: Kill the container. +- **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. +- **stop**: Stop the container. + +[//]: # (END included file options/health-on-failure.md) + + +[//]: # (BEGIN included file options/health-retries.md) +#### **--health-retries**=*retries* + +The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is **3**. + +[//]: # (END included file options/health-retries.md) + + +[//]: # (BEGIN included file options/health-start-period.md) +#### **--health-start-period**=*period* + +The initialization time needed for a container to bootstrap. The value can be expressed in time format like +**2m3s**. The default value is **0s**. + +Note: The health check command is executed as soon as a container is started, if the health check is successful +the container's health state will be updated to `healthy`. However, if the health check fails, the health state will +stay as `starting` until either the health check is successful or until the `--health-start-period` time is over. If the +health check command fails after the `--health-start-period` time is over, the health state will be updated to `unhealthy`. +The health check command is executed periodically based on the value of `--health-interval`. + +[//]: # (END included file options/health-start-period.md) + + +[//]: # (BEGIN included file options/health-startup-cmd.md) +#### **--health-startup-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set a startup healthcheck command for a container. This command is executed inside the container and is used to gate the regular +healthcheck. When the startup command succeeds, the regular healthcheck begins and the startup healthcheck ceases. Optionally, +if the command fails for a set number of attempts, the container is restarted. A startup healthcheck can be used to ensure that +containers with an extended startup period are not marked as unhealthy until they are fully started. Startup healthchecks can only be +used when a regular healthcheck (from the container's image or the **--health-cmd** option) is also set. + +[//]: # (END included file options/health-startup-cmd.md) + + +[//]: # (BEGIN included file options/health-startup-interval.md) +#### **--health-startup-interval**=*interval* + +Set an interval for the startup healthcheck. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-startup-interval.md) + + +[//]: # (BEGIN included file options/health-startup-retries.md) +#### **--health-startup-retries**=*retries* + +The number of attempts allowed before the startup healthcheck restarts the container. If set to **0**, the container is never restarted. The default is **0**. + +[//]: # (END included file options/health-startup-retries.md) + + +[//]: # (BEGIN included file options/health-startup-success.md) +#### **--health-startup-success**=*retries* + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value +of **0** means that any success begins the regular healthcheck. The default is **0**. + +[//]: # (END included file options/health-startup-success.md) + + +[//]: # (BEGIN included file options/health-startup-timeout.md) +#### **--health-startup-timeout**=*timeout* + +The maximum time a startup healthcheck command has to complete before it is marked as failed. The value can be expressed in a time +format like **2m3s**. The default value is **30s**. + +[//]: # (END included file options/health-startup-timeout.md) + + +[//]: # (BEGIN included file options/health-timeout.md) +#### **--health-timeout**=*timeout* + +The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the +value can be expressed in a time format such as **1m22s**. The default value is **30s**. + +[//]: # (END included file options/health-timeout.md) + +#### **--help** + +Print usage statement + + +[//]: # (BEGIN included file options/hostname.container.md) +#### **--hostname**, **-h**=*name* + +Set the container's hostname inside the container. + +This option can only be used with a private UTS namespace `--uts=private` +(default). If `--pod` is given and the pod shares the same UTS namespace +(default), the pod's hostname is used. The given hostname is also added to the +`/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). + +[//]: # (END included file options/hostname.container.md) + + +[//]: # (BEGIN included file options/hosts-file.md) +#### **--hosts-file**=*path* | *none* | *image* + +Base file to create the `/etc/hosts` file inside the container. This must either +be an absolute path to a file on the host system, or one of the following +special flags: + "" Follow the `base_hosts_file` configuration in _containers.conf_ (the default) + `none` Do not use a base file (i.e. start with an empty file) + `image` Use the container image's `/etc/hosts` file as base file + +[//]: # (END included file options/hosts-file.md) + + +[//]: # (BEGIN included file options/hostuser.md) +#### **--hostuser**=*name* + +Add a user account to /etc/passwd from the host to the container. The Username +or UID must exist on the host system. + +[//]: # (END included file options/hostuser.md) + + +[//]: # (BEGIN included file options/http-proxy.md) +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. + +[//]: # (END included file options/http-proxy.md) + + +[//]: # (BEGIN included file options/image-volume.md) +#### **--image-volume**=**bind** | *tmpfs* | *ignore* + +Tells Podman how to handle the builtin image volumes. Default is **bind**. + +- **bind**: An anonymous named volume is created and mounted into the container. +- **tmpfs**: The volume is mounted onto the container as a tmpfs, which allows the users to create +content that disappears when the container is stopped. +- **ignore**: All volumes are just ignored and no action is taken. + +[//]: # (END included file options/image-volume.md) + + +[//]: # (BEGIN included file options/init.md) +#### **--init** + +Run an init inside the container that forwards signals and reaps processes. +The container-init binary is mounted at `/run/podman-init`. +Mounting over `/run` breaks container execution. + +[//]: # (END included file options/init.md) + +#### **--init-ctr**=*type* + +(Pods only). +When using pods, create an init style container, which is run after the infra container is started +but before regular pod containers are started. Init containers are useful for running +setup operations for the pod's applications. + +Valid values for `init-ctr` type are *always* or *once*. The *always* value +means the container runs with each and every `pod start`, whereas the *once* +value means the container only runs once when the pod is started and then the container is removed. + +Init containers are only run on pod `start`. Restarting a pod does not execute +any init containers. Furthermore, init containers can only be created in a +pod when that pod is not running. + + +[//]: # (BEGIN included file options/init-path.md) +#### **--init-path**=*path* + +Path to the container-init binary. + +[//]: # (END included file options/init-path.md) + + +[//]: # (BEGIN included file options/interactive.md) +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. + +[//]: # (END included file options/interactive.md) + + +[//]: # (BEGIN included file options/ip.md) +#### **--ip**=*ipv4* + +Specify a static IPv4 address for the container, for example **10.88.64.128**. +This option can only be used if the container is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IP address pool (default **10.88.0.0/16**). + +To specify multiple static IP addresses per container, set multiple networks using the **--network** option with a static IP address specified for each using the `ip` mode for that option. + +[//]: # (END included file options/ip.md) + + +[//]: # (BEGIN included file options/ip6.md) +#### **--ip6**=*ipv6* + +Specify a static IPv6 address for the container, for example **fd46\:db93\:aa76\:ac37::10**. +This option can only be used if the container is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IPv6 address pool. + +To specify multiple static IPv6 addresses per container, set multiple networks using the **--network** option with a static IPv6 address specified for each using the `ip6` mode for that option. + +[//]: # (END included file options/ip6.md) + + +[//]: # (BEGIN included file options/ipc.md) +#### **--ipc**=*ipc* + +Set the IPC namespace mode for a container. The default is to create +a private IPC namespace. + +- "": Use Podman's default, defined in containers.conf. +- **container:**_id_: reuses another container's shared memory, semaphores, and message queues +- **host**: use the host's shared memory, semaphores, and message queues inside the container. Note: the host mode gives the container full access to local shared memory and is therefore considered insecure. +- **none**: private IPC namespace, with /dev/shm not mounted. +- **ns:**_path_: path to an IPC namespace to join. +- **private**: private IPC namespace. +- **shareable**: private IPC namespace with a possibility to share it with other containers. + +[//]: # (END included file options/ipc.md) + + +[//]: # (BEGIN included file options/label.md) +#### **--label**, **-l**=*key=value* + +Add metadata to a container. + +[//]: # (END included file options/label.md) + + +[//]: # (BEGIN included file options/label-file.md) +#### **--label-file**=*file* + +Read in a line-delimited file of labels. + +[//]: # (END included file options/label-file.md) + + +[//]: # (BEGIN included file options/link-local-ip.md) +#### **--link-local-ip**=*ip* + +Not implemented. + +[//]: # (END included file options/link-local-ip.md) + + +[//]: # (BEGIN included file options/log-driver.md) +#### **--log-driver**=*driver* + +Logging driver for the container. Currently available options are **k8s-file**, **journald**, **none**, **passthrough** and **passthrough-tty**, with **json-file** aliased to **k8s-file** for scripting compatibility. (Default **journald**). + +The podman info command below displays the default log-driver for the system. +``` +$ podman info --format '{{ .Host.LogDriver }}' +journald +``` +The **passthrough** driver passes down the standard streams (stdin, stdout, stderr) to the +container. It is not allowed with the remote Podman client, including Mac and Windows (excluding WSL2) machines, and on a tty, since it is +vulnerable to attacks via TIOCSTI. + +The **passthrough-tty** driver is the same as **passthrough** except that it also allows it to be used on a TTY if the user really wants it. + +[//]: # (END included file options/log-driver.md) + + +[//]: # (BEGIN included file options/log-opt.md) +#### **--log-opt**=*name=value* + +Logging driver specific options. + +Set custom logging configuration. The following *name*s are supported: + +**path**: specify a path to the log file + (e.g. **--log-opt path=/var/log/container/mycontainer.json**); + +**max-size**: specify a max size of the log file + (e.g. **--log-opt max-size=10mb**); + +**tag**: specify a custom log tag for the container + (e.g. **--log-opt tag="{{.ImageName}}"**. +It supports the same keys as **podman inspect --format**. +This option is currently supported only by the **journald** log driver. + +[//]: # (END included file options/log-opt.md) + + +[//]: # (BEGIN included file options/mac-address.md) +#### **--mac-address**=*address* + +Container network interface MAC address (e.g. 92\:d0\:c6:0a:29:33) +This option can only be used if the container is joined to only a single network - i.e., **--network=_network-name_** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. + +Remember that the MAC address in an Ethernet network must be unique. +The IPv6 link-local address is based on the device's MAC address +according to RFC4862. + +To specify multiple static MAC addresses per container, set multiple networks using the **--network** option with a static MAC address specified for each using the `mac` mode for that option. + +[//]: # (END included file options/mac-address.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-reservation.md) +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-reservation.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/memory-swappiness.md) +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/memory-swappiness.md) + + +[//]: # (BEGIN included file options/mount.md) +#### **--mount**=*type=TYPE,TYPE-SPECIFIC-OPTION[,...]* + +Attach a filesystem mount to the container + +Current supported mount TYPEs are **bind**, **devpts**, **glob**, **image**, **ramfs**, **tmpfs** and **volume**. + +Options common to all mount types: + +- *src*, *source*: mount source spec for **bind**, **glob**, and **volume**. + Mandatory for **bind** and **glob**. + +- *dst*, *destination*, *target*: mount destination spec. + +When source globs are specified without the destination directory, +the files and directories are mounted with their complete path +within the container. When the destination is specified, the +files and directories matching the glob on the base file name +on the destination directory are mounted. The option +`type=glob,src=/foo*,destination=/tmp/bar` tells container engines +to mount host files matching /foo* to the /tmp/bar/ +directory in the container. + +Options specific to type=**volume**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *idmap*: If specified, create an idmapped mount to the target user namespace in the container. + The idmap option is only supported by Podman in rootful mode. The Linux kernel does not allow the use of idmaped file systems for unprivileged users. + The idmap option supports a custom mapping that can be different than the user namespace used by the container. + The mapping can be specified after the idmap option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the first value is the + start of the backing file system IDs that are mapped to the second value on the host. The length of this mapping is given in the third value. + Multiple ranges are separated with #. If the specified mapping is prepended with a '@' then the mapping is considered relative to the container + user namespace. The host ID for the mapping is changed to account for the relative position of the container user in the container user namespace. + +Options specific to type=**image**: + +- *rw*, *readwrite*: *true* or *false* (default if unspecified: *false*). + +- *subpath*: Mount only a specific path within the image, instead of the whole image. + +Options specific to **bind** and **glob**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *bind-propagation*: *shared*, *slave*, *private*, *unbindable*, *rshared*, *rslave*, *runbindable*, or **rprivate** (default).[[1]](#Footnote1) See also mount(2). + +- *bind-nonrecursive*: do not set up a recursive bind mount. By default it is recursive. + +- *relabel*: *shared*, *private*. + +- *idmap*: *true* or *false* (default if unspecified: *false*). If true, create an idmapped mount to the target user namespace in the container. The idmap option is only supported by Podman in rootful mode. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *no-dereference*: do not dereference symlinks but copy the link source into the mount destination. + +Options specific to type=**tmpfs** and **ramfs**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *tmpfs-size*: Size of the tmpfs/ramfs mount, in bytes. Unlimited by default in Linux. + +- *tmpfs-mode*: Octal file mode of the tmpfs/ramfs (e.g. 700 or 0700.). + +- *tmpcopyup*: Enable copyup from the image directory at the same location to the tmpfs/ramfs. Used by default. + +- *notmpcopyup*: Disable copying files from the image to the tmpfs/ramfs. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +Options specific to type=**devpts**: + +- *uid*: numeric UID of the file owner (default: 0). + +- *gid*: numeric GID of the file owner (default: 0). + +- *mode*: octal permission mask for the file (default: 600). + +- *max*: maximum number of PTYs (default: 1048576). + +Examples: + +- `type=bind,source=/path/on/host,destination=/path/in/container` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared,U=true` + +- `type=devpts,destination=/dev/pts` + +- `type=glob,src=/usr/lib/libfoo*,destination=/usr/lib,ro=true` + +- `type=image,source=fedora,destination=/fedora-image,rw=true` + +- `type=ramfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,destination=/path/in/container,noswap` + +- `type=volume,source=vol1,destination=/path/in/container,ro=true` + +[//]: # (END included file options/mount.md) + + +[//]: # (BEGIN included file options/name.container.md) +#### **--name**=*name* + +Assign a name to the container. + +The operator can identify a container in three ways: + +- UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”); +- UUID short identifier (“f78375b1c487”); +- Name (“jonah”). + +Podman generates a UUID for each container, and if no name is assigned to the +container using **--name**, Podman generates a random string name. The name can +be useful as a more human-friendly way to identify containers. This works for +both background and foreground containers. The container's name is also added +to the `/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). + +[//]: # (END included file options/name.container.md) + + +[//]: # (BEGIN included file options/network.md) +#### **--network**=*mode*, **--net** + +Set the network mode for the container. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured, to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.md) + +Invalid if using **--dns**, **--dns-option**, or **--dns-search** with **--network** set to **none** or **container:**_id_. + +If used together with **--pod**, the container does not join the pod's network namespace. + + +[//]: # (BEGIN included file options/network-alias.md) +#### **--network-alias**=*alias* + +Add a network-scoped alias for the container, setting the alias for all networks that the container joins. To set a +name only for a specific network, use the alias option as described under the **--network** option. +If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. This option can be specified multiple times. +NOTE: When using CNI a container only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. + +[//]: # (END included file options/network-alias.md) + + +[//]: # (BEGIN included file options/no-healthcheck.md) +#### **--no-healthcheck** + +Disable any defined healthchecks for container. + +[//]: # (END included file options/no-healthcheck.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the container. + +Podman assumes control over the container's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/oom-kill-disable.md) +#### **--oom-kill-disable** + +Whether to disable OOM Killer for the container or not. + +This flag is not supported on cgroups V2 systems. + +[//]: # (END included file options/oom-kill-disable.md) + + +[//]: # (BEGIN included file options/oom-score-adj.md) +#### **--oom-score-adj**=*num* + +Tune the host's OOM preferences for containers (accepts values from **-1000** to **1000**). + +When running in rootless mode, the specified value can't be lower than +the oom_score_adj for the current process. In this case, the +oom-score-adj is clamped to the current process value. + +[//]: # (END included file options/oom-score-adj.md) + + +[//]: # (BEGIN included file options/os.pull.md) +#### **--os**=*OS* + +Override the OS, defaults to hosts, of the image to be pulled. For example, `windows`. +Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. + +[//]: # (END included file options/os.pull.md) + + +[//]: # (BEGIN included file options/passwd-entry.md) +#### **--passwd-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/passwd` file within the container when `--passwd` is used. + +The variables $USERNAME, $UID, $GID, $NAME, $HOME are automatically replaced with their value at runtime. + +[//]: # (END included file options/passwd-entry.md) + + +[//]: # (BEGIN included file options/personality.md) +#### **--personality**=*persona* + +Personality sets the execution domain via Linux personality(2). + +[//]: # (END included file options/personality.md) + + +[//]: # (BEGIN included file options/pid.container.md) +#### **--pid**=*mode* + +Set the PID namespace mode for the container. +The default is to create a private PID namespace for the container. + +- **container:**_id_: join another container's PID namespace; +- **host**: use the host's PID namespace for the container. Note the host mode gives the container full access to local PID and is therefore considered insecure; +- **ns:**_path_: join the specified PID namespace; +- **private**: create a new namespace for the container (default). + +[//]: # (END included file options/pid.container.md) + + +[//]: # (BEGIN included file options/pidfile.md) +#### **--pidfile**=*path* + +When the pidfile location is specified, the container process' PID is written to the pidfile. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +If the pidfile option is not specified, the container process' PID is written to /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile. + +After the container is started, the location for the pidfile can be discovered with the following `podman inspect` command: + + $ podman inspect --format '{{ .PidFile }}' $CID + /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile + +[//]: # (END included file options/pidfile.md) + + +[//]: # (BEGIN included file options/pids-limit.md) +#### **--pids-limit**=*limit* + +Tune the container's pids limit. Set to **-1** to have unlimited pids for the container. The default is **2048** on systems that support "pids" cgroup controller. + +[//]: # (END included file options/pids-limit.md) + + +[//]: # (BEGIN included file options/platform.md) +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with --arch and --os) +The `--platform` option can be used to override the current architecture and operating system. +Unless overridden, subsequent lookups of the same image in the local storage matches this platform, regardless of the host. + +[//]: # (END included file options/platform.md) + + +[//]: # (BEGIN included file options/pod.run.md) +#### **--pod**=*name* + +Run container in an existing pod. Podman makes the pod automatically if the pod name is prefixed with **new:**. +To make a pod with more granular options, use the **podman pod create** command before creating a container. +When a container is run with a pod with an infra-container, the infra-container is started first. + +[//]: # (END included file options/pod.run.md) + + +[//]: # (BEGIN included file options/pod-id-file.container.md) +#### **--pod-id-file**=*file* + +Run container in an existing pod and read the pod's ID from the specified *file*. +When a container is run within a pod which has an infra-container, the infra-container starts first. + +[//]: # (END included file options/pod-id-file.container.md) + + +[//]: # (BEGIN included file options/privileged.md) +#### **--privileged** + +Give extended privileges to this container. The default is **false**. + +By default, Podman containers are unprivileged (**=false**) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read-only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. +Due to the disabled security features, the privileged field should almost never +be set as containers can easily break out of confinement. + +Containers running in a user namespace (e.g., rootless containers) cannot have +more privileges than the user that launched them. + +[//]: # (END included file options/privileged.md) + + +[//]: # (BEGIN included file options/publish.md) +#### **--publish**, **-p**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Publish a container's port, or range of ports, to the host. + +Both *hostPort* and *containerPort* can be specified as a range of ports. +When specifying ranges for both, the number of container ports in the +range must match the number of host ports in the range. + +If host IP is set to 0.0.0.0 or not set at all, the port is bound on all IPs on the host. + +By default, Podman publishes TCP ports. To publish a UDP port instead, give +`udp` as protocol. To publish both TCP and UDP ports, set `--publish` twice, +with `tcp`, and `udp` as protocols respectively. Rootful containers can also +publish ports using the `sctp` protocol. + +Host port does not have to be specified (e.g. `podman run -p 127.0.0.1::80`). +If it is not, the container port is randomly assigned a port on the host. + +Use **podman port** to see the actual mapping: `podman port $CONTAINER $CONTAINERPORT`. + +Note that the network drivers `macvlan` and `ipvlan` do not support port forwarding, +it will have no effect on these networks. + +[//]: # (END included file options/publish.md) + +**Note:** If a container runs within a pod, it is not necessary to publish the port for +the containers in the pod. The port must only be published by the pod itself. Pod network +stacks act like the network stack on the host - when there are a variety of containers in the pod, +and programs in the container, all sharing a single interface and IP address, and +associated ports. If one container binds to a port, no other container can use that port +within the pod while it is in use. Containers in the pod can also communicate over localhost +by having one container bind to localhost in the pod, and another connect to that port. + + +[//]: # (BEGIN included file options/publish-all.md) +#### **--publish-all**, **-P** + +Publish all exposed ports to random ports on the host interfaces. The default is **false**. + +When set to **true**, publish all exposed ports to the host interfaces. +If the operator uses **-P** (or **-p**) then Podman makes the +exposed port accessible on the host and the ports are available to any +client that can reach the host. + +When using this option, Podman binds any exposed port to a random port on the host +within an ephemeral port range defined by */proc/sys/net/ipv4/ip_local_port_range*. +To find the mapping between the host ports and the exposed ports, use **podman port**. + +[//]: # (END included file options/publish-all.md) + + +[//]: # (BEGIN included file options/pull.md) +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Pull the image only when the image is not in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error if no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. + +[//]: # (END included file options/pull.md) + +#### **--quiet**, **-q** + +Suppress output information when pulling images + + +[//]: # (BEGIN included file options/rdt-class.md) +#### **--rdt-class**=*intel-rdt-class-of-service* + +Rdt-class sets the class of service (CLOS or COS) for the container to run in. Based on the Cache Allocation Technology (CAT) feature that is part of Intel's Resource Director Technology (RDT) feature set, all container processes will run within the pre-configured COS, representing a part of the cache. The COS has to be created and configured using a pseudo file system (usually mounted at `/sys/fs/resctrl`) that the resctrl kernel driver provides. Assigning the container to a COS requires root privileges and thus doesn't work in a rootless environment. Currently, the feature is only supported using `runc` as a runtime. See for more details on creating a COS before a container can be assigned to it. + +[//]: # (END included file options/rdt-class.md) + + +[//]: # (BEGIN included file options/read-only.md) +#### **--read-only** + +Mount the container's root filesystem as read-only. + +By default, container root filesystems are writable, allowing processes +to write files anywhere. By specifying the **--read-only** flag, the containers root filesystem are mounted read-only prohibiting any writes. + +[//]: # (END included file options/read-only.md) + + +[//]: # (BEGIN included file options/read-only-tmpfs.md) +#### **--read-only-tmpfs** + +When running --read-only containers, mount a read-write tmpfs on _/dev_, _/dev/shm_, _/run_, _/tmp_, and _/var/tmp_. The default is **true**. + +| --read-only | --read-only-tmpfs | / | /run, /tmp, /var/tmp| +| ----------- | ----------------- | ---- | ----------------------------------- | +| true | true | r/o | r/w | +| true | false | r/o | r/o | +| false | false | r/w | r/w | +| false | true | r/w | r/w | + +When **--read-only=true** and **--read-only-tmpfs=true** additional tmpfs are mounted on +the /tmp, /run, and /var/tmp directories. + +When **--read-only=true** and **--read-only-tmpfs=false** /dev and /dev/shm are marked +Read/Only and no tmpfs are mounted on /tmp, /run and /var/tmp. The directories +are exposed from the underlying image, meaning they are read-only by default. +This makes the container totally read-only. No writable directories exist within +the container. In this mode writable directories need to be added via external +volumes or mounts. + +By default, when **--read-only=false**, the /dev and /dev/shm are read/write, and the /tmp, /run, and /var/tmp are read/write directories from the container image. + +[//]: # (END included file options/read-only-tmpfs.md) + + +[//]: # (BEGIN included file options/replace.md) +#### **--replace** + +If another container with the same name already exists, replace and remove it. The default is **false**. + +[//]: # (END included file options/replace.md) + + +[//]: # (BEGIN included file options/requires.md) +#### **--requires**=*container* + +Specify one or more requirements. +A requirement is a dependency container that is started before this container. +Containers can be specified by name or ID, with multiple containers being separated by commas. + +[//]: # (END included file options/requires.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + +#### **--rm** + +Automatically remove the container and any anonymous unnamed volume associated with +the container when it exits. The default is **false**. + + +[//]: # (BEGIN included file options/rootfs.md) +#### **--rootfs** + +If specified, the first argument refers to an exploded container on the file system. + +This is useful to run a container without requiring any image management, the rootfs +of the container is assumed to be managed externally. + + `Overlay Rootfs Mounts` + + The `\:O` flag tells Podman to mount the directory from the rootfs path as +storage using the `overlay file system`. The container processes +can modify content within the mount point which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +Note: On **SELinux** systems, the rootfs needs the correct label, which is by default +**unconfined_u\:object_r\:container_file_t\:s0**. + + `idmap` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. +The idmap option supports a custom mapping that can be different than the user +namespace used by the container. The mapping can be specified after the idmap +option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the +first value is the start of the backing file system IDs that are mapped to the +second value on the host. The length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/rootfs.md) + + +[//]: # (BEGIN included file options/sdnotify.md) +#### **--sdnotify**=**container** | *conmon* | *healthy* | *ignore* + +Determines how to use the NOTIFY_SOCKET, as passed with systemd and Type=notify. + +Default is **container**, which means allow the OCI runtime to proxy the socket into the +container to receive ready notification. Podman sets the MAINPID to conmon's pid. +The **conmon** option sets MAINPID to conmon's pid, and sends READY when the container +has started. The socket is never passed to the runtime or the container. +The **healthy** option sets MAINPID to conmon's pid, and sends READY when the container +has turned healthy; requires a healthcheck to be set. The socket is never passed to the runtime or the container. +The **ignore** option removes NOTIFY_SOCKET from the environment for itself and child processes, +for the case where some other process above Podman uses NOTIFY_SOCKET and Podman does not use it. + +[//]: # (END included file options/sdnotify.md) + + +[//]: # (BEGIN included file options/seccomp-policy.md) +#### **--seccomp-policy**=*policy* + +Specify the policy to select the seccomp profile. If set to *image*, Podman looks for a "io.containers.seccomp.profile" label in the container-image config and use its value as a seccomp profile. Otherwise, Podman follows the *default* policy by applying the default profile unless specified otherwise via *--security-opt seccomp* as described below. + +Note that this feature is experimental and may change in the future. + +[//]: # (END included file options/seccomp-policy.md) + + +[//]: # (BEGIN included file options/secret.md) +#### **--secret**=*secret[,opt=opt ...]* + +Give the container access to a secret. Can be specified multiple times. + +A secret is a blob of sensitive data which a container needs at runtime but +is not stored in the image or in source control, such as usernames and passwords, +TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 500 kb in size). + +When secrets are specified as type `mount`, the secrets are copied and mounted into the container when a container is created. +When secrets are specified as type `env`, the secret is set as an environment variable within the container. +Secrets are written in the container at the time of container creation, and modifying the secret using `podman secret` commands +after the container is created affects the secret inside the container. + +Secrets and its storage are managed using the `podman secret` command. + +Secret Options + +- `type=mount|env` : How the secret is exposed to the container. + `mount` mounts the secret into the container as a file. + `env` exposes the secret as an environment variable. + Defaults to `mount`. +- `target=target` : Target of secret. + For mounted secrets, this is the path to the secret inside the container. + If a fully qualified path is provided, the secret is mounted at that location. + Otherwise, the secret is mounted to + `/run/secrets/target` for linux containers or + `/var/run/secrets/target` for freebsd containers. + If the target is not set, the secret is mounted to `/run/secrets/secretname` by default. + For env secrets, this is the environment variable key. Defaults to `secretname`. +- `uid=0` : UID of secret. Defaults to 0. Mount secret type only. +- `gid=0` : GID of secret. Defaults to 0. Mount secret type only. +- `mode=0` : Mode of secret. Defaults to 0444. Mount secret type only. + + +Examples + +Mount at `/my/location/mysecret` with UID 1: +``` +--secret mysecret,target=/my/location/mysecret,uid=1 +``` + +Mount at `/run/secrets/customtarget` with mode 0777: +``` +--secret mysecret,target=customtarget,mode=0777 +``` + +Create a secret environment variable called `ENVSEC`: +``` +--secret mysecret,type=env,target=ENVSEC +``` + +[//]: # (END included file options/secret.md) + + +[//]: # (BEGIN included file options/security-opt.md) +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the container +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the container + +- **label=user:**_USER_: Set the label user for the container processes +- **label=role:**_ROLE_: Set the label role for the container processes +- **label=type:**_TYPE_: Set the label process type for the container processes +- **label=level:**_LEVEL_: Set the label level for the container processes +- **label=filetype:**_TYPE_: Set the label file type for the container files +- **label=disable**: Turn off label separation for the container + +Note: Labeling can be disabled for all containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the container. + +- **no-new-privileges**: Disable container processes from gaining additional privileges. + +- **seccomp=unconfined**: Turn off seccomp confinement for the container. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. + +[//]: # (END included file options/security-opt.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the container. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/shm-size-systemd.md) +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. + +[//]: # (END included file options/shm-size-systemd.md) + + +[//]: # (BEGIN included file options/stop-signal.md) +#### **--stop-signal**=*signal* + +Signal to stop a container. Default is **SIGTERM**. + +[//]: # (END included file options/stop-signal.md) + + +[//]: # (BEGIN included file options/stop-timeout.md) +#### **--stop-timeout**=*seconds* + +Timeout to stop a container. Default is **10**. +Remote connections use local containers.conf for defaults. + +[//]: # (END included file options/stop-timeout.md) + + +[//]: # (BEGIN included file options/subgidname.md) +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. + +[//]: # (END included file options/subgidname.md) + + +[//]: # (BEGIN included file options/subuidname.md) +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. + +[//]: # (END included file options/subuidname.md) + + +[//]: # (BEGIN included file options/sysctl.md) +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters at runtime. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: if using the **--ipc=host** option, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: if using the **--network=host** option, the above sysctls are not allowed. + +[//]: # (END included file options/sysctl.md) + + +[//]: # (BEGIN included file options/systemd.md) +#### **--systemd**=*true* | *false* | *always* + +Run container in systemd mode. The default is **true**. + +- **true** enables systemd mode only when the command executed inside the container is *systemd*, */usr/sbin/init*, +*/sbin/init* or */usr/local/sbin/init*. + +- **false** disables systemd mode. + +- **always** enforces the systemd mode to be enabled. + +Running the container in systemd mode causes the following changes: + +* Podman mounts tmpfs file systems on the following directories + * _/run_ + * _/run/lock_ + * _/tmp_ + * _/sys/fs/cgroup/systemd_ (on a cgroup v1 system) + * _/var/lib/journal_ +* Podman sets the default stop signal to **SIGRTMIN+3**. +* Podman sets **container_uuid** environment variable in the container to the +first 32 characters of the container ID. +* Podman does not mount virtual consoles (_/dev/tty\d+_) when running with **--privileged**. +* On cgroup v2, */sys/fs/cgroup* is mounted writeable. + +This allows systemd to run in a confined container without any modifications. + +Note that on **SELinux** systems, systemd attempts to write to the cgroup +file system. Containers writing to the cgroup file system are denied by default. +The **container_manage_cgroup** boolean must be enabled for this to be allowed on an SELinux separated system. +``` +setsebool -P container_manage_cgroup true +``` + +[//]: # (END included file options/systemd.md) + + +[//]: # (BEGIN included file options/timeout.md) +#### **--timeout**=*seconds* + +Maximum time a container is allowed to run before conmon sends it the kill +signal. By default containers run until they exit or are stopped by +`podman stop`. + +[//]: # (END included file options/timeout.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/tmpfs.md) +#### **--tmpfs**=*fs* + +Create a tmpfs mount. + +Mount a temporary filesystem (**tmpfs**) mount into a container, for example: + +``` +$ podman create -d --tmpfs /tmp\:rw,size=787448k,mode=1777 my_image +``` + +This command mounts a **tmpfs** at _/tmp_ within the container. The supported mount +options are the same as the Linux default mount flags. If no options are specified, +the system uses the following options: +**rw,noexec,nosuid,nodev**. + +[//]: # (END included file options/tmpfs.md) + + +[//]: # (BEGIN included file options/tty.md) +#### **--tty**, **-t** + +Allocate a pseudo-TTY. The default is **false**. + +When set to **true**, Podman allocates a pseudo-tty and attach to the standard +input of the container. This can be used, for example, to run a throwaway +interactive shell. + +**NOTE**: The --tty flag prevents redirection of standard output. It combines STDOUT and STDERR, it can insert control characters, and it can hang pipes. This option is only used when run interactively in a terminal. When feeding input to Podman, use -i only, not -it. + +[//]: # (END included file options/tty.md) + + +[//]: # (BEGIN included file options/tz.md) +#### **--tz**=*timezone* + +Set timezone in container. This flag takes area-based timezones, GMT time, as well as `local`, which sets the timezone in the container to match the host machine. See `/usr/share/zoneinfo/` for valid timezones. +Remote connections use local containers.conf for defaults + +[//]: # (END included file options/tz.md) + + +[//]: # (BEGIN included file options/uidmap.container.md) +#### **--uidmap**=*[flags]container_uid\:from_uid[\:amount]* + +Run the container in a new user namespace using the supplied UID mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +The possible values of the optional *flags* are discussed further down on this page. +The *amount* value is optional and assumed to be **1** if not given. + +The *from_uid* value is based upon the user running the command, either rootful or rootless users. + +* rootful user: [*flags*]*container_uid*:*host_uid*[:*amount*] +* rootless user: [*flags*]*container_uid*:*intermediate_uid*[:*amount*] + + `Rootful mappings` + + +When **podman create** is called by a privileged user, the option **--uidmap** +works as a direct mapping between host UIDs and container UIDs. + +host UID -> container UID + +The _amount_ specifies the number of consecutive UIDs that is mapped. +If for example _amount_ is **4** the mapping looks like: + +| host UID | container UID | +| ---------- | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | + + `Rootless mappings` + +When **podman create** is called by an unprivileged user (i.e. running rootless), +the value *from_uid* is interpreted as an "intermediate UID". In the rootless +case, host UIDs are not mapped directly to container UIDs. Instead the mapping +happens over two mapping steps: + +host UID -> intermediate UID -> container UID + +The **--uidmap** option only influences the second mapping step. + +The first mapping step is derived by Podman from the contents of the file +_/etc/subuid_ and the UID of the user calling Podman. + +First mapping step: + +| host UID | intermediate UID | +| -------- | ---------------- | +| UID for Podman user | 0 | +| 1st subordinate UID | 1 | +| 2nd subordinate UID | 2 | +| 3rd subordinate UID | 3 | +| nth subordinate UID | n | + +To be able to use intermediate UIDs greater than zero, the user needs to have +subordinate UIDs configured in _/etc/subuid_. See **subuid**(5). + +The second mapping step is configured with **--uidmap**. + +If for example _amount_ is **5** the second mapping step looks like: + +| intermediate UID | container UID | +| ------------------ | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | +| *from_uid* + 4 | *container_uid* + 4 | + +When running as rootless, Podman uses all the ranges configured in the _/etc/subuid_ file. + +The current user ID is mapped to UID=0 in the rootless user namespace. +Every additional range is added sequentially afterward: + +| host | rootless user namespace | length | +| ------ | ----------------------- | ------ | +| $UID | 0 | 1 | +| 1 | $FIRST_RANGE_ID | $FIRST_RANGE_LENGTH | +| 1+$FIRST_RANGE_LENGTH | $SECOND_RANGE_ID | $SECOND_RANGE_LENGTH| + + `Referencing a host ID from the parent namespace` + +As a rootless user, the given host ID in **--uidmap** or **--gidmap** +is mapped from the *intermediate namespace* generated by Podman. Sometimes +it is desirable to refer directly at the *host namespace*. It is possible +to manually do so, by running `podman unshare cat /proc/self/gid_map`, +finding the desired host id at the second column of the output, and getting +the corresponding intermediate id from the first column. + +Podman can perform all that by preceding the host id in the mapping +with the `@` symbol. For instance, by specifying `--gidmap 100000:@2000:1`, +podman will look up the intermediate id corresponding to host id `2000` and +it will map the found intermediate id to the container id `100000`. The +given host id must have been subordinated (otherwise it would not be mapped +into the intermediate space in the first place). + +If the length is greater than one, for instance with `--gidmap 100000:@2000:2`, +Podman will map host ids `2000` and `2001` to `100000` and `100001`, respectively, +regardless of how the intermediate mapping is defined. + + `Extending previous mappings` + +Some mapping modifications may be cumbersome. For instance, a user +starts with a mapping such as `--gidmap="0:0:65000"`, that needs to be +changed such as the parent id `1000` is mapped to container id `100000` +instead, leaving container id `1` unassigned. The corresponding `--gidmap` +becomes `--gidmap="0:0:1" --gidmap="2:2:65534" --gidmap="100000:1:1"`. + +This notation can be simplified using the `+` flag, that takes care of +breaking previous mappings removing any conflicting assignment with +the given mapping. The flag is given before the container id +as follows: `--gidmap="0:0:65000" --gidmap="+100000:1:1"` + + + Flag | Example | Description +-----------|---------------|------------- + `+` | `+100000:1:1` | Extend the previous mapping + +This notation leads to gaps in the assignment, so it may be convenient to +fill those gaps afterwards: `--gidmap="0:0:65000" --gidmap="+100000:1:1" --gidmap="1:65001:1"` + +One specific use case for this flag is in the context of rootless +users. A rootless user may specify mappings with the `+` flag as +in `--gidmap="+100000:1:1"`. Podman will then "fill the gaps" starting +from zero with all the remaining intermediate ids. This is convenient when +a user wants to map a specific intermediate id to a container id, leaving +the rest of subordinate ids to be mapped by Podman at will. + + `Passing only one of --uidmap or --gidmap` + +Usually, subordinated user and group ids are assigned simultaneously, and +for any user the subordinated user ids match the subordinated group ids. +For convenience, if only one of **--uidmap** or **--gidmap** is given, +podman assumes the mapping refers to both UIDs and GIDs and applies the +given mapping to both. If only one value of the two needs to be changed, +the mappings should include the `u` or the `g` flags to specify that +they only apply to UIDs or GIDs and should not be copied over. + + flag | Example | Description +---------|-----------------|----------------- + `u` | `u20000:2000:1` |The mapping only applies to UIDs + `g` | `g10000:1000:1` |The mapping only applies to GIDs + +For instance given the command + + podman create --gidmap "0:0:1000" --gidmap "g2000:2000:1" + +Since no **--uidmap** is given, the **--gidmap** is copied to **--uidmap**, +giving a command equivalent to + + podman create --gidmap "0:0:1000" --gidmap "2000:2000:1" --uidmap "0:0:1000" + +The `--gidmap "g2000:2000:1"` used the `g` flag and therefore it was +not copied to **--uidmap**. + + `Rootless mapping of additional host GIDs` + +A rootless user may desire to map a specific host group that has already been +subordinated within _/etc/subgid_ without specifying the rest of the mapping. + +This can be done with **--gidmap "+g*container_gid*:@*host_gid*"** + +Where: + +- The host GID is given through the `@` symbol +- The mapping of this GID is not copied over to **--usermap** thanks to the `g` flag. +- The rest of the container IDs will be mapped starting from 0 to n, + with all the remaining subordinated GIDs, thanks to the `+` flag. + +For instance, if a user belongs to the group `2000` and that group is +subordinated to that user (with `usermod --add-subgids 2000-2000 $USER`), +the user can map the group into the container with: **--gidmap=+g100000:@2000**. + +If this mapping is combined with the option, **--group-add=keep-groups**, the +process in the container will belong to group `100000`, and files belonging +to group `2000` in the host will appear as being owned by group `100000` +inside the container. + + podman run --group-add=keep-groups --gidmap="+g100000:@2000" ... + + `No subordinate UIDs` + +Even if a user does not have any subordinate UIDs in _/etc/subuid_, +**--uidmap** can be used to map the normal UID of the user to a +container UID by running `podman create --uidmap $container_uid:0:1 --user $container_uid ...`. + + `Pods` + +The **--uidmap** option cannot be called in conjunction with the **--pod** option as a uidmap cannot be set on the container level when in a pod. + +[//]: # (END included file options/uidmap.container.md) + + +[//]: # (BEGIN included file options/ulimit.md) +#### **--ulimit**=*option* + +Ulimit options. Sets the ulimits values inside of the container. + +--ulimit with a soft and hard limit in the format =[:]. For example: + +$ podman run --ulimit nofile=1024:1024 --rm ubi9 ulimit -n +1024 + +Set -1 for the soft or hard limit to set the limit to the maximum limit of the current +process. In rootful mode this is often unlimited. + + +If nofile and nproc are unset, a default value of 1048576 will be used, unless overridden +in containers.conf(5). However, if the default value exceeds the hard limit for the current +rootless user, the current hard limit will be applied instead. + +Use **host** to copy the current configuration from the host. + +Don't use nproc with the ulimit flag as Linux uses nproc to set the +maximum number of processes available to a user, not to a container. + +Use the --pids-limit option to modify the cgroup control to limit the number +of processes within a container. + +[//]: # (END included file options/ulimit.md) + + +[//]: # (BEGIN included file options/umask.md) +#### **--umask**=*umask* + +Set the umask inside the container. Defaults to `0022`. +Remote connections use local containers.conf for defaults + +[//]: # (END included file options/umask.md) + + +[//]: # (BEGIN included file options/unsetenv.md) +#### **--unsetenv**=*env* + +Unset default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. + +[//]: # (END included file options/unsetenv.md) + + +[//]: # (BEGIN included file options/unsetenv-all.md) +#### **--unsetenv-all** + +Unset all default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. + +[//]: # (END included file options/unsetenv-all.md) + + +[//]: # (BEGIN included file options/user.md) +#### **--user**, **-u**=*user[\:group]* + +Sets the username or UID used and, optionally, the groupname or GID for the specified command. Both *user* and *group* may be symbolic or numeric. + +Without this argument, the command runs as the user specified in the container image. Unless overridden by a `USER` command in the Containerfile or by a value passed to this option, this user generally defaults to root. + +When a user namespace is not in use, the UID and GID used within the container and on the host match. When user namespaces are in use, however, the UID and GID in the container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container by default corresponds to the UID and GID of the user invoking Podman. + +[//]: # (END included file options/user.md) + + +[//]: # (BEGIN included file options/userns.container.md) +#### **--userns**=*mode* + +Set the user namespace mode for the container. + +If `--userns` is not set, the default value is determined as follows. +- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used. +- If the environment variable **PODMAN_USERNS** is set its value is used. +- If `userns` is specified in `containers.conf` this value is used. +- Otherwise, `--userns=host` is assumed. + +`--userns=""` (i.e., an empty string) is an alias for `--userns=host`. + +This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +------------------------|-----------|--------------------- +auto | $UID | nil (Host User UID is not mapped into container.) +host | $UID | 0 (Default User account mapped to root user in container.) +keep-id | $UID | $UID (Map user account to same UID within container.) +keep-id\:uid=200,gid=210 | $UID | 200:210 (Map user account to specified UID, GID value within container.) +nomap | $UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + +**auto**[\:_OPTIONS,..._]: automatically create a unique user namespace. + +* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. + + Example: `containers:2147483647:2147483648`. + +* `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5). + +Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user IDs. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. + +The option `--userns=keep-id` uses all the subuids and subgids of the user. +The option `--userns=nomap` uses all the subuids and subgids of the user except the user's own ID. +Using `--userns=auto` when starting new containers does not work as long as any containers exist that were started with `--userns=nomap` or `--userns=keep-id` without limiting the user namespace size. + + Valid `auto` options: + + - *gidmapping*=_CONTAINER\_GID\:HOST\_GID\:SIZE_: to force a GID mapping to be present in the user namespace. + - *size*=_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates a size for the user namespace. + - *uidmapping*=_CONTAINER\_UID\:HOST\_UID\:SIZE_: to force a UID mapping to be present in the user namespace. + +The host UID and GID in *gidmapping* and *uidmapping* can optionally be prefixed with the `@` symbol. +In this case, podman will look up the intermediate ID corresponding to host ID and it will map the found intermediate ID to the container id. +For details see **--uidmap**. + +**container:**_id_: join the user namespace of the specified container. + +**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user. + +**keep-id**: creates a user namespace where the current user's UID\:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace. + + Valid `keep-id` options: + + - *uid*=UID: override the UID inside the container that is used to map the current user to. + - *gid*=GID: override the GID inside the container that is used to map the current user to. + - *size*=SIZE: override the size of the configured user namespace. It is useful to not saturate all the available IDs. Not supported when running as root. + +**nomap**: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +**ns:**_namespace_: run the container in the given existing user namespace. + +[//]: # (END included file options/userns.container.md) + + +[//]: # (BEGIN included file options/uts.container.md) +#### **--uts**=*mode* + +Set the UTS namespace mode for the container. The following values are supported: + +- **host**: use the host's UTS namespace inside the container. +- **private**: create a new namespace for the container (default). +- **ns:[path]**: run the container in the given existing UTS namespace. +- **container:[container]**: join the UTS namespace of the specified container. + +[//]: # (END included file options/uts.container.md) + + +[//]: # (BEGIN included file options/variant.container.md) +#### **--variant**=*VARIANT* + +Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. + +[//]: # (END included file options/variant.container.md) + + +[//]: # (BEGIN included file options/volume.md) +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the container is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +container. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a container is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the container, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the container. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system +might prevent the processes running inside the container from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the container context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +containers share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label Only the current container can use a private +volume. Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any of one the containers. Relabeling walks +the file system under the volume and changes the label on each file, if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the container. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually change with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the container. +For example if a user wanted to volume mount their entire home directory into a +container, they need to disable SELinux separation. + + $ podman create --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The container processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous container executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the container +to work. + +Do not modify the source directory mounted into the container with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the container are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the container +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +container, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +container. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the container. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the container. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless container fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/volume.md) + +Use the **--group-add keep-groups** option to pass the user's supplementary group access into the container. + + +[//]: # (BEGIN included file options/volumes-from.md) +#### **--volumes-from**=*CONTAINER[\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +container. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target container, then the volume hides +that data on the target. + +[//]: # (END included file options/volumes-from.md) + + +[//]: # (BEGIN included file options/workdir.md) +#### **--workdir**, **-w**=*dir* + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (**/**). +The image developer can set a different default with the WORKDIR instruction. The operator +can override the working directory by using the **-w** option. + +[//]: # (END included file options/workdir.md) + +## EXAMPLES + +Create a container using a local image: +``` +$ podman create alpine ls +``` + +Create a container using a local image and annotate it: +``` +$ podman create --annotation HELLO=WORLD alpine ls +``` + +Create a container using a local image, allocating a pseudo-TTY, keeping stdin open and name it myctr: +``` + podman create -t -i --name myctr alpine ls +``` + +Running a container in a new user namespace requires a mapping of +the UIDs and GIDs from the host: +``` +$ podman create --uidmap 0:30000:7000 --gidmap 0:30000:7000 fedora echo hello +``` + +Setting automatic user-namespace separated containers: +``` +# podman create --userns=auto\:size=65536 ubi8-init +``` + +Configure the timezone in a container: +``` +$ podman create --tz=local alpine date +$ podman create --tz=Asia/Shanghai alpine date +$ podman create --tz=US/Eastern alpine date +``` + +Ensure the first container (container1) is running before the second container (container2) is started: +``` +$ podman create --name container1 -t -i fedora bash +$ podman create --name container2 --requires container1 -t -i fedora bash +$ podman start --attach container2 +``` + +Create a container which requires multiple containers: +``` +$ podman create --name container1 -t -i fedora bash +$ podman create --name container2 -t -i fedora bash +$ podman create --name container3 --requires container1,container2 -t -i fedora bash +$ podman start --attach container3 +``` + +Expose shared libraries inside of container as read-only using a glob: +``` +$ podman create --mount type=glob,src=/usr/lib64/libnvidia\*,ro -i -t fedora /bin/bash +``` + +Create a container allowing supplemental groups to have access to the volume: +``` +$ podman create -v /var/lib/design:/var/lib/design --group-add keep-groups ubi8 +``` + +Configure execution domain for containers using the personality option: +``` +$ podman create --name container1 --personality=LINUX32 fedora bash +``` + +Create a container with external rootfs mounted as an overlay: +``` +$ podman create --name container1 --rootfs /path/to/rootfs:O bash +``` + +Create a container connected to two networks (called net1 and net2) with a static ip: +``` +$ podman create --network net1\:ip=10.89.1.5 --network net2:ip=10.89.10.10 alpine ip addr +``` + +### Rootless Containers + +Podman runs as a non-root user on most systems. This feature requires that a new enough version of shadow-utils +be installed. The shadow-utils package must include the newuidmap and newgidmap executables. + +In order for users to run rootless, there must be an entry for their username in /etc/subuid and /etc/subgid which lists the UIDs for their user namespace. + +Rootless Podman works better if the fuse-overlayfs and slirp4netns packages are installed. +The fuse-overlayfs package provides a userspace overlay storage driver, otherwise users need to use +the vfs storage driver, which can be disk space expensive and less performant +than other drivers. + +To enable VPN on the container, slirp4netns or pasta needs to be specified; +without either, containers need to be run with the --network=host flag. + +## ENVIRONMENT + +Environment variables within containers can be set using multiple different options: This section describes the precedence. + +Precedence order (later entries override earlier entries): + +- **--env-host** : Host environment of the process executing Podman is added. +- **--http-proxy**: By default, several environment variables are passed in from the host, such as **http_proxy** and **no_proxy**. See **--http-proxy** for details. +- Container image : Any environment variables specified in the container image. +- **--env-file** : Any environment variables specified via env-files. If multiple files specified, then they override each other in order of entry. +- **--env** : Any environment variables specified overrides previous settings. + +Create containers and set the environment ending with a __*__. +The trailing __*__ glob functionality is only active when no value is specified: + +``` +$ export ENV1=a +$ podman create --name ctr1 --env 'ENV*' alpine env +$ podman start --attach ctr1 | grep ENV +ENV1=a +$ podman create --name ctr2 --env 'ENV*=b' alpine env +$ podman start --attach ctr2 | grep ENV +ENV*=b +``` + +## CONMON + +When Podman starts a container it actually executes the conmon program, which +then executes the OCI Runtime. Conmon is the container monitor. It is a small +program whose job is to watch the primary process of the container, and if the +container dies, save the exit code. It also holds open the tty of the +container, so that it can be attached to later. This is what allows Podman to +run in detached mode (backgrounded), so Podman can exit but conmon continues to +run. Each container has their own instance of conmon. Conmon waits for the +container to exit, gathers and saves the exit code, and then launches a Podman +process to complete the container cleanup, by shutting down the network and +storage. For more information about conmon, see the conmon(8) man +page. + +## FILES + +**/etc/subuid** +**/etc/subgid** + +NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-save(1)](podman-save.1.md)**, **[podman-ps(1)](podman-ps.1.md)**, **[podman-attach(1)](podman-attach.1.md)**, **[podman-pod-create(1)](podman-pod-create.1.md)**, **[podman-port(1)](podman-port.1.md)**, **[podman-start(1)](podman-start.1.md)**, **[podman-kill(1)](podman-kill.1.md)**, **[podman-stop(1)](podman-stop.1.md)**, **[podman-generate-systemd(1)](podman-generate-systemd.1.md)**, **[podman-rm(1)](podman-rm.1.md)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)**, **[setsebool(8)](https://man7.org/linux/man-pages/man8/setsebool.8.html)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, **[pasta(1)](https://passt.top/builds/latest/web/passt.1.html)**, **[fuse-overlayfs(1)](https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md)**, **proc(5)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)**, **personality(2)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +See [podman-rootless(7)](https://github.com/containers/podman/blob/main/rootless.md) +for rootless issues. + +## HISTORY +October 2017, converted from Docker documentation to Podman by Dan Walsh for Podman `` + +November 2014, updated by Sven Dowideit `` + +September 2014, updated by Sven Dowideit `` + +August 2014, updated by Sven Dowideit `` + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a core value of open source. The `master` and `slave` mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately. diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-diff.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-diff.1.md new file mode 100644 index 000000000..67f377ccf --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-diff.1.md @@ -0,0 +1,75 @@ +--- +title: podman-diff +version: v5.4.2 +--- + +% podman-diff 1 + +## NAME +podman\-diff - Inspect changes on a container or image's filesystem + +## SYNOPSIS +**podman diff** [*options*] *container|image* [*container|image*] + +## DESCRIPTION +Displays changes on a container or image's filesystem. The container or image is compared to its parent layer or the second argument when given. + +The output is prefixed with the following symbols: + +| Symbol | Description | +|--------|-------------| +| A | A file or directory was added. | +| D | A file or directory was deleted. | +| C | A file or directory was changed. | + +## OPTIONS + +#### **--format** + +Alter the output into a different format. The only valid format for **podman diff** is `json`. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Show container-modified files versus the container's image: +``` +$ podman diff container1 +A /myscript.sh +``` + +Show container-modified files versus the container's image in JSON format: +``` +$ podman diff --format json myimage +{ + "changed": [ + "/usr", + "/usr/local", + "/usr/local/bin" + ], + "added": [ + "/usr/local/bin/docker-entrypoint.sh" + ] +} +``` + +Show the difference between the specified container and the image: +``` +$ podman diff container1 image1 +A /test +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container-diff(1)](podman-container-diff.1.md)**, **[podman-image-diff(1)](podman-image-diff.1.md)** + +## HISTORY +August 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-events.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-events.1.md new file mode 100644 index 000000000..caaac362f --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-events.1.md @@ -0,0 +1,222 @@ +--- +title: podman-events +version: v5.4.2 +--- + +% podman-events 1 + +## NAME +podman\-events - Monitor Podman events + +## SYNOPSIS +**podman events** [*options*] + +**podman system events** [*options*] + +## DESCRIPTION + +Monitor and print events that occur in Podman. Each event includes a timestamp, +a type, a status, name (if applicable), and image (if applicable). The default logging +mechanism is *journald*. This can be changed in containers.conf by changing the `events_logger` +value to `file`. Only `file` and `journald` are accepted. A `none` logger is also +available, but this logging mechanism completely disables events; nothing is reported by +`podman events`. + +By default, streaming mode is used, printing new events as they occur. Previous events can be listed via `--since` and `--until`. + +The *container* event type reports the follow statuses: + * attach + * checkpoint + * cleanup + * commit + * connect + * create + * died + * disconnect + * exec + * exec_died + * exited + * export + * import + * init + * kill + * mount + * pause + * prune + * remove + * rename + * restart + * restore + * start + * stop + * sync + * unmount + * unpause + * update + +The *pod* event type reports the follow statuses: + * create + * kill + * pause + * remove + * start + * stop + * unpause + +The *image* event type reports the following statuses: + * loadFromArchive, + * mount + * pull + * pull-error + * push + * remove + * save + * tag + * unmount + * untag + +The *system* type reports the following statuses: + * refresh + * renumber + +The *volume* type reports the following statuses: + * create + * prune + * remove + +#### Verbose Create Events + +Setting `events_container_create_inspect_data=true` in containers.conf(5) instructs Podman to create more verbose container-create events which include a JSON payload with detailed information about the containers. The JSON payload is identical to the one of podman-container-inspect(1). The associated field in journald is named `PODMAN_CONTAINER_INSPECT_DATA`. + +## OPTIONS + +#### **--filter**, **-f**=*filter* + +Filter events that are displayed. They must be in the format of "filter=value". The following +filters are supported: + +| **Filter** | **Description** | +|------------|-------------------------------------| +| container | [Name or ID] Container's name or ID | +| event | event_status (described above) | +| image | [Name or ID] Image name or ID | +| label | [key=value] label | +| pod | [Name or ID] Pod name or ID | +| volume | [Name or ID] Volume name or ID | +| type | Event_type (described above) | + +In the case where an ID is used, the ID may be in its full or shortened form. The "die" event is mapped to "died" for Docker compatibility. + +#### **--format** + +Format the output to JSON Lines or using the given Go template. + +| **Placeholder** | **Description** | +| --------------------- | -------------------------------------------------------------------- | +| .Attributes ... | created_at, _by, labels, and more (map[]) | +| .ContainerExitCode | Exit code (int) | +| .ContainerInspectData | Payload of the container's inspect | +| .Error | Error message in case the event status is an error (e.g. pull-error) | +| .HealthStatus | Health Status (string) | +| .ID | Container ID (full 64-bit SHA) | +| .Image | Name of image being run (string) | +| .Name | Container name (string) | +| .Network | Name of network being used (string) | +| .PodID | ID of pod associated with container, if any | +| .Status | Event status (e.g., create, start, died, ...) | +| .Time | Event timestamp (string) | +| .TimeNano | Event timestamp with nanosecond precision (int64) | +| .Type | Event type (e.g., image, container, pod, ...) | + +#### **--help** + +Print usage statement. + +#### **--no-trunc** + +Do not truncate the output (default *true*). + +#### **--since**=*timestamp* + +Show all events created since the given timestamp + +#### **--stream** + +Stream events and do not exit after reading the last known event (default *true*). + +#### **--until**=*timestamp* + +Show all events created until the given timestamp + +The *since* and *until* values can be RFC3339Nano time stamps or a Go duration string such as 10m, 5h. If no +*since* or *until* values are provided, only new events are shown. + +## JOURNALD IDENTIFIERS + +The journald events-backend of Podman uses the following journald identifiers. You can use the identifiers to filter Podman events directly with `journalctl`. + +| **Identifier** | **Description** | +|-------------------------------|---------------------------------------------------------| +| SYSLOG_IDENTIFIER | Always set to "podman" | +| PODMAN_EVENT | The event status as described above | +| PODMAN_TYPE | The event type as described above | +| PODMAN_TIME | The time stamp when the event was written | +| PODMAN_NAME | Name of the event object (e.g., container, image) | +| PODMAN_ID | ID of the event object (e.g., container, image) | +| PODMAN_EXIT_CODE | Exit code of the container | +| PODMAN_POD_ID | Pod ID of the container | +| PODMAN_LABELS | Labels of the container | +| PODMAN_HEALTH_STATUS | Health status of the container | +| PODMAN_CONTAINER_INSPECT_DATA | The JSON payload of `podman-inspect` as described above | +| PODMAN_NETWORK_NAME | The name of the network | + +## EXAMPLES + +Show Podman events: +``` +$ podman events +2019-03-02 10:33:42.312377447 -0600 CST container create 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +2019-03-02 10:33:46.958768077 -0600 CST container init 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +2019-03-02 10:33:46.973661968 -0600 CST container start 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +2019-03-02 10:33:50.833761479 -0600 CST container stop 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +2019-03-02 10:33:51.047104966 -0600 CST container cleanup 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +``` + +Show only Podman container create events: +``` +$ podman events -f event=create +2019-03-02 10:36:01.375685062 -0600 CST container create 20dc581f6fbf (image=docker.io/library/alpine:latest, name=sharp_morse) +2019-03-02 10:36:08.561188337 -0600 CST container create 58e7e002344c (image=registry.k8s.io/pause:3.1, name=3e701f270d54-infra) +2019-03-02 10:36:13.146899437 -0600 CST volume create cad6dc50e087 (image=, name=cad6dc50e0879568e7d656bd004bd343d6035e7fc4024e1711506fe2fd459e6f) +2019-03-02 10:36:29.978806894 -0600 CST container create d81e30f1310f (image=docker.io/library/busybox:latest, name=musing_newton) +``` + +Show only Podman pod create events: +``` +$ podman events --filter event=create --filter type=pod +2019-03-02 10:44:29.601746633 -0600 CST pod create 1df5ebca7b44 (image=, name=confident_hawking) +2019-03-02 10:44:42.374637304 -0600 CST pod create ca731231718e (image=, name=webapp) +2019-03-02 10:44:47.486759133 -0600 CST pod create 71e807fc3a8e (image=, name=reverent_swanson) +``` + +Show only Podman events created in the last five minutes: +``` +$ sudo podman events --since 5m +2019-03-02 10:44:29.598835409 -0600 CST container create b629d10d3831 (image=registry.k8s.io/pause:3.1, name=1df5ebca7b44-infra) +2019-03-02 10:44:29.601746633 -0600 CST pod create 1df5ebca7b44 (image=, name=confident_hawking) +2019-03-02 10:44:42.371100253 -0600 CST container create 170a0f457d00 (image=registry.k8s.io/pause:3.1, name=ca731231718e-infra) +2019-03-02 10:44:42.374637304 -0600 CST pod create ca731231718e (image=, name=webapp) +``` + +Show Podman events in JSON Lines format: +``` +$ podman events --format json +{"ID":"683b0909d556a9c02fa8cd2b61c3531a965db42158627622d1a67b391964d519","Image":"localhost/myshdemo:latest","Name":"agitated_diffie","Status":"cleanup","Time":"2019-04-27T22:47:00.849932843-04:00","Type":"container"} +{"ID":"a0f8ab051bfd43f9c5141a8a2502139707e4b38d98ac0872e57c5315381e88ad","Image":"docker.io/library/alpine:latest","Name":"friendly_tereshkova","Status":"unmount","Time":"2019-04-28T13:43:38.063017276-04:00","Type":"container"} +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +## HISTORY +March 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-exec.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-exec.1.md new file mode 100644 index 000000000..b181c5155 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-exec.1.md @@ -0,0 +1,208 @@ +--- +title: podman-exec +version: v5.4.2 +--- + +% podman-exec 1 + +## NAME +podman\-exec - Execute a command in a running container + +## SYNOPSIS +**podman exec** [*options*] *container* *command* [*arg* ...] + +**podman container exec** [*options*] *container* *command* [*arg* ...] + +## DESCRIPTION +**podman exec** executes a command in a running container. + +## OPTIONS + +#### **--detach**, **-d** + +Start the exec session, but do not attach to it. The command runs in the background, and the exec session is automatically removed when it completes. The **podman exec** command prints the ID of the exec session and exits immediately after it starts. + + +[//]: # (BEGIN included file options/detach-keys.md) +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. + +[//]: # (END included file options/detach-keys.md) + + +[//]: # (BEGIN included file options/env.md) +#### **--env**, **-e**=*env* + +Set environment variables. + +This option allows arbitrary environment variables that are available for the process to be launched inside of the container. If an environment variable is specified without a value, Podman checks the host environment for a value and set the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the container. + +[//]: # (END included file options/env.md) + + +[//]: # (BEGIN included file options/env-file.md) +#### **--env-file**=*file* + +Read in a line-delimited file of environment variables. + +[//]: # (END included file options/env-file.md) + + +[//]: # (BEGIN included file options/interactive.md) +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. + +[//]: # (END included file options/interactive.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/preserve-fd.md) +#### **--preserve-fd**=*FD1[,FD2,...]* + +Pass down to the process the additional file descriptors specified in the comma separated list. It can be specified multiple times. +This option is only supported with the crun OCI runtime. It might be a security risk to use this option with other OCI runtimes. + +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/preserve-fd.md) + + +[//]: # (BEGIN included file options/preserve-fds.md) +#### **--preserve-fds**=*N* + +Pass down to the process N additional file descriptors (in addition to 0, 1, 2). +The total FDs are 3+N. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/preserve-fds.md) + + +[//]: # (BEGIN included file options/privileged.md) +#### **--privileged** + +Give extended privileges to this container. The default is **false**. + +By default, Podman containers are unprivileged (**=false**) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read-only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. +Due to the disabled security features, the privileged field should almost never +be set as containers can easily break out of confinement. + +Containers running in a user namespace (e.g., rootless containers) cannot have +more privileges than the user that launched them. + +[//]: # (END included file options/privileged.md) + + +[//]: # (BEGIN included file options/tty.md) +#### **--tty**, **-t** + +Allocate a pseudo-TTY. The default is **false**. + +When set to **true**, Podman allocates a pseudo-tty and attach to the standard +input of the container. This can be used, for example, to run a throwaway +interactive shell. + +**NOTE**: The --tty flag prevents redirection of standard output. It combines STDOUT and STDERR, it can insert control characters, and it can hang pipes. This option is only used when run interactively in a terminal. When feeding input to Podman, use -i only, not -it. + +[//]: # (END included file options/tty.md) + + +[//]: # (BEGIN included file options/user.md) +#### **--user**, **-u**=*user[:group]* + +Sets the username or UID used and, optionally, the groupname or GID for the specified command. Both *user* and *group* may be symbolic or numeric. + +Without this argument, the command runs as the user specified in the container image. Unless overridden by a `USER` command in the Containerfile or by a value passed to this option, this user generally defaults to root. + +When a user namespace is not in use, the UID and GID used within the container and on the host match. When user namespaces are in use, however, the UID and GID in the container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container by default corresponds to the UID and GID of the user invoking Podman. + +[//]: # (END included file options/user.md) + + +[//]: # (BEGIN included file options/workdir.md) +#### **--workdir**, **-w**=*dir* + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (**/**). +The image developer can set a different default with the WORKDIR instruction. The operator +can override the working directory by using the **-w** option. + +[//]: # (END included file options/workdir.md) + +## Exit Status + +The exit code from `podman exec` gives information about why the command within the container failed to run or why it exited. When `podman exec` exits with a +non-zero code, the exit codes follow the `chroot` standard, see below: + + **125** The error is with Podman itself + + $ podman exec --foo ctrID /bin/sh; echo $? + Error: unknown flag: --foo + 125 + + **126** The _contained command_ cannot be invoked + + $ podman exec ctrID /etc; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error + 126 + + **127** The _contained command_ cannot be found + + $ podman exec ctrID foo; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error + 127 + + **Exit code** The _contained command_ exit code + + $ podman exec ctrID /bin/sh -c 'exit 3'; echo $? + 3 + +## EXAMPLES + +Execute command in selected container with a stdin and a tty allocated: +``` +$ podman exec -it ctrID ls +``` + +Execute command with the overridden working directory in selected container with a stdin and a tty allocated: +``` +$ podman exec -it -w /tmp myCtr pwd +``` + +Execute command as the specified user in selected container: +``` +$ podman exec --user root ctrID ls +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)** + +## HISTORY +December 2017, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-export.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-export.1.md new file mode 100644 index 000000000..fa286c49a --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-export.1.md @@ -0,0 +1,56 @@ +--- +title: podman-export +version: v5.4.2 +--- + +% podman-export 1 + +## NAME +podman\-export - Export a container's filesystem contents as a tar archive + +## SYNOPSIS +**podman export** [*options*] *container* + +**podman container export** [*options*] *container* + +## DESCRIPTION +**podman export** exports the filesystem of a container and saves it as a tarball +on the local machine. **podman export** writes to STDOUT by default and can be +redirected to a file using the `--output` flag. +The image of the container exported by **podman export** can be imported by **podman import**. +To export image(s) with parent layers, use **podman save**. +Note: `:` is a restricted character and cannot be part of the file name. + +**podman [GLOBAL OPTIONS]** + +**podman export [GLOBAL OPTIONS]** + +**podman export [OPTIONS] CONTAINER** + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--output**, **-o** + +Write to a file, default is STDOUT + +## EXAMPLES + +Export container into specified tar ball: +``` +$ podman export -o redis-container.tar 883504668ec465463bc0fe7e63d53154ac3b696ea8d7b233748918664ea90e57 +``` + +Export container to stdout: +``` +$ podman export 883504668ec465463bc0fe7e63d53154ac3b696ea8d7b233748918664ea90e57 > redis-container.tar +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-import(1)](podman-import.1.md)** + +## HISTORY +August 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-farm-build.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-farm-build.1.md new file mode 100644 index 000000000..a57e5b061 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-farm-build.1.md @@ -0,0 +1,1564 @@ +--- +title: podman-farm-build +version: v5.4.2 +--- + +% podman-farm-build 1 + +## NAME +podman\-farm\-build - Build images on farm nodes, then bundle them into a manifest list + +## SYNOPSIS +**podman farm build** [*options*] [*context*] + +## DESCRIPTION +**podman farm build** Builds an image on all nodes in a farm and bundles them up into a manifest list. +It executes the `podman build` command on the nodes in the farm with the given Containerfile. Once the +images are built on all the farm nodes, the images will be pushed to the registry given via the **--tag** +flag. Once all the images have been pushed, a manifest list will be created locally and pushed to the registry +as well. + +The manifest list will contain an image per native architecture type that is present in the farm. + +The primary function of this command is to create multi-architecture builds that will be faster than doing it +via emulation using `podman build --arch --platform`. + +If no farm is specified, the build will be sent out to all the nodes that `podman system connection` knows of. + +Note: Since the images built are directly pushed to a registry, the user must pass in a full image name using the +**--tag** option in the format _registry_**/**_repository_**/**_imageName_[**:**_tag_]`. + +## OPTIONS + + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the container's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + + +[//]: # (BEGIN included file options/annotation.image.md) +#### **--annotation**=*annotation=value* + +Add an image *annotation* (e.g. annotation=*value*) to the image metadata. Can +be used multiple times. + +Note: this information is not present in Docker image formats, so it is +discarded when writing images in Docker formats. + +[//]: # (END included file options/annotation.image.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/build-arg.md) +#### **--build-arg**=*arg=value* + +Specifies a build argument and its value, which is interpolated in +instructions read from the Containerfiles in the same way that environment variables are, but which are not added to environment variable list in the resulting image's configuration. + +[//]: # (END included file options/build-arg.md) + + +[//]: # (BEGIN included file options/build-arg-file.md) +#### **--build-arg-file**=*path* + +Specifies a file containing lines of build arguments of the form `arg=value`. +The suggested file name is `argfile.conf`. + +Comment lines beginning with `#` are ignored, along with blank lines. +All others must be of the `arg=value` format passed to `--build-arg`. + +If several arguments are provided via the `--build-arg-file` +and `--build-arg` options, the build arguments are merged across all +of the provided files and command line arguments. + +Any file provided in a `--build-arg-file` option is read before +the arguments supplied via the `--build-arg` option. + +When a given argument name is specified several times, the last instance +is the one that is passed to the resulting builds. This means `--build-arg` +values always override those in a `--build-arg-file`. + +[//]: # (END included file options/build-arg-file.md) + + +[//]: # (BEGIN included file options/build-context.md) +#### **--build-context**=*name=value* + +Specify an additional build context using its short name and its location. +Additional build contexts can be referenced in the same manner as we access +different stages in COPY instruction. + +Valid values are: + +* Local directory – e.g. --build-context project2=../path/to/project2/src (This option is not available with the remote Podman client. On Podman machine setup (i.e macOS and Windows) path must exists on the machine VM) +* HTTP URL to a tarball – e.g. --build-context src=https://example.org/releases/src.tar +* Container image – specified with a container-image:// prefix, e.g. --build-context alpine=container-image://alpine:3.15, (also accepts docker://, docker-image://) + +On the Containerfile side, reference the build context on all +commands that accept the “from” parameter. Here’s how that might look: + +```dockerfile +FROM [name] +COPY --from=[name] ... +RUN --mount=from=[name] … +``` + +The value of [name] is matched with the following priority order: + +* Named build context defined with --build-context [name]=.. +* Stage defined with AS [name] inside Containerfile +* Image [name], either local or in a remote registry + +[//]: # (END included file options/build-context.md) + + +[//]: # (BEGIN included file options/cache-from.md) +#### **--cache-from**=*image* + +Repository to utilize as a potential cache source. When specified, Buildah tries to look for +cache images in the specified repository and attempts to pull cache images instead of actually +executing the build steps locally. Buildah only attempts to pull previously cached images if they +are considered as valid cache hits. + +Use the `--cache-to` option to populate a remote repository with cache content. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-from` option is ignored unless `--layers` is specified. + +[//]: # (END included file options/cache-from.md) + + +[//]: # (BEGIN included file options/cache-to.md) +#### **--cache-to**=*image* + +Set this flag to specify a remote repository that is used to store cache images. Buildah attempts to +push newly built cache image to the remote repository. + +Note: Use the `--cache-from` option in order to use cache content in a remote repository. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-to` option is ignored unless `--layers` is specified. + +[//]: # (END included file options/cache-to.md) + + +[//]: # (BEGIN included file options/cache-ttl.md) +#### **--cache-ttl** + +Limit the use of cached images to only consider images with created timestamps less than *duration* ago. +For example if `--cache-ttl=1h` is specified, Buildah considers intermediate cache images which are created +under the duration of one hour, and intermediate cache images outside this duration is ignored. + +Note: Setting `--cache-ttl=0` manually is equivalent to using `--no-cache` in the +implementation since this means that the user does not want to use cache at all. + +[//]: # (END included file options/cache-ttl.md) + + +[//]: # (BEGIN included file options/cap-add.image.md) +#### **--cap-add**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability added to its capability set. +Certain capabilities are granted by default; this option can be used to add +more. + +[//]: # (END included file options/cap-add.image.md) + + +[//]: # (BEGIN included file options/cap-drop.image.md) +#### **--cap-drop**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability removed from its capability set. +The CAP\_CHOWN, CAP\_DAC\_OVERRIDE, CAP\_FOWNER, +CAP\_FSETID, CAP\_KILL, CAP\_NET\_BIND\_SERVICE, CAP\_SETFCAP, +CAP\_SETGID, CAP\_SETPCAP, and CAP\_SETUID capabilities are +granted by default; this option can be used to remove them. + +If a capability is specified to both the **--cap-add** and **--cap-drop** +options, it is dropped, regardless of the order in which the options were +given. + +[//]: # (END included file options/cap-drop.image.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the container is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cgroupns.image.md) +#### **--cgroupns**=*how* + +Sets the configuration for cgroup namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "private" to indicate +that a new cgroup namespace is created, or it can be "host" to indicate +that the cgroup namespace in which `buildah` itself is being run is reused. + +[//]: # (END included file options/cgroupns.image.md) + +#### **--cleanup** + +Remove built images from farm nodes on success (Default: false). + + +[//]: # (BEGIN included file options/compat-volumes.md) +#### **--compat-volumes** + +Handle directories marked using the VOLUME instruction (both in this build, and +those inherited from base images) such that their contents can only be modified +by ADD and COPY instructions. Any changes made in those locations by RUN +instructions will be reverted. Before the introduction of this option, this +behavior was the default, but it is now disabled by default. + +[//]: # (END included file options/compat-volumes.md) + + +[//]: # (BEGIN included file options/cpp-flag.md) +#### **--cpp-flag**=*flags* + +Set additional flags to pass to the C Preprocessor cpp(1). Containerfiles ending with a ".in" suffix is preprocessed via cpp(1). This option can be used to pass additional flags to cpp.Note: You can also set default CPPFLAGS by setting the BUILDAH_CPPFLAGS environment variable (e.g., export BUILDAH_CPPFLAGS="-DDEBUG"). + +[//]: # (END included file options/cpp-flag.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the container. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The container only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: if the user only has access rights via a group, accessing the device +from inside a rootless container fails. The **[crun(1)](https://github.com/containers/crun/tree/main/crun.1.md)** runtime offers a +workaround for this by adding the option +**--annotation run.oci.keep_original_groups=1**. + + +[//]: # (BEGIN included file options/disable-compression.md) +#### **--disable-compression**, **-D** + +Don't compress filesystem layers when building the image unless it is required +by the location where the image is being written. This is the default setting, +because image layers are compressed automatically when they are pushed to +registries, and images being written to local storage only need to be +decompressed again to be stored. Compression can be forced in all cases by +specifying **--disable-compression=false**. + +[//]: # (END included file options/disable-compression.md) + + +[//]: # (BEGIN included file options/dns.md) +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. + +[//]: # (END included file options/dns.md) + +This option cannot be combined with **--network** that is set to **none**. + +Note: this option takes effect only during *RUN* instructions in the build. +It does not affect _/etc/resolv.conf_ in the final image. + + +[//]: # (BEGIN included file options/dns-option.image.md) +#### **--dns-option**=*option* + +Set custom DNS options to be used during the build. + +[//]: # (END included file options/dns-option.image.md) + + +[//]: # (BEGIN included file options/dns-search.image.md) +#### **--dns-search**=*domain* + +Set custom DNS search domains to be used during the build. + +[//]: # (END included file options/dns-search.image.md) + + +[//]: # (BEGIN included file options/env.image.md) +#### **--env**=*env[=value]* + +Add a value (e.g. env=*value*) to the built image. Can be used multiple times. +If neither `=` nor a *value* are specified, but *env* is set in the current +environment, the value from the current environment is added to the image. +To remove an environment variable from the built image, use the `--unsetenv` +option. + +[//]: # (END included file options/env.image.md) + + +[//]: # (BEGIN included file options/farm.md) +#### **--farm** + +This option specifies the name of the farm to be used in the build process. + +[//]: # (END included file options/farm.md) + +This option specifies the name of the farm to be used in the build process. + + +[//]: # (BEGIN included file options/file.md) +#### **--file**, **-f**=*Containerfile* + +Specifies a Containerfile which contains instructions for building the image, +either a local file or an **http** or **https** URL. If more than one +Containerfile is specified, *FROM* instructions are only be accepted from the +last specified file. + +If a build context is not specified, and at least one Containerfile is a +local file, the directory in which it resides is used as the build +context. + +Specifying the option `-f -` causes the Containerfile contents to be read from stdin. + +[//]: # (END included file options/file.md) + + +[//]: # (BEGIN included file options/force-rm.md) +#### **--force-rm** + +Always remove intermediate containers after a build, even if the build fails (default true). + +[//]: # (END included file options/force-rm.md) + + +[//]: # (BEGIN included file options/format.md) +#### **--format** + +Control the format for the built image's manifest and configuration data. +Recognized formats include *oci* (OCI image-spec v1.0, the default) and +*docker* (version 2, using schema format 2 for the manifest). + +Note: You can also override the default format by setting the BUILDAH\_FORMAT +environment variable. `export BUILDAH_FORMAT=docker` + +[//]: # (END included file options/format.md) + + +[//]: # (BEGIN included file options/from.md) +#### **--from** + +Overrides the first `FROM` instruction within the Containerfile. If there are multiple +FROM instructions in a Containerfile, only the first is changed. + +With the remote podman client, not all container transports work as +expected. For example, oci-archive:/x.tar references /x.tar on the remote +machine instead of on the client. When using podman remote clients it is +best to restrict use to *containers-storage*, and *docker:// transports*. + +[//]: # (END included file options/from.md) + + +[//]: # (BEGIN included file options/group-add.md) +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/group-add.md) + + +[//]: # (BEGIN included file options/help.md) +#### **--help**, **-h** + +Print usage statement + +[//]: # (END included file options/help.md) + + +[//]: # (BEGIN included file options/hooks-dir.md) +#### **--hooks-dir**=*path* + +Each *.json file in the path configures a hook for buildah build containers. For more details on the syntax of the JSON files and the semantics of hook injection. Buildah currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. + +This option may be set multiple times; paths from later options have higher precedence. + +For the annotation conditions, buildah uses any annotations set in the generated OCI configuration. + +For the bind-mount conditions, only mounts explicitly requested by the caller via --volume are considered. Bind mounts that buildah inserts by default (e.g. /dev/shm) are not considered. + +If --hooks-dir is unset for root callers, Buildah currently defaults to /usr/share/containers/oci/hooks.d and /etc/containers/oci/hooks.d in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting --hooks-dir. + +[//]: # (END included file options/hooks-dir.md) + + +[//]: # (BEGIN included file options/http-proxy.md) +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. + +[//]: # (END included file options/http-proxy.md) + + +[//]: # (BEGIN included file options/identity-label.md) +#### **--identity-label** + +Adds default identity label `io.buildah.version` if set. (default true). + +[//]: # (END included file options/identity-label.md) + + +[//]: # (BEGIN included file options/ignorefile.md) +#### **--ignorefile** + +Path to an alternative .containerignore file. + +[//]: # (END included file options/ignorefile.md) + + +[//]: # (BEGIN included file options/iidfile.md) +#### **--iidfile**=*ImageIDfile* + +Write the built image's ID to the file. When `--platform` is specified more than once, attempting to use this option triggers an error. + +[//]: # (END included file options/iidfile.md) + + +[//]: # (BEGIN included file options/ipc.image.md) +#### **--ipc**=*how* + +Sets the configuration for IPC namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate +that a new IPC namespace is created, or it can be "host" to indicate +that the IPC namespace in which `podman` itself is being run is reused, +or it can be the path to an IPC namespace which is already in use by +another process. + +[//]: # (END included file options/ipc.image.md) + + +[//]: # (BEGIN included file options/isolation.md) +#### **--isolation**=*type* + +Controls what type of isolation is used for running processes as part of `RUN` +instructions. Recognized types include *oci* (OCI-compatible runtime, the +default), *rootless* (OCI-compatible runtime invoked using a modified +configuration and its --rootless option enabled, with *--no-new-keyring +--no-pivot* added to its *create* invocation, with network and UTS namespaces +disabled, and IPC, PID, and user namespaces enabled; the default for +unprivileged users), and *chroot* (an internal wrapper that leans more toward +chroot(1) than container technology). + +Note: You can also override the default isolation type by setting the +BUILDAH\_ISOLATION environment variable. `export BUILDAH_ISOLATION=oci` + +[//]: # (END included file options/isolation.md) + + +[//]: # (BEGIN included file options/jobs.md) +#### **--jobs**=*number* + +Run up to N concurrent stages in parallel. If the number of jobs is greater +than 1, stdin is read from /dev/null. If 0 is specified, then there is +no limit in the number of jobs that run in parallel. + +[//]: # (END included file options/jobs.md) + + +[//]: # (BEGIN included file options/label.image.md) +#### **--label**=*label* + +Add an image *label* (e.g. label=*value*) to the image metadata. Can be used +multiple times. + +Users can set a special LABEL **io.containers.capabilities=CAP1,CAP2,CAP3** in +a Containerfile that specifies the list of Linux capabilities required for the +container to run properly. This label specified in a container image tells +Podman to run the container with just these capabilities. Podman launches the +container with just the specified capabilities, as long as this list of +capabilities is a subset of the default list. + +If the specified capabilities are not in the default set, Podman prints an error +message and runs the container with the default capabilities. + +[//]: # (END included file options/label.image.md) + + +[//]: # (BEGIN included file options/layer-label.md) +#### **--layer-label**=*label[=value]* + +Add an intermediate image *label* (e.g. label=*value*) to the intermediate +image metadata. It can be used multiple times. + +If *label* is named, but neither `=` nor a `value` is provided, then +the *label* is set to an empty value. + +[//]: # (END included file options/layer-label.md) + + +[//]: # (BEGIN included file options/layers.md) +#### **--layers** + +Cache intermediate images during the build process (Default is `true`). + +Note: You can also override the default value of layers by setting the +BUILDAH\_LAYERS environment variable. `export BUILDAH_LAYERS=true` + +[//]: # (END included file options/layers.md) + +#### **--local**, **-l** + +Build image on local machine as well as on farm nodes. + + +[//]: # (BEGIN included file options/logfile.md) +#### **--logfile**=*filename* + +Log output which is sent to standard output and standard error to the +specified file instead of to standard output and standard error. +This option is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. + +[//]: # (END included file options/logfile.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/network.image.md) +#### **--network**=*mode*, **--net** + +Sets the configuration for network namespaces when handling `RUN` instructions. + +Valid _mode_ values are: + +- **none**: no networking. +- **host**: use the Podman host network stack. Note: the host mode gives the +container full access to local system services such as D-bus and is therefore +considered insecure. +- **ns:**_path_: path to a network namespace to join. +- **private**: create a new namespace for the container (default) +- **\**: Join the network with the given name or ID, e.g. use `--network mynet` to join the network with the name mynet. Only supported for rootful users. +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=MTU**: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=CIDR**: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=INTERFACE**: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=IPv4**: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=INTERFACE**: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=IPv6**: Specify the outbound ipv6 address slirp binds to. +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.image.md) + + +[//]: # (BEGIN included file options/no-cache.md) +#### **--no-cache** + +Do not use existing cached images for the container build. Build from the start with a new set of cached layers. + +[//]: # (END included file options/no-cache.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the container. + +Podman assumes control over the container's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/omit-history.md) +#### **--omit-history** + +Omit build history information in the built image. (default false). + +This option is useful for the cases where end users explicitly +want to set `--omit-history` to omit the optional `History` from +built images or when working with images built using build tools that +do not include `History` information in their images. + +[//]: # (END included file options/omit-history.md) + + +[//]: # (BEGIN included file options/os-feature.md) +#### **--os-feature**=*feature* + +Set the name of a required operating system *feature* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS feature list is kept, if the base image specified any. This option is typically only meaningful when the image's OS is Windows. + +If *feature* has a trailing `-`, then the *feature* is removed from the set of required features which is listed in the image. + +[//]: # (END included file options/os-feature.md) + + +[//]: # (BEGIN included file options/os-version.image.md) +#### **--os-version**=*version* + +Set the exact required operating system *version* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS version is kept, if the base image specified one. This option is typically only meaningful when the image's OS is Windows, and is typically set in Windows base images, so using this option is usually unnecessary. + +[//]: # (END included file options/os-version.image.md) + + +[//]: # (BEGIN included file options/pid.image.md) +#### **--pid**=*pid* + +Sets the configuration for PID namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new PID namespace is created, or it can be "host" to indicate that the PID namespace in which `podman` itself is being run is reused, or it can be the path to a PID namespace which is already in use by another +process. + +[//]: # (END included file options/pid.image.md) + +#### **--platforms**=*p1,p2,p3...* + +Build only on farm nodes that match the given platforms. + + +[//]: # (BEGIN included file options/pull.image.md) +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Only pull the image when it does not exist in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error when no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. + +[//]: # (END included file options/pull.image.md) + + +[//]: # (BEGIN included file options/quiet.md) +#### **--quiet**, **-q** + +Suppress output messages which indicate which instruction is being processed, and of progress when pulling images from a registry, and when writing the output image. + +[//]: # (END included file options/quiet.md) + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + + +[//]: # (BEGIN included file options/rm.md) +#### **--rm** + +Remove intermediate containers after a successful build (default true). + +[//]: # (END included file options/rm.md) + + +[//]: # (BEGIN included file options/runtime.md) +#### **--runtime**=*path* + +The *path* to an alternate OCI-compatible runtime, which is used to run +commands specified by the **RUN** instruction. + +Note: You can also override the default runtime by setting the BUILDAH\_RUNTIME environment variable. `export BUILDAH_RUNTIME=/usr/local/bin/runc` + +[//]: # (END included file options/runtime.md) + + +[//]: # (BEGIN included file options/runtime-flag.md) +#### **--runtime-flag**=*flag* + +Adds global flags for the container runtime. To list the supported flags, please consult the manpages of the selected container runtime. + +Note: Do not pass the leading -- to the flag. To pass the runc flag --log-format json to buildah build, the option given is --runtime-flag log-format=json. + +[//]: # (END included file options/runtime-flag.md) + + +[//]: # (BEGIN included file options/sbom.md) +#### **--sbom**=*preset* + +Generate SBOMs (Software Bills Of Materials) for the output image by scanning +the working container and build contexts using the named combination of scanner +image, scanner commands, and merge strategy. Must be specified with one or +more of **--sbom-image-output**, **--sbom-image-purl-output**, **--sbom-output**, +and **--sbom-purl-output**. Recognized presets, and the set of options which +they equate to: + + - "syft", "syft-cyclonedx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output cyclonedx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output cyclonedx-json={OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "syft-spdx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output spdx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output spdx-json={OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + - "trivy", "trivy-cyclonedx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "trivy-spdx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + +[//]: # (END included file options/sbom.md) + + +[//]: # (BEGIN included file options/sbom-image-output.md) +#### **--sbom-image-output**=*path* + +When generating SBOMs, store the generated SBOM in the specified path in the +output image. There is no default. + +[//]: # (END included file options/sbom-image-output.md) + + +[//]: # (BEGIN included file options/sbom-image-purl-output.md) +#### **--sbom-image-purl-output**=*path* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the specified path in the output +image. There is no default. + +[//]: # (END included file options/sbom-image-purl-output.md) + + +[//]: # (BEGIN included file options/sbom-merge-strategy.md) +#### **--sbom-merge-strategy**=*method* + +If more than one **--sbom-scanner-command** value is being used, use the +specified method to merge the output from later commands with output from +earlier commands. Recognized values include: + + - cat + Concatenate the files. + - merge-cyclonedx-by-component-name-and-version + Merge the "component" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "version" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + - merge-spdx-by-package-name-and-versioninfo + Merge the "package" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "versionInfo" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + +[//]: # (END included file options/sbom-merge-strategy.md) + + +[//]: # (BEGIN included file options/sbom-output.md) +#### **--sbom-output**=*file* + +When generating SBOMs, store the generated SBOM in the named file on the local +filesystem. There is no default. + +[//]: # (END included file options/sbom-output.md) + + +[//]: # (BEGIN included file options/sbom-purl-output.md) +#### **--sbom-purl-output**=*file* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the named file in the local +filesystem. There is no default. + +[//]: # (END included file options/sbom-purl-output.md) + + +[//]: # (BEGIN included file options/sbom-scanner-command.md) +#### **--sbom-scanner-command**=*image* + +Generate SBOMs by running the specified command from the scanner image. If +multiple commands are specified, they are run in the order in which they are +specified. These text substitutions are performed: + - {ROOTFS} + The root of the built image's filesystem, bind mounted. + - {CONTEXT} + The build context and additional build contexts, bind mounted. + - {OUTPUT} + The name of a temporary output file, to be read and merged with others or copied elsewhere. + +[//]: # (END included file options/sbom-scanner-command.md) + + +[//]: # (BEGIN included file options/sbom-scanner-image.md) +#### **--sbom-scanner-image**=*image* + +Generate SBOMs using the specified scanner image. + +[//]: # (END included file options/sbom-scanner-image.md) + + +[//]: # (BEGIN included file options/secret.image.md) +#### **--secret**=**id=id[,src=*envOrFile*][,env=*ENV*][,type=*file* | *env*]** + +Pass secret information to be used in the Containerfile for building images +in a safe way that will not end up stored in the final image, or be seen in other stages. +The value of the secret will be read from an environment variable or file named +by the "id" option, or named by the "src" option if it is specified, or from an +environment variable specified by the "env" option. See [EXAMPLES](#examples). +The secret will be mounted in the container at `/run/secrets/id` by default. + +To later use the secret, use the --mount flag in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret` + +The location of the secret in the container can be overridden using the +"target", "dst", or "destination" option of the `RUN --mount` flag. + +`RUN --mount=type=secret,id=mysecret,target=/run/secrets/myothersecret cat /run/secrets/myothersecret` + +Note: changing the contents of secret files will not trigger a rebuild of layers that use said secrets. + +[//]: # (END included file options/secret.image.md) + + +[//]: # (BEGIN included file options/security-opt.image.md) +#### **--security-opt**=*option* + +Security Options + +- `apparmor=unconfined` : Turn off apparmor confinement for the container +- `apparmor=alternate-profile` : Set the apparmor confinement profile for the +container + +- `label=user:USER` : Set the label user for the container processes +- `label=role:ROLE` : Set the label role for the container processes +- `label=type:TYPE` : Set the label process type for the container processes +- `label=level:LEVEL` : Set the label level for the container processes +- `label=filetype\:TYPE` : Set the label file type for the container files +- `label=disable` : Turn off label separation for the container +- `no-new-privileges` : Not supported + +- `seccomp=unconfined` : Turn off seccomp confinement for the container +- `seccomp=profile.json` : JSON file to be used as the seccomp filter for the container. + +[//]: # (END included file options/security-opt.image.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the container. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/skip-unused-stages.md) +#### **--skip-unused-stages** + +Skip stages in multi-stage builds which don't affect the target stage. (Default: **true**). + +[//]: # (END included file options/skip-unused-stages.md) + + +[//]: # (BEGIN included file options/squash.md) +#### **--squash** + +Squash all of the image's new layers into a single new layer; any preexisting layers are not squashed. + +[//]: # (END included file options/squash.md) + + +[//]: # (BEGIN included file options/squash-all.md) +#### **--squash-all** + +Squash all of the new image's layers (including those inherited from a base image) into a single new layer. + +[//]: # (END included file options/squash-all.md) + + +[//]: # (BEGIN included file options/ssh.md) +#### **--ssh**=*default* | *id[=socket>* + +SSH agent socket or keys to expose to the build. +The socket path can be left empty to use the value of `default=$SSH_AUTH_SOCK` + +To later use the ssh agent, use the --mount option in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=ssh,id=id mycmd` + +[//]: # (END included file options/ssh.md) + + +[//]: # (BEGIN included file options/tag.md) +#### **--tag**, **-t**=*imageName* + +Specifies the name which is assigned to the resulting image if the build process completes successfully. +If _imageName_ does not include a registry name, the registry name *localhost* is prepended to the image name. + +[//]: # (END included file options/tag.md) + + +[//]: # (BEGIN included file options/target.md) +#### **--target**=*stageName* + +Set the target build stage to build. When building a Containerfile with multiple build stages, --target can be used to specify an intermediate build stage by name as the final stage for the resulting image. Commands after the target stage is skipped. + +[//]: # (END included file options/target.md) + + +[//]: # (BEGIN included file options/timestamp.md) +#### **--timestamp**=*seconds* + +Set the create timestamp to seconds since epoch to allow for deterministic builds (defaults to current time). By default, the created timestamp is changed and written into the image manifest with every commit, causing the image's sha256 hash to be different even if the sources are exactly the same otherwise. +When --timestamp is set, the created timestamp is always set to the time specified and therefore not changed, allowing the image's sha256 hash to remain the same. All files committed to the layers of the image is created with the timestamp. + +If the only instruction in a Containerfile is `FROM`, this flag has no effect. + +[//]: # (END included file options/timestamp.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/ulimit.image.md) +#### **--ulimit**=*type=soft-limit[\:hard-limit]* + +Specifies resource limits to apply to processes launched when processing `RUN` instructions. This option can be specified multiple times. Recognized resource types include: + "core": maximum core dump size (ulimit -c) + "cpu": maximum CPU time (ulimit -t) + "data": maximum size of a process's data segment (ulimit -d) + "fsize": maximum size of new files (ulimit -f) + "locks": maximum number of file locks (ulimit -x) + "memlock": maximum amount of locked memory (ulimit -l) + "msgqueue": maximum amount of data in message queues (ulimit -q) + "nice": niceness adjustment (nice -n, ulimit -e) + "nofile": maximum number of open files (ulimit -n) + "nproc": maximum number of processes (ulimit -u) + "rss": maximum size of a process's (ulimit -m) + "rtprio": maximum real-time scheduling priority (ulimit -r) + "rttime": maximum amount of real-time execution between blocking syscalls + "sigpending": maximum number of pending signals (ulimit -i) + "stack": maximum stack size (ulimit -s) + +[//]: # (END included file options/ulimit.image.md) + + +[//]: # (BEGIN included file options/unsetenv.image.md) +#### **--unsetenv**=*env* + +Unset environment variables from the final image. + +[//]: # (END included file options/unsetenv.image.md) + + +[//]: # (BEGIN included file options/unsetlabel.md) +#### **--unsetlabel**=*label* + +Unset the image label, causing the label not to be inherited from the base image. + +[//]: # (END included file options/unsetlabel.md) + + +[//]: # (BEGIN included file options/userns.image.md) +#### **--userns**=*how* + +Sets the configuration for user namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new user namespace is created, it can be "host" to indicate that the user namespace in which `podman` itself is being run is reused, or it can be the path to a user namespace which is already in use by another process. + +[//]: # (END included file options/userns.image.md) + + +[//]: # (BEGIN included file options/userns-gid-map.md) +#### **--userns-gid-map**=*mapping* + +Directly specifies a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container GID, a corresponding starting host-level GID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-gids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-gid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-gid-map are specified, but --userns-uid-map is specified, the GID map is set to use the same numeric values as the UID map. + +[//]: # (END included file options/userns-gid-map.md) + + +[//]: # (BEGIN included file options/userns-gid-map-group.md) +#### **--userns-gid-map-group**=*group* + +Specifies that a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subgid` file which correspond to the specified group. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-uid-map-user is specified, but --userns-gid-map-group is not specified, `podman` assumes that the specified user name is also a +suitable group name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. + +[//]: # (END included file options/userns-gid-map-group.md) + + +[//]: # (BEGIN included file options/userns-uid-map.md) +#### **--userns-uid-map**=*mapping* + +Directly specifies a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions default to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container UID, a corresponding starting host-level UID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-uids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-uid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-uid-map are specified, but --userns-gid-map is specified, the UID map is set to use the same numeric values as the GID map. + +[//]: # (END included file options/userns-uid-map.md) + + +[//]: # (BEGIN included file options/userns-uid-map-user.md) +#### **--userns-uid-map-user**=*user* + +Specifies that a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subuid` file which correspond to the specified user. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-gid-map-group is specified, but --userns-uid-map-user is not specified, `podman` assumes that the specified group name is also a +suitable user name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. + +[//]: # (END included file options/userns-uid-map-user.md) + + +[//]: # (BEGIN included file options/uts.md) +#### **--uts**=*how* + +Sets the configuration for UTS namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new UTS namespace to be created, or it can be "host" to indicate that the UTS namespace in which `podman` itself is being run is reused, or it can be the path to a UTS namespace which is already in use by another process. + +[//]: # (END included file options/uts.md) + + +[//]: # (BEGIN included file options/volume.image.md) +#### **--volume**, **-v**=*[HOST-DIR\:CONTAINER-DIR[\:OPTIONS]]* + +Mount a host directory into containers when executing RUN instructions during +the build. + +The `OPTIONS` are a comma-separated list and can be one or more of: + + * [rw|ro] + * [z|Z|O] + * [U] + * [`[r]shared`|`[r]slave`|`[r]private`][[1]](#Footnote1) + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR` +must be an absolute path as well. Podman bind-mounts the `HOST-DIR` to the +specified path when processing RUN instructions. + +You can specify multiple **-v** options to mount one or more mounts. + +You can add the `:ro` or `:rw` suffix to a volume to mount it read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted. When running using user namespaces, the UID and GID inside +the namespace may correspond to another UID and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the namespace, to change recursively the owner and group of +the source volume. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add one of these two suffixes +`:z` or `:Z` to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The `z` option tells Podman that two containers +share the volume content. As a result, Podman labels the content with a shared +content label. Shared volume labels allow all containers to read/write content. +The `Z` option tells Podman to label the content with a private unshared label. +Only the current container can use a private volume. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the host machine to fail. For these types +of containers, disabling SELinux separation is recommended. The option +`--security-opt label=disable` disables SELinux separation for the container. +For example, if a user wanted to volume mount their entire home directory into the build containers, they need to disable SELinux separation. + + $ podman build --security-opt label=disable -v $HOME:/home/user . + +`Overlay Volume Mounts` + +The `:O` flag tells Podman to mount the directory from the host as a +temporary storage using the Overlay file system. The `RUN` command containers +are allowed to modify contents within the mountpoint and are stored in the +container storage in a separate directory. In Overlay FS terms the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the `RUN` command +finishes executing, similar to a tmpfs mount point. + +Any subsequent execution of `RUN` commands sees the original source directory +content, any changes from previous RUN commands no longer exists. + +One use case of the `overlay` mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: + +- Overlay mounts are not currently supported in rootless mode. +- The `O` flag is not allowed to be specified with the `Z` or `z` flags. + Content mounted into the container is labeled with the private label. + On SELinux systems, labels in the source directory needs to be readable + by the container label. If not, SELinux container separation must be disabled + for the container to work. +- Modification of the directory volume mounted into the container with an + overlay mount can cause unexpected failures. Do not modify the directory until + the container finishes running. + +By default bind mounted volumes are `private`. That means any mounts done +inside containers are not be visible on the host and vice versa. This behavior +can be changed by specifying a volume mount propagation property. + +When the mount propagation policy is set to `shared`, any mounts completed +inside the container on that volume is visible to both the host and +container. When the mount propagation policy is set to `slave`, one way mount +propagation is enabled and any mounts completed on the host for that volume is +visible only inside of the container. To control the mount propagation +property of volume use the `:[r]shared`, `:[r]slave` or `:[r]private` +propagation flag. For mount propagation to work on the source mount point (mount +point where source dir is mounted on) has to have the right propagation properties. +For shared volumes, the source mount point has to be shared. And for slave volumes, +the source mount has to be either shared or slave. [[1]](#Footnote1) + +Use `df ` to determine the source mount and then use +`findmnt -o TARGET,PROPAGATION ` to determine propagation +properties of source mount, if `findmnt` utility is not available, the source +mount point can be determined by looking at the mount entry in +`/proc/self/mountinfo`. Look at `optional fields` and see if any propagation +properties are specified. +`shared:X` means the mount is `shared`, `master\:X` means the mount is `slave` +and if nothing is there that means the mount is `private`. [[1]](#Footnote1) + +To change propagation properties of a mount point use the `mount` command. For +example, to bind mount the source directory `/foo` do +`mount --bind /foo /foo` and `mount --make-private --make-shared /foo`. This +converts /foo into a `shared` mount point. The propagation properties of +the source mount can be changed directly. For instance if `/` is the source +mount for `/foo`, then use `mount --make-shared /` to convert `/` into a +`shared` mount. + +[//]: # (END included file options/volume.image.md) + +## EXAMPLES + +Build named image and manifest list using specified Containerfile with default farm: +``` +$ podman farm build --local -t name -f /path/to/containerfile . +``` + +Build named image and manifest list using the specified farm: +``` +$ podman farm build --farm myfarm -t name . +``` + +Build named image and manifest list using the specified farm, removing all images from farm nodes, after they are pushed to registry: +``` +$ podman farm build --farm myfarm --cleanup -t name . +``` + +Build named images and manifest list for specified platforms using default farm: +``` +$ podman farm build --platforms arm64,amd64 -t name . +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/main/man/runc.8.md)**, **[useradd(8)](https://www.unix.com/man-page/redhat/8/useradd)**, **[Containerfile(5)](https://github.com/containers/common/blob/main/docs/Containerfile.5.md)**, **[containerignore(5)](https://github.com/containers/common/blob/main/docs/containerignore.5.md)** + +## HISTORY + +September 2023, Originally compiled by Urvashi Mohnani `` + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a +core value of open source. The `master` and `slave` mount propagation +terminology used here is problematic and divisive, and needs to be changed. +However, these terms are currently used within the Linux kernel and must be +used as-is at this time. When the kernel maintainers rectify this usage, +Podman will follow suit immediately. diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-farm-create.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-farm-create.1.md new file mode 100644 index 000000000..09bc80ad8 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-farm-create.1.md @@ -0,0 +1,39 @@ +--- +title: podman-farm-create +version: v5.4.2 +--- + +% podman-farm-create 1 + +## NAME +podman\-farm\-create - Create a new farm + +## SYNOPSIS +**podman farm create** *name* [*connections*] + +## DESCRIPTION +Create a new farm with connections that Podman knows about which were added via the +*podman system connection add* command. + +An empty farm can be created without adding any connections to it. Add or remove +connections from a farm via the *podman farm update* command. + +## EXAMPLE + + + +Create the specified farm: +``` +$ podman farm create farm2 +``` + +Create multiple farms: +``` +$ podman farm create farm1 f37 f38 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)**, **[podman-system-connection-add(1)](podman-system-connection-add.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-farm-list.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-farm-list.1.md new file mode 100644 index 000000000..2462d88cc --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-farm-list.1.md @@ -0,0 +1,47 @@ +--- +title: podman-farm-list +version: v5.4.2 +--- + +% podman-farm-list 1 + +## NAME +podman\-farm\-list - List the existing farms + +## SYNOPSIS +**podman farm list** [*options*] + +**podman farm ls** [*options*] + +## DESCRIPTION +List all the existing farms. + +## OPTIONS + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' or a Go template. +Valid placeholders for the Go template listed below: + +| **Placeholder** | **Description** | +| --------------- | --------------------------------------------------------------------- | +| .Connections | List of all system connections in the farm | +| .Default | Indicates whether farm is the default | +| .Name | Farm name | +| .ReadWrite | Indicates if this farm can be modified using the podman farm commands | + +## EXAMPLE + +List all farms: +``` +$ podman farm list +Name Connections Default ReadWrite +farm1 [f38 f37] false true +farm2 [f37] true true +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-farm-remove.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-farm-remove.1.md new file mode 100644 index 000000000..f7b04f95b --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-farm-remove.1.md @@ -0,0 +1,41 @@ +--- +title: podman-farm-remove +version: v5.4.2 +--- + +% podman-farm-remove 1 + +## NAME +podman\-farm\-remove - Delete one or more farms + +## SYNOPSIS +**podman farm remove** [*options*] *name* + +**podman farm rm** [*options*] *name* + +## DESCRIPTION +Delete one or more farms. + +## OPTIONS + +#### **--all**, **-a** + +Remove all farms. + +## EXAMPLE + +Remove specified farm: +``` +$ podman farm remove farm1 +``` + +Remove all farms: +``` +$ podman farm rm --all +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com)s diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-farm-update.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-farm-update.1.md new file mode 100644 index 000000000..52c4fa05b --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-farm-update.1.md @@ -0,0 +1,53 @@ +--- +title: podman-farm-update +version: v5.4.2 +--- + +% podman-farm-update 1 + +## NAME +podman\-farm\-update - Update an existing farm + +## SYNOPSIS +**podman farm update** [*options*] *name* + +## DESCRIPTION +Update a farm by either adding connections to it, removing connections from it, or setting it as the new +default farm. + +## OPTIONS + +#### **--add**, **-a** + +Add new connections to an existing farm. Multiple connections can be added at once. + +#### **--default**, **-d** + +Set the current farm as the default. + +#### **--remove**, **-r** + +Remove one or more connections from an existing farm. + +## EXAMPLE + +Add two connections to specified farm: +``` +$ podman farm update --add f35,f38 farm1 +``` + +Add connection to specified farm: +``` +$ podman farm update --remove f35 farm1 +``` + +Change specified farm to be default: +``` +$ podman farm update --default farm2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com)s diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-farm.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-farm.1.md new file mode 100644 index 000000000..2183f700b --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-farm.1.md @@ -0,0 +1,46 @@ +--- +title: podman-farm +version: v5.4.2 +--- + +% podman-farm 1 + +## NAME +podman\-farm - Farm out builds to machines running podman for different architectures + +## SYNOPSIS +**podman farm** *subcommand* + +## DESCRIPTION +Farm out builds to machines running Podman for different architectures. + +Manage farms by creating, updating, and removing them. + +Note: All farm machines must have a minimum podman version of v4.9.0. + +Podman manages the farms by writing and reading the `podman-connections.json` file located under +`$XDG_CONFIG_HOME/containers` or if the env is not set it defaults to `$HOME/.config/containers`. +Or the `PODMAN_CONNECTIONS_CONF` environment variable can be set to a full file path which podman +will use instead. +This file is managed by the podman commands and should never be edited by users directly. To manually +configure the farms use the `[farm]` section in containers.conf. + +If the ReadWrite column in the **podman farm list** output is set to true the farm is stored in the +`podman-connections.json` file otherwise it is stored in containers.conf and can therefore not be +edited with the **podman farm remove/update** commands. It can still be used with **podman farm build**. + +## COMMANDS + +| Command | Man Page | Description | +| -------- | ----------------------------------------------------| ----------------------------------------------------------------- | +| build | [podman-farm\-build(1)](podman-farm-build.1.md) | Build images on farm nodes, then bundle them into a manifest list | +| create | [podman-farm\-create(1)](podman-farm-create.1.md) | Create a new farm | +| list | [podman-farm\-list(1)](podman-farm-list.1.md) | List the existing farms | +| remove | [podman-farm\-remove(1)](podman-farm-remove.1.md) | Delete one or more farms | +| update | [podman-farm\-update(1)](podman-farm-update.1.md) | Update an existing farm | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-generate-spec.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-generate-spec.1.md new file mode 100644 index 000000000..719545cea --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-generate-spec.1.md @@ -0,0 +1,31 @@ +--- +title: podman-generate-spec +version: v5.4.2 +--- + +% podman-generate-spec 1 + +## NAME +podman\-generate\-spec - Generate Specgen JSON based on containers or pods + +## SYNOPSIS +**podman generate spec** [*options*] *container | *pod* + +## DESCRIPTION +**podman generate spec** generates SpecGen JSON from Podman Containers and Pods. This JSON can be printed to a file, directly to the command line, or both. + +This JSON can then be used as input for the Podman API, specifically for Podman container and pod creation. Specgen is Podman's internal structure for formulating new container-related entities. + +## OPTIONS + +#### **--compact**, **-c** + +Print the output in a compact, one line format. This is useful when piping the data to the Podman API + +#### **--filename**, **-f**=**filename** + +Output to the given file. + +#### **--name**, **-n** + +Rename the pod or container, so that it does not conflict with the existing entity. This is helpful when the JSON is to be used before the source pod or container is deleted. diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-generate-systemd.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-generate-systemd.1.md new file mode 100644 index 000000000..aa47e5d86 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-generate-systemd.1.md @@ -0,0 +1,326 @@ +--- +title: podman-generate-systemd +version: v5.4.2 +--- + +% podman-generate-systemd 1 + +## NAME +podman\-generate\-systemd - [DEPRECATED] Generate systemd unit file(s) for a container or pod + +## SYNOPSIS +**podman generate systemd** [*options*] *container|pod* + +## DESCRIPTION +DEPRECATED: +Note: **podman generate systemd** is deprecated. We recommend using [Quadlet](podman-systemd.unit.5.md) +files when running Podman containers or pods under systemd. There are no plans to remove the command. +It will receive urgent bug fixes but no new features. + +**podman generate systemd** creates a systemd unit file that can be used to control a container or pod. +By default, the command prints the content of the unit files to stdout. + +Generating unit files for a pod requires the pod to be created with an infra container (see `--infra=true`). An infra container runs across the entire lifespan of a pod and is hence required for systemd to manage the life cycle of the pod's main unit. + +- Note: When using this command with the remote client, including Mac and Windows (excluding WSL2) machines, place the generated units on the remote system. Moreover, make sure that the `XDG_RUNTIME_DIR` environment variable is set. If unset, set it via `export XDG_RUNTIME_DIR=/run/user/$(id -u)`._ + +- Note: The generated `podman run` command contains an `--sdnotify` option with the value taken from the container. +If the container does not have any explicitly set value or the value is set to __ignore__, the value __conmon__ is used. +The reason for overriding the default value __container__ is that almost no container workloads send notify messages. +Systemd waits for a ready message that never comes, if the value __container__ is used for a container +that does not send notify messages. The use of the default value might have been unintentional by the user, +therefore the overridden default value._ + +### Kubernetes Integration + +A Kubernetes YAML can be executed in systemd via the `podman-kube@.service` systemd template. The template's argument is the path to the YAML file. Given a `workload.yaml` file in the home directory, it can be executed as follows: + +``` +$ escaped=$(systemd-escape ~/workload.yaml) +$ systemctl --user start podman-kube@$escaped.service +$ systemctl --user is-active podman-kube@$escaped.service +active +``` + +## OPTIONS + +#### **--after**=*dependency_name* + +Add the systemd unit after (`After=`) option, that ordering dependencies between the list of dependencies and this service. This option may be specified more than once. + +User-defined dependencies are appended to the generated unit file, but any existing options needed or defined by default (e.g., `online.target`) are **not** removed or overridden. + +#### **--container-prefix**=*prefix* + +Set the systemd unit name prefix for containers. The default is *container*. + +#### **--env**, **-e**=*env* + +Set environment variables to the systemd unit files. + +If an environment variable is specified without a value, Podman checks the host environment for a value and sets the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the systemd unit files. + +#### **--files**, **-f** + +Generate files instead of printing to stdout. The generated files are named {container,pod}-{ID,name}.service and are placed in the current working directory. + +Note: On a system with SELinux enabled, the generated files inherits contexts from the current working directory. Depending on the SELinux setup, changes to the generated files using `restorecon`, `chcon`, or `semanage` may be required to allow systemd to access these files. Alternatively, use the `-Z` option when running `mv` or `cp`. + +#### **--format**=*format* + +Print the created units in the specified format (json). If `--files` is specified, the paths to the created files are printed instead of the unit content. + +#### **--name**, **-n** + +Use the name of the container for the start, stop, and description in the unit file + +#### **--new** + +This option yields unit files that do not expect containers and pods to exist. Instead, new containers and pods are created based on their configuration files. The unit files are created best effort and may need further editing; please review the generated files carefully before using them in production. + +Note that `--new` only works on containers and pods created directly via Podman (i.e., `podman [container] {create,run}` or `podman pod create`). It does not work on containers or pods created via the REST API or via `podman kube play`. For `podman kube play`, use the `podman-kube@.service` systemd template instead. + +#### **--no-header** + +Do not generate the header including meta data such as the Podman version and the timestamp. + +#### **--pod-prefix**=*prefix* + +Set the systemd unit name prefix for pods. The default is *pod*. + +#### **--requires**=*dependency_name* + +Set the systemd unit requires (`Requires=`) option. Similar to wants, but declares a stronger requirement dependency. + +#### **--restart-policy**=*policy* + +Set the systemd restart policy. The restart-policy must be one of: "no", "on-success", "on-failure", "on-abnormal", +"on-watchdog", "on-abort", or "always". The default policy is *on-failure* unless the container was created with a custom restart policy. + +Note that generating a unit without `--new` on a container with a custom restart policy can lead to issues on shutdown; systemd attempts to stop the unit while Podman tries to restart it. Creating the container without `--restart` and using the `--restart-policy` option when generating the unit file is recommended. + +#### **--restart-sec**=*time* + +Set the systemd service restartsec value. Configures the time to sleep before restarting a service (as configured with restart-policy). +Takes a value in seconds. + +#### **--separator**=*separator* + +Set the systemd unit name separator between the name/id of a container/pod and the prefix. The default is *-*. + +#### **--start-timeout**=*value* + +Override the default start timeout for the container with the given value in seconds. + +#### **--stop-timeout**=*value* + +Override the default stop timeout for the container with the given value in seconds. + +#### **--template** + +Add template specifiers to run multiple services from the systemd unit file. + +Note that if `--new` was not set to true, it is set to true by default. However, the command fails if `--new` is set to `false` explicitly. + +#### **--wants**=*dependency_name* + +Add the systemd unit wants (`Wants=`) option, that this service is (weak) dependent on. This option may be specified more than once. This option does not influence the order in which services are started or stopped. + +User-defined dependencies are appended to the generated unit file, but any existing options needed or defined by default (e.g., `online.target`) are **not** removed or overridden. + +## EXAMPLES + +### Generate and print a systemd unit file for a container + +Generate a systemd unit file for a container running nginx with an *always* restart policy and 1-second timeout to stdout. Note that the **RequiresMountsFor** option in the **Unit** section ensures that the container storage for both the GraphRoot and the RunRoot are mounted prior to starting the service. For systems with container storage on disks like iSCSI or other remote block protocols, this ensures that Podman is not executed prior to any necessary storage operations coming online. + +``` +$ podman create --name nginx nginx:latest +$ podman generate systemd --restart-policy=always -t 1 nginx +# container-de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6.service +# autogenerated by Podman 1.8.0 +# Wed Mar 09 09:46:45 CEST 2020 + +[Unit] +Description=Podman container-de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6.service +Documentation=man:podman-generate-systemd(1) +Wants=network-online.target +After=network-online.target +RequiresMountsFor=/var/run/container/storage + +[Service] +Restart=always +ExecStart=/usr/bin/podman start de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6 +ExecStop=/usr/bin/podman stop \ + -t 1 de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6 +KillMode=none +Type=forking +PIDFile=/run/user/1000/overlay-containers/de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6/userdata/conmon.pid + +[Install] +WantedBy=default.target +``` + +### Generate systemd unit file for a container with `--new` flag + + The `--new` flag generates systemd unit files that create and remove containers at service start and stop commands (see ExecStartPre and ExecStopPost service actions). Such unit files are not tied to a single machine and can easily be shared and used on other machines. + +``` +$ sudo podman generate systemd --new --files --name bb310a0780ae +# container-busy_moser.service +# autogenerated by Podman 1.8.3 +# Fri Apr 3 09:40:47 EDT 2020 + +[Unit] +Description=Podman container-busy_moser.service +Documentation=man:podman-generate-systemd(1) +Wants=network-online.target +After=network-online.target +RequiresMountsFor=/var/run/container/storage + +[Service] +Environment=PODMAN_SYSTEMD_UNIT=%n +Restart=on-failure +ExecStartPre=/bin/rm -f %t/%n-pid %t/%n-cid +ExecStart=/usr/local/bin/podman run \ + --conmon-pidfile %t/%n-pid \ + --cidfile %t/%n-cid \ + --cgroups=no-conmon \ + -d \ + -dit alpine +ExecStop=/usr/local/bin/podman stop \ + --ignore \ + --cidfile %t/%n-cid -t 10 +ExecStopPost=/usr/local/bin/podman rm \ + --ignore \ + -f \ + --cidfile %t/%n-cid +PIDFile=%t/%n-pid +KillMode=none +Type=forking + +[Install] +WantedBy=default.target +``` + +### Generate systemd unit files for a pod with two simple alpine containers + +Note `systemctl` must only be used on the pod unit and not used to start or stop containers individually. The containers are managed by the pod service along with the internal infra-container. + +Use `systemctl status` or `journalctl` to examine container or pod unit files. +``` +$ podman pod create --name systemd-pod +$ podman create --pod systemd-pod alpine top +$ podman create --pod systemd-pod alpine top +$ podman generate systemd --files --name systemd-pod +/home/user/pod-systemd-pod.service +/home/user/container-amazing_chandrasekhar.service +/home/user/container-jolly_shtern.service +$ cat pod-systemd-pod.service +# pod-systemd-pod.service +# autogenerated by Podman 1.8.0 +# Wed Mar 09 09:52:37 CEST 2020 + +[Unit] +Description=Podman pod-systemd-pod.service +Documentation=man:podman-generate-systemd(1) +Requires=container-amazing_chandrasekhar.service container-jolly_shtern.service +Before=container-amazing_chandrasekhar.service container-jolly_shtern.service +Wants=network-online.target +After=network-online.target +RequiresMountsFor=/var/run/container/storage + +[Service] +Restart=on-failure +ExecStart=/usr/bin/podman start 77a818221650-infra +ExecStop=/usr/bin/podman stop \ + -t 10 77a818221650-infra +KillMode=none +Type=forking +PIDFile=/run/user/1000/overlay-containers/ccfd5c71a088768774ca7bd05888d55cc287698dde06f475c8b02f696a25adcd/userdata/conmon.pid + +[Install] +WantedBy=default.target +``` + +### Installation of generated systemd unit files. + +Podman-generated unit files include an `[Install]` section, which carries installation information for the unit. It is used by the enable and disable commands of systemctl(1) during installation. + +Once the systemd unit file is generated, install it to */etc/systemd/system* to be run by the root user or to *$HOME/.config/systemd/user* for installing it as a non-root user. Enable the copied unit file or files using `systemctl enable`. + +Note: Copying unit files to */etc/systemd/system* and enabling it marks the unit file to be automatically started at boot. And similarly, copying a unit file to *$HOME/.config/systemd/user* and enabling it marks the unit file to be automatically started on user login. + + +``` +# Generated systemd files. +$ podman pod create --name systemd-pod +$ podman create --pod systemd-pod alpine top +$ podman generate systemd --files --name systemd-pod + +# Copy all the generated files. + +$ sudo cp pod-systemd-pod.service container-great_payne.service /etc/systemd/system +$ systemctl enable pod-systemd-pod.service +Created symlink /etc/systemd/system/multi-user.target.wants/pod-systemd-pod.service → /etc/systemd/system/pod-systemd-pod.service. +Created symlink /etc/systemd/system/default.target.wants/pod-systemd-pod.service → /etc/systemd/system/pod-systemd-pod.service. +$ systemctl is-enabled pod-systemd-pod.service +enabled +``` +To run the user services placed in `$HOME/.config/systemd/user` on first login of that user, enable the service with --user flag. + +``` +$ systemctl --user enable <.service> +``` +The systemd user instance is killed after the last session for the user is closed. The systemd user instance can be started at boot and kept running even after the user logs out by enabling `lingering` using + +``` +$ loginctl enable-linger +``` +### Use `systemctl` to perform operations on generated installed unit files. + +Create and enable systemd unit files for a pod using the above examples as reference and use `systemctl` to perform operations. + +Since systemctl defaults to using the root user, all the changes using the systemctl can be seen by appending sudo to the podman cli commands. To perform `systemctl` actions as a non-root user use the `--user` flag when interacting with `systemctl`. + +Note: If the previously created containers or pods are using shared resources, such as ports, make sure to remove them before starting the generated systemd units. + +``` +$ systemctl --user start pod-systemd-pod.service +$ podman pod ps +POD ID NAME STATUS CREATED # OF CONTAINERS INFRA ID +0815c7b8e7f5 systemd-pod Running 29 minutes ago 2 6c5d116f4bbe +$ sudo podman ps # 0 Number of pods on root. +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +$ systemctl stop pod-systemd-pod.service +$ podman pod ps +POD ID NAME STATUS CREATED # OF CONTAINERS INFRA ID +272d2813c798 systemd-pod Exited 29 minutes ago 2 6c5d116f4bbe +``` + +Create a simple alpine container and generate the systemd unit file with `--new` flag. +Enable the service and control operations using the systemctl commands. + +Note: When starting the container using `systemctl start` rather than altering the already running container it spins up a "new" container with similar configuration. + +``` +# Enable the service. + +$ sudo podman ps -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +bb310a0780ae docker.io/library/alpine:latest /bin/sh 2 minutes ago Created busy_moser +$ sudo systemctl start container-busy_moser.service +$ sudo podman ps -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +772df2f8cf3b docker.io/library/alpine:latest /bin/sh 1 second ago Up 1 second distracted_albattani +bb310a0780ae docker.io/library/alpine\:latest /bin/sh 3 minutes ago Created busy_moser +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **systemctl(1)**, **systemd.unit(5)**, **systemd.service(5)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)**, **[podman-systemd.unit(5)](podman-systemd.unit.5.md)** + +## HISTORY +April 2020, Updated details and added use case to use generated .service files as root and non-root, by Sujil Shah (sushah at redhat dot com) + +August 2019, Updated with pod support by Valentin Rothberg (rothberg at redhat dot com) + +April 2019, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-generate.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-generate.1.md new file mode 100644 index 000000000..341f1a9b1 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-generate.1.md @@ -0,0 +1,27 @@ +--- +title: podman-generate +version: v5.4.2 +--- + +% podman-generate 1 + +## NAME +podman\-generate - Generate structured data based on containers, pods or volumes + +## SYNOPSIS +**podman generate** *subcommand* + +## DESCRIPTION +The generate command creates structured output (like YAML) based on a container, pod or volume. + +## COMMANDS + +| Command | Man Page | Description | +|---------|------------------------------------------------------------|-------------------------------------------------------------------------------------| +| kube | [podman-kube-generate(1)](podman-kube-generate.1.md) | Generate Kubernetes YAML based on containers, pods or volumes. | +| spec | [podman-generate-spec(1)](podman-generate-spec.1.md) | Generate Specgen JSON based on containers or pods. | +| systemd | [podman-generate-systemd(1)](podman-generate-systemd.1.md) | [DEPRECATED] Generate systemd unit file(s) for a container or pod. | + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-container(1)](podman-container.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-healthcheck-run.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-healthcheck-run.1.md new file mode 100644 index 000000000..9a86f70c3 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-healthcheck-run.1.md @@ -0,0 +1,45 @@ +--- +title: podman-healthcheck-run +version: v5.4.2 +--- + +% podman-healthcheck-run 1 + +## NAME +podman\-healthcheck\-run - Run a container healthcheck + +## SYNOPSIS +**podman healthcheck run** *container* + +## DESCRIPTION + +Runs the healthcheck command defined in a running container manually. The resulting error codes are defined +as follows: + +* 0 = healthcheck command succeeded +* 1 = healthcheck command failed +* 125 = an error has occurred + +Possible errors that can occur during the healthcheck are: +* unable to find the container +* container has no defined healthcheck +* container is not running + +## OPTIONS +#### **--help** + +Print usage statement + + +## EXAMPLES + +Run healthchecks in specified container: +``` +$ podman healthcheck run mywebapp +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-healthcheck(1)](podman-healthcheck.1.md)** + +## HISTORY +Feb 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-healthcheck.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-healthcheck.1.md new file mode 100644 index 000000000..f11f8b756 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-healthcheck.1.md @@ -0,0 +1,27 @@ +--- +title: podman-healthcheck +version: v5.4.2 +--- + +% podman-healthcheck 1 + +## NAME +podman\-healthcheck - Manage healthchecks for containers + +## SYNOPSIS +**podman healthcheck** *subcommand* + +## DESCRIPTION +podman healthcheck is a set of subcommands that manage container healthchecks + +## SUBCOMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------- | ------------------------------------------------------------------------------ | +| run | [podman-healthcheck-run(1)](podman-healthcheck-run.1.md) | Run a container healthcheck | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +Feb 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-history.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-history.1.md new file mode 100644 index 000000000..d30c9fa2b --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-history.1.md @@ -0,0 +1,110 @@ +--- +title: podman-history +version: v5.4.2 +--- + +% podman-history 1 + +## NAME +podman\-history - Show the history of an image + +## SYNOPSIS +**podman history** [*options*] *image*[:*tag*|@*digest*] + +**podman image history** [*options*] *image*[:*tag*|@*digest*] + +## DESCRIPTION +**podman history** displays the history of an image by printing out information +about each layer used in the image. The information printed out for each layer +include Created (time and date), Created By, Size, and Comment. The output can +be truncated or not using the **--no-trunc** flag. If the **--human** flag is +set, the time of creation and size are printed out in a human readable format. +The **--quiet** flag displays the ID of the image only when set and the **--format** +flag is used to print the information using the Go template provided by the user. + +## OPTIONS + +#### **--format**=*format* + +Alter the output for a format like 'json' or a Go template. + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|------------------------|---------------------------------------------------------------------------| +| .Comment | Comment for the layer | +| .Created | if --human, time elapsed since creation, otherwise time stamp of creation | +| .CreatedAt | Time when the image layer was created | +| .CreatedBy | Command used to create the layer | +| .CreatedSince | Elapsed time since the image layer was created | +| .ID | Image ID | +| .Size | Size of layer on disk | +| .Tags | Image tags | + +#### **--help**, **-h** + +Print usage statement + +#### **--human**, **-H** + +Display sizes and dates in human readable format (default *true*). + +#### **--no-trunc** + +Do not truncate the output (default *false*). + +#### **--quiet**, **-q** + +Print the numeric IDs only (default *false*). + +## EXAMPLES + +Show the history of the specified image: +``` +$ podman history debian +ID CREATED CREATED BY SIZE COMMENT +b676ca55e4f2c 9 weeks ago /bin/sh -c #(nop) CMD ["bash"] 0 B + 9 weeks ago /bin/sh -c #(nop) ADD file:ebba725fb97cea4... 45.14 MB +``` + +Show the history of the specified image without truncating content and using raw data: +``` +$ podman history --no-trunc=true --human=false debian +ID CREATED CREATED BY SIZE COMMENT +b676ca55e4f2c 2017-07-24T16:52:55Z /bin/sh -c #(nop) CMD ["bash"] 0 + 2017-07-24T16:52:54Z /bin/sh -c #(nop) ADD file:ebba725fb97cea4... 45142935 +``` + +Show the formatted history of the specified image: +``` +$ podman history --format "{{.ID}} {{.Created}}" debian +b676ca55e4f2c 9 weeks ago + 9 weeks ago +``` + +Show the history in JSON format for the specified image: +``` +$ podman history --format json debian +[ + { + "id": "b676ca55e4f2c0ce53d0636438c5372d3efeb5ae99b676fa5a5d1581bad46060", + "created": "2017-07-24T16:52:55.195062314Z", + "createdBy": "/bin/sh -c #(nop) CMD [\"bash\"]", + "size": 0, + "comment": "" + }, + { + "id": "b676ca55e4f2c0ce53d0636438c5372d3efeb5ae99b676fa5a5d1581bad46060", + "created": "2017-07-24T16:52:54.898893387Z", + "createdBy": "/bin/sh -c #(nop) ADD file:ebba725fb97cea45d0b1b35ccc8144e766fcfc9a78530465c23b0c4674b14042 in / ", + "size": 45142935, + "comment": "" + } +] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-image-diff.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-image-diff.1.md new file mode 100644 index 000000000..ddd4143b4 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-image-diff.1.md @@ -0,0 +1,61 @@ +--- +title: podman-image-diff +version: v5.4.2 +--- + +% podman-image-diff 1 + +## NAME +podman-image-diff - Inspect changes on an image's filesystem + +## SYNOPSIS +**podman image diff** [*options*] *image* [*image*] + +## DESCRIPTION +Displays changes on an image's filesystem. The image is compared to its parent layer or the second argument when given. + +The output is prefixed with the following symbols: + +| Symbol | Description | +|--------|-------------| +| A | A file or directory was added. | +| D | A file or directory was deleted. | +| C | A file or directory was changed. | + +## OPTIONS + +#### **--format** + +Alter the output into a different format. The only valid format for **podman image diff** is `json`. + +## EXAMPLE + +Display image differences from images parent layer: +``` +$ podman image diff redis:old +C /usr +C /usr/local +C /usr/local/bin +A /usr/local/bin/docker-entrypoint.sh +``` + +Display image differences between two different images in JSON format: +``` +$ podman image diff --format json redis:old redis\:alpine +{ + "changed": [ + "/usr", + "/usr/local", + "/usr/local/bin" + ], + "added": [ + "/usr/local/bin/docker-entrypoint.sh" + ] +} +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image(1)](podman-image.1.md)** + +## HISTORY +August 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-image-exists.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-image-exists.1.md new file mode 100644 index 000000000..176f126eb --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-image-exists.1.md @@ -0,0 +1,46 @@ +--- +title: podman-image-exists +version: v5.4.2 +--- + +% podman-image-exists 1 + +## NAME +podman-image-exists - Check if an image exists in local storage + +## SYNOPSIS +**podman image exists** *image* + +## DESCRIPTION +**podman image exists** checks if an image exists in local storage. The **ID** or **Name** +of the image may be used as input. Podman returns an exit code +of `0` when the image is found. A `1` is returned otherwise. An exit code of `125` indicates there +was an issue accessing the local storage. + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Check if an image called `webclient` exists in local storage (the image does actually exist): +``` +$ podman image exists webclient +$ echo $? +0 +``` + +Check if an image called `webbackend` exists in local storage (the image does not actually exist): +``` +$ podman image exists webbackend +$ echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image(1)](podman-image.1.md)** + +## HISTORY +November 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-image-inspect.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-image-inspect.1.md new file mode 100644 index 000000000..d17f8f7fd --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-image-inspect.1.md @@ -0,0 +1,139 @@ +--- +title: podman-image-inspect +version: v5.4.2 +--- + +% podman-image-inspect 1 + +## NAME +podman\-image\-inspect - Display an image's configuration + +## SYNOPSIS +**podman image inspect** [*options*] *image* [*image* ...] + +## DESCRIPTION + +This displays the low-level information on images identified by name or ID. By default, this renders all results in a JSON array. If a format is specified, the given template is executed for each result. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Format the output using the given Go template. +The keys of the returned JSON can be used as the values for the --format flag (see examples below). + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ----------------- | ------------------ | +| .Annotations ... | Annotation information included in the image | +| .Architecture | Architecture of software in the image | +| .Author | Image author | +| .Comment | Image comment | +| .Config ... | Structure with config info | +| .Created ... | Image creation time (string, ISO3601) | +| .Digest | Image digest (sha256:+64-char hash) | +| .GraphDriver ... | Structure for the graph driver info | +| .HealthCheck ... | Structure for the health check info | +| .History | History information stored in image | +| .ID | Image ID (full 64-char hash) | +| .Labels ... | Label information included in the image | +| .ManifestType | Manifest type of the image | +| .NamesHistory | Name history information stored in image | +| .Os | Operating system of software in the image | +| .Parent | Parent image of the specified image | +| .RepoDigests | Repository digests for the image | +| .RepoTags | Repository tags for the image | +| .RootFS ... | Structure for the root file system info | +| .Size | Size of image, in bytes | +| .User | Default user to execute the image as | +| .Version | Image Version | +| .VirtualSize | Virtual size of image, in bytes | + +## EXAMPLE + +Inspect information on the specified image: +``` +$ podman image inspect fedora +[ + { + "Id": "37e5619f4a8ca9dbc4d6c0ae7890625674a10dbcfb76201399e2aaddb40da17d", + "Digest": "sha256:1b0d4ddd99b1a8c8a80e885aafe6034c95f266da44ead992aab388e6aa91611a", + "RepoTags": [ + "registry.fedoraproject.org/fedora:latest" + ], + "RepoDigests": [ + "registry.fedoraproject.org/fedora@sha256:1b0d4ddd99b1a8c8a80e885aafe6034c95f266da44ead992aab388e6aa91611a", + "registry.fedoraproject.org/fedora@sha256:b5290db40008aae9272ad3a6bd8070ef7ecd547c3bef014b894c327960acc582" + ], + "Parent": "", + "Comment": "Created by Image Factory", + "Created": "2021-08-09T05:48:47Z", + "Config": { + "Env": [ + "DISTTAG=f34container", + "FGC=f34", + "container=oci" + ], + "Cmd": [ + "/bin/bash" + ], + "Labels": { + "license": "MIT", + "name": "fedora", + "vendor": "Fedora Project", + "version": "34" + } + }, + "Version": "1.10.1", + "Author": "", + "Architecture": "amd64", + "Os": "linux", + "Size": 183852302, + "VirtualSize": 183852302, + "GraphDriver": { + "Name": "overlay", + "Data": { + "UpperDir": "/home/dwalsh/.local/share/containers/storage/overlay/0203e243f1ca4b6bb49371ecd21363212467ec6d7d3fa9f324cd4e78cc6b5fa2/diff", + "WorkDir": "/home/dwalsh/.local/share/containers/storage/overlay/0203e243f1ca4b6bb49371ecd21363212467ec6d7d3fa9f324cd4e78cc6b5fa2/work" + } + }, + "RootFS": { + "Type": "layers", + "Layers": [ + "sha256:0203e243f1ca4b6bb49371ecd21363212467ec6d7d3fa9f324cd4e78cc6b5fa2" + ] + }, + "Labels": { + "license": "MIT", + "name": "fedora", + "vendor": "Fedora Project", + "version": "34" + }, + "Annotations": {}, + "ManifestType": "application/vnd.docker.distribution.manifest.v2+json", + "User": "", + "History": [ + { + "created": "2021-08-09T05:48:47Z", + "comment": "Created by Image Factory" + } + ], + "NamesHistory": [ + "registry.fedoraproject.org/fedora:latest" + ] + } +] +``` + +Inspect image ID for the specified image: +``` +$ podman image inspect --format '{{ .Id }}' fedora +37e5619f4a8ca9dbc4d6c0ae7890625674a10dbcfb76201399e2aaddb40da17d +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image(1)](podman-image.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +Sep 2021, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-image-mount.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-image-mount.1.md new file mode 100644 index 000000000..c922a9360 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-image-mount.1.md @@ -0,0 +1,82 @@ +--- +title: podman-image-mount +version: v5.4.2 +--- + +% podman-image-mount 1 + +## NAME +podman\-image\-mount - Mount an image's root filesystem + +## SYNOPSIS +**podman image mount** [*options*] [*image* ...] + +## DESCRIPTION +Mounts the specified images' root file system in a location which can be +accessed from the host, and returns its location. + +The `podman image mount` command without any arguments lists all of the +currently mounted images. + +Rootless mode only supports mounting VFS driver, unless podman is run in a user namespace. +Use the `podman unshare` command to enter the user namespace. All other storage drivers fail to mount. + +## RETURN VALUE +The location of the mounted file system. On error an empty string and errno is +returned. + +## OPTIONS + +#### **--all**, **-a** + +Mount all images. + +#### **--format**=*format* + +Print the mounted images in specified format (json). + +## EXAMPLE + +Mount multiple images. Note: In rootless mode, image mounting works only after executing the podman unshare command to enter the user namespace. +``` +podman image mount fedora ubi8-init +/var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +/var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged +``` + +List mounted images: +``` +podman image mount +registry.fedoraproject.org/fedora:latest /var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +registry.access.redhat.com/ubi8-init:latest /var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged +``` + +List mounted images in JSON format: +``` +podman image mount --format json +[ + { + "id": "00ff39a8bf19f810a7e641f7eb3ddc47635913a19c4996debd91fafb6b379069", + "Names": [ + "sha256:58de585a231aca14a511347bc85b912a6f000159b49bc2b0582032911e5d3a6c" + ], + "Repositories": [ + "registry.fedoraproject.org/fedora:latest" + ], + "mountpoint": "/var/lib/containers/storage/overlay/0ccfac04663bbe8813b5f24502ee0b7371ce5bf3c5adeb12e4258d191c2cf7bc/merged" + }, + { + "id": "bcc2dc9a261774ad25a15e07bb515f9b77424266abf2a1252ec7bcfed1dd0ac2", + "Names": [ + "sha256:d5f260b2e51b3ee9d05de1c31d261efc9af28e7d2d47cedf054c496d71424d63" + ], + "Repositories": [ + "registry.access.redhat.com/ubi8-init:latest" + ], + "mountpoint": "/var/lib/containers/storage/overlay/d66b58e3391ea8ce4c81316c72e22b332618f2a28b461a32ed673e8998cdaeb8/merged" + } +] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image(1)](podman-image.1.md)**, **[podman-image-unmount(1)](podman-image-unmount.1.md)**, **[podman-unshare(1)](podman-unshare.1.md)**, **mount(8)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-image-prune.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-image-prune.1.md new file mode 100644 index 000000000..131133d4e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-image-prune.1.md @@ -0,0 +1,121 @@ +--- +title: podman-image-prune +version: v5.4.2 +--- + +% podman-image-prune 1 + +## NAME +podman-image-prune - Remove all unused images from the local store + +## SYNOPSIS +**podman image prune** [*options*] + +## DESCRIPTION +**podman image prune** removes all dangling images from local storage. With the `all` option, +all unused images are deleted (i.e., images not in use by any container). + +The image prune command does not prune cache images that only use layers that are necessary for other images. + +## OPTIONS +#### **--all**, **-a** + +Remove dangling images and images that have no associated containers. + +#### **--build-cache** + +Remove persistent build cache create for `--mount=type=cache`. + +#### **--external** + +Remove images even when they are used by external containers (e.g., build containers). + +#### **--filter**=*filters* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------:|--------------------------------------------------------------------------------------------------| +| label | Only remove images, with (or without, in the case of label!=[...] is used) the specified labels. | +| until | Only remove images created before given timestamp. | + + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes containers with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes containers without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not provide an interactive prompt for container removal. + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Remove all dangling images from local storage: +``` +$ sudo podman image prune + +WARNING! This will remove all dangling images. +Are you sure you want to continue? [y/N] y +f3e20dc537fb04cb51672a5cb6fdf2292e61d411315549391a0d1f64e4e3097e +324a7a3b2e0135f4226ffdd473e4099fd9e477a74230cdc35de69e84c0f9d907 +``` + +Remove all unused images from local storage without confirming: +``` +$ sudo podman image prune -a -f +f3e20dc537fb04cb51672a5cb6fdf2292e61d411315549391a0d1f64e4e3097e +324a7a3b2e0135f4226ffdd473e4099fd9e477a74230cdc35de69e84c0f9d907 +6125002719feb1ddf3030acab1df6156da7ce0e78e571e9b6e9c250424d6220c +91e732da5657264c6f4641b8d0c4001c218ae6c1adb9dcef33ad00cafd37d8b6 +e4e5109420323221f170627c138817770fb64832da7d8fe2babd863148287fca +77a57fa8285e9656dbb7b23d9efa837a106957409ddd702f995605af27a45ebe + +``` + +Remove all unused images from local storage since given time/hours: +``` +$ sudo podman image prune -a --filter until=2019-11-14T06:15:42.937792374Z + +WARNING! This will remove all dangling images. +Are you sure you want to continue? [y/N] y +e813d2135f17fadeffeea8159a34cfdd4c30b98d8111364b913a91fd930643e9 +5e6572320437022e2746467ddf5b3561bf06e099e8e6361df27e0b2a7ed0b17b +58fda2abf5042b35dfe04e5f8ee458a3cc26375bf309efb42c078b551a2055c7 +6d2bd30fe924d3414b64bd3920760617e6ced872364bc3bc6959a623252da002 +33d1c829be64a1e1d379caf4feec1f05a892c3ef7aa82c0be53d3c08a96c59c5 +f9f0a8a58c9e02a2b3250b88cc5c95b1e10245ca2c4161d19376580aaa90f55c +1ef14d5ede80db78978b25ad677fd3e897a578c3af614e1fda608d40c8809707 +45e1482040e441a521953a6da2eca9bafc769e15667a07c23720d6e0cafc3ab2 + +$ sudo podman image prune -f --filter until=10h +f3e20dc537fb04cb51672a5cb6fdf2292e61d411315549391a0d1f64e4e3097e +324a7a3b2e0135f4226ffdd473e4099fd9e477a74230cdc35de69e84c0f9d907 +``` + +Remove all unused images from local storage with label version 1.0: +``` +$ sudo podman image prune -a -f --filter label=version=1.0 +e813d2135f17fadeffeea8159a34cfdd4c30b98d8111364b913a91fd930643e9 +5e6572320437022e2746467ddf5b3561bf06e099e8e6361df27e0b2a7ed0b17b +58fda2abf5042b35dfe04e5f8ee458a3cc26375bf309efb42c078b551a2055c7 +6d2bd30fe924d3414b64bd3920760617e6ced872364bc3bc6959a623252da002 +33d1c829be64a1e1d379caf4feec1f05a892c3ef7aa82c0be53d3c08a96c59c5 +f9f0a8a58c9e02a2b3250b88cc5c95b1e10245ca2c4161d19376580aaa90f55c +1ef14d5ede80db78978b25ad677fd3e897a578c3af614e1fda608d40c8809707 +45e1482040e441a521953a6da2eca9bafc769e15667a07c23720d6e0cafc3ab2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-images(1)](podman-images.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) +December 2020, converted filter information from docs.docker.com documentation by Dan Walsh (dwalsh at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-image-scp.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-image-scp.1.md new file mode 100644 index 000000000..37295da92 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-image-scp.1.md @@ -0,0 +1,107 @@ +--- +title: podman-image-scp +version: v5.4.2 +--- + +% podman-image-scp 1 + +## NAME +podman-image-scp - Securely copy an image from one host to another + +## SYNOPSIS +**podman image scp** [*options*] *name*[:*tag*] + +## DESCRIPTION +**podman image scp** copies container images between hosts on a network. This command can copy images to the remote host or from the remote host as well as between two remote hosts. +Note: `::` is used to specify the image name depending on Podman is saving or loading. Images can also be transferred from rootful to rootless storage on the same machine without using sshd. This feature is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. + +**podman image scp [GLOBAL OPTIONS]** + +**podman image** *scp [OPTIONS] NAME[:TAG] [HOSTNAME::]* + +**podman image** *scp [OPTIONS] [HOSTNAME::]IMAGENAME* + +**podman image** *scp [OPTIONS] [HOSTNAME::]IMAGENAME [HOSTNAME::]* + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--quiet**, **-q** + +Suppress the output + +## EXAMPLES + +Copy specified image to local storage: +``` +$ podman image scp alpine +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image from local storage to remote connection: +``` +$ podman image scp alpine Fedora::/home/charliedoern/Documents/alpine +Getting image source signatures +Copying blob 72e830a4dff5 done +Copying config 85f9dc67c7 done +Writing manifest to image destination +Storing signatures +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image from remote connection to remote connection: +``` +$ podman image scp Fedora::alpine RHEL:: +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image via ssh to local storage: +``` +$ podman image scp charliedoern@192.168.68.126:22/run/user/1000/podman/podman.sock::alpine +WARN[0000] Unknown connection name given. Please use system connection add to specify the default remote socket location +Getting image source signatures +Copying blob 9450ef9feb15 [--------------------------------------] 0.0b / 0.0b +Copying config 1f97f0559c done +Writing manifest to image destination +Storing signatures +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image from root account to user accounts local storage: +``` +$ sudo podman image scp root@localhost::alpine username@localhost:: +Copying blob e2eb06d8af82 done +Copying config 696d33ca15 done +Writing manifest to image destination +Storing signatures +Getting image source signatures +Copying blob 5eb901baf107 skipped: already exists +Copying config 696d33ca15 done +Writing manifest to image destination +Storing signatures +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image from root account to local storage: +``` +$ sudo podman image scp root@localhost::alpine +Copying blob e2eb06d8af82 done +Copying config 696d33ca15 done +Writing manifest to image destination +Storing signatures +Getting image source signatures +Copying blob 5eb901baf107 +Copying config 696d33ca15 done +Writing manifest to image destination +Storing signatures +Loaded image: docker.io/library/alpine:latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-load(1)](podman-load.1.md)**, **[podman-save(1)](podman-save.1.md)**, **[podman-remote(1)](podman-remote.1.md)**, **[podman-system-connection-add(1)](podman-system-connection-add.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** + +## HISTORY +July 2021, Originally written by Charlie Doern diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-image-sign.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-image-sign.1.md new file mode 100644 index 000000000..265c5f244 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-image-sign.1.md @@ -0,0 +1,94 @@ +--- +title: podman-image-sign +version: v5.4.2 +--- + +% podman-image-sign 1 + +## NAME +podman-image-sign - Create a signature for an image + +## SYNOPSIS +**podman image sign** [*options*] *image* [*image* ...] + +## DESCRIPTION +**podman image sign** creates a local signature for one or more local images that have +been pulled from a registry. The signature is written to a directory +derived from the registry configuration files in `$HOME/.config/containers/registries.d` if it exists, +otherwise `/etc/containers/registries.d` (unless overridden at compile-time), see **containers-registries.d(5)** for more information. +By default, the signature is written into `/var/lib/containers/sigstore` for root and `$HOME/.local/share/containers/sigstore` for non-root users + +## OPTIONS + +#### **--all**, **-a** + +Sign all the manifests of the multi-architecture image (default false). + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + +#### **--directory**, **-d**=*dir* + +Store the signatures in the specified directory. Default: /var/lib/containers/sigstore + +#### **--help**, **-h** + +Print usage statement. + +#### **--sign-by**=*identity* + +Override the default identity of the signature. + +## EXAMPLES +Sign the busybox image with the identity of foo@bar.com with a user's keyring and save the signature in /tmp/signatures/. + +```bash + $ sudo podman image sign --sign-by foo@bar.com --directory /tmp/signatures docker://privateregistry.example.com/foobar + + $ sudo podman image sign --authfile=/tmp/foobar.json --sign-by foo@bar.com --directory /tmp/signatures docker://privateregistry.example.com/foobar +``` + +## RELATED CONFIGURATION + +The write (and read) location for signatures is defined in YAML-based +configuration files in /etc/containers/registries.d/ for root, +or $HOME/.config/containers/registries.d for non-root users. When signing +an image, Podman uses those configuration files to determine +where to write the signature based on the name of the originating +registry or a default storage value unless overridden with the --directory +option. For example, consider the following configuration file. + +```yaml +docker: + privateregistry.example.com: + sigstore: file:///var/lib/containers/sigstore +``` + +When signing an image preceded with the registry name 'privateregistry.example.com', +the signature is written into sub-directories of +/var/lib/containers/sigstore/privateregistry.example.com. The use of 'sigstore' also means +the signature is 'read' from that same location on a pull-related function. + +## SEE ALSO +**[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.d(5)](https://github.com/containers/image/blob/main/docs/containers-registries.d.5.md)** + +## HISTORY +November 2018, Originally compiled by Qi Wang (qiwan at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-image-tree.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-image-tree.1.md new file mode 100644 index 000000000..701009991 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-image-tree.1.md @@ -0,0 +1,91 @@ +--- +title: podman-image-tree +version: v5.4.2 +--- + +% podman-image-tree 1 + +## NAME +podman\-image\-tree - Print layer hierarchy of an image in a tree format + +## SYNOPSIS +**podman image tree** [*options*] *image:tag*|*image-id* + + +## DESCRIPTION +Prints layer hierarchy of an image in a tree format. +If no *tag* is provided, Podman defaults to `latest` for the *image*. +Layers are indicated with image tags as `Top Layer of`, when the tag is known locally. +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--whatrequires** + +Show all child images and layers of the specified image + +## EXAMPLES + +List image tree information on specified image: +``` +$ podman image tree docker.io/library/wordpress +Image ID: 6e880d17852f +Tags: [docker.io/library/wordpress:latest] +Size: 429.9MB +Image Layers +├── ID: 3c816b4ead84 Size: 58.47MB +├── ID: e39dad2af72e Size: 3.584kB +├── ID: b2d6a702383c Size: 213.6MB +├── ID: 94609408badd Size: 3.584kB +├── ID: f4dddbf86725 Size: 43.04MB +├── ID: 8f695df43a4c Size: 11.78kB +├── ID: c29d67bf8461 Size: 9.728kB +├── ID: 23f4315918f8 Size: 7.68kB +├── ID: d082f93a18b3 Size: 13.51MB +├── ID: 7ea8bedcac69 Size: 4.096kB +├── ID: dc3bbf7b3dc0 Size: 57.53MB +├── ID: fdbbc6404531 Size: 11.78kB +├── ID: 8d24785437c6 Size: 4.608kB +├── ID: 80715f9e8880 Size: 4.608kB Top Layer of: [docker.io/library/php:7.2-apache] +├── ID: c93cbcd6437e Size: 3.573MB +├── ID: dece674f3cd1 Size: 4.608kB +├── ID: 834f4497afda Size: 7.168kB +├── ID: bfe2ce1263f8 Size: 40.06MB +└── ID: 748e99b214cf Size: 11.78kB Top Layer of: [docker.io/library/wordpress:latest] +``` + +Show all child images and layers of the specified image: +``` +$ podman image tree ae96a4ad4f3f --whatrequires +Image ID: ae96a4ad4f3f +Tags: [docker.io/library/ruby:latest] +Size: 894.2MB +Image Layers +└── ID: 9c92106221c7 Size: 2.56kB Top Layer of: [docker.io/library/ruby\:latest] + ├── ID: 1b90f2b80ba0 Size: 3.584kB + │ ├── ID: 42b7d43ae61c Size: 169.5MB + │ ├── ID: 26dc8ba99ec3 Size: 2.048kB + │ ├── ID: b4f822db8d95 Size: 3.957MB + │ ├── ID: 044e9616ef8a Size: 164.7MB + │ ├── ID: bf94b940200d Size: 11.75MB + │ ├── ID: 4938e71bfb3b Size: 8.532MB + │ └── ID: f513034bf553 Size: 1.141MB + ├── ID: 1e55901c3ea9 Size: 3.584kB + ├── ID: b62835a63f51 Size: 169.5MB + ├── ID: 9f4e8857f3fd Size: 2.048kB + ├── ID: c3b392020e8f Size: 3.957MB + ├── ID: 880163026a0a Size: 164.8MB + ├── ID: 8c78b2b14643 Size: 11.75MB + ├── ID: 830370cfa182 Size: 8.532MB + └── ID: 567fd7b7bd38 Size: 1.141MB Top Layer of: [docker.io/circleci/ruby\\:latest] + +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +Feb 2019, Originally compiled by Kunal Kushwaha `` diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-image-trust.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-image-trust.1.md new file mode 100644 index 000000000..ae6ece9df --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-image-trust.1.md @@ -0,0 +1,211 @@ +--- +title: podman-image-trust +version: v5.4.2 +--- + +% podman-image-trust 1 + +## NAME +podman\-image\-trust - Manage container registry image trust policy + + +## SYNOPSIS +**podman image trust** set|show [*options*] *registry[/repository]* + +## DESCRIPTION +Manages which registries to trust as a source of container images based on its location. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +The location is determined +by the transport and the registry host of the image. Using this container image `docker://docker.io/library/busybox` +as an example, `docker` is the transport and `docker.io` is the registry host. + +Trust is defined in **/etc/containers/policy.json** and is enforced when a user attempts to pull +a remote image from a registry. The trust policy in policy.json describes a registry scope (registry and/or repository) for the trust. This trust can use public keys for signed images. + +The scope of the trust is evaluated from most specific to the least specific. In other words, a policy may be: + + * Defined to an entire registry. + * Defined to a particular repository in that registry. + * Defined to a specific signed image inside of the registry. + +The following list are examples of valid scope values used in policy.json from most specific to the least specific: + +docker.io/library/busybox\:notlatest + +docker.io/library/busybox + +docker.io/library + +docker.io + +If no configuration is found for any of these scopes, the default value (specified by using "default" instead of REGISTRY[/REPOSITORY]) is used. + +Trust **type** provides a way to: + +Allowlist ("accept") or +Denylist ("reject") registries or +Require a simple signing signature (“signedBy”), +Require a sigstore signature ("sigstoreSigned"). + +Trust may be updated using the command **podman image trust set** for an existing trust scope. + +## OPTIONS +#### **--help**, **-h** + Print usage statement. + +### set OPTIONS + +#### **--pubkeysfile**, **-f**=*KEY1* + A path to an exported public key on the local system. Key paths + are referenced in policy.json. Any path to a file may be used but locating the file in **/etc/pki/containers** is recommended. Options may be used multiple times to + require an image be signed by multiple keys. The **--pubkeysfile** option is required for the **signedBy** and **sigstoreSigned** types. + +#### **--type**, **-t**=*value* + The trust type for this policy entry. + Accepted values: + **signedBy** (default): Require simple signing signatures with corresponding list of + public keys + **sigstoreSigned**: Require sigstore signatures with corresponding list of + public keys + **accept**: do not require any signatures for this + registry scope + **reject**: do not accept images for this registry scope + +### show OPTIONS + +#### **--json**, **-j** + Output trust as JSON for machine parsing + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--raw** + Output trust policy file as raw JSON + +## EXAMPLES + +Accept all unsigned images from a registry: +``` +sudo podman image trust set --type accept docker.io +``` + +Modify default trust policy: +``` +sudo podman image trust set -t reject default +``` + +Display system trust policy: +``` +podman image trust show +TRANSPORT NAME TYPE ID STORE +all default reject +repository docker.io/library accept +repository registry.access.redhat.com signed security@redhat.com https://access.redhat.com/webassets/docker/content/sigstore +repository registry.redhat.io signed security@redhat.com https://registry.redhat.io/containers/sigstore +repository docker.io reject +docker-daemon accept +``` + +Display trust policy file: +``` +podman image trust show --raw +{ + "default": [ + { + "type": "reject" + } + ], + "transports": { + "docker": { + "docker.io": [ + { + "type": "reject" + } + ], + "docker.io/library": [ + { + "type": "insecureAcceptAnything" + } + ], + "registry.access.redhat.com": [ + { + "type": "signedBy", + "keyType": "GPGKeys", + "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" + } + ], + "registry.redhat.io": [ + { + "type": "signedBy", + "keyType": "GPGKeys", + "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" + } + ] + }, + "docker-daemon": { + "": [ + { + "type": "insecureAcceptAnything" + } + ] + } + } +} +``` + +Display trust as JSON: +``` +podman image trust show --json +[ + { + "transport": "all", + "name": "* (default)", + "repo_name": "default", + "type": "reject" + }, + { + "transport": "repository", + "name": "docker.io", + "repo_name": "docker.io", + "type": "reject" + }, + { + "transport": "repository", + "name": "docker.io/library", + "repo_name": "docker.io/library", + "type": "accept" + }, + { + "transport": "repository", + "name": "registry.access.redhat.com", + "repo_name": "registry.access.redhat.com", + "sigstore": "https://access.redhat.com/webassets/docker/content/sigstore", + "type": "signed", + "gpg_id": "security@redhat.com" + }, + { + "transport": "repository", + "name": "registry.redhat.io", + "repo_name": "registry.redhat.io", + "sigstore": "https://registry.redhat.io/containers/sigstore", + "type": "signed", + "gpg_id": "security@redhat.com" + }, + { + "transport": "docker-daemon", + "type": "accept" + } +] +``` + +## SEE ALSO +**[containers-policy.json(5)](https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md)** + +## HISTORY +January 2019, updated by Tom Sweeney (tsweeney at redhat dot com) +December 2018, originally compiled by Qi Wang (qiwan at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-image-unmount.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-image-unmount.1.md new file mode 100644 index 000000000..c05fdefae --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-image-unmount.1.md @@ -0,0 +1,55 @@ +--- +title: podman-image-unmount +version: v5.4.2 +--- + +% podman-image-unmount 1 + +## NAME +podman\-image\-unmount - Unmount an image's root filesystem + +## SYNOPSIS +**podman image unmount** [*options*] *image* [...] + +**podman image umount** [*options*] *image* [...] + +## DESCRIPTION +Unmounts the specified images' root file system, if no other processes +are using it. + +Image storage increments a mount counter each time an image is mounted. +When an image is unmounted, the mount counter is decremented, and the +image's root filesystem is physically unmounted only when the mount +counter reaches zero indicating no other processes are using the mount. +An unmount can be forced with the --force flag. + +## OPTIONS +#### **--all**, **-a** + +All of the currently mounted images are unmounted. + +#### **--force**, **-f** + +Force the unmounting of specified images' root file system, even if other +processes have mounted it. + +Note: Other processes using the file system can fail if the mount point is removed without their knowledge. + +## EXAMPLE + +Unmount image with a given ID: +``` +podman image unmount imageID +``` + +Unmount multiple images with given IDs: +``` +podman image unmount imageID1 imageID2 imageID3 +``` + +Unmount all images: +``` +podman image unmount --all +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image-mount(1)](podman-image-mount.1.md)**, **[podman-mount(1)](podman-mount.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-image.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-image.1.md new file mode 100644 index 000000000..814f33b56 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-image.1.md @@ -0,0 +1,45 @@ +--- +title: podman-image +version: v5.4.2 +--- + +% podman-image 1 + +## NAME +podman\-image - Manage images + +## SYNOPSIS +**podman image** *subcommand* + +## DESCRIPTION +The image command allows the management of images + +## COMMANDS + +| Command | Man Page | Description | +| -------- | --------------------------------------------------- | ----------------------------------------------------------------------- | +| build | [podman-build(1)](podman-build.1.md) | Build a container using a Dockerfile. | +| diff | [podman-image-diff(1)](podman-image-diff.1.md) | Inspect changes on an image's filesystem. | +| exists | [podman-image-exists(1)](podman-image-exists.1.md) | Check if an image exists in local storage. | +| history | [podman-history(1)](podman-history.1.md) | Show the history of an image. | +| import | [podman-import(1)](podman-import.1.md) | Import a tarball and save it as a filesystem image. | +| inspect | [podman-image-inspect(1)](podman-image-inspect.1.md)| Display an image's configuration. | +| list | [podman-images(1)](podman-images.1.md) | List the container images on the system.(alias ls) | +| load | [podman-load(1)](podman-load.1.md) | Load an image from the docker archive. | +| mount | [podman-image-mount(1)](podman-image-mount.1.md) | Mount an image's root filesystem. | +| prune | [podman-image-prune(1)](podman-image-prune.1.md) | Remove all unused images from the local store. | +| pull | [podman-pull(1)](podman-pull.1.md) | Pull an image from a registry. | +| push | [podman-push(1)](podman-push.1.md) | Push an image from local storage to elsewhere. | +| rm | [podman-rmi(1)](podman-rmi.1.md) | Remove one or more locally stored images. | +| save | [podman-save(1)](podman-save.1.md) | Save an image to docker-archive or oci. | +| scp | [podman-image-scp(1)](podman-image-scp.1.md) | Securely copy an image from one host to another. | +| search | [podman-search(1)](podman-search.1.md) | Search a registry for an image. | +| sign | [podman-image-sign(1)](podman-image-sign.1.md) | Create a signature for an image. | +| tag | [podman-tag(1)](podman-tag.1.md) | Add an additional name to a local image. | +| tree | [podman-image-tree(1)](podman-image-tree.1.md) | Print layer hierarchy of an image in a tree format. | +| trust | [podman-image-trust(1)](podman-image-trust.1.md) | Manage container registry image trust policy. | +| unmount | [podman-image-unmount(1)](podman-image-unmount.1.md) | Unmount an image's root filesystem. | +| untag | [podman-untag(1)](podman-untag.1.md) | Remove one or more names from a locally-stored image. | + +## SEE ALSO +**[podman(1)](podman.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-images.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-images.1.md new file mode 100644 index 000000000..eba7b2ec4 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-images.1.md @@ -0,0 +1,268 @@ +--- +title: podman-images +version: v5.4.2 +--- + +% podman-images 1 + +## NAME +podman\-images - List images in local storage + +## SYNOPSIS +**podman images** [*options*] [image] + +**podman image list** [*options*] [image] + +**podman image ls** [*options*] [image] + +## DESCRIPTION +Displays locally stored images, their names, and their IDs. + +## OPTIONS + +#### **--all**, **-a** + +Show all images (by default filter out the intermediate image layers). The default is false. + +#### **--digests** + +Show image digests + +#### **--filter**, **-f**=*filter* + +Provide filter values. + +The *filters* argument format is of `key=value` or `key!=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------------:|-----------------------------------------------------------------------------------------------| +| id | Filter by image ID. | +| before | Filter by images created before the given IMAGE (name or tag). | +| containers | Filter by images with a running container. | +| dangling | Filter by dangling (unused) images. | +| digest | Filter by digest. | +| intermediate | Filter by images that are dangling and have no children | +| label | Filter by images with (or without, in the case of label!=[...] is used) the specified labels. | +| manifest | Filter by images that are manifest lists. | +| readonly | Filter by read-only or read/write images. | +| reference | Filter by image name. | +| after/since | Filter by images created after the given IMAGE (name or tag). | +| until | Filter by images created until the given duration or time. | + +The `id` *filter* accepts the image ID string. + +The `before` *filter* accepts formats: `[:]`, `` or ``. + +The `containers` *filter* shows images that have a running container based on that image. + +The `dangling` *filter* shows images that are taking up disk space and serve no purpose. Dangling image is a file system layer that was used in a previous build of an image and is no longer referenced by any image. They are denoted with the `` tag, consume disk space and serve no active purpose. + +The `digest` *filter* accepts the image digest string. + +The `intermediate` *filter* shows images that are dangling and have no children. + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which shows images with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which shows images without the specified labels. + +The `manifest` *filter* shows images that are manifest lists. + +The `readonly` *filter* shows, as a default, both read-only and read/write images. Read-only images can be configured by modifying the `additionalimagestores` in the `/etc/containers/storage.conf` file. + +The `reference` *filter* accepts the pattern of an image reference `[:]`. + +The `after` or `since` *filter* accepts formats: `[:]`, `` or ``. + +The `until` *filter* accepts formats: golang duration, RFC3339 time, or a Unix timestamp and shows all images that are created until that time. + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|-----------------|------------------------------------------------------------| +| .Containers | Number of containers using this image | +| .Created | Elapsed time since the image was created | +| .CreatedAt | Time when the image was created, YYYY-MM-DD HH\:MM\:SS +nnnn | +| .CreatedSince | Same as .Created | +| .CreatedTime | Same as .CreatedAt | +| .Dangling | Same as .IsDangling | +| .Digest | Image digest | +| .History | History of the image layer | +| .ID | Image ID (truncated) | +| .Id | Image ID (full SHA) | +| .IsDangling | Is image dangling? (true/false) | +| .IsReadOnly | Is unage read-only? (true/false) | +| .Labels ... | map[] of labels | +| .Names | Image FQIN | +| .ParentId | Full SHA of parent image ID, or null (string) | +| .ReadOnly | Same as .IsReadOnly | +| .RepoDigests | map[] of zero or more repo/name@sha256\:SHA strings | +| .Repository | Image repository | +| .RepoTags | map[] of zero or more FQIN strings for this image | +| .SharedSize | Always seems to be 0 | +| .Size | Size of layer on disk (human-friendly string) | +| .Tag | Image tag | +| .VirtualSize | Size of layer on disk (bytes) | + +#### **--history** + +Display the history of image names. If an image gets re-tagged or untagged, then the image name history gets prepended (latest image first). This is especially useful when undoing a tag operation or an image does not contain any name because it has been untagged. + + +[//]: # (BEGIN included file options/no-trunc.md) +#### **--no-trunc** + +Do not truncate the output (default *false*). + +[//]: # (END included file options/no-trunc.md) + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Lists only the image IDs. + +#### **--sort**=*sort* + +Sort by *created*, *id*, *repository*, *size* or *tag* (default: **created**) +When sorting by *repository* it also sorts by the *tag* as second criteria to provide a stable output. + +## EXAMPLE + +List all non-dangling images in local storage: +``` +$ podman images +REPOSITORY TAG IMAGE ID CREATED SIZE +quay.io/podman/stable latest e0b7dabc3352 22 hours ago 331 MB +docker.io/library/alpine latest 9c6f07244728 5 days ago 5.83 MB +registry.fedoraproject.org/fedora latest 2ecb6df95994 3 weeks ago 169 MB +quay.io/libpod/testimage 20220615 f26aa69bb3f3 2 months ago 8.4 MB +``` + +List all images matching the specified name: +``` +$ podman images stable +REPOSITORY TAG IMAGE ID CREATED SIZE +quay.io/podman/stable latest e0b7dabc3352 22 hours ago 331 MB +``` + +List image ids of all images in containers storage: +``` +# podman image ls --quiet +e3d42bcaf643 +ebb91b73692b +4526339ae51c +``` + +List all images without showing the headers: +``` +# podman images --noheading +docker.io/kubernetes/pause latest e3d42bcaf643 3 years ago 251 kB + ebb91b73692b 4 weeks ago 27.2 MB +docker.io/library/ubuntu latest 4526339ae51c 6 weeks ago 126 MB +``` + +List all images without truncating output: +``` +# podman image list --no-trunc +REPOSITORY TAG IMAGE ID CREATED SIZE +docker.io/kubernetes/pause latest sha256:e3d42bcaf643097dd1bb0385658ae8cbe100a80f773555c44690d22c25d16b27 3 years ago 251 kB + sha256:ebb91b73692bd27890685846412ae338d13552165eacf7fcd5f139bfa9c2d6d9 4 weeks ago 27.2 MB +docker.io/library/ubuntu latest sha256:4526339ae51c3cdc97956a7a961c193c39dfc6bd9733b0d762a36c6881b5583a 6 weeks ago 126 MB +``` + +List all image content with the formatted content: +``` +# podman images --format "table {{.ID}} {{.Repository}} {{.Tag}}" +IMAGE ID REPOSITORY TAG +e3d42bcaf643 docker.io/kubernetes/pause latest +ebb91b73692b +4526339ae51c docker.io/library/ubuntu latest +``` + +List any image that is not tagged with a name (dangling): +``` +# podman images --filter dangling=true +REPOSITORY TAG IMAGE ID CREATED SIZE + ebb91b73692b 4 weeks ago 27.2 MB +``` + +List all images in JSON format: +``` +# podman images --format json +[ + { + "id": "e3d42bcaf643097dd1bb0385658ae8cbe100a80f773555c44690d22c25d16b27", + "names": [ + "docker.io/kubernetes/pause:latest" + ], + "digest": "sha256:0aecf73ff86844324847883f2e916d3f6984c5fae3c2f23e91d66f549fe7d423", + "created": "2014-07-19T07:02:32.267701596Z", + "size": 250665 + }, + { + "id": "ebb91b73692bd27890685846412ae338d13552165eacf7fcd5f139bfa9c2d6d9", + "names": [ + "\u003cnone\u003e" + ], + "digest": "sha256:ba7e4091d27e8114a205003ca6a768905c3395d961624a2c78873d9526461032", + "created": "2017-10-26T03:07:22.796184288Z", + "size": 27170520 + }, + { + "id": "4526339ae51c3cdc97956a7a961c193c39dfc6bd9733b0d762a36c6881b5583a", + "names": [ + "docker.io/library/ubuntu\:latest" + ], + "digest": "sha256:193f7734ddd68e0fb24ba9af8c2b673aecb0227b026871f8e932dab45add7753", + "created": "2017-10-10T20:59:05.10196344Z", + "size": 126085200 + } +] +``` + +List all images sorted by the specified column: +``` +# podman images --sort repository +REPOSITORY TAG IMAGE ID CREATED SIZE + 2460217d76fc About a minute ago 4.41 MB +docker.io/library/alpine latest 3fd9065eaf02 5 months ago 4.41 MB +localhost/myapp latest b2e0ad03474a About a minute ago 4.41 MB +registry.access.redhat.com/rhel7 latest 7a840db7f020 2 weeks ago 211 MB +registry.fedoraproject.org/fedora 27 801894bc0e43 6 weeks ago 246 MB +``` + +Show the difference between listed images in use versus all images, including dangling images: +``` +# podman images +REPOSITORY TAG IMAGE ID CREATED SIZE +localhost/test latest 18f0c080cd72 4 seconds ago 4.42 MB +docker.io/library/alpine latest 3fd9065eaf02 5 months ago 4.41 MB +# podman images -a +REPOSITORY TAG IMAGE ID CREATED SIZE +localhost/test latest 18f0c080cd72 6 seconds ago 4.42 MB + 270e70dc54c0 7 seconds ago 4.42 MB + 4ed6fbe43414 8 seconds ago 4.41 MB + 6b0df8e71508 8 seconds ago 4.41 MB +docker.io/library/alpine latest 3fd9065eaf02 5 months ago 4.41 MB +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +March 2017, Originally compiled by Dan Walsh `` diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-import.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-import.1.md new file mode 100644 index 000000000..f976eea58 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-import.1.md @@ -0,0 +1,121 @@ +--- +title: podman-import +version: v5.4.2 +--- + +% podman-import 1 + +## NAME +podman\-import - Import a tarball and save it as a filesystem image + +## SYNOPSIS +**podman import** [*options*] *path* [*reference*] + +**podman image import** [*options*] *path* [*reference*] + +## DESCRIPTION +**podman import** imports a tarball (possibly compressed using Gzip, Bzip2, XZ or Zstd) +and saves it as a filesystem image. Remote tarballs can be specified using a URL. +Various image instructions can be configured with the **--change** flag and +a commit message can be set using the **--message** flag. +**reference**, if present, is a tag to assign to the image. +**podman import** is used for importing from the archive generated by **podman export**, that includes the container's filesystem. To import the archive of image layers created by **podman save**, use **podman load**. +Note: `:` is a restricted character and cannot be part of the file name. + +## OPTIONS + +#### **--arch** + +Set architecture of the imported image. + +#### **--change**, **-c**=*instruction* + +Apply the following possible instructions to the created image: +**CMD** | **ENTRYPOINT** | **ENV** | **EXPOSE** | **LABEL** | **STOPSIGNAL** | **USER** | **VOLUME** | **WORKDIR** + +Can be set multiple times + +#### **--help**, **-h** + +Print usage statement + +#### **--message**, **-m**=*message* + +Set commit message for imported image + +#### **--os** + +Set OS of the imported image. + +#### **--quiet**, **-q** + +Shows progress on the import + +#### **--variant** + +Set variant of the imported image. + +## EXAMPLES + +Import the selected tarball into new image, specifying the CMD, ENTRYPOINT and LABEL: +``` +$ podman import --change CMD=/bin/bash --change ENTRYPOINT=/bin/sh --change LABEL=blue=image ctr.tar image-imported +Getting image source signatures +Copying blob sha256:b41deda5a2feb1f03a5c1bb38c598cbc12c9ccd675f438edc6acd815f7585b86 + 25.80 MB / 25.80 MB [======================================================] 0s +Copying config sha256:c16a6d30f3782288ec4e7521c754acc29d37155629cb39149756f486dae2d4cd + 448 B / 448 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +db65d991f3bbf7f31ed1064db9a6ced7652e3f8166c4736aa9133dadd3c7acb3 +``` + +Import the selected tarball into new image, specifying the CMD, ENTRYPOINT and LABEL: +``` +$ podman import --change 'ENTRYPOINT ["/bin/sh","-c","test-image"]' --change LABEL=blue=image test-image.tar image-imported +Getting image source signatures +Copying blob e3b0c44298fc skipped: already exists +Copying config 1105523502 done +Writing manifest to image destination +Storing signatures +110552350206337183ceadc0bdd646dc356e06514c548b69a8917b4182414b +``` + +Import new tagged image from stdin in quiet mode: +``` +$ cat ctr.tar | podman -q import --message "importing the ctr.tar file" - image-imported +db65d991f3bbf7f31ed1064db9a6ced7652e3f8166c4736aa9133dadd3c7acb3 +``` + +Import an image from stdin: +``` +$ cat ctr.tar | podman import - +Getting image source signatures +Copying blob sha256:b41deda5a2feb1f03a5c1bb38c598cbc12c9ccd675f438edc6acd815f7585b86 + 25.80 MB / 25.80 MB [======================================================] 0s +Copying config sha256:d61387b4d5edf65edee5353e2340783703074ffeaaac529cde97a8357eea7645 + 378 B / 378 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +db65d991f3bbf7f31ed1064db9a6ced7652e3f8166c4736aa9133dadd3c7acb3 +``` + +Import named image from tarball via a URL: +``` +$ podman import http://example.com/ctr.tar url-image +Downloading from "http://example.com/ctr.tar" +Getting image source signatures +Copying blob sha256:b41deda5a2feb1f03a5c1bb38c598cbc12c9ccd675f438edc6acd815f7585b86 + 25.80 MB / 25.80 MB [======================================================] 0s +Copying config sha256:5813fe8a3b18696089fd09957a12e88bda43dc1745b5240879ffffe93240d29a + 419 B / 419 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +db65d991f3bbf7f31ed1064db9a6ced7652e3f8166c4736aa9133dadd3c7acb3 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-export(1)](podman-export.1.md)** + +## HISTORY +November 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-info.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-info.1.md new file mode 100644 index 000000000..e5169760f --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-info.1.md @@ -0,0 +1,409 @@ +--- +title: podman-info +version: v5.4.2 +--- + +% podman-info 1 + +## NAME +podman\-info - Display Podman related system information + +## SYNOPSIS +**podman info** [*options*] + +**podman system info** [*options*] + +## DESCRIPTION + +Displays information pertinent to the host, current storage stats, configured container registries, and build of podman. + + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change output format to "json" or a Go template. + +| **Placeholder** | **Info pertaining to ...** | +| ------------------- | --------------------------------------- | +| .Host ... | ...the host on which podman is running | +| .Plugins ... | ...external plugins | +| .Registries ... | ...configured registries | +| .Store ... | ...the storage driver and paths | +| .Version ... | ...podman version | + +Each of the above branch out into further subfields, more than can +reasonably be enumerated in this document. + +## EXAMPLES + +Run `podman info` for a YAML formatted response: +``` +$ podman info +host: + arch: amd64 + buildahVersion: 1.23.0 + cgroupControllers: [] + cgroupManager: systemd + cgroupVersion: v2 + conmon: + package: conmon-2.0.29-2.fc34.x86_64 + path: /usr/bin/conmon + version: 'conmon version 2.0.29, commit: ' + cpu_utilization: + idle_percent: 96.84 + system_percent: 0.71 + user_percent: 2.45 + cpus: 8 + distribution: + distribution: fedora + variant: workstation + version: "34" + eventLogger: journald + hostname: localhost.localdomain + idMappings: + gidmap: + - container_id: 0 + host_id: 3267 + size: 1 + - container_id: 1 + host_id: 100000 + size: 65536 + uidmap: + - container_id: 0 + host_id: 3267 + size: 1 + - container_id: 1 + host_id: 100000 + size: 65536 + kernel: 5.13.13-200.fc34.x86_64 + linkmode: dynamic + logDriver: journald + memFree: 1833385984 + memTotal: 16401895424 + networkBackend: cni + networkBackendInfo: + backend: cni + dns: + package: podman-plugins-3.4.4-1.fc34.x86_64 + path: /usr/libexec/cni/dnsname + version: |- + CNI dnsname plugin + version: 1.3.1 + commit: unknown + package: |- + containernetworking-plugins-1.0.1-1.fc34.x86_64 + podman-plugins-3.4.4-1.fc34.x86_64 + path: /usr/libexec/cni + ociRuntime: + name: crun + package: crun-1.0-1.fc34.x86_64 + path: /usr/bin/crun + version: |- + crun version 1.0 + commit: 139dc6971e2f1d931af520188763e984d6cdfbf8 + spec: 1.0.0 + +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL + os: linux + pasta: + executable: /usr/bin/passt + package: passt-0^20221116.gace074c-1.fc34.x86_64 + version: | + passt 0^20221116.gace074c-1.fc34.x86_64 + Copyright Red Hat + GNU Affero GPL version 3 or later + This is free software: you are free to change and redistribute it. + There is NO WARRANTY, to the extent permitted by law. + remoteSocket: + path: /run/user/3267/podman/podman.sock + security: + apparmorEnabled: false + capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID + rootless: true + seccompEnabled: true + seccompProfilePath: /usr/share/containers/seccomp.json + selinuxEnabled: true + serviceIsRemote: false + slirp4netns: + executable: /bin/slirp4netns + package: slirp4netns-1.1.12-2.fc34.x86_64 + version: |- + slirp4netns version 1.1.12 + commit: 7a104a101aa3278a2152351a082a6df71f57c9a3 + libslirp: 4.4.0 + SLIRP_CONFIG_VERSION_MAX: 3 + libseccomp: 2.5.0 + swapFree: 15687475200 + swapTotal: 16886259712 + uptime: 47h 15m 9.91s (Approximately 1.96 days) +plugins: + log: + - k8s-file + - none + - journald + network: + - bridge + - macvlan + volume: + - local +registries: + search: + - registry.fedoraproject.org + - registry.access.redhat.com + - docker.io + - quay.io +store: + configFile: /home/dwalsh/.config/containers/storage.conf + containerStore: + number: 9 + paused: 0 + running: 1 + stopped: 8 + graphDriverName: overlay + graphOptions: {} + graphRoot: /home/dwalsh/.local/share/containers/storage + graphRootAllocated: 510389125120 + graphRootUsed: 129170714624 + graphStatus: + Backing Filesystem: extfs + Native Overlay Diff: "true" + Supports d_type: "true" + Using metacopy: "false" + imageCopyTmpDir: /home/dwalsh/.local/share/containers/storage/tmp + imageStore: + number: 5 + runRoot: /run/user/3267/containers + transientStore: false + volumePath: /home/dwalsh/.local/share/containers/storage/volumes +version: + APIVersion: 4.0.0 + Built: 1631648722 + BuiltTime: Tue Sep 14 15:45:22 2021 + GitCommit: 23677f92dd83e96d2bc8f0acb611865fb8b1a56d + GoVersion: go1.16.6 + OsArch: linux/amd64 + Version: 4.0.0 +``` + +Run `podman info --format json` for a JSON formatted response: +``` +$ podman info --format json +{ + "host": { + "arch": "amd64", + "buildahVersion": "1.23.0", + "cgroupManager": "systemd", + "cgroupVersion": "v2", + "cgroupControllers": [], + "conmon": { + "package": "conmon-2.0.29-2.fc34.x86_64", + "path": "/usr/bin/conmon", + "version": "conmon version 2.0.29, commit: " + }, + "cpus": 8, + "distribution": { + "distribution": "fedora", + "version": "34" + }, + "eventLogger": "journald", + "hostname": "localhost.localdomain", + "idMappings": { + "gidmap": [ + { + "container_id": 0, + "host_id": 3267, + "size": 1 + }, + { + "container_id": 1, + "host_id": 100000, + "size": 65536 + } + ], + "uidmap": [ + { + "container_id": 0, + "host_id": 3267, + "size": 1 + }, + { + "container_id": 1, + "host_id": 100000, + "size": 65536 + } + ] + }, + "kernel": "5.13.13-200.fc34.x86_64", + "logDriver": "journald", + "memFree": 1785753600, + "memTotal": 16401895424, + "networkBackend": "cni", + "networkBackendInfo": { + "backend": "cni", + "package": "containernetworking-plugins-1.0.1-1.fc34.x86_64\npodman-plugins-3.4.4-1.fc34.x86_64", + "path": "/usr/libexec/cni", + "dns": { + "version": "CNI dnsname plugin\nversion: 1.3.1\ncommit: unknown", + "package": "podman-plugins-3.4.4-1.fc34.x86_64", + "path": "/usr/libexec/cni/dnsname" + } + }, + "ociRuntime": { + "name": "crun", + "package": "crun-1.0-1.fc34.x86_64", + "path": "/usr/bin/crun", + "version": "crun version 1.0\ncommit: 139dc6971e2f1d931af520188763e984d6cdfbf8\nspec: 1.0.0\n+SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL" + }, + "os": "linux", + "remoteSocket": { + "path": "/run/user/3267/podman/podman.sock" + }, + "serviceIsRemote": false, + "security": { + "apparmorEnabled": false, + "capabilities": "CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID", + "rootless": true, + "seccompEnabled": true, + "seccompProfilePath": "/usr/share/containers/seccomp.json", + "selinuxEnabled": true + }, + "slirp4netns": { + "executable": "/bin/slirp4netns", + "package": "slirp4netns-1.1.12-2.fc34.x86_64", + "version": "slirp4netns version 1.1.12\ncommit: 7a104a101aa3278a2152351a082a6df71f57c9a3\nlibslirp: 4.4.0\nSLIRP_CONFIG_VERSION_MAX: 3\nlibseccomp: 2.5.0" + }, + "pasta": { + "executable": "/usr/bin/passt", + "package": "passt-0^20221116.gace074c-1.fc34.x86_64", + "version": "passt 0^20221116.gace074c-1.fc34.x86_64\nCopyright Red Hat\nGNU Affero GPL version 3 or later \u003chttps://www.gnu.org/licenses/agpl-3.0.html\u003e\nThis is free software: you are free to change and redistribute it.\nThere is NO WARRANTY, to the extent permitted by law.\n" + }, + "swapFree": 15687475200, + "swapTotal": 16886259712, + "uptime": "47h 17m 29.75s (Approximately 1.96 days)", + "linkmode": "dynamic" + }, + "store": { + "configFile": "/home/dwalsh/.config/containers/storage.conf", + "containerStore": { + "number": 9, + "paused": 0, + "running": 1, + "stopped": 8 + }, + "graphDriverName": "overlay", + "graphOptions": { + + }, + "graphRoot": "/home/dwalsh/.local/share/containers/storage", + "graphStatus": { + "Backing Filesystem": "extfs", + "Native Overlay Diff": "true", + "Supports d_type": "true", + "Using metacopy": "false" + }, + "imageCopyTmpDir": "/home/dwalsh/.local/share/containers/storage/tmp", + "imageStore": { + "number": 5 + }, + "runRoot": "/run/user/3267/containers", + "volumePath": "/home/dwalsh/.local/share/containers/storage/volumes", + "transientStore": false + }, + "registries": { + "search": [ + "registry.fedoraproject.org", + "registry.access.redhat.com", + "docker.io", + "quay.io" +] + }, + "plugins": { + "volume": [ + "local" + ], + "network": [ + "bridge", + "macvlan" + ], + "log": [ + "k8s-file", + "none", + "journald" + ] + }, + "version": { + "APIVersion": "4.0.0", + "Version": "4.0.0", + "GoVersion": "go1.16.6", + "GitCommit": "23677f92dd83e96d2bc8f0acb611865fb8b1a56d", + "BuiltTime": "Tue Sep 14 15:45:22 2021", + "Built": 1631648722, + "OsArch": "linux/amd64" + } +} +``` + +#### Extracting the list of container registries with a Go template + +If shell completion is enabled, type `podman info --format={{.` and then press `[TAB]` twice. + +``` +$ podman info --format={{. +{{.Host. {{.Plugins. {{.Registries}} {{.Store. {{.Version. +``` + +Press `R` `[TAB]` `[ENTER]` to print the registries information. + +``` +$ podman info -f {{.Registries}} +map[search:[registry.fedoraproject.org registry.access.redhat.com docker.io quay.io]] +$ +``` + +The output still contains a map and an array. The map value can be extracted with + +``` +$ podman info -f '{{index .Registries "search"}}' +[registry.fedoraproject.org registry.access.redhat.com docker.io quay.io] +``` + +The array can be printed as one entry per line + +``` +$ podman info -f '{{range index .Registries "search"}}{{.}}\n{{end}}' +registry.fedoraproject.org +registry.access.redhat.com +docker.io +quay.io + +``` + +#### Extracting the list of container registries from JSON with jq + +The command-line JSON processor [__jq__](https://stedolan.github.io/jq/) can be used to extract the list +of container registries. + +``` +$ podman info -f json | jq '.registries["search"]' +[ + "registry.fedoraproject.org", + "registry.access.redhat.com", + "docker.io", + "quay.io" +] +``` + +The array can be printed as one entry per line + +``` +$ podman info -f json | jq -r '.registries["search"] | .[]' +registry.fedoraproject.org +registry.access.redhat.com +docker.io +quay.io +``` + +Note, the Go template struct fields start with upper case. When running `podman info` or `podman info --format=json`, the same names start with lower case. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-init.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-init.1.md new file mode 100644 index 000000000..cc6ba3c85 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-init.1.md @@ -0,0 +1,61 @@ +--- +title: podman-init +version: v5.4.2 +--- + +% podman-init 1 + +## NAME +podman\-init - Initialize one or more containers + +## SYNOPSIS +**podman init** [*options*] *container* [*container*...] + +**podman container init** [*options*] *container* [*container*...] + +## DESCRIPTION +Initialize one or more containers. +You may use container IDs or names as input. +Initializing a container performs all tasks necessary for starting the container (mounting filesystems, creating an OCI spec, initializing the container network) but does not start the container. +If a container is not initialized, the `podman start` and `podman run` commands initialize it automatically prior to starting it. +This command is intended to be used for inspecting a container's filesystem or OCI spec prior to starting it. +This can be used to inspect the container before it runs, or debug why a container is failing to run. + +## OPTIONS + +#### **--all**, **-a** + +Initialize all containers. Containers that have already initialized (including containers that have been started and are running) are ignored. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Initialize specified container with a given ID. +``` +podman init 35480fc9d568 +``` + +Initialize specified container with a given name. +``` +podman init test1 +``` + +Initialize the latest container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +podman init --latest +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-start(1)](podman-start.1.md)** + +## HISTORY +April 2019, Originally compiled by Matthew Heon diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-inspect.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-inspect.1.md new file mode 100644 index 000000000..7207c51e7 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-inspect.1.md @@ -0,0 +1,185 @@ +--- +title: podman-inspect +version: v5.4.2 +--- + +% podman-inspect 1 + +## NAME +podman\-inspect - Display a container, image, volume, network, or pod's configuration + +## SYNOPSIS +**podman inspect** [*options*] *name* [...] + +## DESCRIPTION + +This displays the low-level information on containers and images identified by name or ID. By default, this renders +all results in a JSON array. If the inspect type is all, the order of inspection is: containers, images, volumes, network, pods. + If a container has the same name as an image, then the container JSON is returned, and so on. + If a format is specified, the given template is executed for each result. + +For more inspection options, see also +[podman-container-inspect(1)](podman-container-inspect.1.md), +[podman-image-inspect(1)](podman-image-inspect.1.md), +[podman-network-inspect(1)](podman-network-inspect.1.md), +[podman-pod-inspect(1)](podman-pod-inspect.1.md), and +[podman-volume-inspect(1)](podman-volume-inspect.1.md). + +## OPTIONS + +#### **--format**, **-f**=*format* + +Format the output using the given Go template. +The keys of the returned JSON can be used as the values for the --format flag (see examples below). + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--size**, **-s** + +In addition to normal output, display the total file size if the type is a container. + +#### **--type**, **-t**=*type* + +Return JSON for the specified type. Type can be 'container', 'image', 'volume', 'network', 'pod', or 'all' (default: all) +(Only meaningful when invoked as *podman inspect*) + +## EXAMPLE + +Inspect the fedora image: +``` +# podman inspect fedora +[ + { + "Id": "f0858ad3febdf45bb2e5501cb459affffacef081f79eaa436085c3b6d9bd46ca", + "Digest": "sha256:d4f7df6b691d61af6cee7328f82f1d8afdef63bc38f58516858ae3045083924a", + "RepoTags": [ + "docker.io/library/fedora:latest" + ], + "RepoDigests": [ + "docker.io/library/fedora@sha256:8fa60b88e2a7eac8460b9c0104b877f1aa0cea7fbc03c701b7e545dacccfb433", + "docker.io/library/fedora@sha256:d4f7df6b691d61af6cee7328f82f1d8afdef63bc38f58516858ae3045083924a" + ], + "Parent": "", + "Comment": "", + "Created": "2019-10-29T03:23:37.695123423Z", + "Config": { + "Env": [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "DISTTAG=f31-updates-candidatecontainer", + "FGC=f31-updates-candidate", + "FBR=f31-updates-candidate" + ], + "Cmd": [ + "/bin/bash" + ], + "Labels": { + "maintainer": "Clement Verna \u003ccverna@fedoraproject.org\u003e" + } + }, + "Version": "18.06.1-ce", + "Author": "", + "Architecture": "amd64", + "Os": "linux", + "Size": 201096840, + "VirtualSize": 201096840, + "GraphDriver": { + "Name": "overlay", + "Data": { + "UpperDir": "/home/user/.local/share/containers/storage/overlay/2ae3cee18c8ef9e0d448649747dab81c4f1ca2714a8c4550eff49574cab262c9/diff", + "WorkDir": "/home/user/.local/share/containers/storage/overlay/2ae3cee18c8ef9e0d448649747dab81c4f1ca2714a8c4550eff49574cab262c9/work" + } + }, + "RootFS": { + "Type": "layers", + "Layers": [ + "sha256:2ae3cee18c8ef9e0d448649747dab81c4f1ca2714a8c4550eff49574cab262c9" + ] + }, + "Labels": { + "maintainer": "Clement Verna \u003ccverna@fedoraproject.org\u003e" + }, + "Annotations": {}, + "ManifestType": "application/vnd.docker.distribution.manifest.v2+json", + "User": "", + "History": [ + { + "created": "2019-01-16T21:21:55.569693599Z", + "created_by": "/bin/sh -c #(nop) LABEL maintainer=Clement Verna \u003ccverna@fedoraproject.org\u003e", + "empty_layer": true + }, + { + "created": "2019-09-27T21:21:07.784469821Z", + "created_by": "/bin/sh -c #(nop) ENV DISTTAG=f31-updates-candidatecontainer FGC=f31-updates-candidate FBR=f31-updates-candidate", + "empty_layer": true + }, + { + "created": "2019-10-29T03:23:37.355187998Z", + "created_by": "/bin/sh -c #(nop) ADD file:298f828afc880ccde9205fc4418435d5e696ad165e283f0530d0b1a74326d6dc in / " + }, + { + "created": "2019-10-29T03:23:37.695123423Z", + "created_by": "/bin/sh -c #(nop) CMD [\"/bin/bash\"]", + "empty_layer": true + } + ], + "NamesHistory": [] + } +] +``` + +Inspect the specified image with the `ImageName` format specifier: +``` +# podman inspect a04 --format "{{.ImageName}}" +fedora +``` + +Inspect the specified image for `GraphDriver` format specifier: +``` +# podman inspect a04 --format "{{.GraphDriver.Name}}" +overlay +``` + +Inspect the specified image for its `Size` format specifier: +``` +# podman image inspect --format "size: {{.Size}}" alpine +size: 4405240 +``` + +Inspect the latest container created for `EffectiveCaps` format specifier. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman container inspect --latest --format {{.EffectiveCaps}} +[CAP_CHOWN CAP_DAC_OVERRIDE CAP_FSETID CAP_FOWNER CAP_SETGID CAP_SETUID CAP_SETFCAP CAP_SETPCAP CAP_NET_BIND_SERVICE CAP_KILL] +``` + +Inspect the specified pod for the `Name` format specifier: +``` +# podman inspect myPod --type pod --format "{{.Name}}" +myPod +``` + +Inspect the specified volume for the `Name` format specifier: +``` +# podman inspect myVolume --type volume --format "{{.Name}}" +myVolume +``` + +Inspect the specified network for the `Name` format specifier: +``` +# podman inspect nyNetwork --type network --format "{{.name}}" +myNetwork +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container-inspect(1)](podman-container-inspect.1.md)**, **[podman-image-inspect(1)](podman-image-inspect.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-pod-inspect(1)](podman-pod-inspect.1.md)**, **[podman-volume-inspect(1)](podman-volume-inspect.1.md)** + +## HISTORY +July 2017, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-kill.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-kill.1.md new file mode 100644 index 000000000..9a0c6e7d9 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-kill.1.md @@ -0,0 +1,91 @@ +--- +title: podman-kill +version: v5.4.2 +--- + +% podman-kill 1 + +## NAME +podman\-kill - Kill the main process in one or more containers + +## SYNOPSIS +**podman kill** [*options*] [*container* ...] + +**podman container kill** [*options*] [*container* ...] + +## DESCRIPTION +The main process inside each container specified is sent SIGKILL or any signal specified with the `--signal` option. + +## OPTIONS +#### **--all**, **-a** + +Signal all running and paused containers. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and kill the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/signal.md) +#### **--signal**, **-s**=**signal** + +Signal to send to the container. For more information on Linux signals, refer to *signal(7)*. +The default is **SIGKILL**. + +[//]: # (END included file options/signal.md) + +## EXAMPLE + +Kill container with a given name: +``` +podman kill mywebserver +``` + +Kill container with a given ID: +``` +podman kill 860a4b23 +``` + +Terminate container by sending `TERM` signal: +``` +podman kill --signal TERM 860a4b23 +``` + +Kill the latest container. (This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines): +``` +podman kill --latest +``` + +Terminate all containers by sending `KILL` signal: +``` +podman kill --signal KILL -a +``` + +Kill containers using ID specified in a given files: +``` +podman kill --cidfile /home/user/cidfile-1 +podman kill --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-stop(1)](podman-stop.1.md)** + +## HISTORY +September 2017, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-kube-apply.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-kube-apply.1.md new file mode 100644 index 000000000..9d439543c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-kube-apply.1.md @@ -0,0 +1,79 @@ +--- +title: podman-kube-apply +version: v5.4.2 +--- + +% podman-kube-apply 1 + +## NAME +podman-kube-apply - Apply Kubernetes YAML based on containers, pods, or volumes to a Kubernetes cluster + +## SYNOPSIS +**podman kube apply** [*options*] [*container...* | *pod...* | *volume...*] + +## DESCRIPTION +**podman kube apply** deploys a podman container, pod, or volume to a Kubernetes cluster. Use the `--file` option to deploy a Kubernetes YAML (v1 specification) to a Kubernetes cluster as well. + +Note that the Kubernetes YAML file can be used to run the deployment in Podman via podman-play-kube(1). + +## OPTIONS + +#### **--ca-cert-file**=*ca cert file path | "insecure"* + +The path to the CA cert file for the Kubernetes cluster. Usually the kubeconfig has the CA cert file data and `generate kube` automatically picks that up if it is available in the kubeconfig. If no CA cert file data is available, set this to `insecure` to bypass the certificate verification. + +#### **--file**, **-f**=*kube yaml filepath* + +Path to the kubernetes yaml file to deploy onto the kubernetes cluster. This file can be generated using the `podman kube generate` command. The input may be in the form of a yaml file, or stdin. For stdin, use `--file=-`. + +#### **--kubeconfig**, **-k**=*kubeconfig filepath* + +Path to the kubeconfig file to be used when deploying the generated kube yaml to the Kubernetes cluster. The environment variable `KUBECONFIG` can be used to set the path for the kubeconfig file as well. +Note: A kubeconfig can have multiple cluster configurations, but `kube generate` always picks the first cluster configuration in the given kubeconfig. + +#### **--ns**=*namespace* + +The namespace or project to deploy the workloads of the generated kube yaml to in the Kubernetes cluster. + +#### **--service**, **-s** + +Used to create a service for the corresponding container or pod being deployed to the cluster. In particular, if the container or pod has portmap bindings, the service specification includes a NodePort declaration to expose the service. A random port is assigned by Podman in the service specification that is deployed to the cluster. + +## EXAMPLES + +Apply a podman volume and container to the "default" namespace in a Kubernetes cluster. +``` +$ podman kube apply --kubeconfig /tmp/kubeconfig myvol vol-test-1 +Deploying to cluster... +Successfully deployed workloads to cluster! +$ kubectl get pods +NAME READY STATUS RESTARTS AGE +vol-test-1-pod 1/1 Running 0 9m +``` + +Apply a Kubernetes YAML file to the "default" namespace in a Kubernetes cluster. +``` +$ podman kube apply --kubeconfig /tmp/kubeconfig -f vol.yaml +Deploying to cluster... +Successfully deployed workloads to cluster! +$ kubectl get pods +NAME READY STATUS RESTARTS AGE +vol-test-2-pod 1/1 Running 0 9m +``` + +Apply a Kubernetes YAML file to the "test1" namespace in a Kubernetes cluster. +``` +$ podman kube apply --kubeconfig /tmp/kubeconfig --ns test1 vol-test-3 +Deploying to cluster... +Successfully deployed workloads to cluster! +$ kubectl get pods --namespace test1 +NAME READY STATUS RESTARTS AGE +vol-test-3-pod 1/1 Running 0 9m + +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)** + +## HISTORY +September 2022, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-kube-down.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-kube-down.1.md new file mode 100644 index 000000000..ad646ec4f --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-kube-down.1.md @@ -0,0 +1,76 @@ +--- +title: podman-kube-down +version: v5.4.2 +--- + +% podman-kube-down 1 + +## NAME +podman-kube-down - Remove containers and pods based on Kubernetes YAML + +## SYNOPSIS +**podman kube down** [*options*] *file.yml|-|https://website.io/file.yml* + +## DESCRIPTION +**podman kube down** reads a specified Kubernetes YAML file, tearing down pods that were created by the `podman kube play` command via the same Kubernetes YAML +file. Any volumes that were created by the previous `podman kube play` command remain intact unless the `--force` options is used. If the YAML file is +specified as `-`, `podman kube down` reads the YAML from stdin. The input can also be a URL that points to a YAML file such as https://podman.io/demo.yml. +`podman kube down` tears down the pods and containers created by `podman kube play` via the same Kubernetes YAML from the URL. However, +`podman kube down` does not work with a URL if the YAML file the URL points to has been changed or altered since the creation of the pods and containers using +`podman kube play`. + +## OPTIONS + +#### **--force** + +Tear down the volumes linked to the PersistentVolumeClaims as part --down + +## EXAMPLES + +Example YAML file `demo.yml`: +``` +apiVersion: v1 +kind: Pod +metadata: +... +spec: + containers: + - command: + - top + - name: container + value: podman + image: foobar +... +``` + +Remove the pod and containers as described in the `demo.yml` file +``` +$ podman kube down demo.yml +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Remove the pod and containers as described in the `demo.yml` file YAML sent to stdin +``` +$ cat demo.yml | podman kube play - +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Remove the pods and containers as described in the `demo.yml` file YAML read from a URL +``` +$ podman kube down https://podman.io/demo.yml +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` +`podman kube down` does not work with a URL if the YAML file the URL points to has been changed +or altered since it was used to create the pods and containers. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-kube(1)](podman-kube.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-kube-generate.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-kube-generate.1.md new file mode 100644 index 000000000..012c4ac46 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-kube-generate.1.md @@ -0,0 +1,254 @@ +--- +title: podman-kube-generate +version: v5.4.2 +--- + +% podman-kube-generate 1 + +## NAME +podman-kube-generate - Generate Kubernetes YAML based on containers, pods or volumes + +## SYNOPSIS +**podman kube generate** [*options*] *container...* | *pod...* | *volume...* + +## DESCRIPTION +**podman kube generate** generates Kubernetes YAML (v1 specification) from Podman containers, pods or volumes. Regardless of whether +the input is for containers or pods, Podman generates the specification as a Pod by default. The input may be in the form +of one or more containers, pods or volumes names or IDs. + +`Podman Containers or Pods` + +Volumes appear in the generated YAML according to two different volume types. Bind-mounted volumes become *hostPath* volume types and named volumes become *persistentVolumeClaim* volume types. Generated *hostPath* volume types are one of three subtypes depending on the state of the host path: *DirectoryOrCreate* when no file or directory exists at the host, *Directory* when host path is a directory, or *File* when host path is a file. The value for *claimName* for a *persistentVolumeClaim* is the name of the named volume registered in Podman. + +Potential name conflicts between volumes are avoided by using a standard naming scheme for each volume type. The *hostPath* volume types are named according to the path on the host machine, replacing forward slashes with hyphens less any leading and trailing forward slashes. The special case of the filesystem root, `/`, translates to the name `root`. Additionally, the name is suffixed with `-host` to avoid naming conflicts with *persistentVolumeClaim* volumes. Each *persistentVolumeClaim* volume type uses the name of its associated named volume suffixed with `-pvc`. + +Note that if an init container is created with type `once` and the pod has been started, it does not show up in the generated kube YAML as `once` type init containers are deleted after they are run. If the pod has only been created and not started, it is in the generated kube YAML. +Init containers created with type `always` are always generated in the kube YAML as they are never deleted, even after running to completion. + +*Note*: When using volumes and generating a Kubernetes YAML for an unprivileged and rootless podman container on an **SELinux enabled system**, one of the following options must be completed: + * Add the "privileged: true" option to the pod spec + * Add `type: spc_t` under the `securityContext` `seLinuxOptions` in the pod spec + * Relabel the volume via the CLI command `chcon -t container_file_t -R ` + +Once completed, the correct permissions are in place to access the volume when the pod/container is created in a Kubernetes cluster. + +Note that the generated Kubernetes YAML file can be used to re-run the deployment via podman-play-kube(1). + +Note that if the pod being generated was created with the **--infra-name** flag set, then the generated kube yaml will have the **io.podman.annotations.infra.name** set where the value is the name of the infra container set by the user. + +Note that both Deployment and DaemonSet can only have `restartPolicy` set to `Always`. + +Note that Job can only have `restartPolicy` set to `OnFailure` or `Never`. By default, podman sets it to `Never` when generating a kube yaml using `kube generate`. + +## OPTIONS + +#### **--filename**, **-f**=*filename* + +Output to the given file instead of STDOUT. If the file already exists, `kube generate` refuses to replace it and returns an error. + +#### **--podman-only** + +Add podman-only reserved annotations in generated YAML file (Cannot be used by Kubernetes) + +#### **--replicas**, **-r**=*replica count* + +The value to set `replicas` to when generating a **Deployment** kind. +Note: this can only be set with the option `--type=deployment`. + +#### **--service**, **-s** + +Generate a Kubernetes service object in addition to the Pods. Used to generate a Service specification for the corresponding Pod output. In particular, if the object has portmap bindings, the service specification includes a NodePort declaration to expose the service. A random port is assigned by Podman in the specification. + +#### **--type**, **-t**=*pod* | *deployment* | *daemonset* | *job* + +The Kubernetes kind to generate in the YAML file. Currently, the only supported Kubernetes specifications are `Pod`, `Deployment`, `Job`, and `DaemonSet`. By default, the `Pod` specification is generated. + +## EXAMPLES + +Create Kubernetes Pod YAML for the specified container. +``` +$ podman kube generate some-mariadb +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-4.8.2 + +# NOTE: If you generated this yaml from an unprivileged and rootless podman container on an SELinux +# enabled system, check the podman generate kube man page for steps to follow to ensure that your pod/container +# has the right permissions to access the volumes added. +--- +apiVersion: v1 +kind: Pod +metadata: + creationTimestamp: "2024-01-09T02:24:55Z" + labels: + app: some-mariadb-pod + name: some-mariadb-pod +spec: + containers: + - args: + - mariadbd + env: + - name: MARIADB_ROOT_PASSWORD + value: x + image: docker.io/library/mariadb:10.11 + name: some-mariadb + ports: + - containerPort: 3306 + hostPort: 34891 + volumeMounts: + - mountPath: /var/lib/mysql + name: mariadb_data-pvc + volumes: + - name: mariadb_data-pvc + persistentVolumeClaim: + claimName: mariadb_data +``` + +Create Kubernetes Deployment YAML with 3 replicas for the specified container. +``` +$ podman kube generate --type deployment --replicas 3 dep-ct +r +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-4.5.0-dev +apiVersion: apps/v1 +kind: Deployment +metadata: + creationTimestamp: "2023-03-27T20:45:08Z" + labels: + app: dep-ctr-pod + name: dep-ctr-pod-deployment +spec: + replicas: 3 + selector: + matchLabels: + app: dep-ctr-pod + template: + metadata: + annotations: + io.podman.annotations.ulimit: nofile=524288:524288,nproc=127332:127332 + creationTimestamp: "2023-03-27T20:45:08Z" + labels: + app: dep-ctr-pod + name: dep-ctr-pod + spec: + containers: + - command: + - top + image: docker.io/library/alpine:latest + name: dep-ctr +``` + + +Create Kubernetes Pod YAML for the specified container with the host directory `/home/user/my-data` bind-mounted onto the container path `/volume`. +``` +$ podman kube generate my-container-with-bind-mounted-data +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-3.1.0-dev +apiVersion: v1 +kind: Pod +metadata: + creationTimestamp: "2021-03-18T16:26:08Z" + labels: + app: my-container-with-bind-mounted-data + name: my-container-with-bind-mounted-data +spec: + containers: + - command: + - /bin/sh + image: docker.io/library/alpine:latest + name: test-bind-mount + volumeMounts: + - mountPath: /volume + name: home-user-my-data-host + restartPolicy: Never + volumes: + - hostPath: + path: /home/user/my-data + type: Directory + name: home-user-my-data-host +``` + +Create Kubernetes Pod YAML for the specified container with named volume `priceless-data` mounted onto the container path `/volume`. +``` +$ podman kube generate my-container-using-priceless-data +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-3.1.0-dev +apiVersion: v1 +kind: Pod +metadata: + creationTimestamp: "2021-03-18T16:26:08Z" + labels: + app: my-container-using-priceless-data + name: my-container-using-priceless-data +spec: + containers: + - command: + - /bin/sh + image: docker.io/library/alpine:latest + name: test-bind-mount + volumeMounts: + - mountPath: /volume + name: priceless-data-pvc + restartPolicy: Never + volumes: + - name: priceless-data-pvc + persistentVolumeClaim: + claimName: priceless-data +``` + +Create Kubernetes Pod YAML for the specified pod and include a service. +``` +$ sudo podman kube generate -s demoweb +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-0.12.2-dev +apiVersion: v1 +kind: Pod +metadata: + creationTimestamp: 2018-12-18T15:16:06Z + labels: + app: demoweb + name: demoweb-libpod +spec: + containers: + - command: + - python3 + - /root/code/graph.py + image: quay.io/baude/demoweb:latest + name: practicalarchimedes + tty: true + workingDir: /root/code +--- +apiVersion: v1 +kind: Service +metadata: + creationTimestamp: 2018-12-18T15:16:06Z + labels: + app: demoweb + name: demoweb-libpod +spec: + ports: + - name: "8050" + nodePort: 31269 + port: 8050 + targetPort: 0 + selector: + app: demoweb + type: NodePort +status: + loadBalancer: {} +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-down(1)](podman-kube-down.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-kube-play.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-kube-play.1.md new file mode 100644 index 000000000..279421199 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-kube-play.1.md @@ -0,0 +1,813 @@ +--- +title: podman-kube-play +version: v5.4.2 +--- + +% podman-kube-play 1 + +## NAME +podman-kube-play - Create containers, pods and volumes based on Kubernetes YAML + +## SYNOPSIS +**podman kube play** [*options*] *file.yml|-|https://website.io/file.yml* + +## DESCRIPTION +**podman kube play** reads in a structured file of Kubernetes YAML. It recreates the containers, pods, or volumes described in the YAML. Containers within a pod are then started, and the ID of the new Pod or the name of the new Volume is output. If the YAML file is specified as "-", then `podman kube play` reads the YAML file from stdin. +The input can also be a URL that points to a YAML file such as https://podman.io/demo.yml. `podman kube play` reads the YAML from the URL and create pods and containers from it. + +Using the `--down` command line option, it is also capable of tearing down the pods created by a previous run of `podman kube play`. + +Using the `--replace` command line option, it tears down the pods(if any) created by a previous run of `podman kube play` and recreate the pods with the Kubernetes YAML file. + +Ideally the input file is created by the Podman command (see podman-kube-generate(1)). This guarantees a smooth import and expected results. + +Currently, the supported Kubernetes kinds are: + +- Pod +- Deployment +- PersistentVolumeClaim +- ConfigMap +- Secret +- DaemonSet +- Job + +`Kubernetes Pods or Deployments` + +Only four volume types are supported by kube play, the *hostPath*, *emptyDir*, *persistentVolumeClaim*, and *image* volume types. + +- When using the *hostPath* volume type, only the *default (empty)*, *DirectoryOrCreate*, *Directory*, *FileOrCreate*, *File*, *Socket*, *CharDevice* and *BlockDevice* subtypes are supported. Podman interprets the value of *hostPath* *path* as a file path when it contains at least one forward slash, otherwise Podman treats the value as the name of a named volume. +- When using a *persistentVolumeClaim*, the value for *claimName* is the name for the Podman named volume. +- When using an *emptyDir* volume, Podman creates an anonymous volume that is attached the containers running inside the pod and is deleted once the pod is removed. +- When using an *image* volume, Podman creates a read-only image volume with an empty subpath (the whole image is mounted). The image must already exist locally. It is supported in rootful mode only. + +Note: The default restart policy for containers is `always`. You can change the default by setting the `restartPolicy` field in the spec. + +Note: When playing a kube YAML with init containers, the init container is created with init type value `once`. To change the default type, use the `io.podman.annotations.init.container.type` annotation to set the type to `always`. + +Note: *hostPath* volume types created by kube play is given an SELinux shared label (z), bind mounts are not relabeled (use `chcon -t container_file_t -R `). + +Note: To set userns of a pod, use the **io.podman.annotations.userns** annotation in the pod/deployment definition. For example, **io.podman.annotations.userns=keep-id** annotation tells Podman to create a user namespace where the current rootless user's UID\:GID are mapped to the same values in the container. This can be overridden with the `--userns` flag. + +Note: Use the **io.podman.annotations.volumes-from** annotation to bind mount volumes of one container to another. You can mount volumes from multiple source containers to a target container. The source containers that belong to the same pod must be defined before the source container in the kube YAML. The annotation format is `io.podman.annotations.volumes-from/targetContainer: "sourceContainer1\:mountOpts1;sourceContainer2:mountOpts2"`. + +Note: If the `:latest` tag is used, Podman attempts to pull the image from a registry. If the image was built locally with Podman or Buildah, it has `localhost` as the domain, in that case, Podman uses the image from the local store even if it has the `\:latest` tag. + +Note: The command `podman play kube` is an alias of `podman kube play`, and performs the same function. + +Note: The command `podman kube down` can be used to stop and remove pods or containers based on the same Kubernetes YAML used +by `podman kube play` to create them. + +Note: To customize the name of the infra container created during `podman kube play`, use the **io.podman.annotations.infra.name** annotation in the pod definition. This annotation is automatically set when generating a kube yaml from a pod that was created with the `--infra-name` flag set. + +`Kubernetes PersistentVolumeClaims` + +A Kubernetes PersistentVolumeClaim represents a Podman named volume. Only the PersistentVolumeClaim name is required by Podman to create a volume. Kubernetes annotations can be used to make use of the available options for Podman volumes. + +- volume.podman.io/driver +- volume.podman.io/device +- volume.podman.io/type +- volume.podman.io/uid +- volume.podman.io/gid +- volume.podman.io/mount-options +- volume.podman.io/import-source +- volume.podman.io/image + +Use `volume.podman.io/import-source` to import the contents of the tarball (.tar, .tar.gz, .tgz, .bzip, .tar.xz, .txz) specified in the annotation's value into the created Podman volume + +Kube play is capable of building images on the fly given the correct directory layout and Containerfiles. This +option is not available for remote clients, including Mac and Windows (excluding WSL2) machines, yet. Consider the following excerpt from a YAML file: +``` +apiVersion: v1 +kind: Pod +metadata: +... +spec: + containers: + - name: container + image: foobar +... +``` + +If there is a directory named `foobar` in the current working directory with a file named `Containerfile` or `Dockerfile`, +Podman kube play builds that image and name it `foobar`. An example directory structure for this example looks +like: +``` +|- mykubefiles + |- myplayfile.yaml + |- foobar + |- Containerfile +``` + +The build considers `foobar` to be the context directory for the build. If there is an image in local storage +called `foobar`, the image is not built unless the `--build` flag is used. Use `--build=false` to completely +disable builds. + +Kube play supports CDI (Container Device Interface) device selectors to share +host devices (e.g. GPUs) with containers. The configuration format follows +Kubernetes extended resource management: +``` +apiVersion: v1 +kind: Pod +spec: + containers: + - name: container + resources: + limits: + nvidia.com/gpu=all: 1 +``` + +To enable sharing host devices, analogous to using the `--device` flag Podman +kube supports a custom CDI selector: `podman.io/device=`. + +`Kubernetes ConfigMap` + +Kubernetes ConfigMap can be referred as a source of environment variables or volumes in Pods or Deployments. +ConfigMaps aren't a standalone object in Podman; instead, when a container uses a ConfigMap, Podman creates environment variables or volumes as needed. + +For example, the following YAML document defines a ConfigMap and then uses it in a Pod: + +``` +apiVersion: v1 +kind: ConfigMap +metadata: + name: foo +data: + FOO: bar +--- +apiVersion: v1 +kind: Pod +metadata: + name: foobar +spec: + containers: + - name: container-1 + image: foobar + envFrom: + - configMapRef: + name: foo + optional: false +``` + +and as a result environment variable `FOO` is set to `bar` for container `container-1`. + +`Kubernetes Secret` + +Kubernetes Secret represents a Podman named secret. The Kubernetes Secret is saved as a whole and may be referred to as a source of environment variables or volumes in Pods or Deployments. + +For example, the following YAML document defines a Secret and then uses it in a Pod: + +``` +kind: Secret +apiVersion: v1 +metadata: + name: foo +data: + foo: YmFy # base64 for bar +--- +apiVersion: v1 +kind: Pod +metadata: + name: foobar +spec: + containers: + - name: container-1 + image: foobar + env: + - name: FOO + valueFrom: + secretKeyRef: + name: foo + key: foo +``` + +and as a result environment variable `FOO` is set to `bar` for container `container-1`. + +`Automounting Volumes (deprecated)` + +Note: The automounting annotation is deprecated. Kubernetes has [native support for image volumes](https://kubernetes.io/docs/tasks/configure-pod-container/image-volumes/) and that should be used rather than this podman-specific annotation. + +An image can be automatically mounted into a container if the annotation `io.podman.annotations.kube.image.automount/$ctrname` is given. The following rules apply: + +- The image must already exist locally. +- The image must have at least 1 volume directive. +- The path given by the volume directive will be mounted from the image into the container. For example, an image with a volume at `/test/test_dir` will have `/test/test_dir` in the image mounted to `/test/test_dir` in the container. +- Multiple images can be specified. If multiple images have a volume at a specific path, the last image specified trumps. +- The images are always mounted read-only. +- Images to mount are defined in the annotation "io.podman.annotations.kube.image.automount/$ctrname" as a semicolon-separated list. They are mounted into a single container in the pod, not the whole pod. The annotation can be specified for additional containers if additional mounts are required. + +## OPTIONS + + +[//]: # (BEGIN included file options/annotation.container.md) +#### **--annotation**=*key=value* + +Add an annotation to the container or pod. This option can be set multiple times. + +[//]: # (END included file options/annotation.container.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + +#### **--build** + +Build images even if they are found in the local storage. Use `--build=false` to completely disable builds. (This option is not available with the remote Podman client) + +Note: You can also override the default isolation type by setting the BUILDAH_ISOLATION environment variable. export BUILDAH_ISOLATION=oci. See podman-build.1.md for more information. + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + +#### **--configmap**=*path* + +Use Kubernetes configmap YAML at path to provide a source for environment variable values within the containers of the pod. (This option is not available with the remote Podman client) + +Note: The *--configmap* option can be used multiple times or a comma-separated list of paths can be used to pass multiple Kubernetes configmap YAMLs. +The YAML file may be in a multi-doc YAML format. But, it must container only configmaps + +#### **--context-dir**=*path* + +Use *path* as the build context directory for each image. Requires --build option be true. (This option is not available with the remote Podman client) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + +#### **--force** + +Tear down the volumes linked to the PersistentVolumeClaims as part of --down + +#### **--help**, **-h** + +Print usage statement + +#### **--ip**=*IP address* + +Assign a static ip address to the pod. This option can be specified several times when kube play creates more than one pod. +Note: When joining multiple networks use the **--network name\:ip=\** syntax. + +#### **--log-driver**=*driver* + +Set logging driver for all created containers. + + +[//]: # (BEGIN included file options/log-opt.md) +#### **--log-opt**=*name=value* + +Logging driver specific options. + +Set custom logging configuration. The following *name*s are supported: + +**path**: specify a path to the log file + (e.g. **--log-opt path=/var/log/container/mycontainer.json**); + +**max-size**: specify a max size of the log file + (e.g. **--log-opt max-size=10mb**); + +**tag**: specify a custom log tag for the container + (e.g. **--log-opt tag="{{.ImageName}}"**. +It supports the same keys as **podman inspect --format**. +This option is currently supported only by the **journald** log driver. + +[//]: # (END included file options/log-opt.md) + +#### **--mac-address**=*MAC address* + +Assign a static mac address to the pod. This option can be specified several times when kube play creates more than one pod. +Note: When joining multiple networks use the **--network name\:mac=\** syntax. + + +[//]: # (BEGIN included file options/network.md) +#### **--network**=*mode*, **--net** + +Set the network mode for the pod. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured, to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.md) + +When no network option is specified and *host* network mode is not configured in the YAML file, a new network stack is created and pods are attached to it making possible pod to pod communication. + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the pod. + +Podman assumes control over the pod's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with host added in the Kubernetes YAML. + +#### **--publish**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Define or override a port definition in the YAML file. + +The lists of ports in the YAML file and the command line are merged. Matching is done by using the **containerPort** field. +If **containerPort** exists in both the YAML file and the option, the latter takes precedence. + +#### **--publish-all** + +Setting this option to `true` will expose all ports to the host, +even if only specified via **containerPort** in the K8 YAML. +In terms of which port will be exposed, **--publish** has higher priority than **hostPort**, has higher priority than +**containerPort**. + +If set to `false` (which is the default), only ports defined via **hostPort** +or **--publish** are published on the host. + +#### **--quiet**, **-q** + +Suppress output information when pulling images + +#### **--replace** + +Tears down the pods created by a previous run of `kube play` and recreates the pods. This option is used to keep the existing pods up to date based upon the Kubernetes YAML. + +#### **--seccomp-profile-root**=*path* + +Directory path for seccomp profiles (default: "/var/lib/kubelet/seccomp"). (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +#### **--start** + +Start the pod after creating it, set to false to only create it. + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/userns.container.md) +#### **--userns**=*mode* + +Set the user namespace mode for the container. + +If `--userns` is not set, the default value is determined as follows. +- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used. +- If the environment variable **PODMAN_USERNS** is set its value is used. +- If `userns` is specified in `containers.conf` this value is used. +- Otherwise, `--userns=host` is assumed. + +`--userns=""` (i.e., an empty string) is an alias for `--userns=host`. + +This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +------------------------|-----------|--------------------- +auto | $UID | nil (Host User UID is not mapped into container.) +host | $UID | 0 (Default User account mapped to root user in container.) +keep-id | $UID | $UID (Map user account to same UID within container.) +keep-id\:uid=200,gid=210 | $UID | 200:210 (Map user account to specified UID, GID value within container.) +nomap | $UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + +**auto**[\:_OPTIONS,..._]: automatically create a unique user namespace. + +* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. + + Example: `containers:2147483647:2147483648`. + +* `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5). + +Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user IDs. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. + +The option `--userns=keep-id` uses all the subuids and subgids of the user. +The option `--userns=nomap` uses all the subuids and subgids of the user except the user's own ID. +Using `--userns=auto` when starting new containers does not work as long as any containers exist that were started with `--userns=nomap` or `--userns=keep-id` without limiting the user namespace size. + + Valid `auto` options: + + - *gidmapping*=_CONTAINER\_GID\:HOST\_GID\:SIZE_: to force a GID mapping to be present in the user namespace. + - *size*=_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates a size for the user namespace. + - *uidmapping*=_CONTAINER\_UID\:HOST\_UID\:SIZE_: to force a UID mapping to be present in the user namespace. + +The host UID and GID in *gidmapping* and *uidmapping* can optionally be prefixed with the `@` symbol. +In this case, podman will look up the intermediate ID corresponding to host ID and it will map the found intermediate ID to the container id. +For details see **--uidmap**. + +**container:**_id_: join the user namespace of the specified container. + +**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user. + +**keep-id**: creates a user namespace where the current user's UID\:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace. + + Valid `keep-id` options: + + - *uid*=UID: override the UID inside the container that is used to map the current user to. + - *gid*=GID: override the GID inside the container that is used to map the current user to. + - *size*=SIZE: override the size of the configured user namespace. It is useful to not saturate all the available IDs. Not supported when running as root. + +**nomap**: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +**ns:**_namespace_: run the pod in the given existing user namespace. + +[//]: # (END included file options/userns.container.md) + +#### **--wait**, **-w** + +Run pods and containers in the foreground. Default is false. + +At any time you can run `podman pod ps` in another shell to view a list of +the running pods and containers. + +When attached in the tty mode, you can kill the pods and containers by pressing +Ctrl-C or receiving any other interrupt signals. + +All pods, containers, and volumes created with `podman kube play` is removed +upon exit. + +## EXAMPLES + +Recreate the pod and containers described in the specified host YAML file. +``` +$ podman kube play demo.yml +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Recreate the pod and containers specified in a YAML file sent to stdin. +``` +$ cat demo.yml | podman kube play - +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Tear down the pod and containers as described in the specified YAML file. +``` +$ podman kube play --down demo.yml +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Provide multiple configmap files as sources for environment variables within the specified pods and containers. +``` +$ podman kube play demo.yml --configmap configmap-foo.yml,configmap-bar.yml +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 + +$ podman kube play demo.yml --configmap configmap-foo.yml --configmap configmap-bar.yml +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Create a pod connected to two networks with a static ip on each. +``` +$ podman kube play demo.yml --network net1\:ip=10.89.1.5 --network net2\:ip=10.89.10.10 +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` +Please take into account that networks must be created first using podman-network-create(1). + +Create and teardown from a URL pointing to a YAML file. +``` +$ podman kube play https://podman.io/demo.yml +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 + +$ podman kube play --down https://podman.io/demo.yml +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` +`podman kube play --down` does not work with a URL if the YAML file the URL points to +has been changed or altered. + + +[//]: # (BEGIN included file ../../kubernetes_support.md) +# Podman Kube Play Support + +This document outlines the kube yaml fields that are currently supported by the **podman kube play** command. + +Note: **N/A** means that the option cannot be supported in a single-node Podman environment. + +## Pod Fields + +| Field | Support | +|-----------------------------------------------------|---------| +| containers | ✅ | +| initContainers | ✅ | +| imagePullSecrets | no | +| enableServiceLinks | no | +| os\.name | no | +| volumes | ✅ | +| nodeSelector | N/A | +| nodeName | N/A | +| affinity\.nodeAffinity | N/A | +| affinity\.podAffinity | N/A | +| affinity\.podAntiAffinity | N/A | +| tolerations\.key | N/A | +| tolerations\.operator | N/A | +| tolerations\.effect | N/A | +| tolerations\.tolerationSeconds | N/A | +| schedulerName | N/A | +| runtimeClassName | no | +| priorityClassName | no | +| priority | no | +| topologySpreadConstraints\.maxSkew | N/A | +| topologySpreadConstraints\.topologyKey | N/A | +| topologySpreadConstraints\.whenUnsatisfiable | N/A | +| topologySpreadConstraints\.labelSelector | N/A | +| topologySpreadConstraints\.minDomains | N/A | +| restartPolicy | ✅ | +| terminationGracePeriodSeconds | ✅ | +| activeDeadlineSeconds | no | +| readinessGates\.conditionType | no | +| hostname | ✅ | +| setHostnameAsFQDN | no | +| subdomain | no | +| hostAliases\.hostnames | ✅ | +| hostAliases\.ip | ✅ | +| dnsConfig\.nameservers | ✅ | +| dnsConfig\.options\.name | ✅ | +| dnsConfig\.options\.value | ✅ | +| dnsConfig\.searches | ✅ | +| dnsPolicy | no | +| hostNetwork | ✅ | +| hostPID | ✅ | +| hostIPC | ✅ | +| shareProcessNamespace | ✅ | +| serviceAccountName | no | +| automountServiceAccountToken | no | +| securityContext\.runAsUser | ✅ | +| securityContext\.runAsNonRoot | no | +| securityContext\.runAsGroup | ✅ | +| securityContext\.supplementalGroups | ✅ | +| securityContext\.fsGroup | no | +| securityContext\.fsGroupChangePolicy | no | +| securityContext\.seccompProfile\.type | no | +| securityContext\.seccompProfile\.localhostProfile | no | +| securityContext\.seLinuxOptions\.level | ✅ | +| securityContext\.seLinuxOptions\.role | ✅ | +| securityContext\.seLinuxOptions\.type | ✅ | +| securityContext\.seLinuxOptions\.user | ✅ | +| securityContext\.sysctls\.name | ✅ | +| securityContext\.sysctls\.value | ✅ | +| securityContext\.windowsOptions\.gmsaCredentialSpec | no | +| securityContext\.windowsOptions\.hostProcess | no | +| securityContext\.windowsOptions\.runAsUserName | no | + +## Container Fields + +| Field | Support | +|-----------------------------------------------------|---------| +| name | ✅ | +| image | ✅ | +| imagePullPolicy | ✅ | +| command | ✅ | +| args | ✅ | +| workingDir | ✅ | +| ports\.containerPort | ✅ | +| ports\.hostIP | ✅ | +| ports\.hostPort | ✅ | +| ports\.name | ✅ | +| ports\.protocol | ✅ | +| env\.name | ✅ | +| env\.value | ✅ | +| env\.valueFrom\.configMapKeyRef\.key | ✅ | +| env\.valueFrom\.configMapKeyRef\.name | ✅ | +| env\.valueFrom\.configMapKeyRef\.optional | ✅ | +| env\.valueFrom\.fieldRef | ✅ | +| env\.valueFrom\.resourceFieldRef | ✅ | +| env\.valueFrom\.secretKeyRef\.key | ✅ | +| env\.valueFrom\.secretKeyRef\.name | ✅ | +| env\.valueFrom\.secretKeyRef\.optional | ✅ | +| envFrom\.configMapRef\.name | ✅ | +| envFrom\.configMapRef\.optional | ✅ | +| envFrom\.prefix | no | +| envFrom\.secretRef\.name | ✅ | +| envFrom\.secretRef\.optional | ✅ | +| volumeMounts\.mountPath | ✅ | +| volumeMounts\.name | ✅ | +| volumeMounts\.mountPropagation | no | +| volumeMounts\.readOnly | ✅ | +| volumeMounts\.subPath | ✅ | +| volumeMounts\.subPathExpr | no | +| volumeDevices\.devicePath | no | +| volumeDevices\.name | no | +| resources\.limits | ✅ | +| resources\.requests | ✅ | +| lifecycle\.postStart | no | +| lifecycle\.preStop | no | +| terminationMessagePath | no | +| terminationMessagePolicy | no | +| livenessProbe | ✅ | +| readinessProbe | no | +| startupProbe | no | +| securityContext\.runAsUser | ✅ | +| securityContext\.runAsNonRoot | no | +| securityContext\.runAsGroup | ✅ | +| securityContext\.readOnlyRootFilesystem | ✅ | +| securityContext\.procMount | ✅ | +| securityContext\.privileged | ✅ | +| securityContext\.allowPrivilegeEscalation | ✅ | +| securityContext\.capabilities\.add | ✅ | +| securityContext\.capabilities\.drop | ✅ | +| securityContext\.seccompProfile\.type | no | +| securityContext\.seccompProfile\.localhostProfile | no | +| securityContext\.seLinuxOptions\.level | ✅ | +| securityContext\.seLinuxOptions\.role | ✅ | +| securityContext\.seLinuxOptions\.type | ✅ | +| securityContext\.seLinuxOptions\.user | ✅ | +| securityContext\.windowsOptions\.gmsaCredentialSpec | no | +| securityContext\.windowsOptions\.hostProcess | no | +| securityContext\.windowsOptions\.runAsUserName | no | +| stdin | no | +| stdinOnce | no | +| tty | no | + +## PersistentVolumeClaim Fields + +| Field | Support | +|---------------------|---------| +| volumeName | no | +| storageClassName | ✅ | +| volumeMode | no | +| accessModes | ✅ | +| selector | no | +| resources\.limits | no | +| resources\.requests | ✅ | + +## ConfigMap Fields + +| Field | Support | +|------------|---------| +| binaryData | ✅ | +| data | ✅ | +| immutable | no | + +## Deployment Fields + +| Field | Support | +|-----------------------------------------|-------------------------------------------------------| +| replicas | ✅ (the actual replica count is ignored and set to 1) | +| selector | ✅ | +| template | ✅ | +| minReadySeconds | no | +| strategy\.type | no | +| strategy\.rollingUpdate\.maxSurge | no | +| strategy\.rollingUpdate\.maxUnavailable | no | +| revisionHistoryLimit | no | +| progressDeadlineSeconds | no | +| paused | no | + +## DaemonSet Fields + +| Field | Support | +|-----------------------------------------|---------| +| selector | ✅ | +| template | ✅ | +| minReadySeconds | no | +| strategy\.type | no | +| strategy\.rollingUpdate\.maxSurge | no | +| strategy\.rollingUpdate\.maxUnavailable | no | +| revisionHistoryLimit | no | + +## Job Fields + +| Field | Support | +|-------------------------|----------------------------------| +| activeDeadlineSeconds | no | +| selector | no (automatically set by k8s) | +| template | ✅ | +| backoffLimit | no | +| completionMode | no | +| completions | no (set to 1 with kube generate) | +| manualSelector | no | +| parallelism | no (set to 1 with kube generate) | +| podFailurePolicy | no | +| suspend | no | +| ttlSecondsAfterFinished | no | + +[//]: # (END included file ../../kubernetes_support.md) + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-kube(1)](podman-kube.1.md)**, **[podman-kube-down(1)](podman-kube-down.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)**, **[podman-build(1)](podman-build.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-kube.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-kube.1.md new file mode 100644 index 000000000..707e37b91 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-kube.1.md @@ -0,0 +1,35 @@ +--- +title: podman-kube +version: v5.4.2 +--- + +% podman-kube 1 + +## NAME +podman\-kube - Play containers, pods or volumes based on a structured input file + +## SYNOPSIS +**podman kube** *subcommand* + +## DESCRIPTION +The kube command recreates containers, pods or volumes based on the input from a structured (like YAML) +file input. Containers are automatically started. + +Note: The kube commands in podman focus on simplifying the process of moving containers from podman to a Kubernetes +environment and from a Kubernetes environment back to podman. Podman is not replicating the kubectl CLI. Once containers +are deployed to a Kubernetes cluster from podman, please use `kubectl` to manage the workloads in the cluster. + +## COMMANDS + +| Command | Man Page | Description | +| ------- | ---------------------------------------------------- | ----------------------------------------------------------------------------- | +| apply | [podman-kube-apply(1)](podman-kube-apply.1.md) | Apply Kubernetes YAML based on containers, pods, or volumes to a Kubernetes cluster | +| down | [podman-kube-down(1)](podman-kube-down.1.md) | Remove containers and pods based on Kubernetes YAML. | +| generate | [podman-kube-generate(1)](podman-kube-generate.1.md) | Generate Kubernetes YAML based on containers, pods or volumes. | +| play | [podman-kube-play(1)](podman-kube-play.1.md) | Create containers, pods and volumes based on Kubernetes YAML. | + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-down(1)](podman-kube-down.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)**, **[podman-kube-apply(1)](podman-kube-apply.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-load.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-load.1.md new file mode 100644 index 000000000..1c3d4001e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-load.1.md @@ -0,0 +1,92 @@ +--- +title: podman-load +version: v5.4.2 +--- + +% podman-load 1 + +## NAME +podman\-load - Load image(s) from a tar archive into container storage + +## SYNOPSIS +**podman load** [*options*] + +**podman image load** [*options*] + +## DESCRIPTION +**podman load** loads an image from either an **oci-archive** or a **docker-archive** stored on the local machine into container storage. **podman load** reads from stdin by default or a file if the **input** option is set. +**podman load** is used for loading from the archive generated by **podman save**, that includes the image parent layers. To load the archive of container's filesystem created by **podman export**, use **podman import**. + +The local client further supports loading an **oci-dir** or a **docker-dir** as created with **podman save** (1). + +The **quiet** option suppresses the progress output when set. +Note: `:` is a restricted character and cannot be part of the file name. + + +**podman [GLOBAL OPTIONS]** + +**podman load [GLOBAL OPTIONS]** + +**podman load [OPTIONS]** + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--input**, **-i**=*input* + +Load the specified input file instead of from stdin. The file can be on the local file system or on a server (e.g., https://server.com/archive.tar). Also supports loading in compressed files. + +The remote client, including Mac and Windows (excluding WSL2) machines, requires the use of this option. + +NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of container images. Podman defaults to use `/var/tmp`. + +#### **--quiet**, **-q** + +Suppress the progress output + +## EXAMPLES + +Create an image from a compressed tar file, without showing progress. +``` +$ podman load --quiet -i fedora.tar.gz +``` + +Create an image from the archive.tar file pulled from a URL, without showing progress. +``` +$ podman load -q -i https://server.com/archive.tar +``` + +Create an image from stdin using bash redirection from a tar file. +``` +$ podman load < fedora.tar +Getting image source signatures +Copying blob sha256:5bef08742407efd622d243692b79ba0055383bbce12900324f75e56f589aedb0 + 0 B / 4.03 MB [---------------------------------------------------------------] +Copying config sha256:7328f6f8b41890597575cbaadc884e7386ae0acc53b747401ebce5cf0d624560 + 0 B / 1.48 KB [---------------------------------------------------------------] +Writing manifest to image destination +Storing signatures +Loaded image: registry.fedoraproject.org/fedora:latest +``` + +Create an image from stdin using a pipe. +``` +$ cat fedora.tar | podman load +Getting image source signatures +Copying blob sha256:5bef08742407efd622d243692b79ba0055383bbce12900324f75e56f589aedb0 + 0 B / 4.03 MB [---------------------------------------------------------------] +Copying config sha256:7328f6f8b41890597575cbaadc884e7386ae0acc53b747401ebce5cf0d624560 + 0 B / 1.48 KB [---------------------------------------------------------------] +Writing manifest to image destination +Storing signatures +Loaded image: registry.fedoraproject.org/fedora:latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-save(1)](podman-save.1.md)** + +## HISTORY +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-login.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-login.1.md new file mode 100644 index 000000000..3d4a6fb34 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-login.1.md @@ -0,0 +1,188 @@ +--- +title: podman-login +version: v5.4.2 +--- + +% podman-login 1 + +## NAME +podman\-login - Log in to a container registry + +## SYNOPSIS +**podman login** [*options*] [*registry*] + +## DESCRIPTION +**podman login** logs into a specified registry server with the correct username +and password. If the registry is not specified, the first registry under [registries.search] +from registries.conf is used. **podman login** reads in the username and password from STDIN. +The username and password can also be set using the **username** and **password** flags. +The path of the authentication file can be specified by the user by setting the **authfile** +flag. The default path for reading and writing credentials is **${XDG\_RUNTIME\_DIR}/containers/auth.json**. +Podman uses existing credentials if the user does not pass in a username. +Podman first searches for the username and password in the **${XDG\_RUNTIME\_DIR}/containers/auth.json**, if they are not valid, +Podman then uses any existing credentials found in **$HOME/.docker/config.json**. +If those credentials are not present, Podman creates **${XDG\_RUNTIME\_DIR}/containers/auth.json** (if the file does not exist) and +then stores the username and password from STDIN as a base64 encoded string in it. +For more details about format and configurations of the auth.json file, see containers-auth.json(5) + +**podman [GLOBAL OPTIONS]** + +**podman login [GLOBAL OPTIONS]** + +**podman login [OPTIONS] [REGISTRY] [GLOBAL OPTIONS]** + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/compat-auth-file.md) +#### **--compat-auth-file**=*path* + +Instead of updating the default credentials file, update the one at *path*, and use a Docker-compatible format. + +[//]: # (END included file options/compat-auth-file.md) + +#### **--get-login** + +Return the logged-in user for the registry. Return error if no login is found. + +#### **--help**, **-h** + +Print usage statement + +#### **--password**, **-p**=*password* + +Password for registry + +#### **--password-stdin** + +Take the password from stdin + +#### **--secret**=*name* + +Read the password for the registry from the podman secret `name`. +If --username is not specified --username=`name` is used. + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +#### **--username**, **-u**=*username* + +Username for registry + +#### **--verbose**, **-v** + +print detailed information about credential store + +## EXAMPLES + +Add login credentials for specified registry to default authentication file; +note that unlike the `docker` default, the default credentials are under `$XDG_RUNTIME_DIR` +which is a subdirectory of `/run` (an emphemeral directory) and hence do not persist across reboot. + +``` +$ podman login quay.io +Username: umohnani +Password: +Login Succeeded! +``` + +To explicitly preserve credentials across reboot, you will need to specify +the default persistent path: + +``` +$ podman login --authfile ~/.config/containers/auth.json quay.io +Username: umohnani +Password: +Login Succeeded! +``` + +Add login credentials using specified username and password for local registry to default authentication file. +``` +$ podman login -u testuser -p testpassword localhost:5000 +Login Succeeded! +``` + +Add login credentials for alternate authfile path for the specified registry. +``` +$ podman login --authfile authdir/myauths.json quay.io +Username: umohnani +Password: +Login Succeeded! +``` + +Add login credentials using a Podman secret for the password. +``` +$ echo -n MySecret! | podman secret create secretname - +a0ad54df3c97cf89d5ca6193c +$ podman login --secret secretname -u testuser quay.io +Login Succeeded! +``` + +Add login credentials for user test with password test to localhost:5000 registry disabling tls verification requirement. +``` +$ podman login --tls-verify=false -u test -p test localhost:5000 +Login Succeeded! +``` + +Add login credentials for user foo with password bar to localhost:5000 registry using the certificate directory /etc/containers/certs.d. +``` +$ podman login --cert-dir /etc/containers/certs.d/ -u foo -p bar localhost:5000 +Login Succeeded! +``` + +Add login credentials for specified registries to default authentication file for given user with password information provided via stdin from a file on disk. +``` +$ podman login -u testuser --password-stdin < testpassword.txt docker.io +Login Succeeded! +``` + +Add login credentials for specified registry to default authentication file for given user with password information provided via stdin from a pipe. +``` +$ echo $testpassword | podman login -u testuser --password-stdin quay.io +Login Succeeded! +``` + +Add login credentials for specified registry to default authentication file in verbose mode. +``` +$ podman login quay.io --verbose +Username: myusername +Password: +Used: /run/user/1000/containers/auth.json +Login Succeeded! +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-logout(1)](podman-logout.1.md)**, **[containers-auth.json(5)](https://github.com/containers/image/blob/main/docs/containers-auth.json.5.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[podman-secret(1)](podman-secret.1.md)**, **[podman-secret-create(1)](podman-secret-create.1.md)** + +## HISTORY +August 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-logout.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-logout.1.md new file mode 100644 index 000000000..b30a53bdd --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-logout.1.md @@ -0,0 +1,77 @@ +--- +title: podman-logout +version: v5.4.2 +--- + +% podman-logout 1 + +## NAME +podman\-logout - Log out of a container registry + +## SYNOPSIS +**podman logout** [*options*] *registry* + +## DESCRIPTION +**podman logout** logs out of a specified registry server by deleting the cached credentials +stored in the **auth.json** file. If the registry is not specified, the first registry under [registries.search] +from registries.conf is used. The path of the authentication file can be overridden by the user by setting the **authfile** flag. +The default path used is **${XDG\_RUNTIME\_DIR}/containers/auth.json**. For more details about format and configurations of the auth,json file, see containers-auth.json(5) +All the cached credentials can be removed by setting the **all** flag. + +**podman [GLOBAL OPTIONS]** + +**podman logout [GLOBAL OPTIONS]** + +**podman logout [OPTIONS] REGISTRY [GLOBAL OPTIONS]** + +## OPTIONS + +#### **--all**, **-a** + +Remove the cached credentials for all registries in the auth file + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/compat-auth-file.md) +#### **--compat-auth-file**=*path* + +Instead of updating the default credentials file, update the one at *path*, and use a Docker-compatible format. + +[//]: # (END included file options/compat-auth-file.md) + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Remove login credentials for the docker.io registry from the authentication file: +``` +$ podman logout docker.io +``` + +Remove login credentials for the docker.io registry from the authdir/myauths.json file: +``` +$ podman logout --authfile authdir/myauths.json docker.io +``` + +Remove login credentials for all registries: +``` +$ podman logout --all +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-auth.json(5)](https://github.com/containers/image/blob/main/docs/containers-auth.json.5.md)** + +## HISTORY +August 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-logs.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-logs.1.md new file mode 100644 index 000000000..c5aa70fd8 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-logs.1.md @@ -0,0 +1,173 @@ +--- +title: podman-logs +version: v5.4.2 +--- + +% podman-logs 1 + +## NAME +podman\-logs - Display the logs of one or more containers + +## SYNOPSIS +**podman logs** [*options*] *container* [*container...*] + +**podman container logs** [*options*] *container* [*container...*] + +## DESCRIPTION +The podman logs command batch-retrieves whatever logs are present for one or more containers at the time of execution. +This does not guarantee execution order when combined with podman run (i.e. the run may not have generated +any logs at the time podman logs was executed). + +## OPTIONS + + +[//]: # (BEGIN included file options/color.md) +#### **--color** + +Output the containers with different colors in the log. + +[//]: # (END included file options/color.md) + + +[//]: # (BEGIN included file options/follow.md) +#### **--follow**, **-f** + +Follow log output. Default is false. + +Note: When following a container which is removed by `podman container rm` +or removed on exit (`podman run --rm ...`), there is a chance that the log +file is removed before `podman logs` reads the final content. + +[//]: # (END included file options/follow.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/names.md) +#### **--names**, **-n** + +Output the container names instead of the container IDs in the log. + +[//]: # (END included file options/names.md) + + +[//]: # (BEGIN included file options/since.md) +#### **--since**=*TIMESTAMP* + +Show logs since TIMESTAMP. The --since option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. + +[//]: # (END included file options/since.md) + + +[//]: # (BEGIN included file options/tail.md) +#### **--tail**=*LINES* + +Output the specified number of LINES at the end of the logs. LINES must be an integer. Defaults to -1, +which prints all lines + +[//]: # (END included file options/tail.md) + + +[//]: # (BEGIN included file options/timestamps.md) +#### **--timestamps**, **-t** + +Show timestamps in the log outputs. The default is false + +[//]: # (END included file options/timestamps.md) + + +[//]: # (BEGIN included file options/until.md) +#### **--until**=*TIMESTAMP* + +Show logs until TIMESTAMP. The --until option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. + +[//]: # (END included file options/until.md) + +## EXAMPLE + +To view a container's logs: +``` +podman logs -t b3f2436bdb978c1d33b1387afb5d7ba7e3243ed2ce908db431ac0069da86cb45 + +2017/08/07 10:16:21 Seeked /var/log/crio/pods/eb296bd56fab164d4d3cc46e5776b54414af3bf543d138746b25832c816b933b/c49f49788da14f776b7aa93fb97a2a71f9912f4e5a3e30397fca7dfe0ee0367b.log - &{Offset:0 Whence:0} +1:C 07 Aug 14:10:09.055 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo +1:C 07 Aug 14:10:09.055 # Redis version=4.0.1, bits=64, commit=00000000, modified=0, pid=1, just started +1:C 07 Aug 14:10:09.055 # Warning: no config file specified, using the default config. In order to specify a config file use redis-server /path/to/redis.conf +1:M 07 Aug 14:10:09.055 # You requested maxclients of 10000 requiring at least 10032 max file descriptors. +1:M 07 Aug 14:10:09.055 # Server can't set maximum open files to 10032 because of OS error: Operation not permitted. +1:M 07 Aug 14:10:09.055 # Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit. If you need higher maxclients increase 'ulimit -n'. +1:M 07 Aug 14:10:09.056 * Running mode=standalone, port=6379. +1:M 07 Aug 14:10:09.056 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. +1:M 07 Aug 14:10:09.056 # Server initialized +``` + +To view only the last two lines in container's log: +``` +podman logs --tail 2 b3f2436bdb97 + +# WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. +# Server initialized +``` + +To view all containers logs: +``` +podman logs -t --since 0 myserver + +1:M 07 Aug 14:10:09.055 # Server can't set maximum open files to 10032 because of OS error: Operation not permitted. +1:M 07 Aug 14:10:09.055 # Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit. If you need higher maxclients increase 'ulimit -n'. +1:M 07 Aug 14:10:09.056 * Running mode=standalone, port=6379. +1:M 07 Aug 14:10:09.056 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. +1:M 07 Aug 14:10:09.056 # Server initialized +``` + +To view a container's logs since a certain time: +``` +podman logs -t --since 2017-08-07T10:10:09.055837383-04:00 myserver + +1:M 07 Aug 14:10:09.055 # Server can't set maximum open files to 10032 because of OS error: Operation not permitted. +1:M 07 Aug 14:10:09.055 # Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit. If you need higher maxclients increase 'ulimit -n'. +1:M 07 Aug 14:10:09.056 * Running mode=standalone, port=6379. +1:M 07 Aug 14:10:09.056 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. +1:M 07 Aug 14:10:09.056 # Server initialized +``` + +To view a container's logs generated in the last 10 minutes: +``` +podman logs --since 10m myserver + +# Server can't set maximum open files to 10032 because of OS error: Operation not permitted. +# Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit, Increase 'ulimit -n' when higher maxclients are required. +``` + +To view a container's logs until 30 minutes ago: +``` +podman logs --until 30m myserver + +AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.0.2.100. Set the 'ServerName' directive globally to suppress this message +AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.0.2.100. Set the 'ServerName' directive globally to suppress this message +[Tue Jul 20 13:18:14.223727 2021] [mpm_event:notice] [pid 1:tid 140021067187328] AH00489: Apache/2.4.48 (Unix) configured -- resuming normal operations +[Tue Jul 20 13:18:14.223819 2021] [core:notice] [pid 1:tid 140021067187328] AH00094: Command line: 'httpd -D FOREGROUND' +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-rm(1)](podman-rm.1.md)** + +## HISTORY +February 2018, Updated by Brent Baude + +August 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-machine-info.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-machine-info.1.md new file mode 100644 index 000000000..7711c8ca6 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-machine-info.1.md @@ -0,0 +1,107 @@ +--- +title: podman-machine-info +version: v5.4.2 +--- + +% podman-machine-info 1 + +## NAME +podman\-machine\-info - Display machine host info + +## SYNOPSIS +**podman machine info** + +## DESCRIPTION + +Display information pertaining to the machine host. +Rootless only, as all `podman machine` commands can be only be used with rootless Podman. + +*Note*: The `DefaultMachine` field in the `Host` output does not suggest that +one can set a default podman machine via system connections. This value represents +the current active system connection associated with a podman machine. Regardless +of the default system connection, the default podman machine will always be +`podman-machine-default`. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change output format to "json" or a Go template. + +| **Placeholder** | **Description** | +| ------------------- | --------------------------------- | +| .Host ... | Host information for local machine| +| .Version ... | Version of the machine | + +#### **--help** + +Print usage statement. + +## EXAMPLES + +Display default Podman machine info. +``` +$ podman machine info +Host: + Arch: amd64 + CurrentMachine: "" + DefaultMachine: "" + EventsDir: /run/user/3267/podman + MachineConfigDir: /home/myusername/.config/containers/podman/machine/qemu + MachineImageDir: /home/myusername/.local/share/containers/podman/machine/qemu + MachineState: "" + NumberOfMachines: 0 + OS: linux + VMType: qemu +Version: + APIVersion: 4.4.0 + Built: 1677097848 + BuiltTime: Wed Feb 22 15:30:48 2023 + GitCommit: aa196c0d5c9abd5800edf9e27587c60343a26c2b-dirty + GoVersion: go1.20 + Os: linux + OsArch: linux/amd64 + Version: 4.4.0 +``` + +Display default Podman machine info formatted as json. +``` +$ podman machine info --format json +{ + "Host": { + "Arch": "amd64", + "CurrentMachine": "", + "DefaultMachine": "", + "EventsDir": "/run/user/3267/podman", + "MachineConfigDir": "/home/myusername/.config/containers/podman/machine/qemu", + "MachineImageDir": "/home/myusername/.local/share/containers/podman/machine/qemu", + "MachineState": "", + "NumberOfMachines": 0, + "OS": "linux", + "VMType": "qemu" + }, + "Version": { + "APIVersion": "4.4.0", + "Version": "4.4.0", + "GoVersion": "go1.20", + "GitCommit": "aa196c0d5c9abd5800edf9e27587c60343a26c2b-dirty", + "BuiltTime": "Wed Feb 22 15:30:48 2023", + "Built": 1677097848, + "OsArch": "linux/amd64", + "Os": "linux" + } +} +``` + +Display default Podman machine Host.Arch field. +``` +$ podman machine info --format "{{ .Host.Arch }}" +amd64 + +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +June 2022, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-machine-init.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-machine-init.1.md new file mode 100644 index 000000000..a886920a3 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-machine-init.1.md @@ -0,0 +1,250 @@ +--- +title: podman-machine-init +version: v5.4.2 +--- + +% podman-machine-init 1 + +## NAME +podman\-machine\-init - Initialize a new virtual machine + +## SYNOPSIS +**podman machine init** [*options*] [*name*] + +## DESCRIPTION + +Initialize a new virtual machine for Podman. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then the new machine will be named `podman-machine-default`. + +Rootless only. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +**podman machine init** initializes a new Linux virtual machine where containers are run. +SSH keys are automatically generated to access the VM, and system connections to the root account +and a user account inside the VM are added. + +By default, the VM distribution is [Fedora CoreOS](https://getfedora.org/en/coreos?stream=testing) except for +WSL which is based on a custom Fedora image. While Fedora CoreOS upgrades come out every 14 days, the automatic +update mechanism Zincata is disabled by Podman machine. + +To check if there is an upgrade available for your machine os, you can run the following command: + +``` +$ podman machine ssh 'sudo rpm-ostree upgrade --check' + +``` +If an update is available, you can rerun the above command and remove the `--check` and your operating system will +be updated. After updating, you must stop and start your machine with `podman machine stop && podman machine start` for +it to take effect. + +Note: Updating as described above can result in version mismatches between Podman on the host and Podman in the +machine. Executing `podman info` should reveal versions of both. A configuration where the Podman host and machine +mismatch are unsupported. + +For more information on updates and advanced configuration, +see the Fedora CoreOS documentation about [auto-updates](https://docs.fedoraproject.org/en-US/fedora-coreos/auto-updates/) and [update strategies](https://coreos.github.io/zincati/usage/updates-strategy/). + + + + +Fedora CoreOS upgrades come out every 14 days and are detected and installed automatically. The VM is rebooted during the upgrade. +For more information on updates and advanced configuration, +see the Fedora CoreOS documentation about [auto-updates](https://docs.fedoraproject.org/en-US/fedora-coreos/auto-updates/) and [update strategies](https://coreos.github.io/zincati/usage/updates-strategy/). + +Default Podman machine settings can be set via the [machine] section in the containers.conf(5) file. + +## OPTIONS + +#### **--cpus**=*number* + +Number of CPUs. + +#### **--disk-size**=*number* + +Size of the disk for the guest VM in GiB. + +#### **--help** + +Print usage statement. + +#### **--ignition-path** + +Fully qualified path of the ignition file. + +If an ignition file is provided, the file +is copied into the user's CONF_DIR and renamed. Additionally, no SSH keys are generated, nor are any system connections made. It is assumed that the user does these things manually or handled otherwise. + +#### **--image** + +Fully qualified registry, path, or URL to a VM image. +Registry target must be in the form of `docker://registry/repo/image:version`. + +Note: Only images provided by podman will be supported. + +#### **--memory**, **-m**=*number* + +Memory (in MiB). Note: 1024MiB = 1GiB. + +#### **--now** + +Start the virtual machine immediately after it has been initialized. + +#### **--playbook** + +Add the provided Ansible playbook to the machine and execute it after the first boot. + +Note: The playbook will be executed with the same privileges given to the user in the virtual machine. The playbook provided cannot include other files from the host system, as they will not be copied. +Use of the `--playbook` flag will require the image to include Ansible. The default image provided will have Ansible included. + +#### **--rootful** + +Whether this machine prefers rootful (`true`) or rootless (`false`) +container execution. This option determines the remote connection default +if there is no existing remote connection configurations. + +API forwarding, if available, follows this setting. + +#### **--timezone** + +Set the timezone for the machine and containers. Valid values are `local` or +a `timezone` such as `America/Chicago`. A value of `local`, which is the default, +means to use the timezone of the machine host. + +The timezone setting is not used with WSL. WSL automatically sets the timezone to the same +as the host Windows operating system. + +#### **--usb**=*bus=number,devnum=number* or *vendor=hexadecimal,product=hexadecimal* + +Assign a USB device from the host to the VM via USB passthrough. +Only supported for QEMU Machines. + +The device needs to have proper permissions in order to be passed to the machine. This +means the device needs to be under your user group. + +Note that using bus and device number are simpler but the values can change every boot +or when the device is unplugged. + +When specifying a USB using vendor and product ID's, if more than one device has the +same vendor and product ID, the first available device is assigned. + + +[//]: # (BEGIN included file options/user-mode-networking.md) +#### **--user-mode-networking** + +Indicates that this machine relays traffic from the guest through a user-space +process running on the host. In some VPN configurations the VPN may drop +traffic from alternate network interfaces, including VM network devices. By +enabling user-mode networking (a setting of `true`), VPNs observe all +podman machine traffic as coming from the host, bypassing the problem. + +When the qemu backend is used (Linux, Mac), user-mode networking is +mandatory and the only allowed value is `true`. In contrast, The Windows/WSL +backend defaults to `false`, and follows the standard WSL network setup. +Changing this setting to `true` on Windows/WSL informs Podman to replace +the WSL networking setup on start of this machine instance with a user-mode +networking distribution. Since WSL shares the same kernel across +distributions, all other running distributions reuses this network. +Likewise, when the last machine instance with a `true` setting stops, the +original networking setup is restored. + +[//]: # (END included file options/user-mode-networking.md) + +#### **--username** + +Username to use for executing commands in remote VM. Default value is `core` +for FCOS and `user` for Fedora (default on Windows hosts). Should match the one +used inside the resulting VM image. + +#### **--volume**, **-v**=*source:target[\\\:options]* + +Mounts a volume from source to target. + +Create a mount. If /host-dir:/machine-dir is specified as the `*source:target*`, +Podman mounts _host-dir_ in the host to _machine-dir_ in the Podman machine. + +Additional options may be specified as a comma-separated string. Recognized +options are: +* **ro**: mount volume read-only +* **rw**: mount volume read/write (default) +* **security_model=[model]**: specify 9p security model (see below) + +The 9p security model [determines] https://wiki.qemu.org/Documentation/9psetup#Starting_the_Guest_directly +if and how the 9p filesystem translates some filesystem operations before +actual storage on the host. + +In order to allow symlinks to work, on MacOS the default security model is + *none*. + +The value of *mapped-xattr* specifies that 9p store symlinks and some file +attributes as extended attributes on the host. This is suitable when the host +and the guest do not need to interoperate on the shared filesystem, but has +caveats for actual shared access; notably, symlinks on the host are not usable +on the guest and vice versa. If interoperability is required, then choose +*none* instead, but keep in mind that the guest is not able to do things +that the user running the virtual machine cannot do, e.g. create files owned by +another user. Using *none* is almost certainly the best choice for read-only +volumes. + +Example: `-v "$HOME/git:$HOME/git:ro,security_model=none"` + +Default volume mounts are defined in *containers.conf*. Unless changed, the default values +is `$HOME:$HOME`. + +**Note on Windows Subsystem for Linux (WSL)** +Since all drives are mounted at `/mnt` on startup by default in WSL, passing +`--volume` is redundant and has no effect. The host home directory for a `C:` +drive will be mounted at `/mnt/c/Users/`. + +## EXAMPLES + +Initialize the default Podman machine, pulling the content from the internet. +``` +$ podman machine init +``` + +Initialize a Podman machine for the specified name pulling the content from the internet. +``` +$ podman machine init myvm +``` + +Initialize the default Podman machine pulling the content from the internet defaulting to rootful mode. The default is rootless. +``` +$ podman machine init --rootful +``` + +Initialize the default Podman machine overriding its disk size override, pulling the content from the internet. +``` +$ podman machine init --disk-size 50 +``` + +Initialize the specified Podman machine overriding its memory size, pulling the content from the internet. +``` +$ podman machine init --memory=1024 myvm +``` + +Initialize the default Podman machine with the host directory `/Users` mounted into the VM at `/Users`. +``` +$ podman machine init -v /Users:/Users +``` + +Initialize the default Podman machine with a usb device passthrough specified with options. Only supported for QEMU Machines. +``` +$ podman machine init --usb vendor=13d3,product=5406 +``` + +Initialize the default Podman machine with a usb device passthrough with specified with options. Only supported for QEMU Machines. +``` +$ podman machine init --usb bus=1,devnum=3 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**, **containers.conf(5)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-machine-inspect.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-machine-inspect.1.md new file mode 100644 index 000000000..6bdb48c29 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-machine-inspect.1.md @@ -0,0 +1,60 @@ +--- +title: podman-machine-inspect +version: v5.4.2 +--- + +% podman-machine-inspect 1 + +## NAME +podman\-machine\-inspect - Inspect one or more virtual machines + +## SYNOPSIS +**podman machine inspect** [*options*] [*name*] ... + +## DESCRIPTION + +Inspect one or more virtual machines + +Obtain greater detail about Podman virtual machines. More than one virtual machine can be +inspected at once. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be inspected. + +Rootless only. + +## OPTIONS +#### **--format** + +Print results with a Go template. + +| **Placeholder** | **Description** | +| ------------------- | --------------------------------------------------------------------- | +| .ConfigDir ... | Machine configuration directory location | +| .ConnectionInfo ... | Machine connection information | +| .Created ... | Machine creation time (string, ISO3601) | +| .LastUp ... | Time when machine was last booted | +| .Name | Name of the machine | +| .Resources ... | Resources used by the machine | +| .Rootful | Whether the machine prefers rootful or rootless container execution | +| .Rosetta | Whether this machine uses Rosetta | +| .SSHConfig ... | SSH configuration info for communicating with machine | +| .State | Machine state | +| .UserModeNetworking | Whether this machine uses user-mode networking | + +#### **--help** + +Print usage statement. + +## EXAMPLES + +Inspect the specified Podman machine. +``` +$ podman machine inspect podman-machine-default +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +April 2022, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-machine-list.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-machine-list.1.md new file mode 100644 index 000000000..99319767d --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-machine-list.1.md @@ -0,0 +1,117 @@ +--- +title: podman-machine-list +version: v5.4.2 +--- + +% podman-machine-list 1 + +## NAME +podman\-machine\-list - List virtual machines + +## SYNOPSIS +**podman machine list** [*options*] + +**podman machine ls** [*options*] + +## DESCRIPTION + +List Podman managed virtual machines. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +Rootless only. + +NOTE: The podman-machine configuration file is managed under the +`$XDG_CONFIG_HOME/containers/podman/machine/` directory. Changing the `$XDG_CONFIG_HOME` +environment variable while the machines are running can lead to unexpected behavior. +(see [podman(1)](podman.1.md)) + +## OPTIONS + +#### **--all-providers** + +Show machines from all providers + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------- | ----------------------------------------- | +| .CPUs | Number of CPUs | +| .Created | Time since VM creation | +| .Default | Is default machine | +| .DiskSize | Disk size of machine | +| .IdentityPath | Path to ssh identity file | +| .LastUp | Time since the VM was last run | +| .Memory | Allocated memory for machine | +| .Name | VM name | +| .Port | SSH Port to use to connect to VM | +| .RemoteUsername | VM Username for rootless Podman | +| .Running | Is machine running | +| .Stream | Stream name | +| .UserModeNetworking | Whether machine uses user-mode networking | +| .VMType | VM type | + +#### **--help** + +Print usage statement. + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Only print the name of the machine. This also implies no table heading +is printed. + +## EXAMPLES + +List all Podman machines. +``` +$ podman machine list +NAME VM TYPE CREATED LAST UP CPUS MEMORY DISK SIZE +podman-machine-default qemu 2 weeks ago 2 weeks ago 1 2.147GB 10.74GB +``` + +List all Podman machines using the specified table format. +``` +$ podman machine ls --format "table {{.Name}}\t{{.VMType}}\t{{.Created}}\t{{.LastUp}}" +NAME VM TYPE CREATED LAST UP +podman-machine-default qemu 2 weeks ago 2 weeks ago +``` + +List all Podman machines in json format. +``` +$ podman machine ls --format json +[ + { + "Name": "podman-machine-default", + "Default": false, + "Created": "2021-12-27T10:36:14.373347492-05:00", + "Running": false, + "LastUp": "2021-12-27T11:22:50.17333371-05:00", + "Stream": "default", + "VMType": "qemu", + "CPUs": 1, + "Memory": "2147483648", + "DiskSize": "10737418240" + } +] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-machine-os-apply.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-machine-os-apply.1.md new file mode 100644 index 000000000..217f24477 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-machine-os-apply.1.md @@ -0,0 +1,54 @@ +--- +title: podman-machine-os-apply +version: v5.4.2 +--- + +% podman-machine-os-apply 1 + +## NAME +podman\-machine\-os\-apply - Apply an OCI image to a Podman Machine's OS + +## SYNOPSIS +**podman machine os apply** [*options*] *image* [vm] + +## DESCRIPTION + +Apply machine OS changes from an OCI image. + +VM's that use OS's that use rpm-ostreee have the capability to rebase itself from the content of an OCI image. +`podman machine image apply` takes an OCI image with container native ostree functionality and rebases itself on that image. + +By default, Podman machines on Mac and Linux use an rpm-ostree based distribution (Fedora CoreOS). + +For more information, see the [rpm-ostree documentation](https://coreos.github.io/rpm-ostree/container/). + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then the OS changes will be applied to `podman-machine-default`. + +## OPTIONS + +#### **--help** + +Print usage statement. + +#### **--restart** + +Restart VM after applying changes. + +## EXAMPLES + +Update the default Podman machine to the specified bootable OCI image. +``` +$ podman machine os apply quay.io/podman_next +``` + +Update the specified Podman machine to the specified bootable OCI image. +``` +$ podman machine os apply quay.io/podman_next podman-machine-default +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**, **[podman-machine-os(1)](podman-machine-os.1.md)** + +## HISTORY +February 2023, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-machine-os.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-machine-os.1.md new file mode 100644 index 000000000..50d9e3187 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-machine-os.1.md @@ -0,0 +1,27 @@ +--- +title: podman-machine-os +version: v5.4.2 +--- + +% podman-machine-os 1 + +## NAME +podman\-machine\-os - Manage a Podman virtual machine's OS + +## SYNOPSIS +**podman machine os** *subcommand* + +## DESCRIPTION +`podman machine os` is a set of subcommands that manage a Podman virtual machine's operating system. + +## SUBCOMMANDS + +| Command | Man Page | Description | +|---------|--------------------------------------------------------------|----------------------------------------------| +| apply | [podman-machine-os-apply(1)](podman-machine-os-apply.1.md) | Apply an OCI image to a Podman Machine's OS | + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**, **[podman-machine-os-apply(1)](podman-machine-os-apply.1.md)** + +## HISTORY +February 2023, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-machine-reset.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-machine-reset.1.md new file mode 100644 index 000000000..43bec5ca9 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-machine-reset.1.md @@ -0,0 +1,52 @@ +--- +title: podman-machine-reset +version: v5.4.2 +--- + +% podman-machine-reset 1 + +## NAME +podman\-machine\-reset - Reset Podman machines and environment + +## SYNOPSIS +**podman machine reset** [*options*] + +## DESCRIPTION + +Reset your Podman machine environment. This command stops any running machines +and then removes them. Configuration and data files are then removed. Data files +would include machine disk images and any previously pulled cache images. When +this command is run, all of your Podman machines will have been deleted. + +## OPTIONS + +#### **--force**, **-f** + +Reset without confirmation. + +#### **--help** + +Print usage statement. + + +## EXAMPLES + +``` +$ podman machine reset +Warning: this command will delete all existing podman machines +and all of the configuration and data directories for Podman machines + +The following machine(s) will be deleted: + +dev +podman-machine-default + +Are you sure you want to continue? [y/N] y +$ +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +Feb 2024, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-machine-rm.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-machine-rm.1.md new file mode 100644 index 000000000..868e743e4 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-machine-rm.1.md @@ -0,0 +1,71 @@ +--- +title: podman-machine-rm +version: v5.4.2 +--- + +% podman-machine-rm 1 + +## NAME +podman\-machine\-rm - Remove a virtual machine + +## SYNOPSIS +**podman machine rm** [*options*] [*name*] + +## DESCRIPTION + +Remove a virtual machine and its related files. What is actually deleted +depends on the virtual machine type. For all virtual machines, the generated +podman system connections are deleted. The ignition files +generated for that VM are also removed as is its image file on the filesystem. + +Users get a display of what is deleted and are required to confirm unless the option `--force` +is used. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be removed. + +Rootless only. + +## OPTIONS + +#### **--force**, **-f** + +Stop and delete without confirmation. + +#### **--help** + +Print usage statement. + +#### **--save-ignition** + +Do not delete the generated ignition file. + +#### **--save-image** + +Do not delete the VM image. + +## EXAMPLES + +Remove the specified Podman machine. +``` +$ podman machine rm test1 + +The following files will be deleted: + +/home/user/.config/containers/podman/machine/qemu/test1.ign +/home/user/.local/share/containers/podman/machine/qemu/test1_fedora-coreos-33.20210315.1.0-qemu.x86_64.qcow2 +/home/user/.config/containers/podman/machine/qemu/test1.json + +Are you sure you want to continue? [y/N] y +``` + +Remove the specified Podman machine even if it is running. +``` +$ podman machine rm -f test1 +$ +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-machine-set.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-machine-set.1.md new file mode 100644 index 000000000..3eb5b4716 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-machine-set.1.md @@ -0,0 +1,126 @@ +--- +title: podman-machine-set +version: v5.4.2 +--- + +% podman-machine-set 1 + +## NAME +podman\-machine\-set - Set a virtual machine setting + +## SYNOPSIS +**podman machine set** [*options*] [*name*] + +## DESCRIPTION + +Change a machine setting. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then the settings will be applied to `podman-machine-default`. + +Rootless only. + +Default Podman machine settings can be set via the [machine] section in the containers.conf(5) file. + +## OPTIONS + +#### **--cpus**=*number* + +Number of CPUs. +Only supported for QEMU machines. + +#### **--disk-size**=*number* + +Size of the disk for the guest VM in GB. +Can only be increased. Only supported for QEMU machines. + +#### **--help** + +Print usage statement. + +#### **--memory**, **-m**=*number* + +Memory (in MB). +Only supported for QEMU machines. + +#### **--rootful** + +Whether this machine prefers rootful (`true`) or rootless (`false`) +container execution. This option updates the current podman +remote connection default if it is currently pointing at the specified +machine name (or `podman-machine-default` if no name is specified). + +Unlike [**podman system connection default**](podman-system-connection-default.1.md) +this option makes the API socket, if available, forward to the rootful/rootless +socket in the VM. + +Note that changing this option means that all the existing containers/images/volumes, etc... +are no longer visible with the default connection/socket. This is because the root and rootless +users in the VM are completely separated and do not share any storage. The data however is not +lost and you can always change this option back or use the other connection to access it. + +#### **--usb**=*bus=number,devnum=number* or *vendor=hexadecimal,product=hexadecimal* or *""* + +Assign a USB device from the host to the VM. +Only supported for QEMU Machines. + +The device needs to be present when the VM starts. +The device needs to have proper permissions in order to be assign to podman machine. + +Use an empty string to remove all previously set USB devices. + +Note that using bus and device number are simpler but the values can change every boot or when the +device is unplugged. Using vendor and product might lead to collision in the case of multiple +devices with the same vendor product value, the first available device is assigned. + + +[//]: # (BEGIN included file options/user-mode-networking.md) +#### **--user-mode-networking** + +Indicates that this machine relays traffic from the guest through a user-space +process running on the host. In some VPN configurations the VPN may drop +traffic from alternate network interfaces, including VM network devices. By +enabling user-mode networking (a setting of `true`), VPNs observe all +podman machine traffic as coming from the host, bypassing the problem. + +When the qemu backend is used (Linux, Mac), user-mode networking is +mandatory and the only allowed value is `true`. In contrast, The Windows/WSL +backend defaults to `false`, and follows the standard WSL network setup. +Changing this setting to `true` on Windows/WSL informs Podman to replace +the WSL networking setup on start of this machine instance with a user-mode +networking distribution. Since WSL shares the same kernel across +distributions, all other running distributions reuses this network. +Likewise, when the last machine instance with a `true` setting stops, the +original networking setup is restored. + +[//]: # (END included file options/user-mode-networking.md) + +## EXAMPLES + +To switch the default Podman machine from rootless to rootful: + +``` +$ podman machine set --rootful +``` + +or more explicitly set with value true. + +``` +$ podman machine set --rootful=true +``` + +Switch the default Podman machine from rootful to rootless. +``` +$ podman machine set --rootful=false +``` + +Switch the specified Podman machine from rootless to rootful. +``` +$ podman machine set --rootful myvm +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**, **containers.conf(5)** + +## HISTORY +February 2022, Originally compiled by Jason Greene diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-machine-ssh.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-machine-ssh.1.md new file mode 100644 index 000000000..6a65dd012 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-machine-ssh.1.md @@ -0,0 +1,91 @@ +--- +title: podman-machine-ssh +version: v5.4.2 +--- + +% podman-machine-ssh 1 + +## NAME +podman\-machine\-ssh - SSH into a virtual machine + +## SYNOPSIS +**podman machine ssh** [*options*] [*name*] [*command* [*arg* ...]] + +## DESCRIPTION + +SSH into a Podman-managed virtual machine and optionally execute a command +on the virtual machine. Unless using the default virtual machine, the +first argument must be the virtual machine name. The optional command to +execute can then follow. If no command is provided, an interactive session +with the virtual machine is established. + +The exit code from ssh command is forwarded to the podman machine ssh caller, see [Exit Codes](#Exit-Codes). + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be SSH'd into. + +Rootless only. + +## OPTIONS + +#### **--help** + +Print usage statement. + +#### **--username**=*name* + +Username to use when SSH-ing into the VM. + +## Exit Codes + +The exit code from `podman machine ssh` gives information about why the command failed. +When `podman machine ssh` commands exit with a non-zero code, +the exit codes follow the `chroot` standard, see below: + + **125** The error is with podman **_itself_** + + $ podman machine ssh --foo; echo $? + Error: unknown flag: --foo + 125 + + **126** Executing a _contained command_ and the _command_ cannot be invoked + + $ podman machine ssh /etc; echo $? + Error: fork/exec /etc: permission denied + 126 + + **127** Executing a _contained command_ and the _command_ cannot be found + + $ podman machine ssh foo; echo $? + Error: fork/exec /usr/bin/bogus: no such file or directory + 127 + + **Exit code** _contained command_ exit code + + $ podman machine ssh /bin/sh -c 'exit 3'; echo $? + 3 + +## EXAMPLES + +To get an interactive session with the default Podman machine: + +SSH into the default Podman machine. +``` +$ podman machine ssh +``` + +Run command inside the default Podman machine via ssh. +``` +$ podman machine ssh myvm +``` + +Run command inside the specified Podman machine via ssh. +``` +$ podman machine ssh myvm rpm -q podman +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-machine-start.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-machine-start.1.md new file mode 100644 index 000000000..4966f3d12 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-machine-start.1.md @@ -0,0 +1,58 @@ +--- +title: podman-machine-start +version: v5.4.2 +--- + +% podman-machine-start 1 + +## NAME +podman\-machine\-start - Start a virtual machine + +## SYNOPSIS +**podman machine start** [*name*] + +## DESCRIPTION + +Starts a virtual machine for Podman. + +Rootless only. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be started. + +Only one Podman managed VM can be active at a time. If a VM is already running, +`podman machine start` returns an error. + +**podman machine start** starts a Linux virtual machine where containers are run. + +## OPTIONS + +#### **--help** + +Print usage statement. + +#### **--no-info** + +Suppress informational tips. + +#### **--quiet**, **-q** + +Suppress machine starting status output. + +## EXAMPLES + +Start the specified podman machine. +``` +$ podman machine start myvm +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-machine-stop.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-machine-stop.1.md new file mode 100644 index 000000000..3ba08f1a1 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-machine-stop.1.md @@ -0,0 +1,47 @@ +--- +title: podman-machine-stop +version: v5.4.2 +--- + +% podman-machine-stop 1 + +## NAME +podman\-machine\-stop - Stop a virtual machine + +## SYNOPSIS +**podman machine stop** [*name*] + +## DESCRIPTION + +Stops a virtual machine. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be stopped. + +Rootless only. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +**podman machine stop** stops a Linux virtual machine where containers are run. + +## OPTIONS + +#### **--help** + +Print usage statement. + +## EXAMPLES + +Stop a podman machine named myvm. +``` +$ podman machine stop myvm +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-machine.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-machine.1.md new file mode 100644 index 000000000..9f6d41be0 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-machine.1.md @@ -0,0 +1,55 @@ +--- +title: podman-machine +version: v5.4.2 +--- + +% podman-machine 1 + +## NAME +podman\-machine - Manage Podman's virtual machine + +## SYNOPSIS +**podman machine** *subcommand* + +## DESCRIPTION +`podman machine` is a set of subcommands that manage Podman's virtual machine. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +All `podman machine` commands are rootless only. + +NOTE: The podman-machine configuration file is managed under the +`$XDG_CONFIG_HOME/containers/podman/machine/` directory. Changing the `$XDG_CONFIG_HOME` +environment variable while the machines are running can lead to unexpected behavior. + +Podman machine behaviour can be modified via the [machine] section in the containers.conf(5) file. + +## SUBCOMMANDS + +| Command | Man Page | Description | +|---------|----------------------------------------------------------|---------------------------------------| +| info | [podman-machine-info(1)](podman-machine-info.1.md) | Display machine host info | +| init | [podman-machine-init(1)](podman-machine-init.1.md) | Initialize a new virtual machine | +| inspect | [podman-machine-inspect(1)](podman-machine-inspect.1.md) | Inspect one or more virtual machines | +| list | [podman-machine-list(1)](podman-machine-list.1.md) | List virtual machines | +| os | [podman-machine-os(1)](podman-machine-os.1.md) | Manage a Podman virtual machine's OS | +| reset | [podman-machine-reset(1)](podman-machine-reset.1.md) | Reset Podman machines and environment | +| rm | [podman-machine-rm(1)](podman-machine-rm.1.md) | Remove a virtual machine | +| set | [podman-machine-set(1)](podman-machine-set.1.md) | Set a virtual machine setting | +| ssh | [podman-machine-ssh(1)](podman-machine-ssh.1.md) | SSH into a virtual machine | +| start | [podman-machine-start(1)](podman-machine-start.1.md) | Start a virtual machine | +| stop | [podman-machine-stop(1)](podman-machine-stop.1.md) | Stop a virtual machine | + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine-info(1)](podman-machine-info.1.md)**, **[podman-machine-init(1)](podman-machine-init.1.md)**, **[podman-machine-list(1)](podman-machine-list.1.md)**, **[podman-machine-os(1)](podman-machine-os.1.md)**, **[podman-machine-rm(1)](podman-machine-rm.1.md)**, **[podman-machine-ssh(1)](podman-machine-ssh.1.md)**, **[podman-machine-start(1)](podman-machine-start.1.md)**, **[podman-machine-stop(1)](podman-machine-stop.1.md)**, **[podman-machine-inspect(1)](podman-machine-inspect.1.md)**, **[podman-machine-reset(1)](podman-machine-reset.1.md)**, **containers.conf(5)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-manifest-add.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-manifest-add.1.md new file mode 100644 index 000000000..f019de681 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-manifest-add.1.md @@ -0,0 +1,235 @@ +--- +title: podman-manifest-add +version: v5.4.2 +--- + +% podman-manifest-add 1 + +## NAME +podman\-manifest\-add - Add an image or artifact to a manifest list or image index + +## SYNOPSIS +**podman manifest add** [*options*] *listnameorindexname* [*transport*]:*imagename* *imageorartifactname* [...] + +## DESCRIPTION + +Adds the specified image to the specified manifest list or image index, or +creates an artifact manifest and adds it to the specified image index. + +## RETURN VALUE + +The list image's ID. + +## OPTIONS + +#### **--all** + +If the image which is added to the list or index is itself a list or +index, add all of the contents to the local list. By default, only one image +from such a list or index is added to the list or index. Combining +*--all* with any of the other options described below is NOT recommended. + + +[//]: # (BEGIN included file options/annotation.manifest.md) +#### **--annotation**=*annotation=value* + +Set an annotation on the entry for the specified image or artifact. + +[//]: # (END included file options/annotation.manifest.md) + +#### **--arch**=*architecture* + +Override the architecture which the list or index records as a requirement for +the image. If *imageName* refers to a manifest list or image index, the +architecture information is retrieved from it. Otherwise, it is +retrieved from the image's configuration information. + +#### **--artifact** + +Create an artifact manifest and add it to the image index. Arguments after the +index name will be interpreted as file names rather than as image references. +In most scenarios, the **--artifact-type** option should also be specified. + +#### **--artifact-config**=*path* + +When creating an artifact manifest and adding it to the image index, use the +specified file's contents as the configuration blob in the artifact manifest. +In most scenarios, leaving the default value, which signifies an empty +configuration, unchanged, is the preferred option. + +#### **--artifact-config-type**=*type* + +When creating an artifact manifest and adding it to the image index, use the +specified MIME type as the `mediaType` associated with the configuration blob +in the artifact manifest. In most scenarios, leaving the default value, which +signifies either an empty configuration or the standard OCI configuration type, +unchanged, is the preferred option. + +#### **--artifact-exclude-titles** + +When creating an artifact manifest and adding it to the image index, do not +set "org.opencontainers.image.title" annotations equal to the file's basename +for each file added to the artifact manifest. Tools which retrieve artifacts +from a registry may use these values to choose names for files when saving +artifacts to disk, so this option is not recommended unless it is required +for interoperability with a particular registry. + +#### **--artifact-layer-type**=*type* + +When creating an artifact manifest and adding it to the image index, use the +specified MIME type as the `mediaType` associated with the files' contents. If +not specified, guesses based on either the files names or their contents will +be made and used, but the option should be specified if certainty is needed. + +#### **--artifact-subject**=*imageName* + +When creating an artifact manifest and adding it to the image index, set the +*subject* field in the artifact manifest to mark the artifact manifest as being +associated with the specified image in some way. An artifact manifest can only +be associated with, at most, one subject. + +#### **--artifact-type**=*type* + +When creating an artifact manifest, use the specified MIME type as the +manifest's `artifactType` value instead of the less informative default value. + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/features.md) +#### **--features**=*feature* + +Specify the features list which the list or index records as requirements for +the image. This option is rarely used. + +[//]: # (END included file options/features.md) + +#### **--os**=*OS* + +Override the OS which the list or index records as a requirement for the image. +If *imagename* refers to a manifest list or image index, the OS information +is retrieved from it. Otherwise, it is retrieved from the image's +configuration information. + + +[//]: # (BEGIN included file options/os-version.md) +#### **--os-version**=*version* + +Specify the OS version which the list or index records as a requirement for the +image. This option is rarely used. + +[//]: # (END included file options/os-version.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/variant.manifest.md) +#### **--variant** + +Specify the variant which the list or index records for the image. This option +is typically used to distinguish between multiple entries which share the same +architecture value, but which expect different versions of its instruction set. + +[//]: # (END included file options/variant.manifest.md) + +## Transport + + Multiple transports are supported: + + **docker://**_docker-reference_ _(default)_ + An image in a registry implementing the "Docker Registry HTTP API V2". By default, uses the authorization state in `$XDG_RUNTIME_DIR/containers/auth.json`, which is set using `(podman login)`. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using `(docker login)`. + + $ podman manifest add mylist\:v1.11 docker://quay.io/username/myimage + + **containers-storage:**_oci-reference_ + An image in _oci-reference_ format stored in the local container storage. _oci-reference_ must contain a tag. + + $ podman manifest add mylist\:v1.11 containers-storage\:quay.io/username/myimage + + **dir:**_path_ + An existing local directory _path_ storing the manifest, layer tarballs, and signatures as individual files. This + is a non-standardized format, primarily useful for debugging or noninvasive container inspection. + + $ podman manifest add dir:/tmp/myimage + + **docker-archive:**_path_[**:**_docker-reference_] + An image is stored in the `docker save` formatted file. _docker-reference_ is only used when creating such a + file, and it must not contain a digest. + + $ podman manifest add docker-archive:/tmp/myimage + + **docker-daemon:**_docker-reference_ + An image in _docker-reference_ format stored in the docker daemon internal storage. The _docker-reference_ can also be an image ID (docker-daemon\:algo\:digest). + + $ sudo podman manifest add docker-daemon\:docker.io/library/myimage:33 + + **oci-archive:**_path_**:**_tag_ + An image _tag_ in a directory compliant with "Open Container Image Layout Specification" at _path_. + + $ podman manifest add oci-archive:/tmp/myimage + +## EXAMPLE + +Add specified default image from source manifest list to destination manifest list: +``` +podman manifest add mylist:v1.11 docker://fedora +71c201d10fffdcac52968a000d85a0a016ca1c7d5473948000d3131c1773d965 +``` + +Add all images from source manifest list to destination manifest list: +``` +podman manifest add --all mylist:v1.11 docker://fedora +71c201d10fffdcac52968a000d85a0a016ca1c7d5473948000d3131c1773d965 +``` + +Add selected image matching arch and variant from source manifest list to destination manifest list: +``` +podman manifest add --arch arm64 --variant v8 mylist\:v1.11 docker://71c201d10fffdcac52968a000d85a0a016ca1c7d5473948000d3131c1773d965 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-manifest-annotate.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-manifest-annotate.1.md new file mode 100644 index 000000000..882e63bbc --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-manifest-annotate.1.md @@ -0,0 +1,95 @@ +--- +title: podman-manifest-annotate +version: v5.4.2 +--- + +% podman-manifest-annotate 1 + +## NAME +podman\-manifest\-annotate - Add and update information about an image or artifact in a manifest list or image index + +## SYNOPSIS +**podman manifest annotate** [*options*] *listnameorindexname* *imagemanifestdigestorimageorartifactname* + +## DESCRIPTION + +Adds or updates information about an image or artifact included in a manifest list or image index. + +## OPTIONS + + +[//]: # (BEGIN included file options/annotation.manifest.md) +#### **--annotation**=*annotation=value* + +Set an annotation on the entry for the specified image or artifact. + +[//]: # (END included file options/annotation.manifest.md) +If **--index** is also specified, sets the annotation on the entire image index. + +#### **--arch**=*architecture* + +Override the architecture which the list or index records as a requirement for +the image. This is usually automatically retrieved from the image's +configuration information, so it is rarely necessary to use this option. + + +[//]: # (BEGIN included file options/features.md) +#### **--features**=*feature* + +Specify the features list which the list or index records as requirements for +the image. This option is rarely used. + +[//]: # (END included file options/features.md) + +#### **--index** + +Treats arguments to the **--annotation** option as annotation values to be set +on the image index itself rather than on an entry in the image index. Implied +for **--subject**. + +#### **--os**=*OS* + +Override the OS which the list or index records as a requirement for the image. +This is usually automatically retrieved from the image's configuration +information, so it is rarely necessary to use this option. + +#### **--os-features**=*feature* + +Specify the OS features list which the list or index records as requirements +for the image. This option is rarely used. + + +[//]: # (BEGIN included file options/os-version.md) +#### **--os-version**=*version* + +Specify the OS version which the list or index records as a requirement for the +image. This option is rarely used. + +[//]: # (END included file options/os-version.md) + +#### **--subject**=*imageName* + +Set the *subject* field in the image index to mark the image index as being +associated with the specified image in some way. An image index can only be +associated with, at most, one subject. + + +[//]: # (BEGIN included file options/variant.manifest.md) +#### **--variant** + +Specify the variant which the list or index records for the image. This option +is typically used to distinguish between multiple entries which share the same +architecture value, but which expect different versions of its instruction set. + +[//]: # (END included file options/variant.manifest.md) + +## EXAMPLE + +Update arch and variant information to specified manifest list for image: +``` +podman manifest annotate --arch arm64 --variant v8 mylist:v1.11 sha256:59eec8837a4d942cc19a52b8c09ea75121acc38114a2c68b98983ce9356b8610 +07ec8dc22b5dba3a33c60b68bce28bbd2b905e383fdb32a90708fa5eeac13a07: sha256:59eec8837a4d942cc19a52b8c09ea75121acc38114a2c68b98983ce9356b8610 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-manifest-create.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-manifest-create.1.md new file mode 100644 index 000000000..4e25573af --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-manifest-create.1.md @@ -0,0 +1,79 @@ +--- +title: podman-manifest-create +version: v5.4.2 +--- + +% podman-manifest-create 1 + +## NAME +podman\-manifest\-create - Create a manifest list or image index + +## SYNOPSIS +**podman manifest create** [*options*] *listnameorindexname* [*imagename* ...] + +## DESCRIPTION + +Creates a new manifest list and stores it as an image in local storage using +the specified name. + +If additional images are specified, they are added to the newly-created list or +index. + +## OPTIONS + +#### **--all** + +If any of the images added to the new list or index are +themselves lists or indexes, add all of their contents. By default, only one +image from such a list is added to the newly-created list or index. + +#### **--amend**, **-a** + +If a manifest list named *listnameorindexname* already exists, modify the +preexisting list instead of exiting with an error. The contents of +*listnameorindexname* are not modified if no *imagename*s are given. + +#### **--annotation**=*value* + +Set an annotation on the newly-created image index. + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Create the specified manifest. +``` +podman manifest create mylist:v1.11 +9cfd24048d5fc80903f088f1531a21bff01172abe66effa8941a4c2308dc745f +``` + +Create the specified manifest manifest or modify it if it previously exist. +``` +podman manifest create --amend mylist:v1.11 +9cfd24048d5fc80903f088f1531a21bff01172abe66effa8941a4c2308dc745f +``` + +Create the named manifest including the specified image matching the current platform. +``` +podman manifest create mylist:v1.11 docker://fedora +5c2bc76bfb4ba6665a7973f7e1c05ee0536b4580637f27adc9fa5a4b2bc03cf1 +``` + +Create the named manifest including all images referred to with the specified image reference. +``` +podman manifest create --all mylist\:v1.11 docker://fedora +30330571e79c65288a4fca421d9aed29b0210d57294d9c2056743fdcf6e3967b +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-manifest-exists.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-manifest-exists.1.md new file mode 100644 index 000000000..68e0b2e52 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-manifest-exists.1.md @@ -0,0 +1,47 @@ +--- +title: podman-manifest-exists +version: v5.4.2 +--- + +% podman-manifest-exists 1 + +## NAME +podman\-manifest\-exists - Check if the given manifest list exists in local storage + +## SYNOPSIS +**podman manifest exists** *manifest* + +## DESCRIPTION +**podman manifest exists** checks if a manifest list exists on local storage. +Podman returns an exit code of `0` when the manifest is found. A `1` is +returned otherwise. +An exit code of `125` indicates there was another issue. + + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement. + +## EXAMPLE + +Check if a manifest list called `list1` exists (the manifest list does actually exist): +``` +$ podman manifest exists list1 +$ echo $? +0 +``` + +Check if a manifest called `mylist` exists (the manifest list does not actually exist): +``` +$ podman manifest exists mylist +$ echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** + +## HISTORY +January 2021, Originally compiled by Paul Holzinger `` diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-manifest-inspect.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-manifest-inspect.1.md new file mode 100644 index 000000000..db510cc97 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-manifest-inspect.1.md @@ -0,0 +1,54 @@ +--- +title: podman-manifest-inspect +version: v5.4.2 +--- + +% podman-manifest-inspect 1 + +## NAME +podman\-manifest\-inspect - Display a manifest list or image index + +## SYNOPSIS +**podman manifest inspect** [*options*] *listnameorindexname* + +## DESCRIPTION + +Displays the manifest list or image index stored using the specified image name. +## RETURN VALUE + +A formatted JSON representation of the manifest list or image index. + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Inspect the manifest of mylist:v1.11. +``` +podman manifest inspect mylist\:v1.11 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-manifest-push.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-manifest-push.1.md new file mode 100644 index 000000000..d2d384847 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-manifest-push.1.md @@ -0,0 +1,173 @@ +--- +title: podman-manifest-push +version: v5.4.2 +--- + +% podman-manifest-push 1 + +## NAME +podman\-manifest\-push - Push a manifest list or image index to a registry + +## SYNOPSIS +**podman manifest push** [*options*] *listnameorindexname* [*destination*] + +## DESCRIPTION +Pushes a manifest list or image index to a registry. + +## RETURN VALUE +The list image's ID and the digest of the image's manifest. + +## OPTIONS + +#### **--add-compression**=*compression* + +Makes sure that requested compression variant for each platform is added to the manifest list keeping original instance +intact in the same manifest list. Supported values are (`gzip`, `zstd` and `zstd:chunked`). Following flag can be used +multiple times. + +Note that `--compression-format` controls the compression format of each instance in the manifest list. `--add-compression` +will add another variant for each instance in the list with the specified compressions. `--compression-format` gzip `--add-compression` +zstd will push a manifest list with each instance being compressed with gzip plus an additional variant of each instance +being compressed with zstd. + +#### **--all** + +Push the images mentioned in the manifest list or image index, in addition to +the list or index itself. (Default true) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/compression-format.md) +#### **--compression-format**=**gzip** | *zstd* | *zstd:chunked* + +Specifies the compression format to use. Supported values are: `gzip`, `zstd` and `zstd:chunked`. The default is `gzip` unless overridden in the containers.conf file. +`zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning in that case. + +[//]: # (END included file options/compression-format.md) + + +[//]: # (BEGIN included file options/compression-level.md) +#### **--compression-level**=*level* + +Specifies the compression level to use. The value is specific to the compression algorithm used, e.g. for zstd the accepted values are in the range 1-20 (inclusive) with a default of 3, while for gzip it is 1-9 (inclusive) and has a default of 5. + +[//]: # (END included file options/compression-level.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/digestfile.md) +#### **--digestfile**=*Digestfile* + +After copying the image, write the digest of the resulting image to the file. + +[//]: # (END included file options/digestfile.md) + + +[//]: # (BEGIN included file options/force-compression.md) +#### **--force-compression** + +If set, push uses the specified compression algorithm even if the destination contains a differently-compressed variant already. +Defaults to `true` if `--compression-format` is explicitly specified on the command-line, `false` otherwise. + +[//]: # (END included file options/force-compression.md) + +#### **--format**, **-f**=*format* + +Manifest list type (oci or v2s2) to use when pushing the list (default is oci). + +#### **--quiet**, **-q** + +When writing the manifest, suppress progress output + +#### **--remove-signatures** + +Don't copy signatures when pushing images. + +#### **--rm** + +Delete the manifest list or image index from local storage if pushing succeeds. + +#### **--sign-by**=*fingerprint* + +Sign the pushed images with a “simple signing” signature using the specified key. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-by-sigstore.md) +#### **--sign-by-sigstore**=*param-file* + +Add a sigstore signature based on further options specified in a container's sigstore signing parameter file *param-file*. +See containers-sigstore-signing-params.yaml(5) for details about the file format. + +[//]: # (END included file options/sign-by-sigstore.md) + +#### **--sign-by-sigstore-private-key**=*path* + +Sign the pushed images with a sigstore signature using a private key at the specified path. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-passphrase-file.md) +#### **--sign-passphrase-file**=*path* + +If signing the image (using either **--sign-by** or **--sign-by-sigstore-private-key**), read the passphrase to use from the specified path. + +[//]: # (END included file options/sign-passphrase-file.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## DESTINATION + + DESTINATION is the location the container image is pushed to. It supports all transports from `containers-transports(5)`. If no transport is specified, the `docker` (i.e., container registry) transport is used. For remote clients, including Mac and Windows (excluding WSL2) machines, `docker` is the only supported transport. + +## EXAMPLE + +Push manifest list to container registry: +``` +podman manifest push mylist:v1.11 docker://registry.example.org/mylist:v1.11 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-manifest-remove.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-manifest-remove.1.md new file mode 100644 index 000000000..2686b93a6 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-manifest-remove.1.md @@ -0,0 +1,29 @@ +--- +title: podman-manifest-remove +version: v5.4.2 +--- + +% podman-manifest-remove 1 + +## NAME +podman\-manifest\-remove - Remove an item from a manifest list or image index + +## SYNOPSIS +**podman manifest remove** *listnameorindexname* *digest* + +## DESCRIPTION +Removes the item with the specified digest from the specified manifest list or image index. + +## RETURN VALUE +The list image's ID and the digest of the removed image's manifest. + +## EXAMPLE + +Remove specified digest from the manifest list: +``` +podman manifest remove mylist:v1.11 sha256:cb8a924afdf0229ef7515d9e5b3024e23b3eb03ddbba287f4a19c6ac90b8d221 +podman manifest remove e604eabaaee4858232761b4fef84e2316ed8f93e15eceafce845966ee3400036 sha256\:cb8a924afdf0229ef7515d9e5b3024e23b3eb03ddbba287f4a19c6ac90b8d221 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-manifest-rm.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-manifest-rm.1.md new file mode 100644 index 000000000..010d4d0af --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-manifest-rm.1.md @@ -0,0 +1,36 @@ +--- +title: podman-manifest-rm +version: v5.4.2 +--- + +% podman-manifest-rm 1 + +## NAME +podman\-manifest\-rm - Remove manifest list or image index from local storage + +## SYNOPSIS +**podman manifest rm** [*options*] *list-or-index* [...] + +## DESCRIPTION +Removes one or more locally stored manifest lists. + +## OPTIONS + +#### **--ignore**, **-i** + +If a specified manifest does not exist in the local storage, ignore it and do not throw an error. + +## EXAMPLE + +podman manifest rm `` + +podman manifest rm listid1 listid2 + +**storage.conf** (`/etc/containers/storage.conf`) + +storage.conf is the storage configuration file for all tools using containers/storage + +The storage configuration file specifies all of the available container storage options for tools using shared container storage. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-manifest.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-manifest.1.md new file mode 100644 index 000000000..d39cc34f4 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-manifest.1.md @@ -0,0 +1,76 @@ +--- +title: podman-manifest +version: v5.4.2 +--- + +% podman-manifest 1 + +## NAME +podman\-manifest - Create and manipulate manifest lists and image indexes + +## SYNOPSIS +**podman manifest** *subcommand* + +## DESCRIPTION +The `podman manifest` command provides subcommands which can be used to: + + * Create a working Docker manifest list or OCI image index. + +## SUBCOMMANDS + +| Command | Man Page | Description | +| -------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------------------- | +| add | [podman-manifest-add(1)](podman-manifest-add.1.md) | Add an image or artifact to a manifest list or image index. | +| annotate | [podman-manifest-annotate(1)](podman-manifest-annotate.1.md) | Add and update information about an image or artifact in a manifest list or image index. | +| create | [podman-manifest-create(1)](podman-manifest-create.1.md) | Create a manifest list or image index. | +| exists | [podman-manifest-exists(1)](podman-manifest-exists.1.md) | Check if the given manifest list exists in local storage | +| inspect | [podman-manifest-inspect(1)](podman-manifest-inspect.1.md) | Display a manifest list or image index. | +| push | [podman-manifest-push(1)](podman-manifest-push.1.md) | Push a manifest list or image index to a registry. | +| remove | [podman-manifest-remove(1)](podman-manifest-remove.1.md) | Remove an item from a manifest list or image index. | +| rm | [podman-manifest-rm(1)](podman-manifest-rm.1.md) | Remove manifest list or image index from local storage. | + +## EXAMPLES + +### Building a multi-arch manifest list from a Containerfile + +Assuming the `Containerfile` uses `RUN` instructions, the host needs +a way to execute non-native binaries. Configuring this is beyond +the scope of this example. Building a multi-arch manifest list +`shazam` in parallel across 4-threads can be done like this: + + $ platarch=linux/amd64,linux/ppc64le,linux/arm64,linux/s390x + $ podman build --jobs=4 --platform=$platarch --manifest shazam . + +**Note:** The `--jobs` argument is optional. Do not use the `podman build` command's `--tag` (or `-t`) option when building a multi-arch manifest list. + +### Assembling a multi-arch manifest from separately built images + +Assuming `example.com/example/shazam:$arch` images are built separately +on other hosts and pushed to the `example.com` registry. They may +be combined into a manifest list, and pushed using a simple loop: + + $ REPO=example.com/example/shazam + $ podman manifest create $REPO:latest + $ for IMGTAG in amd64 s390x ppc64le arm64; do \ + podman manifest add $REPO:latest docker://$REPO\:IMGTAG; \ + done + $ podman manifest push --all $REPO\:latest + +**Note:** The `add` instruction argument order is `` then ``. +Also, the `--all` push option is required to ensure all contents are +pushed, not just the native platform/arch. + +### Removing and tagging a manifest list before pushing + +Special care is needed when removing and pushing manifest lists, as opposed +to the contents. You almost always want to use the `manifest rm` and +`manifest push --all` subcommands. For example, a rename and push can +be performed like this: + + $ podman tag localhost/shazam example.com/example/shazam + $ podman manifest rm localhost/shazam + $ podman manifest push --all example.com/example/shazam + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest-add(1)](podman-manifest-add.1.md)**, **[podman-manifest-annotate(1)](podman-manifest-annotate.1.md)**, **[podman-manifest-create(1)](podman-manifest-create.1.md)**, **[podman-manifest-inspect(1)](podman-manifest-inspect.1.md)**, **[podman-manifest-push(1)](podman-manifest-push.1.md)**, **[podman-manifest-remove(1)](podman-manifest-remove.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-mount.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-mount.1.md new file mode 100644 index 000000000..49a845b67 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-mount.1.md @@ -0,0 +1,86 @@ +--- +title: podman-mount +version: v5.4.2 +--- + +% podman-mount 1 + +## NAME +podman\-mount - Mount a working container's root filesystem + +## SYNOPSIS +**podman mount** [*options*] [*container* ...] + +**podman container mount** [*options*] [*container* ...] + +## DESCRIPTION +Mounts the specified containers' root file system in a location which can be +accessed from the host, and returns its location. + +Podman lists all of the currently mounted containers, including external containers, when the command is executed +without any arguments. External containers are containers in container/storage by tools other than Podman. +For example Buildah and CRI-O. + +Rootless mode only supports mounting VFS driver, unless Podman is run within the user namespace +via the `podman unshare` command. All other storage drivers fails to mount. + +## RETURN VALUE +The location of the mounted file system. On error an empty string and errno is +returned. + +## OPTIONS + +#### **--all**, **-a** + +Mount all podman containers. (External containers are not mounted) + +#### **--format**=*format* + +Print the mounted containers in specified format (json). + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--no-trunc** + +Do not truncate the output (default *false*). + +## EXAMPLE + +In rootful mode, Mount specified container. +``` +# podman mount c831414b10a3 +/var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +``` + +In rootless mode, container mounting only works from inside the user namespace. +``` +$ podman unshare +# podman mount affectionate_mcnulty +/home/dwalsh/.local/share/containers/storage/overlay/4218326b9a80619aef005ff95067f76687ad975ce101c176598fb416f6186906/merged +``` + +List the currently mounted containers: +``` +podman mount +c831414b10a3 /var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +a7060253093b /var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged +``` + +Mount multiple containers: +``` +podman mount c831414b10a3 a7060253093b +/var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +/var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-unmount(1)](podman-unmount.1.md)**, **[podman-unshare(1)](podman-unshare.1.md)**, **mount(8)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-network-connect.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-network-connect.1.md new file mode 100644 index 000000000..b86fe69ec --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-network-connect.1.md @@ -0,0 +1,55 @@ +--- +title: podman-network-connect +version: v5.4.2 +--- + +% podman-network-connect 1 + +## NAME +podman\-network\-connect - Connect a container to a network + +## SYNOPSIS +**podman network connect** [*options*] network container + +## DESCRIPTION +Connects a container to a network. A container can be connected to a network by name or by ID. +Once connected, the container can communicate with other containers in the same network. + +## OPTIONS +#### **--alias**=*name* +Add network-scoped alias for the container. If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. Multiple *--alias* options may be specified as input. +NOTE: When using CNI, a container only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. + +#### **--ip**=*address* +Set a static ipv4 address for this container on this network. + +#### **--ip6**=*address* +Set a static ipv6 address for this container on this network. + +#### **--mac-address**=*address* +Set a static mac address for this container on this network. + +## EXAMPLE + +Connect specified container to a named network: +``` +podman network connect test web +``` + +Connect specified container to named network with two aliases: +``` +podman network connect --alias web1 --alias web2 test web +``` + +Connect specified container to named network with a static ip: +``` +podman network connect --ip 10.89.1.13 test web +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-network-disconnect(1)](podman-network-disconnect.1.md)** + +## HISTORY +November 2020, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-network-create.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-network-create.1.md new file mode 100644 index 000000000..b64f28b4d --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-network-create.1.md @@ -0,0 +1,220 @@ +--- +title: podman-network-create +version: v5.4.2 +--- + +% podman-network-create 1 + +## NAME +podman\-network-create - Create a Podman network + +## SYNOPSIS +**podman network create** [*options*] [*name*] + +## DESCRIPTION +Create a network configuration for use with Podman. By default, Podman creates a bridge connection. +A *Macvlan* connection can be created with the *-d macvlan* option. A parent device for macvlan or +ipvlan can be designated with the *-o parent=``* or *--network-interface=``* option. + +If no options are provided, Podman assigns a free subnet and name for the network. + +Upon completion of creating the network, Podman displays the name of the newly added network. + +## OPTIONS +#### **--disable-dns** + +Disables the DNS plugin for this network which if enabled, can perform container to container name +resolution. It is only supported with the `bridge` driver, for other drivers it is always disabled. + +#### **--dns**=*ip* + +Set network-scoped DNS resolver/nameserver for containers in this network. If not set, the host servers from `/etc/resolv.conf` is used. It can be overwritten on the container level with the `podman run/create --dns` option. This option can be specified multiple times to set more than one IP. + +#### **--driver**, **-d**=*driver* + +Driver to manage the network. Currently `bridge`, `macvlan` and `ipvlan` are supported. Defaults to `bridge`. +As rootless the `macvlan` and `ipvlan` driver have no access to the host network interfaces because rootless networking requires a separate network namespace. + +The netavark backend allows the use of so called *netavark plugins*, see the +[plugin-API.md](https://github.com/containers/netavark/blob/main/plugin-API.md) +documentation in netavark. The binary must be placed in a specified directory +so podman can discover it, this list is set in `netavark_plugin_dirs` in +**[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** +under the `[network]` section. + +The name of the plugin can then be used as driver to create a network for your plugin. +The list of all supported drivers and plugins can be seen with `podman info --format {{.Plugins.Network}}`. + +Note that the `macvlan` and `ipvlan` drivers do not support port forwarding. Support for port forwarding +with a plugin depends on the implementation of the plugin. + +#### **--gateway**=*ip* + +Define a gateway for the subnet. To provide a gateway address, a +*subnet* option is required. Can be specified multiple times. +The argument order of the **--subnet**, **--gateway** and **--ip-range** options must match. + +#### **--ignore** + +Ignore the create request if a network with the same name already exists instead of failing. +Note, trying to create a network with an existing name and different parameters does not change the configuration of the existing one. + +#### **--interface-name**=*name* + +This option maps the *network_interface* option in the network config, see **podman network inspect**. +Depending on the driver, this can have different effects; for `bridge`, it uses the bridge interface name. +For `macvlan` and `ipvlan`, it is the parent device on the host. It is the same as `--opt parent=...`. + +#### **--internal** + +Restrict external access of this network when using a `bridge` network. Note when using the CNI backend +DNS will be automatically disabled, see **--disable-dns**. + +When using the `macvlan` or `ipvlan` driver with this option no default route will be added to the container. +Because it bypasses the host network stack no additional restrictions can be set by podman and if a +privileged container is run it can set a default route themselves. If this is a concern then the +container connections should be blocked on your actual network gateway. + +Using the `bridge` driver with this option has the following effects: + - Global IP forwarding sysctls will not be changed in the host network namespace. + - IP forwarding is disabled on the bridge interface instead of setting up a firewall. + - No default route will be added to the container. + +In all cases, aardvark-dns will only resolve container names with this option enabled. +Other queries will be answered with `NXDOMAIN`. + +#### **--ip-range**=*range* + +Allocate container IP from a range. The range must be a either a complete subnet in CIDR notation or be in +the `-` syntax which allows for a more flexible range compared to the CIDR subnet. +The *ip-range* option must be used with a *subnet* option. Can be specified multiple times. +The argument order of the **--subnet**, **--gateway** and **--ip-range** options must match. + +#### **--ipam-driver**=*driver* + +Set the ipam driver (IP Address Management Driver) for the network. When unset podman chooses an +ipam driver automatically based on the network driver. + +Valid values are: + + - `dhcp`: IP addresses are assigned from a dhcp server on the network. When using the netavark backend + the `netavark-dhcp-proxy.socket` must be enabled in order to start the dhcp-proxy when a container is + started, for CNI use the `cni-dhcp.socket` unit instead. + - `host-local`: IP addresses are assigned locally. + - `none`: No ip addresses are assigned to the interfaces. + +View the driver in the **podman network inspect** output under the `ipam_options` field. + +#### **--ipv6** + +Enable IPv6 (Dual Stack) networking. If no subnets are given, it allocates an ipv4 and an ipv6 subnet. + +#### **--label**=*label* + +Set metadata for a network (e.g., --label mykey=value). + +#### **--opt**, **-o**=*option* + +Set driver specific options. + +All drivers accept the `mtu`, `metric`, `no_default_route` and options. + +- `mtu`: Sets the Maximum Transmission Unit (MTU) and takes an integer value. +- `metric` Sets the Route Metric for the default route created in every container joined to this network. Accepts a positive integer value. Can only be used with the Netavark network backend. +- `no_default_route`: If set to 1, Podman will not automatically add a default route to subnets. Routes can still be added +manually by creating a custom route using `--route`. + +Additionally the `bridge` driver supports the following options: + +- `vlan`: This option assign VLAN tag and enables vlan\_filtering. Defaults to none. +- `isolate`: This option isolates networks by blocking traffic between those that have this option enabled. +- `com.docker.network.bridge.name`: This option assigns the given name to the created Linux Bridge +- `com.docker.network.driver.mtu`: Sets the Maximum Transmission Unit (MTU) and takes an integer value. +- `vrf`: This option assigns a VRF to the bridge interface. It accepts the name of the VRF and defaults to none. Can only be used with the Netavark network backend. +- `mode`: This option sets the specified bridge mode on the interface. Defaults to `managed`. Supported values: + - `managed`: Podman creates and deletes the bridge and changes sysctls of it. It adds firewall rules to masquerade outgoing traffic, as well as setup port forwarding for incoming traffic using DNAT. + - `unmanaged`: Podman uses an existing bridge. It must exist by the time you want to start a container which uses the network. There will be no NAT or port forwarding, even if such options were passed while creating the container. + +The `macvlan` and `ipvlan` driver support the following options: + +- `parent`: The host device which is used for the macvlan interface. Defaults to the default route interface. +- `mode`: This option sets the specified ip/macvlan mode on the interface. + - Supported values for `macvlan` are `bridge`, `private`, `vepa`, `passthru`. Defaults to `bridge`. + - Supported values for `ipvlan` are `l2`, `l3`, `l3s`. Defaults to `l2`. + +Additionally the `macvlan` driver supports the `bclim` option: + +- `bclim`: Set the threshold for broadcast queueing. Must be a 32 bit integer. Setting this value to `-1` disables broadcast queueing altogether. + +#### **--route**=*route* + +A static route in the format `,,`. This route will be added to every container in this network. Only available with the netavark backend. It can be specified multiple times if more than one static route is desired. + +#### **--subnet**=*subnet* + +The subnet in CIDR notation. Can be specified multiple times to allocate more than one subnet for this network. +The argument order of the **--subnet**, **--gateway** and **--ip-range** options must match. +This is useful to set a static ipv4 and ipv6 subnet. + +## EXAMPLE + +Create a network with no options. +``` +$ podman network create +podman2 +``` + +Create a network named *newnet* that uses *192.5.0.0/16* for its subnet. +``` +$ podman network create --subnet 192.5.0.0/16 newnet +newnet +``` + +Create an IPv6 network named *newnetv6* with a subnet of *2001\:db8::/64*. +``` +$ podman network create --subnet 2001:db8::/64 --ipv6 newnetv6 +newnetv6 +``` + +Create a network named *newnet* that uses *192.168.33.0/24* and defines a gateway as *192.168.33.3*. +``` +$ podman network create --subnet 192.168.33.0/24 --gateway 192.168.33.3 newnet +newnet +``` + +Create a network that uses a *192.168.55.0/24* subnet and has an IP address range of *192.168.55.129 - 192.168.55.254*. +``` +$ podman network create --subnet 192.168.55.0/24 --ip-range 192.168.55.128/25 +podman5 +``` + +Create a network with a static ipv4 and ipv6 subnet and set a gateway. +``` +$ podman network create --subnet 192.168.55.0/24 --gateway 192.168.55.3 --subnet fd52:2a5a:747e:3acd::/64 --gateway fd52:2a5a:747e:3acd::10 +podman4 +``` + +Create a network with a static subnet and a static route. +``` +$ podman network create --subnet 192.168.33.0/24 --route 10.1.0.0/24,192.168.33.10 newnet +``` + +Create a network with a static subnet and a static route without a default +route. +``` +$ podman network create --subnet 192.168.33.0/24 --route 10.1.0.0/24,192.168.33.10 --opt no_default_route=1 newnet +``` + +Create a Macvlan based network using the host interface eth0. Macvlan networks can only be used as root. +``` +$ sudo podman network create -d macvlan -o parent=eth0 --subnet 192.5.0.0/16 newnet +newnet +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-network-ls(1)](podman-network-ls.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +## HISTORY +August 2021, Updated with the new network format by Paul Holzinger + +August 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-network-disconnect.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-network-disconnect.1.md new file mode 100644 index 000000000..e1a804f5f --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-network-disconnect.1.md @@ -0,0 +1,37 @@ +--- +title: podman-network-disconnect +version: v5.4.2 +--- + +% podman-network-disconnect 1 + +## NAME +podman\-network\-disconnect - Disconnect a container from a network + +## SYNOPSIS +**podman network disconnect** [*options*] network container + +## DESCRIPTION +Disconnects a container from a network. A container can be disconnected from a network by name or by ID. +If all networks are disconnected from the container, it behaves like a container created with `--network=none` +and it does not have network connectivity until a network is connected again. + + +## OPTIONS +#### **--force**, **-f** + +Force the container to disconnect from a network + +## EXAMPLE + +Disconnect container from specified network: +``` +podman network disconnect test web +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-connect(1)](podman-network-connect.1.md)** + +## HISTORY +November 2020, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-network-exists.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-network-exists.1.md new file mode 100644 index 000000000..3864b380a --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-network-exists.1.md @@ -0,0 +1,47 @@ +--- +title: podman-network-exists +version: v5.4.2 +--- + +% podman-network-exists 1 + +## NAME +podman\-network\-exists - Check if the given network exists + +## SYNOPSIS +**podman network exists** *network* + +## DESCRIPTION +**podman network exists** checks if a network exists. The **Name** or **ID** +of the network may be used as input. Podman returns an exit code +of `0` when the network is found. A `1` is returned otherwise. An exit code of +`125` indicates there was another issue. + + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLE + +Check if specified network exists (the network does actually exist): +``` +$ podman network exists net1 +$ echo $? +0 +``` + +Check if nonexistent network exists: +``` +$ podman network exists webbackend +$ echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)** + +## HISTORY +January 2021, Originally compiled by Paul Holzinger `` diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-network-inspect.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-network-inspect.1.md new file mode 100644 index 000000000..b89548821 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-network-inspect.1.md @@ -0,0 +1,83 @@ +--- +title: podman-network-inspect +version: v5.4.2 +--- + +% podman-network-inspect 1 + +## NAME +podman\-network\-inspect - Display the network configuration for one or more networks + +## SYNOPSIS +**podman network inspect** [*options*] *network* [*network* ...] + +## DESCRIPTION +Display the (JSON format) network configuration. + +## OPTIONS +#### **--format**, **-f**=*format* + +Pretty-print networks to JSON or using a Go template. + +| **Placeholder** | **Description** | +|--------------------|-------------------------------------------| +| .Containers ... | Running containers on this network. | +| .Created ... | Timestamp when the network was created | +| .DNSEnabled | Network has dns enabled (boolean) | +| .Driver | Network driver | +| .ID | Network ID | +| .Internal | Network is internal (boolean) | +| .IPAMOptions ... | Network ipam options | +| .IPv6Enabled | Network has ipv6 subnet (boolean) | +| .Labels ... | Network labels | +| .Name | Network name | +| .Network ... | Nested Network type | +| .NetworkDNSServers | Array of DNS servers used in this network | +| .NetworkInterface | Name of the network interface on the host | +| .Options ... | Network options | +| .Routes | List of static routes for this network | +| .Subnets | List of subnets on this network | + +## EXAMPLE + +Inspect the default podman network. + +``` +$ podman network inspect podman +[ + { + "name": "podman", + "id": "2f259bab93aaaaa2542ba43ef33eb990d0999ee1b9924b557b7be53c0b7a1bb9", + "driver": "bridge", + "network_interface": "podman0", + "created": "2021-06-03T12:04:33.088567413+02:00", + "subnets": [ + { + "subnet": "10.88.0.0/16", + "gateway": "10.88.0.1" + } + ], + "ipv6_enabled": false, + "internal": false, + "dns_enabled": false, + "ipam_options": { + "driver": "host-local" + } + } +] +``` + +Show the subnet and gateway for a network. + +``` +$ podman network inspect podman --format "{{range .Subnets}}Subnet: {{.Subnet}} Gateway: {{.Gateway}}{{end}}" +Subnet: 10.88.0.0/16 Gateway: 10.88.0.1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-ls(1)](podman-network-ls.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)** + +## HISTORY +August 2021, Updated with the new network format by Paul Holzinger + +August 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-network-ls.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-network-ls.1.md new file mode 100644 index 000000000..8ef720340 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-network-ls.1.md @@ -0,0 +1,124 @@ +--- +title: podman-network-ls +version: v5.4.2 +--- + +% podman-network-ls 1 + +## NAME +podman\-network\-ls - Display a summary of networks + +## SYNOPSIS +**podman network ls** [*options*] + +## DESCRIPTION +Displays a list of existing podman networks. + +## OPTIONS +#### **--filter**, **-f**=*filter=value* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| **Filter** | **Description** | +| ---------- | ------------------------------------------------------------------------------------------------ | +| driver | Filter by driver type. | +| id | Filter by full or partial network ID. | +| label | Filter by network with (or without, in the case of label!=[...] is used) the specified labels. | +| name | Filter by network name (accepts `regex`). | +| until | Filter by networks created before given timestamp. | +| dangling | Filter by networks with no containers attached. | + + +The `driver` filter accepts values: `bridge`, `macvlan`, `ipvlan`. + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which shows images with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which shows images without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +The `dangling` *filter* accepts values `true` or `false`. + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|--------------------|-------------------------------------------| +| .Created ... | Timestamp when the network was created | +| .DNSEnabled | Network has dns enabled (boolean) | +| .Driver | Network driver | +| .ID | Network ID | +| .Internal | Network is internal (boolean) | +| .IPAMOptions ... | Network ipam options | +| .IPv6Enabled | Network has ipv6 subnet (boolean) | +| .Labels | Network labels | +| .Name | Network name | +| .NetworkDNSServers | Array of DNS servers used in this network | +| .NetworkInterface | Name of the network interface on the host | +| .Options ... | Network options | +| .Routes | List of static routes for this network | +| .Subnets | List of subnets on this network | + +#### **--no-trunc** + +Do not truncate the network ID. + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +The `quiet` option restricts the output to only the network names. + +## EXAMPLE + +Display networks: +``` +$ podman network ls +NETWORK ID NAME DRIVER +88a7120ee19d podman bridge +6dd508dbf8cd podman6 bridge +8e35c2cd3bf6 podman5 macvlan +``` + +Display only network names: +``` +$ podman network ls -q +podman +podman2 +outside +podman9 +``` + +Display name of network which support bridge plugin: +``` +$ podman network ls --filter driver=bridge --format {{.Name}} +podman +podman2 +podman9 +``` +List networks with their subnets: +``` +$ podman network ls --format "{{.Name}}: {{range .Subnets}}{{.Subnet}} {{end}}" +podman: 10.88.0.0/16 +podman3: 10.89.30.0/24 fde4:f86f:4aab\:e68f::/64 +macvlan: +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)** + +## HISTORY +August 2021, Updated with the new network format by Paul Holzinger + +August 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-network-prune.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-network-prune.1.md new file mode 100644 index 000000000..a39a989b7 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-network-prune.1.md @@ -0,0 +1,58 @@ +--- +title: podman-network-prune +version: v5.4.2 +--- + +% podman-network-prune 1 + +## NAME +podman\-network\-prune - Remove all unused networks + +## SYNOPSIS +**podman network prune** [*options*] + +## DESCRIPTION +Remove all unused networks. An unused network is defined by a network which +has no containers connected or configured to connect to it. It does not remove +the so-called default network which goes by the name of *podman*. + +## OPTIONS + +#### **--filter** + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------:|----------------------------------------------------------------------------------------------------| +| label | Only remove networks, with (or without, in the case of label!=[...] is used) the specified labels. | +| until | Only remove networks created before given timestamp. | + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes networks with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes networks without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not prompt for confirmation + +## EXAMPLE + +Prune networks: +``` +podman network prune +``` + +Prune all networks created not created in the last two hours: +``` +podman network prune --filter until=2h +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-rm(1)](podman-network-rm.1.md)** + +## HISTORY +February 2021, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-network-reload.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-network-reload.1.md new file mode 100644 index 000000000..294841066 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-network-reload.1.md @@ -0,0 +1,67 @@ +--- +title: podman-network-reload +version: v5.4.2 +--- + +% podman-network-reload 1 + +## NAME +podman\-network\-reload - Reload network configuration for containers + +## SYNOPSIS +**podman network reload** [*options*] [*container...*] + +## DESCRIPTION +Reload one or more container network configurations. + +Rootful Podman relies on iptables rules in order to provide network connectivity. If the iptables rules are deleted, +this happens for example with `firewall-cmd --reload`, the container loses network connectivity. This command restores +the network connectivity. + +## OPTIONS +#### **--all**, **-a** + +Reload network configuration of all containers. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Reload the network configuration after a firewall reload: +``` +# podman run -p 80:80 -d nginx +b1b538e8bc4078fc3ee1c95b666ebc7449b9a97bacd15bcbe464a29e1be59c1c +# curl 127.0.0.1 +works +# sudo firewall-cmd --reload +success +# curl 127.0.0.1 +hangs +# podman network reload b1b538e8bc40 +b1b538e8bc4078fc3ee1c95b666ebc7449b9a97bacd15bcbe464a29e1be59c1c +# curl 127.0.0.1 +works +``` + +Reload the network configuration for all containers: +``` +# podman network reload --all +b1b538e8bc4078fc3ee1c95b666ebc7449b9a97bacd15bcbe464a29e1be59c1c +fe7e8eca56f844ec33af10f0aa3b31b44a172776e3277b9550a623ed5d96e72b +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)** + +## HISTORY +December 2020, Originally compiled by Paul Holzinger diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-network-rm.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-network-rm.1.md new file mode 100644 index 000000000..f8d11c974 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-network-rm.1.md @@ -0,0 +1,54 @@ +--- +title: podman-network-rm +version: v5.4.2 +--- + +% podman-network-rm 1 + +## NAME +podman\-network\-rm - Remove one or more networks + +## SYNOPSIS +**podman network rm** [*options*] [*network...*] + +## DESCRIPTION +Delete one or more Podman networks. + +## OPTIONS +#### **--force**, **-f** + +The `force` option removes all containers that use the named network. If the container is +running, the container is stopped and removed. + +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping the running containers that are using the specified network. The --force option must be specified to use the --time option. Use -1 for infinite wait. + +## EXAMPLE + +Delete specified network: +``` +# podman network rm podman9 +Deleted: podman9 +``` + +Delete specified network and all containers associated with the network: +``` +# podman network rm -f fred +Deleted: fred +``` + +## Exit Status + **0** All specified networks removed + + **1** One of the specified networks did not exist, and no other failures + + **2** The network is in use by a container or a Pod + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)** + +## HISTORY +August 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-network-update.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-network-update.1.md new file mode 100644 index 000000000..0a9690630 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-network-update.1.md @@ -0,0 +1,41 @@ +--- +title: podman-network-update +version: v5.4.2 +--- + +% podman-network-update 1 + +## NAME +podman\-network\-update - Update an existing Podman network + +## SYNOPSIS +**podman network update** [*options*] *network* + +## DESCRIPTION +Allow changes to existing container networks. At present, only changes to the DNS servers in use by a network is supported. + +NOTE: Only supported with the netavark network backend. + + +## OPTIONS +#### **--dns-add** + +Accepts array of DNS resolvers and add it to the existing list of resolvers configured for a network. + +#### **--dns-drop** + +Accepts array of DNS resolvers and removes them from the existing list of resolvers configured for a network. + +## EXAMPLE + +Update a network: +``` +$ podman network update network1 --dns-add 8.8.8.8,1.1.1.1 +``` + +Update a network and add/remove dns servers: +``` +$ podman network update network1 --dns-drop 8.8.8.8 --dns-add 3.3.3.3 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-network-ls(1)](podman-network-ls.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-network.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-network.1.md new file mode 100644 index 000000000..e3c426e98 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-network.1.md @@ -0,0 +1,61 @@ +--- +title: podman-network +version: v5.4.2 +--- + +% podman-network 1 + +## NAME +podman\-network - Manage Podman networks + +## SYNOPSIS +**podman network** *subcommand* + +## DESCRIPTION +The network command manages networks for Podman. + +Podman supports two network backends [Netavark](https://github.com/containers/netavark) +and [CNI](https://www.cni.dev/). Netavark is the default network backend and was added in Podman version 4.0. +CNI is deprecated and will be removed in the next major Podman version 5.0, in preference of Netavark. +To configure the network backend use the `network_backend` key under the `[Network]` in +**[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**. +New systems use netavark by default, to check what backend is used run +`podman info --format {{.Host.NetworkBackend}}`. + +All network commands work for both backends but CNI and Netavark use different config files +so networks have to be created again after a backend change. + +## COMMANDS + +| Command | Man Page | Description | +| ---------- | -------------------------------------------------------------- | --------------------------------------------------------------- | +| connect | [podman-network-connect(1)](podman-network-connect.1.md) | Connect a container to a network | +| create | [podman-network-create(1)](podman-network-create.1.md) | Create a Podman network | +| disconnect | [podman-network-disconnect(1)](podman-network-disconnect.1.md) | Disconnect a container from a network | +| exists | [podman-network-exists(1)](podman-network-exists.1.md) | Check if the given network exists | +| inspect | [podman-network-inspect(1)](podman-network-inspect.1.md) | Display the network configuration for one or more networks | +| ls | [podman-network-ls(1)](podman-network-ls.1.md) | Display a summary of networks | +| prune | [podman-network-prune(1)](podman-network-prune.1.md) | Remove all unused networks | +| reload | [podman-network-reload(1)](podman-network-reload.1.md) | Reload network configuration for containers | +| rm | [podman-network-rm(1)](podman-network-rm.1.md) | Remove one or more networks | +| update | [podman-network-update(1)](podman-network-update.1.md) | Update an existing Podman network | + +## SUBNET NOTES +Podman requires specific default IPs and, thus, network subnets. The default values used by Podman can be modified in the **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** file. + +### Podman network +The default bridge network (called `podman`) uses 10.88.0.0/16 as a subnet. When Podman runs as root, the `podman` network is used as default. It is the same as adding the option `--network bridge` or `--network podman`. This subnet can be changed in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** under the [network] section. Set the `default_subnet` to any subnet that is free in the environment. The name of the default network can also be changed from `podman` to another name using the default network key. Note that this is only done when no containers are running. + +### Pasta +Pasta by default performs no Network Address Translation (NAT) and copies the IPs from your main interface into the container namespace. If pasta cannot find an interface with the default route, it will select an interface if there is only one interface with a valid route. If you do not have a default route and several interfaces have defined routes, pasta will be unable to figure out the correct interface and it will fail to start. To specify the interface, use `-i` option to pasta. A default set of pasta options can be set in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** under the `[network]` section with the `pasta_options` key. + +The default rootless networking tool can be selected in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** under the `[network]` section with `default_rootless_network_cmd`, which can be set to `pasta` (default) or `slirp4netns`. + +### Slirp4netns +Slirp4netns uses 10.0.2.0/24 for its default network. This can also be changed in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** but under the `[engine]` section. Use the `network_cmd_options` key and add `["cidr=X.X.X.X/24"]` as a value. Note that slirp4netns needs a network prefix size between 1 and 25. This option accepts an array, so more options can be added in a comma-separated string as described on the **[podman-network-create(1)](podman-network-create.1.md)** man page. To change the CIDR for just one container, specify it on the cli using the `--network` option like this: `--network slirp4netns\:cidr=192.168.1.0/24`. + +### Podman network create +When a new network is created with a `podman network create` command, and no subnet is given with the --subnet option, Podman starts picking a free subnet from 10.89.0.0/24 to 10.255.255.0/24. Use the `default_subnet_pools` option under the `[network]` section in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** to change the range and/or size that is assigned by default. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-pause.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-pause.1.md new file mode 100644 index 000000000..f8f462c8e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-pause.1.md @@ -0,0 +1,102 @@ +--- +title: podman-pause +version: v5.4.2 +--- + +% podman-pause 1 + +## NAME +podman\-pause - Pause one or more containers + +## SYNOPSIS +**podman pause** [*options*] [*container*...] + +**podman container pause** [*options*] [*container*...] + +## DESCRIPTION +Pauses all the processes in one or more containers. You may use container IDs or names as input. + +## OPTIONS + +#### **--all**, **-a** + +Pause all running containers. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and pause the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + +#### **--filter**, **-f**=*filter* + +Filter what containers pause. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Pause specified container: +``` +podman pause mywebserver +``` + +Pause container by partial container ID: +``` +podman pause 860a4b23 +``` + +Pause all **running** containers: +``` +podman pause --all +``` + +Pause container using ID specified in given files: +``` +podman pause --cidfile /home/user/cidfile-1 +podman pause --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +Pause the latest container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman pause --latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-unpause(1)](podman-unpause.1.md)** + +## HISTORY +September 2017, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-pod-clone.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-pod-clone.1.md new file mode 100644 index 000000000..c7b6445ab --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-pod-clone.1.md @@ -0,0 +1,794 @@ +--- +title: podman-pod-clone +version: v5.4.2 +--- + +% podman-pod-clone 1 + +## NAME +podman\-pod\-clone - Create a copy of an existing pod + +## SYNOPSIS +**podman pod clone** [*options*] *pod* *name* + +## DESCRIPTION +**podman pod clone** creates a copy of a pod, recreating the identical config for the pod and for all of its containers. Users can modify the pods new name and select pod details within the infra container + +## OPTIONS + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the pod is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + +#### **--cpus** + +Set a number of CPUs for the pod that overrides the original pods CPU limits. If none are specified, the original pod's Nano CPUs are used. + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + +If none are specified, the original pod's CPUset is used. + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/destroy.md) +#### **--destroy** + +Remove the original pod that we are cloning once used to mimic the configuration. + +[//]: # (END included file options/destroy.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the pod. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The pod only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: the pod implements devices by storing the initial configuration passed by the user and recreating the device on each container added to the pod. + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + + +[//]: # (BEGIN included file options/gidmap.pod.md) +#### **--gidmap**=*pod_gid\:host_gid\:amount* + +GID map for the user namespace. Using this flag runs all containers in the pod with user namespace enabled. +It conflicts with the **--userns** and **--subgidname** flags. + +[//]: # (END included file options/gidmap.pod.md) + + +[//]: # (BEGIN included file options/gpus.md) +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. + +[//]: # (END included file options/gpus.md) + +#### **--help**, **-h** + +Print usage statement. + + +[//]: # (BEGIN included file options/hostname.pod.md) +#### **--hostname**=*name* + +Set the pod's hostname inside all containers. + +The given hostname is also added to the `/etc/hosts` file using the container's +primary IP address (also see the **--add-host** option). + +[//]: # (END included file options/hostname.pod.md) + + +[//]: # (BEGIN included file options/infra-command.md) +#### **--infra-command**=*command* + +The command that is run to start the infra container. Default: "/pause". + +[//]: # (END included file options/infra-command.md) + + +[//]: # (BEGIN included file options/infra-conmon-pidfile.md) +#### **--infra-conmon-pidfile**=*file* + +Write the pid of the infra container's **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to manage Podman containers and pods. + +[//]: # (END included file options/infra-conmon-pidfile.md) + + +[//]: # (BEGIN included file options/infra-name.md) +#### **--infra-name**=*name* + +The name that is used for the pod's infra container. + +[//]: # (END included file options/infra-name.md) + + +[//]: # (BEGIN included file options/label.md) +#### **--label**, **-l**=*key=value* + +Add metadata to a pod. + +[//]: # (END included file options/label.md) + + +[//]: # (BEGIN included file options/label-file.md) +#### **--label-file**=*file* + +Read in a line-delimited file of labels. + +[//]: # (END included file options/label-file.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + +#### **--name**, **-n** + +Set a custom name for the cloned pod. The default if not specified is of the syntax: **\-clone** + + +[//]: # (BEGIN included file options/pid.pod.md) +#### **--pid**=*pid* + +Set the PID mode for the pod. The default is to create a private PID namespace for the pod. Requires the PID namespace to be shared via --share. + + host: use the host’s PID namespace for the pod + ns: join the specified PID namespace + private: create a new namespace for the pod (default) + +[//]: # (END included file options/pid.pod.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + +Default restart policy for all the containers in a pod. + + +[//]: # (BEGIN included file options/security-opt.md) +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the pod +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the pod + +- **label=user:**_USER_: Set the label user for the pod processes +- **label=role:**_ROLE_: Set the label role for the pod processes +- **label=type:**_TYPE_: Set the label process type for the pod processes +- **label=level:**_LEVEL_: Set the label level for the pod processes +- **label=filetype:**_TYPE_: Set the label file type for the pod files +- **label=disable**: Turn off label separation for the pod + +Note: Labeling can be disabled for all pods/containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the containers within the pod. + +- **no-new-privileges**: Disable container processes from gaining additional privileges. + +- **seccomp=unconfined**: Turn off seccomp confinement for the pod. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. + +[//]: # (END included file options/security-opt.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the pod. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/shm-size-systemd.md) +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. + +[//]: # (END included file options/shm-size-systemd.md) + +#### **--start** + +When set to true, this flag starts the newly created pod after the +clone process has completed. All containers within the pod are started. + + +[//]: # (BEGIN included file options/subgidname.md) +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. + +[//]: # (END included file options/subgidname.md) + + +[//]: # (BEGIN included file options/subuidname.md) +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. + +[//]: # (END included file options/subuidname.md) + + +[//]: # (BEGIN included file options/sysctl.md) +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters for all containers in the pod. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: if the ipc namespace is not shared within the pod, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: if the network namespace is not shared within the pod, the above sysctls are not allowed. + +[//]: # (END included file options/sysctl.md) + + +[//]: # (BEGIN included file options/uidmap.pod.md) +#### **--uidmap**=*container_uid\:from_uid\:amount* + +Run all containers in the pod in a new user namespace using the supplied mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +[//]: # (END included file options/uidmap.pod.md) + + +[//]: # (BEGIN included file options/userns.pod.md) +#### **--userns**=*mode* + +Set the user namespace mode for all the containers in a pod. It defaults to the `PODMAN_USERNS` environment variable. An empty value ("") means user namespaces are disabled. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +----------|---------------|--------------------- +"" |$UID |0 (Default User account mapped to root user in container.) +host |$UID |0 (Default User account mapped to root user in container.) +keep-id |$UID |$UID (Map user account to same UID within container.) +auto |$UID | nil (Host User UID is not mapped into container.) +nomap |$UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + + - *auto[:*_OPTIONS,..._*]*: automatically create a namespace. It is possible to specify these options to `auto`: + + - *gidmapping=*_CONTAINER\_GID\:HOST\_GID\:SIZE_ to force a GID mapping to be present in the user namespace. + + - *size=*_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates the size for the user namespace. + + - *uidmapping=*_CONTAINER\_UID\:HOST\_UID\:SIZE_ to force a UID mapping to be present in the user namespace. + + - *host*: run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user (default). + + - *keep-id*: creates a user namespace where the current rootless user's UID\:GID are mapped to the same values in the container. This option is not allowed for containers created by the root user. + + - *nomap*: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +[//]: # (END included file options/userns.pod.md) + + +[//]: # (BEGIN included file options/uts.pod.md) +#### **--uts**=*mode* + +Set the UTS namespace mode for the pod. The following values are supported: + +- **host**: use the host's UTS namespace inside the pod. +- **private**: create a new namespace for the pod (default). +- **ns:[path]**: run the pod in the given existing UTS namespace. + +[//]: # (END included file options/uts.pod.md) + + +[//]: # (BEGIN included file options/volume.md) +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the pod is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +pod. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a pod is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the pod, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the pod. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a pod. Without a label, the security system +might prevent the processes running inside the pod from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the pod context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +pods share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label Only the current pod can use a private +volume. Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any of one the containers. Relabeling walks +the file system under the volume and changes the label on each file, if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the pod. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually change with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the pod. +For example if a user wanted to volume mount their entire home directory into a +pod, they need to disable SELinux separation. + + $ podman pod clone --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The pod processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the pod +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous pod executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the pod infra container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the pod or infra container +to work. + +Do not modify the source directory mounted into the pod with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the pod are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the pod +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +pod, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +pod. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the pod. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the pod. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless pod fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/volume.md) + + +[//]: # (BEGIN included file options/volumes-from.md) +#### **--volumes-from**=*CONTAINER[\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers and pods. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +pod. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a pod. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the pod context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target pod, then the volume hides +that data on the target. + +[//]: # (END included file options/volumes-from.md) + +## EXAMPLES + +Clone the specified pod to a new pod. +``` +# podman pod clone pod-name +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone the specified pod to a new pod with a new name. +``` +# podman pod clone pod-name --name=cloned-pod +d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone and remove the specified pod to a new pod, modifying its cpus. +``` +# podman pod clone --destroy --cpus=5 d0cf1 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone the specified pod to a new named pod. +``` +# podman pod clone 2d4d4fca7219b4437e0d74fcdc272c4f031426a6eacd207372691207079551de new_name +5a9b7851013d326aa4ac4565726765901b3ecc01fcbc0f237bc7fd95588a24f9 +``` +## SEE ALSO +**[podman-pod-create(1)](podman-pod-create.1.md)** + +## HISTORY +May 2022, Originally written by Charlie Doern + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a core value of open source. The `master` and `slave` mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately. diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-pod-create.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-pod-create.1.md new file mode 100644 index 000000000..8fe9dec2e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-pod-create.1.md @@ -0,0 +1,1130 @@ +--- +title: podman-pod-create +version: v5.4.2 +--- + +% podman-pod-create 1 + +## NAME +podman\-pod\-create - Create a new pod + +## SYNOPSIS +**podman pod create** [*options*] [*name*] + +## DESCRIPTION + +Creates an empty pod, or unit of multiple containers, and prepares it to have +containers added to it. The pod can be created with a specific name. If a name +is not given a random name is generated. The pod ID is printed to STDOUT. You +can then use **podman create --pod `` ...** to add containers +to the pod, and **podman pod start ``** to start the pod. + +The operator can identify a pod in three ways: +UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”) +UUID short identifier (“f78375b1c487”) +Name (“jonah”) + +podman generates a UUID for each pod, and if a name is not assigned +to the container with **--name** then a random string name is generated +for it. This name is useful to identify a pod. + +Note: resource limit related flags work by setting the limits explicitly in the pod's cgroup parent +for all containers joining the pod. A container can override the resource limits when joining a pod. +For example, if a pod was created via **podman pod create --cpus=5**, specifying **podman container create --pod=`` --cpus=4** causes the container to use the smaller limit. Also, containers which specify their own cgroup, such as **--cgroupns=host**, do NOT get the assigned pod level cgroup resources. + +## OPTIONS + + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the pod's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + +The /etc/hosts file is shared between all containers in the pod. + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the pod is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + +#### **--cpus**=*amount* + +Set the total number of CPUs delegated to the pod. Default is 0.000 which indicates that there is no limit on computation power. + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the pod. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The pod only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: the pod implements devices by storing the initial configuration passed by the user and recreating the device on each container added to the pod. + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + +#### **--dns**=*ipaddr* + +Set custom DNS servers in the /etc/resolv.conf file that is shared between all containers in the pod. A special option, "none" is allowed which disables creation of /etc/resolv.conf for the pod. + +#### **--dns-option**=*option* + +Set custom DNS options in the /etc/resolv.conf file that is shared between all containers in the pod. + +#### **--dns-search**=*domain* + +Set custom DNS search domains in the /etc/resolv.conf file that is shared between all containers in the pod. + +#### **--exit-policy**=**continue** | *stop* + +Set the exit policy of the pod when the last container exits. Supported policies are: + +| Exit Policy | Description | +| ------------------ | -------------------------------------------------------------------------------------------------------------------------- | +| *continue* | The pod continues running, by keeping its infra container alive, when the last container exits. Used by default. | +| *stop* | The pod (including its infra container) is stopped when the last container exits. Used in `kube play`. | + + +[//]: # (BEGIN included file options/gidmap.pod.md) +#### **--gidmap**=*pod_gid\:host_gid\:amount* + +GID map for the user namespace. Using this flag runs all containers in the pod with user namespace enabled. +It conflicts with the **--userns** and **--subgidname** flags. + +[//]: # (END included file options/gidmap.pod.md) + + +[//]: # (BEGIN included file options/gpus.md) +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. + +[//]: # (END included file options/gpus.md) + +#### **--help**, **-h** + +Print usage statement. + + +[//]: # (BEGIN included file options/hostname.pod.md) +#### **--hostname**=*name* + +Set the pod's hostname inside all containers. + +The given hostname is also added to the `/etc/hosts` file using the container's +primary IP address (also see the **--add-host** option). + +[//]: # (END included file options/hostname.pod.md) + + +[//]: # (BEGIN included file options/hosts-file.md) +#### **--hosts-file**=*path* | *none* | *image* + +Base file to create the `/etc/hosts` file inside the container. This must either +be an absolute path to a file on the host system, or one of the following +special flags: + "" Follow the `base_hosts_file` configuration in _containers.conf_ (the default) + `none` Do not use a base file (i.e. start with an empty file) + `image` Use the container image's `/etc/hosts` file as base file + +[//]: # (END included file options/hosts-file.md) + +#### **--infra** + +Create an infra container and associate it with the pod. An infra container is a lightweight container used to coordinate the shared kernel namespace of a pod. Default: true. + + +[//]: # (BEGIN included file options/infra-command.md) +#### **--infra-command**=*command* + +The command that is run to start the infra container. Default: "/pause". + +[//]: # (END included file options/infra-command.md) + + +[//]: # (BEGIN included file options/infra-conmon-pidfile.md) +#### **--infra-conmon-pidfile**=*file* + +Write the pid of the infra container's **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to manage Podman containers and pods. + +[//]: # (END included file options/infra-conmon-pidfile.md) + +#### **--infra-image**=*image* + +The custom image that is used for the infra container. Unless specified, Podman builds a custom local image which does not require pulling down an image. + + +[//]: # (BEGIN included file options/infra-name.md) +#### **--infra-name**=*name* + +The name that is used for the pod's infra container. + +[//]: # (END included file options/infra-name.md) + + +[//]: # (BEGIN included file options/ip.md) +#### **--ip**=*ipv4* + +Specify a static IPv4 address for the pod, for example **10.88.64.128**. +This option can only be used if the pod is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the pod is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IP address pool (default **10.88.0.0/16**). + +To specify multiple static IP addresses per pod, set multiple networks using the **--network** option with a static IP address specified for each using the `ip` mode for that option. + +[//]: # (END included file options/ip.md) + + +[//]: # (BEGIN included file options/ip6.md) +#### **--ip6**=*ipv6* + +Specify a static IPv6 address for the pod, for example **fd46\:db93\:aa76\:ac37::10**. +This option can only be used if the pod is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the pod is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IPv6 address pool. + +To specify multiple static IPv6 addresses per pod, set multiple networks using the **--network** option with a static IPv6 address specified for each using the `ip6` mode for that option. + +[//]: # (END included file options/ip6.md) + + +[//]: # (BEGIN included file options/label.md) +#### **--label**, **-l**=*key=value* + +Add metadata to a pod. + +[//]: # (END included file options/label.md) + + +[//]: # (BEGIN included file options/label-file.md) +#### **--label-file**=*file* + +Read in a line-delimited file of labels. + +[//]: # (END included file options/label-file.md) + + +[//]: # (BEGIN included file options/mac-address.md) +#### **--mac-address**=*address* + +Pod network interface MAC address (e.g. 92\:d0\:c6:0a:29:33) +This option can only be used if the pod is joined to only a single network - i.e., **--network=_network-name_** is used at most once - +and if the pod is not joining another container's network namespace via **--network=container\:_id_**. + +Remember that the MAC address in an Ethernet network must be unique. +The IPv6 link-local address is based on the device's MAC address +according to RFC4862. + +To specify multiple static MAC addresses per pod, set multiple networks using the **--network** option with a static MAC address specified for each using the `mac` mode for that option. + +[//]: # (END included file options/mac-address.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + +#### **--name**, **-n**=*name* + +Assign a name to the pod. + + +[//]: # (BEGIN included file options/network.md) +#### **--network**=*mode*, **--net** + +Set the network mode for the pod. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured, to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.md) + +Invalid if using **--dns**, **--dns-option**, or **--dns-search** with **--network** set to **none** or **container:**_id_. + + +[//]: # (BEGIN included file options/network-alias.md) +#### **--network-alias**=*alias* + +Add a network-scoped alias for the pod, setting the alias for all networks that the container joins. To set a +name only for a specific network, use the alias option as described under the **--network** option. +If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. This option can be specified multiple times. +NOTE: When using CNI a pod only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. + +[//]: # (END included file options/network-alias.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the pod. + +Podman assumes control over the pod's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/pid.pod.md) +#### **--pid**=*pid* + +Set the PID mode for the pod. The default is to create a private PID namespace for the pod. Requires the PID namespace to be shared via --share. + + host: use the host’s PID namespace for the pod + ns: join the specified PID namespace + private: create a new namespace for the pod (default) + +[//]: # (END included file options/pid.pod.md) + +#### **--pod-id-file**=*path* + +Write the pod ID to the file. + + +[//]: # (BEGIN included file options/publish.md) +#### **--publish**, **-p**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Publish a container's port, or range of ports, within this pod to the host. + +Both *hostPort* and *containerPort* can be specified as a range of ports. +When specifying ranges for both, the number of container ports in the +range must match the number of host ports in the range. + +If host IP is set to 0.0.0.0 or not set at all, the port is bound on all IPs on the host. + +By default, Podman publishes TCP ports. To publish a UDP port instead, give +`udp` as protocol. To publish both TCP and UDP ports, set `--publish` twice, +with `tcp`, and `udp` as protocols respectively. Rootful containers can also +publish ports using the `sctp` protocol. + +Host port does not have to be specified (e.g. `podman run -p 127.0.0.1::80`). +If it is not, the container port is randomly assigned a port on the host. + +Use **podman port** to see the actual mapping: `podman port $CONTAINER $CONTAINERPORT`. + +Note that the network drivers `macvlan` and `ipvlan` do not support port forwarding, +it will have no effect on these networks. + +[//]: # (END included file options/publish.md) + +**Note:** You must not publish ports of containers in the pod individually, +but only by the pod itself. + +**Note:** This cannot be modified once the pod is created. + + +[//]: # (BEGIN included file options/replace.md) +#### **--replace** + +If another pod with the same name already exists, replace and remove it. The default is **false**. + +[//]: # (END included file options/replace.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + +Default restart policy for all the containers in a pod. + + +[//]: # (BEGIN included file options/security-opt.md) +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the pod +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the pod + +- **label=user:**_USER_: Set the label user for the pod processes +- **label=role:**_ROLE_: Set the label role for the pod processes +- **label=type:**_TYPE_: Set the label process type for the pod processes +- **label=level:**_LEVEL_: Set the label level for the pod processes +- **label=filetype:**_TYPE_: Set the label file type for the pod files +- **label=disable**: Turn off label separation for the pod + +Note: Labeling can be disabled for all pods/containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the containers within the pod. + +- **no-new-privileges**: Disable container processes from gaining additional privileges. + +- **seccomp=unconfined**: Turn off seccomp confinement for the pod. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. + +[//]: # (END included file options/security-opt.md) + +#### **--share**=*namespace* + +A comma-separated list of kernel namespaces to share. If none or "" is specified, no namespaces are shared, and the infra container is not created unless explicitly specified via **--infra=true**. The namespaces to choose from are cgroup, ipc, net, pid, uts. If the option is prefixed with a "+", the namespace is appended to the default list. Otherwise, it replaces the default list. Defaults match Kubernetes default (ipc, net, uts) + +#### **--share-parent** + +This boolean determines whether or not all containers entering the pod use the pod as their cgroup parent. The default value of this option is true. Use the **--share** option to share the cgroup namespace rather than a cgroup parent in a pod. + +Note: This option conflicts with the **--share=cgroup** option since that option sets the pod as the cgroup parent but enters the container into the same cgroupNS as the infra container. + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the pod. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/shm-size-systemd.md) +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. + +[//]: # (END included file options/shm-size-systemd.md) + + +[//]: # (BEGIN included file options/subgidname.md) +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. + +[//]: # (END included file options/subgidname.md) + + +[//]: # (BEGIN included file options/subuidname.md) +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. + +[//]: # (END included file options/subuidname.md) + + +[//]: # (BEGIN included file options/sysctl.md) +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters for all containers in the pod. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: if the ipc namespace is not shared within the pod, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: if the network namespace is not shared within the pod, the above sysctls are not allowed. + +[//]: # (END included file options/sysctl.md) + + +[//]: # (BEGIN included file options/uidmap.pod.md) +#### **--uidmap**=*container_uid\:from_uid\:amount* + +Run all containers in the pod in a new user namespace using the supplied mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +[//]: # (END included file options/uidmap.pod.md) + + +[//]: # (BEGIN included file options/userns.pod.md) +#### **--userns**=*mode* + +Set the user namespace mode for all the containers in a pod. It defaults to the `PODMAN_USERNS` environment variable. An empty value ("") means user namespaces are disabled. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +----------|---------------|--------------------- +"" |$UID |0 (Default User account mapped to root user in container.) +host |$UID |0 (Default User account mapped to root user in container.) +keep-id |$UID |$UID (Map user account to same UID within container.) +auto |$UID | nil (Host User UID is not mapped into container.) +nomap |$UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + + - *auto[:*_OPTIONS,..._*]*: automatically create a namespace. It is possible to specify these options to `auto`: + + - *gidmapping=*_CONTAINER\_GID\:HOST\_GID\:SIZE_ to force a GID mapping to be present in the user namespace. + + - *size=*_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates the size for the user namespace. + + - *uidmapping=*_CONTAINER\_UID\:HOST\_UID\:SIZE_ to force a UID mapping to be present in the user namespace. + + - *host*: run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user (default). + + - *keep-id*: creates a user namespace where the current rootless user's UID\:GID are mapped to the same values in the container. This option is not allowed for containers created by the root user. + + - *nomap*: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +[//]: # (END included file options/userns.pod.md) + + +[//]: # (BEGIN included file options/uts.pod.md) +#### **--uts**=*mode* + +Set the UTS namespace mode for the pod. The following values are supported: + +- **host**: use the host's UTS namespace inside the pod. +- **private**: create a new namespace for the pod (default). +- **ns:[path]**: run the pod in the given existing UTS namespace. + +[//]: # (END included file options/uts.pod.md) + + +[//]: # (BEGIN included file options/volume.md) +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the pod is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +pod. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a pod is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the pod, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the pod. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a pod. Without a label, the security system +might prevent the processes running inside the pod from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the pod context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +pods share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label Only the current pod can use a private +volume. Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any of one the containers. Relabeling walks +the file system under the volume and changes the label on each file, if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the pod. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually change with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the pod. +For example if a user wanted to volume mount their entire home directory into a +pod, they need to disable SELinux separation. + + $ podman pod create --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The pod processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the pod +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous pod executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the pod infra container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the pod or infra container +to work. + +Do not modify the source directory mounted into the pod with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the pod are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the pod +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +pod, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +pod. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the pod. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the pod. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless pod fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/volume.md) + + +[//]: # (BEGIN included file options/volumes-from.md) +#### **--volumes-from**=*CONTAINER[\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers and pods. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +pod. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a pod. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the pod context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target pod, then the volume hides +that data on the target. + +[//]: # (END included file options/volumes-from.md) + +## EXAMPLES + +Create a named pod. +``` +$ podman pod create --name test +``` + +Create a named pod. +``` +$ podman pod create mypod +``` + +Create a pod without an infra container. +``` +$ podman pod create --infra=false +``` + +Create a named pod with infra container command to run. +``` +$ podman pod create --infra-command /top toppod +``` + +Create a pod with published ports on the host. +``` +$ podman pod create --publish 8443:443 +``` + +Create a pod with the specified network configuration. +``` +$ podman pod create --network slirp4netns:outbound_addr=127.0.0.1,allow_host_loopback=true +``` + +Create a pod with the specified network. +``` +$ podman pod create --network pasta +``` + +Create a pod on two networks. +``` +$ podman pod create --network net1\:ip=10.89.1.5 --network net2\:ip=10.89.10.10 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **containers.conf(1)**, **[cgroups(7)](https://man7.org/linux/man-pages/man7/cgroups.7.html)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +July 2018, Originally compiled by Peter Hunt + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a core value of open source. The `master` and `slave` mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately. diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-pod-exists.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-pod-exists.1.md new file mode 100644 index 000000000..f32add615 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-pod-exists.1.md @@ -0,0 +1,38 @@ +--- +title: podman-pod-exists +version: v5.4.2 +--- + +% podman-pod-exists 1 + +## NAME +podman-pod-exists - Check if a pod exists in local storage + +## SYNOPSIS +**podman pod exists** *pod* + +## DESCRIPTION +**podman pod exists** checks if a pod exists in local storage. The **ID** or **Name** +of the pod may be used as input. Podman returns an exit code +of `0` when the pod is found. A `1` is returned otherwise. An exit code of `125` indicates there +was an issue accessing the local storage. + +## EXAMPLES + +Check if specified pod exists in local storage (the pod does actually exist): +``` +$ sudo podman pod exists web; echo $? +0 +``` + +Check if specified pod exists in local storage (the pod does not actually exist): +``` +$ sudo podman pod exists backend; echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-pod-inspect.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-pod-inspect.1.md new file mode 100644 index 000000000..ddef4a787 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-pod-inspect.1.md @@ -0,0 +1,113 @@ +--- +title: podman-pod-inspect +version: v5.4.2 +--- + +% podman-pod-inspect 1 + +## NAME +podman\-pod\-inspect - Display information describing a pod + +## SYNOPSIS +**podman pod inspect** [*options*] *pod* ... + +## DESCRIPTION +Displays configuration and state information about a given pod. It also displays information about containers +that belong to the pod. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|----------------------|---------------------------------------------| +| .BlkioDeviceReadBps | Block I/O Device Read, in bytes/sec | +| .BlkioDeviceWriteBps | Block I/O Device Read, in bytes/sec | +| .BlkioWeight | Block I/O Weight | +| .BlkioWeightDevice | Block I/O Device Weight | +| .CgroupParent | Pod cgroup parent | +| .CgroupPath | Pod cgroup path | +| .Containers | Pod containers | +| .CPUPeriod | CPU period | +| .CPUQuota | CPU quota | +| .CPUSetCPUs | CPU Set CPUs | +| .CPUSetMems | CPU Set Mems | +| .CPUShares | CPU Shares | +| .CreateCgroup | Whether cgroup was created | +| .CreateCommand | Create command | +| .Created ... | Time when the pod was created | +| .CreateInfra | Whether infrastructure created | +| .Devices | Devices | +| .ExitPolicy | Exit policy | +| .Hostname | Pod hostname | +| .ID | Pod ID | +| .InfraConfig ... | Infra config (contains further fields) | +| .InfraContainerID | Pod infrastructure ID | +| .InspectPodData ... | Nested structure, for experts only | +| .Labels ... | Pod labels | +| .LockNumber | Number of the pod's Libpod lock | +| .MemoryLimit | Memory limit, bytes | +| .MemorySwap | Memory swap limit, in bytes | +| .Mounts | Mounts | +| .Name | Pod name | +| .Namespace | Namespace | +| .NumContainers | Number of containers in the pod | +| .RestartPolicy | Restart policy of the pod | +| .SecurityOpts | Security options | +| .SharedNamespaces | Pod shared namespaces | +| .State | Pod state | +| .VolumesFrom | Volumes from | + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Inspect specified pod: +``` +# podman pod inspect foobar +[ + { + "Id": "3513ca70583dd7ef2bac83331350f6b6c47d7b4e526c908e49d89ebf720e4693", + "Name": "foobar", + "Labels": {}, + "CgroupParent": "/libpod_parent", + "CreateCgroup": true, + "Created": "2018-08-08T11:15:18.823115347-05:00" + "State": "created", + "Hostname": "", + "SharedNamespaces": [ + "uts", + "ipc", + "net" + ] + "CreateInfra": false, + "InfraContainerID": "1020dd70583dd7ff2bac83331350f6b6e007de0d026c908e49d89ebf891d4699" + "CgroupPath": "" + "Containers": [ + { + "id": "d53f8bf1e9730281264aac6e6586e327429f62c704abea4b6afb5d8a2b2c9f2c", + "state": "configured" + } + ] + } +] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +August 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-pod-kill.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-pod-kill.1.md new file mode 100644 index 000000000..c8202dd14 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-pod-kill.1.md @@ -0,0 +1,73 @@ +--- +title: podman-pod-kill +version: v5.4.2 +--- + +% podman-pod-kill 1 + +## NAME +podman\-pod\-kill - Kill the main process of each container in one or more pods + +## SYNOPSIS +**podman pod kill** [*options*] *pod* ... + +## DESCRIPTION +The main process of each container inside the pods specified is sent SIGKILL, or any signal specified with option --signal. + +## OPTIONS +#### **--all**, **-a** + +Sends signal to all containers associated with a pod. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/signal.md) +#### **--signal**, **-s**=**signal** + +Signal to send to the containers in the pod. For more information on Linux signals, refer to *signal(7)*. +The default is **SIGKILL**. + +[//]: # (END included file options/signal.md) + +## EXAMPLE + +Kill pod with a given name: +``` +podman pod kill mywebserver +``` + +Kill pod with a given ID: +``` +podman pod kill 860a4b23 +``` + +Terminate pod by sending `TERM` signal: +``` +podman pod kill --signal TERM 860a4b23 +``` + +Kill the latest pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman pod kill --latest +``` + +Terminate all pods by sending `KILL` signal: +``` +podman pod kill --all +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-stop(1)](podman-pod-stop.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-pod-logs.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-pod-logs.1.md new file mode 100644 index 000000000..20e4c2d12 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-pod-logs.1.md @@ -0,0 +1,136 @@ +--- +title: podman-pod-logs +version: v5.4.2 +--- + +% podman-pod-logs 1 + +## NAME +podman\-pod\-logs - Display logs for pod with one or more containers + +## SYNOPSIS +**podman pod logs** [*options*] *pod* + +## DESCRIPTION +The podman pod logs command batch-retrieves whatever logs are present with all the containers of a pod. Pod logs can be filtered by container name or ID using flag **-c** or **--container** if needed. + +Note: A long-running `podman pod log` command with a `-f` or `--follow` option needs to be reinvoked if a new container is added to the pod dynamically; otherwise, logs of newly added containers are not visible in the log stream. + +## OPTIONS + + +[//]: # (BEGIN included file options/color.md) +#### **--color** + +Output the containers with different colors in the log. + +[//]: # (END included file options/color.md) + +#### **--container**, **-c** + +By default, `podman pod logs` retrieves logs for all the containers available within the pod, differentiated by the field `container`. However, there are use cases where the user wants to limit the log stream only to a particular container of a pod. For such cases, `-c` can be used like `podman pod logs -c ctrNameorID podname`. + + +[//]: # (BEGIN included file options/follow.md) +#### **--follow**, **-f** + +Follow log output. Default is false. + +Note: When following a pod which is removed by `podman pod rm` +or removed on exit (`podman run --rm ...`), there is a chance that the log +file is removed before `podman pod logs` reads the final content. + +[//]: # (END included file options/follow.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/names.md) +#### **--names**, **-n** + +Output the container names instead of the container IDs in the log. + +[//]: # (END included file options/names.md) + + +[//]: # (BEGIN included file options/since.md) +#### **--since**=*TIMESTAMP* + +Show logs since TIMESTAMP. The --since option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. + +[//]: # (END included file options/since.md) + + +[//]: # (BEGIN included file options/tail.md) +#### **--tail**=*LINES* + +Output the specified number of LINES at the end of the logs. LINES must be an integer. Defaults to -1, +which prints all lines + +[//]: # (END included file options/tail.md) + + +[//]: # (BEGIN included file options/timestamps.md) +#### **--timestamps**, **-t** + +Show timestamps in the log outputs. The default is false + +[//]: # (END included file options/timestamps.md) + + +[//]: # (BEGIN included file options/until.md) +#### **--until**=*TIMESTAMP* + +Show logs until TIMESTAMP. The --until option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. + +[//]: # (END included file options/until.md) + +## EXAMPLE + +To view a pod's logs: +``` +podman pod logs -t podIdorName +``` + +To view logs of a specific container on the pod: +``` +podman pod logs -c ctrIdOrName podIdOrName +``` + +To view all pod logs: +``` +podman pod logs -t --since 0 myserver-pod-1 +``` + +To view a pod's logs since a certain time: +``` +podman pod logs -t --since 2017-08-07T10:10:09.055837383-04:00 myserver-pod-1 +``` + +To view a pod's logs generated in the last 10 minutes: +``` +podman pod logs --since 10m myserver-pod-1 +``` + +To view a pod's logs until 30 minutes ago: +``` +podman pod logs --until 30m myserver-pod-1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-rm(1)](podman-pod-rm.1.md)**, **[podman-logs(1)](podman-logs.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-pod-pause.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-pod-pause.1.md new file mode 100644 index 000000000..90ff7446e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-pod-pause.1.md @@ -0,0 +1,43 @@ +--- +title: podman-pod-pause +version: v5.4.2 +--- + +% podman-pod-pause 1 + +## NAME +podman\-pod\-pause - Pause one or more pods + +## SYNOPSIS +**podman pod pause** [*options*] *pod* ... + +## DESCRIPTION +Pauses all the running processes in the containers of one or more pods. You may use pod IDs or names as input. + +## OPTIONS + +#### **--all**, **-a** + +Pause all pods. + +#### **--latest**, **-l** + +Instead of providing the pod name or ID, pause the last created pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +## EXAMPLE + +Pause a pod with a given name: +``` +podman pod pause mywebserverpod +``` + +Pause a pod with a given ID: +``` +podman pod pause 860a4b23 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-unpause(1)](podman-pod-unpause.1.md)**, **[podman-pause(1)](podman-pause.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-pod-prune.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-pod-prune.1.md new file mode 100644 index 000000000..9cd051d18 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-pod-prune.1.md @@ -0,0 +1,38 @@ +--- +title: podman-pod-prune +version: v5.4.2 +--- + +% podman-pod-prune 1 + +## NAME +podman-pod-prune - Remove all stopped pods and their containers + +## SYNOPSIS +**podman pod prune** [*options*] + +## DESCRIPTION +**podman pod prune** removes all stopped pods and their containers from local storage. + +## OPTIONS + +#### **--force**, **-f** +Force removal of all running pods and their containers. The default is false. + +## EXAMPLES + +Remove all stopped pods and their containers from local storage. +``` +$ sudo podman pod prune +22b8813332948064b6566370088c5e0230eeaf15a58b1c5646859fd9fc364fe7 +2afb26869fe5beab979c234afb75c7506063cd4655b1a73557c9d583ff1aebe9 +49161ad2a722cf18722f0e17199a9e840703a17d1158cdeda502b6d54080f674 +5ca429f37fb83a9f54eea89e3a9102b7780a6e6ae5f132db0672da551d862c4a +6bb06573787efb8b0675bc88ebf8361f1a56d3ac7922d1a6436d8f59ffd955f1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +April 2019, Originally compiled by Peter Hunt (pehunt at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-pod-ps.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-pod-ps.1.md new file mode 100644 index 000000000..037cdc0d6 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-pod-ps.1.md @@ -0,0 +1,206 @@ +--- +title: podman-pod-ps +version: v5.4.2 +--- + +% podman-pod-ps 1 + +## NAME +podman\-pod\-ps - Print out information about pods + +## SYNOPSIS +**podman pod ps** [*options*] + +## DESCRIPTION +**podman pod ps** lists the pods on the system. +By default it lists: + + * pod ID + * pod name + * the time the pod was created + * number of containers attached to pod + * container ID of the pod infra container + * status of pod as defined by the following table + +| **Status** | **Description** | +| ------------ | ------------------------------------------------| +| Created | No containers running nor stopped | +| Running | at least one container is running | +| Stopped | At least one container stopped and none running | +| Exited | All containers stopped in pod | +| Dead | Error retrieving state | + + +## OPTIONS + +#### **--ctr-ids** + +Display the container IDs + +#### **--ctr-names** + +Display the container names + +#### **--ctr-status** + +Display the container statuses + +#### **--filter**, **-f**=*filter* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|------------|--------------------------------------------------------------------------------------------------| +| ctr-ids | Filter by container ID within the pod. (CID prefix match by default; accepts regex) | +| ctr-names | Filter by container name within the pod. | +| ctr-number | Filter by number of containers in the pod. | +| ctr-status | Filter by container status within the pod. | +| id | Filter by pod ID. (Prefix match by default; accepts regex) | +| label | Filter by container with (or without, in the case of label!=[...] is used) the specified labels. | +| name | Filter by pod name. | +| network | Filter by network name or full ID of network. | +| status | Filter by pod status. | +| until | Filter by pods created before given timestamp. | + +The `ctr-ids`, `ctr-names`, `id`, `name` filters accept `regex` format. + +The `ctr-status` filter accepts values: `created`, `running`, `paused`, `stopped`, `exited`, `unknown`. + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes containers with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes containers without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +The `status` filter accepts values: `stopped`, `running`, `paused`, `exited`, `dead`, `created`, `degraded`. + +#### **--format**=*format* + +Pretty-print containers to JSON or using a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|---------------------|------------------------------------------------------| +| .Cgroup | Cgroup path of pod | +| .ContainerIds | Comma-separated list of container IDs in the pod | +| .ContainerNames | Comma-separated list of container names in the pod | +| .ContainerStatuses | Comma-separated list of container statuses | +| .Created | Creation time of pod | +| .ID | Container ID | +| .InfraID | Pod infra container ID | +| .Label *string* | Specified label of the pod | +| .Labels ... | All the labels assigned to the pod | +| .Name | Name of pod | +| .Networks | Show all networks connected to the infra container | +| .NumberOfContainers | Show the number of containers attached to pod | +| .Restarts | Show the total number of container restarts in a pod | +| .Status | Status of pod | + +#### **--help**, **-h** + +Print usage statement + +#### **--latest**, **-l** + +Show the latest pod created (all states) (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +#### **--namespace**, **--ns** + +Display namespace information of the pod + +#### **--no-trunc** + +Do not truncate the output (default *false*). + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Print the numeric IDs of the pods only + +#### **--sort** + +Sort by created, ID, name, status, or number of containers + +Default: created + +## EXAMPLES + +List all running pods. +``` +$ podman pod ps +POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS +00dfd6fa02c0 jolly_goldstine Running 31 hours ago ba465ab0a3a4 1 +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a 2 +``` + +List all running pods along with container names within the pods. +``` +$ podman pod ps --ctr-names +POD ID NAME STATUS CREATED INFRA ID NAMES +00dfd6fa02c0 jolly_goldstine Running 31 hours ago ba465ab0a3a4 loving_archimedes +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a thirsty_hawking,wizardly_golick +``` + +List all running pods along with status, names and ids. +``` +$ podman pod ps --ctr-status --ctr-names --ctr-ids +POD ID NAME STATUS CREATED INFRA ID IDS NAMES STATUS +00dfd6fa02c0 jolly_goldstine Running 31 hours ago ba465ab0a3a4 ba465ab0a3a4 loving_archimedes running +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a 331693bff40a,8e428daeb89e thirsty_hawking,wizardly_golick configured,configured +``` + +List all running pods and print ID, Container Names, and cgroups. +``` +$ podman pod ps --format "{{.ID}} {{.ContainerNames}} {{.Cgroup}}" +00dfd6fa02c0 loving_archimedes /libpod_parent +f4df8692e116 thirsty_hawking,wizardly_golick /libpod_parent +``` + +List all running pods with two containers sorted by pod ID. +``` +$ podman pod ps --sort id --filter ctr-number=2 +POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a 2 +``` + +List all running pods with their container ids. +``` +$ podman pod ps --ctr-ids +POD ID NAME STATUS CREATED INFRA ID IDS +00dfd6fa02c0 jolly_goldstine Running 31 hours ago ba465ab0a3a4 ba465ab0a3a4 +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a 331693bff40a,8e428daeb89e +``` + +List all running pods with container ids without truncating IDs. +``` +$ podman pod ps --no-trunc --ctr-ids +POD ID NAME STATUS CREATED INFRA ID IDS +00dfd6fa02c0a2daaedfdf8fcecd06f22ad114d46d167d71777224735f701866 jolly_goldstine Running 31 hours ago ba465ab0a3a4e15e3539a1e79c32d1213a02b0989371e274f98e0f1ae9de7050 ba465ab0a3a4e15e3539a1e79c32d1213a02b0989371e274f98e0f1ae9de7050 +f4df8692e116a3e6d1d62572644ed36ca475d933808cc3c93435c45aa139314b nifty_torvalds Created 10 minutes ago 331693bff40a926b6d52b184e116afd15497610c378d5d4c42945dd6e33b75b0 331693bff40a926b6d52b184e116afd15497610c378d5d4c42945dd6e33b75b0,8e428daeb89e69b71e7916a13accfb87d122889442b5c05c2d99cf94a3230e9d +``` + +List all running pods with container names. +``` +$ podman pod ps --ctr-names +POD ID NAME STATUS CREATED INFRA ID NAMES +314f4da82d74 hi Created 17 hours ago a9f2d2165675 jovial_jackson,hopeful_archimedes,vibrant_ptolemy,heuristic_jennings,keen_raman,hopeful_newton,mystifying_bose,silly_lalande,serene_lichterman ... +``` + +## pod ps +Print a list of pods + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-pod-restart.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-pod-restart.1.md new file mode 100644 index 000000000..abf825d28 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-pod-restart.1.md @@ -0,0 +1,64 @@ +--- +title: podman-pod-restart +version: v5.4.2 +--- + +% podman-pod-restart 1 + +## NAME +podman\-pod\-restart - Restart one or more pods + +## SYNOPSIS +**podman pod restart** [*options*] *pod* ... + +## DESCRIPTION +Restart containers in one or more pods. Running containers are stopped and restarted. +Stopped containers are started. You may use pod IDs or names as input. +The pod ID is printed upon successful restart. +When restarting multiple pods, an error from restarting one pod does not effect restarting other pods. + +## OPTIONS + +#### **--all**, **-a** + +Restarts all pods + +#### **--latest**, **-l** + +Instead of providing the pod name or ID, restart the last created pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +## EXAMPLE + +Restart pod with a given name: +``` +podman pod restart mywebserverpod +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` + +Restart multiple pods with given IDs: +``` +podman pod restart 490eb 3557fb +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +``` + +Restart the last created pod: +``` +podman pod restart --latest +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +``` + +Restart all pods: +``` +podman pod restart --all +19456b4cd557eaf9629825113a552681a6013f8c8cad258e36ab825ef536e818 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +70c358daecf71ef9be8f62404f926080ca0133277ef7ce4f6aa2d5af6bb2d3e9 +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-restart(1)](podman-restart.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-pod-rm.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-pod-rm.1.md new file mode 100644 index 000000000..8e5f9674e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-pod-rm.1.md @@ -0,0 +1,109 @@ +--- +title: podman-pod-rm +version: v5.4.2 +--- + +% podman-pod-rm 1 + +## NAME +podman\-pod\-rm - Remove one or more stopped pods and containers + +## SYNOPSIS +**podman pod rm** [*options*] *pod* + +## DESCRIPTION +**podman pod rm** removes one or more stopped pods and their containers from the host. The pod name or ID can be used. The \-f option stops all containers and then removes them before removing the pod. If all containers added by the user are in an exited state, the pod is removed. + +## OPTIONS + +#### **--all**, **-a** + +Remove all pods. Can be used in conjunction with \-f as well. + +#### **--force**, **-f** + +Stop running containers and delete all stopped containers before removal of pod. + + +[//]: # (BEGIN included file options/ignore.md) +#### **--ignore**, **-i** + +Ignore errors when specified pods are not in the container store. A user +might have decided to manually remove a pod which leads to a failure +during the ExecStop directive of a systemd service referencing that pod. + +[//]: # (END included file options/ignore.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/pod-id-file.pod.md) +#### **--pod-id-file**=*file* + +Read pod ID from the specified *file* and rm the pod. Can be specified multiple times. + +[//]: # (END included file options/pod-id-file.pod.md) +If specified, the pod-id-file is removed along with the pod. + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping running containers within the pod. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +The --force option must be specified to use the --time option. + +## EXAMPLE + +Remove pod with a given name: +``` +podman pod rm mywebserverpod +``` + +Remove multiple pods with given names and/or IDs: +``` +podman pod rm mywebserverpod myflaskserverpod 860a4b23 +``` + +Forcefully remove pod with a given ID: +``` +podman pod rm -f 860a4b23 +``` + +Forcefully remove all pods: +``` +podman pod rm -f -a +podman pod rm -fa +``` + +Remove pod using ID specified in a given file: +``` +podman pod rm --pod-id-file /path/to/id/file +``` + +## Exit Status + **0** All specified pods removed + + **1** One of the specified pods did not exist, and no other failures + + **2** One of the specified pods is attached to a container + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-pod-start.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-pod-start.1.md new file mode 100644 index 000000000..0d93dacb6 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-pod-start.1.md @@ -0,0 +1,74 @@ +--- +title: podman-pod-start +version: v5.4.2 +--- + +% podman-pod-start 1 + +## NAME +podman\-pod\-start - Start one or more pods + +## SYNOPSIS +**podman pod start** [*options*] *pod* ... + +## DESCRIPTION +Start containers in one or more pods. You may use pod IDs or names as input. The pod must have a container attached +to be started. + +## OPTIONS + +#### **--all**, **-a** + +Starts all pods + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/pod-id-file.pod.md) +#### **--pod-id-file**=*file* + +Read pod ID from the specified *file* and start the pod. Can be specified multiple times. + +[//]: # (END included file options/pod-id-file.pod.md) + +## EXAMPLE + +Start pod with a given name: +``` +podman pod start mywebserverpod +``` + +Start pods with given IDs: +``` +podman pod start 860a4b23 5421ab4 +``` + +Start the latest pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman pod start --latest +``` + +Start all pods: +``` +podman pod start --all +``` + +Start pod using ID specified in a given file: +``` +podman pod start --pod-id-file /path/to/id/file +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-stop(1)](podman-pod-stop.1.md)** + +## HISTORY +July 2018, Adapted from podman start man page by Peter Hunt diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-pod-stats.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-pod-stats.1.md new file mode 100644 index 000000000..7d59de1b4 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-pod-stats.1.md @@ -0,0 +1,116 @@ +--- +title: podman-pod-stats +version: v5.4.2 +--- + +% podman-pod-stats 1 + +## NAME +podman\-pod\-stats - Display a live stream of resource usage stats for containers in one or more pods + +## SYNOPSIS +**podman pod stats** [*options*] [*pod*] + +## DESCRIPTION +Display a live stream of containers in one or more pods resource usage statistics. Running rootless is only supported on cgroups v2. + +## OPTIONS + +#### **--all**, **-a** + +Show all containers. Only running containers are shown by default + +#### **--format**=*template* + +Pretty-print container statistics to JSON or using a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| --------------- | ------------------ | +| .BlockIO | Block IO | +| .CID | Container ID | +| .CPU | CPU percentage | +| .Mem | Memory percentage | +| .MemUsage | Memory usage | +| .MemUsageBytes | Memory usage (IEC) | +| .Name | Container Name | +| .NetIO | Network IO | +| .PIDS | Number of PIDs | +| .Pod | Pod ID | + +When using a Go template, precede the format with `table` to print headers. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/no-reset.md) +#### **--no-reset** + +Do not clear the terminal/screen in between reporting intervals + +[//]: # (END included file options/no-reset.md) + + +[//]: # (BEGIN included file options/no-stream.md) +#### **--no-stream** + +Disable streaming pod stats and only pull the first result, default setting is false + +[//]: # (END included file options/no-stream.md) + +## EXAMPLE + +List statistics about all pods without streaming: +``` +# podman pod stats -a --no-stream +ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS +a9f807ffaacd frosty_hodgkin -- 3.092MB / 16.7GB 0.02% -- / -- -- / -- 2 +3b33001239ee sleepy_stallman -- -- / -- -- -- / -- -- / -- -- +``` + +List statistics about specified pod without streaming: +``` +# podman pod stats --no-stream a9f80 +ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS +a9f807ffaacd frosty_hodgkin -- 3.092MB / 16.7GB 0.02% -- / -- -- / -- 2 +``` + +List statistics about specified pod in JSON format without streaming: +``` +# podman pod stats --no-stream --format=json a9f80 +[ + { + "id": "a9f807ffaacd", + "name": "frosty_hodgkin", + "cpu_percent": "--", + "mem_usage": "3.092MB / 16.7GB", + "mem_percent": "0.02%", + "netio": "-- / --", + "blocki": "-- / --", + "pids": "2" + } +] +``` + +List selected statistics formatted in a table about specified pod: +``` +# podman pod stats --no-stream --format "table {{.ID}} {{.Name}} {{.MemUsage}}" 6eae +ID NAME MEM USAGE / LIMIT +6eae9e25a564 clever_bassi 3.031MB / 16.7GB +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +February 2019, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-pod-stop.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-pod-stop.1.md new file mode 100644 index 000000000..1848aa534 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-pod-stop.1.md @@ -0,0 +1,111 @@ +--- +title: podman-pod-stop +version: v5.4.2 +--- + +% podman-pod-stop 1 + +## NAME +podman\-pod\-stop - Stop one or more pods + +## SYNOPSIS +**podman pod stop** [*options*] *pod* ... + +## DESCRIPTION +Stop containers in one or more pods. You may use pod IDs or names as input. + +## OPTIONS + +#### **--all**, **-a** + +Stops all pods + + +[//]: # (BEGIN included file options/ignore.md) +#### **--ignore**, **-i** + +Ignore errors when specified pods are not in the container store. A user +might have decided to manually remove a pod which leads to a failure +during the ExecStop directive of a systemd service referencing that pod. + +[//]: # (END included file options/ignore.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/pod-id-file.pod.md) +#### **--pod-id-file**=*file* + +Read pod ID from the specified *file* and stop the pod. Can be specified multiple times. + +[//]: # (END included file options/pod-id-file.pod.md) + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping running containers within the pod. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +## EXAMPLE + +Stop pod with a given name. +``` +$ podman pod stop mywebserverpod +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` + +Stop multiple pods with given IDs. +``` +$ podman pod stop 490eb 3557fb +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +``` + +Stop the last created pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman pod stop --latest +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +``` + +Stop all pods. +``` +$ podman pod stop --all +19456b4cd557eaf9629825113a552681a6013f8c8cad258e36ab825ef536e818 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +70c358daecf71ef9be8f62404f926080ca0133277ef7ce4f6aa2d5af6bb2d3e9 +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` + +Stop two pods via --pod-id-file. +``` +$ podman pod stop --pod-id-file file1 --pod-id-file file2 +19456b4cd557eaf9629825113a552681a6013f8c8cad258e36ab825ef536e818 +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` + +Stop all pods with a timeout of 1 second. +``` +$ podman pod stop -a -t 1 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +70c358daecf71ef9be8f62404f926080ca0133277ef7ce4f6aa2d5af6bb2d3e9 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-start(1)](podman-pod-start.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-pod-top.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-pod-top.1.md new file mode 100644 index 000000000..b9195d9a6 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-pod-top.1.md @@ -0,0 +1,65 @@ +--- +title: podman-pod-top +version: v5.4.2 +--- + +% podman-pod-top 1 + +## NAME +podman\-pod\-top - Display the running processes of containers in a pod + +## SYNOPSIS +**podman pod top** [*options*] *pod* [*format-descriptors*] + +## DESCRIPTION +Display the running processes of containers in a pod. The *format-descriptors* are ps (1) compatible AIX format +descriptors but extended to print additional information, such as the seccomp mode or the effective capabilities +of a given process. The descriptors can either be passed as separate arguments or as a single comma-separated argument. + +## OPTIONS + +#### **--help**, **-h** + + Print usage statement + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## FORMAT DESCRIPTORS + +For a full list of available descriptors, see podman-top(1) + +## EXAMPLES + +Print top data for the specified pod. +By default, `podman-pod-top` prints data similar to `ps -ef`: +``` +$ podman pod top b031293491cc +USER PID PPID %CPU ELAPSED TTY TIME COMMAND +root 1 0 0.000 2h5m38.737137571s ? 0s top +root 8 0 0.000 2h5m15.737228361s ? 0s top +``` + +The output can be controlled by specifying format descriptors as arguments after the pod. + +Print the pod top data fields pid,seccomp, args and %C on the latest pod created. (This -l option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman pod top -l pid seccomp args %C +PID SECCOMP COMMAND %CPU +1 filter top 0.000 +1 filter /bin/sh 0.000 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **ps(1)**, **seccomp(2)**, **proc(5)**, **capabilities(7)** + +## HISTORY +August 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-pod-unpause.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-pod-unpause.1.md new file mode 100644 index 000000000..9ab0bf434 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-pod-unpause.1.md @@ -0,0 +1,43 @@ +--- +title: podman-pod-unpause +version: v5.4.2 +--- + +% podman-pod-unpause 1 + +## NAME +podman\-pod\-unpause - Unpause one or more pods + +## SYNOPSIS +**podman pod unpause** [*options*] *pod* ... + +## DESCRIPTION +Unpauses all the paused processes in the containers of one or more pods. You may use pod IDs or names as input. + +## OPTIONS + +#### **--all**, **-a** + +Unpause all pods. + +#### **--latest**, **-l** + +Instead of providing the pod name or ID, unpause the last created pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +## EXAMPLE + +Unpause pod with a given name: +``` +podman pod unpause mywebserverpod +``` + +Unpause pod with a given ID: +``` +podman pod unpause 860a4b23 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-pause(1)](podman-pod-pause.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-pod.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-pod.1.md new file mode 100644 index 000000000..9346f4e99 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-pod.1.md @@ -0,0 +1,42 @@ +--- +title: podman-pod +version: v5.4.2 +--- + +% podman-pod 1 + +## NAME +podman\-pod - Management tool for groups of containers, called pods + +## SYNOPSIS +**podman pod** *subcommand* + +## DESCRIPTION +podman pod is a set of subcommands that manage pods, or groups of containers. + +## SUBCOMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------- | --------------------------------------------------------------------------------- | +| clone | [podman-pod-clone(1)](podman-pod-clone.1.md) | Create a copy of an existing pod. | +| create | [podman-pod-create(1)](podman-pod-create.1.md) | Create a new pod. | +| exists | [podman-pod-exists(1)](podman-pod-exists.1.md) | Check if a pod exists in local storage. | +| inspect | [podman-pod-inspect(1)](podman-pod-inspect.1.md) | Display information describing a pod. | +| kill | [podman-pod-kill(1)](podman-pod-kill.1.md) | Kill the main process of each container in one or more pods. | +| logs | [podman-pod-logs(1)](podman-pod-logs.1.md) | Display logs for pod with one or more containers. | +| pause | [podman-pod-pause(1)](podman-pod-pause.1.md) | Pause one or more pods. | +| prune | [podman-pod-prune(1)](podman-pod-prune.1.md) | Remove all stopped pods and their containers. | +| ps | [podman-pod-ps(1)](podman-pod-ps.1.md) | Print out information about pods. | +| restart | [podman-pod-restart(1)](podman-pod-restart.1.md) | Restart one or more pods. | +| rm | [podman-pod-rm(1)](podman-pod-rm.1.md) | Remove one or more stopped pods and containers. | +| start | [podman-pod-start(1)](podman-pod-start.1.md) | Start one or more pods. | +| stats | [podman-pod-stats(1)](podman-pod-stats.1.md) | Display a live stream of resource usage stats for containers in one or more pods. | +| stop | [podman-pod-stop(1)](podman-pod-stop.1.md) | Stop one or more pods. | +| top | [podman-pod-top(1)](podman-pod-top.1.md) | Display the running processes of containers in a pod. | +| unpause | [podman-pod-unpause(1)](podman-pod-unpause.1.md) | Unpause one or more pods. | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-port.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-port.1.md new file mode 100644 index 000000000..b2ffa7870 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-port.1.md @@ -0,0 +1,71 @@ +--- +title: podman-port +version: v5.4.2 +--- + +% podman-port 1 + +## NAME +podman\-port - List port mappings for a container + +## SYNOPSIS +**podman port** [*options*] *container* [*private-port*[/*proto*]] + +**podman container port** [*options*] *container* [*private-port*[/*proto*]] + +## DESCRIPTION +List port mappings for the *container* or look up the public-facing port that is NAT-ed to the *private-port*. + +## OPTIONS + +#### **--all**, **-a** + +List all known port mappings for running containers; when using this option, container names or private ports/protocols filters cannot be used. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +List all port mappings: +``` +# podman port -a +b4d2f05432e482e017b1a4b2eae15fa7b4f6fb7e9f65c1bde46294fdef285906 +80/udp -> 0.0.0.0:44327 +80/tcp -> 0.0.0.0:44327 +# +``` + +List port mappings for a specific container: +``` +# podman port b4d2f054 +80/udp -> 0.0.0.0:44327 +80/tcp -> 0.0.0.0:44327 +# +``` +List the specified port mappings for a specific container: +``` +# podman port b4d2f054 80 + 0.0.0.0:44327 +# +``` + +List the port mappings for a specific container for port 80 and the tcp protocol: +``` +# podman port b4d2f054 80/tcp +0.0.0.0:44327 +# +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +January 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-ps.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-ps.1.md new file mode 100644 index 000000000..84ddcf028 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-ps.1.md @@ -0,0 +1,228 @@ +--- +title: podman-ps +version: v5.4.2 +--- + +% podman-ps 1 + +## NAME +podman\-ps - Print out information about containers + +## SYNOPSIS +**podman ps** [*options*] + +**podman container ps** [*options*] + +**podman container list** [*options*] + +**podman container ls** [*options*] + +## DESCRIPTION +**podman ps** lists the running containers on the system. Use the **--all** flag to view +all the containers information. By default it lists: + + * container id + * the name of the image the container is using + * the COMMAND the container is executing + * the time the container was created + * the status of the container + * port mappings the container is using + * alternative names for the container + +## OPTIONS + +#### **--all**, **-a** + +Show all the containers, default is only running containers. + +Note: Podman shares containers storage with other tools such as Buildah and CRI-O. In some cases these `external` containers might also exist in the same storage. Use the `--external` option to see these external containers. External containers show the 'storage' status. + +#### **--external** + +Display external containers that are not controlled by Podman but are stored in containers storage. These external containers are generally created via other container technology such as Buildah or CRI-O and may depend on the same container images that Podman is also using. External containers are denoted with either a 'buildah' or 'storage' in the COMMAND and STATUS column of the ps output. + +#### **--filter**, **-f** + +Filter what containers are shown in the output. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| label! | [Key] or [Key=Value] Label NOT assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container (accepts regex) | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] container created before the given duration or time. | + + +#### **--format**=*format* + +Pretty-print containers to JSON or using a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|--------------------|----------------------------------------------| +| .AutoRemove | If true, containers are removed on exit | +| .CIDFile | Container ID File | +| .Command | Quoted command used | +| .Created ... | Creation time for container, Y-M-D H:M\:S | +| .CreatedAt | Creation time for container (same as above) | +| .CreatedHuman | Creation time, relative | +| .ExitCode | Container exit code | +| .Exited | "true" if container has exited | +| .ExitedAt | Time (epoch seconds) that container exited | +| .ExposedPorts ... | Map of exposed ports on this container | +| .ID | Container ID | +| .Image | Image Name/ID | +| .ImageID | Image ID | +| .IsInfra | "true" if infra container | +| .Label *string* | Specified label of the container | +| .Labels ... | All the labels assigned to the container | +| .Mounts | Volumes mounted in the container | +| .Names | Name of container | +| .Networks | Show all networks connected to the container | +| .Pid | Process ID on host system | +| .Pod | Pod the container is associated with (SHA) | +| .PodName | PodName of the container | +| .Ports | Forwarded and exposed ports | +| .Restarts | Display the container restart count | +| .RunningFor | Time elapsed since container was started | +| .Size | Size of container | +| .StartedAt | Time (epoch seconds) the container started | +| .State | Human-friendly description of ctr state | +| .Status | Status of container | + +#### **--help**, **-h** + +Print usage statement + +#### **--last**, **-n** + +Print the n last created containers (all states) + +#### **--latest**, **-l** + +Show the latest container created (all states) (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +#### **--namespace**, **--ns** + +Display namespace information + +#### **--no-trunc** + +Do not truncate the output (default *false*). + +#### **--noheading** + +Omit the table headings from the listing of containers. + +#### **--pod**, **-p** + +Display the pods the containers are associated with + +#### **--quiet**, **-q** + +Print the numeric IDs of the containers only + +#### **--size**, **-s** + +Display the total file size + +#### **--sort**=*created* + +Sort by command, created, id, image, names, runningfor, size, or status", +Note: Choosing size sorts by size of rootFs, not alphabetically like the rest of the options + +#### **--sync** + +Force a sync of container state with the OCI runtime. +In some cases, a container's state in the runtime can become out of sync with Podman's state. +This updates Podman's state based on what the OCI runtime reports. +Forcibly syncing is much slower, but can resolve inconsistent state issues. + +#### **--watch**, **-w** + +Refresh the output with current containers on an interval in seconds. + +## EXAMPLES + +List running containers. +``` +$ podman ps +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +4089df24d4f3 docker.io/library/centos:latest /bin/bash 2 minutes ago Up 2 minutes 0.0.0.0:80->8080/tcp, 0.0.0.0:2000-2006->2000-2006/tcp manyports +92f58933c28c docker.io/library/centos:latest /bin/bash 3 minutes ago Up 3 minutes 192.168.99.100:1000-1006->1000-1006/tcp zen_sanderson +``` + +List all containers. +``` +$ podman ps -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +02f65160e14ca redis:alpine "redis-server" 19 hours ago Exited (-1) 19 hours ago 6379/tcp k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0 +69ed779d8ef9f redis:alpine "redis-server" 25 hours ago Created 6379/tcp k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 +``` + +List all containers including their size. Note: this can take longer since Podman needs to calculate the size from the file system. +``` +$ podman ps -a -s +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES SIZE +02f65160e14ca redis:alpine "redis-server" 20 hours ago Exited (-1) 20 hours ago 6379/tcp k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0 27.49 MB +69ed779d8ef9f redis:alpine "redis-server" 25 hours ago Created 6379/tcp k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 27.49 MB +``` + +List all containers, running or not, using a custom Go format. +``` +$ podman ps -a --format "{{.ID}} {{.Image}} {{.Labels}} {{.Mounts}}" +02f65160e14ca redis:alpine tier=backend proc,tmpfs,devpts,shm,mqueue,sysfs,cgroup,/var/run/,/var/run/ +69ed779d8ef9f redis:alpine batch=no,type=small proc,tmpfs,devpts,shm,mqueue,sysfs,cgroup,/var/run/,/var/run/ +``` + +List all containers and display their namespaces. +``` +$ podman ps --ns -a +CONTAINER ID NAMES PID CGROUP IPC MNT NET PIDNS USER UTS +3557d882a82e3 k8s_container2_podsandbox1_redhat.test.crio_redhat-test-crio_1 29910 4026531835 4026532585 4026532593 4026532508 4026532595 4026531837 4026532594 +09564cdae0bec k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 29851 4026531835 4026532585 4026532590 4026532508 4026532592 4026531837 4026532591 +a31ebbee9cee7 k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0 29717 4026531835 4026532585 4026532587 4026532508 4026532589 4026531837 4026532588 +``` + +List all containers including size sorted by names. +``` +$ podman ps -a --size --sort names +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +69ed779d8ef9f redis:alpine "redis-server" 25 hours ago Created 6379/tcp k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 +02f65160e14ca redis:alpine "redis-server" 19 hours ago Exited (-1) 19 hours ago 6379/tcp k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0 +``` + +List all external containers created by tools other than Podman. +``` +$ podman ps --external -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +69ed779d8ef9f redis:alpine "redis-server" 25 hours ago Created 6379/tcp k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 +38a8a78596f9 docker.io/library/busybox:latest buildah 2 hours ago storage busybox-working-container +fd7b786b5c32 docker.io/library/alpine\:latest buildah 2 hours ago storage alpine-working-container +f78620804e00 scratch buildah 2 hours ago storage working-container +``` + +## ps +Print a list of containers + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **[crio(8)](https://github.com/cri-o/cri-o/blob/main/docs/crio.8.md)** + +## HISTORY +August 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-pull.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-pull.1.md new file mode 100644 index 000000000..51afb7066 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-pull.1.md @@ -0,0 +1,327 @@ +--- +title: podman-pull +version: v5.4.2 +--- + +% podman-pull 1 + +## NAME +podman\-pull - Pull an image from a registry + +## SYNOPSIS +**podman pull** [*options*] *source* [*source*...] + +**podman image pull** [*options*] *source* [*source*...] + +**podman pull** [*options*] [*transport*]*name*[:*tag*|@*digest*] + +**podman image pull** [*options*] [*transport*]*name*[:*tag*|@*digest*] + +## DESCRIPTION +podman pull copies an image from a registry onto the local machine. The command can pull one or more images. If the image reference in the command line argument does not contain a registry, it is referred to as a `short-name` reference. If the image is a 'short-name' reference, Podman prompts the user for the specific container registry to pull the image from, if an alias for the short-name has not been specified in the `short-name-aliases.conf`. If an image tag is not specified, **podman pull** defaults to the image with the **latest** tag (if it exists) and pulls it. After the image is pulled, podman prints the full image ID. **podman pull** can also pull images using a digest **podman pull** *image*@*digest* and can also be used to pull images from archives and local storage using different transports. +*IMPORTANT: Images are stored in local image storage.* + +## SOURCE +SOURCE is the location from which the container image is pulled from. It supports all transports from **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)**. If no transport is specified, the input is subject to short-name resolution and the `docker` (i.e., container registry) transport is used. For remote clients, including Mac and Windows (excluding WSL2) machines, `docker` is the only supported transport. + +``` +# Pull from a container registry +$ podman pull quay.io/username/myimage + +# Pull from a container registry with short-name resolution +$ podman pull fedora + +# Pull from a container registry via the docker transport +$ podman pull docker://quay.io/username/myimage + +# Pull from a local directory +$ podman pull dir:/tmp/myimage + +# Pull from a tarball in the docker-archive format +$ podman pull docker-archive:/tmp/myimage + +# Pull from a local docker daemon +$ sudo podman pull docker-daemon\:docker.io/library/myimage:33 + +# Pull from a tarball in the OCI-archive format +$ podman pull oci-archive:/tmp/myimage +``` + +## OPTIONS +#### **--all-tags**, **-a** + +All tagged images in the repository are pulled. + +*IMPORTANT: When using the all-tags flag, Podman does not iterate over the search registries in the **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** but always uses docker.io for unqualified image names.* + + +[//]: # (BEGIN included file options/arch.md) +#### **--arch**=*ARCH* +Override the architecture, defaults to hosts, of the image to be pulled. For example, `arm`. +Unless overridden, subsequent lookups of the same image in the local storage matches this architecture, regardless of the host. + +[//]: # (END included file options/arch.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + +#### **--help**, **-h** + +Print the usage statement. + + +[//]: # (BEGIN included file options/os.pull.md) +#### **--os**=*OS* + +Override the OS, defaults to hosts, of the image to be pulled. For example, `windows`. +Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. + +[//]: # (END included file options/os.pull.md) + + +[//]: # (BEGIN included file options/platform.md) +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with --arch and --os) +The `--platform` option can be used to override the current architecture and operating system. +Unless overridden, subsequent lookups of the same image in the local storage matches this platform, regardless of the host. + +[//]: # (END included file options/platform.md) + +#### **--quiet**, **-q** + +Suppress output information when pulling images + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/variant.container.md) +#### **--variant**=*VARIANT* + +Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. + +[//]: # (END included file options/variant.container.md) + +## FILES + +**short-name-aliases.conf** (`/var/cache/containers/short-name-aliases.conf`, `$HOME/.cache/containers/short-name-aliases.conf`) + +When users specify images that do not include the container registry where the +image is stored, this is called a short name. The use of unqualified-search registries entails an ambiguity as it is unclear from which registry a given image, referenced by a short name, may be pulled from. + +Using short names is subject to the risk of hitting squatted registry namespaces. If the unqualified-search registries are set to ["public-registry.com", "my-private-registry.com"] an attacker may take over a namespace of `public-registry.com` such that an image may be pulled from `public-registry.com` instead of the intended source `my-private-registry.com`. + +While it is highly recommended to always use fully-qualified image references, existing deployments using short names may not be easily changed. To circumvent the aforementioned ambiguity, so called short-name aliases can be configured that point to a fully-qualified image reference. Distributions often ship a default shortnames.conf expansion file in /etc/containers/registries.conf.d/ directory. Administrators can use this directory to add their own local short-name expansion files. + +When pulling an image, if the user does not specify the complete registry, container engines attempt to expand the short-name into a full name. If the command is executed with a tty, the user is prompted to select a registry from the +default list unqualified registries defined in registries.conf. The user's selection is then stored in a cache file to be used in all future short-name expansions. Rootful short-names are stored in /var/cache/containers/short-name-aliases.conf. Rootless short-names are stored in the $HOME/.cache/containers/short-name-aliases.conf file. + +For more information on short-names, see `containers-registries.conf(5)` + +**registries.conf** (`/etc/containers/registries.conf`) + +registries.conf is the configuration file which specifies which container registries is consulted when completing image names which do not include a registry or domain portion. + +NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + + +## EXAMPLES +Pull a single image with short name resolution. +``` +$ podman pull alpine:latest +Resolved "alpine" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf) +Trying to pull docker.io/library/alpine:latest... +Getting image source signatures +Copying blob 5843afab3874 done +Copying config d4ff818577 done +Writing manifest to image destination +Storing signatures +d4ff818577bc193b309b355b02ebc9220427090057b54a59e73b79bdfe139b83 +``` + +Pull multiple images with/without short name resolution. +``` +podman pull busybox:musl alpine quay.io/libpod/cirros +Trying to pull docker.io/library/busybox:musl... +Getting image source signatures +Copying blob 0c52b060233b [--------------------------------------] 0.0b / 0.0b +Copying config 9ad2c435a8 done +Writing manifest to image destination +Storing signatures +9ad2c435a887e3f723654e09b48563de44aa3c7950246b2e9305ec85dd3422db +Trying to pull docker.io/library/alpine:latest... +Getting image source signatures +Copying blob 5843afab3874 [--------------------------------------] 0.0b / 0.0b +Copying config d4ff818577 done +Writing manifest to image destination +Storing signatures +d4ff818577bc193b309b355b02ebc9220427090057b54a59e73b79bdfe139b83 +Trying to pull quay.io/libpod/cirros:latest... +Getting image source signatures +Copying blob 8da581cc9286 done +Copying blob 856628d95d17 done +Copying blob f513001ba4ab done +Copying config 3c82e4d066 done +Writing manifest to image destination +Storing signatures +3c82e4d066cf6f9e50efaead6e3ff7fddddf5527826afd68e5a969579fc4db4a +``` + +Pull an image using its digest. +``` +$ podman pull alpine@sha256:d7342993700f8cd7aba8496c2d0e57be0666e80b4c441925fc6f9361fa81d10e +Trying to pull docker.io/library/alpine@sha256:d7342993700f8cd7aba8496c2d0e57be0666e80b4c441925fc6f9361fa81d10e... +Getting image source signatures +Copying blob 188c0c94c7c5 done +Copying config d6e46aa247 done +Writing manifest to image destination +Storing signatures +d6e46aa2470df1d32034c6707c8041158b652f38d2a9ae3d7ad7e7532d22ebe0 +``` + +Pull an image by specifying an authentication file. +``` +$ podman pull --authfile temp-auths/myauths.json docker://docker.io/umohnani/finaltest +Trying to pull docker.io/umohnani/finaltest:latest...Getting image source signatures +Copying blob sha256:6d987f6f42797d81a318c40d442369ba3dc124883a0964d40b0c8f4f7561d913 + 1.90 MB / 1.90 MB [========================================================] 0s +Copying config sha256:ad4686094d8f0186ec8249fc4917b71faa2c1030d7b5a025c29f26e19d95c156 + 1.41 KB / 1.41 KB [========================================================] 0s +Writing manifest to image destination +Storing signatures +03290064078cb797f3e0a530e78c20c13dd22a3dd3adf84a5da2127b48df0438 +``` + +Pull an image by authenticating to a registry. +``` +$ podman pull --creds testuser:testpassword docker.io/umohnani/finaltest +Trying to pull docker.io/umohnani/finaltest:latest...Getting image source signatures +Copying blob sha256:6d987f6f42797d81a318c40d442369ba3dc124883a0964d40b0c8f4f7561d913 + 1.90 MB / 1.90 MB [========================================================] 0s +Copying config sha256:ad4686094d8f0186ec8249fc4917b71faa2c1030d7b5a025c29f26e19d95c156 + 1.41 KB / 1.41 KB [========================================================] 0s +Writing manifest to image destination +Storing signatures +03290064078cb797f3e0a530e78c20c13dd22a3dd3adf84a5da2127b48df0438 +``` + +Pull an image using tls verification. +``` +$ podman pull --tls-verify=false --cert-dir image/certs docker.io/umohnani/finaltest +Trying to pull docker.io/umohnani/finaltest:latest...Getting image source signatures +Copying blob sha256:6d987f6f42797d81a318c40d442369ba3dc124883a0964d40b0c8f4f7561d913 + 1.90 MB / 1.90 MB [========================================================] 0s +Copying config sha256:ad4686094d8f0186ec8249fc4917b71faa2c1030d7b5a025c29f26e19d95c156 + 1.41 KB / 1.41 KB [========================================================] 0s +Writing manifest to image destination +Storing signatures +03290064078cb797f3e0a530e78c20c13dd22a3dd3adf84a5da2127b48df0438 +``` + +Pull an image by overriding the host architecture. +``` +$ podman pull --arch=arm arm32v7/debian:stretch +Trying to pull docker.io/arm32v7/debian\:stretch... +Getting image source signatures +Copying blob b531ae4a3925 done +Copying config 3cba58dad5 done +Writing manifest to image destination +Storing signatures +3cba58dad5d9b35e755b48b634acb3fdd185ab1c996ac11510cc72c17780e13c +``` + +Pull an image with up to 6 retries, delaying 10 seconds between retries in quet mode. +``` +$ podman --remote pull -q --retry 6 --retry-delay 10s ubi9 +4d6addf62a90e392ff6d3f470259eb5667eab5b9a8e03d20b41d0ab910f92170 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-push(1)](podman-push.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-push.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-push.1.md new file mode 100644 index 000000000..8eebbf92c --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-push.1.md @@ -0,0 +1,276 @@ +--- +title: podman-push +version: v5.4.2 +--- + +% podman-push 1 + +## NAME +podman\-push - Push an image, manifest list or image index from local storage to elsewhere + +## SYNOPSIS +**podman push** [*options*] *image* [*destination*] + +**podman image push** [*options*] *image* [*destination*] + +## DESCRIPTION +Pushes an image, manifest list or image index from local storage to a specified +destination. + +## Image storage +Images are pushed from those stored in local image storage. + +## DESTINATION + + DESTINATION is the location the container image is pushed to. It supports all transports from `containers-transports(5)`. If no transport is specified, the `docker` (i.e., container registry) transport is used. For remote clients, including Mac and Windows (excluding WSL2) machines, `docker` is the only supported transport. + +``` +# Push to a container registry +$ podman push quay.io/podman/stable + +# Push to a container registry via the docker transport +$ podman push docker://quay.io/podman/stable + +# Push to a container registry with another tag +$ podman push myimage quay.io/username/myimage + +# Push to a local directory +$ podman push myimage dir:/tmp/myimage + +# Push to a tarball in the docker-archive format +$ podman push myimage docker-archive:/tmp/myimage + +# Push to a local docker daemon +$ sudo podman push myimage docker-daemon\:docker.io/library/myimage:33 + +# Push to a tarball in the OCI format +$ podman push myimage oci-archive:/tmp/myimage +``` + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/dir-compress.md) +#### **--compress** + +Compress tarball image layers when pushing to a directory using the 'dir' transport. (default is same compression type, compressed or uncompressed, as source) + +[//]: # (END included file options/dir-compress.md) + +Note: This flag can only be set when using the **dir** transport + + +[//]: # (BEGIN included file options/compression-format.md) +#### **--compression-format**=**gzip** | *zstd* | *zstd:chunked* + +Specifies the compression format to use. Supported values are: `gzip`, `zstd` and `zstd:chunked`. The default is `gzip` unless overridden in the containers.conf file. +`zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning in that case. + +[//]: # (END included file options/compression-format.md) + + +[//]: # (BEGIN included file options/compression-level.md) +#### **--compression-level**=*level* + +Specifies the compression level to use. The value is specific to the compression algorithm used, e.g. for zstd the accepted values are in the range 1-20 (inclusive) with a default of 3, while for gzip it is 1-9 (inclusive) and has a default of 5. + +[//]: # (END included file options/compression-level.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/digestfile.md) +#### **--digestfile**=*Digestfile* + +After copying the image, write the digest of the resulting image to the file. + +[//]: # (END included file options/digestfile.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + +#### **--encrypt-layer**=*layer(s)* + +Layer(s) to encrypt: 0-indexed layer indices with support for negative indexing (e.g. 0 is the first layer, -1 is the last layer). If not defined, encrypts all layers if encryption-key flag is specified. + +#### **--encryption-key**=*key* + +The [protocol\:keyfile] specifies the encryption protocol, which can be JWE (RFC7516), PGP (RFC4880), and PKCS7 (RFC2315) and the key material required for image encryption. For instance, jwe:/path/to/key.pem or pgp\:admin@example.com or pkcs7:/path/to/x509-file. + + +[//]: # (BEGIN included file options/force-compression.md) +#### **--force-compression** + +If set, push uses the specified compression algorithm even if the destination contains a differently-compressed variant already. +Defaults to `true` if `--compression-format` is explicitly specified on the command-line, `false` otherwise. + +[//]: # (END included file options/force-compression.md) + +#### **--format**, **-f**=*format* + +Manifest Type (oci, v2s2, or v2s1) to use when pushing an image. + +#### **--quiet**, **-q** + +When writing the output image, suppress progress output + +#### **--remove-signatures** + +Discard any pre-existing signatures in the image. + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + +#### **--sign-by**=*key* + +Add a “simple signing” signature at the destination using the specified key. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-by-sigstore.md) +#### **--sign-by-sigstore**=*param-file* + +Add a sigstore signature based on further options specified in a container's sigstore signing parameter file *param-file*. +See containers-sigstore-signing-params.yaml(5) for details about the file format. + +[//]: # (END included file options/sign-by-sigstore.md) + +#### **--sign-by-sigstore-private-key**=*path* + +Add a sigstore signature at the destination using a private key at the specified path. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-passphrase-file.md) +#### **--sign-passphrase-file**=*path* + +If signing the image (using either **--sign-by** or **--sign-by-sigstore-private-key**), read the passphrase to use from the specified path. + +[//]: # (END included file options/sign-passphrase-file.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLE + +Push the specified image to a local directory: +``` +# podman push imageID dir:/path/to/image +``` + +Push the specified image to a local directory in OCI format: +``` +# podman push imageID oci-archive:/path/to/layout:image:tag +``` + +Push the specified image to a container registry: +``` +# podman push imageID docker://registry.example.com/repository:tag +``` + +Push the specified image to a container registry and save the digest in the specified file: +``` +# podman push --digestfile=/tmp/mydigest imageID docker://registry.example.com/repository:tag +``` + +Push the specified image into the local Docker daemon container store: +``` +# podman push imageID docker-daemon:image:tag +``` + +Push the specified image with a different image name using credentials from an alternate authfile path: +``` +# podman push --authfile temp-auths/myauths.json alpine docker://docker.io/umohnani/alpine +Getting image source signatures +Copying blob sha256:5bef08742407efd622d243692b79ba0055383bbce12900324f75e56f589aedb0 + 4.03 MB / 4.03 MB [========================================================] 1s +Copying config sha256:ad4686094d8f0186ec8249fc4917b71faa2c1030d7b5a025c29f26e19d95c156 + 1.41 KB / 1.41 KB [========================================================] 1s +Writing manifest to image destination +Storing signatures +``` + +Push the specified image to a local directory as an OCI image: +``` +# podman push --format oci registry.access.redhat.com/rhel7 dir\:rhel7-dir +Getting image source signatures +Copying blob sha256:9cadd93b16ff2a0c51ac967ea2abfadfac50cfa3af8b5bf983d89b8f8647f3e4 + 71.41 MB / 71.41 MB [======================================================] 9s +Copying blob sha256:4aa565ad8b7a87248163ce7dba1dd3894821aac97e846b932ff6b8ef9a8a508a + 1.21 KB / 1.21 KB [========================================================] 0s +Copying config sha256\:f1b09a81455c351eaa484b61aacd048ab613c08e4c5d1da80c4c46301b03cf3b + 3.01 KB / 3.01 KB [========================================================] 0s +Writing manifest to image destination +Storing signatures +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pull(1)](podman-pull.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-remote.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-remote.1.md new file mode 100644 index 000000000..343cff446 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-remote.1.md @@ -0,0 +1,206 @@ +--- +title: podman-remote +version: v5.4.2 +--- + +% podman-remote 1 + +## NAME +podman-remote - A remote CLI for Podman: A Simple management tool for pods, containers and images. + +## SYNOPSIS +**podman-remote** [*options*] *command* + +## DESCRIPTION +Podman (Pod Manager) is a fully featured container engine that is a simple daemonless tool. +Podman provides a Docker-CLI comparable command line that eases the transition from other +container engines and allows the management of pods, containers and images. Simply put: `alias docker=podman`. +Most Podman commands can be run as a regular user, without requiring additional +privileges. + +Podman uses Buildah(1) internally to create container images. Both tools share image +(not container) storage, hence each can use or manipulate images (but not containers) +created by the other. + +Podman-remote provides a local client interacting with a Podman backend node through a RESTful API tunneled through a ssh connection. In this context, a Podman node is a Linux system with Podman installed on it and the API service activated. Credentials for this session can be passed in using flags, environment variables, or in `containers.conf`. + +The `containers.conf` file is placed under `$HOME/.config/containers/containers.conf` on Linux and Mac and `%APPDATA%\containers\containers.conf` on Windows. + +**podman [GLOBAL OPTIONS]** + +## GLOBAL OPTIONS + +#### **--connection**=*name*, **-c** + +Remote connection name + +Overrides environment variable `CONTAINER_CONNECTION` if set. + +#### **--help**, **-h** + +Print usage statement + +#### **--identity**=*path* + +Path to ssh identity file. If the identity file has been encrypted, Podman prompts the user for the passphrase. +If no identity file is provided and no user is given, Podman defaults to the user running the podman command. +Podman prompts for the login password on the remote server. + +Identity value resolution precedence: + - command line value + - environment variable `CONTAINER_SSHKEY`, if `CONTAINER_HOST` is found + - `containers.conf` + +#### **--log-level**=*level* + +Log messages above specified level: debug, info, warn, error (default), fatal or panic + +#### **--url**=*value* + +URL to access Podman service (default from `containers.conf`, rootless "unix:///run/user/$UID/podman/podman.sock" or as root "unix:///run/podman/podman.sock). + + - `CONTAINER_HOST` is of the format `://[]@][:][]` + - `CONTAINER_PROXY` is of the format `://[]@][:]` + +Details: + - `schema` is one of: + * `ssh` (default): a local unix(7) socket on the named `host` and `port`, reachable via SSH + * `tcp`: an unencrypted, unauthenticated TCP connection to the named `host` and `port`, can work with proxy if `CONTAINER_PROXY` is set + * `unix`: a local unix(7) socket at the specified `path`, or the default for the user + - `user` defaults to either `root` or the current running user (`ssh` only) + - `password` has no default (`ssh` only) + - `host` must be provided and is either the IP or name of the machine hosting the Podman service (`ssh` and `tcp`) + - `port` defaults to 22 (`ssh` and `tcp`) + - `path` defaults to either `/run/podman/podman.sock`, or `/run/user/$UID/podman/podman.sock` if running rootless (`unix`), or must be explicitly specified (`ssh`) + - `CONTAINER_PROXY`: use proxy (`socks5` or `socks5h`) to access Podman service (`tcp` only) + +URL value resolution precedence: + - command line value + - environment variable `CONTAINER_HOST` + - `engine.service_destinations` table in containers.conf, excluding the /usr/share/containers directory + - `unix:///run/podman/podman.sock` + +Remote connections use local containers.conf for default. + +Some example URL values in valid formats: + - unix:///run/podman/podman.sock + - unix:///run/user/$UID/podman/podman.sock + - ssh://notroot@localhost:22/run/user/$UID/podman/podman.sock + - ssh://root@localhost:22/run/podman/podman.sock + - tcp://localhost:34451 + - tcp://127.0.0.1:34451 + +#### **--version** + +Print the version + +## Environment Variables + +Podman can set up environment variables from env of [engine] table in containers.conf. These variables can be overridden by passing environment variables before the `podman` commands. + +#### **CONTAINERS_CONF** + +Set default locations of containers.conf file + +#### **CONTAINER_CONNECTION** + +Set default `--connection` value to access Podman service. + +#### **CONTAINER_HOST** + +Set default `--url` value to access Podman service. + +#### **CONTAINER_SSHKEY** + +Set default `--identity` path to ssh key file value used to access Podman service. + +## Exit Status + +The exit code from `podman` gives information about why the container +failed to run or why it exited. When `podman` commands exit with a non-zero code, +the exit codes follow the `chroot` standard, see below: + + **125** The error is with podman itself + + $ podman run --foo busybox; echo $? + Error: unknown flag: --foo + 125 + + **126** Executing a _contained command_ and the _command_ cannot be invoked + + $ podman run busybox /etc; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error + 126 + + **127** Executing a _contained command_ and the _command_ cannot be found + $ podman run busybox foo; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error + 127 + + **Exit code** _contained command_ exit code + + $ podman run busybox /bin/sh -c 'exit 3'; echo $? + 3 + + +## COMMANDS + +| Command | Description | +| ------------------------------------------------ | --------------------------------------------------------------------------- | +| [podman-attach(1)](podman-attach.1.md) | Attach to a running container. | +| [podman-build(1)](podman-build.1.md) | Build a container image using a Dockerfile. | +| [podman-commit(1)](podman-commit.1.md) | Create new image based on the changed container. | +| [podman-container(1)](podman-container.1.md) | Manage containers. | +| [podman-cp(1)](podman-cp.1.md) | Copy files/folders between a container and the local filesystem. | +| [podman-create(1)](podman-create.1.md) | Create a new container. | +| [podman-diff(1)](podman-diff.1.md) | Inspect changes on a container or image's filesystem. | +| [podman-events(1)](podman-events.1.md) | Monitor Podman events | +| [podman-export(1)](podman-export.1.md) | Export a container's filesystem contents as a tar archive. | +| [podman-generate(1)](podman-generate.1.md) | Generate structured data based on containers and pods. | +| [podman-healthcheck(1)](podman-healthcheck.1.md) | Manage healthchecks for containers | +| [podman-history(1)](podman-history.1.md) | Show the history of an image. | +| [podman-image(1)](podman-image.1.md) | Manage images. | +| [podman-images(1)](podman-images.1.md) | List images in local storage. | +| [podman-import(1)](podman-import.1.md) | Import a tarball and save it as a filesystem image. | +| [podman-info(1)](podman-info.1.md) | Display Podman related system information. | +| [podman-init(1)](podman-init.1.md) | Initialize a container | +| [podman-inspect(1)](podman-inspect.1.md) | Display a container or image's configuration. | +| [podman-kill(1)](podman-kill.1.md) | Kill the main process in one or more containers. | +| [podman-load(1)](podman-load.1.md) | Load an image from a container image archive into container storage. | +| [podman-logs(1)](podman-logs.1.md) | Display the logs of a container. | +| [podman-pause(1)](podman-pause.1.md) | Pause one or more containers. | +| [podman-pod(1)](podman-pod.1.md) | Management tool for groups of containers, called pods. | +| [podman-port(1)](podman-port.1.md) | List port mappings for a container. | +| [podman-ps(1)](podman-ps.1.md) | Print out information about containers. | +| [podman-pull(1)](podman-pull.1.md) | Pull an image from a registry. | +| [podman-push(1)](podman-push.1.md) | Push an image from local storage to elsewhere. | +| [podman-restart(1)](podman-restart.1.md) | Restart one or more containers. | +| [podman-rm(1)](podman-rm.1.md) | Remove one or more containers. | +| [podman-rmi(1)](podman-rmi.1.md) | Remove one or more locally stored images. | +| [podman-run(1)](podman-run.1.md) | Run a command in a new container. | +| [podman-save(1)](podman-save.1.md) | Save an image to a container archive. | +| [podman-start(1)](podman-start.1.md) | Start one or more containers. | +| [podman-stop(1)](podman-stop.1.md) | Stop one or more running containers. | +| [podman-system(1)](podman-system.1.md) | Manage podman. | +| [podman-tag(1)](podman-tag.1.md) | Add an additional name to a local image. | +| [podman-top(1)](podman-top.1.md) | Display the running processes of a container. | +| [podman-unpause(1)](podman-unpause.1.md) | Unpause one or more containers. | +| [podman-version(1)](podman-version.1.md) | Display the Podman version information. | +| [podman-volume(1)](podman-volume.1.md) | Manage Volumes. | +## FILES + +**containers.conf** (`$HOME/.config/containers/containers.conf`) + +Podman has builtin defaults for command line options. These defaults can be overridden using the containers.conf configuration files. + +Users can modify defaults by creating the `$HOME/.config/containers/containers.conf` file. Podman merges its builtin defaults with the specified fields from this file, if it exists. Fields specified in the users file override the built-in defaults. + +Podman uses builtin defaults if no containers.conf file is found. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system-service(1)](podman-system-service.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-rename.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-rename.1.md new file mode 100644 index 000000000..464cdcd30 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-rename.1.md @@ -0,0 +1,43 @@ +--- +title: podman-rename +version: v5.4.2 +--- + +% podman-rename 1 + +## NAME +podman\-rename - Rename an existing container + +## SYNOPSIS +**podman rename** *container* *newname* + +**podman container rename** *container* *newname* + +## DESCRIPTION +Rename changes the name of an existing container. +The old name is freed, and is available for use. +This command can be run on containers in any state. +However, running containers may not fully receive the effects until they are restarted - for example, a running container may still use the old name in its logs. +At present, only containers are supported; pods and volumes cannot be renamed. + +## OPTIONS + +## EXAMPLES + +Rename container with a given name. +``` +$ podman rename oldContainer aNewName +``` + +Rename container with a given ID. +``` +$ podman rename 717716c00a6b testcontainer +``` + +Create an alias for container with a given ID. +``` +$ podman container rename 6e7514b47180 databaseCtr +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-restart.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-restart.1.md new file mode 100644 index 000000000..bf4eaef9e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-restart.1.md @@ -0,0 +1,120 @@ +--- +title: podman-restart +version: v5.4.2 +--- + +% podman-restart 1 + +## NAME +podman\-restart - Restart one or more containers + +## SYNOPSIS +**podman restart** [*options*] *container* ... + +**podman container restart** [*options*] *container* ... + +## DESCRIPTION +The restart command allows containers to be restarted using their ID or name. +Running containers are stopped and restarted. Stopped containers are started. + +## OPTIONS + +#### **--all**, **-a** + +Restart all containers regardless of their current state. + +#### **--cidfile** + +Read container ID from the specified file and restart the container. Can be specified multiple times. + +#### **--filter**, **-f**=*filter* + +Filter what containers restart. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--running** + +Restart all containers that are already in the *running* state. + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping the container. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +## EXAMPLES + +Restart the latest container. +``` +$ podman restart -l +ec588fc80b05e19d3006bf2e8aa325f0a2e2ff1f609b7afb39176ca8e3e13467 +``` + +Restart a specific container by partial container ID. +``` +$ podman restart ff6cf1 +ff6cf1e5e77e6dba1efc7f3fcdb20e8b89ad8947bc0518be1fcb2c78681f226f +``` + +Restart two containers by name with a timeout of 4 seconds. +``` +$ podman restart --time 4 test1 test2 +c3bb026838c30e5097f079fa365c9a4769d52e1017588278fa00d5c68ebc1502 +17e13a63081a995136f907024bcfe50ff532917988a152da229db9d894c5a9ec +``` + +Restart all running containers. +``` +$ podman restart --running +``` + +Restart all containers. +``` +$ podman restart --all +``` + +Restart container using ID specified in a given files. +``` +$ podman restart --cidfile /home/user/cidfile-1 +$ podman restart --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +March 2018, Originally compiled by Matt Heon diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-rm.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-rm.1.md new file mode 100644 index 000000000..682f45f43 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-rm.1.md @@ -0,0 +1,162 @@ +--- +title: podman-rm +version: v5.4.2 +--- + +% podman-rm 1 + +## NAME +podman\-rm - Remove one or more containers + +## SYNOPSIS +**podman rm** [*options*] *container* + +**podman container rm** [*options*] *container* + +## DESCRIPTION +**podman rm** removes one or more containers from the host. The container name or ID can be used. This does not remove images. +Running or unusable containers are not removed without the **-f** option. + +## OPTIONS + +#### **--all**, **-a** + +Remove all containers. Can be used in conjunction with **-f** as well. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and rm the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + +Command does not fail when *file* is missing and user specified --ignore. + +#### **--depend** + +Remove selected container and recursively remove all containers that depend on it. + +#### **--filter**=*filter* + +Filter what containers remove. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | + +#### **--force**, **-f** + +Force the removal of running and paused containers. Forcing a container removal also +removes containers from container storage even if the container is not known to Podman. +For example, containers that are created by different container engines like Buildah. +In addition, forcing can be used to remove unusable containers, e.g. containers +whose OCI runtime has become unavailable. + + +[//]: # (BEGIN included file options/ignore.md) +#### **--ignore**, **-i** + +Ignore errors when specified containers are not in the container store. A user +might have decided to manually remove a container which leads to a failure +during the ExecStop directive of a systemd service referencing that container. + +[//]: # (END included file options/ignore.md) +Further ignore when the specified `--cidfile` does not exist as it may have +already been removed along with the container. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping the container. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +The --force option must be specified to use the --time option. + +#### **--volumes**, **-v** + +Remove anonymous volumes associated with the container. This does not include named volumes +created with **podman volume create**, or the **--volume** option of **podman run** and **podman create**. + +## EXAMPLE +Remove container with a given name: +``` +$ podman rm mywebserver +``` + +Remove container with a given name and all of the containers that depend on it: +``` +$ podman rm --depend mywebserver +``` + +Remove multiple containers with given names or IDs: +``` +$ podman rm mywebserver myflaskserver 860a4b23 +``` + +Remove multiple containers with IDs read from files: +``` +$ podman rm --cidfile ./cidfile-1 --cidfile /home/user/cidfile-2 +``` + +Forcibly remove container with a given ID: +``` +$ podman rm -f 860a4b23 +``` + +Remove all containers regardless of the run state: +``` +$ podman rm -f -a +``` + +Forcibly remove the last created container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +$ podman rm -f --latest +``` + +## Exit Status + **0** All specified containers removed + + **1** One of the specified containers did not exist, and no other failures + + **2** One of the specified containers is paused or running + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +August 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-rmi.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-rmi.1.md new file mode 100644 index 000000000..11e47c7a9 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-rmi.1.md @@ -0,0 +1,81 @@ +--- +title: podman-rmi +version: v5.4.2 +--- + +% podman-rmi 1 + +## NAME +podman\-rmi - Remove one or more locally stored images + +## SYNOPSIS +**podman rmi** [*options*] *image* [...] + +**podman image rm** [*options*] *image* [...] + +## DESCRIPTION +Removes one or more locally stored images. +Passing an argument _image_ deletes it, along with any of its dangling parent images. A dangling image is an image without a tag and without being referenced by another image. + +Note: To delete an image from a remote registry, use the [**skopeo delete**](https://github.com/containers/skopeo/blob/main/docs/skopeo-delete.1.md) command. Some registries do not allow users to delete an image via a CLI remotely. + +## OPTIONS + +#### **--all**, **-a** + +Remove all images in the local storage. + +#### **--force**, **-f** + +This option causes Podman to remove all containers that are using the image before removing the image from the system. + +#### **--ignore**, **-i** + +If a specified image does not exist in the local storage, ignore it and do not throw an error. + +#### **--no-prune** + +This option does not remove dangling parents of the specified image. + +Remove an image by its short ID +``` +$ podman rmi c0ed59d05ff7 +``` +Remove an image and its associated containers. +``` +$ podman rmi --force imageID +``` + +Remove multiple images by their shortened IDs. +``` +$ podman rmi c4dfb1609ee2 93fd78260bd1 c0ed59d05ff7 +``` + +Remove all images and containers. +``` +$ podman rmi -a -f +``` + +Remove an absent image with and without the `--ignore` flag. +``` +$ podman rmi --ignore nothing +$ podman rmi nothing +Error: nothing: image not known + +``` + + +## Exit Status + **0** All specified images removed + + **1** One of the specified images did not exist, and no other failures + + **2** One of the specified images has child images or is being used by a container + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[skopeo-delete(1)](https://github.com/containers/skopeo/blob/main/docs/skopeo-delete.1.md)** + +## HISTORY +March 2017, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-rootless.7.md b/versioned_docs/version-5.4.2/source/markdown/podman-rootless.7.md new file mode 100644 index 000000000..bf24f5919 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-rootless.7.md @@ -0,0 +1,54 @@ +--- +title: Shortcomings of Rootless Podman +version: v5.4.2 +--- + +% podman-rootless 7 + +# Shortcomings of Rootless Podman + +The following list categorizes the known issues and irregularities with running Podman as a non-root user. Although currently functional, there is still a number of work items that are under consideration to be added. These proposed changes are in varying degrees of design and development. + +Contributors are more than welcomed to help with this work. If you decide to carve off a piece and work on it, please create an issue in [GitHub](https://github.com/containers/podman/issues), and assign it to yourself. If you find other unexpected behavior with rootless Podman and feel it’s warranted, please feel free to update this document. + +* Podman can not create containers that bind to ports < 1024. + * The kernel does not allow processes without CAP_NET_BIND_SERVICE to bind to low ports. + * You can modify the `net.ipv4.ip_unprivileged_port_start` sysctl to change the lowest port. For example `sysctl net.ipv4.ip_unprivileged_port_start=443` allows rootless Podman containers to bind to ports >= 443. + * A proxy server, kernel firewall rule, or redirection tool such as [redir](https://github.com/troglobit/redir) may be used to redirect traffic from a privileged port to an unprivileged one (where a podman pod is bound) in a server scenario - where a user has access to the root account (or setuid on the binary would be an acceptable risk), but wants to run the containers as an unprivileged user for enhanced security and for a limited number of pre-known ports. +* As of Podman 5.0, pasta is the default networking tool. Since pasta copies the IP address of the main interface, connections to that IP from containers do not work. This means that unless you have more than one interface, inter-container connections cannot be made without explicitly passing a pasta network configuration, either in `containers.conf` or at runtime. + * If you previously had port forwards (ex. via -p 80:80) that other containers could access, you can either revert back to slirp4netns or use the solution (setting pasta options with 10.0.2.x IPs) posted [here](https://blog.podman.io/2024/03/podman-5-0-breaking-changes-in-detail/). +* “How To” documentation is patchy at best. +* If /etc/subuid and /etc/subgid are not set up for a user, then podman commands +can easily fail + * This can be a big issue on machines using Network Based Password information (FreeIPA, Active Directory, LDAP) + * We are working to get support for NSSWITCH on the /etc/subuid and /etc/subgid files. +* No cgroup V1 Support + * cgroup V1 does not safely support cgroup delegation. + * As of Fedora 31 defaults to cgroup V2, which has full support of rootless cgroup management. Note this requires the --cgroup-manager within rootless containers to use systemd, which new containers will get by default. +* Some system unit configuration options do not work in the rootless container + * systemd fails to apply several options and failures are silently ignored (e.g. CPUShares, MemoryLimit). Should work on cgroup V2. + * Use of certain options will cause service startup failures (e.g. PrivateNetwork). The systemd services requiring `PrivateNetwork` can be made to work by passing `--cap-add SYS_ADMIN`, but the security implications should be carefully evaluated. In most cases, it's better to create an override.conf drop-in that sets `PrivateNetwork=no`. This also applies to containers run by root. +* Can not share container images with CRI-O or other rootful users +* Difficult to use additional stores for sharing content +* Does not work on NFS or parallel filesystem homedirs (e.g. [GPFS](https://www.ibm.com/support/knowledgecenter/en/SSFKCN/gpfs_welcome.html)) + * NFS and parallel filesystems enforce file creation on different UIDs on the server side and does not understand User Namespace. + * When a container root process like YUM attempts to create a file owned by a different UID, NFS Server/GPFS denies the creation. +* Does not work with homedirs mounted with noexec/nodev + * User can set up storage to point to other directories they can write to that are not mounted noexec/nodev +* Support for using native overlayfs as an unprivileged user is only available for Podman version >= 3.1 on a Linux kernel version >= 5.12, otherwise the slower _fuse-overlayfs_ may be used. + * A few Linux distributions (e.g. Ubuntu) have supported even older Podman and Linux kernel versions by modifying the normal Linux kernel behaviour. +* Only other supported driver is VFS. +* Cannot use ping out of the box. + * [(Can be fixed by setting sysctl on host)](https://github.com/containers/podman/blob/main/troubleshooting.md#5-rootless-containers-cannot-ping-hosts) +* Requires new shadow-utils (not found in older (RHEL7/Centos7 distros) Should be fixed in RHEL7.7 release) +* A few commands do not work. + * mount/unmount (on fuse-overlay) + * Only works if you enter the mount namespace with podman unshare + * podman stats (Works with cgroup V2 support) + * Checkpoint and Restore (CRIU requires root) + * Pause and Unpause (Works with cgroup V2 support) +* Issues with higher UIDs can cause builds to fail + * If a build is attempting to use a UID that is not mapped into the user namespace mapping for a container, then builds will not be able to put the UID in an image. +* Making device nodes within a container fails, even when running --privileged. + * The kernel does not allow non root user processes (processes without CAP_MKNOD) to create device nodes. If a container needs to create device nodes, it must be run as root. +* When using --net=host with rootless containers, subsequent podman execs to that container will not join the host network namespace because it is owned by root. diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-run.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-run.1.md new file mode 100644 index 000000000..1910a3040 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-run.1.md @@ -0,0 +1,3258 @@ +--- +title: podman-run +version: v5.4.2 +--- + +% podman-run 1 + +## NAME +podman\-run - Run a command in a new container + +## SYNOPSIS +**podman run** [*options*] *image* [*command* [*arg* ...]] + +**podman container run** [*options*] *image* [*command* [*arg* ...]] + +## DESCRIPTION + +Run a process in a new container. **podman run** starts a process with its own +file system, its own networking, and its own isolated process tree. The _image_ +which starts the process may define defaults related to the process that will be +run in the container, the networking to expose, and more, but **podman run** +gives final control to the operator or administrator who starts the container +from the image. For that reason **podman run** has more options than any other +Podman command. + +If the _image_ is not already loaded then **podman run** will pull the _image_, and +all image dependencies, from the repository in the same way running **podman +pull** _image_, before it starts the container from that image. + +Several files will be automatically created within the container. These include +_/etc/hosts_, _/etc/hostname_, and _/etc/resolv.conf_ to manage networking. +These will be based on the host's version of the files, though they can be +customized with options (for example, **--dns** will override the host's DNS +servers in the created _resolv.conf_). Additionally, a container environment +file is created in each container to indicate to programs they are running in a +container. This file is located at _/run/.containerenv_ (or +_/var/run/.containerenv_ for FreeBSD containers). When using the +--privileged flag the .containerenv contains name/value pairs indicating the +container engine version, whether the engine is running in rootless mode, the +container name and ID, as well as the image name and ID that the container is based on. Note: _/run/.containerenv_ will not be created when a volume is mounted on /run. + +When running from a user defined network namespace, the _/etc/netns/NSNAME/resolv.conf_ +will be used if it exists, otherwise _/etc/resolv.conf_ will be used. + +Default settings are defined in `containers.conf`. Most settings for remote +connections use the servers containers.conf, except when documented in man +pages. + +## IMAGE + + The image is specified using transport\:path format. If no transport is specified, the `docker` (container registry) +transport is used by default. For remote Podman, including Mac and Windows (excluding WSL2) machines, `docker` is the only allowed transport. + + **dir:**_path_ + An existing local directory _path_ storing the manifest, layer tarballs and signatures as individual files. This +is a non-standardized format, primarily useful for debugging or noninvasive container inspection. + + $ podman save --format docker-dir fedora -o /tmp/fedora + $ podman run dir:/tmp/fedora echo hello + + **docker://**_docker-reference_ (Default) + An image reference stored in a remote container image registry. Example: "quay.io/podman/stable:latest". +The reference can include a path to a specific registry; if it does not, the +registries listed in registries.conf are queried to find a matching image. +By default, credentials from `podman login` (stored at +$XDG_RUNTIME_DIR/containers/auth.json by default) are used to authenticate; +otherwise it falls back to using credentials in $HOME/.docker/config.json. + + $ podman run registry.fedoraproject.org/fedora\:latest echo hello + + **docker-archive:**_path_[**:**_docker-reference_] +An image stored in the `docker save` formatted file. _docker-reference_ is only used when creating such a +file, and it must not contain a digest. + + $ podman save --format docker-archive fedora -o /tmp/fedora + $ podman run docker-archive:/tmp/fedora echo hello + + **docker-daemon:**_docker-reference_ + An image in _docker-reference_ format stored in the docker daemon internal storage. The _docker-reference_ can also be an image ID (docker-daemon\:algo\:digest). + + $ sudo docker pull fedora + $ sudo podman run docker-daemon\:docker.io/library/fedora echo hello + + **oci-archive:**_path_**:**_tag_ + An image in a directory compliant with the "Open Container Image Layout Specification" at the specified _path_ +and specified with a _tag_. + + $ podman save --format oci-archive fedora -o /tmp/fedora + $ podman run oci-archive:/tmp/fedora echo hello + +## OPTIONS + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the container's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + + +[//]: # (BEGIN included file options/annotation.container.md) +#### **--annotation**=*key=value* + +Add an annotation to the container. This option can be set multiple times. + +[//]: # (END included file options/annotation.container.md) + + +[//]: # (BEGIN included file options/arch.md) +#### **--arch**=*ARCH* +Override the architecture, defaults to hosts, of the image to be pulled. For example, `arm`. +Unless overridden, subsequent lookups of the same image in the local storage matches this architecture, regardless of the host. + +[//]: # (END included file options/arch.md) + + +[//]: # (BEGIN included file options/attach.md) +#### **--attach**, **-a**=*stdin* | *stdout* | *stderr* + +Attach to STDIN, STDOUT or STDERR. + +In foreground mode (the default when **-d** +is not specified), **podman run** can start the process in the container +and attach the console to the process's standard input, output, and +error. It can even pretend to be a TTY (this is what most command-line +executables expect) and pass along signals. The **-a** option can be set for +each of **stdin**, **stdout**, and **stderr**. + +[//]: # (END included file options/attach.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cap-add.md) +#### **--cap-add**=*capability* + +Add Linux capabilities. + +[//]: # (END included file options/cap-add.md) + + +[//]: # (BEGIN included file options/cap-drop.md) +#### **--cap-drop**=*capability* + +Drop Linux capabilities. + +[//]: # (END included file options/cap-drop.md) + + +[//]: # (BEGIN included file options/cgroup-conf.md) +#### **--cgroup-conf**=*KEY=VALUE* + +When running on cgroup v2, specify the cgroup file to write to and its value. For example **--cgroup-conf=memory.high=1073741824** sets the memory.high limit to 1GB. + +[//]: # (END included file options/cgroup-conf.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the container is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cgroupns.md) +#### **--cgroupns**=*mode* + +Set the cgroup namespace mode for the container. + +- **host**: use the host's cgroup namespace inside the container. +- **container:**_id_: join the namespace of the specified container. +- **private**: create a new cgroup namespace. +- **ns:**_path_: join the namespace at the specified path. + +If the host uses cgroups v1, the default is set to **host**. On cgroups v2, the default is **private**. + +[//]: # (END included file options/cgroupns.md) + + +[//]: # (BEGIN included file options/cgroups.md) +#### **--cgroups**=*how* + +Determines whether the container creates CGroups. + +Default is **enabled**. + +The **enabled** option creates a new cgroup under the cgroup-parent. +The **disabled** option forces the container to not create CGroups, and thus conflicts with CGroup options (**--cgroupns** and **--cgroup-parent**). +The **no-conmon** option disables a new CGroup only for the **conmon** process. +The **split** option splits the current CGroup in two sub-cgroups: one for conmon and one for the container payload. It is not possible to set **--cgroup-parent** with **split**. + +[//]: # (END included file options/cgroups.md) + + +[//]: # (BEGIN included file options/chrootdirs.md) +#### **--chrootdirs**=*path* + +Path to a directory inside the container that is treated as a `chroot` directory. +Any Podman managed file (e.g., /etc/resolv.conf, /etc/hosts, etc/hostname) that is mounted into the root directory is mounted into that location as well. +Multiple directories are separated with a comma. + +[//]: # (END included file options/chrootdirs.md) + + +[//]: # (BEGIN included file options/cidfile.write.md) +#### **--cidfile**=*file* + +Write the container ID to *file*. The file is removed along with the container, except +when used with podman --remote run on detached containers. + +[//]: # (END included file options/cidfile.write.md) + + +[//]: # (BEGIN included file options/conmon-pidfile.md) +#### **--conmon-pidfile**=*file* + +Write the pid of the **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to restart Podman containers. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/conmon-pidfile.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-rt-period.md) +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-period.md) + + +[//]: # (BEGIN included file options/cpu-rt-runtime.md) +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-runtime.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpus.container.md) +#### **--cpus**=*number* + +Number of CPUs. The default is *0.0* which means no limit. This is shorthand +for **--cpu-period** and **--cpu-quota**, therefore the option cannot be specified with +**--cpu-period** or **--cpu-quota**. + +On some systems, changing the CPU limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpus.container.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + +#### **--detach**, **-d** + +Detached mode: run the container in the background and print the new container ID. The default is *false*. + +At any time run **podman ps** in +the other shell to view a list of the running containers. Reattach to a +detached container with **podman attach** command. + +When attached via tty mode, detach from the container (and leave it +running) using a configurable key sequence. The default sequence is `ctrl-p,ctrl-q`. +Specify the key sequence using the **--detach-keys** option, or configure +it in the **containers.conf** file: see **containers.conf(5)** for more information. + + +[//]: # (BEGIN included file options/detach-keys.md) +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. + +[//]: # (END included file options/detach-keys.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the container. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The container only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: if the user only has access rights via a group, accessing the device +from inside a rootless container fails. Use the `--group-add keep-groups` +flag to pass the user's supplementary group access into the container. + + +[//]: # (BEGIN included file options/device-cgroup-rule.md) +#### **--device-cgroup-rule**=*"type major\:minor mode"* + +Add a rule to the cgroup allowed devices list. The rule is expected to be +in the format specified in the Linux kernel documentation +[admin-guide/cgroup-v1/devices](https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.html): +- *type*: `a` (all), `c` (char), or `b` (block); +- *major* and *minor*: either a number, or `*` for all; +- *mode*: a composition of `r` (read), `w` (write), and `m` (mknod(2)). + +[//]: # (END included file options/device-cgroup-rule.md) + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-read-iops.md) +#### **--device-read-iops**=*path:rate* + +Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-iops.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + + +[//]: # (BEGIN included file options/device-write-iops.md) +#### **--device-write-iops**=*path:rate* + +Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-iops.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + + +[//]: # (BEGIN included file options/dns.md) +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. + +[//]: # (END included file options/dns.md) + +This option cannot be combined with **--network** that is set to **none** or **container:**_id_. + + +[//]: # (BEGIN included file options/dns-option.container.md) +#### **--dns-option**=*option* + +Set custom DNS options. Invalid if using **--dns-option** with **--network** that is set to **none** or **container:**_id_. + +[//]: # (END included file options/dns-option.container.md) + + +[//]: # (BEGIN included file options/dns-search.container.md) +#### **--dns-search**=*domain* + +Set custom DNS search domains. Invalid if using **--dns-search** with **--network** that is set to **none** or **container:**_id_. +Use **--dns-search=.** to remove the search domain. + +[//]: # (END included file options/dns-search.container.md) + + +[//]: # (BEGIN included file options/entrypoint.md) +#### **--entrypoint**=*"command"* | *'["command", "arg1", ...]'* + +Override the default ENTRYPOINT from the image. + +The ENTRYPOINT of an image is similar to a COMMAND +because it specifies what executable to run when the container starts, but it is +(purposely) more difficult to override. The ENTRYPOINT gives a container its +default nature or behavior. When the ENTRYPOINT is set, the +container runs as if it were that binary, complete with default options. More options can be +passed in via the COMMAND. But, if a user wants to run +something else inside the container, the **--entrypoint** option allows a new +ENTRYPOINT to be specified. + +Specify multi option commands in the form of a json string. + +[//]: # (END included file options/entrypoint.md) + + +[//]: # (BEGIN included file options/env.md) +#### **--env**, **-e**=*env* + +Set environment variables. + +This option allows arbitrary environment variables that are available for the process to be launched inside of the container. If an environment variable is specified without a value, Podman checks the host environment for a value and set the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the container. + +[//]: # (END included file options/env.md) + +See [**Environment**](#environment) note below for precedence and examples. + + +[//]: # (BEGIN included file options/env-file.md) +#### **--env-file**=*file* + +Read in a line-delimited file of environment variables. + +[//]: # (END included file options/env-file.md) + +See [**Environment**](#environment) note below for precedence and examples. + + +[//]: # (BEGIN included file options/env-host.md) +#### **--env-host** + +Use host environment inside of the container. See **Environment** note below for precedence. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/env-host.md) + + +[//]: # (BEGIN included file options/env-merge.md) +#### **--env-merge**=*env* + +Preprocess default environment variables for the containers. For example +if image contains environment variable `hello=world` user can preprocess +it using `--env-merge hello=${hello}-some` so new value is `hello=world-some`. + +Please note that if the environment variable `hello` is not present in the image, +then it'll be replaced by an empty string and so using `--env-merge hello=${hello}-some` +would result in the new value of `hello=-some`, notice the leading `-` delimiter. + +[//]: # (END included file options/env-merge.md) + + +[//]: # (BEGIN included file options/expose.md) +#### **--expose**=*port[/protocol]* + +Expose a port or a range of ports (e.g. **--expose=3300-3310**). +The protocol can be `tcp`, `udp` or `sctp` and if not given `tcp` is assumed. +This option matches the EXPOSE instruction for image builds and has no effect on +the actual networking rules unless **-P/--publish-all** is used to forward to all +exposed ports from random host ports. To forward specific ports from the host +into the container use the **-p/--publish** option instead. + +[//]: # (END included file options/expose.md) + + +[//]: # (BEGIN included file options/gidmap.container.md) +#### **--gidmap**=*[flags]container_uid\:from_uid[\:amount]* + +Run the container in a new user namespace using the supplied GID mapping. This +option conflicts with the **--userns** and **--subgidname** options. This +option provides a way to map host GIDs to container GIDs in the same way as +__--uidmap__ maps host UIDs to container UIDs. For details see __--uidmap__. + +Note: the **--gidmap** option cannot be called in conjunction with the **--pod** option as a gidmap cannot be set on the container level when in a pod. + +[//]: # (END included file options/gidmap.container.md) + + +[//]: # (BEGIN included file options/gpus.md) +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. + +[//]: # (END included file options/gpus.md) + + +[//]: # (BEGIN included file options/group-add.md) +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/group-add.md) + + +[//]: # (BEGIN included file options/group-entry.md) +#### **--group-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/group` file within the container when `--user` is used. + +The variables $GROUPNAME, $GID, and $USERLIST are automatically replaced with their value at runtime if present. + +[//]: # (END included file options/group-entry.md) + + +[//]: # (BEGIN included file options/health-cmd.md) +#### **--health-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set or alter a healthcheck command for a container. The command is a command to be executed inside the +container that determines the container health. The command is required for other healthcheck options +to be applied. A value of **none** disables existing healthchecks. + +Multiple options can be passed in the form of a JSON array; otherwise, the command is interpreted +as an argument to **/bin/sh -c**. + +[//]: # (END included file options/health-cmd.md) + + +[//]: # (BEGIN included file options/health-interval.md) +#### **--health-interval**=*interval* + +Set an interval for the healthchecks. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-interval.md) + + +[//]: # (BEGIN included file options/health-log-destination.md) +#### **--health-log-destination**=*directory_path* + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) (Default: local) + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. + +[//]: # (END included file options/health-log-destination.md) + + +[//]: # (BEGIN included file options/health-max-log-count.md) +#### **--health-max-log-count**=*number of stored logs* + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) (Default: 5 attempts) + +[//]: # (END included file options/health-max-log-count.md) + + +[//]: # (BEGIN included file options/health-max-log-size.md) +#### **--health-max-log-size**=*size of stored logs* + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) (Default: 500 characters) + +[//]: # (END included file options/health-max-log-size.md) + + +[//]: # (BEGIN included file options/health-on-failure.md) +#### **--health-on-failure**=*action* + +Action to take once the container transitions to an unhealthy state. The default is **none**. + +- **none**: Take no action. +- **kill**: Kill the container. +- **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. +- **stop**: Stop the container. + +[//]: # (END included file options/health-on-failure.md) + + +[//]: # (BEGIN included file options/health-retries.md) +#### **--health-retries**=*retries* + +The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is **3**. + +[//]: # (END included file options/health-retries.md) + + +[//]: # (BEGIN included file options/health-start-period.md) +#### **--health-start-period**=*period* + +The initialization time needed for a container to bootstrap. The value can be expressed in time format like +**2m3s**. The default value is **0s**. + +Note: The health check command is executed as soon as a container is started, if the health check is successful +the container's health state will be updated to `healthy`. However, if the health check fails, the health state will +stay as `starting` until either the health check is successful or until the `--health-start-period` time is over. If the +health check command fails after the `--health-start-period` time is over, the health state will be updated to `unhealthy`. +The health check command is executed periodically based on the value of `--health-interval`. + +[//]: # (END included file options/health-start-period.md) + + +[//]: # (BEGIN included file options/health-startup-cmd.md) +#### **--health-startup-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set a startup healthcheck command for a container. This command is executed inside the container and is used to gate the regular +healthcheck. When the startup command succeeds, the regular healthcheck begins and the startup healthcheck ceases. Optionally, +if the command fails for a set number of attempts, the container is restarted. A startup healthcheck can be used to ensure that +containers with an extended startup period are not marked as unhealthy until they are fully started. Startup healthchecks can only be +used when a regular healthcheck (from the container's image or the **--health-cmd** option) is also set. + +[//]: # (END included file options/health-startup-cmd.md) + + +[//]: # (BEGIN included file options/health-startup-interval.md) +#### **--health-startup-interval**=*interval* + +Set an interval for the startup healthcheck. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-startup-interval.md) + + +[//]: # (BEGIN included file options/health-startup-retries.md) +#### **--health-startup-retries**=*retries* + +The number of attempts allowed before the startup healthcheck restarts the container. If set to **0**, the container is never restarted. The default is **0**. + +[//]: # (END included file options/health-startup-retries.md) + + +[//]: # (BEGIN included file options/health-startup-success.md) +#### **--health-startup-success**=*retries* + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value +of **0** means that any success begins the regular healthcheck. The default is **0**. + +[//]: # (END included file options/health-startup-success.md) + + +[//]: # (BEGIN included file options/health-startup-timeout.md) +#### **--health-startup-timeout**=*timeout* + +The maximum time a startup healthcheck command has to complete before it is marked as failed. The value can be expressed in a time +format like **2m3s**. The default value is **30s**. + +[//]: # (END included file options/health-startup-timeout.md) + + +[//]: # (BEGIN included file options/health-timeout.md) +#### **--health-timeout**=*timeout* + +The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the +value can be expressed in a time format such as **1m22s**. The default value is **30s**. + +[//]: # (END included file options/health-timeout.md) + +#### **--help** + +Print usage statement + + +[//]: # (BEGIN included file options/hostname.container.md) +#### **--hostname**, **-h**=*name* + +Set the container's hostname inside the container. + +This option can only be used with a private UTS namespace `--uts=private` +(default). If `--pod` is given and the pod shares the same UTS namespace +(default), the pod's hostname is used. The given hostname is also added to the +`/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). + +[//]: # (END included file options/hostname.container.md) + + +[//]: # (BEGIN included file options/hosts-file.md) +#### **--hosts-file**=*path* | *none* | *image* + +Base file to create the `/etc/hosts` file inside the container. This must either +be an absolute path to a file on the host system, or one of the following +special flags: + "" Follow the `base_hosts_file` configuration in _containers.conf_ (the default) + `none` Do not use a base file (i.e. start with an empty file) + `image` Use the container image's `/etc/hosts` file as base file + +[//]: # (END included file options/hosts-file.md) + + +[//]: # (BEGIN included file options/hostuser.md) +#### **--hostuser**=*name* + +Add a user account to /etc/passwd from the host to the container. The Username +or UID must exist on the host system. + +[//]: # (END included file options/hostuser.md) + + +[//]: # (BEGIN included file options/http-proxy.md) +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. + +[//]: # (END included file options/http-proxy.md) + + +[//]: # (BEGIN included file options/image-volume.md) +#### **--image-volume**=**bind** | *tmpfs* | *ignore* + +Tells Podman how to handle the builtin image volumes. Default is **bind**. + +- **bind**: An anonymous named volume is created and mounted into the container. +- **tmpfs**: The volume is mounted onto the container as a tmpfs, which allows the users to create +content that disappears when the container is stopped. +- **ignore**: All volumes are just ignored and no action is taken. + +[//]: # (END included file options/image-volume.md) + + +[//]: # (BEGIN included file options/init.md) +#### **--init** + +Run an init inside the container that forwards signals and reaps processes. +The container-init binary is mounted at `/run/podman-init`. +Mounting over `/run` breaks container execution. + +[//]: # (END included file options/init.md) + + +[//]: # (BEGIN included file options/init-path.md) +#### **--init-path**=*path* + +Path to the container-init binary. + +[//]: # (END included file options/init-path.md) + + +[//]: # (BEGIN included file options/interactive.md) +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. + +[//]: # (END included file options/interactive.md) + + +[//]: # (BEGIN included file options/ip.md) +#### **--ip**=*ipv4* + +Specify a static IPv4 address for the container, for example **10.88.64.128**. +This option can only be used if the container is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IP address pool (default **10.88.0.0/16**). + +To specify multiple static IP addresses per container, set multiple networks using the **--network** option with a static IP address specified for each using the `ip` mode for that option. + +[//]: # (END included file options/ip.md) + + +[//]: # (BEGIN included file options/ip6.md) +#### **--ip6**=*ipv6* + +Specify a static IPv6 address for the container, for example **fd46\:db93\:aa76\:ac37::10**. +This option can only be used if the container is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IPv6 address pool. + +To specify multiple static IPv6 addresses per container, set multiple networks using the **--network** option with a static IPv6 address specified for each using the `ip6` mode for that option. + +[//]: # (END included file options/ip6.md) + + +[//]: # (BEGIN included file options/ipc.md) +#### **--ipc**=*ipc* + +Set the IPC namespace mode for a container. The default is to create +a private IPC namespace. + +- "": Use Podman's default, defined in containers.conf. +- **container:**_id_: reuses another container's shared memory, semaphores, and message queues +- **host**: use the host's shared memory, semaphores, and message queues inside the container. Note: the host mode gives the container full access to local shared memory and is therefore considered insecure. +- **none**: private IPC namespace, with /dev/shm not mounted. +- **ns:**_path_: path to an IPC namespace to join. +- **private**: private IPC namespace. +- **shareable**: private IPC namespace with a possibility to share it with other containers. + +[//]: # (END included file options/ipc.md) + + +[//]: # (BEGIN included file options/label.md) +#### **--label**, **-l**=*key=value* + +Add metadata to a container. + +[//]: # (END included file options/label.md) + + +[//]: # (BEGIN included file options/label-file.md) +#### **--label-file**=*file* + +Read in a line-delimited file of labels. + +[//]: # (END included file options/label-file.md) + + +[//]: # (BEGIN included file options/link-local-ip.md) +#### **--link-local-ip**=*ip* + +Not implemented. + +[//]: # (END included file options/link-local-ip.md) + + +[//]: # (BEGIN included file options/log-driver.md) +#### **--log-driver**=*driver* + +Logging driver for the container. Currently available options are **k8s-file**, **journald**, **none**, **passthrough** and **passthrough-tty**, with **json-file** aliased to **k8s-file** for scripting compatibility. (Default **journald**). + +The podman info command below displays the default log-driver for the system. +``` +$ podman info --format '{{ .Host.LogDriver }}' +journald +``` +The **passthrough** driver passes down the standard streams (stdin, stdout, stderr) to the +container. It is not allowed with the remote Podman client, including Mac and Windows (excluding WSL2) machines, and on a tty, since it is +vulnerable to attacks via TIOCSTI. + +The **passthrough-tty** driver is the same as **passthrough** except that it also allows it to be used on a TTY if the user really wants it. + +[//]: # (END included file options/log-driver.md) + + +[//]: # (BEGIN included file options/log-opt.md) +#### **--log-opt**=*name=value* + +Logging driver specific options. + +Set custom logging configuration. The following *name*s are supported: + +**path**: specify a path to the log file + (e.g. **--log-opt path=/var/log/container/mycontainer.json**); + +**max-size**: specify a max size of the log file + (e.g. **--log-opt max-size=10mb**); + +**tag**: specify a custom log tag for the container + (e.g. **--log-opt tag="{{.ImageName}}"**. +It supports the same keys as **podman inspect --format**. +This option is currently supported only by the **journald** log driver. + +[//]: # (END included file options/log-opt.md) + + +[//]: # (BEGIN included file options/mac-address.md) +#### **--mac-address**=*address* + +Container network interface MAC address (e.g. 92\:d0\:c6:0a:29:33) +This option can only be used if the container is joined to only a single network - i.e., **--network=_network-name_** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. + +Remember that the MAC address in an Ethernet network must be unique. +The IPv6 link-local address is based on the device's MAC address +according to RFC4862. + +To specify multiple static MAC addresses per container, set multiple networks using the **--network** option with a static MAC address specified for each using the `mac` mode for that option. + +[//]: # (END included file options/mac-address.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-reservation.md) +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-reservation.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/memory-swappiness.md) +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/memory-swappiness.md) + + +[//]: # (BEGIN included file options/mount.md) +#### **--mount**=*type=TYPE,TYPE-SPECIFIC-OPTION[,...]* + +Attach a filesystem mount to the container + +Current supported mount TYPEs are **bind**, **devpts**, **glob**, **image**, **ramfs**, **tmpfs** and **volume**. + +Options common to all mount types: + +- *src*, *source*: mount source spec for **bind**, **glob**, and **volume**. + Mandatory for **bind** and **glob**. + +- *dst*, *destination*, *target*: mount destination spec. + +When source globs are specified without the destination directory, +the files and directories are mounted with their complete path +within the container. When the destination is specified, the +files and directories matching the glob on the base file name +on the destination directory are mounted. The option +`type=glob,src=/foo*,destination=/tmp/bar` tells container engines +to mount host files matching /foo* to the /tmp/bar/ +directory in the container. + +Options specific to type=**volume**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *idmap*: If specified, create an idmapped mount to the target user namespace in the container. + The idmap option is only supported by Podman in rootful mode. The Linux kernel does not allow the use of idmaped file systems for unprivileged users. + The idmap option supports a custom mapping that can be different than the user namespace used by the container. + The mapping can be specified after the idmap option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the first value is the + start of the backing file system IDs that are mapped to the second value on the host. The length of this mapping is given in the third value. + Multiple ranges are separated with #. If the specified mapping is prepended with a '@' then the mapping is considered relative to the container + user namespace. The host ID for the mapping is changed to account for the relative position of the container user in the container user namespace. + +Options specific to type=**image**: + +- *rw*, *readwrite*: *true* or *false* (default if unspecified: *false*). + +- *subpath*: Mount only a specific path within the image, instead of the whole image. + +Options specific to **bind** and **glob**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *bind-propagation*: *shared*, *slave*, *private*, *unbindable*, *rshared*, *rslave*, *runbindable*, or **rprivate** (default).[[1]](#Footnote1) See also mount(2). + +- *bind-nonrecursive*: do not set up a recursive bind mount. By default it is recursive. + +- *relabel*: *shared*, *private*. + +- *idmap*: *true* or *false* (default if unspecified: *false*). If true, create an idmapped mount to the target user namespace in the container. The idmap option is only supported by Podman in rootful mode. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *no-dereference*: do not dereference symlinks but copy the link source into the mount destination. + +Options specific to type=**tmpfs** and **ramfs**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *tmpfs-size*: Size of the tmpfs/ramfs mount, in bytes. Unlimited by default in Linux. + +- *tmpfs-mode*: Octal file mode of the tmpfs/ramfs (e.g. 700 or 0700.). + +- *tmpcopyup*: Enable copyup from the image directory at the same location to the tmpfs/ramfs. Used by default. + +- *notmpcopyup*: Disable copying files from the image to the tmpfs/ramfs. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +Options specific to type=**devpts**: + +- *uid*: numeric UID of the file owner (default: 0). + +- *gid*: numeric GID of the file owner (default: 0). + +- *mode*: octal permission mask for the file (default: 600). + +- *max*: maximum number of PTYs (default: 1048576). + +Examples: + +- `type=bind,source=/path/on/host,destination=/path/in/container` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared,U=true` + +- `type=devpts,destination=/dev/pts` + +- `type=glob,src=/usr/lib/libfoo*,destination=/usr/lib,ro=true` + +- `type=image,source=fedora,destination=/fedora-image,rw=true` + +- `type=ramfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,destination=/path/in/container,noswap` + +- `type=volume,source=vol1,destination=/path/in/container,ro=true` + +[//]: # (END included file options/mount.md) + + +[//]: # (BEGIN included file options/name.container.md) +#### **--name**=*name* + +Assign a name to the container. + +The operator can identify a container in three ways: + +- UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”); +- UUID short identifier (“f78375b1c487”); +- Name (“jonah”). + +Podman generates a UUID for each container, and if no name is assigned to the +container using **--name**, Podman generates a random string name. The name can +be useful as a more human-friendly way to identify containers. This works for +both background and foreground containers. The container's name is also added +to the `/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). + +[//]: # (END included file options/name.container.md) + + +[//]: # (BEGIN included file options/network.md) +#### **--network**=*mode*, **--net** + +Set the network mode for the container. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured, to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.md) + +Invalid if using **--dns**, **--dns-option**, or **--dns-search** with **--network** set to **none** or **container:**_id_. + +If used together with **--pod**, the container joins the pod's network namespace. + + +[//]: # (BEGIN included file options/network-alias.md) +#### **--network-alias**=*alias* + +Add a network-scoped alias for the container, setting the alias for all networks that the container joins. To set a +name only for a specific network, use the alias option as described under the **--network** option. +If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. This option can be specified multiple times. +NOTE: When using CNI a container only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. + +[//]: # (END included file options/network-alias.md) + + +[//]: # (BEGIN included file options/no-healthcheck.md) +#### **--no-healthcheck** + +Disable any defined healthchecks for container. + +[//]: # (END included file options/no-healthcheck.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the container. + +Podman assumes control over the container's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/oom-kill-disable.md) +#### **--oom-kill-disable** + +Whether to disable OOM Killer for the container or not. + +This flag is not supported on cgroups V2 systems. + +[//]: # (END included file options/oom-kill-disable.md) + + +[//]: # (BEGIN included file options/oom-score-adj.md) +#### **--oom-score-adj**=*num* + +Tune the host's OOM preferences for containers (accepts values from **-1000** to **1000**). + +When running in rootless mode, the specified value can't be lower than +the oom_score_adj for the current process. In this case, the +oom-score-adj is clamped to the current process value. + +[//]: # (END included file options/oom-score-adj.md) + + +[//]: # (BEGIN included file options/os.pull.md) +#### **--os**=*OS* + +Override the OS, defaults to hosts, of the image to be pulled. For example, `windows`. +Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. + +[//]: # (END included file options/os.pull.md) + +#### **--passwd** + +Allow Podman to add entries to /etc/passwd and /etc/group when used in conjunction with the --user option. +This is used to override the Podman provided user setup in favor of entrypoint configurations such as libnss-extrausers. + + +[//]: # (BEGIN included file options/passwd-entry.md) +#### **--passwd-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/passwd` file within the container when `--passwd` is used. + +The variables $USERNAME, $UID, $GID, $NAME, $HOME are automatically replaced with their value at runtime. + +[//]: # (END included file options/passwd-entry.md) + + +[//]: # (BEGIN included file options/personality.md) +#### **--personality**=*persona* + +Personality sets the execution domain via Linux personality(2). + +[//]: # (END included file options/personality.md) + + +[//]: # (BEGIN included file options/pid.container.md) +#### **--pid**=*mode* + +Set the PID namespace mode for the container. +The default is to create a private PID namespace for the container. + +- **container:**_id_: join another container's PID namespace; +- **host**: use the host's PID namespace for the container. Note the host mode gives the container full access to local PID and is therefore considered insecure; +- **ns:**_path_: join the specified PID namespace; +- **private**: create a new namespace for the container (default). + +[//]: # (END included file options/pid.container.md) + + +[//]: # (BEGIN included file options/pidfile.md) +#### **--pidfile**=*path* + +When the pidfile location is specified, the container process' PID is written to the pidfile. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +If the pidfile option is not specified, the container process' PID is written to /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile. + +After the container is started, the location for the pidfile can be discovered with the following `podman inspect` command: + + $ podman inspect --format '{{ .PidFile }}' $CID + /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile + +[//]: # (END included file options/pidfile.md) + + +[//]: # (BEGIN included file options/pids-limit.md) +#### **--pids-limit**=*limit* + +Tune the container's pids limit. Set to **-1** to have unlimited pids for the container. The default is **2048** on systems that support "pids" cgroup controller. + +[//]: # (END included file options/pids-limit.md) + + +[//]: # (BEGIN included file options/platform.md) +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with --arch and --os) +The `--platform` option can be used to override the current architecture and operating system. +Unless overridden, subsequent lookups of the same image in the local storage matches this platform, regardless of the host. + +[//]: # (END included file options/platform.md) + + +[//]: # (BEGIN included file options/pod.run.md) +#### **--pod**=*name* + +Run container in an existing pod. Podman makes the pod automatically if the pod name is prefixed with **new:**. +To make a pod with more granular options, use the **podman pod create** command before creating a container. +When a container is run with a pod with an infra-container, the infra-container is started first. + +[//]: # (END included file options/pod.run.md) + + +[//]: # (BEGIN included file options/pod-id-file.container.md) +#### **--pod-id-file**=*file* + +Run container in an existing pod and read the pod's ID from the specified *file*. +When a container is run within a pod which has an infra-container, the infra-container starts first. + +[//]: # (END included file options/pod-id-file.container.md) + + +[//]: # (BEGIN included file options/preserve-fd.md) +#### **--preserve-fd**=*FD1[,FD2,...]* + +Pass down to the process the additional file descriptors specified in the comma separated list. It can be specified multiple times. +This option is only supported with the crun OCI runtime. It might be a security risk to use this option with other OCI runtimes. + +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/preserve-fd.md) + + +[//]: # (BEGIN included file options/preserve-fds.md) +#### **--preserve-fds**=*N* + +Pass down to the process N additional file descriptors (in addition to 0, 1, 2). +The total FDs are 3+N. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/preserve-fds.md) + + +[//]: # (BEGIN included file options/privileged.md) +#### **--privileged** + +Give extended privileges to this container. The default is **false**. + +By default, Podman containers are unprivileged (**=false**) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read-only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. +Due to the disabled security features, the privileged field should almost never +be set as containers can easily break out of confinement. + +Containers running in a user namespace (e.g., rootless containers) cannot have +more privileges than the user that launched them. + +[//]: # (END included file options/privileged.md) + + +[//]: # (BEGIN included file options/publish.md) +#### **--publish**, **-p**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Publish a container's port, or range of ports, to the host. + +Both *hostPort* and *containerPort* can be specified as a range of ports. +When specifying ranges for both, the number of container ports in the +range must match the number of host ports in the range. + +If host IP is set to 0.0.0.0 or not set at all, the port is bound on all IPs on the host. + +By default, Podman publishes TCP ports. To publish a UDP port instead, give +`udp` as protocol. To publish both TCP and UDP ports, set `--publish` twice, +with `tcp`, and `udp` as protocols respectively. Rootful containers can also +publish ports using the `sctp` protocol. + +Host port does not have to be specified (e.g. `podman run -p 127.0.0.1::80`). +If it is not, the container port is randomly assigned a port on the host. + +Use **podman port** to see the actual mapping: `podman port $CONTAINER $CONTAINERPORT`. + +Note that the network drivers `macvlan` and `ipvlan` do not support port forwarding, +it will have no effect on these networks. + +[//]: # (END included file options/publish.md) + +**Note:** If a container runs within a pod, it is not necessary to publish the port for +the containers in the pod. The port must only be published by the pod itself. Pod network +stacks act like the network stack on the host - meaning a variety of containers in the pod +and programs in the container all share a single interface, IP address, and +associated ports. If one container binds to a port, no other container can use that port +within the pod while it is in use. Containers in the pod can also communicate over localhost +by having one container bind to localhost in the pod, and another connect to that port. + + +[//]: # (BEGIN included file options/publish-all.md) +#### **--publish-all**, **-P** + +Publish all exposed ports to random ports on the host interfaces. The default is **false**. + +When set to **true**, publish all exposed ports to the host interfaces. +If the operator uses **-P** (or **-p**) then Podman makes the +exposed port accessible on the host and the ports are available to any +client that can reach the host. + +When using this option, Podman binds any exposed port to a random port on the host +within an ephemeral port range defined by */proc/sys/net/ipv4/ip_local_port_range*. +To find the mapping between the host ports and the exposed ports, use **podman port**. + +[//]: # (END included file options/publish-all.md) + + +[//]: # (BEGIN included file options/pull.md) +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Pull the image only when the image is not in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error if no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. + +[//]: # (END included file options/pull.md) + +#### **--quiet**, **-q** + +Suppress output information when pulling images + + +[//]: # (BEGIN included file options/rdt-class.md) +#### **--rdt-class**=*intel-rdt-class-of-service* + +Rdt-class sets the class of service (CLOS or COS) for the container to run in. Based on the Cache Allocation Technology (CAT) feature that is part of Intel's Resource Director Technology (RDT) feature set, all container processes will run within the pre-configured COS, representing a part of the cache. The COS has to be created and configured using a pseudo file system (usually mounted at `/sys/fs/resctrl`) that the resctrl kernel driver provides. Assigning the container to a COS requires root privileges and thus doesn't work in a rootless environment. Currently, the feature is only supported using `runc` as a runtime. See for more details on creating a COS before a container can be assigned to it. + +[//]: # (END included file options/rdt-class.md) + + +[//]: # (BEGIN included file options/read-only.md) +#### **--read-only** + +Mount the container's root filesystem as read-only. + +By default, container root filesystems are writable, allowing processes +to write files anywhere. By specifying the **--read-only** flag, the containers root filesystem are mounted read-only prohibiting any writes. + +[//]: # (END included file options/read-only.md) + + +[//]: # (BEGIN included file options/read-only-tmpfs.md) +#### **--read-only-tmpfs** + +When running --read-only containers, mount a read-write tmpfs on _/dev_, _/dev/shm_, _/run_, _/tmp_, and _/var/tmp_. The default is **true**. + +| --read-only | --read-only-tmpfs | / | /run, /tmp, /var/tmp| +| ----------- | ----------------- | ---- | ----------------------------------- | +| true | true | r/o | r/w | +| true | false | r/o | r/o | +| false | false | r/w | r/w | +| false | true | r/w | r/w | + +When **--read-only=true** and **--read-only-tmpfs=true** additional tmpfs are mounted on +the /tmp, /run, and /var/tmp directories. + +When **--read-only=true** and **--read-only-tmpfs=false** /dev and /dev/shm are marked +Read/Only and no tmpfs are mounted on /tmp, /run and /var/tmp. The directories +are exposed from the underlying image, meaning they are read-only by default. +This makes the container totally read-only. No writable directories exist within +the container. In this mode writable directories need to be added via external +volumes or mounts. + +By default, when **--read-only=false**, the /dev and /dev/shm are read/write, and the /tmp, /run, and /var/tmp are read/write directories from the container image. + +[//]: # (END included file options/read-only-tmpfs.md) + + +[//]: # (BEGIN included file options/replace.md) +#### **--replace** + +If another container with the same name already exists, replace and remove it. The default is **false**. + +[//]: # (END included file options/replace.md) + + +[//]: # (BEGIN included file options/requires.md) +#### **--requires**=*container* + +Specify one or more requirements. +A requirement is a dependency container that is started before this container. +Containers can be specified by name or ID, with multiple containers being separated by commas. + +[//]: # (END included file options/requires.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + +#### **--rm** + +Automatically remove the container and any anonymous unnamed volume associated with +the container when it exits. The default is **false**. + +#### **--rmi** + +After exit of the container, remove the image unless another +container is using it. Implies --rm on the new container. The default is *false*. + + +[//]: # (BEGIN included file options/rootfs.md) +#### **--rootfs** + +If specified, the first argument refers to an exploded container on the file system. + +This is useful to run a container without requiring any image management, the rootfs +of the container is assumed to be managed externally. + + `Overlay Rootfs Mounts` + + The `\:O` flag tells Podman to mount the directory from the rootfs path as +storage using the `overlay file system`. The container processes +can modify content within the mount point which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +Note: On **SELinux** systems, the rootfs needs the correct label, which is by default +**unconfined_u\:object_r\:container_file_t\:s0**. + + `idmap` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. +The idmap option supports a custom mapping that can be different than the user +namespace used by the container. The mapping can be specified after the idmap +option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the +first value is the start of the backing file system IDs that are mapped to the +second value on the host. The length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/rootfs.md) + + +[//]: # (BEGIN included file options/sdnotify.md) +#### **--sdnotify**=**container** | *conmon* | *healthy* | *ignore* + +Determines how to use the NOTIFY_SOCKET, as passed with systemd and Type=notify. + +Default is **container**, which means allow the OCI runtime to proxy the socket into the +container to receive ready notification. Podman sets the MAINPID to conmon's pid. +The **conmon** option sets MAINPID to conmon's pid, and sends READY when the container +has started. The socket is never passed to the runtime or the container. +The **healthy** option sets MAINPID to conmon's pid, and sends READY when the container +has turned healthy; requires a healthcheck to be set. The socket is never passed to the runtime or the container. +The **ignore** option removes NOTIFY_SOCKET from the environment for itself and child processes, +for the case where some other process above Podman uses NOTIFY_SOCKET and Podman does not use it. + +[//]: # (END included file options/sdnotify.md) + + +[//]: # (BEGIN included file options/seccomp-policy.md) +#### **--seccomp-policy**=*policy* + +Specify the policy to select the seccomp profile. If set to *image*, Podman looks for a "io.containers.seccomp.profile" label in the container-image config and use its value as a seccomp profile. Otherwise, Podman follows the *default* policy by applying the default profile unless specified otherwise via *--security-opt seccomp* as described below. + +Note that this feature is experimental and may change in the future. + +[//]: # (END included file options/seccomp-policy.md) + + +[//]: # (BEGIN included file options/secret.md) +#### **--secret**=*secret[,opt=opt ...]* + +Give the container access to a secret. Can be specified multiple times. + +A secret is a blob of sensitive data which a container needs at runtime but +is not stored in the image or in source control, such as usernames and passwords, +TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 500 kb in size). + +When secrets are specified as type `mount`, the secrets are copied and mounted into the container when a container is created. +When secrets are specified as type `env`, the secret is set as an environment variable within the container. +Secrets are written in the container at the time of container creation, and modifying the secret using `podman secret` commands +after the container is created affects the secret inside the container. + +Secrets and its storage are managed using the `podman secret` command. + +Secret Options + +- `type=mount|env` : How the secret is exposed to the container. + `mount` mounts the secret into the container as a file. + `env` exposes the secret as an environment variable. + Defaults to `mount`. +- `target=target` : Target of secret. + For mounted secrets, this is the path to the secret inside the container. + If a fully qualified path is provided, the secret is mounted at that location. + Otherwise, the secret is mounted to + `/run/secrets/target` for linux containers or + `/var/run/secrets/target` for freebsd containers. + If the target is not set, the secret is mounted to `/run/secrets/secretname` by default. + For env secrets, this is the environment variable key. Defaults to `secretname`. +- `uid=0` : UID of secret. Defaults to 0. Mount secret type only. +- `gid=0` : GID of secret. Defaults to 0. Mount secret type only. +- `mode=0` : Mode of secret. Defaults to 0444. Mount secret type only. + + +Examples + +Mount at `/my/location/mysecret` with UID 1: +``` +--secret mysecret,target=/my/location/mysecret,uid=1 +``` + +Mount at `/run/secrets/customtarget` with mode 0777: +``` +--secret mysecret,target=customtarget,mode=0777 +``` + +Create a secret environment variable called `ENVSEC`: +``` +--secret mysecret,type=env,target=ENVSEC +``` + +[//]: # (END included file options/secret.md) + + +[//]: # (BEGIN included file options/security-opt.md) +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the container +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the container + +- **label=user:**_USER_: Set the label user for the container processes +- **label=role:**_ROLE_: Set the label role for the container processes +- **label=type:**_TYPE_: Set the label process type for the container processes +- **label=level:**_LEVEL_: Set the label level for the container processes +- **label=filetype:**_TYPE_: Set the label file type for the container files +- **label=disable**: Turn off label separation for the container + +Note: Labeling can be disabled for all containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the container. + +- **no-new-privileges**: Disable container processes from gaining additional privileges. + +- **seccomp=unconfined**: Turn off seccomp confinement for the container. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. + +[//]: # (END included file options/security-opt.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the container. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/shm-size-systemd.md) +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. + +[//]: # (END included file options/shm-size-systemd.md) + + +[//]: # (BEGIN included file options/sig-proxy.md) +#### **--sig-proxy** + +Proxy received signals to the container process. SIGCHLD, SIGURG, SIGSTOP, and SIGKILL are not proxied. + +[//]: # (END included file options/sig-proxy.md) + +The default is **true**. + + +[//]: # (BEGIN included file options/stop-signal.md) +#### **--stop-signal**=*signal* + +Signal to stop a container. Default is **SIGTERM**. + +[//]: # (END included file options/stop-signal.md) + + +[//]: # (BEGIN included file options/stop-timeout.md) +#### **--stop-timeout**=*seconds* + +Timeout to stop a container. Default is **10**. +Remote connections use local containers.conf for defaults. + +[//]: # (END included file options/stop-timeout.md) + + +[//]: # (BEGIN included file options/subgidname.md) +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. + +[//]: # (END included file options/subgidname.md) + + +[//]: # (BEGIN included file options/subuidname.md) +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. + +[//]: # (END included file options/subuidname.md) + + +[//]: # (BEGIN included file options/sysctl.md) +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters at runtime. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: if using the **--ipc=host** option, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: if using the **--network=host** option, the above sysctls are not allowed. + +[//]: # (END included file options/sysctl.md) + + +[//]: # (BEGIN included file options/systemd.md) +#### **--systemd**=*true* | *false* | *always* + +Run container in systemd mode. The default is **true**. + +- **true** enables systemd mode only when the command executed inside the container is *systemd*, */usr/sbin/init*, +*/sbin/init* or */usr/local/sbin/init*. + +- **false** disables systemd mode. + +- **always** enforces the systemd mode to be enabled. + +Running the container in systemd mode causes the following changes: + +* Podman mounts tmpfs file systems on the following directories + * _/run_ + * _/run/lock_ + * _/tmp_ + * _/sys/fs/cgroup/systemd_ (on a cgroup v1 system) + * _/var/lib/journal_ +* Podman sets the default stop signal to **SIGRTMIN+3**. +* Podman sets **container_uuid** environment variable in the container to the +first 32 characters of the container ID. +* Podman does not mount virtual consoles (_/dev/tty\d+_) when running with **--privileged**. +* On cgroup v2, */sys/fs/cgroup* is mounted writeable. + +This allows systemd to run in a confined container without any modifications. + +Note that on **SELinux** systems, systemd attempts to write to the cgroup +file system. Containers writing to the cgroup file system are denied by default. +The **container_manage_cgroup** boolean must be enabled for this to be allowed on an SELinux separated system. +``` +setsebool -P container_manage_cgroup true +``` + +[//]: # (END included file options/systemd.md) + + +[//]: # (BEGIN included file options/timeout.md) +#### **--timeout**=*seconds* + +Maximum time a container is allowed to run before conmon sends it the kill +signal. By default containers run until they exit or are stopped by +`podman stop`. + +[//]: # (END included file options/timeout.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/tmpfs.md) +#### **--tmpfs**=*fs* + +Create a tmpfs mount. + +Mount a temporary filesystem (**tmpfs**) mount into a container, for example: + +``` +$ podman run -d --tmpfs /tmp\:rw,size=787448k,mode=1777 my_image +``` + +This command mounts a **tmpfs** at _/tmp_ within the container. The supported mount +options are the same as the Linux default mount flags. If no options are specified, +the system uses the following options: +**rw,noexec,nosuid,nodev**. + +[//]: # (END included file options/tmpfs.md) + + +[//]: # (BEGIN included file options/tty.md) +#### **--tty**, **-t** + +Allocate a pseudo-TTY. The default is **false**. + +When set to **true**, Podman allocates a pseudo-tty and attach to the standard +input of the container. This can be used, for example, to run a throwaway +interactive shell. + +**NOTE**: The --tty flag prevents redirection of standard output. It combines STDOUT and STDERR, it can insert control characters, and it can hang pipes. This option is only used when run interactively in a terminal. When feeding input to Podman, use -i only, not -it. + +[//]: # (END included file options/tty.md) + +``` +echo "asdf" | podman run --rm -i someimage /bin/cat +``` + + +[//]: # (BEGIN included file options/tz.md) +#### **--tz**=*timezone* + +Set timezone in container. This flag takes area-based timezones, GMT time, as well as `local`, which sets the timezone in the container to match the host machine. See `/usr/share/zoneinfo/` for valid timezones. +Remote connections use local containers.conf for defaults + +[//]: # (END included file options/tz.md) + + +[//]: # (BEGIN included file options/uidmap.container.md) +#### **--uidmap**=*[flags]container_uid\:from_uid[\:amount]* + +Run the container in a new user namespace using the supplied UID mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +The possible values of the optional *flags* are discussed further down on this page. +The *amount* value is optional and assumed to be **1** if not given. + +The *from_uid* value is based upon the user running the command, either rootful or rootless users. + +* rootful user: [*flags*]*container_uid*:*host_uid*[:*amount*] +* rootless user: [*flags*]*container_uid*:*intermediate_uid*[:*amount*] + + `Rootful mappings` + + +When **podman run** is called by a privileged user, the option **--uidmap** +works as a direct mapping between host UIDs and container UIDs. + +host UID -> container UID + +The _amount_ specifies the number of consecutive UIDs that is mapped. +If for example _amount_ is **4** the mapping looks like: + +| host UID | container UID | +| ---------- | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | + + `Rootless mappings` + +When **podman run** is called by an unprivileged user (i.e. running rootless), +the value *from_uid* is interpreted as an "intermediate UID". In the rootless +case, host UIDs are not mapped directly to container UIDs. Instead the mapping +happens over two mapping steps: + +host UID -> intermediate UID -> container UID + +The **--uidmap** option only influences the second mapping step. + +The first mapping step is derived by Podman from the contents of the file +_/etc/subuid_ and the UID of the user calling Podman. + +First mapping step: + +| host UID | intermediate UID | +| -------- | ---------------- | +| UID for Podman user | 0 | +| 1st subordinate UID | 1 | +| 2nd subordinate UID | 2 | +| 3rd subordinate UID | 3 | +| nth subordinate UID | n | + +To be able to use intermediate UIDs greater than zero, the user needs to have +subordinate UIDs configured in _/etc/subuid_. See **subuid**(5). + +The second mapping step is configured with **--uidmap**. + +If for example _amount_ is **5** the second mapping step looks like: + +| intermediate UID | container UID | +| ------------------ | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | +| *from_uid* + 4 | *container_uid* + 4 | + +When running as rootless, Podman uses all the ranges configured in the _/etc/subuid_ file. + +The current user ID is mapped to UID=0 in the rootless user namespace. +Every additional range is added sequentially afterward: + +| host | rootless user namespace | length | +| ------ | ----------------------- | ------ | +| $UID | 0 | 1 | +| 1 | $FIRST_RANGE_ID | $FIRST_RANGE_LENGTH | +| 1+$FIRST_RANGE_LENGTH | $SECOND_RANGE_ID | $SECOND_RANGE_LENGTH| + + `Referencing a host ID from the parent namespace` + +As a rootless user, the given host ID in **--uidmap** or **--gidmap** +is mapped from the *intermediate namespace* generated by Podman. Sometimes +it is desirable to refer directly at the *host namespace*. It is possible +to manually do so, by running `podman unshare cat /proc/self/gid_map`, +finding the desired host id at the second column of the output, and getting +the corresponding intermediate id from the first column. + +Podman can perform all that by preceding the host id in the mapping +with the `@` symbol. For instance, by specifying `--gidmap 100000:@2000:1`, +podman will look up the intermediate id corresponding to host id `2000` and +it will map the found intermediate id to the container id `100000`. The +given host id must have been subordinated (otherwise it would not be mapped +into the intermediate space in the first place). + +If the length is greater than one, for instance with `--gidmap 100000:@2000:2`, +Podman will map host ids `2000` and `2001` to `100000` and `100001`, respectively, +regardless of how the intermediate mapping is defined. + + `Extending previous mappings` + +Some mapping modifications may be cumbersome. For instance, a user +starts with a mapping such as `--gidmap="0:0:65000"`, that needs to be +changed such as the parent id `1000` is mapped to container id `100000` +instead, leaving container id `1` unassigned. The corresponding `--gidmap` +becomes `--gidmap="0:0:1" --gidmap="2:2:65534" --gidmap="100000:1:1"`. + +This notation can be simplified using the `+` flag, that takes care of +breaking previous mappings removing any conflicting assignment with +the given mapping. The flag is given before the container id +as follows: `--gidmap="0:0:65000" --gidmap="+100000:1:1"` + + + Flag | Example | Description +-----------|---------------|------------- + `+` | `+100000:1:1` | Extend the previous mapping + +This notation leads to gaps in the assignment, so it may be convenient to +fill those gaps afterwards: `--gidmap="0:0:65000" --gidmap="+100000:1:1" --gidmap="1:65001:1"` + +One specific use case for this flag is in the context of rootless +users. A rootless user may specify mappings with the `+` flag as +in `--gidmap="+100000:1:1"`. Podman will then "fill the gaps" starting +from zero with all the remaining intermediate ids. This is convenient when +a user wants to map a specific intermediate id to a container id, leaving +the rest of subordinate ids to be mapped by Podman at will. + + `Passing only one of --uidmap or --gidmap` + +Usually, subordinated user and group ids are assigned simultaneously, and +for any user the subordinated user ids match the subordinated group ids. +For convenience, if only one of **--uidmap** or **--gidmap** is given, +podman assumes the mapping refers to both UIDs and GIDs and applies the +given mapping to both. If only one value of the two needs to be changed, +the mappings should include the `u` or the `g` flags to specify that +they only apply to UIDs or GIDs and should not be copied over. + + flag | Example | Description +---------|-----------------|----------------- + `u` | `u20000:2000:1` |The mapping only applies to UIDs + `g` | `g10000:1000:1` |The mapping only applies to GIDs + +For instance given the command + + podman run --gidmap "0:0:1000" --gidmap "g2000:2000:1" + +Since no **--uidmap** is given, the **--gidmap** is copied to **--uidmap**, +giving a command equivalent to + + podman run --gidmap "0:0:1000" --gidmap "2000:2000:1" --uidmap "0:0:1000" + +The `--gidmap "g2000:2000:1"` used the `g` flag and therefore it was +not copied to **--uidmap**. + + `Rootless mapping of additional host GIDs` + +A rootless user may desire to map a specific host group that has already been +subordinated within _/etc/subgid_ without specifying the rest of the mapping. + +This can be done with **--gidmap "+g*container_gid*:@*host_gid*"** + +Where: + +- The host GID is given through the `@` symbol +- The mapping of this GID is not copied over to **--usermap** thanks to the `g` flag. +- The rest of the container IDs will be mapped starting from 0 to n, + with all the remaining subordinated GIDs, thanks to the `+` flag. + +For instance, if a user belongs to the group `2000` and that group is +subordinated to that user (with `usermod --add-subgids 2000-2000 $USER`), +the user can map the group into the container with: **--gidmap=+g100000:@2000**. + +If this mapping is combined with the option, **--group-add=keep-groups**, the +process in the container will belong to group `100000`, and files belonging +to group `2000` in the host will appear as being owned by group `100000` +inside the container. + + podman run --group-add=keep-groups --gidmap="+g100000:@2000" ... + + `No subordinate UIDs` + +Even if a user does not have any subordinate UIDs in _/etc/subuid_, +**--uidmap** can be used to map the normal UID of the user to a +container UID by running `podman run --uidmap $container_uid:0:1 --user $container_uid ...`. + + `Pods` + +The **--uidmap** option cannot be called in conjunction with the **--pod** option as a uidmap cannot be set on the container level when in a pod. + +[//]: # (END included file options/uidmap.container.md) + + +[//]: # (BEGIN included file options/ulimit.md) +#### **--ulimit**=*option* + +Ulimit options. Sets the ulimits values inside of the container. + +--ulimit with a soft and hard limit in the format =[:]. For example: + +$ podman run --ulimit nofile=1024:1024 --rm ubi9 ulimit -n +1024 + +Set -1 for the soft or hard limit to set the limit to the maximum limit of the current +process. In rootful mode this is often unlimited. + + +If nofile and nproc are unset, a default value of 1048576 will be used, unless overridden +in containers.conf(5). However, if the default value exceeds the hard limit for the current +rootless user, the current hard limit will be applied instead. + +Use **host** to copy the current configuration from the host. + +Don't use nproc with the ulimit flag as Linux uses nproc to set the +maximum number of processes available to a user, not to a container. + +Use the --pids-limit option to modify the cgroup control to limit the number +of processes within a container. + +[//]: # (END included file options/ulimit.md) + + +[//]: # (BEGIN included file options/umask.md) +#### **--umask**=*umask* + +Set the umask inside the container. Defaults to `0022`. +Remote connections use local containers.conf for defaults + +[//]: # (END included file options/umask.md) + + +[//]: # (BEGIN included file options/unsetenv.md) +#### **--unsetenv**=*env* + +Unset default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. + +[//]: # (END included file options/unsetenv.md) + + +[//]: # (BEGIN included file options/unsetenv-all.md) +#### **--unsetenv-all** + +Unset all default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. + +[//]: # (END included file options/unsetenv-all.md) + + +[//]: # (BEGIN included file options/user.md) +#### **--user**, **-u**=*user[\:group]* + +Sets the username or UID used and, optionally, the groupname or GID for the specified command. Both *user* and *group* may be symbolic or numeric. + +Without this argument, the command runs as the user specified in the container image. Unless overridden by a `USER` command in the Containerfile or by a value passed to this option, this user generally defaults to root. + +When a user namespace is not in use, the UID and GID used within the container and on the host match. When user namespaces are in use, however, the UID and GID in the container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container by default corresponds to the UID and GID of the user invoking Podman. + +[//]: # (END included file options/user.md) + + +[//]: # (BEGIN included file options/userns.container.md) +#### **--userns**=*mode* + +Set the user namespace mode for the container. + +If `--userns` is not set, the default value is determined as follows. +- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used. +- If the environment variable **PODMAN_USERNS** is set its value is used. +- If `userns` is specified in `containers.conf` this value is used. +- Otherwise, `--userns=host` is assumed. + +`--userns=""` (i.e., an empty string) is an alias for `--userns=host`. + +This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +------------------------|-----------|--------------------- +auto | $UID | nil (Host User UID is not mapped into container.) +host | $UID | 0 (Default User account mapped to root user in container.) +keep-id | $UID | $UID (Map user account to same UID within container.) +keep-id\:uid=200,gid=210 | $UID | 200:210 (Map user account to specified UID, GID value within container.) +nomap | $UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + +**auto**[\:_OPTIONS,..._]: automatically create a unique user namespace. + +* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. + + Example: `containers:2147483647:2147483648`. + +* `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5). + +Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user IDs. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. + +The option `--userns=keep-id` uses all the subuids and subgids of the user. +The option `--userns=nomap` uses all the subuids and subgids of the user except the user's own ID. +Using `--userns=auto` when starting new containers does not work as long as any containers exist that were started with `--userns=nomap` or `--userns=keep-id` without limiting the user namespace size. + + Valid `auto` options: + + - *gidmapping*=_CONTAINER\_GID\:HOST\_GID\:SIZE_: to force a GID mapping to be present in the user namespace. + - *size*=_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates a size for the user namespace. + - *uidmapping*=_CONTAINER\_UID\:HOST\_UID\:SIZE_: to force a UID mapping to be present in the user namespace. + +The host UID and GID in *gidmapping* and *uidmapping* can optionally be prefixed with the `@` symbol. +In this case, podman will look up the intermediate ID corresponding to host ID and it will map the found intermediate ID to the container id. +For details see **--uidmap**. + +**container:**_id_: join the user namespace of the specified container. + +**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user. + +**keep-id**: creates a user namespace where the current user's UID\:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace. + + Valid `keep-id` options: + + - *uid*=UID: override the UID inside the container that is used to map the current user to. + - *gid*=GID: override the GID inside the container that is used to map the current user to. + - *size*=SIZE: override the size of the configured user namespace. It is useful to not saturate all the available IDs. Not supported when running as root. + +**nomap**: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +**ns:**_namespace_: run the container in the given existing user namespace. + +[//]: # (END included file options/userns.container.md) + + +[//]: # (BEGIN included file options/uts.container.md) +#### **--uts**=*mode* + +Set the UTS namespace mode for the container. The following values are supported: + +- **host**: use the host's UTS namespace inside the container. +- **private**: create a new namespace for the container (default). +- **ns:[path]**: run the container in the given existing UTS namespace. +- **container:[container]**: join the UTS namespace of the specified container. + +[//]: # (END included file options/uts.container.md) + + +[//]: # (BEGIN included file options/variant.container.md) +#### **--variant**=*VARIANT* + +Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. + +[//]: # (END included file options/variant.container.md) + + +[//]: # (BEGIN included file options/volume.md) +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the container is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +container. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a container is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the container, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the container. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system +might prevent the processes running inside the container from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the container context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +containers share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label Only the current container can use a private +volume. Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any of one the containers. Relabeling walks +the file system under the volume and changes the label on each file, if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the container. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually change with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the container. +For example if a user wanted to volume mount their entire home directory into a +container, they need to disable SELinux separation. + + $ podman run --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The container processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous container executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the container +to work. + +Do not modify the source directory mounted into the container with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the container are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the container +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +container, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +container. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the container. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the container. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless container fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/volume.md) + +Use the **--group-add keep-groups** option to pass the user's supplementary group access into the container. + + +[//]: # (BEGIN included file options/volumes-from.md) +#### **--volumes-from**=*CONTAINER[\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +container. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target container, then the volume hides +that data on the target. + +[//]: # (END included file options/volumes-from.md) + + +[//]: # (BEGIN included file options/workdir.md) +#### **--workdir**, **-w**=*dir* + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (**/**). +The image developer can set a different default with the WORKDIR instruction. The operator +can override the working directory by using the **-w** option. + +[//]: # (END included file options/workdir.md) + +## Exit Status + +The exit code from **podman run** gives information about why the container +failed to run or why it exited. When **podman run** exits with a non-zero code, +the exit codes follow the **chroot**(1) standard, see below: + + **125** The error is with Podman itself + + $ podman run --foo busybox; echo $? + Error: unknown flag: --foo + 125 + + **126** The _contained command_ cannot be invoked + + $ podman run busybox /etc; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error + 126 + + **127** The _contained command_ cannot be found + + $ podman run busybox foo; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error + 127 + + **Exit code** _contained command_ exit code + + $ podman run busybox /bin/sh -c 'exit 3'; echo $? + 3 + +## EXAMPLES + +### Running container in read-only mode + +During container image development, containers often need to write to the image +content. Installing packages into _/usr_, for example. In production, +applications seldom need to write to the image. Container applications write +to volumes if they need to write to file systems at all. Applications can be +made more secure by running them in read-only mode using the **--read-only** switch. +This protects the container's image from modification. By default read-only +containers can write to temporary data. Podman mounts a tmpfs on _/run_ and +_/tmp_ within the container. + +``` +$ podman run --read-only -i -t fedora /bin/bash +``` + +If the container does not write to any file +system within the container, including tmpfs, set --read-only-tmpfs=false. +``` +$ podman run --read-only --read-only-tmpfs=false --tmpfs /run -i -t fedora /bin/bash +``` + +### Exposing shared libraries inside of container as read-only using a glob + +``` +$ podman run --mount type=glob,src=/usr/lib64/libnvidia\*,ro=true -i -t fedora /bin/bash +``` + +### Exposing log messages from the container to the host's log + +Bind mount the _/dev/log_ directory to have messages that are logged in the container show up in the host's +syslog/journal. + +``` +$ podman run -v /dev/log:/dev/log -i -t fedora /bin/bash +``` + +From inside the container test this by sending a message to the log. + +``` +(bash)# logger "Hello from my container" +``` + +Then exit and check the journal. + +``` +(bash)# exit + +$ journalctl -b | grep Hello +``` + +This lists the message sent to the logger. + +### Attaching to one or more from STDIN, STDOUT, STDERR + +Without specifying the **-a** option, Podman attaches everything (stdin, stdout, stderr). +Override the default by specifying -a (stdin, stdout, stderr), as in: + +``` +$ podman run -a stdin -a stdout -i -t fedora /bin/bash +``` + +### Sharing IPC between containers + +Using **shm_server.c** available here: https://www.cs.cf.ac.uk/Dave/C/node27.html + +Testing **--ipc=host** mode: + +Host shows a shared memory segment with 7 pids attached, happens to be from httpd: + +``` +$ sudo ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +0x01128e25 0 root 600 1000 7 +``` + +Now run a regular container, and it correctly does NOT see the shared memory segment from the host: + +``` +$ podman run -it shm ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +``` + +Run a container with the new **--ipc=host** option, and it now sees the shared memory segment from the host httpd: + +``` +$ podman run -it --ipc=host shm ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +0x01128e25 0 root 600 1000 7 +``` +Testing **--ipc=container:**_id_ mode: + +Start a container with a program to create a shared memory segment: +``` +$ podman run -it shm bash +$ sudo shm/shm_server & +$ sudo ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +0x0000162e 0 root 666 27 1 +``` +Create a 2nd container correctly shows no shared memory segment from 1st container: +``` +$ podman run shm ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +``` + +Create a 3rd container using the **--ipc=container:**_id_ option, now it shows the shared memory segment from the first: + +``` +$ podman run -it --ipc=container\:ed735b2264ac shm ipcs -m +$ sudo ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +0x0000162e 0 root 666 27 1 +``` + +### Mapping Ports for External Usage + +The exposed port of an application can be mapped to a host port using the **-p** +flag. For example, an httpd port 80 can be mapped to the host port 8080 using the +following: + +``` +$ podman run -p 8080:80 -d -i -t fedora/httpd +``` + +### Mounting External Volumes + +To mount a host directory as a container volume, specify the absolute path to +the directory and the absolute path for the container directory separated by a +colon. If the source is a named volume maintained by Podman, it is recommended to +use its name rather than the path to the volume. Otherwise the volume is +considered an orphan and wiped by the **podman volume prune** command: + +``` +$ podman run -v /var/db:/data1 -i -t fedora bash + +$ podman run -v data:/data2 -i -t fedora bash + +$ podman run -v /var/cache/dnf:/var/cache/dnf\:O -ti fedora dnf -y update +``` + +If the container needs a writeable mounted volume by a non root user inside the container, use the **U** option. This option tells Podman to chown the source volume to match the default UID and GID used within the container. +``` +$ podman run -d -e MARIADB_ROOT_PASSWORD=root --user mysql --userns=keep-id -v ~/data:/var/lib/mysql:Z,U mariadb +``` + +Alternatively if the container needs a writable volume by a non root +user inside of the container, the --userns=keep-id option allows users to +specify the UID and GID of the user executing Podman to specific UIDs and GIDs +within the container. Since the processes running in the container run as the user's UID, they can read/write files owned by the user. +``` +$ podman run -d -e MARIADB_ROOT_PASSWORD=root --user mysql --userns=keep-id\:uid=999,gid=999 -v ~/data:/var/lib/mysql\:Z mariadb +``` + +Using **--mount** flags to mount a host directory as a container folder, specify +the absolute path to the directory or the volume name, and the absolute path +within the container directory: + +```` +$ podman run --mount type=bind,src=/var/db,target=/data1 busybox sh + +$ podman run --mount type=bind,src=volume-name,target=/data1 busybox sh +```` + +When using SELinux, be aware that the host has no knowledge of container SELinux +policy. Therefore, in the above example, if SELinux policy is enforced, the +_/var/db_ directory is not writable to the container. A "Permission Denied" +message occurs, and an **avc:** message is added to the host's syslog. + +To work around this, at time of writing this man page, the following command +needs to be run in order for the proper SELinux policy type label to be attached +to the host directory: + +``` +$ chcon -Rt svirt_sandbox_file_t /var/db +``` + +Now, writing to the _/data1_ volume in the container is allowed and the +changes are reflected on the host in _/var/db_. + +### Using alternative security labeling + +Override the default labeling scheme for each container by specifying +the **--security-opt** flag. For example, specify the MCS/MLS level, a +requirement for MLS systems. Specifying the level in the following command +allows the same content to be shared between containers. + +``` +podman run --security-opt label=level\:s0:c100,c200 -i -t fedora bash +``` + +An MLS example might be: + +``` +$ podman run --security-opt label=level\:TopSecret -i -t rhel7 bash +``` + +To disable the security labeling for this container versus running with the +#### **--permissive** flag, use the following command: + +``` +$ podman run --security-opt label=disable -i -t fedora bash +``` + +Tighten the security policy on the processes within a container by specifying an +alternate type for the container. For example, run a container +that is only allowed to listen on Apache ports by executing the following +command: + +``` +$ podman run --security-opt label=type\:svirt_apache_t -i -t centos bash +``` + +Note that an SELinux policy defining a **svirt_apache_t** type must be written. + +To mask additional specific paths in the container, specify the paths +separated by a colon using the **mask** option with the **--security-opt** +flag. + +``` +$ podman run --security-opt mask=/foo/bar:/second/path fedora bash +``` + +To unmask all the paths that are masked by default, set the **unmask** option to +**ALL**. Or to only unmask specific paths, specify the paths as shown above with +the **mask** option. + +``` +$ podman run --security-opt unmask=ALL fedora bash +``` + +To unmask all the paths that start with /proc, set the **unmask** option to +**/proc/***. + +``` +$ podman run --security-opt unmask=/proc/* fedora bash +``` + +``` +$ podman run --security-opt unmask=/foo/bar:/sys/firmware fedora bash +``` + +### Setting device weight via **--blkio-weight-device** flag. + +``` +$ podman run -it --blkio-weight-device "/dev/sda:200" ubuntu +``` + +### Using a podman container with input from a pipe + +``` +$ echo "asdf" | podman run --rm -i --entrypoint /bin/cat someimage +asdf +``` + +### Setting automatic user namespace separated containers + +``` +# podman run --userns=auto\:size=65536 ubi8-micro cat /proc/self/uid_map +0 2147483647 65536 +# podman run --userns=auto\:size=65536 ubi8-micro cat /proc/self/uid_map +0 2147549183 65536 +``` + +### Setting Namespaced Kernel Parameters (Sysctls) + +The **--sysctl** sets namespaced kernel parameters (sysctls) in the +container. For example, to turn on IP forwarding in the containers +network namespace, run this command: + +``` +$ podman run --sysctl net.ipv4.ip_forward=1 someimage +``` + +Note that not all sysctls are namespaced. Podman does not support changing sysctls +inside of a container that also modify the host system. As the kernel +evolves we expect to see more sysctls become namespaced. + +See the definition of the **--sysctl** option above for the current list of +supported sysctls. + +### Set UID/GID mapping in a new user namespace + +Running a container in a new user namespace requires a mapping of +the UIDs and GIDs from the host. + +``` +$ podman run --uidmap 0:30000:7000 --gidmap 0:30000:7000 fedora echo hello +``` + +### Configuring Storage Options from the command line + +Podman allows for the configuration of storage by changing the values +in the _/etc/container/storage.conf_ or by using global options. This +shows how to set up and use fuse-overlayfs for a one-time run of busybox +using global options. + +``` +podman --log-level=debug --storage-driver overlay --storage-opt "overlay.mount_program=/usr/bin/fuse-overlayfs" run busybox /bin/sh +``` + +### Configure timezone in a container + +``` +$ podman run --tz=local alpine date +$ podman run --tz=Asia/Shanghai alpine date +$ podman run --tz=US/Eastern alpine date +``` + +### Adding dependency containers + +The first container, container1, is not started initially, but must be running before container2 starts. +The `podman run` command starts the container automatically before starting container2. + +``` +$ podman create --name container1 -t -i fedora bash +$ podman run --name container2 --requires container1 -t -i fedora bash +``` + +Multiple containers can be required. + +``` +$ podman create --name container1 -t -i fedora bash +$ podman create --name container2 -t -i fedora bash +$ podman run --name container3 --requires container1,container2 -t -i fedora bash +``` + +### Configure keep supplemental groups for access to volume + +``` +$ podman run -v /var/lib/design:/var/lib/design --group-add keep-groups ubi8 +``` + +### Configure execution domain for containers using personality flag + +``` +$ podman run --name container1 --personality=LINUX32 fedora bash +``` + +### Run a container with external rootfs mounted as an overlay + +``` +$ podman run --name container1 --rootfs /path/to/rootfs:O bash +``` + +### Handling Timezones in java applications in a container. + +In order to use a timezone other than UTC when running a +Java application within a container, the `TZ` environment variable must be +set within the container. Java applications ignores the value set with the +`--tz` option. + +``` +# Example run +podman run -ti --rm -e TZ=EST mytzimage +lrwxrwxrwx. 1 root root 29 Nov 3 08:51 /etc/localtime -> ../usr/share/zoneinfo/Etc/UTC +Now with default timezone: +Fri Nov 19 18:10:55 EST 2021 +Java default sees the following timezone: +2021-11-19T18:10:55.651130-05:00 +Forcing UTC: +Fri Nov 19 23:10:55 UTC 2021 +``` + +### Run a container connected to two networks (called net1 and net2) with a static ip + +``` +$ podman run --network net1\:ip=10.89.1.5 --network net2\:ip=10.89.10.10 alpine ip addr +``` + +### Rootless Containers + +Podman runs as a non-root user on most systems. This feature requires that a new enough version of **shadow-utils** +be installed. The **shadow-utils** package must include the **newuidmap**(1) and **newgidmap**(1) executables. + +In order for users to run rootless, there must be an entry for their username in _/etc/subuid_ and _/etc/subgid_ which lists the UIDs for their user namespace. + +Rootless Podman works better if the fuse-overlayfs and slirp4netns packages are installed. +The **fuse-overlayfs** package provides a userspace overlay storage driver, otherwise users need to use +the **vfs** storage driver, which can be disk space expensive and less +performant than other drivers. + +To enable VPN on the container, slirp4netns or pasta needs to be specified; +without either, containers need to be run with the --network=host flag. + +## ENVIRONMENT + +Environment variables within containers can be set using multiple different options, +in the following order of precedence (later entries override earlier entries): + +- Container image: Any environment variables specified in the container image. +- **--http-proxy**: By default, several environment variables are passed in from the host, such as **http_proxy** and **no_proxy**. See **--http-proxy** for details. +- **--env-host**: Host environment of the process executing Podman is added. +- **--env-file**: Any environment variables specified via env-files. If multiple files are specified, then they override each other in order of entry. +- **--env**: Any environment variables specified overrides previous settings. + +Run containers and set the environment ending with a __*__. +The trailing __*__ glob functionality is only active when no value is specified: + +``` +$ export ENV1=a +$ podman run --env 'ENV*' alpine env | grep ENV +ENV1=a +$ podman run --env 'ENV*=b' alpine env | grep ENV +ENV*=b +``` + +## CONMON + +When Podman starts a container it actually executes the conmon program, which +then executes the OCI Runtime. Conmon is the container monitor. It is a small +program whose job is to watch the primary process of the container, and if the +container dies, save the exit code. It also holds open the tty of the +container, so that it can be attached to later. This is what allows Podman to +run in detached mode (backgrounded), so Podman can exit but conmon continues to +run. Each container has their own instance of conmon. Conmon waits for the +container to exit, gathers and saves the exit code, and then launches a Podman +process to complete the container cleanup, by shutting down the network and +storage. For more information about conmon, see the conmon(8) man +page. + +## FILES + +**/etc/subuid** + +**/etc/subgid** + +NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-save(1)](podman-save.1.md)**, **[podman-ps(1)](podman-ps.1.md)**, **[podman-attach(1)](podman-attach.1.md)**, **[podman-pod-create(1)](podman-pod-create.1.md)**, **[podman-port(1)](podman-port.1.md)**, **[podman-start(1)](podman-start.1.md)**, **[podman-kill(1)](podman-kill.1.md)**, **[podman-stop(1)](podman-stop.1.md)**, **[podman-generate-systemd(1)](podman-generate-systemd.1.md)**, **[podman-rm(1)](podman-rm.1.md)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)**, **[setsebool(8)](https://man7.org/linux/man-pages/man8/setsebool.8.html)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, **[pasta(1)](https://passt.top/builds/latest/web/passt.1.html)**, **[fuse-overlayfs(1)](https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md)**, **proc(5)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)**, **personality(2)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +See [podman-rootless(7)](https://github.com/containers/podman/blob/main/rootless.md) +for rootless issues. + +## HISTORY +September 2018, updated by Kunal Kushwaha `` + +October 2017, converted from Docker documentation to Podman by Dan Walsh for Podman `` + +November 2015, updated by Sally O'Malley `` + +June 2014, updated by Sven Dowideit `` + +April 2014, Originally compiled by William Henry `` based on docker.com source material and internal work. + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a core value of open source. The `master` and `slave` mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately. diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-save.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-save.1.md new file mode 100644 index 000000000..e386337b1 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-save.1.md @@ -0,0 +1,107 @@ +--- +title: podman-save +version: v5.4.2 +--- + +% podman-save 1 + +## NAME +podman\-save - Save image(s) to an archive + +## SYNOPSIS +**podman save** [*options*] *name*[:*tag*] + +**podman image save** [*options*] *name*[:*tag*] + +## DESCRIPTION +**podman save** saves an image to a local file or directory. +**podman save** writes to STDOUT by default and can be redirected to a +file using the **output** flag. The **quiet** flag suppresses the output when set. +**podman save** saves parent layers of the image(s) and the image(s) can be loaded using **podman load**. +To export the containers, use the **podman export**. +Note: `:` is a restricted character and cannot be part of the file name. + +**podman [GLOBAL OPTIONS]** + +**podman save [GLOBAL OPTIONS]** + +**podman save [OPTIONS] NAME[\:TAG]** + +## OPTIONS + + +[//]: # (BEGIN included file options/dir-compress.md) +#### **--compress** + +Compress tarball image layers when pushing to a directory using the 'dir' transport. (default is same compression type, compressed or uncompressed, as source) + +[//]: # (END included file options/dir-compress.md) + +Note: This flag can only be set with **--format=docker-dir**. + +#### **--format**=*format* + +An image format to produce, one of: + +| Format | Description | +| ------------------ | ---------------------------------------------------------------------------- | +| **docker-archive** | A tar archive interoperable with **docker load(1)** (the default) | +| **oci-archive** | A tar archive using the OCI Image Format | +| **oci-dir** | A directory using the OCI Image Format | +| **docker-dir** | **dir** transport (see **containers-transports(5)**) with v2s2 manifest type | + +#### **--help**, **-h** + +Print usage statement + +#### **--multi-image-archive**, **-m** + +Allow for creating archives with more than one image. Additional names are interpreted as images instead of tags. Only supported for **--format=docker-archive**. +The default for this option can be modified via the `multi_image_archive="true"|"false"` flag in containers.conf. + +#### **--output**, **-o**=*file* + +Write to a file, default is STDOUT + +#### **--quiet**, **-q** + +Suppress the output + +#### **--uncompressed** + +Accept uncompressed layers when using one of the OCI formats. + +## EXAMPLES + +Save image to a local file without displaying progress. +``` +$ podman save --quiet -o alpine.tar alpine:2.6 +``` + +Save image to stdout and redirect content via shell. +``` +$ podman save alpine > alpine-all.tar +``` + +Save image in oci-archive format to the local file. +``` +$ podman save -o oci-alpine.tar --format oci-archive alpine +``` + +Save image compressed in docker-dir format. +``` +$ podman save --compress --format docker-dir -o alp-dir alpine +Getting image source signatures +Copying blob sha256:2fdfe1cd78c20d05774f0919be19bc1a3e4729bce219968e4188e7e0f1af679d + 1.97 MB / 1.97 MB [========================================================] 0s +Copying config sha256:501d1a8f0487e93128df34ea349795bc324d5e0c0d5112e08386a9dfaff620be + 584 B / 584 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-load(1)](podman-load.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** + +## HISTORY +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-search.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-search.1.md new file mode 100644 index 000000000..69d5f1013 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-search.1.md @@ -0,0 +1,191 @@ +--- +title: podman-search +version: v5.4.2 +--- + +% podman-search 1 + +## NAME +podman\-search - Search a registry for an image + +## SYNOPSIS +**podman search** [*options*] *term* + +## DESCRIPTION +**podman search** searches a registry or a list of registries for a matching image. +The user can specify which registry to search by prefixing the registry in the search term +(e.g., **registry.fedoraproject.org/fedora**). By default, all +unqualified-search registries in `containers-registries.conf(5)` are used. + +The default number of results is 25. The number of results can be limited using the **--limit** flag. +If more than one registry is being searched, the limit is applied to each registry. The output can be filtered +using the **--filter** flag. To get all available images in a registry without a specific +search term, the user can just enter the registry name with a trailing "/" (example **registry.fedoraproject.org/**). + +Note that **podman search** is not a reliable way to determine the presence or existence of an image. +The search behavior of the v1 and v2 Docker distribution API is specific to the implementation of each registry. +Some registries may not support searching at all. +Further note that searching without a search term only works for registries that implement the v2 API. + +**podman [GLOBAL OPTIONS]** + +**podman search [GLOBAL OPTIONS]** + +**podman search [OPTIONS] TERM** + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + +#### **--compatible** + +After the name and the description, also show the stars, official and automated descriptors as Docker does. +Podman does not show these descriptors by default since they are not supported by most public container registries. + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + +#### **--filter**, **-f**=*filter* + +Filter output based on conditions provided (default []) + +Supported filters are: + +* stars (int) - minimum number of stars required for images to show +* is-automated (boolean - true | false) - is the image automated or not +* is-official (boolean - true | false) - is the image official or not + +#### **--format**=*format* + +Change the output format to a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| --------------- | ---------------------------- | +| .Automated | "[OK]" if image is automated | +| .Description | Image description | +| .Index | Registry | +| .Name | Image name | +| .Official | "[OK]" if image is official | +| .Stars | Star count of image | +| .Tag | Repository tag | + +Note: use .Tag only if the --list-tags is set. + +#### **--help**, **-h** + +Print usage statement + +#### **--limit**=*limit* + +Limit the number of results (default 25). +Note: The results from each registry is limited to this value. +Example if limit is 10 and two registries are being searched, the total +number of results is 20, 10 from each (if there are at least 10 matches in each). +The order of the search results is the order in which the API endpoint returns the results. + +#### **--list-tags** + +List the available tags in the repository for the specified image. +**Note:** --list-tags requires the search term to be a fully specified image name. +The result contains the Image name and its tag, one line for every tag associated with the image. + +#### **--no-trunc** + +Do not truncate the output (default *false*). + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Search for images containing the specified name, returning the first three images from each defined registry. +``` +$ podman search --limit 3 fedora +NAME DESCRIPTION +NAME DESCRIPTION +registry.fedoraproject.org/f29/fedora-toolbox +registry.fedoraproject.org/f30/fedora-toolbox +registry.fedoraproject.org/f31/fedora-toolbox +docker.io/library/fedora Official Docker builds of Fedora +docker.io/kasmweb/fedora-37-desktop Fedora 37 desktop for Kasm Workspaces +docker.io/kasmweb/fedora-38-desktop Fedora 38 desktop for Kasm Workspaces +quay.io/fedora/fedora +quay.io/containerdisks/fedora # Fedora Containerdisk Images diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-secret-create.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-secret-create.1.md new file mode 100644 index 000000000..71f37bfd7 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-secret-create.1.md @@ -0,0 +1,112 @@ +--- +title: podman-secret-create +version: v5.4.2 +--- + +% podman-secret-create 1 + +## NAME +podman\-secret\-create - Create a new secret + +## SYNOPSIS +**podman secret create** [*options*] *name* *file|-* + +## DESCRIPTION + +Creates a secret using standard input or from a file for the secret content. + +Create accepts a path to a file, or `-`, which tells podman to read the secret from stdin + +A secret is a blob of sensitive data which a container needs at runtime but +is not stored in the image or in source control, such as usernames and passwords, +TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 500 kb in size). + +Secrets are not committed to an image with `podman commit`, and does not get committed in the archive created by a `podman export` command. + +Secrets can also be used to store passwords for `podman login` to authenticate against container registries. + +## OPTIONS + +#### **--driver**, **-d**=*driver* + +Specify the secret driver (default **file**). + +#### **--driver-opts**=*key1=val1,key2=val2* + +Specify driver specific options. + +#### **--env**=*false* + +Read secret data from environment variable. + +#### **--help** + +Print usage statement. + +#### **--label**, **-l**=*key=val1,key2=val2* + +Add label to secret. These labels can be viewed in podman secrete inspect or ls. + +#### **--replace**=*false* + +If existing secret with the same name already exists, update the secret. +The `--replace` option does not change secrets within existing containers, only newly created containers. + The default is **false**. + +## SECRET DRIVERS + +#### file + +Secret resides in a read-protected file. + +#### pass + +Secret resides in a GPG-encrypted file. + +#### shell + +Secret is managed by custom scripts. An environment variable **SECRET_ID** +is passed to the scripts (except for **list**), and secrets are communicated +via stdin/stdout (where applicable). Driver options **list**, **lookup**, +**store**, and **delete** serve to install the scripts: + +``` +[secrets] +driver = "shell" + +[secrets.opts] +list = +lookup = +store = +delete = +``` + +## EXAMPLES + +Create the specified secret based on local file. +``` +echo -n mysecret > ./secret.txt +$ podman secret create my_secret ./secret.txt +``` + +Create the specified secret via stdin. +``` +$ printf | podman secret create my_secret - +``` + +Create gpg encrypted secret based on local file using the pass driver. +``` +$ podman secret create --driver=pass my_secret ./secret.txt.gpg +``` + +Create a secret from an environment variable called 'MYSECRET'. +``` +$ podman secret create --env=true my_secret MYSECRET +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)**, **[podman-login(1)](podman-login.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui +February 2024, Added example showing secret creation from an environment variable by Brett Calliss diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-secret-exists.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-secret-exists.1.md new file mode 100644 index 000000000..4bbcfaafe --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-secret-exists.1.md @@ -0,0 +1,48 @@ +--- +title: podman-secret-exists +version: v5.4.2 +--- + +% podman-secret-exists 1 + +## NAME +podman\-secret\-exists - Check if the given secret exists + +## SYNOPSIS +**podman secret exists** *secret* + +## DESCRIPTION +**podman secret exists** checks if a secret exists. Podman returns an exit code +of `0` when the secret is found. A `1` is returned otherwise. An exit code of +`125` indicates there was another issue. + + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLE + +Check if a secret called `mysecret` exists (the secret does actually exist). +``` +$ podman secret exists mysecret +$ echo $? +0 +$ +``` + +Check if a secret called `mypassword` exists (the secret does not actually exist). +``` +$ podman secret exists mypassword +$ echo $? +1 +$ +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)** + +## HISTORY +April 2023, Originally compiled by Ygal Blum `` diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-secret-inspect.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-secret-inspect.1.md new file mode 100644 index 000000000..a736054bb --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-secret-inspect.1.md @@ -0,0 +1,73 @@ +--- +title: podman-secret-inspect +version: v5.4.2 +--- + +% podman-secret-inspect 1 + +## NAME +podman\-secret\-inspect - Display detailed information on one or more secrets + +## SYNOPSIS +**podman secret inspect** [*options*] *secret* [...] + +## DESCRIPTION + +Inspects the specified secret. + +By default, this renders all results in a JSON array. If a format is specified, the given template is executed for each result. +Secrets can be queried individually by providing their full name or a unique partial name. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Format secret output using Go template. + +| **Placeholder** | **Description** | +|--------------------------|-------------------------------------------------------------------| +| .CreatedAt ... | When secret was created (relative timestamp, human-readable) | +| .ID | ID of secret | +| .SecretData | Secret Data (Displayed only with --showsecret option) | +| .Spec ... | Details of secret | +| .Spec.Driver ... | Driver info | +| .Spec.Driver.Name | Driver name (string) | +| .Spec.Driver.Options ... | Driver options (map of driver-specific options) | +| .Spec.Labels ... | Labels for this secret | +| .Spec.Name | Name of secret | +| .UpdatedAt ... | When secret was last updated (relative timestamp, human-readable) | + +#### **--help** + +Print usage statement. + +#### **--pretty** + +Print inspect output in human-readable format + +#### **--showsecret** + +Display secret data + +## EXAMPLES + +Inspect the secret mysecret. +``` +$ podman secret inspect mysecret +``` + +Inspect the secret mysecret and display the Name and Labels field. +``` +$ podman secret inspect --format "{{.Spec.Name}} {{.Spec.Labels}}" mysecret +``` + +Inspect the secret mysecret and display the Name and SecretData fields. Note this will display the secret data to the screen. +``` +$ podman secret inspect --showsecret --format "{{.Spec.Name}} {{.SecretData}}" mysecret +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-secret-ls.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-secret-ls.1.md new file mode 100644 index 000000000..41e145863 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-secret-ls.1.md @@ -0,0 +1,84 @@ +--- +title: podman-secret-ls +version: v5.4.2 +--- + +% podman-secret-ls 1 + +## NAME +podman\-secret\-ls - List all available secrets + +## SYNOPSIS +**podman secret ls** [*options*] + +## DESCRIPTION + +Lists all the secrets that exist. The output can be formatted to a Go template using the **--format** option. + +## OPTIONS + +#### **--filter**, **-f**=*filter=value* + +Filter output based on conditions given. +Multiple filters can be given with multiple uses of the --filter option. + +Valid filters are listed below: + +| **Filter** | **Description** | +| ---------- | ----------------------------------------------------------------- | +| name | [Name] Secret name (accepts regex) | +| id | [ID] Full or partial secret ID | + +#### **--format**=*format* + +Format secret output using Go template. + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------------ | ----------------------------------------------------------------- | +| .CreatedAt ... | When secret was created (relative timestamp, human-readable) | +| .ID | ID of secret | +| .SecretData | Secret Data (Displayed only with --showsecret option) | +| .Spec ... | Details of secret | +| .Spec.Driver ... | Driver info | +| .Spec.Driver.Name | Driver name (string) | +| .Spec.Driver.Options ... | Driver options (map of driver-specific options) | +| .Spec.Labels ... | Labels for this secret | +| .Spec.Name | Name of secret | +| .UpdatedAt ... | When secret was last updated (relative timestamp, human-readable) | + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Print secret IDs only. + +## EXAMPLES + +List all secrets. +``` +$ podman secret ls +``` + +List the name field of all secrets. +``` +$ podman secret ls --format "{{.Name}}" +``` + +List all secrets whose name includes the specified string. +``` +$ podman secret ls --filter name=confidential +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-secret-rm.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-secret-rm.1.md new file mode 100644 index 000000000..ec164ab17 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-secret-rm.1.md @@ -0,0 +1,48 @@ +--- +title: podman-secret-rm +version: v5.4.2 +--- + +% podman-secret-rm 1 + +## NAME +podman\-secret\-rm - Remove one or more secrets + +## SYNOPSIS +**podman secret rm** [*options*] *secret* [...] + +## DESCRIPTION + +Removes one or more secrets. + +`podman secret rm` is safe to use on secrets that are in use by a container. +The created container has access to the secret data because secrets are +copied and mounted into the container when a container is created. If a secret is deleted and +another secret is created with the same name, the secret inside the container does not change; +the old secret value still remains. + +## OPTIONS + +#### **--all**, **-a** + +Remove all existing secrets. + +#### **--help** + +Print usage statement. + +#### **--ignore**, **-i** +Ignore errors when specified secrets are not present. + +## EXAMPLES + +Remove secrets mysecret1 and mysecret2. +``` +$ podman secret rm mysecret1 mysecret2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-secret.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-secret.1.md new file mode 100644 index 000000000..c2a63ff17 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-secret.1.md @@ -0,0 +1,31 @@ +--- +title: podman-secret +version: v5.4.2 +--- + +% podman-secret 1 + +## NAME +podman\-secret - Manage podman secrets + +## SYNOPSIS +**podman secret** *subcommand* + +## DESCRIPTION +podman secret is a set of subcommands that manage secrets. + +## SUBCOMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------------ | ------------------------------------------------------ | +| create | [podman-secret-create(1)](podman-secret-create.1.md) | Create a new secret | +| exists | [podman-secret-exists(1)](podman-secret-exists.1.md) | Check if the given secret exists | +| inspect | [podman-secret-inspect(1)](podman-secret-inspect.1.md) | Display detailed information on one or more secrets | +| ls | [podman-secret-ls(1)](podman-secret-ls.1.md) | List all available secrets | +| rm | [podman-secret-rm(1)](podman-secret-rm.1.md) | Remove one or more secrets | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-start.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-start.1.md new file mode 100644 index 000000000..beaaaac21 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-start.1.md @@ -0,0 +1,127 @@ +--- +title: podman-start +version: v5.4.2 +--- + +% podman-start 1 + +## NAME +podman\-start - Start one or more containers + +## SYNOPSIS +**podman start** [*options*] *container* ... + +**podman container start** [*options*] *container* ... + +## DESCRIPTION +Start one or more containers using container IDs or names as input. The *attach* and *interactive* +options cannot be used to override the *--tty* and *--interactive* options from when the container +was created. Starting an already running container with the *--attach* option, Podman simply +attaches to the container. + +## OPTIONS + +#### **--all** + +Start all the containers, default is only running containers. + +#### **--attach**, **-a** + +Attach container's STDOUT and STDERR. The default is false. This option cannot be used when +starting multiple containers. + + +[//]: # (BEGIN included file options/detach-keys.md) +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. + +[//]: # (END included file options/detach-keys.md) + +#### **--filter**, **-f** + +Filter what containers are going to be started from the given arguments. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | + + +[//]: # (BEGIN included file options/interactive.md) +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. + +[//]: # (END included file options/interactive.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/sig-proxy.md) +#### **--sig-proxy** + +Proxy received signals to the container process. SIGCHLD, SIGURG, SIGSTOP, and SIGKILL are not proxied. + +[//]: # (END included file options/sig-proxy.md) + +The default is **true** when attaching, **false** otherwise. + +## EXAMPLE + +Start specified container: +``` +podman start mywebserver +``` + +Start multiple containers: +``` +podman start 860a4b231279 5421ab43b45 +``` + +Start specified container in interactive mode with terminal attached: +``` +podman start --interactive --attach 860a4b231279 +``` + +Start last created container in interactive mode (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman start -i -l +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +November 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-stats.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-stats.1.md new file mode 100644 index 000000000..215362b70 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-stats.1.md @@ -0,0 +1,164 @@ +--- +title: podman-stats +version: v5.4.2 +--- + +% podman-stats 1 + +## NAME +podman\-stats - Display a live stream of one or more container's resource usage statistics + +## SYNOPSIS +**podman stats** [*options*] [*container*] + +**podman container stats** [*options*] [*container*] + +## DESCRIPTION +Display a live stream of one or more containers' resource usage statistics + +Note: Podman stats does not work in rootless environments that use CGroups V1. +Podman stats relies on CGroup information for statistics, and CGroup v1 is not +supported for rootless use cases. + +Note: Rootless environments that use CGroups V2 are not able to report statistics +about their networking usage. + +## OPTIONS + +#### **--all**, **-a** + +Show all containers. Only running containers are shown by default + +#### **--format**=*template* + +Pretty-print container statistics to JSON or using a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|---------------------|--------------------------------------------------| +| .AvgCPU | Average CPU, full precision float | +| .AVGCPU | Average CPU, formatted as a percent | +| .BlockInput | Total data read from block device | +| .BlockIO | Total data read/total data written to block device| +| .BlockOutput | Total data written to block device | +| .ContainerID | Container ID, full (untruncated) hash | +| .ContainerStats ... | Nested structure, for experts only | +| .CPU | Percent CPU, full precision float | +| .CPUNano | CPU Usage, total, in nanoseconds | +| .CPUPerc | Percentage of CPU used | +| .CPUSystemNano | CPU Usage, kernel, in nanoseconds | +| .Duration | Same as CPUNano | +| .ID | Container ID, truncated | +| .MemLimit | Memory limit, in bytes | +| .MemPerc | Memory percentage used | +| .MemUsage | Memory usage | +| .MemUsageBytes | Memory usage (IEC) | +| .Name | Container Name | +| .NetIO | Network IO | +| .Network ... | Network I/O, separated by network interface | +| .PerCPU | CPU time consumed by all tasks [1] | +| .PIDs | Number of PIDs | +| .PIDS | Number of PIDs (yes, we know this is a dup) | +| .SystemNano | Current system datetime, nanoseconds since epoch | +| .Up | Duration (CPUNano), in human-readable form | +| .UpTime | Same as Up | + +[1] Cgroups V1 only + +When using a Go template, precede the format with `table` to print headers. + +#### **--interval**, **-i**=*seconds* + +Time in seconds between stats reports, defaults to 5 seconds. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/no-reset.md) +#### **--no-reset** + +Do not clear the terminal/screen in between reporting intervals + +[//]: # (END included file options/no-reset.md) + + +[//]: # (BEGIN included file options/no-stream.md) +#### **--no-stream** + +Disable streaming stats and only pull the first result, default setting is false + +[//]: # (END included file options/no-stream.md) + +#### **--no-trunc** + +Do not truncate output + +## EXAMPLE + +List statistics about all running containers without streaming mode: +``` +# podman stats -a --no-stream +ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS +a9f807ffaacd frosty_hodgkin -- 3.092MB / 16.7GB 0.02% -- / -- -- / -- 2 +3b33001239ee sleepy_stallman -- -- / -- -- -- / -- -- / -- -- +``` + +List the specified container's statistics in streaming mode: +``` +# podman stats a9f80 +ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS +a9f807ffaacd frosty_hodgkin -- 3.092MB / 16.7GB 0.02% -- / -- -- / -- 2 +``` + +List the specified statistics about the specified container in table format: +``` +$ podman stats --no-trunc 3667 --format 'table {{ .ID }} {{ .MemUsage }}' +ID MEM USAGE / LIMIT +3667c6aacb06aac2eaffce914c01736420023d56ef9b0f4cfe58b6d6a78b7503 49.15kB / 67.17GB +``` + +List the specified container statistics in JSON format: +``` +# podman stats --no-stream --format=json a9f80 +[ + { + "id": "a9f807ffaacd", + "name": "frosty_hodgkin", + "cpu_percent": "--", + "mem_usage": "3.092MB / 16.7GB", + "mem_percent": "0.02%", + "netio": "-- / --", + "blocki": "-- / --", + "pids": "2" + } +] +``` + +List the specified container statistics in table format: +``` +# podman stats --no-stream --format "table {{.ID}} {{.Name}} {{.MemUsage}}" 6eae +ID NAME MEM USAGE / LIMIT +6eae9e25a564 clever_bassi 3.031MB / 16.7GB +``` + +Note: When using a slirp4netns network with the rootlesskit port +handler, the traffic sent via the port forwarding is accounted to +the `lo` device. Traffic accounted to `lo` is not accounted in the +stats output. + + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +July 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-stop.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-stop.1.md new file mode 100644 index 000000000..16f728b14 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-stop.1.md @@ -0,0 +1,141 @@ +--- +title: podman-stop +version: v5.4.2 +--- + +% podman-stop 1 + +## NAME +podman\-stop - Stop one or more running containers + +## SYNOPSIS +**podman stop** [*options*] *container* ... + +**podman container stop** [*options*] *container* ... + +## DESCRIPTION +Stops one or more containers using container IDs or names as input. The **--time** option +specifies the number of seconds to wait before forcibly stopping the container after the stop command +is issued to the container. The default is 10 seconds. By default, containers are stopped with SIGTERM +and then SIGKILL after the timeout. The SIGTERM default can be overridden by the image used to create the +container and also via command line when creating the container. + +## OPTIONS + +#### **--all**, **-a** + +Stop all running containers. This does not include paused containers. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and stop the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + +Command does not fail when *file* is missing and user specified --ignore. + +#### **--filter**, **-f**=*filter* + +Filter what containers are going to be stopped. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | + + +[//]: # (BEGIN included file options/ignore.md) +#### **--ignore**, **-i** + +Ignore errors when specified containers are not in the container store. A user +might have decided to manually remove a container which leads to a failure +during the ExecStop directive of a systemd service referencing that container. + +[//]: # (END included file options/ignore.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping the container. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +## EXAMPLES + +Stop the specified container via its name. +``` +$ podman stop mywebserver +``` + +Stop the container via its id. +``` +$ podman stop 860a4b235279 +``` + +Stop multiple containers. +``` +$ podman stop mywebserver 860a4b235279 +``` + +Stop the container identified in the cidfile. +``` +$ podman stop --cidfile /home/user/cidfile-1 +``` + +Stop the containers identified in the cidfiles. +``` +$ podman stop --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +Stop the specified container in 2 seconds. +``` +$ podman stop --time 2 860a4b235279 +``` + +Stop all running containers. +``` +$ podman stop -a +``` + +Stop the last created container (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman stop --latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-rm(1)](podman-rm.1.md)** + +## HISTORY +September 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-system-check.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-system-check.1.md new file mode 100644 index 000000000..6f6a24a7f --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-system-check.1.md @@ -0,0 +1,64 @@ +--- +title: podman-system-check +version: v5.4.2 +--- + +% podman-system-check 1 + +## NAME +podman\-system\-check - Perform consistency checks on image and container storage + +## SYNOPSIS +**podman system check** [*options*] + +## DESCRIPTION +Perform consistency checks on image and container storage, reporting images and +containers which have identified issues. + +## OPTIONS + +#### **--force**, **-f** + +When attempting to remove damaged images, also remove containers which depend +on those images. By default, damaged images which are being used by containers +are left alone. + +Containers which depend on damaged images do so regardless of which engine +created them, but because podman only "knows" how to shut down containers that +it started, the effect on still-running containers which were started by other +engines is difficult to predict. + +#### **--max**, **-m**=*duration* + +When considering layers which are not used by any images or containers, assume +that any layers which are more than *duration* old are the results of canceled +attempts to pull images, and should be treated as though they are damaged. + +#### **--quick**, **-q** + +Skip checks which are known to be time-consuming. This will prevent some types +of errors from being detected. + +#### **--repair**, **-r** + +Remove any images which are determined to have been damaged in some way, unless +they are in use by containers. Use **--force** to remove containers which +depend on damaged images, and those damaged images, as well. + +## EXAMPLE + +A reasonably quick check: +``` +podman system check --quick --repair --force +``` + +A more thorough check: +``` +podman system check --repair --max=1h --force +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)** + +## HISTORY +April 2024 diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-system-connection-add.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-system-connection-add.1.md new file mode 100644 index 000000000..e471f9845 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-system-connection-add.1.md @@ -0,0 +1,69 @@ +--- +title: podman-system-connection-add +version: v5.4.2 +--- + +% podman-system-connection-add 1 + +## NAME +podman\-system\-connection\-add - Record destination for the Podman service + +## SYNOPSIS +**podman system connection add** [*options*] *name* *destination* + +## DESCRIPTION +Record ssh destination for remote podman service(s). The ssh destination is given as one of: + - [user@]hostname[:port] + - ssh://[user@]hostname[:port] + - unix://path + - tcp://hostname\\:port + +The user is prompted for the remote ssh login password or key file passphrase as required. The `ssh-agent` is supported if it is running. + +## OPTIONS + +#### **--default**, **-d** + +Make the new destination the default for this user. The default is **false**. + +#### **--identity**=*path* + +Path to ssh identity file. If the identity file has been encrypted, Podman prompts the user for the passphrase. +If no identity file is provided and no user is given, Podman defaults to the user running the podman command. +Podman prompts for the login password on the remote server. + +#### **--port**, **-p**=*port* + +Port for ssh destination. The default value is `22`. + +#### **--socket-path**=*path* + +Path to the Podman service unix domain socket on the ssh destination host + +## EXAMPLE + +Add a named system connection: +``` +$ podman system connection add QA podman.example.com +``` + +Add a system connection using SSH data: +``` +$ podman system connection add --identity ~/.ssh/dev_rsa production ssh://root@server.example.com:2222 +``` + +Add a named system connection to local Unix domain socket: +``` +$ podman system connection add testing unix:///run/podman/podman.sock +``` + +Add a named system connection to local tcp socket: +``` +$ podman system connection add debug tcp://localhost:8080 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + + +## HISTORY +June 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-system-connection-default.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-system-connection-default.1.md new file mode 100644 index 000000000..e5320a4bb --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-system-connection-default.1.md @@ -0,0 +1,27 @@ +--- +title: podman-system-connection-default +version: v5.4.2 +--- + +% podman-system-connection-default 1 + +## NAME +podman\-system\-connection\-default - Set named destination as default for the Podman service + +## SYNOPSIS +**podman system connection default** *name* + +## DESCRIPTION +Set named ssh destination as default destination for the Podman service. + +## EXAMPLE + +Set the specified connection as default: +``` +$ podman system connection default production +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + +## HISTORY +July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-system-connection-list.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-system-connection-list.1.md new file mode 100644 index 000000000..85231a7fc --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-system-connection-list.1.md @@ -0,0 +1,51 @@ +--- +title: podman-system-connection-list +version: v5.4.2 +--- + +% podman-system-connection-list 1 + +## NAME +podman\-system\-connection\-list - List the destination for the Podman service(s) + +## SYNOPSIS +**podman system connection list** [*options*] + +**podman system connection ls** [*options*] + +## DESCRIPTION +List ssh destination(s) for podman service(s). + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change the default output format. This can be of a supported type like 'json' or a Go template. +Valid placeholders for the Go template listed below: + +| **Placeholder** | **Description** | +| --------------- | ----------------------------------------------------------------------------- | +| .Default | Indicates whether connection is the default | +| .Identity | Path to file containing SSH identity | +| .Name | Connection Name/Identifier | +| .ReadWrite | Indicates if this connection can be modified using the system connection commands | +| .URI | URI to podman service. Valid schemes are ssh://[user@]*host*[\:port]*Unix domain socket*[?secure=True], unix://*Unix domain socket*, and tcp://localhost[:*port*] | + +#### **--quiet**, **-q** + +Only show connection names + +## EXAMPLE + +List system connections: +``` +$ podman system connection list +Name URI Identity Default ReadWrite +deva ssh://root@example.com:/run/podman/podman.sock ~/.ssh/id_rsa true true +devb ssh://user@example.com:/run/user/1000/podman/podman.sock ~/.ssh/id_rsa false true +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + +## HISTORY +July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-system-connection-remove.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-system-connection-remove.1.md new file mode 100644 index 000000000..b5937bbbb --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-system-connection-remove.1.md @@ -0,0 +1,33 @@ +--- +title: podman-system-connection-remove +version: v5.4.2 +--- + +% podman-system-connection-remove 1 + +## NAME +podman\-system\-connection\-remove - Delete named destination + +## SYNOPSIS +**podman system connection remove** [*options*] *name* + +## DESCRIPTION +Delete named ssh destination. + +## OPTIONS + +#### **--all**, **-a** + +Remove all connections. + +## EXAMPLE + +Remove the specified system connection: +``` +$ podman system connection remove production +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + +## HISTORY +July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-system-connection-rename.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-system-connection-rename.1.md new file mode 100644 index 000000000..802cafc2e --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-system-connection-rename.1.md @@ -0,0 +1,27 @@ +--- +title: podman-system-connection-rename +version: v5.4.2 +--- + +% podman-system-connection-rename 1 + +## NAME +podman\-system\-connection\-rename - Rename the destination for Podman service + +## SYNOPSIS +**podman system connection rename** *old* *new* + +## DESCRIPTION +Rename ssh destination from *old* to *new*. + +## EXAMPLE + +Rename the specified connection: +``` +$ podman system connection rename laptop devel +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + +## HISTORY +July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-system-connection.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-system-connection.1.md new file mode 100644 index 000000000..97809abf9 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-system-connection.1.md @@ -0,0 +1,52 @@ +--- +title: podman-system-connection +version: v5.4.2 +--- + +% podman-system-connection 1 + +## NAME +podman\-system\-connection - Manage the destination(s) for Podman service(s) + +## SYNOPSIS +**podman system connection** *subcommand* + +## DESCRIPTION +Manage the destination(s) for Podman service(s). + +The user is prompted for the ssh login password or key file passphrase as required. The `ssh-agent` is supported if it is running. + +Podman manages the system connection by writing and reading the `podman-connections.json` file located under +`$XDG_CONFIG_HOME/containers` or if the env is not set it defaults to `$HOME/.config/containers`. +Or the `PODMAN_CONNECTIONS_CONF` environment variable can be set to a full file path which podman +will use instead. +This file is managed by the podman commands and should never be edited by users directly. To manually +configure the connections use `service_destinations` in containers.conf. + +If the ReadWrite column in the **podman system connection list** output is set to true the connection is +stored in the `podman-connections.json` file otherwise it is stored in containers.conf and can therefore +not be edited with the **podman system connection** commands. + +## COMMANDS + +| Command | Man Page | Description | +| -------- | ----------------------------------------------------------------------------- | ---------------------------------------------------------- | +| add | [podman-system-connection\-add(1)](podman-system-connection-add.1.md) | Record destination for the Podman service | +| default | [podman-system-connection\-default(1)](podman-system-connection-default.1.md) | Set named destination as default for the Podman service | +| list | [podman-system-connection\-list(1)](podman-system-connection-list.1.md) | List the destination for the Podman service(s) | +| remove | [podman-system-connection\-remove(1)](podman-system-connection-remove.1.md) | Delete named destination | +| rename | [podman-system-connection\-rename(1)](podman-system-connection-rename.1.md) | Rename the destination for Podman service | + +## EXAMPLE + +List system connections: +``` +$ podman system connection list +Name URI Identity Default ReadWrite +devl ssh://root@example.com/run/podman/podman.sock ~/.ssh/id_rsa true true +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)** + +## HISTORY +June 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-system-df.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-system-df.1.md new file mode 100644 index 000000000..285cb6661 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-system-df.1.md @@ -0,0 +1,80 @@ +--- +title: podman-system-df +version: v5.4.2 +--- + +% podman-system-df 1 + +## NAME +podman\-system\-df - Show podman disk usage + +## SYNOPSIS +**podman system df** [*options*] + +## DESCRIPTION +Show podman disk usage + +## OPTIONS +#### **--format**=*format* + +Pretty-print images using a Go template or JSON. This flag is not allowed in combination with **--verbose** + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------------- | ------------------------------------------------ | +| .Active | Indicates whether volume is in use | +| .RawReclaimable | Raw reclaimable size of each Type | +| .RawSize | Raw size of each type | +| .Reclaimable | Reclaimable size or each type (human-readable) | +| .Size | Size of each type (human-readable) | +| .Total | Total items for each type | +| .Type | Type of data | + + +#### **--verbose**, **-v** +Show detailed information on space usage + +## EXAMPLE + +Show disk usage: +``` +$ podman system df +TYPE TOTAL ACTIVE SIZE RECLAIMABLE +Images 6 2 281MB 168MB (59%) +Containers 3 1 0B 0B (0%) +Local Volumes 1 1 22B 0B (0%) +``` + +Show disk usage in verbose mode: +``` +$ podman system df -v +Images space usage: + +REPOSITORY TAG IMAGE ID CREATED SIZE SHARED SIZE UNIQUE SIZE CONTAINERS +docker.io/library/alpine latest 5cb3aa00f899 2 weeks ago 5.79MB 0B 5.79MB 5 + +Containers space usage: + +CONTAINER ID IMAGE COMMAND LOCAL VOLUMES SIZE CREATED STATUS NAMES +073f7e62812d 5cb3 sleep 100 1 0B 20 hours ago exited zen_joliot +3f19f5bba242 5cb3 sleep 100 0 5.52kB 22 hours ago exited pedantic_archimedes +8cd89bf645cc 5cb3 ls foodir 0 58B 21 hours ago configured agitated_hamilton +a1d948a4b61d 5cb3 ls foodir 0 12B 21 hours ago exited laughing_wing +eafe3e3c5bb3 5cb3 sleep 10000 0 72B 21 hours ago exited priceless_liskov + +Local Volumes space usage: + +VOLUME NAME LINKS SIZE +data 1 0B + +$ podman system df --format "{{.Type}}\t{{.Total}}" +Images 1 +Containers 5 +Local Volumes 1 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)** + +## HISTORY +March 2019, Originally compiled by Qi Wang (qiwan at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-system-migrate.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-system-migrate.1.md new file mode 100644 index 000000000..f918e8408 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-system-migrate.1.md @@ -0,0 +1,44 @@ +--- +title: podman-system-migrate +version: v5.4.2 +--- + +% podman-system-migrate 1 + +## NAME +podman\-system\-migrate - Migrate existing containers to a new podman version + +## SYNOPSIS +**podman system migrate** [*options*] + +## DESCRIPTION +**podman system migrate** migrates containers to the latest podman version. + +**podman system migrate** takes care of migrating existing containers to the latest version of podman if any change is necessary. + +"Rootless Podman uses a pause process to keep the unprivileged +namespaces alive. This prevents any change to the `/etc/subuid` and +`/etc/subgid` files from being propagated to the rootless containers +while the pause process is running. + +For these changes to be propagated, it is necessary to first stop all +running containers associated with the user and to also stop the pause +process and delete its pid file. Instead of doing it manually, `podman +system migrate` can be used to stop both the running containers and the +pause process. The `/etc/subuid` and `/etc/subgid` files can then be +edited or changed with usermod to recreate the user namespace with the +newly configured mappings. + +## OPTIONS + +#### **--new-runtime**=*runtime* + +Set a new OCI runtime for all containers. +This can be used after a system upgrade which changes the default OCI runtime to move all containers to the new runtime. +There are no guarantees that the containers continue to work under the new runtime, as some runtimes support differing options and configurations. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **usermod(8)** + +## HISTORY +April 2019, Originally compiled by Giuseppe Scrivano (gscrivan at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-system-prune.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-system-prune.1.md new file mode 100644 index 000000000..2ac1df5e9 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-system-prune.1.md @@ -0,0 +1,76 @@ +--- +title: podman-system-prune +version: v5.4.2 +--- + +% podman-system-prune 1 + +## NAME +podman\-system\-prune - Remove all unused pods, containers, images, networks, and volume data + +## SYNOPSIS +**podman system prune** [*options*] + +## DESCRIPTION +**podman system prune** removes all unused containers (both dangling and unreferenced), build containers, pods, networks, and optionally, volumes from local storage. + +Use the **--all** option to delete all unused images. Unused images are dangling images as well as any image that does not have any containers based on it. + +By default, volumes are not removed to prevent important data from being deleted if there is currently no container using the volume. Use the **--volumes** flag when running the command to prune volumes as well. + +By default, build containers are not removed to prevent interference with builds in progress. Use the **--build** flag when running the command to remove build containers as well. + +## OPTIONS +#### **--all**, **-a** + +Recursively remove all unused pods, containers, images, networks, and volume data. (Maximum 50 iterations.) + +#### **--build** + +Removes any build containers that were created during the build, but were not removed because the build was unexpectedly terminated. + +Note: **This is not safe operation and should be executed only when no builds are in progress. It can interfere with builds in progress.** + +#### **--external** + +Tries to clean up remainders of previous containers or layers that are not references in the storage json files. These can happen in the case of unclean shutdowns or regular restarts in transient storage mode. + +However, when using transient storage mode, the Podman database does not persist. This means containers leave the writable layers on disk after a reboot. When using a transient store, it is recommended that the **podman system prune --external** command is run during boot. + +This option is incompatible with **--all** and **--filter** and drops the default behaviour of removing unused resources. + +#### **--filter**=*filters* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------:|-----------------------------------------------------------------------------------------------------------------| +| label | Only remove containers and images, with (or without, in the case of label!=[...] is used) the specified labels. | +| until | Only remove containers and images created before given timestamp. | + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes containers and images with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes containers and images without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not prompt for confirmation + +#### **--help**, **-h** + +Print usage statement + +#### **--volumes** + +Prune volumes currently unused by any container + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)** + +## HISTORY +February 2019, Originally compiled by Dan Walsh (dwalsh at redhat dot com) +December 2020, converted filter information from docs.docker.com documentation by Dan Walsh (dwalsh at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-system-renumber.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-system-renumber.1.md new file mode 100644 index 000000000..cc716cdf1 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-system-renumber.1.md @@ -0,0 +1,31 @@ +--- +title: podman-system-renumber +version: v5.4.2 +--- + +% podman-system-renumber 1 + +## NAME +podman\-system\-renumber - Migrate lock numbers to handle a change in maximum number of locks + +## SYNOPSIS +**podman system renumber** + +## DESCRIPTION +**podman system renumber** renumbers locks used by containers and pods. + +Each Podman container and pod is allocated a lock at creation time, up to a maximum number controlled by the **num_locks** parameter in **containers.conf**. + +When all available locks are exhausted, no further containers and pods can be created until some existing containers and pods are removed. This can be avoided by increasing the number of locks available via modifying **containers.conf** and subsequently running **podman system renumber** to prepare the new locks (and reallocate lock numbers to fit the new struct). + +**podman system renumber** must be called after any changes to **num_locks** - failure to do so results in errors starting Podman as the number of locks available conflicts with the configured number of locks. + +**podman system renumber** can also be used to migrate 1.0 and earlier versions of Podman, which used a different locking scheme, to the new locking model. It is not strictly required to do this, but it is highly recommended to do so as deadlocks can occur otherwise. + +If possible, avoid calling **podman system renumber** while there are other Podman processes running. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +## HISTORY +February 2019, Originally compiled by Matt Heon (mheon at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-system-reset.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-system-reset.1.md new file mode 100644 index 000000000..60e008e92 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-system-reset.1.md @@ -0,0 +1,72 @@ +--- +title: podman-system-reset +version: v5.4.2 +--- + +% podman-system-reset 1 + +## NAME +podman\-system\-reset - Reset storage back to initial state + +## SYNOPSIS +**podman system reset** [*options*] + +## DESCRIPTION +**podman system reset** removes all pods, containers, images, networks and volumes, and machines. +It also removes the configured graphRoot and runRoot directories. Make sure these are not set to +some important directory. + +This command must be run **before** changing any of the following fields in the +`containers.conf` or `storage.conf` files: `driver`, `static_dir`, `tmp_dir` +or `volume_path`. + +`podman system reset` reads the current configuration and attempts to remove all +of the relevant configurations. If the administrator modified the configuration files first, +`podman system reset` might not be able to clean up the previous storage. + +## OPTIONS +#### **--force**, **-f** + +Do not prompt for confirmation + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Reset all storage back to a clean initialized state. +``` +$ podman system reset +WARNING! This will remove: + - all containers + - all pods + - all images + - all networks + - all build cache + - all machines + - all volumes + - the graphRoot directory: /var/lib/containers/storage + - the runRoot directory: /run/containers/storage +Are you sure you want to continue? [y/N] y +``` + +### Switching rootless user from VFS driver to overlay with fuse-overlayfs + +If the user ran rootless containers without having the `fuse-overlayfs` program +installed, podman defaults to the `vfs` storage in their home directory. If they +want to switch to use fuse-overlay, they must install the fuse-overlayfs +package. The user needs to reset the storage to use overlayfs by default. +Execute `podman system reset` as the user first to remove the VFS storage. Now +the user can edit the `/etc/containers/storage.conf` to make any changes if +necessary. If the system's default was already `overlay`, then no changes are +necessary to switch to fuse-overlayfs. Podman looks for the existence of +fuse-overlayfs to use it when set in the `overlay` driver, only falling back to vfs +if the program does not exist. Users can run `podman info` to ensure Podman is +using fuse-overlayfs and the overlay driver. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[fuse-overlayfs(1)](https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)** + +## HISTORY +November 2019, Originally compiled by Dan Walsh (dwalsh at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-system-service.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-system-service.1.md new file mode 100644 index 000000000..0443e1a84 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-system-service.1.md @@ -0,0 +1,146 @@ +--- +title: podman-system-service +version: v5.4.2 +--- + +% podman-system-service 1 + +## NAME +podman\-system\-service - Run an API service + +## SYNOPSIS +**podman system service** [*options*] + +## DESCRIPTION +The **podman system service** command creates a listening service that answers API calls for Podman. +The command is available on Linux systems and is usually executed in systemd services. +The command is not available when the Podman command is executed directly on a Windows or macOS +host or in other situations where the Podman command is accessing a remote Podman API service. + +The REST API provided by **podman system service** is split into two parts: a compatibility layer offering support for the Docker v1.40 API, and a Podman-native Libpod layer. +Documentation for the latter is available at *https://docs.podman.io/en/latest/_static/api.html*. +Both APIs are versioned, but the server does not reject requests with an unsupported version set. + +### Run the command in a systemd service + +The command **podman system service** supports systemd socket activation. +When the command is run in a systemd service, the API service can therefore be provided on demand. +If the systemd service is not already running, it will be activated as soon as +a client connects to the listening socket. Systemd then executes the +**podman system service** command. +After some time of inactivity, as defined by the __--time__ option, the command terminates. +Systemd sets the _podman.service_ state as inactive. At this point there is no +**podman system service** process running. No unnecessary compute resources are wasted. +As soon as another client connects, systemd activates the systemd service again. + +The systemd unit files that declares the Podman API service for users are + +* _/usr/lib/systemd/user/podman.service_ +* _/usr/lib/systemd/user/podman.socket_ + +In the file _podman.socket_ the path of the listening Unix socket is defined by + +``` +ListenStream=%t/podman/podman.sock +``` + +The path contains the systemd specifier `%t` which systemd expands to the value of the environment variable +`XDG_RUNTIME_DIR` (see systemd specifiers in the **systemd.unit(5)** man page). + +In addition to the systemd user services, there is also a systemd system service _podman.service_. +It runs rootful Podman and is accessed from the Unix socket _/run/podman/podman.sock_. See the systemd unit files + +* _/usr/lib/systemd/system/podman.service_ +* _/usr/lib/systemd/system/podman.socket_ + +The **podman system service** command does not support more than one listening socket for the API service. + +Note: The default systemd unit files (system and user) change the log-level option to *info* from *error*. This change provides additional information on each API call. + +### Run the command directly + +To support running an API service without using a systemd service, the command also takes an +optional endpoint argument for the API in URI form. For example, *unix:///tmp/foobar.sock* or *tcp://localhost:8080*. +If no endpoint is provided, defaults is used. The default endpoint for a rootful +service is *unix:///run/podman/podman.sock* and rootless is *unix://$XDG_RUNTIME_DIR/podman/podman.sock* (for +example *unix:///run/user/1000/podman/podman.sock*) + +### Access the Unix socket from inside a container + +To access the API service inside a container: +- mount the socket as a volume +- run the container with `--security-opt label=disable` + +### Security + +Please note that the API grants full access to all Podman functionality, and thus allows arbitrary code execution as the user running the API, with no ability to limit or audit this access. +The API's security model is built upon access via a Unix socket with access restricted via standard file permissions, ensuring that only the user running the service will be able to access it. +We *strongly* recommend against making the API socket available via the network (IE, bindings the service to a *tcp* URL). +Even access via Localhost carries risks - anyone with access to the system will be able to access the API. +If remote access is required, we instead recommend forwarding the API socket via SSH, and limiting access on the remote machine to the greatest extent possible. +If a *tcp* URL must be used, using the *--cors* option is recommended to improve security. + +## OPTIONS + +#### **--cors** + +CORS headers to inject to the HTTP response. The default value is empty string which disables CORS headers. + +#### **--help**, **-h** + +Print usage statement. + +#### **--time**, **-t** + +The time until the session expires in _seconds_. The default is 5 +seconds. A value of `0` means no timeout, therefore the session does not expire. + +The default timeout can be changed via the `service_timeout=VALUE` field in containers.conf. +See **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** for more information. + +## EXAMPLES + +Start the user systemd socket for a rootless service. +``` +systemctl --user start podman.socket +``` + +Configure DOCKER_HOST environment variable to point to the Podman socket so that +it can be used via Docker API tools like docker-compose. +``` +$ export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock +$ docker-compose up +``` + +Configure the systemd socket to be automatically started after reboots, and run as the specified user. +``` +systemctl --user enable podman.socket +loginctl enable-linger +``` + +Start the systemd socket for the rootful service. +``` +sudo systemctl start podman.socket +``` + +Configure the socket to be automatically started after reboots. +``` +sudo systemctl enable podman.socket +``` + +It is possible to run the API without using systemd socket activation. +In this case the API will not be available on demand because the command will +stay terminated after the inactivity timeout has passed. +Run an API with an inactivity timeout of 5 seconds without using socket activation. +``` +podman system service --time 5 +``` + +The default socket was used as no URI argument was provided. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +## HISTORY +January 2020, Originally compiled by Brent Baude `` +November 2020, Updated by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-system.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-system.1.md new file mode 100644 index 000000000..206e14810 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-system.1.md @@ -0,0 +1,33 @@ +--- +title: podman-system +version: v5.4.2 +--- + +% podman-system 1 + +## NAME +podman\-system - Manage podman + +## SYNOPSIS +**podman system** *subcommand* + +## DESCRIPTION +The system command allows management of the podman systems + +## COMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------------------ | ------------------------------------------------------------------------ | +| check | [podman-system-check(1)](podman-system-check.1.md) | Perform consistency checks on image and container storage. +| connection | [podman-system-connection(1)](podman-system-connection.1.md) | Manage the destination(s) for Podman service(s) | +| df | [podman-system-df(1)](podman-system-df.1.md) | Show podman disk usage. | +| events | [podman-events(1)](podman-events.1.md) | Monitor Podman events | +| info | [podman-info(1)](podman-info.1.md) | Display Podman related system information. | +| migrate | [podman-system-migrate(1)](podman-system-migrate.1.md) | Migrate existing containers to a new podman version. | +| prune | [podman-system-prune(1)](podman-system-prune.1.md) | Remove all unused pods, containers, images, networks, and volume data. | +| renumber | [podman-system-renumber(1)](podman-system-renumber.1.md) | Migrate lock numbers to handle a change in maximum number of locks. | +| reset | [podman-system-reset(1)](podman-system-reset.1.md) | Reset storage back to initial state. | +| service | [podman-system-service(1)](podman-system-service.1.md) | Run an API service | + +## SEE ALSO +**[podman(1)](podman.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-systemd.unit.5.md b/versioned_docs/version-5.4.2/source/markdown/podman-systemd.unit.5.md new file mode 100644 index 000000000..e44f2680d --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-systemd.unit.5.md @@ -0,0 +1,2105 @@ +--- +title: Restart service when sleep finishes +version: v5.4.2 +--- + +% podman-systemd.unit 5 + +## NAME + +podman\-systemd.unit - systemd units using Podman Quadlet + +## SYNOPSIS + +*name*.container, *name*.volume, *name*.network, *name*.kube *name*.image, *name*.build *name*.pod + +### Podman rootful unit search path + +Quadlet files for the root user can be placed in the following directories ordered in precedence. Meaning duplicate named quadlets found under /run take precedence over ones in /etc, as well as those in /usr: + +Temporary quadlets, usually used for testing: + +* /run/containers/systemd/ + +System administrator's defined quadlets: + +* /etc/containers/systemd/ + +Distribution defined quadlets: + +* /usr/share/containers/systemd/ + +### Podman rootless unit search path + +Quadlet files for non-root users can be placed in the following directories + + * $XDG_RUNTIME_DIR/containers/systemd/ + * $XDG_CONFIG_HOME/containers/systemd/ or ~/.config/containers/systemd/ + * /etc/containers/systemd/users/$(UID) + * /etc/containers/systemd/users/ + +### Using symbolic links + +Quadlet supports using symbolic links for the base of the search paths and inside them. + +## DESCRIPTION + +Podman supports building, and starting containers (and creating volumes) via systemd by using a +[systemd generator](https://www.freedesktop.org/software/systemd/man/systemd.generator.html). +These files are read during boot (and when `systemctl daemon-reload` is run) and generate +corresponding regular systemd service unit files. Both system and user systemd units are supported. +All options and tables available in standard systemd unit files are supported. For example, options defined in +the [Service] table and [Install] tables pass directly to systemd and are handled by it. +See systemd.unit(5) man page for more information. + +The Podman generator reads the search paths above and reads files with the extensions `.container` +`.volume`, `.network`, `.build`, `.pod` and `.kube`, and for each file generates a similarly named `.service` file. Be aware that +existing vendor services (i.e., in `/usr/`) are replaced if they have the same name. The generated unit files can +be started and managed with `systemctl` like any other systemd service. `systemctl {--user} list-unit-files` +lists existing unit files on the system. + +The Podman files use the same format as [regular systemd unit files](https://www.freedesktop.org/software/systemd/man/systemd.syntax.html). +Each file type has a custom section (for example, `[Container]`) that is handled by Podman, and all +other sections are passed on untouched, allowing the use of any normal systemd configuration options +like dependencies or cgroup limits. + +The source files also support drop-ins in the same [way systemd does](https://www.freedesktop.org/software/systemd/man/latest/systemd.unit.html). +For a given source file (`foo.container`), the corresponding `.d` directory (`foo.container.d`) will +be scanned for files with a `.conf` extension, which are then merged into the base file in alphabetical +order. Top-level type drop-ins (`container.d`) will also be included. If the unit contains dashes ("-") +in the name (`foo-bar-baz.container`), then the drop-in directories generated by truncating the name after +the dash are searched as well (`foo-.container.d` and `foo-bar-.container.d`). Drop-in files with the same name +further down the hierarchy override those further up (`foo-bar-baz.container.d/10-override.conf` overrides +`foo-bar-.container.d/10-override.conf`, which overrides `foo-.service.d/10-override.conf`, which overrides +`container.d/10-override.conf`). The format of these drop-in files is the same as the base file. This is useful +to alter or add configuration settings for a unit, without having to modify unit files. + +For rootless containers, when administrators place Quadlet files in the +/etc/containers/systemd/users directory, all users' sessions execute the +Quadlet when the login session begins. If the administrator places a Quadlet +file in the /etc/containers/systemd/users/${UID}/ directory, then only the +user with the matching UID execute the Quadlet when the login +session gets started. For unit files placed in subdirectories within +/etc/containers/systemd/user/${UID}/ and the other user unit search paths, +Quadlet will recursively search and run the unit files present in these subdirectories. + +Note: When a Quadlet is starting, Podman often pulls or builds one more container images which may take a considerable amount of time. +Systemd defaults service start time to 90 seconds, or fails the service. Pre-pulling the image or extending +the systemd timeout time for the service using the *TimeoutStartSec* Service option can fix the problem. +A word of caution: *TimeoutStartSec* is not available for `Type=oneshot` units. Refer to `systemd.service(5)` +for more information on how to handle long startup times for units which do not need to stay active +once their main process has finished. + +Adding the following snippet to a Quadlet file extends the systemd timeout to 15 minutes. + +``` +[Service] +TimeoutStartSec=900 +``` + +Quadlet requires the use of cgroup v2, use `podman info --format {{.Host.CgroupsVersion}}` to check on the system. + +### Service Type + +By default, the `Type` field of the `Service` section of the Quadlet file does not need to be set. +Quadlet will set it to `notify` for `.container` and `.kube` files, +`forking` for `.pod` files, and `oneshot` for `.volume`, `.network`, `.build`, and `.image` files. + +However, `Type` may be explicitly set to `oneshot` for `.container` and `.kube` files when no containers are expected +to run once `podman` exits. + +When setting `Type=oneshot`, it is recommended to also set `RemainAfterExit=yes` to prevent the service state +from becoming `inactive (dead)`. However, when activating a service via a timer unit, having `RemainAfterExit=yes` +leaves the job in a "started" state which prevents subsequent activations by the timer. For more information, see the +`systemd.service(5)` man page. + +Examples for such cases: +- `.container` file with an image that exits after their entrypoint has finished +`` +- `.kube` file pointing to a Kubernetes Yaml file that does not define any containers. E.g. PVCs only + +### Enabling unit files + +The services created by Podman are considered transient by systemd, which means they don't have the same +persistence rules as regular units. In particular, it is not possible to "systemctl enable" them +in order for them to become automatically enabled on the next boot. + +To compensate for this, the generator manually applies the `[Install]` section of the container definition +unit files during generation, in the same way `systemctl enable` does when run later. + +For example, to start a container on boot, add something like this to the file: + +``` +[Install] +WantedBy=default.target +``` + +Currently, only the `Alias`, `WantedBy` and `RequiredBy` keys are supported. + +The Install section can be part of the main file, or it can be in a +separate drop-in file as described above. The latter allows you to +install an non-enabled unit and then later enabling it by installing +the drop-in. + + +**NOTE:** To express dependencies between containers, use the generated names of the service. In other +words `WantedBy=other.service`, not `WantedBy=other.container`. The same is +true for other kinds of dependencies, too, like `After=other.service`. + +### Template files + +Systemd supports a concept of [template files](https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html#Service%20Templates). +They are units with names of the form "basename@instancename.service" +when they are running, but that can be instantiated multiple times +from a single "basename@.service" file. The individual instances can +also be different by using drop-in files with the full instance name. + +Quadlets support these in two ways. First of all, a quadlet unit with +a template form will generate a systemd service with a template form, +and the template systemd service can be used as a regular template. +For example, "foo@.container" will generate "foo@.service" and you can +then "systemctl start foo@bar.service". + +Secondly, if you make a symlink like "foo@instance.container", that +will generate an instantiated template file. When generating this file +quadlet will read drop-in files both from the instanced directory +(foo@instance.container.d) and the template directory +(foo@.container.d). This allows customization of individual instances. + +Instanced template files (like `foo@bar.container`) can be enabled +just like non-templated ones. However, templated ones +(`foo@.container`) are different, because they need to be +instantiated. If the `[Install]` section contains a `DefaultInstance=` +key, then that instance will be enabled, but if not, nothing will +happen and the options will only be used as the default for units +that are instantiated using symlinks. + +An example template file `sleep@.container` might look like this: + +``` +[Unit] +Description=A templated sleepy container + +[Container] +Image=quay.io/fedora/fedora +Exec=sleep %i + +[Service] +# Restart service when sleep finishes +Restart=always + +[Install] +WantedBy=multi-user.target +DefaultInstance=100 +``` + +If this is installed, then on boot there will be a `sleep@100.service` +running that sleeps for 100 seconds. You can then do something like +`systemctl start sleep@50.service` to start another instance that +sleeps 50 seconds, or alternatively another service can start it via a +dependency like `Wants=sleep@50.service`. + +In addition, if you do `ln -s sleep@.container sleep@10.container` you +will also have a 10 second sleep running at boot. And, if you want +that particular instance to be running with another image, you can +create a drop-in file like `sleep@10.container.d/10-image.conf`: +``` +[Container] +Image=quay.io/centos/centos +``` + +### Relative paths + +In order to support Systemd specifiers, Quadlet does not resolve relative paths that start with `%`. +To resolve such a path, prepend it with `./`. + +For example, instead of `EnvironmentFile=%n/env` use `EnvironmentFile=./%n/env` + +### Debugging unit files + +After placing the unit file in one of the unit search paths (mentioned +above), you can start it with `systemctl start {--user}`. If it fails +with "Failed to start example.service: Unit example.service not +found.", then it is possible that you used incorrect syntax or you +used an option from a newer version of Podman Quadlet and the +generator failed to create a service file. + +View the generated files and/or error messages with: +``` +/usr/lib/systemd/system-generators/podman-system-generator {--user} --dryrun +``` + +Alternatively, show only the errors with: +``` +systemd-analyze {--user} --generators=true verify example.service +``` + +That command also performs additional checks on the generated service unit. +For details, see systemd-analyze(1) man page. + +#### Debugging a limited set of unit files + +If you would like to debug a limited set of unit files, you can copy them to a separate directory and set the +`QUADLET_UNIT_DIRS` environment variable to this directory when running the command below: + +``` +QUADLET_UNIT_DIRS= /usr/lib/systemd/system-generators/podman-system-generator {--user} --dryrun +``` + +This will instruct Quadlet to look for units in this directory instead of the common ones and by +that limit the output to only the units you are debugging. + +### Implicit network dependencies + +Quadlet will add dependencies on the `network-online.target` (as root) or `podman-user-wait-network-online.service` +(as user) by adding `After=` and `Wants=` properties to the unit. This is to ensure that the network is reachable +if an image needs to be pulled and by the time the container is started. + +The special case `podman-user-wait-network-online.service` unit is needed as user because user units are unable to wait +for system (root) units so `network-online.target` doesn't do anything there and is instead ignored. As this caused +a significant amount of issues we decided to work around this with our own special purpose unit that simply checks if +the `network-online.target` unit is active with `systemctl is-active network-online.target`. + +This behavior can be disabled by adding `DefaultDependencies=false` in the `Quadlet` section. + +## Container units [Container] + +Container units are named with a `.container` extension and contain a `[Container]` section describing +the container that is run as a service. The resulting service file contains a line like +`ExecStart=podman run … image-name`, and most of the keys in this section control the command-line +options passed to Podman. However, some options also affect the details of how systemd is set up to run and +interact with the container. + +By default, the Podman container has the same name as the unit, but with a `systemd-` prefix, i.e. +a `$name.container` file creates a `$name.service` unit and a `systemd-$name` Podman container. The +`ContainerName` option allows for overriding this default name with a user-provided one. + +There is only one required key, `Image`, which defines the container image the service runs. + +Valid options for `[Container]` are listed below: + +| **[Container] options** | **podman run equivalent** | +|--------------------------------------|------------------------------------------------------| +| AddCapability=CAP | --cap-add CAP | +| AddDevice=/dev/foo | --device /dev/foo | +| AddHost=example\.com:192.168.10.11 | --add-host example.com:192.168.10.11 | +| Annotation="XYZ" | --annotation "XYZ" | +| AutoUpdate=registry | --label "io.containers.autoupdate=registry" | +| CgroupsMode=no-conmon | --cgroups=no-conmon | +| ContainerName=name | --name name | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| DNS=192.168.55.1 | --dns=192.168.55.1 | +| DNSOption=ndots:1 | --dns-option=ndots:1 | +| DNSSearch=example.com | --dns-search example.com | +| DropCapability=CAP | --cap-drop=CAP | +| Entrypoint=/foo.sh | --entrypoint=/foo.sh | +| Environment=foo=bar | --env foo=bar | +| EnvironmentFile=/tmp/env | --env-file /tmp/env | +| EnvironmentHost=true | --env-host | +| Exec=/usr/bin/command | Command after image specification - /usr/bin/command | +| ExposeHostPort=50-59 | --expose 50-59 | +| GIDMap=0:10000:10 | --gidmap=0:10000:10 | +| GlobalArgs=--log-level=debug | --log-level=debug | +| Group=1234 | --user UID:1234 | +| GroupAdd=keep-groups | --group-add=keep-groups | +| HealthCmd=/usr/bin/command | --health-cmd=/usr/bin/command | +| HealthInterval=2m | --health-interval=2m | +| HealthLogDestination=/foo/log | --health-log-destination=/foo/log | +| HealthMaxLogCount=5 | --health-max-log-count=5 | +| HealthMaxLogSize=500 | --health-max-log-size=500 | +| HealthOnFailure=kill | --health-on-failure=kill | +| HealthRetries=5 | --health-retries=5 | +| HealthStartPeriod=1m | --health-start-period=period=1m | +| HealthStartupCmd=command | --health-startup-cmd=command | +| HealthStartupInterval=1m | --health-startup-interval=1m | +| HealthStartupRetries=8 | --health-startup-retries=8 | +| HealthStartupSuccess=2 | --health-startup-success=2 | +| HealthStartupTimeout=1m33s | --health-startup-timeout=1m33s | +| HealthTimeout=20s | --health-timeout=20s | +| HostName=example.com | --hostname example.com | +| Image=ubi8 | Image specification - ubi8 | +| IP=192.5.0.1 | --ip 192.5.0.1 | +| IP6=2001:db8::1 | --ip6 2001:db8::1 | +| Label="XYZ" | --label "XYZ" | +| LogDriver=journald | --log-driver journald | +| LogOpt=path=/var/log/mykube\.json | --log-opt path=/var/log/mykube\.json | +| Mask=/proc/sys/foo\:/proc/sys/bar | --security-opt mask=/proc/sys/foo:/proc/sys/bar | +| Mount=type=... | --mount type=... | +| Network=host | --network host | +| NetworkAlias=name | --network-alias name | +| NoNewPrivileges=true | --security-opt no-new-privileges | +| Notify=true | --sdnotify container | +| PidsLimit=10000 | --pids-limit 10000 | +| Pod=pod-name | --pod=pod-name | +| PodmanArgs=--publish 8080:80 | --publish 8080:80 | +| PublishPort=8080:80 | --publish 8080:80 | +| Pull=never | --pull never | +| ReadOnly=true | --read-only | +| ReadOnlyTmpfs=true | --read-only-tmpfs | +| Rootfs=/var/lib/rootfs | --rootfs /var/lib/rootfs | +| RunInit=true | --init | +| SeccompProfile=/tmp/s.json | --security-opt seccomp=/tmp/s.json | +| Secret=secret | --secret=secret[,opt=opt ...] | +| SecurityLabelDisable=true | --security-opt label=disable | +| SecurityLabelFileType=usr_t | --security-opt label=filetype:usr_t | +| SecurityLabelLevel=s0:c1,c2 | --security-opt label=level\:s0\:c1,c2 | +| SecurityLabelNested=true | --security-opt label=nested | +| SecurityLabelType=spc_t | --security-opt label=type\:spc_t | +| ShmSize=100m | --shm-size=100m | +| StartWithPod=true | If Pod= is defined, container is started by pod | +| StopSignal=SIGINT | --stop-signal=SIGINT | +| StopTimeout=20 | --stop-timeout=20 | +| SubGIDMap=gtest | --subgidname=gtest | +| SubUIDMap=utest | --subuidname=utest | +| Sysctl=name=value | --sysctl=name=value | +| Timezone=local | --tz local | +| Tmpfs=/work | --tmpfs /work | +| UIDMap=0:10000:10 | --uidmap=0:10000:10 | +| Ulimit=nofile=1000:10000 | --ulimit nofile=1000:10000 | +| Unmask=ALL | --security-opt unmask=ALL | +| User=bin | --user bin | +| UserNS=keep-id\:uid=200,gid=210 | --userns keep-id:uid=200,gid=210 | +| Volume=/source:/dest | --volume /source:/dest | +| WorkingDir=$HOME | --workdir $HOME | + +Description of `[Container]` section are: + +### `AddCapability=` + +Add these capabilities, in addition to the default Podman capability set, to the container. + +This is a space separated list of capabilities. This key can be listed multiple times. + +For example: +``` +AddCapability=CAP_DAC_OVERRIDE CAP_IPC_OWNER +``` + +### `AddDevice=` + +Adds a device node from the host into the container. The format of this is +`HOST-DEVICE[\:CONTAINER-DEVICE][:PERMISSIONS]`, where `HOST-DEVICE` is the path of +the device node on the host, `CONTAINER-DEVICE` is the path of the device node in +the container, and `PERMISSIONS` is a list of permissions combining 'r' for read, +'w' for write, and 'm' for mknod(2). The `-` prefix tells Quadlet to add the device +only if it exists on the host. + +This key can be listed multiple times. + +### `AddHost=` + +Add host-to-IP mapping to /etc/hosts. +The format is `hostname\:ip`. + +Equivalent to the Podman `--add-host` option. +This key can be listed multiple times. + +### `Annotation=` + +Set one or more OCI annotations on the container. The format is a list of `key=value` items, +similar to `Environment`. + +This key can be listed multiple times. + +### `AutoUpdate=` + +Indicates whether the container will be auto-updated ([podman-auto-update(1)](podman-auto-update.1.md)). The following values are supported: + +* `registry`: Requires a fully-qualified image reference (e.g., quay.io/podman/stable:latest) to be used to create the container. This enforcement is necessary to know which image to actually check and pull. If an image ID was used, Podman does not know which image to check/pull anymore. + +* `local`: Tells Podman to compare the image a container is using to the image with its raw name in local storage. If an image is updated locally, Podman simply restarts the systemd unit executing the container. + +### `CgroupsMode=` + +The cgroups mode of the Podman container. Equivalent to the Podman `--cgroups` option. + +By default, the cgroups mode of the container created by Quadlet is `split`, +which differs from the default (`enabled`) used by the Podman CLI. + +If the container joins a pod (i.e. `Pod=` is specified), you may want to change this to +`no-conmon` or `enabled` so that pod level cgroup resource limits can take effect. + +### `ContainerName=` + +The (optional) name of the Podman container. If this is not specified, the default value +of `systemd-%N` is used, which is the same as the service name but with a `systemd-` +prefix to avoid conflicts with user-managed containers. + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `DNS=` + +Set network-scoped DNS resolver/nameserver for containers in this network. + +This key can be listed multiple times. + +### `DNSOption=` + +Set custom DNS options. + +This key can be listed multiple times. + +### `DNSSearch=` + +Set custom DNS search domains. Use **DNSSearch=.** to remove the search domain. + +This key can be listed multiple times. + +### `DropCapability=` + +Drop these capabilities from the default podman capability set, or `all` to drop all capabilities. + +This is a space separated list of capabilities. This key can be listed multiple times. + +For example: +``` +DropCapability=CAP_DAC_OVERRIDE CAP_IPC_OWNER +``` + +### `Entrypoint=` + +Override the default ENTRYPOINT from the image. +Equivalent to the Podman `--entrypoint` option. +Specify multi option commands in the form of a json string. + +### `Environment=` + +Set an environment variable in the container. This uses the same format as +[services in systemd](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Environment=) +and can be listed multiple times. + +### `EnvironmentFile=` + +Use a line-delimited file to set environment variables in the container. +The path may be absolute or relative to the location of the unit file. +This key may be used multiple times, and the order persists when passed to `podman run`. + +### `EnvironmentHost=` + +Use the host environment inside of the container. + +### `Exec=` + +Additional arguments for the container; this has exactly the same effect as passing +more arguments after a `podman run ` invocation. + +The format is the same as for [systemd command lines](https://www.freedesktop.org/software/systemd/man/systemd.service.html#Command%20lines), +However, unlike the usage scenario for similarly-named systemd `ExecStart=` verb +which operates on the ambient root filesystem, it is very common for container +images to have their own `ENTRYPOINT` or `CMD` metadata which this interacts with. + +The default expectation for many images is that the image will include an `ENTRYPOINT` +with a default binary, and this field will add arguments to that entrypoint. + +Another way to describe this is that it works the same way as the [args field in a Kubernetes pod](https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell). + +### `ExposeHostPort=` + +Exposes a port, or a range of ports (e.g. `50-59`), from the host to the container. Equivalent +to the Podman `--expose` option. + +This key can be listed multiple times. + +### `GIDMap=` + +Run the container in a new user namespace using the supplied GID mapping. +Equivalent to the Podman `--gidmap` option. + +This key can be listed multiple times. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `run` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Group=` + +The (numeric) GID to run as inside the container. This does not need to match the GID on the host, +which can be modified with `UsersNS`, but if that is not specified, this GID is also used on the host. + +### `GroupAdd=` + +Assign additional groups to the primary user running within the container process. Also supports the `keep-groups` special flag. +Equivalent to the Podman `--group-add` option. + +### `HealthCmd=` + +Set or alter a healthcheck command for a container. A value of none disables existing healthchecks. +Equivalent to the Podman `--health-cmd` option. + +### `HealthInterval=` + +Set an interval for the healthchecks. An interval of disable results in no automatic timer setup. +Equivalent to the Podman `--health-interval` option. + +### `HealthLogDestination=` + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) +(Default: local) +Equivalent to the Podman `--health-log-destination` option. + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. + +### `HealthMaxLogCount=` + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) +(Default: 5 attempts) +Equivalent to the Podman `--Health-max-log-count` option. + +### `HealthMaxLogSize=` + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) +(Default: 500 characters) +Equivalent to the Podman `--Health-max-log-size` option. + +### `HealthOnFailure=` + +Action to take once the container transitions to an unhealthy state. +The "kill" action in combination integrates best with systemd. Once +the container turns unhealthy, it gets killed, and systemd restarts the +service. +Equivalent to the Podman `--health-on-failure` option. + +### `HealthRetries=` + +The number of retries allowed before a healthcheck is considered to be unhealthy. +Equivalent to the Podman `--health-retries` option. + +### `HealthStartPeriod=` + +The initialization time needed for a container to bootstrap. +Equivalent to the Podman `--health-start-period` option. + +### `HealthStartupCmd=` + +Set a startup healthcheck command for a container. +Equivalent to the Podman `--health-startup-cmd` option. + +### `HealthStartupInterval=` + +Set an interval for the startup healthcheck. An interval of disable results in no automatic timer setup. +Equivalent to the Podman `--health-startup-interval` option. + +### `HealthStartupRetries=` + +The number of attempts allowed before the startup healthcheck restarts the container. +Equivalent to the Podman `--health-startup-retries` option. + +### `HealthStartupSuccess=` + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. +Equivalent to the Podman `--health-startup-success` option. + +### `HealthStartupTimeout=` + +The maximum time a startup healthcheck command has to complete before it is marked as failed. +Equivalent to the Podman `--health-startup-timeout` option. + +### `HealthTimeout=` + +The maximum time allowed to complete the healthcheck before an interval is considered failed. +Equivalent to the Podman `--health-timeout` option. + +### `HostName=` + +Sets the host name that is available inside the container. +Equivalent to the Podman `--hostname` option. + +### `Image=` + +The image to run in the container. +It is recommended to use a fully qualified image name rather than a short name, both for +performance and robustness reasons. + +The format of the name is the same as when passed to `podman pull`. So, it supports using +`\:tag` or digests to guarantee the specific image version. + +Special Cases: + +* If the `name` of the image ends with `.image`, Quadlet will use the image pulled by the corresponding `.image` file, and the generated systemd service contains a dependency on the `$name-image.service` (or the service name set in the .image file). Note that the corresponding `.image` file must exist. +* If the `name` of the image ends with `.build`, Quadlet will use the image built by the corresponding `.build` file, and the generated systemd service contains a dependency on the `$name-build.service`. Note: the corresponding `.build` file must exist. + +### `IP=` + +Specify a static IPv4 address for the container, for example **10.88.64.128**. +Equivalent to the Podman `--ip` option. + +### `IP6=` + +Specify a static IPv6 address for the container, for example **fd46\:db93\:aa76\:ac37::10**. +Equivalent to the Podman `--ip6` option. + +### `Label=` + +Set one or more OCI labels on the container. The format is a list of `key=value` items, +similar to `Environment`. + +This key can be listed multiple times. + +### `LogDriver=` + +Set the log-driver used by Podman when running the container. +Equivalent to the Podman `--log-driver` option. + +### `LogOpt=` + +Set the log-opt (logging options) used by Podman when running the container. +Equivalent to the Podman `--log-opt` option. +This key can be listed multiple times. + +### `Mask=` + +Specify the paths to mask separated by a colon. `Mask=/path/1:/path/2`. A masked path cannot be accessed inside the container. + +### `Mount=` + +Attach a filesystem mount to the container. +This is equivalent to the Podman `--mount` option, and +generally has the form `type=TYPE,TYPE-SPECIFIC-OPTION[,...]`. + +Special cases: + +* For `type=volume`, if `source` ends with `.volume`, the Podman named volume generated by the corresponding `.volume` file is used. +* For `type=image`, if `source` ends with `.image`, the image generated by the corresponding `.image` file is used. + +In both cases, the generated systemd service will contain a dependency on the service generated for the corresponding unit. Note: the corresponding `.volume` or `.image` file must exist. + +This key can be listed multiple times. + +### `Network=` + +Specify a custom network for the container. This has the same format as the `--network` option +to `podman run`. For example, use `host` to use the host network in the container, or `none` to +not set up networking in the container. + +Special cases: + +* If the `name` of the network ends with `.network`, a Podman network called +`systemd-$name` is used, and the generated systemd service contains +a dependency on the `$name-network.service`. Such a network can be automatically +created by using a `$name.network` Quadlet file. Note: the corresponding `.network` file must exist. + +* If the `name` ends with `.container`, +the container will reuse the network stack of another container created by `$name.container`. +The generated systemd service contains a dependency on `$name.service`. Note: the corresponding `.container` file must exist. + +This key can be listed multiple times. + +### `NetworkAlias=` + +Add a network-scoped alias for the container. This has the same format as the `--network-alias` +option to `podman run`. Aliases can be used to group containers together in DNS resolution: for +example, setting `NetworkAlias=web` on multiple containers will make a DNS query for `web` resolve +to all the containers with that alias. + +This key can be listed multiple times. + +### `NoNewPrivileges=` (defaults to `false`) + +If enabled, this disables the container processes from gaining additional privileges via things like +setuid and file capabilities. + +### `Notify=` (defaults to `false`) + +By default, Podman is run in such a way that the systemd startup notify command is handled by +the container runtime. In other words, the service is deemed started when the container runtime +starts the child in the container. However, if the container application supports +[sd_notify](https://www.freedesktop.org/software/systemd/man/sd_notify.html), then setting +`Notify` to true passes the notification details to the container allowing it to notify +of startup on its own. + +In addition, setting `Notify` to `healthy` will postpone startup notifications until such time as +the container is marked healthy, as determined by Podman healthchecks. Note that this requires +setting up a container healthcheck, see the `HealthCmd` option for more. + +### `PidsLimit=` + +Tune the container's pids limit. +This is equivalent to the Podman `--pids-limit` option. + +### `Pod=` + +Specify a Quadlet `.pod` unit to link the container to. +The value must take the form of `.pod` and the `.pod` unit must exist. + +Quadlet will add all the necessary parameters to link between the container and the pod and between their corresponding services. + + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman run` command +in the generated file (right before the image name in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `PublishPort=` + +Exposes a port, or a range of ports (e.g. `50-59`), from the container to the host. Equivalent +to the Podman `--publish` option. The format is similar to the Podman options, which is of +the form `ip\:hostPort:containerPort`, `ip::containerPort`, `hostPort:containerPort` or +`containerPort`, where the number of host and container ports must be the same (in the case +of a range). + +If the IP is set to 0.0.0.0 or not set at all, the port is bound on all IPv4 addresses on +the host; use [::] for IPv6. + +Note that not listing a host port means that Podman automatically selects one, and it +may be different for each invocation of service. This makes that a less useful option. The +allocated port can be found with the `podman port` command. + +This key can be listed multiple times. + +### `Pull=` + +Set the image pull policy. +This is equivalent to the Podman `--pull` option + +### `ReadOnly=` (defaults to `false`) + +If enabled, makes the image read-only. + +### `ReadOnlyTmpfs=` (defaults to `true`) + +If ReadOnly is set to `true`, mount a read-write tmpfs on /dev, /dev/shm, /run, /tmp, and /var/tmp. + +### `Rootfs=` + +The rootfs to use for the container. Rootfs points to a directory on the system that contains the content to be run within the container. This option conflicts with the `Image` option. + +The format of the rootfs is the same as when passed to `podman run --rootfs`, so it supports overlay mounts as well. + +Note: On SELinux systems, the rootfs needs the correct label, which is by default unconfined_u\:object_r\:container_file_t\:s0. + +### `RunInit=` (default to `false`) + +If enabled, the container has a minimal init process inside the +container that forwards signals and reaps processes. + +### `SeccompProfile=` + +Set the seccomp profile to use in the container. If unset, the default podman profile is used. +Set to either the pathname of a json file, or `unconfined` to disable the seccomp filters. + +### `Secret=` + +Use a Podman secret in the container either as a file or an environment variable. +This is equivalent to the Podman `--secret` option and generally has the form `secret[,opt=opt ...]` + +### `SecurityLabelDisable=` + +Turn off label separation for the container. + +### `SecurityLabelFileType=` + +Set the label file type for the container files. + +### `SecurityLabelLevel=` + +Set the label process level for the container processes. + +### `SecurityLabelNested=` + +Allow SecurityLabels to function within the container. This allows separation of containers created within the container. + +### `SecurityLabelType=` + +Set the label process type for the container processes. + +### `ShmSize=` + +Size of /dev/shm. + +This is equivalent to the Podman `--shm-size` option and generally has the form `number[unit]` + +### `StartWithPod=` + +Start the container after the associated pod is created. Default to **true**. + +If `true`, container will be started/stopped/restarted alongside the pod. + +If `false`, the container will not be started when the pod starts. The container will be stopped with the pod. Restarting the pod will also restart the container as long as the container was also running before. + +Note, the container can still be started manually or through a target by configuring the `[Install]` section. The pod will be started as needed in any case. + +### `StopSignal=` + +Signal to stop a container. Default is **SIGTERM**. + +This is equivalent to the Podman `--stop-signal` option + +### `StopTimeout=` + +Seconds to wait before forcibly stopping the container. + +Note, this value should be lower than the actual systemd unit timeout to make sure the podman rm command is not killed by systemd. + +This is equivalent to the Podman `--stop-timeout` option + +### `SubGIDMap=` + +Run the container in a new user namespace using the map with name in the /etc/subgid file. +Equivalent to the Podman `--subgidname` option. + +### `SubUIDMap=` + +Run the container in a new user namespace using the map with name in the /etc/subuid file. +Equivalent to the Podman `--subuidname` option. + +### `Sysctl=` + +Configures namespaced kernel parameters for the container. The format is `Sysctl=name=value`. + +This is a space separated list of kernel parameters. This key can be listed multiple times. + +For example: +``` +Sysctl=net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.all.use_tempaddr=1 +``` + +### `Timezone=` (if unset uses system-configured default) + +The timezone to run the container in. + +### `Tmpfs=` + +Mount a tmpfs in the container. This is equivalent to the Podman `--tmpfs` option, and +generally has the form `CONTAINER-DIR[\:OPTIONS]`. + +This key can be listed multiple times. + +### `UIDMap=` + +Run the container in a new user namespace using the supplied UID mapping. +Equivalent to the Podman `--uidmap` option. + +This key can be listed multiple times. + +### `Ulimit=` + +Ulimit options. Sets the ulimits values inside of the container. + +This key can be listed multiple times. + +### `Unmask=` + +Specify the paths to unmask separated by a colon. unmask=ALL or /path/1:/path/2, or shell expanded paths (/proc/*): + +If set to `ALL`, Podman will unmask all the paths that are masked or made read-only by default. + +The default masked paths are /proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux. + +The default paths that are read-only are /proc/asound, /proc/bus, /proc/fs, /proc/irq, /proc/sys, /proc/sysrq-trigger, /sys/fs/cgroup. + +### `User=` + +The (numeric) UID to run as inside the container. This does not need to match the UID on the host, +which can be modified with `UserNS`, but if that is not specified, this UID is also used on the host. + +### `UserNS=` + +Set the user namespace mode for the container. This is equivalent to the Podman `--userns` option and +generally has the form `MODE[:OPTIONS,...]`. + +### `Volume=` + +Mount a volume in the container. This is equivalent to the Podman `--volume` option, and +generally has the form `[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[:OPTIONS]]`. + +If `SOURCE-VOLUME` starts with `.`, Quadlet resolves the path relative to the location of the unit file. + +Special case: + +* If `SOURCE-VOLUME` ends with `.volume`, a Podman named volume called `systemd-$name` is used as the source, and the generated systemd service contains a dependency on the `$name-volume.service`. Note that the corresponding `.volume` file must exist. + +This key can be listed multiple times. + +### `WorkingDir=` + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (/). The image developer can set a different default with the WORKDIR instruction. This option overrides the working directory by using the -w option. + +## Pod units [Pod] + +Pod units are named with a `.pod` extension and contain a `[Pod]` section describing +the pod that is created and run as a service. The resulting service file contains a line like +`ExecStartPre=podman pod create …`, and most of the keys in this section control the command-line +options passed to Podman. + +By default, the Podman pod has the same name as the unit, but with a `systemd-` prefix, i.e. +a `$name.pod` file creates a `$name-pod.service` unit and a `systemd-$name` Podman pod. The +`PodName` option allows for overriding this default name with a user-provided one. + +Valid options for `[Pod]` are listed below: + +| **[Pod] options** | **podman container create equivalent** | +|-------------------------------------|----------------------------------------| +| AddHost=example\.com:192.168.10.11 | --add-host example.com:192.168.10.11 | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| DNS=192.168.55.1 | --dns=192.168.55.1 | +| DNSOption=ndots:1 | --dns-option=ndots:1 | +| DNSSearch=example.com | --dns-search example.com | +| GIDMap=0:10000:10 | --gidmap=0:10000:10 | +| GlobalArgs=--log-level=debug | --log-level=debug | +| IP=192.5.0.1 | --ip 192.5.0.1 | +| IP6=2001\:db8::1 | --ip6 2001:db8::1 | +| Network=host | --network host | +| NetworkAlias=name | --network-alias name | +| PodmanArgs=\-\-cpus=2 | --cpus=2 | +| PodName=name | --name=name | +| PublishPort=8080:80 | --publish 8080:80 | +| ServiceName=name | Name the systemd unit `name.service` | +| ShmSize=100m | --shm-size=100m | +| SubGIDMap=gtest | --subgidname=gtest | +| SubUIDMap=utest | --subuidname=utest | +| UIDMap=0:10000:10 | --uidmap=0:10000:10 | +| UserNS=keep-id\:uid=200,gid=210 | --userns keep-id:uid=200,gid=210 | +| Volume=/source:/dest | --volume /source:/dest | + +Supported keys in the `[Pod]` section are: + +### `AddHost=` + +Add host-to-IP mapping to /etc/hosts. +The format is `hostname\:ip`. + +Equivalent to the Podman `--add-host` option. +This key can be listed multiple times. + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `DNS=` + +Set network-scoped DNS resolver/nameserver for containers in this pod. + +This key can be listed multiple times. + +### `DNSOption=` + +Set custom DNS options. + +This key can be listed multiple times. + +### `DNSSearch=` + +Set custom DNS search domains. Use **DNSSearch=.** to remove the search domain. + +This key can be listed multiple times. + +### `GIDMap=` + +Create the pod in a new user namespace using the supplied GID mapping. +Equivalent to the Podman `--gidmap` option. + +This key can be listed multiple times. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `pod` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `IP=` + +Specify a static IPv4 address for the pod, for example **10.88.64.128**. +Equivalent to the Podman `--ip` option. + +### `IP6=` + +Specify a static IPv6 address for the pod, for example **fd46\:db93\:aa76\:ac37::10**. +Equivalent to the Podman `--ip6` option. + +### `Network=` + +Specify a custom network for the pod. +This has the same format as the `--network` option to `podman pod create`. +For example, use `host` to use the host network in the pod, or `none` to not set up networking in the pod. + +Special case: + +* If the `name` of the network ends with `.network`, Quadlet will look for the corresponding `.network` Quadlet unit. If found, Quadlet will use the name of the Network set in the Unit, otherwise, `systemd-$name` is used. + +The generated systemd service contains a dependency on the service unit generated for that `.network` unit. Note: the corresponding `.network` file must exist. + +This key can be listed multiple times. + +### `NetworkAlias=` + +Add a network-scoped alias for the pod. This has the same format as the `--network-alias` option to +`podman pod create`. Aliases can be used to group containers together in DNS resolution: for +example, setting `NetworkAlias=web` on multiple containers will make a DNS query for `web` resolve +to all the containers with that alias. + +This key can be listed multiple times. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman pod create` command +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `PodName=` + +The (optional) name of the Podman pod. If this is not specified, the default value +of `systemd-%N` is used, which is the same as the service name but with a `systemd-` +prefix to avoid conflicts with user-managed containers. + +Please note that pods and containers cannot have the same name. +So, if PodName is set, it must not conflict with any container. + +### `PublishPort=` + +Exposes a port, or a range of ports (e.g. `50-59`), from the pod to the host. Equivalent +to the Podman `--publish` option. The format is similar to the Podman options, which is of +the form `ip\:hostPort:containerPort`, `ip::containerPort`, `hostPort:containerPort` or +`containerPort`, where the number of host and container ports must be the same (in the case +of a range). + +If the IP is set to 0.0.0.0 or not set at all, the port is bound on all IPv4 addresses on +the host; use [::] for IPv6. + +Note that not listing a host port means that Podman automatically selects one, and it +may be different for each invocation of service. This makes that a less useful option. The +allocated port can be found with the `podman port` command. + +When using `host` networking via `Network=host`, the `PublishPort=` option cannot be used. + +This key can be listed multiple times. + + +### `ServiceName=` + +By default, Quadlet will name the systemd service unit by appending `-pod` to the name of the Quadlet. +Setting this key overrides this behavior by instructing Quadlet to use the provided name. + +Note, the name should not include the `.service` file extension + +### `ShmSize=` + +Size of /dev/shm. + +This is equivalent to the Podman `--shm-size` option and generally has the form `number[unit]` + +### `SubGIDMap=` + +Create the pod in a new user namespace using the map with name in the /etc/subgid file. +Equivalent to the Podman `--subgidname` option. + +### `SubUIDMap=` + +Create the pod in a new user namespace using the map with name in the /etc/subuid file. +Equivalent to the Podman `--subuidname` option. + +### `UIDMap=` + +Create the pod in a new user namespace using the supplied UID mapping. +Equivalent to the Podman `--uidmap` option. + +This key can be listed multiple times. + +### `UserNS=` + +Set the user namespace mode for the pod. This is equivalent to the Podman `--userns` option and +generally has the form `MODE[:OPTIONS,...]`. + +### `Volume=` + +Mount a volume in the pod. This is equivalent to the Podman `--volume` option, and +generally has the form `[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]`. + +If `SOURCE-VOLUME` starts with `.`, Quadlet resolves the path relative to the location of the unit file. + +Special case: + +* If `SOURCE-VOLUME` ends with `.volume`, Quadlet will look for the corresponding `.volume` Quadlet unit. If found, Quadlet will use the name of the Volume set in the Unit, otherwise, `systemd-$name` is used. Note: the corresponding `.volume` file must exist. + +The generated systemd service contains a dependency on the service unit generated for that `.volume` unit, +or on `$name-volume.service` if the `.volume` unit is not found. + +This key can be listed multiple times. + +## Kube units [Kube] + +Kube units are named with a `.kube` extension and contain a `[Kube]` section describing +how `podman kube play` runs as a service. The resulting service file contains a line like +`ExecStart=podman kube play … file.yml`, and most of the keys in this section control the command-line +options passed to Podman. However, some options also affect the details of how systemd is set up to run and +interact with the container. + +There is only one required key, `Yaml`, which defines the path to the Kubernetes YAML file. + +Valid options for `[Kube]` are listed below: + +| **[Kube] options** | **podman kube play equivalent** | +| ------------------------------------| -----------------------------------------------------------------| +| AutoUpdate=registry | --annotation "io.containers.autoupdate=registry" | +| ConfigMap=/tmp/config.map | --config-map /tmp/config.map | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| ExitCodePropagation=how | How to propagate container error status | +| GlobalArgs=--log-level=debug | --log-level=debug | +| KubeDownForce=true | --force (for `podman kube down`) | +| LogDriver=journald | --log-driver journald | +| Network=host | --network host | +| PodmanArgs=\-\-annotation=key=value | --annotation=key=value | +| PublishPort=8080:80 | --publish 8080:80 | +| SetWorkingDirectory=yaml | Set `WorkingDirectory` of unit file to location of the YAML file | +| UserNS=keep-id\:uid=200,gid=210 | --userns keep-id\:uid=200,gid=210 | +| Yaml=/tmp/kube.yaml | podman kube play /tmp/kube.yaml | + +Supported keys in the `[Kube]` section are: + +### `AutoUpdate=` + +Indicates whether containers will be auto-updated ([podman-auto-update(1)](podman-auto-update.1.md)). AutoUpdate can be specified multiple times. The following values are supported: + +* `registry`: Requires a fully-qualified image reference (e.g., quay.io/podman/stable:latest) to be used to create the container. This enforcement is necessary to know which images to actually check and pull. If an image ID was used, Podman does not know which image to check/pull anymore. + +* `local`: Tells Podman to compare the image a container is using to the image with its raw name in local storage. If an image is updated locally, Podman simply restarts the systemd unit executing the Kubernetes Quadlet. + +* `name/(local|registry)`: Tells Podman to perform the `local` or `registry` autoupdate on the specified container name. + +### `ConfigMap=` + +Pass the Kubernetes ConfigMap YAML path to `podman kube play` via the `--configmap` argument. +Unlike the `configmap` argument, the value may contain only one path but +it may be absolute or relative to the location of the unit file. + +This key may be used multiple times + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `ExitCodePropagation=` + +Control how the main PID of the systemd service should exit. The following values are supported: +- `all`: exit non-zero if all containers have failed (i.e., exited non-zero) +- `any`: exit non-zero if any container has failed +- `none`: exit zero and ignore failed containers + +The current default value is `none`. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `kube` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `KubeDownForce=` + +Remove all resources, including volumes, when calling `podman kube down`. +Equivalent to the Podman `--force` option. + +### `LogDriver=` + +Set the log-driver Podman uses when running the container. +Equivalent to the Podman `--log-driver` option. + +### `Network=` + +Specify a custom network for the container. This has the same format as the `--network` option +to `podman kube play`. For example, use `host` to use the host network in the container, or `none` to +not set up networking in the container. + +Special case: + +* If the `name` of the network ends with `.network`, a Podman network called `systemd-$name` is used, and the generated systemd service contains a dependency on the `$name-network.service`. Such a network can be automatically created by using a `$name.network` Quadlet file. Note: the corresponding `.network` file must exist. + +This key can be listed multiple times. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman kube play` command +in the generated file (right before the path to the yaml file in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `PublishPort=` + +Exposes a port, or a range of ports (e.g. `50-59`), from the container to the host. Equivalent +to the `podman kube play`'s `--publish` option. The format is similar to the Podman options, which is of +the form `ip\:hostPort:containerPort`, `ip::containerPort`, `hostPort:containerPort` or +`containerPort`, where the number of host and container ports must be the same (in the case +of a range). + +If the IP is set to 0.0.0.0 or not set at all, the port is bound on all IPv4 addresses on +the host; use [::] for IPv6. + +The list of published ports specified in the unit file is merged with the list of ports specified +in the Kubernetes YAML file. If the same container port and protocol is specified in both, the +entry from the unit file takes precedence + +This key can be listed multiple times. + +### `SetWorkingDirectory=` + +Set the `WorkingDirectory` field of the `Service` group of the Systemd service unit file. +Used to allow `podman kube play` to correctly resolve relative paths. +Supported values are `yaml` and `unit` to set the working directory to that of the YAML or Quadlet Unit file respectively. + +Alternatively, users can explicitly set the `WorkingDirectory` field of the `Service` group in the `.kube` file. +Please note that if the `WorkingDirectory` field of the `Service` group is set, +Quadlet will not set it even if `SetWorkingDirectory` is set + +### `UserNS=` + +Set the user namespace mode for the container. This is equivalent to the Podman `--userns` option and +generally has the form `MODE[\:OPTIONS,...]`. + +### `Yaml=` + +The path, absolute or relative to the location of the unit file, to the Kubernetes YAML file to use. + +## Network units [Network] + +Network files are named with a `.network` extension and contain a section `[Network]` describing the +named Podman network. The generated service is a one-time command that ensures that the network +exists on the host, creating it if needed. + +By default, the Podman network has the same name as the unit, but with a `systemd-` prefix, i.e. for +a network file named `$NAME.network`, the generated Podman network is called `systemd-$NAME`, and +the generated service file is `$NAME-network.service`. The `NetworkName` option allows for +overriding this default name with a user-provided one. + +Please note that stopping the corresponding service will not remove the podman network. +In addition, updating an existing network is not supported. +In order to update the network parameters you will first need to manually remove the podman network and then restart the service. + +Using network units allows containers to depend on networks being automatically pre-created. This is +particularly interesting when using special options to control network creation, as Podman otherwise creates networks with the default options. + +Valid options for `[Network]` are listed below: + +| **[Network] options** | **podman network create equivalent** | +|-------------------------------------|--------------------------------------| +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| DisableDNS=true | --disable-dns | +| DNS=192.168.55.1 | --dns=192.168.55.1 | +| Driver=bridge | --driver bridge | +| Gateway=192.168.55.3 | --gateway 192.168.55.3 | +| GlobalArgs=--log-level=debug | --log-level=debug | +| Internal=true | --internal | +| IPAMDriver=dhcp | --ipam-driver dhcp | +| IPRange=192.168.55.128/25 | --ip-range 192.168.55.128/25 | +| IPv6=true | --ipv6 | +| Label="XYZ" | --label "XYZ" | +| NetworkName=foo | podman network create foo | +| Options=isolate=true | --opt isolate=true | +| PodmanArgs=--dns=192.168.55.1 | --dns=192.168.55.1 | +| Subnet=192.5.0.0/16 | --subnet 192.5.0.0/16 | + +Supported keys in `[Network]` section are: + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `DisableDNS=` (defaults to `false`) + +If enabled, disables the DNS plugin for this network. + +This is equivalent to the Podman `--disable-dns` option + +### `DNS=` + +Set network-scoped DNS resolver/nameserver for containers in this network. + +This key can be listed multiple times. + +### `Driver=` (defaults to `bridge`) + +Driver to manage the network. Currently `bridge`, `macvlan` and `ipvlan` are supported. + +This is equivalent to the Podman `--driver` option + +### `Gateway=` + +Define a gateway for the subnet. If you want to provide a gateway address, you must also provide a subnet option. + +This is equivalent to the Podman `--gateway` option + +This key can be listed multiple times. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `network` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Internal=` (defaults to `false`) + +Restrict external access of this network. + +This is equivalent to the Podman `--internal` option + +### `IPAMDriver=` + +Set the ipam driver (IP Address Management Driver) for the network. Currently `host-local`, `dhcp` and `none` are supported. + +This is equivalent to the Podman `--ipam-driver` option + +### `IPRange=` + +Allocate container IP from a range. The range must be a either a complete subnet in CIDR notation or be +in the `-` syntax which allows for a more flexible range compared to the CIDR subnet. +The ip-range option must be used with a subnet option. + +This is equivalent to the Podman `--ip-range` option + +This key can be listed multiple times. + +### `IPv6=` + +Enable IPv6 (Dual Stack) networking. + +This is equivalent to the Podman `--ipv6` option + +### `Label=` + +Set one or more OCI labels on the network. The format is a list of +`key=value` items, similar to `Environment`. + +This key can be listed multiple times. + +### `NetworkName=` + +The (optional) name of the Podman network. If this is not specified, the default value of +`systemd-%N` is used, which is the same as the unit name but with a `systemd-` prefix to avoid +conflicts with user-managed networks. + +### `Options=` + +Set driver specific options. + +This is equivalent to the Podman `--opt` option + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman network create` command +in the generated file (right before the name of the network in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Subnet=` + +The subnet in CIDR notation. + +This is equivalent to the Podman `--subnet` option + +This key can be listed multiple times. + +## Volume units [Volume] + +Volume files are named with a `.volume` extension and contain a section `[Volume]` describing the +named Podman volume. The generated service is a one-time command that ensures that the volume +exists on the host, creating it if needed. + +By default, the Podman volume has the same name as the unit, but with a `systemd-` prefix, i.e. for +a volume file named `$NAME.volume`, the generated Podman volume is called `systemd-$NAME`, and the +generated service file is `$NAME-volume.service`. The `VolumeName` option allows for overriding this +default name with a user-provided one. + +Using volume units allows containers to depend on volumes being automatically pre-created. This is +particularly interesting when using special options to control volume creation, +as Podman otherwise creates volumes with the default options. + +Valid options for `[Volume]` are listed below: + +| **[Volume] options** | **podman volume create equivalent** | +|-------------------------------------|-------------------------------------------| +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| Copy=true | --opt copy | +| Device=tmpfs | --opt device=tmpfs | +| Driver=image | --driver=image | +| GlobalArgs=--log-level=debug | --log-level=debug | +| Group=192 | --opt group=192 | +| Image=quay.io/centos/centos\:latest | --opt image=quay.io/centos/centos:latest | +| Label="foo=bar" | --label "foo=bar" | +| Options=XYZ | --opt "o=XYZ" | +| PodmanArgs=--driver=image | --driver=image | +| Type=type | Filesystem type of Device | +| User=123 | --opt uid=123 | +| VolumeName=foo | podman volume create foo | + +Supported keys in `[Volume]` section are: + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `Copy=` (default to `true`) + +If enabled, the content of the image located at the mountpoint of the volume is copied into the +volume on the first run. + +### `Device=` + +The path of a device which is mounted for the volume. + +### `Driver=` + +Specify the volume driver name. When set to `image`, the `Image` key must also be set. + +This is equivalent to the Podman `--driver` option. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `volume` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Group=` + +The host (numeric) GID, or group name to use as the group for the volume + +### `Image=` + +Specifies the image the volume is based on when `Driver` is set to the `image`. +It is recommended to use a fully qualified image name rather than a short name, both for +performance and robustness reasons. + +The format of the name is the same as when passed to `podman pull`. So, it supports using +`\:tag` or digests to guarantee the specific image version. + +Special case: + +* If the `name` of the image ends with `.image`, Quadlet will use the image +pulled by the corresponding `.image` file, and the generated systemd service contains a dependency on the `$name-image.service` (or the service name set in the .image file). Note: the corresponding `.image` file must exist. + +### `Label=` + +Set one or more OCI labels on the volume. The format is a list of +`key=value` items, similar to `Environment`. + +This key can be listed multiple times. + +### `Options=` + +The mount options to use for a filesystem as used by the **mount(8)** command `-o` option. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman volume create` command +in the generated file (right before the name of the volume in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Type=` + +The filesystem type of `Device` as used by the **mount(8)** commands `-t` option. + +### `User=` + +The host (numeric) UID, or user name to use as the owner for the volume + +### `VolumeName=` + +The (optional) name of the Podman volume. If this is not specified, the default value of +`systemd-%N` is used, which is the same as the unit name but with a `systemd-` prefix to avoid +conflicts with user-managed volumes. + +## Build units [Build] + +Build files are named with a `.build` extension and contain a section `[Build]` describing the image +build command. The generated service is a one-time command that ensures that the image is built on +the host from a supplied Containerfile and context directory. Subsequent (re-)starts of the +generated built service will usually finish quickly, as image layer caching will skip unchanged +build steps. + +A minimal `.build` unit needs at least the `ImageTag=` key, and either of `File=` or +`SetWorkingDirectory=` keys. + +Using build units allows containers and volumes to depend on images being built locally. This can be +interesting for creating container images not available on container registries, or for local +testing and development. + +Valid options for `[Build]` are listed below: + +| **[Build] options** | **podman build equivalent** | +|-------------------------------------|---------------------------------------------| +| Annotation=annotation=value | --annotation=annotation=value | +| Arch=aarch64 | --arch=aarch64 | +| AuthFile=/etc/registry/auth\.json | --authfile=/etc/registry/auth\.json | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| DNS=192.168.55.1 | --dns=192.168.55.1 | +| DNSOption=ndots:1 | --dns-option=ndots:1 | +| DNSSearch=example.com | --dns-search example.com | +| Environment=foo=bar | --env foo=bar | +| File=/path/to/Containerfile | --file=/path/to/Containerfile | +| ForceRM=false | --force-rm=false | +| GlobalArgs=--log-level=debug | --log-level=debug | +| GroupAdd=keep-groups | --group-add=keep-groups | +| ImageTag=localhost/imagename | --tag=localhost/imagename | +| Label=label | --label=label | +| Network=host | --network=host | +| PodmanArgs=--pull never | --pull never | +| Pull=never | --pull never | +| Secret=secret | --secret=id=mysecret,src=path | +| SetWorkingDirectory=unit | Set `WorkingDirectory` of systemd unit file | +| Target=my-app | --target=my-app | +| TLSVerify=false | --tls-verify=false | +| Variant=arm/v7 | --variant=arm/v7 | +| Volume=/source:/dest | --volume /source:/dest | + +### `Annotation=` + +Add an image *annotation* (e.g. annotation=*value*) to the image metadata. Can be used multiple +times. + +This is equivalent to the `--annotation` option of `podman build`. + +### `Arch=` + +Override the architecture, defaults to hosts', of the image to be built. + +This is equivalent to the `--arch` option of `podman build`. + +### `AuthFile=` + +Path of the authentication file. + +This is equivalent to the `--authfile` option of `podman build`. + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `DNS=` + +Set network-scoped DNS resolver/nameserver for the build container. + +This key can be listed multiple times. + +This is equivalent to the `--dns` option of `podman build`. + +### `DNSOption=` + +Set custom DNS options. + +This key can be listed multiple times. + +This is equivalent to the `--dns-option` option of `podman build`. + +### `DNSSearch=` + +Set custom DNS search domains. Use **DNSSearch=.** to remove the search domain. + +This key can be listed multiple times. + +This is equivalent to the `--dns-search` option of `podman build`. + +### `Environment=` + +Add a value (e.g. env=*value*) to the built image. This uses the same format as [services in +systemd](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Environment=) and can be +listed multiple times. + +### `File=` + +Specifies a Containerfile which contains instructions for building the image. A URL starting with +`http(s)://` allows you to specify a remote Containerfile to be downloaded. Note that for a given +relative path to a Containerfile, or when using a `http(s)://` URL, you also must set +`SetWorkingDirectory=` in order for `podman build` to find a valid context directory for the +resources specified in the Containerfile. + +Note that setting a `File=` field is mandatory for a `.build` file, unless `SetWorkingDirectory` (or +a `WorkingDirectory` in the `Service` group) has also been set. + +This is equivalent to the `--file` option of `podman build`. + +### `ForceRM=` + +Always remove intermediate containers after a build, even if the build fails (default true). + +This is equivalent to the `--force-rm` option of `podman build`. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `build` in the generated +file. It can be used to access Podman features otherwise unsupported by the generator. Since the +generator is unaware of what unexpected interactions can be caused by these arguments, it is not +recommended to use this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `GroupAdd=` + +Assign additional groups to the primary user running within the container process. Also supports the +`keep-groups` special flag. + +This is equivalent to the `--group-add` option of `podman build`. + +### `ImageTag=` + +Specifies the name which is assigned to the resulting image if the build process completes +successfully. + +This is equivalent to the `--tag` option of `podman build`. + +This key can be listed multiple times. The first instance will be used as the name of the created artifact when the `.build` file is referenced by another Quadlet unit. + +### `Label=` + +Add an image *label* (e.g. label=*value*) to the image metadata. Can be used multiple times. + +This is equivalent to the `--label` option of `podman build`. + +### `Network=` + +Sets the configuration for network namespaces when handling RUN instructions. This has the same +format as the `--network` option to `podman build`. For example, use `host` to use the host network, +or `none` to not set up networking. + +Special case: + +* If the `name` of the network ends with `.network`, Quadlet will look for the corresponding `.network` Quadlet unit. If found, Quadlet will use the name of the Network set in the Unit, otherwise, `systemd-$name` is used. The generated systemd service contains a dependency on the service unit generated for that `.network` unit, or on `$name-network.service` if the `.network` unit is not found. Note: the corresponding `.network` file must exist. + +This key can be listed multiple times. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman build` command +in the generated file (right before the image name in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Pull=` + +Set the image pull policy. + +This is equivalent to the `--pull` option of `podman build`. + +### `Secret=` + +Pass secret information used in Containerfile build stages in a safe way. + +This is equivalent to the `--secret` option of `podman build` and generally has the form +`secret[,opt=opt ...]`. + +### `SetWorkingDirectory=` + +Provide context (a working directory) to `podman build`. Supported values are a path, a URL, or the +special keys `file` or `unit` to set the context directory to the parent directory of the file from +the `File=` key or to that of the Quadlet `.build` unit file, respectively. This allows Quadlet to +resolve relative paths. + +When using one of the special keys (`file` or `unit`), the `WorkingDirectory` field of the `Service` +group of the Systemd service unit will also be set to accordingly. Alternatively, users can +explicitly set the `WorkingDirectory` field of the `Service` group in the `.build` file. Please note +that if the `WorkingDirectory` field of the `Service` group is set by the user, Quadlet will not +overwrite it even if `SetWorkingDirectory` is set to `file` or `unit`. + +By providing a URL to `SetWorkingDirectory=` you can instruct `podman build` to clone a Git +repository or download an archive file extracted to a temporary location by `podman build` as build +context. Note that in this case, the `WorkingDirectory` of the Systemd service unit is left +untouched by Quadlet. + +Note that providing context directory is mandatory for a `.build` file, unless a `File=` key has +also been provided. + +### `Target=` + +Set the target build stage to build. Commands in the Containerfile after the target stage are +skipped. + +This is equivalent to the `--target` option of `podman build`. + +### `TLSVerify=` + +Require HTTPS and verification of certificates when contacting registries. + +This is equivalent to the `--tls-verify` option of `podman build`. + +### `Variant=` + +Override the default architecture variant of the container image to be built. + +This is equivalent to the `--variant` option of `podman build`. + +### `Volume=` + +Mount a volume to containers when executing RUN instructions during the build. This is equivalent to +the `--volume` option of `podman build`, and generally has the form +`[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]`. + +If `SOURCE-VOLUME` starts with `.`, Quadlet resolves the path relative to the location of the unit file. + +Special case: + +* If `SOURCE-VOLUME` ends with `.volume`, Quadlet will look for the corresponding `.volume` Quadlet unit. If found, Quadlet will use the name of the Volume set in the Unit, otherwise, `systemd-$name` is used. The generated systemd service contains a dependency on the service unit generated for that `.volume` unit, or on `$name-volume.service` if the `.volume` unit is not found. Note: the corresponding `.volume` file must exist. + +This key can be listed multiple times. + +## Image units [Image] + +Image files are named with a `.image` extension and contain a section `[Image]` describing the +container image pull command. The generated service is a one-time command that ensures that the image +exists on the host, pulling it if needed. + +Using image units allows containers and volumes to depend on images being automatically pulled. This is +particularly interesting when using special options to control image pulls. + +Valid options for `[Image]` are listed below: + +| **[Image] options** | **podman image pull equivalent** | +|----------------------------------------|--------------------------------------------------| +| AllTags=true | --all-tags | +| Arch=aarch64 | --arch=aarch64 | +| AuthFile=/etc/registry/auth\.json | --authfile=/etc/registry/auth\.json | +| CertDir=/etc/registry/certs | --cert-dir=/etc/registry/certs | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| Creds=myname\:mypassword | --creds=myname\:mypassword | +| DecryptionKey=/etc/registry\.key | --decryption-key=/etc/registry\.key | +| GlobalArgs=--log-level=debug | --log-level=debug | +| Image=quay\.io/centos/centos\:latest | podman image pull quay.io/centos/centos\:latest | +| ImageTag=quay\.io/centos/centos\:latest | Use this name when resolving `.image` references | +| OS=windows | --os=windows | +| PodmanArgs=--os=linux | --os=linux | +| TLSVerify=false | --tls-verify=false | +| Variant=arm/v7 | --variant=arm/v7 | + +### `AllTags=` + +All tagged images in the repository are pulled. + +This is equivalent to the Podman `--all-tags` option. + +### `Arch=` + +Override the architecture, defaults to hosts, of the image to be pulled. + +This is equivalent to the Podman `--arch` option. + +### `AuthFile=` + +Path of the authentication file. + +This is equivalent to the Podman `--authfile` option. + +### `CertDir=` + +Use certificates at path (*.crt, *.cert, *.key) to connect to the registry. + +This is equivalent to the Podman `--cert-dir` option. + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `Creds=` + +The `[username[:password]]` to use to authenticate with the registry, if required. + +This is equivalent to the Podman `--creds` option. + +### `DecryptionKey=` + +The `[key[:passphrase]]` to be used for decryption of images. + +This is equivalent to the Podman `--decryption-key` option. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `image` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Image=` + +The image to pull. +It is recommended to use a fully qualified image name rather than a short name, both for +performance and robustness reasons. + +The format of the name is the same as when passed to `podman pull`. So, it supports using +`:tag` or digests to guarantee the specific image version. + +### `ImageTag=` + +Actual FQIN of the referenced `Image`. +Only meaningful when source is a file or directory archive. + +For example, an image saved into a `docker-archive` with the following Podman command: + +`podman image save --format docker-archive --output /tmp/archive-file.tar quay.io/podman/stable:latest` + +requires setting +- `Image=docker-archive:/tmp/archive-file.tar` +- `ImageTag=quay.io/podman/stable\:latest` + +### `OS=` + +Override the OS, defaults to hosts, of the image to be pulled. + +This is equivalent to the Podman `--os` option. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman image pull` command +in the generated file (right before the image name in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `TLSVerify=` + +Require HTTPS and verification of certificates when contacting registries. + +This is equivalent to the Podman `--tls-verify` option. + +### `Variant=` + +Override the default architecture variant of the container image. + +This is equivalent to the Podman `--variant` option. + +## Quadlet section [Quadlet] +Some quadlet specific configuration is shared between different unit types. Those settings +can be configured in the `[Quadlet]` section. + +Valid options for `[Quadlet]` are listed below: + +| **[Quadlet] options** | **Description** | +|----------------------------|---------------------------------------------------| +| DefaultDependencies=false | Disable implicit network dependencies to the unit | + +### `DefaultDependencies=` + +Add Quadlet's default network dependencies to the unit (default is `true`). + +When set to false, Quadlet will **not** add a dependency (After=, Wants=) to +`network-online.target`/`podman-user-wait-network-online.service` to the generated unit. + +## EXAMPLES + +Example `test.container`: + +``` +[Unit] +Description=A minimal container + +[Container] +# Use the centos image +Image=quay.io/centos/centos:latest + +# Use volume and network defined below +Volume=test.volume:/data +Network=test.network + +# In the container we just run sleep +Exec=sleep 60 + +[Service] +# Restart service when sleep finishes +Restart=always +# Extend Timeout to allow time to pull the image +TimeoutStartSec=900 +# ExecStartPre flag and other systemd commands can go here, see systemd.unit(5) man page. +ExecStartPre=/usr/share/mincontainer/setup.sh + +[Install] +# Start by default on boot +WantedBy=multi-user.target default.target +``` + +Example `test.kube`: +``` +[Unit] +Description=A kubernetes yaml based service +Before=local-fs.target + +[Kube] +Yaml=/opt/k8s/deployment.yml + +[Install] +# Start by default on boot +WantedBy=multi-user.target default.target +``` + +Example for locally built image to be used in a container: + +`test.build` +``` +[Build] +# Tag the image to be built +ImageTag=localhost/imagename + +# Set the working directory to the path of the unit file, +# expecting to find a Containerfile/Dockerfile +# + other files needed to build the image +SetWorkingDirectory=unit +``` + +`test.container` +``` +[Container] +Image=test.build +``` + +Example `test.volume`: + +``` +[Volume] +User=root +Group=root +Label=org.test.Key=value +``` + +Example `test.network`: +``` +[Network] +Subnet=172.16.0.0/24 +Gateway=172.16.0.1 +IPRange=172.16.0.0/28 +Label=org.test.Key=value +``` + +Example for Container in a Pod: + +`test.pod` +``` +[Pod] +PodName=test +``` + +`centos.container` +``` +[Container] +Image=quay.io/centos/centos\:latest +Exec=sh -c "sleep inf" +Pod=test.pod +``` + +Example `s3fs.volume`: + +For further details, please see the [s3fs-fuse](https://github.com/s3fs-fuse/s3fs-fuse) project. +Remember to read the [FAQ](https://github.com/s3fs-fuse/s3fs-fuse/wiki/FAQ) + +> NOTE: Enabling the cache massively speeds up access and write times on static files/objects. + +> However, `use_cache` is [UNBOUNDED](https://github.com/s3fs-fuse/s3fs-fuse/wiki/FAQ#q-how-does-the-local-file-cache-work)! + +> Be careful, it will fill up with any files accessed on the s3 bucket through the file system. + +Please remember to set `S3_BUCKET`, `PATH`, `AWS_REGION`. `CACHE_DIRECTORY` should be set up by [systemd](https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#RuntimeDirectory=) + +``` +[Service] +CacheDirectory=s3fs +ExecStartPre=/usr/local/bin/aws s3api put-object --bucket ${S3_BUCKET} --key ${PATH}/ + +[Volume] +Device=${S3_BUCKET}:/${PATH} +Type=fuse.s3fs +VolumeName=s3fs-volume +Options=iam_role,endpoint=${AWS_REGION},use_xattr,listobjectsv2,del_cache,use_cache=${CACHE_DIRECTORY} +# `iam_role` assumes inside EC2, if not, Use `profile=` instead +``` + +## SEE ALSO +**[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)**, +**[systemd.service(5)](https://www.freedesktop.org/software/systemd/man/systemd.service.html)**, +**[systemd-analyze(1)](https://www.freedesktop.org/software/systemd/man/latest/systemd-analyze.html)**, +**[podman-run(1)](podman-run.1.md)**, +**[podman-network-create(1)](podman-network-create.1.md)**, +**[podman-auto-update(1)](podman-auto-update.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-tag.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-tag.1.md new file mode 100644 index 000000000..3e7224300 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-tag.1.md @@ -0,0 +1,51 @@ +--- +title: podman-tag +version: v5.4.2 +--- + +% podman-tag 1 + +## NAME +podman\-tag - Add an additional name to a local image + +## SYNOPSIS +**podman tag** *image*[:*tag*] [*target-name*[:*tag*]...] [*options*] + +**podman image tag** *image*[:*tag*] [*target-name*[:*tag*]...] [*options*] + +## DESCRIPTION +Assigns a new image name to an existing image. A full name refers to the entire +image name, including the optional *tag* after the `:`. If there is no *tag* +provided, then Podman defaults to `latest` for both the *image* and the +*target-name*. + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Tag specified image with an image name defaulting to :latest. +``` +$ podman tag 0e3bbc2 fedora:latest +``` + +Tag specified image with fully specified image name. +``` +$ podman tag httpd myregistryhost:5000/fedora/httpd\:v2 +``` + +Tag specified image with multiple tags. +``` +$ podman tag mymariadb mycontainerregistry.io/namespace/mariadb:10 mycontainerregistry.io/namespace/mariadb:10.11 mycontainerregistry.io/namespace/mariadb:10.11.12 +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +December 2019, Update description to refer to 'name' instead of 'alias' by Sascha Grunert +July 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-top.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-top.1.md new file mode 100644 index 000000000..b8128192d --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-top.1.md @@ -0,0 +1,125 @@ +--- +title: podman-top +version: v5.4.2 +--- + +% podman-top 1 + +## NAME +podman\-top - Display the running processes of a container + +## SYNOPSIS +**podman top** [*options*] *container* [*format-descriptors*] + +**podman container top** [*options*] *container* [*format-descriptors*] + +## DESCRIPTION +Display the running processes of the container. The *format-descriptors* are ps (1) compatible AIX format +descriptors but extended to print additional information, such as the seccomp mode or the effective capabilities +of a given process. The descriptors can either be passed as separated arguments or as a single comma-separated +argument. Note that options and or flags of ps(1) can also be specified; in this case, Podman falls back to +executing ps(1) from the host with the specified arguments and flags in the container namespace. If the container +has the `CAP_SYS_PTRACE` capability then we will execute ps(1) in the container so it must be installed there. +To extract host-related information, use the "h*" descriptors. For instance, `podman top $name hpid huser` +to display the PID and user of the processes in the host context. + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## FORMAT DESCRIPTORS + +The following descriptors are supported in addition to the AIX format descriptors mentioned in ps (1): + +**args, capbnd, capeff, capinh, capprm, comm, etime, group, hgroup, hpid, huser, label, nice, pcpu, pgid, pid, ppid, rgroup, ruser, seccomp, state, time, tty, user, vsz** + +**capbnd** + + Set of bounding capabilities. See capabilities (7) for more information. + +**capeff** + + Set of effective capabilities. See capabilities (7) for more information. + +**capinh** + + Set of inheritable capabilities. See capabilities (7) for more information. + +**capprm** + + Set of permitted capabilities. See capabilities (7) for more information. + +**hgroup** + + The corresponding effective group of a container process on the host. + +**hpid** + + The corresponding host PID of a container process. + +**huser** + + The corresponding effective user of a container process on the host. + +**label** + + Current security attributes of the process. + +**seccomp** + + Seccomp mode of the process (i.e., disabled, strict or filter). See seccomp (2) for more information. + +**state** + + Process state codes (e.g, **R** for *running*, **S** for *sleeping*). See proc(5) for more information. + +**stime** + + Process start time (e.g, "2019-12-09 10:50:36 +0100 CET). + +## EXAMPLES + +By default, `podman-top` prints data similar to `ps -ef`. +``` +$ podman top f5a62a71b07 +USER PID PPID %CPU ELAPSED TTY TIME COMMAND +root 1 0 0.000 20.386825206s pts/0 0s sh +root 7 1 0.000 16.386882887s pts/0 0s sleep +root 8 1 0.000 11.386886562s pts/0 0s vi +``` + +The output can be controlled by specifying format descriptors as arguments after the container. +``` +$ podman top -l pid seccomp args %C +PID SECCOMP COMMAND %CPU +1 filter sh 0.000 +8 filter vi /etc/ 0.000 +``` + +Podman falls back to executing ps(1) from the host in the container namespace if an unknown descriptor is specified. +``` +$ podman top -l -- aux +USER PID PPID %CPU ELAPSED TTY TIME COMMAND +root 1 0 0.000 1h2m12.497061672s ? 0s sleep 100000 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **ps(1)**, **seccomp(2)**, **proc(5)**, **capabilities(7)** + +## HISTORY +July 2018, Introduce format descriptors by Valentin Rothberg + +December 2017, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-troubleshooting.7.md b/versioned_docs/version-5.4.2/source/markdown/podman-troubleshooting.7.md new file mode 100644 index 000000000..e429330f2 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-troubleshooting.7.md @@ -0,0 +1,1552 @@ +--- +title: Troubleshooting +version: v5.4.2 +--- + +% podman-troubleshooting 7 + + +# Troubleshooting + +## A list of common issues and solutions for Podman + +--- +### 1) Variety of issues - Validate Version + +A large number of issues reported against Podman are often found to already be fixed +in more current versions of the project. Before reporting an issue, please verify the +version you are running with `podman version` and compare it to the latest release +documented on the top of Podman's [README.md](README.md). + +If they differ, please update your version of PODMAN to the latest possible +and retry your command before reporting the issue. + +--- +### 2) Can't use volume mount, get permission denied + +```console +$ podman run -v ~/mycontent:/content fedora touch /content/file +touch: cannot touch '/content/file': Permission denied +``` + +#### Solution + +This is sometimes caused by SELinux, and sometimes by user namespaces. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, you can add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two containers +share the volume content. As a result, Podman labels the content with a shared +content label. Shared volume labels allow all containers to read/write content. +The **Z** option tells Podman to label the content with a private unshared label. +Only the current container can use a private volume. + +```console +$ podman run -v ~/mycontent:/content\:Z fedora touch /content/file +``` + +Make sure the content is private for the container. Do not relabel system directories and content. +Relabeling system content might cause other confined services on your machine to fail. For these +types of containers we recommend having SELinux separation disabled. The option `--security-opt label=disable` +will disable SELinux separation for the container. + +```console +$ podman run --security-opt label=disable -v ~:/home/user fedora touch /home/user/file +``` + +In cases where the container image runs as a specific, non-root user, though, the +solution is to fix the user namespace. This would include container images such as +the Jupyter Notebook image (which runs as "jovyan") and the Postgres image (which runs +as "postgres"). In either case, use the `--userns` switch to map user namespaces, +most of the time by using the **keep-id** option. + +```console +$ podman run -v "$PWD":/home/jovyan/work --userns=keep-id jupyter/scipy-notebook +``` + +--- +### 3) No such image or Bare keys cannot contain ':' + +When doing a `podman pull` or `podman build` command and a "common" image cannot be pulled, +it is likely that the `/etc/containers/registries.conf` file is either not installed or possibly +misconfigured. + +#### Symptom + +```console +$ sudo podman build -f Dockerfile +STEP 1: FROM alpine +error building: error creating build container: no such image "alpine" in registry: image not known +``` + +or + +```console +$ sudo podman pull fedora +error pulling image "fedora": unable to pull fedora: error getting default registries to try: Near line 9 (last key parsed ''): Bare keys cannot contain ':'. +``` + +#### Solution + + * Verify that the `/etc/containers/registries.conf` file exists. If not, verify that the containers-common package is installed. + * Verify that the entries in the `unqualified-search-registries` list of the `/etc/containers/registries.conf` file are valid and reachable. + * i.e. `unqualified-search-registries = ["registry.fedoraproject.org", "quay.io", "registry.access.redhat.com"]` + +--- +### 4) http: server gave HTTP response to HTTPS client + +When doing a Podman command such as `build`, `commit`, `pull`, or `push` to a registry, +TLS verification is turned on by default. If encryption is not used with +those commands, this error can occur. + +#### Symptom + +```console +$ sudo podman push alpine docker://localhost:5000/myalpine\:latest +Getting image source signatures +Get https://localhost:5000/v2/: http: server gave HTTP response to HTTPS client +``` + +#### Solution + +By default TLS verification is turned on when communicating to registries from +Podman. If the registry does not require encryption the Podman commands +such as `build`, `commit`, `pull` and `push` will fail unless TLS verification is turned +off using the `--tls-verify` option. **NOTE:** It is not at all recommended to +communicate with a registry and not use TLS verification. + + * Turn off TLS verification by passing false to the tls-verify option. + * I.e. `podman push --tls-verify=false alpine docker://localhost:5000/myalpine\:latest` + + +For a global workaround, users[1] can create the file `/etc/containers/registries.conf.d/registry-NAME.conf` +(replacing NAME with the name of this registry) with the following content (replacing FULLY.QUALIFIED.NAME.OF.REGISTRY with the address of this registry): + +``` +[[registry]] +location = "FULLY.QUALIFIED.NAME.OF.REGISTRY" +insecure = true +``` + +[1] If you are using a Mac / Windows, you should execute `podman machine ssh` to login into podman machine before adding the insecure entry to the registry—conf file. + +**This is an insecure method and should be used cautiously.** + +--- +### 5) rootless containers cannot ping hosts + +When using the ping command from a non-root container, the command may +fail because of a lack of privileges. + +#### Symptom + +```console +$ podman run --rm fedora ping -W10 -c1 redhat.com +PING redhat.com (209.132.183.105): 56 data bytes + +--- redhat.com ping statistics --- +1 packets transmitted, 0 packets received, 100% packet loss +``` + +#### Solution + +It is most likely necessary to enable unprivileged pings on the host. +Be sure the UID of the user is part of the range in the +`/proc/sys/net/ipv4/ping_group_range` file. + +To change its value you can use something like: + +```console +# sysctl -w "net.ipv4.ping_group_range=0 2000000" +``` + +To make the change persistent, you'll need to add a file in +`/etc/sysctl.d` that contains `net.ipv4.ping_group_range=0 $MAX_UID`. + +--- +### 6) Build hangs when the Dockerfile contains the useradd command + +When the Dockerfile contains a command like `RUN useradd -u 99999000 -g users newuser` the build can hang. + +#### Symptom + +If you are using a useradd command within a Dockerfile with a large UID/GID, it will create a large sparse file `/var/log/lastlog`. This can cause the build to hang forever. Go language does not support sparse files correctly, which can lead to some huge files being created in your container image. + +#### Solution + +If the entry in the Dockerfile looked like: RUN useradd -u 99999000 -g users newuser then add the `--no-log-init` parameter to change it to: `RUN useradd --no-log-init -u 99999000 -g users newuser`. This option tells useradd to stop creating the lastlog file. + +### 7) Permission denied when running Podman commands + +When rootless Podman attempts to execute a container on a non exec home directory a permission error will be raised. + +#### Symptom + +If you are running Podman or Buildah on a home directory that is mounted noexec, +then they will fail with a message like: + +```console +$ podman run centos:7 +standard_init_linux.go:203: exec user process caused "permission denied" +``` + +#### Solution + +Since the administrator of the system set up your home directory to be noexec, you will not be allowed to execute containers from storage in your home directory. It is possible to work around this by manually specifying a container storage path that is not on a noexec mount. Simply copy the file /etc/containers/storage.conf to ~/.config/containers/ (creating the directory if necessary). Specify a graphroot directory which is not on a noexec mount point and to which you have read/write privileges. You will need to modify other fields to writable directories as well. + +For example + +```console +$ cat ~/.config/containers/storage.conf +[storage] + driver = "overlay" + runroot = "/run/user/1000" + graphroot = "/execdir/myuser/storage" + [storage.options] + mount_program = "/bin/fuse-overlayfs" +``` + +### 8) Permission denied when running systemd within a Podman container + +When running systemd as PID 1 inside of a container on an SELinux +separated machine, it needs to write to the cgroup file system. + +#### Symptom + +Systemd gets permission denied when attempting to write to the cgroup file +system, and AVC messages start to show up in the audit.log file or journal on +the system. + +#### Solution + +Newer versions of Podman (2.0 or greater) support running init based containers +with a different SELinux labels, which allow the container process access to the +cgroup file system. This feature requires container-selinux-2.132 or newer +versions. + +Prior to Podman 2.0, the SELinux boolean `container_manage_cgroup` allows +container processes to write to the cgroup file system. Turn on this boolean, +on SELinux separated systems, to allow systemd to run properly in the container. +Only do this on systems running older versions of Podman. + +```console +# setsebool -P container_manage_cgroup true +``` + +### 9) Newuidmap missing when running rootless Podman commands + +Rootless Podman requires the newuidmap and newgidmap programs to be installed. + +#### Symptom + +If you are running Podman or Buildah as a rootless user, you get an error complaining about +a missing newuidmap executable. + +```console +$ podman run -ti fedora sh +command required for rootless mode with multiple IDs: exec: "newuidmap": executable file not found in $PATH +``` + +#### Solution + +Install a version of shadow-utils that includes these executables. Note that for RHEL and CentOS 7, at least the 7.7 release must be installed for support to be available. + +### 10) rootless setup user: invalid argument + +Rootless Podman requires the user running it to have a range of UIDs listed in /etc/subuid and /etc/subgid. + +#### Symptom + +A user, either via --user or through the default configured for the image, is not mapped inside the namespace. + +```console +$ podman run --rm -ti --user 1000000 alpine echo hi +Error: container create failed: container_linux.go:344: starting container process caused "setup user: invalid argument" +``` + +#### Solution + +Update the /etc/subuid and /etc/subgid with fields for users that look like: + +```console +$ cat /etc/subuid +johndoe:100000:65536 +test:165536:65536 +``` + +The format of this file is `USERNAME\:UID\:RANGE` + +* username as listed in `/etc/passwd` or `getpwent`. +* The initial uid allocated for the user. +* The size of the range of UIDs allocated for the user. + +This means johndoe is allocated UIDs 100000-165535 as well as his standard UID in the +`/etc/passwd` file. + +You should ensure that each user has a unique range of UIDs, because overlapping UIDs, +would potentially allow one user to attack another user. In addition, make sure +that the range of UIDs you allocate can cover all UIDs that the container +requires. For example, if the container has a user with UID 10000, ensure you +have at least 10000 subuids, and if the container needs to be run as a user with +UID 1000000, ensure you have at least 1000000 subuids. + +You could also use the `usermod` program to assign UIDs to a user. + +If you update either the `/etc/subuid` or `/etc/subgid` file, you need to +stop all running containers and kill the pause process. This is done +automatically by the `system migrate` command, which can also be used +to stop all the containers and kill the pause process. + +```console +# usermod --add-subuids 200000-201000 --add-subgids 200000-201000 johndoe +# grep johndoe /etc/subuid /etc/subgid +/etc/subuid:johndoe:200000:1001 +/etc/subgid:johndoe:200000:1001 +``` + +### 11) Changing the location of the Graphroot leads to permission denied + +When I change the graphroot storage location in storage.conf, the next time I +run Podman, I get an error like: + +```console +# podman run -p 5000:5000 -it centos bash + +bash: error while loading shared libraries: /lib64/libc.so.6: cannot apply additional memory protection after relocation: Permission denied +``` + +For example, the admin sets up a spare disk to be mounted at `/src/containers`, +and points storage.conf at this directory. + + +#### Symptom + +SELinux blocks containers from using arbitrary locations for overlay storage. +These directories need to be labeled with the same labels as if the content was +under `/var/lib/containers/storage`. + +#### Solution + +Tell SELinux about the new containers storage by setting up an equivalence record. +This tells SELinux to label content under the new path, as if it was stored +under `/var/lib/containers/storage`. + +```console +# semanage fcontext -a -e /var/lib/containers /srv/containers +# restorecon -R -v /srv/containers +``` + +The semanage command above tells SELinux to set up the default labeling of +`/srv/containers` to match `/var/lib/containers`. The `restorecon` command +tells SELinux to apply the labels to the actual content. + +Now all new content created in these directories will automatically be created +with the correct label. + +### 12) Anonymous image pull fails with 'invalid username/password' + +Pulling an anonymous image that doesn't require authentication can result in an +`invalid username/password` error. + +#### Symptom + +If you pull an anonymous image, one that should not require credentials, you can receive +an `invalid username/password` error if you have credentials established in the +authentication file for the target container registry that are no longer valid. + +```console +$ podman run -it --rm docker://docker.io/library/alpine:latest ls +Trying to pull docker://docker.io/library/alpine:latest...ERRO[0000] Error pulling image ref //alpine:latest: Error determining manifest MIME type for docker://alpine:latest: unable to retrieve auth token: invalid username/password +Failed +Error: unable to pull docker://docker.io/library/alpine:latest: unable to pull image: Error determining manifest MIME type for docker://alpine:latest: unable to retrieve auth token: invalid username/password +``` + +This can happen if the authentication file is modified 'by hand' or if the credentials +are established locally and then the password is updated later in the container registry. + +#### Solution + +Depending upon which container tool was used to establish the credentials, use `podman logout` +or `docker logout` to remove the credentials from the authentication file. + +### 13) Running Podman inside a container causes container crashes and inconsistent states + +Running Podman in a container and forwarding some, but not all, of the required host directories can cause inconsistent container behavior. + +#### Symptom + +After creating a container with Podman's storage directories mounted in from the host and running Podman inside a container, all containers show their state as "configured" or "created", even if they were running or stopped. + +#### Solution + +When running Podman inside a container, it is recommended to mount at a minimum `/var/lib/containers/storage/` as a volume. +Typically, you will not mount in the host version of the directory, but if you wish to share containers with the host, you can do so. +If you do mount in the host's `/var/lib/containers/storage`, however, you must also mount in the host's `/run/libpod` and `/run/containers/storage` directories. +Not doing this will cause Podman in the container to detect that temporary files have been cleared, leading it to assume a system restart has taken place. +This can cause Podman to reset container states and lose track of running containers. + +For running containers on the host from inside a container, we also recommend the [Podman remote client](docs/tutorials/remote_client.md), which only requires a single socket to be mounted into the container. + +### 14) Rootless 'podman build' fails EPERM on NFS: + +NFS enforces file creation on different UIDs on the server side and does not understand user namespace, which rootless Podman requires. +When a container root process like YUM attempts to create a file owned by a different UID, NFS Server denies the creation. +NFS is also a problem for the file locks when the storage is on it. Other distributed file systems (for example: Lustre, Spectrum Scale, the General Parallel File System (GPFS)) are also not supported when running in rootless mode as these file systems do not understand user namespace. + +#### Symptom +```console +$ podman build . +ERRO[0014] Error while applying layer: ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied +error creating build container: Error committing the finished image: error adding layer with blob "sha256\:a02a4930cb5d36f3290eb84f4bfa30668ef2e9fe3a1fb73ec015fc58b9958b17": ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied +``` + +#### Solution +Choose one of the following: + * Set up containers/storage in a different directory, not on an NFS share. + * Create a directory on a local file system. + * Edit `~/.config/containers/containers.conf` and point the `volume_path` option to that local directory. (Copy `/usr/share/containers/containers.conf` if `~/.config/containers/containers.conf` does not exist) + * Otherwise just run Podman as root, via `sudo podman` + +### 15) Rootless 'podman build' fails when using OverlayFS: + +The Overlay file system (OverlayFS) requires the ability to call the `mknod` command when creating whiteout files +when extracting an image. However, a rootless user does not have the privileges to use `mknod` in this capacity. + +#### Symptom +```console +$ podman build --storage-driver overlay . +STEP 1: FROM docker.io/ubuntu\:xenial +Getting image source signatures +Copying blob edf72af6d627 done +Copying blob 3e4f86211d23 done +Copying blob 8d3eac894db4 done +Copying blob f7277927d38a done +Copying config 5e13f8dd4c done +Writing manifest to image destination +Storing signatures +Error: creating build container: Error committing the finished image: error adding layer with blob "sha256:8d3eac894db4dc4154377ad28643dfe6625ff0e54bcfa63e0d04921f1a8ef7f8": Error processing tar file(exit status 1): operation not permitted +$ podman build . +ERRO[0014] Error while applying layer: ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied +error creating build container: Error committing the finished image: error adding layer with blob "sha256\:a02a4930cb5d36f3290eb84f4bfa30668ef2e9fe3a1fb73ec015fc58b9958b17": ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied +``` + +#### Solution +Choose one of the following: + * Complete the build operation as a privileged user. + * Install and configure fuse-overlayfs. + * Install the fuse-overlayfs package for your Linux Distribution. + * Add `mount_program = "/usr/bin/fuse-overlayfs"` under `[storage.options]` in your `~/.config/containers/storage.conf` file. + +### 16) RHEL 7 and CentOS 7 based `init` images don't work with cgroup v2 + +The systemd version shipped in RHEL 7 and CentOS 7 doesn't have support for cgroup v2. Support for cgroup v2 requires version 230 of systemd or newer, which +was never shipped or supported on RHEL 7 or CentOS 7. + +#### Symptom +```console +# podman run --name test -d registry.access.redhat.com/rhel7-init\:latest && sleep 10 && podman exec test systemctl status +c8567461948439bce72fad3076a91ececfb7b14d469bfa5fbc32c6403185beff +Failed to get D-Bus connection: Operation not permitted +Error: non zero exit code: 1: OCI runtime error +``` + +#### Solution +You'll need to either: + +* configure the host to use cgroup v1. On Fedora you can do: + +```console +# dnf install -y grubby +# grubby --update-kernel=ALL --args=”systemd.unified_cgroup_hierarchy=0" +# reboot +``` + +* update the image to use an updated version of systemd. + +### 17) rootless containers exit once the user session exits + +You need to set lingering mode through loginctl to prevent user processes to be killed once +the user session completed. + +#### Symptom + +Once the user logs out all the containers exit. + +#### Solution + +```console +# loginctl enable-linger $UID +``` + +### 18) `podman run` fails with "bpf create: permission denied error" + +The Kernel Lockdown patches deny eBPF programs when Secure Boot is enabled in the BIOS. [Matthew Garrett's post](https://mjg59.dreamwidth.org/50577.html) describes the relationship between Lockdown and Secure Boot and [Jan-Philip Gehrcke's](https://gehrcke.de/2019/09/running-an-ebpf-program-may-require-lifting-the-kernel-lockdown/) connects this with eBPF. [RH bug 1768125](https://bugzilla.redhat.com/show_bug.cgi?id=1768125) contains some additional details. + +#### Symptom + +Attempts to run podman result in + +```Error: bpf create : Operation not permitted: OCI runtime permission denied error``` + +#### Solution + +One workaround is to disable Secure Boot in your BIOS. + +### 19) error creating libpod runtime: there might not be enough IDs available in the namespace + +Unable to pull images + +#### Symptom + +```console +$ podman unshare cat /proc/self/uid_map + 0 1000 1 +``` + +#### Solution + +```console +$ podman system migrate +``` + +Original command now returns + +```console +$ podman unshare cat /proc/self/uid_map + 0 1000 1 + 1 100000 65536 +``` + +Reference [subuid](https://man7.org/linux/man-pages/man5/subuid.5.html) and [subgid](https://man7.org/linux/man-pages/man5/subgid.5.html) man pages for more detail. + +### 20) Passed-in devices or files can't be accessed in rootless container + +As a non-root user you have group access rights to a device or files that you +want to pass into a rootless container with `--device=...` or `--volume=...` + +#### Symptom + +Any access inside the container is rejected with "Permission denied". + +#### Solution + +The runtime uses `setgroups(2)` hence the process loses all additional groups +the non-root user has. Use the `--group-add keep-groups` flag to pass the +user's supplementary group access into the container. Currently only available +with the `crun` OCI runtime. + +### 21) A rootless container running in detached mode is closed at logout + + +When running a container with a command like `podman run --detach httpd` as +a rootless user, the container is closed upon logout and is not kept running. + +#### Symptom + +When logging out of a rootless user session, all containers that were started +in detached mode are stopped and are not kept running. As the root user, these +same containers would survive the logout and continue running. + +#### Solution + +When systemd notes that a session that started a Podman container has exited, +it will also stop any containers that have been associated with it. To avoid +this, use the following command before logging out: `loginctl enable-linger`. +To later revert the linger functionality, use `loginctl disable-linger`. + +LOGINCTL(1), SYSTEMD(1) + +### 22) Containers default detach keys conflict with shell history navigation + +Podman defaults to `ctrl-p,ctrl-q` to detach from a running containers. The +bash and zsh shells default to `ctrl-p` for the displaying of the previous +command. This causes issues when running a shell inside of a container. + +#### Symptom + +With the default detach key combo ctrl-p,ctrl-q, shell history navigation +(tested in bash and zsh) using ctrl-p to access the previous command will not +display this previous command, or anything else. Conmon is waiting for an +additional character to see if the user wants to detach from the container. +Adding additional characters to the command will cause it to be displayed along +with the additional character. If the user types ctrl-p a second time the shell +display the 2nd to last command. + +#### Solution + +The solution to this is to change the default detach_keys. For example in order +to change the defaults to `ctrl-q,ctrl-q` use the `--detach-keys` option. + +```console +$ podman run -ti --detach-keys ctrl-q,ctrl-q fedora sh +``` + +To make this change the default for all containers, users can modify the +containers.conf file. This can be done simply in your home directory, but adding the +following lines to users containers.conf + +```console +$ cat >> ~/.config/containers/containers.conf << _eof +[engine] +detach_keys="ctrl-q,ctrl-q" +_eof +``` + +In order to effect root running containers and all users, modify the system +wide defaults in `/etc/containers/containers.conf`. + + +### 23) Container with exposed ports won't run in a pod + +A container with ports that have been published with the `--publish` or `-p` option +can not be run within a pod. + +#### Symptom + +```console +$ podman pod create --name srcview -p 127.0.0.1:3434:3434 -p 127.0.0.1:7080:7080 -p 127.0.0.1:3370:3370 4b2f4611fa2cbd60b3899b936368c2b3f4f0f68bc8e6593416e0ab8ecb0a3f1d + +$ podman run --pod srcview --name src-expose -p 3434:3434 -v "${PWD}:/var/opt/localrepo":Z,ro sourcegraph/src-expose:latest serve /var/opt/localrepo +Error: cannot set port bindings on an existing container network namespace +``` + +#### Solution + +This is a known limitation. If a container will be run within a pod, it is not necessary +to publish the port for the containers in the pod. The port must only be published by the +pod itself. Pod network stacks act like the network stack on the host - you have a +variety of containers in the pod, and programs in the container, all sharing a single +interface and IP address, and associated ports. If one container binds to a port, no other +container can use that port within the pod while it is in use. Containers in the pod can +also communicate over localhost by having one container bind to localhost in the pod, and +another connect to that port. + +In the example from the symptom section, dropping the `-p 3434:3434` would allow the +`podman run` command to complete, and the container as part of the pod would still have +access to that port. For example: + +```console +$ podman run --pod srcview --name src-expose -v "${PWD}:/var/opt/localrepo":Z,ro sourcegraph/src-expose:latest serve /var/opt/localrepo +``` + +### 24) Podman container images fail with `fuse: device not found` when run + +Some container images require that the fuse kernel module is loaded in the kernel +before they will run with the fuse filesystem in play. + +#### Symptom + +When trying to run the container images found at quay.io/podman, quay.io/containers +registry.access.redhat.com/ubi8 or other locations, an error will sometimes be returned: + + +``` +ERRO error unmounting /var/lib/containers/storage/overlay/30c058cdadc888177361dd14a7ed7edab441c58525b341df321f07bc11440e68/merged: invalid argument +error mounting container "1ae176ca72b3da7c70af31db7434bcf6f94b07dbc0328bc7e4e8fc9579d0dc2e": error mounting build container "1ae176ca72b3da7c70af31db7434bcf6f94b07dbc0328bc7e4e8fc9579d0dc2e": error creating overlay mount to /var/lib/containers/storage/overlay/30c058cdadc888177361dd14a7ed7edab441c58525b341df321f07bc11440e68/merged: using mount program /usr/bin/fuse-overlayfs: fuse: device not found, try 'modprobe fuse' first +fuse-overlayfs: cannot mount: No such device +: exit status 1 +ERRO exit status 1 +``` + +#### Solution + +If you encounter a `fuse: device not found` error when running the container image, it is likely that +the fuse kernel module has not been loaded on your host system. Use the command `modprobe fuse` to load the +module and then run the container image afterwards. To enable this automatically at boot time, you can add a configuration +file to `/etc/modules.load.d`. See `man modules-load.d` for more details. + +### 25) podman run --rootfs link/to//read/only/dir does not work + +An error such as "OCI runtime error" on a read-only filesystem or the error "{image} is not an absolute path or is a symlink" are often times indicators for this issue. For more details, review this [issue]( +https://github.com/containers/podman/issues/5895). + +#### Symptom + +Rootless Podman requires certain files to exist in a file system in order to run. +Podman will create /etc/resolv.conf, /etc/hosts and other file descriptors on the rootfs in order +to mount volumes on them. + +#### Solution + +Run the container once in read/write mode, Podman will generate all of the FDs on the rootfs, and +from that point forward you can run with a read-only rootfs. + +```console +$ podman run --rm --rootfs /path/to/rootfs true +``` + +The command above will create all the missing directories needed to run the container. + +After that, it can be used in read-only mode, by multiple containers at the same time: + +```console +$ podman run --read-only --rootfs /path/to/rootfs .... +``` + +Another option is to use an Overlay Rootfs Mount: + +```console +$ podman run --rootfs /path/to/rootfs\:O .... +``` + +Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +### 26) Running containers with resource limits fails with a permissions error + +On some systemd-based systems, non-root users do not have resource limit delegation +permissions. This causes setting resource limits to fail. + +#### Symptom + +Running a container with a resource limit options will fail with an error similar to the following: + +`--cpus`, `--cpu-period`, `--cpu-quota`, `--cpu-shares`: + + Error: OCI runtime error: crun: the requested cgroup controller `cpu` is not available + +`--cpuset-cpus`, `--cpuset-mems`: + + Error: OCI runtime error: crun: the requested cgroup controller `cpuset` is not available + +This means that resource limit delegation is not enabled for the current user. + +#### Solution + +You can verify whether resource limit delegation is enabled by running the following command: + +```console +$ cat "/sys/fs/cgroup/user.slice/user-$(id -u).slice/user@$(id -u).service/cgroup.controllers" +``` + +Example output might be: + + memory pids + +In the above example, `cpu` and `cpuset` are not listed, which means the current user does +not have permission to set CPU or CPUSET limits. + +If you want to enable CPU or CPUSET limit delegation for all users, you can create the +file `/etc/systemd/system/user@.service.d/delegate.conf` with the contents: + +```ini +[Service] +Delegate=memory pids cpu cpuset +``` + +After logging out and logging back in, you should have permission to set +CPU and CPUSET limits. + +### 27) `exec container process '/bin/sh': Exec format error` (or another binary than `bin/sh`) + +This can happen when running a container from an image for another architecture than the one you are running on. + +For example, if a remote repository only has, and thus send you, a `linux/arm64` _OS/ARCH_ but you run on `linux/amd64` (as happened in https://github.com/openMF/community-app/issues/3323 due to https://github.com/timbru31/docker-ruby-node/issues/564). + +### 28) `Error: failed to create sshClient: Connection to bastion host (ssh://user@host:22/run/user/.../podman/podman.sock) failed.: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain` + +In some situations where the client is not on the same machine as where the podman daemon is running the client key could be using a cipher not supported by the host. This indicates an issue with one's SSH config. Until remedied using podman over ssh +with a pre-shared key will be impossible. + +#### Symptom + +The accepted ciphers per `/etc/crypto-policies/back-ends/openssh.config` are not one that was used to create the public/private key pair that was transferred over to the host for ssh authentication. + +You can confirm this is the case by attempting to connect to the host via `podman-remote info` from the client and simultaneously on the host running `journalctl -f` and watching for the error `userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]`. + +#### Solution + +Create a new key using a supported algorithm e.g. ecdsa: + +```console +$ ssh-keygen -t ecdsa -f ~/.ssh/podman +``` + +Then copy the new id over: + +```console +$ ssh-copy-id -i ~/.ssh/podman.pub user@host +``` + +And then re-add the connection (removing the old one if necessary): + +```console +$ podman-remote system connection add myuser --identity ~/.ssh/podman ssh://user@host/run/user/1000/podman/podman.sock +``` + +And now this should work: + +```console +$ podman-remote info +``` + +### 29) Rootless CNI networking fails in RHEL with Podman v2.2.1 to v3.0.1. + +A failure is encountered when trying to use networking on a rootless +container in Podman v2.2.1 through v3.0.1 on RHEL. This error does not +occur on other Linux distributions. + +#### Symptom + +A rootless container is created using a CNI network, but the `podman run` command +returns an error that an image must be built. + +#### Solution + +In order to use a CNI network in a rootless container on RHEL, +an Infra container image for CNI-in-slirp4netns must be created. The +instructions for building the Infra container image can be found for +v2.2.1 [here](https://github.com/containers/podman/tree/v2.2.1-rhel/contrib/rootless-cni-infra), +and for v3.0.1 [here](https://github.com/containers/podman/tree/v3.0.1-rhel/contrib/rootless-cni-infra). + +### 30) Container related firewall rules are lost after reloading firewalld +Container network can't be reached after `firewall-cmd --reload` and `systemctl restart firewalld` Running `podman network reload` will fix it but it has to be done manually. + +#### Symptom +The firewall rules created by podman are lost when the firewall is reloaded. + +#### Solution +[@ranjithrajaram](https://github.com/containers/podman/issues/5431#issuecomment-847758377) has created a systemd-hook to fix this issue + +1) For "firewall-cmd --reload", create a systemd unit file with the following +```ini +[Unit] +Description=firewalld reload hook - run a hook script on firewalld reload +Wants=dbus.service +After=dbus.service + +[Service] +Type=simple +ExecStart=/bin/bash -c '/bin/busctl monitor --system --match "interface=org.fedoraproject.FirewallD1,member=Reloaded" --match "interface=org.fedoraproject.FirewallD1,member=PropertiesChanged" | while read -r line ; do podman network reload --all ; done' + +[Install] +WantedBy=default.target +``` + +2) For "systemctl restart firewalld", create a systemd unit file with the following +```ini +[Unit] +Description=podman network reload +Wants=firewalld.service +After=firewalld.service +PartOf=firewalld.service + +[Service] +Type=simple +RemainAfterExit=yes +ExecStart=/usr/bin/podman network reload --all + +[Install] +WantedBy=default.target +``` + +However, If you use busctl monitor then you can't get machine-readable output on RHEL 8. +Since it doesn't have `busctl -j` as mentioned here by [@yrro](https://github.com/containers/podman/issues/5431#issuecomment-896943018). + +For RHEL 8, you can use the following one-liner bash script. +```ini +[Unit] +Description=Redo podman NAT rules after firewalld starts or reloads +Wants=dbus.service +After=dbus.service +Requires=firewalld.service + +[Service] +Type=simple +ExecStart=/bin/bash -c "dbus-monitor --profile --system 'type=signal,sender=org.freedesktop.DBus,path=/org/freedesktop/DBus,interface=org.freedesktop.DBus,member=NameAcquired,arg0=org.fedoraproject.FirewallD1' 'type=signal,path=/org/fedoraproject/FirewallD1,interface=org.fedoraproject.FirewallD1,member=Reloaded' | sed -u '/^#/d' | while read -r type timestamp serial sender destination path interface member _junk; do if [[ $type = '#'* ]]; then continue; elif [[ $interface = org.freedesktop.DBus && $member = NameAcquired ]]; then echo 'firewalld started'; podman network reload --all; elif [[ $interface = org.fedoraproject.FirewallD1 && $member = Reloaded ]]; then echo 'firewalld reloaded'; podman network reload --all; fi; done" +Restart=Always + +[Install] +WantedBy=default.target +``` +`busctl-monitor` is almost usable in RHEL 8, except that it always outputs two bogus events when it starts up, +one of which is (in its only machine-readable format) indistinguishable from the `NameOwnerChanged` that you get when firewalld starts up. +This means you would get an extra `podman network reload --all` when this unit starts. + +Apart from this, you can use the following systemd service with the python3 code. + +```ini +[Unit] +Description=Redo podman NAT rules after firewalld starts or reloads +Wants=dbus.service +Requires=firewalld.service +After=dbus.service + +[Service] +Type=simple +ExecStart=/usr/bin/python /path/to/python/code/podman-redo-nat.py +Restart=always + +[Install] +WantedBy=default.target +``` +The code reloads podman network twice when you use `systemctl restart firewalld`. +```python3 +import dbus +from gi.repository import GLib +from dbus.mainloop.glib import DBusGMainLoop +import subprocess +import sys + +# I'm a bit confused on the return values in the code +# Not sure if they are needed. + +def reload_podman_network(): + try: + subprocess.run(["podman","network","reload","--all"],timeout=90) + # I'm not sure about this part + sys.stdout.write("podman network reload done\n") + sys.stdout.flush() + except subprocess.TimeoutExpired as t: + sys.stderr.write(f"Podman reload failed due to Timeout {t}") + except subprocess.CalledProcessError as e: + sys.stderr.write(f"Podman reload failed due to {e}") + except Exception as e: + sys.stderr.write(f"Podman reload failed with an Unhandled Exception {e}") + + return False + +def signal_handler(*args, **kwargs): + if kwargs.get('member') == "Reloaded": + reload_podman_network() + elif kwargs.get('member') == "NameOwnerChanged": + reload_podman_network() + else: + return None + return None + +def signal_listener(): + try: + DBusGMainLoop(set_as_default=True)# Define the loop. + loop = GLib.MainLoop() + system_bus = dbus.SystemBus() + # Listens to systemctl restart firewalld with a filter added, will cause podman network to be reloaded twice + system_bus.add_signal_receiver(signal_handler,dbus_interface='org.freedesktop.DBus',arg0='org.fedoraproject.FirewallD1',member_keyword='member') + # Listens to firewall-cmd --reload + system_bus.add_signal_receiver(signal_handler,dbus_interface='org.fedoraproject.FirewallD1',signal_name='Reloaded',member_keyword='member') + loop.run() + except KeyboardInterrupt: + loop.quit() + sys.exit(0) + except Exception as e: + loop.quit() + sys.stderr.write(f"Error occurred {e}") + sys.exit(1) + +if __name__ == "__main__": + signal_listener() +``` + +### 31) Podman run fails with `ERRO[0000] XDG_RUNTIME_DIR directory "/run/user/0" is not owned by the current user` or `Error: creating tmpdir: mkdir /run/user/1000: permission denied`. + +A failure is encountered when performing `podman run` with a warning `XDG_RUNTIME_DIR is pointing to a path which is not writable. Most likely podman will fail.` + +#### Symptom + +A rootless container is being invoked with cgroup configuration as `cgroupv2` for user with missing or invalid **systemd session**. + +Example cases +```console +# su user1 -c 'podman images' +ERRO[0000] XDG_RUNTIME_DIR directory "/run/user/0" is not owned by the current user +``` +```console +# su - user1 -c 'podman images' +Error: creating tmpdir: mkdir /run/user/1000: permission denied +``` + +#### Solution + +Podman expects a valid login session for the `rootless+cgroupv2` use-case. Podman execution is expected to fail if the login session is not present. In most cases, podman will figure out a solution on its own but if `XDG_RUNTIME_DIR` is pointing to a path that is not writable execution will most likely fail. Typical scenarios of such cases are seen when users are trying to use Podman with `su - -c ''`, or `sudo -l` and badly configured systemd session. + +Alternatives: + +* Execute Podman via __systemd-run__ that will first start a systemd login session: + + ```console + $ sudo systemd-run --machine=username@ --quiet --user --collect --pipe --wait podman run --rm docker.io/library/alpine echo hello + ``` +* Start an interactive shell in a systemd login session with the command `machinectl shell @` + and then run Podman + + ```console + $ sudo -i + # machinectl shell username@ + Connected to the local host. Press ^] three times within 1s to exit session. + $ podman run --rm docker.io/library/alpine echo hello + ``` +* Start a new systemd login session by logging in with `ssh` i.e. `ssh @localhost` and then run Podman. + +* Before invoking Podman command create a valid login session for your rootless user using `loginctl enable-linger ` + +### 32) 127.0.0.1:7777 port already bound + +After deleting a VM on macOS, the initialization of subsequent VMs fails. + +#### Symptom + +After deleting a client VM on macOS via `podman machine stop` && `podman machine rm`, attempting to `podman machine init` a new client VM leads to an error with the 127.0.0.1:7777 port already bound. + +#### Solution + +You will need to remove the hanging gv-proxy process bound to the port in question. For example, if the port mentioned in the error message is 127.0.0.1:7777, you can use the command `kill -9 $(lsof -i:7777)` in order to identify and remove the hanging process which prevents you from starting a new VM on that default port. + +### 33) The sshd process fails to run inside of the container. + +#### Symptom + +The sshd process running inside the container fails with the error +"Error writing /proc/self/loginuid". + +### Solution + +If the `/proc/self/loginuid` file is already initialized then the +`CAP_AUDIT_CONTROL` capability is required to override it. + +This happens when running Podman from a user session since the +`/proc/self/loginuid` file is already initialized. The solution is to +run Podman from a system service, either using the Podman service, and +then using podman -remote to start the container or simply by running +something like `systemd-run podman run ...`. In this case the +container will only need `CAP_AUDIT_WRITE`. + +### 34) Container creates a file that is not owned by the user's regular UID + +After running a container with rootless Podman, the non-root user sees a numerical UID and GID instead of a username and groupname. + +#### Symptom + +When listing file permissions with `ls -l` on the host in a directory that was passed as `--volume /some/dir` to `podman run`, +the UID and GID are displayed rather than the corresponding username and groupname. The UID and GID numbers displayed are +from the user's subordinate UID and GID ranges on the host system. + +An example + +```console +$ mkdir dir1 +$ chmod 777 dir1 +$ podman run --rm -v ./dir1:/dir1\:Z \ + --user 2003:2003 \ + docker.io/library/ubuntu bash -c "touch /dir1/a; chmod 600 /dir1/a" +$ ls -l dir1/a +-rw-------. 1 102002 102002 0 Jan 19 19:35 dir1/a +$ less dir1/a +less: dir1/a: Permission denied +``` + +#### Solution + +If you want to read, chown, or remove such a file, enter a user +namespace. Instead of running commands such as `less dir1/a` or `rm dir1/a`, you +need to prepend the command-line with `podman unshare`, i.e., +`podman unshare less dir1/a` or `podman unshare rm dir1/a`. To change the ownership +of the file `dir1/a` to your regular user's UID and GID, run `podman unshare chown 0:0 dir1/a`. +A file having the ownership `0:0` in the user namespace is owned by the regular +user on the host. To use Bash features, such as variable expansion and +globbing, you need to wrap the command with `bash -c`, e.g. +`podman unshare bash -c 'ls $HOME/dir1/a*'`. + +Would it have been possible to run Podman in another way so that your regular +user would have become the owner of the file? Yes, you can use the option +`--userns keep-id:uid=$uid,gid=$gid` to change how UIDs and GIDs are mapped +between the container and the host. Let's try it out. + +In the example above `ls -l` shows the UID 102002 and GID 102002. Set shell variables + +```console +$ uid_from_ls=102002 +$ gid_from_ls=102002 +``` + +Set shell variables to the lowest subordinate UID and GID + +```console +$ lowest_subuid=$(podman info --format "{{ (index .Host.IDMappings.UIDMap 1).HostID }}") +$ lowest_subgid=$(podman info --format "{{ (index .Host.IDMappings.GIDMap 1).HostID }}") +``` + +Compute the UID and GID inside the container that map to the owner of the created file on the host. + +```console +$ uid=$(( $uid_from_ls - $lowest_subuid + 1)) +$ gid=$(( $gid_from_ls - $lowest_subgid + 1)) +``` +(In the computation it was assumed that there is only one subuid range and one subgid range) + +```console +$ echo $uid +2003 +$ echo $gid +2003 +``` + +The computation shows that the UID is `2003` and the GID is `2003` inside the container. +This comes as no surprise as this is what was specified before with `--user=2003:2003`, +but the same computation could be used whenever a username is specified +or the `--user` option is not used. + +Run the container again but now with UIDs and GIDs mapped + +```console +$ mkdir dir1 +$ chmod 777 dir1 +$ podman run --rm + -v ./dir1:/dir1:Z \ + --user $uid:$gid \ + --userns keep-id:uid=$uid,gid=$gid \ + docker.io/library/ubuntu bash -c "touch /dir1/a; chmod 600 /dir1/a" +$ id -u +tester +$ id -g +tester +$ ls -l dir1/a +-rw-------. 1 tester tester 0 Jan 19 20:31 dir1/a +$ +``` + +In this example the `--user` option specified a rootless user in the container. +As the rootless user could also have been specified in the container image, e.g. + +```console +$ podman image inspect --format "user: {{.User}}" IMAGE +user: hpc +``` +the same problem could also occur even without specifying `--user`. + +Another variant of the same problem could occur when using +`--user=root:root` (the default), but where the root user creates non-root owned files +in some way (e.g by creating them themselves, or switching the effective UID to +a rootless user and then creates files). + +See also the troubleshooting tip: + +[_Podman run fails with "Error: unrecognized namespace mode keep-id\:uid=1000,gid=1000 passed"_](#39-podman-run-fails-with-error-unrecognized-namespace-mode-keep-iduid1000gid1000-passed) + +### 35) Passed-in devices or files can't be accessed in rootless container (UID/GID mapping problem) + +As a non-root user you have access rights to devices, files and directories that you +want to pass into a rootless container with `--device=...`, `--volume=...` or `--mount=..`. + +Podman by default maps a non-root user inside a container to one of the user's +subordinate UIDs and subordinate GIDs on the host. When the container user tries to access a +file, a "Permission denied" error could occur because the container user does not have the +permissions of the regular user of the host. + +#### Symptom + +* Any access inside the container is rejected with "Permission denied" +for files, directories or devices passed in to the container +with `--device=..`,`--volume=..` or `--mount=..`, e.g. + +```console +$ mkdir dir1 +$ chmod 700 dir1 +$ podman run --rm -v ./dir1:/dir1:Z \ + --user 2003:2003 \ + docker.io/library/ubuntu ls /dir1 +ls: cannot open directory '/dir1': Permission denied +``` + +#### Solution + +We follow essentially the same solution as in the previous +troubleshooting tip: + +[_Container creates a file that is not owned by the user's regular UID_](#34-container-creates-a-file-that-is-not-owned-by-the-users-regular-uid) + +but for this problem the container UID and GID can't be as +easily computed by mere addition and subtraction. + +In other words, it might be more challenging to find out the UID and +the GID inside the container that we want to map to the regular +user on the host. + +If the `--user` option is used together with a numerical UID and GID +to specify a rootless user, we already know the answer. + +If the `--user` option is used together with a username and groupname, +we could look up the UID and GID in the file `/etc/passwd` of the container. + +If the container user is not set via `--user` but instead from the +container image, we could inspect the container image + +```console +$ podman image inspect --format "user: {{.User}}" IMAGE +user: hpc +``` + +and then look it up in `/etc/passwd` of the container. + +If the problem occurs in a container that is started to run as root but later +switches to an effictive UID of a rootless user, it might be less +straightforward to find out the UID and the GID. Reading the +`Containerfile`, `Dockerfile` or the `/etc/passwd` could give a clue. + +To run the container with the rootless container UID and GID mapped to the +user's regular UID and GID on the host follow these steps: + +Set the `uid` and `gid` shell variables in a Bash shell to the UID and GID +of the user that will be running inside the container, e.g. + +```console +$ uid=2003 +$ gid=2003 +``` + +and run + +```console +$ mkdir dir1 +$ echo hello > dir1/file.txt +$ chmod 700 dir1/file.txt +$ podman run --rm \ + -v ./dir1:/dir1:Z \ + --user $uid:$gid \ + --userns keep-id:uid=$uid,gid=$gid \ + docker.io/library/alpine cat /dir1/file.txt +hello +``` + +See also the troubleshooting tip: + +[_Podman run fails with "Error: unrecognized namespace mode keep-id:uid=1000,gid=1000 passed"_](#39-podman-run-fails-with-error-unrecognized-namespace-mode-keep-iduid1000gid1000-passed) + +### 36) Images in the additional stores can be deleted even if there are containers using them + +When an image in an additional store is used, it is not locked thus it +can be deleted even if there are containers using it. + +#### Symptom + +WARN[0000] Can't stat lower layer "/var/lib/containers/storage/overlay/l/7HS76F2P5N73FDUKUQAOJA3WI5" because it does not exist. Going through storage to recreate the missing symlinks. + +#### Solution + +It is the user responsibility to make sure images in an additional +store are not deleted while being used by containers in another +store. + +### 37) Syncing bugfixes for podman-remote or setups using Podman API + +After upgrading Podman to a newer version an issue with the earlier version of Podman still presents itself while using podman-remote. + +#### Symptom + +While running podman remote commands with the most updated Podman, issues that were fixed in a prior version of Podman can arise either on the Podman client side or the Podman server side. + +#### Solution + +When upgrading Podman to a particular version for the required fixes, users often make the mistake of only upgrading the Podman client. However, suppose a setup uses `podman-remote` or uses a client that communicates with the Podman server on a remote machine via the REST API. In that case, it is required to upgrade both the Podman client and the Podman server running on the remote machine. Both the Podman client and server must be upgraded to the same version. + +Example: If a particular bug was fixed in `v4.1.0` then the Podman client must have version `v4.1.0` as well the Podman server must have version `v4.1.0`. + +### 38) Unexpected carriage returns are outputted on the terminal + +When using the __--tty__ (__-t__) flag, unexpected carriage returns are outputted on the terminal. + +#### Symptom + +The container program prints a newline (`\n`) but the terminal outputs a carriage return and a newline (`\r\n`). + +``` +$ podman run --rm -t fedora echo abc | od -c +0000000 a b c \r \n +0000005 +``` + +When run directly on the host, the result is as expected. + +``` +$ echo abc | od -c +0000000 a b c \n +0000004 +``` + +Extra carriage returns can also shift the prompt to the right. + +``` +$ podman run --rm -t fedora sh -c "echo 1; echo 2; echo 3" | cat -A +1^M$ + 2^M$ + 3^M$ + $ +``` + +#### Solution + +Run Podman without the __--tty__ (__-t__) flag. + +``` +$ podman run --rm fedora echo abc | od -c +0000000 a b c \n +0000004 +``` + +The __--tty__ (__-t__) flag should only be used when the program requires user interaction in the termainal, for instance expecting +the user to type an answer to a question. + +Where does the extra carriage return `\r` come from? + +The extra `\r` is not outputted by Podman but by the terminal. In fact, a reconfiguration of the terminal can make the extra `\r` go away. + +``` +$ podman run --rm -t fedora /bin/sh -c "stty -onlcr && echo abc" | od -c +0000000 a b c \n +0000004 +``` + +### 39) Podman run fails with "Error: unrecognized namespace mode keep-id:uid=1000,gid=1000 passed" + +Podman 4.3.0 introduced the options _uid_ and _gid_ that can be given to `--userns keep-id` which are not recognized by older versions of Podman. + +#### Symptom + +When using a Podman version older than 4.3.0, the options _uid_ and _gid_ are not recognized, and an "unrecognized namespace mode" error is raised. + +``` +$ uid=1000 +$ gid=1000 +$ podman run --rm + --user $uid:$gid \ + --userns keep-id:uid=$uid,gid=$gid \ + docker.io/library/ubuntu /bin/cat /proc/self/uid_map +Error: unrecognized namespace mode keep-id:uid=1000,gid=1000 passed +$ +``` + +#### Solution + +Use __--uidmap__ and __--gidmap__ options to describe the same UID and GID mapping. + +Run + +``` +$ uid=1000 +$ gid=1000 +$ subuidSize=$(( $(podman info --format "{{ range \ + .Host.IDMappings.UIDMap }}+{{.Size }}{{end }}" ) - 1 )) +$ subgidSize=$(( $(podman info --format "{{ range \ + .Host.IDMappings.GIDMap }}+{{.Size }}{{end }}" ) - 1 )) +$ podman run --rm \ + --user $uid:$gid \ + --uidmap 0:1:$uid \ + --uidmap $uid:0:1 \ + --uidmap $(($uid+1)):$(($uid+1)):$(($subuidSize-$uid)) \ + --gidmap 0:1:$gid \ + --gidmap $gid:0:1 \ + --gidmap $(($gid+1)):$(($gid+1)):$(($subgidSize-$gid)) \ + docker.io/library/ubuntu /bin/cat /proc/self/uid_map + 0 1 1000 + 1000 0 1 + 1001 1001 64536 +``` + +which uses the same UID and GID mapping as when specifying +`--userns keep-id:uid=$uid,gid=$gid` with Podman 4.3.0 (or greater) + +``` +$ uid=1000 +$ gid=1000 +$ podman run --rm \ + --user $uid:$gid \ + --userns keep-id:uid=$uid,gid=$gid \ + docker.io/library/ubuntu /bin/cat /proc/self/uid_map + 0 1 1000 + 1000 0 1 + 1001 1001 64536 +``` + +Replace `/bin/cat /proc/self/uid_map` with +`/bin/cat /proc/self/gid_map` to show the GID mapping. + +### 40) Podman fails to find expected image with "error locating pulled image", "image not known" + +When trying to do a Podman command that pulls an image from local storage or a remote repository, +an error is raised saying "image not known" or "error locating pulled image". Even though the image +had been verified before the Podman command was invoked. + +#### Symptom + +After verifying that an image is in place either locally or on a remote repository, a Podman command +referencing that image will fail in a manner like: +``` +# ls Containerfile +FROM registry.access.redhat.com/ubi8-minimal:latest +MAINTAINER Podman Community +USER root + +# podman build . +STEP 1/2: FROM registry.access.redhat.com/ubi8-minimal +Trying to pull registry.access.redhat.com/ubi8-minimal:latest... +Getting image source signatures +Checking if image destination supports signatures +Copying blob a6577091999b done +Copying config abb1ba1bce done +Writing manifest to image destination +Storing signatures +Error: error creating build container: error locating pulled image "registry.access.redhat.com/ubi8-minimal:latest" name in containers storage: registry.access.redhat.com/ubi8-minimal\:latest: image not known +``` + +#### Solution +The general cause for this is a timing issue. To make Podman commands as +efficient as possible, read and write locks are only established for critical +sections within the code. When pulling an image from a repository, a copy of +that image is first written to local storage using a write lock. This lock is +released before the image is then acquired/read. If another process does a +harmful command such as `podman system prune --all` or `podman system reset` +or `podman rmi --all`, between the time the image is written and before the +first process can acquire it, this type of `image not known` error can arise. + +The maintainers of Podman have considered heavier-duty locks to close this +timing window. However, the slowdown that all Podman commands would encounter +was not considered worth the cost of completely closing this small timing window. + +### 41) A podman build step with `--mount=type=secret` fails with "operation not permitted" + +Executing a step in a `Dockerfile`/`Containerfile` which mounts secrets using `--mount=type=secret` fails with "operation not permitted" when running on a host filesystem mounted with `nosuid` and when using the `runc` runtime. + +#### Symptom + +A `RUN` line in the `Dockerfile`/`Containerfile` contains a [secret mount](https://github.com/containers/common/blob/main/docs/Containerfile.5.md) such as `--mount=type=secret,id=MY_USER,target=/etc/dnf/vars/MY_USER`. +When running `podman build` the process fails with an error message like: + +``` +STEP 3/13: RUN --mount=type=secret,id=MY_USER,target=/etc/dnf/vars/MY_USER --mount=type=secret,id=MY_USER,target=/etc/dnf/vars/MY_USER ...: time="2023-06-13T18:04:59+02:00" level=error msg="runc create failed: unable to start container process: error during container init: error mounting \"/var/tmp/buildah2251989386/mnt/buildah-bind-target-11\" to rootfs at \"/etc/dnf/vars/MY_USER\": mount /var/tmp/buildah2251989386/mnt/buildah-bind-target-11:/etc/dnf/vars/MY_USER (via /proc/self/fd/7), flags: 0x1021: operation not permitted" +: exit status 1 +ERRO[0002] did not get container create message from subprocess: EOF +``` + +#### Solution + +* Install `crun`, e.g. with `dnf install crun`. +* Use the `crun` runtime by passing `--runtime /usr/bin/crun` to `podman build`. + +See also [Buildah issue 4228](https://github.com/containers/buildah/issues/4228) for a full discussion of the problem. + +### 42) podman-in-podman builds that are file I/0 intensive are very slow + +When using the `overlay` storage driver to do a nested `podman build` inside a running container, file I/O operations such as `COPY` of a large amount of data is very slow or can hang completely. + +#### Symptom + +Using the default `overlay` storage driver, a `COPY`, `ADD`, or an I/O intensive `RUN` line in a `Containerfile` that is run inside another container is very slow or hangs completely when running a `podman build` inside the running parent container. + +#### Solution + +This could be caused by the child container using `fuse-overlayfs` for writing to `/var/lib/containers/storage`. Writes can be slow with `fuse-overlayfs`. The solution is to use the native `overlay` filesystem by using a local directory on the host system as a volume to `/var/lib/containers/storage` like so: `podman run --privileged --rm -it -v ./nested_storage:/var/lib/containers/storage parent:latest`. Ensure that the base image of `parent:latest` in this example has no contents in `/var/lib/containers/storage` in the image itself for this to work. Once using the native volume, the nested container should not fall back to `fuse-overlayfs` to write files and the nested build will complete much faster. + +If you don't have access to the parent run process, such as in a CI environment, then the second option is to change the storage driver to `vfs` in the parent image by changing changing this line in your `storage.conf` file: `driver = "vfs"`. You may have to run `podman system reset` for this to take effect. You know it's changed when `podman info |grep graphDriverName` outputs `graphDriverName: vfs`. This method is slower performance than using the volume method above but is significantly faster than `fuse-overlayfs` + +### 43) `podman run --userns=auto` fails with "Error: creating container storage: not enough unused IDs in user namespace" + +Using `--userns=auto` when creating new containers does not work as long as any containers exist that were created with `--userns=keep-id` or `--userns=nomap` + +#### Symptom + +1. Run with `--userns=auto` + ``` + $ podman run --rm -d --userns=auto alpine sleep 3600 + ``` + The command succeeds. +2. Run with `--userns=auto` + ``` + $ podman run --rm -d --userns=auto alpine sleep 3600 + ``` + The command succeeds. +3. Run with `--userns=keep-id` + ``` + $ podman run --rm -d --userns=keep-id alpine sleep 3600 + ``` + The command succeeds. +4. Run with `--userns=auto` + ``` + $ podman run --rm -d --userns=auto alpine sleep 3600 + ``` + The command fails with the error message + ``` + Error: creating container storage: not enough unused IDs in user namespace + ``` + +#### Solution + +Any existing containers that were created using `--userns=keep-id` or `--userns=nomap` must first be deleted before any new container can be created with `--userns=auto` + +### 44) `sudo podman run --userns=auto` fails with `Cannot find mappings for user "containers"` + +When rootful podman is invoked with `--userns=auto`, podman needs to +pick subranges of subuids and subgids for the user namespace of the container. +Rootful podman ensures that the subuid and subgid ranges for such containers +do not overlap, but how can rootful podman prevent other tools +from accidentally using these IDs? + +It's not possible to block other tools that are running as root from using these IDs, +but such tools would normally not use subuids and subgids that have already +been assigned to a user in _/etc/subuid_ and _/etc/subgid_. + +The username _containers_ on the host has a special function for rootful Podman. +Rootful podman uses the subuids and subgids of the user _containers_ when +running `--userns=auto` containers. The user _containers_ has no need for these +subuids and subgids because no processes should be started as the user _containers_. +In other words, the user _containers_ is a special user that only exists on the system +to reserve _subuids_ and _subgids_ for rootful podman. + +_containers_ is the default username but it can be changed by setting the +option `root-auto-userns-user` in the file _/etc/containers/storage.conf_ + +#### Symptom + +Run rootful podman with `--userns=auto` +``` +sudo podman run --rm --userns=auto alpine echo hello +``` +The command fails with the error message: +``` +ERRO[0000] Cannot find mappings for user "containers": no subuid ranges found for user "containers" in /etc/subuid +Error: creating container storage: not enough unused IDs in user namespace +``` + +The files _/etc/subuid_ and _/etc/subgid_ do not have any lines that start with `containers:` + +#### Solution + +Add subuid and subgid ranges for the user _containers_ in _/etc/subuid_ and _/etc/subgid_ +or provide such ranges with _/etc/nsswitch.conf_. +For details, see [subid(5)](https://man7.org/linux/man-pages/man5/subuid.5.html). + +The following steps create the user _containers_ and assigns big subuid and subgid ranges to it: + +1. Create the user _containers_ + ``` + sudo useradd --comment "Helper user to reserve subuids and subgids for Podman" \ + --no-create-home \ + --shell /usr/sbin/nologin \ + containers + ``` +2. Check the subuid and subgid ranges of the user _containers_ + ``` + $ grep ^containers: /etc/subuid + containers:720896:65536 + $ grep ^containers: /etc/subgid + containers:720896:65536 + ``` + By default __useradd__ assigns 65536 subuids and 65536 subgids to a new user. + Typically you would like the reserved pool to be bigger than that. The bigger + the size, the more containers could be started with `sudo podman run --userns=auto ...` +3. Edit the line for the user _containers_ in the files _/etc/subuid_ and _/etc/subgid_ + to make the ranges bigger. Ensure that the subuid range of the user _containers_ do + not overlap with any other subuid ranges in the files _/etc/subuid_. Ensure that the + subgid range of the user _containers_ do not overlap with any other subgid ranges in + the files _/etc/subgid_. + +Test the echo command again + +``` +sudo podman run --rm --userns=auto alpine echo hello +``` + +The command succeeds and prints `hello` diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-unmount.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-unmount.1.md new file mode 100644 index 000000000..da2c6a667 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-unmount.1.md @@ -0,0 +1,75 @@ +--- +title: podman-unmount +version: v5.4.2 +--- + +% podman-unmount 1 + +## NAME +podman\-unmount - Unmount a working container's root filesystem + +## SYNOPSIS +**podman unmount** [*options*] *container* [...] + +**podman umount** [*options*] *container* [...] + +**podman container unmount** [*options*] *container* [...] + +**podman container umount** [*options*] *container* [...] + +## DESCRIPTION +Unmounts the specified containers' root file system, if no other processes +are using it. + +Container storage increments a mount counter each time a container is mounted. +When a container is unmounted, the mount counter is decremented, and the +container's root filesystem is physically unmounted only when the mount +counter reaches zero indicating no other processes are using the mount. +An unmount can be forced with the --force flag. + +Note: Podman can be used to unmount Podman containers as well as external containers. +External containers are containers created in container/storage by other tools like +Buildah and CRI-O. + +## OPTIONS +#### **--all**, **-a** + +All of the currently mounted containers are unmounted. + +#### **--force**, **-f** + +Force the unmounting of specified containers' root file system, even if other +processes have mounted it. + +Note: Other processes can fail if the mount point they are using is removed without their knowledge. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Unmount container with a given ID: +``` +podman container unmount containerID +``` + +Unmount multiple containers with given IDs: +``` +podman unmount containerID1 containerID2 containerID3 +``` + +Unmount all containers: +``` +podman unmount --all +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-mount(1)](podman-mount.1.md)**, **[podman-image-mount(1)](podman-image-mount.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-unpause.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-unpause.1.md new file mode 100644 index 000000000..fd2e25e42 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-unpause.1.md @@ -0,0 +1,102 @@ +--- +title: podman-unpause +version: v5.4.2 +--- + +% podman-unpause 1 + +## NAME +podman\-unpause - Unpause one or more containers + +## SYNOPSIS +**podman unpause** [*options*]|[*container* ...] + +**podman container unpause** [*options*]|[*container* ...] + +## DESCRIPTION +Unpauses the processes in one or more containers. Container IDs or names can be used as input. + +## OPTIONS + +#### **--all**, **-a** + +Unpause all paused containers. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and unpause the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + +#### **--filter**, **-f**=*filter* + +Filter what containers unpause. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Unpause specified container: +``` +podman unpause mywebserver +``` + +Unpause container by a partial container ID: +``` +podman unpause 860a4b23 +``` + +Unpause all **paused** containers: +``` +podman unpause --all +``` + +Unpause container using ID specified in given files: +``` +podman unpause --cidfile /home/user/cidfile-1 +podman unpause --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +Unpause the latest container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman unpause --latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pause(1)](podman-pause.1.md)** + +## HISTORY +September 2017, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-unshare.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-unshare.1.md new file mode 100644 index 000000000..c17e6c6a2 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-unshare.1.md @@ -0,0 +1,114 @@ +--- +title: podman-unshare +version: v5.4.2 +--- + +% podman-unshare 1 + +## NAME +podman\-unshare - Run a command inside of a modified user namespace + +## SYNOPSIS +**podman unshare** [*options*] [*command*] + +## DESCRIPTION +Launches a process (by default, *$SHELL*) in a new user namespace. The user +namespace is configured so that the invoking user's UID and primary GID appear +to be UID 0 and GID 0, respectively. Any ranges which match that user and +group in `/etc/subuid` and `/etc/subgid` are also mapped in as themselves with the +help of the *newuidmap(1)* and *newgidmap(1)* helpers. + +**podman unshare** is useful for troubleshooting unprivileged operations and for +manually clearing storage and other data related to images and containers. + +It is also useful to use the **podman mount** command. If an unprivileged user wants to mount and work with a container, then they need to execute +**podman unshare**. Executing **podman mount** fails for unprivileged users unless the user is running inside a **podman unshare** session. + +The unshare session defines two environment variables: + +- **CONTAINERS_GRAPHROOT**: the path to the persistent container's data. +- **CONTAINERS_RUNROOT**: the path to the volatile container's data. + +*IMPORTANT: This command is not available with the remote Podman client.* + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--rootless-netns** + +Join the rootless network namespace used for netavark networking. It can be used to +connect to a rootless container via IP address (bridge networking). This is otherwise +not possible from the host network namespace. + +## Exit Codes + +The exit code from `podman unshare` gives information about why the container +failed to run or why it exited. When `podman unshare` commands exit with a non-zero code, +the exit codes follow the `chroot` standard, see below: + + **125** The error is with podman **_itself_** + + $ podman unshare --foo; echo $? + Error: unknown flag: --foo + 125 + + **126** Executing a _contained command_ and the _command_ cannot be invoked + + $ podman unshare /etc; echo $? + Error: fork/exec /etc: permission denied + 126 + + **127** Executing a _contained command_ and the _command_ cannot be found + + $ podman unshare foo; echo $? + Error: fork/exec /usr/bin/bogus: no such file or directory + 127 + + **Exit code** _contained command_ exit code + + $ podman unshare /bin/sh -c 'exit 3'; echo $? + 3 + +## EXAMPLE + +Execute specified command in rootless user namespace: +``` +$ podman unshare id +uid=0(root) gid=0(root) groups=0(root),65534(nobody) +``` + +Show user namespace mappings for rootless containers: +``` +$ podman unshare cat /proc/self/uid_map /proc/self/gid_map + 0 1000 1 + 1 10000 65536 + 0 1000 1 + 1 10000 65536 +``` + + +Show rootless netns information in user namespace for rootless containers: +``` +$ podman unshare --rootless-netns ip addr +1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 + link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 + inet 127.0.0.1/8 scope host lo + valid_lft forever preferred_lft forever + inet6 ::1/128 scope host + valid_lft forever preferred_lft forever +2: tap0: mtu 65520 qdisc fq_codel state UNKNOWN group default qlen 1000 + link/ether aa:8c:0b:73:98:f6 brd ff:ff:ff:ff:ff:ff + inet 10.0.2.100/24 brd 10.0.2.255 scope global tap0 + valid_lft forever preferred_lft forever + inet6 fd00::a88c:bff:fe73:98f6/64 scope global dynamic mngtmpaddr + valid_lft 86389sec preferred_lft 14389sec + inet6 fe80::a88c:bff:fe73:98f6/64 scope link + valid_lft forever preferred_lft forever +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-mount(1)](podman-mount.1.md)**, **namespaces(7)**, **newuidmap(1)**, **newgidmap(1)**, **user\_namespaces(7)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-untag.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-untag.1.md new file mode 100644 index 000000000..df83e7381 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-untag.1.md @@ -0,0 +1,46 @@ +--- +title: podman-untag +version: v5.4.2 +--- + +% podman-untag 1 + +## NAME +podman\-untag - Remove one or more names from a locally-stored image + +## SYNOPSIS +**podman untag** *image* [*name*[:*tag*]...] + +**podman image untag** *image* [*name*[:*tag*]...] + +## DESCRIPTION +Remove one or more names from an image in the local storage. The image can be referred to by ID or reference. If no name is specified, all names are removed from the image. If a specified name is a short name and does not include a registry, `localhost/` is prefixed (e.g., `fedora` -> `localhost/fedora`). If a specified name does not include a tag, `:latest` is appended (e.g., `localhost/fedora` -> `localhost/fedora\\:latest`). + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Remove all tags from the specified image. +``` +$ podman untag 0e3bbc2 +``` + +Remove tag from specified image. +``` +$ podman untag imageName:latest otherImageName:latest +``` + +Remove multiple tags from the specified image. +``` +$ podman untag httpd myhttpd myregistryhost:5000/fedora/httpd\\:v2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +December 2019, Originally compiled by Sascha Grunert diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-update.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-update.1.md new file mode 100644 index 000000000..dfd37840a --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-update.1.md @@ -0,0 +1,523 @@ +--- +title: podman-update +version: v5.4.2 +--- + +% podman-update 1 + +## NAME +podman\-update - Update the configuration of a given container + +## SYNOPSIS +**podman update** [*options*] *container* + +**podman container update** [*options*] *container* + +## DESCRIPTION + +Updates the configuration of an existing container, allowing changes to resource limits and healthchecks. + +## OPTIONS + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-rt-period.md) +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-period.md) + + +[//]: # (BEGIN included file options/cpu-rt-runtime.md) +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-runtime.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpus.container.md) +#### **--cpus**=*number* + +Number of CPUs. The default is *0.0* which means no limit. This is shorthand +for **--cpu-period** and **--cpu-quota**, therefore the option cannot be specified with +**--cpu-period** or **--cpu-quota**. + +On some systems, changing the CPU limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpus.container.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-read-iops.md) +#### **--device-read-iops**=*path:rate* + +Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-iops.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + + +[//]: # (BEGIN included file options/device-write-iops.md) +#### **--device-write-iops**=*path:rate* + +Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-iops.md) + + +[//]: # (BEGIN included file options/health-cmd.md) +#### **--health-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set or alter a healthcheck command for a container. The command is a command to be executed inside the +container that determines the container health. The command is required for other healthcheck options +to be applied. A value of **none** disables existing healthchecks. + +Multiple options can be passed in the form of a JSON array; otherwise, the command is interpreted +as an argument to **/bin/sh -c**. + +[//]: # (END included file options/health-cmd.md) + + +[//]: # (BEGIN included file options/health-interval.md) +#### **--health-interval**=*interval* + +Set an interval for the healthchecks. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-interval.md) + +Changing this setting resets the timer. + + +[//]: # (BEGIN included file options/health-log-destination.md) +#### **--health-log-destination**=*directory_path* + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) (Default: local) + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. + +[//]: # (END included file options/health-log-destination.md) + +Warning: Changing this setting may cause the loss of previous logs. + + +[//]: # (BEGIN included file options/health-max-log-count.md) +#### **--health-max-log-count**=*number of stored logs* + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) (Default: 5 attempts) + +[//]: # (END included file options/health-max-log-count.md) + + +[//]: # (BEGIN included file options/health-max-log-size.md) +#### **--health-max-log-size**=*size of stored logs* + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) (Default: 500 characters) + +[//]: # (END included file options/health-max-log-size.md) + + +[//]: # (BEGIN included file options/health-on-failure.md) +#### **--health-on-failure**=*action* + +Action to take once the container transitions to an unhealthy state. The default is **none**. + +- **none**: Take no action. +- **kill**: Kill the container. +- **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. +- **stop**: Stop the container. + +[//]: # (END included file options/health-on-failure.md) + + +[//]: # (BEGIN included file options/health-retries.md) +#### **--health-retries**=*retries* + +The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is **3**. + +[//]: # (END included file options/health-retries.md) + + +[//]: # (BEGIN included file options/health-start-period.md) +#### **--health-start-period**=*period* + +The initialization time needed for a container to bootstrap. The value can be expressed in time format like +**2m3s**. The default value is **0s**. + +Note: The health check command is executed as soon as a container is started, if the health check is successful +the container's health state will be updated to `healthy`. However, if the health check fails, the health state will +stay as `starting` until either the health check is successful or until the `--health-start-period` time is over. If the +health check command fails after the `--health-start-period` time is over, the health state will be updated to `unhealthy`. +The health check command is executed periodically based on the value of `--health-interval`. + +[//]: # (END included file options/health-start-period.md) + + +[//]: # (BEGIN included file options/health-startup-cmd.md) +#### **--health-startup-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set a startup healthcheck command for a container. This command is executed inside the container and is used to gate the regular +healthcheck. When the startup command succeeds, the regular healthcheck begins and the startup healthcheck ceases. Optionally, +if the command fails for a set number of attempts, the container is restarted. A startup healthcheck can be used to ensure that +containers with an extended startup period are not marked as unhealthy until they are fully started. Startup healthchecks can only be +used when a regular healthcheck (from the container's image or the **--health-cmd** option) is also set. + +[//]: # (END included file options/health-startup-cmd.md) + + +[//]: # (BEGIN included file options/health-startup-interval.md) +#### **--health-startup-interval**=*interval* + +Set an interval for the startup healthcheck. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-startup-interval.md) + +Changing this setting resets the timer, depending on the state of the container. + + +[//]: # (BEGIN included file options/health-startup-retries.md) +#### **--health-startup-retries**=*retries* + +The number of attempts allowed before the startup healthcheck restarts the container. If set to **0**, the container is never restarted. The default is **0**. + +[//]: # (END included file options/health-startup-retries.md) + + +[//]: # (BEGIN included file options/health-startup-success.md) +#### **--health-startup-success**=*retries* + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value +of **0** means that any success begins the regular healthcheck. The default is **0**. + +[//]: # (END included file options/health-startup-success.md) + + +[//]: # (BEGIN included file options/health-startup-timeout.md) +#### **--health-startup-timeout**=*timeout* + +The maximum time a startup healthcheck command has to complete before it is marked as failed. The value can be expressed in a time +format like **2m3s**. The default value is **30s**. + +[//]: # (END included file options/health-startup-timeout.md) + + +[//]: # (BEGIN included file options/health-timeout.md) +#### **--health-timeout**=*timeout* + +The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the +value can be expressed in a time format such as **1m22s**. The default value is **30s**. + +[//]: # (END included file options/health-timeout.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-reservation.md) +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-reservation.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/memory-swappiness.md) +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/memory-swappiness.md) + + +[//]: # (BEGIN included file options/no-healthcheck.md) +#### **--no-healthcheck** + +Disable any defined healthchecks for container. + +[//]: # (END included file options/no-healthcheck.md) + + +[//]: # (BEGIN included file options/pids-limit.md) +#### **--pids-limit**=*limit* + +Tune the container's pids limit. Set to **-1** to have unlimited pids for the container. The default is **2048** on systems that support "pids" cgroup controller. + +[//]: # (END included file options/pids-limit.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + + +## EXAMPLEs + +Update a container with a new cpu quota and period. +``` +podman update --cpus=5 myCtr +``` + +Update a container with all available options for cgroups v2. +``` +podman update --cpus 5 --cpuset-cpus 0 --cpu-shares 123 --cpuset-mems 0 --memory 1G --memory-swap 2G --memory-reservation 2G --blkio-weight-device /dev/zero:123 --blkio-weight 123 --device-read-bps /dev/zero:10mb --device-write-bps /dev/zero:10mb --device-read-iops /dev/zero:1000 --device-write-iops /dev/zero:1000 --pids-limit 123 ctrID +``` + +Update a container with all available options for cgroups v1. +``` +podman update --cpus 5 --cpuset-cpus 0 --cpu-shares 123 --cpuset-mems 0 --memory 1G --memory-swap 2G --memory-reservation 2G --memory-swappiness 50 --pids-limit 123 ctrID +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-create(1)](podman-create.1.md)**, **[podman-run(1)](podman-run.1.md)** + +## HISTORY +August 2022, Originally written by Charlie Doern diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-version.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-version.1.md new file mode 100644 index 000000000..84d60eadf --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-version.1.md @@ -0,0 +1,60 @@ +--- +title: podman-version +version: v5.4.2 +--- + +% podman-version 1 + +## NAME +podman\-version - Display the Podman version information + +## SYNOPSIS +**podman version** [*options*] + +## DESCRIPTION +Shows the following information: Remote API Version, Version, Go Version, Git Commit, Build Time, +OS, and Architecture. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change output format to "json" or a Go template. + +| **Placeholder** | **Description** | +| ------------------- | ------------------------ | +| .Client ... | Version of local podman | +| .Server ... | Version of remote podman | + +Each of the above fields branch deeper into further subfields +such as .Version, .APIVersion, .GoVersion, and more. + +## Example + +A sample output of the `version` command: +``` +$ podman version +Version: 2.0.0 +API Version: 1 +Go Version: go1.14.2 +Git Commit: 4520664f63c3a7f9a80227715359e20069d95542 +Built: Tue May 19 10:48:59 2020 +OS/Arch: linux/amd64 +``` + +Filtering out only the version: +``` +$ podman version --format '{{.Client.Version}}' +2.0.0 +``` + +#### **--help**, **-h** + +Print usage statement + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +November 2018, Added --format flag by Tomas Tomecek +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-volume-create.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-volume-create.1.md new file mode 100644 index 000000000..60bf6d289 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-volume-create.1.md @@ -0,0 +1,213 @@ +--- +title: podman-volume-create +version: v5.4.2 +--- + +% podman-volume-create 1 + +## NAME +podman\-volume\-create - Create a new volume + +## SYNOPSIS +**podman volume create** [*options*] [*name*] + +## DESCRIPTION + +Creates an empty volume and prepares it to be used by containers. The volume +can be created with a specific name, if a name is not given a random name is +generated. You can add metadata to the volume by using the **--label** flag and +driver options can be set using the **--opt** flag. + +## OPTIONS + +#### **--driver**, **-d**=*driver* + +Specify the volume driver name (default **local**). +There are two drivers supported by Podman itself: **local** and **image**. + +The **local** driver uses a directory on disk as the backend by default, but can also use the **mount(8)** command to mount a filesystem as the volume if **--opt** is specified. + +The **image** driver uses an image as the backing store of for the volume. +An overlay filesystem is created, which allows changes to the volume to be committed as a new layer on top of the image. + +Using a value other than **local** or **image**, Podman attempts to create the volume using a volume plugin with the given name. +Such plugins must be defined in the **volume_plugins** section of the **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** configuration file. + +#### **--help** + +Print usage statement + +#### **--ignore** + +Don't fail if the named volume already exists, instead just print the name. Note that the new options are not applied to the existing volume. + +#### **--label**, **-l**=*label* + +Set metadata for a volume (e.g., --label mykey=value). + +#### **--opt**, **-o**=*option* + +Set driver specific options. +For the default driver, **local**, this allows a volume to be configured to mount a filesystem on the host. + +For the `local` driver the following options are supported: `type`, `device`, `o`, and `[no]copy`. + + - The `type` option sets the type of the filesystem to be mounted, and is equivalent to the `-t` flag to **mount(8)**. + - The `device` option sets the device to be mounted, and is equivalent to the `device` argument to **mount(8)**. + - The `copy` option enables copying files from the container image path where the mount is created to the newly created volume on the first run. `copy` is the default. + +The `o` option sets options for the mount, and is equivalent to the filesystem +options (also `-o`) passed to **mount(8)** with the following exceptions: + + - The `o` option supports `uid` and `gid` options to set the UID and GID of the created volume that are not normally supported by **mount(8)**. + - The `o` option supports the `size` option to set the maximum size of the created volume, the `inodes` option to set the maximum number of inodes for the volume, and `noquota` to completely disable quota support even for tracking of disk usage. + The `size` option is supported on the "tmpfs" and "xfs[note]" file systems. + The `inodes` option is supported on the "xfs[note]" file systems. + Note: xfs filesystems must be mounted with the `prjquota` flag described in the **xfs_quota(8)** man page. Podman will throw an error if they're not. + - The `o` option supports using volume options other than the UID/GID options with the **local** driver and requires root privileges. + - The `o` options supports the `timeout` option which allows users to set a driver specific timeout in seconds before volume creation fails. For example, **--opt=o=timeout=10** sets a driver timeout of 10 seconds. + +***Note*** Do not confuse the `--opt,-o` create option with the `-o` mount option. For example, with `podman volume create`, use `-o=o=uid=1000` *not* `-o=uid=1000`. + +For the **image** driver, the only supported option is `image`, which specifies the image the volume is based on. +This option is mandatory when using the **image** driver. + +When not using the **local** and **image** drivers, the given options are passed directly to the volume plugin. In this case, supported options are dictated by the plugin in question, not Podman. + +## EXAMPLES + +Create empty volume. +``` +$ podman volume create +``` + +Create empty named volume. +``` +$ podman volume create myvol +``` + +Create empty named volume with specified label. +``` +$ podman volume create --label foo=bar myvol +``` + +Create tmpfs named volume with specified size and mount options. +``` +# podman volume create --opt device=tmpfs --opt type=tmpfs --opt o=size=2M,nodev,noexec myvol +``` + +Create tmpfs named volume testvol with specified options. +``` +# podman volume create --opt device=tmpfs --opt type=tmpfs --opt o=uid=1000,gid=1000 testvol +``` + +Create image named volume using the specified local image in containers/storage. +``` +# podman volume create --driver image --opt image=fedora\:latest fedoraVol +``` + +## QUOTAS + +`podman volume create` uses `XFS project quota controls` for controlling the size and the number of inodes of builtin volumes. The directory used to store the volumes must be an `XFS` file system and be mounted with the `pquota` option. + +Example /etc/fstab entry: +``` +/dev/podman/podman-var /var xfs defaults,x-systemd.device-timeout=0,pquota 1 2 +``` + +Podman generates project IDs for each builtin volume, but these project IDs need to be unique for the XFS file system. These project IDs by default are generated randomly, with a potential for overlap with other quotas on the same file +system. + +The xfs_quota tool can be used to assign a project ID to the storage driver directory, e.g.: + +``` +echo 100000:/var/lib/containers/storage/overlay >> /etc/projects +echo 200000:/var/lib/containers/storage/volumes >> /etc/projects +echo storage:100000 >> /etc/projid +echo volumes:200000 >> /etc/projid +xfs_quota -x -c 'project -s storage volumes' / +``` + +In the example above we are configuring the overlay storage driver for newly +created containers as well as volumes to use project IDs with a **start offset**. +All containers are assigned larger project IDs (e.g. >= 100000). +All volume assigned project IDs larger project IDs starting with 200000. +This prevents xfs_quota management conflicts with containers/storage. + +## MOUNT EXAMPLES + +`podman volume create` allows the `type`, `device`, and `o` options to be passed to `mount(8)` when using the `local` driver. + +## [s3fs-fuse](https://github.com/s3fs-fuse/s3fs-fuse) + +[s3fs-fuse](https://github.com/s3fs-fuse/s3fs-fuse) or just `s3fs`, is a [fuse](https://github.com/libfuse/libfuse) filesystem that allows s3 prefixes to be mounted as filesystem mounts. + +**Installing:** +```shell +$ doas dnf install s3fs-fuse +``` + +**Simple usage:** +```shell +$ s3fs --help +$ s3fs -o use_xattr,endpoint=aq-central-1 bucket:/prefix /mnt +``` + +**Equivalent through `mount(8)`** +```shell +$ mount -t fuse.s3fs -o use_xattr,endpoint=aq-central-1 bucket:/prefix /mnt +``` + +**Equivalent through `podman volume create`** +```shell +$ podman volume create s3fs-fuse-volume -o type=fuse.s3fs -o device=bucket:/prefix -o o=use_xattr,endpoint=aq-central-1 +``` + +**The volume can then be mounted in a container with** +```shell +$ podman run -v s3fs-fuse-volume:/s3:z --rm -it fedora:latest +``` + +Please see the available [options](https://github.com/s3fs-fuse/s3fs-fuse/wiki/Fuse-Over-Amazon#options) on their wiki. + +### Using with other container users + +The above example works because the volume is mounted as the host user and inside the container `root` is mapped to the user in the host. + +If the mount is accessed by a different user inside the container, a "Permission denied" error will be raised. + +```shell +$ podman run --user bin:bin -v s3fs-fuse-volume:/s3:z,U --rm -it fedora:latest +$ ls /s3 +# ls: /s3: Permission denied +``` + +In FUSE-land, mounts are protected for the user who mounted them; specify the `allow_other` mount option if other users need access. +> Note: This will remove the normal fuse [security measures](https://github.com/libfuse/libfuse/wiki/FAQ#why-dont-other-users-have-access-to-the-mounted-filesystem) on the mount point, after which, the normal filesystem permissions will have to protect it + +```shell +$ podman volume create s3fs-fuse-other-volume -o type=fuse.s3fs -o device=bucket:/prefix -o o=allow_other,use_xattr,endpoint=aq-central-1 +$ podman run --user bin:bin -v s3fs-fuse-volume:/s3:z,U --rm -it fedora\:latest +$ ls /s3 +``` + +### The Prefix must exist + +`s3fs` will fail to mount if the prefix does not exist in the bucket. + +Create a s3-directory by putting an empty object at the desired `prefix/` key +```shell +$ aws s3api put-object --bucket bucket --key prefix/ +``` + +If performance is the priority, please check out the more performant [goofys](https://github.com/kahing/goofys). + +> FUSE filesystems exist for [Google Cloud Storage](https://github.com/GoogleCloudPlatform/gcsfuse) and [Azure Blob Storage](https://github.com/Azure/azure-storage-fuse) + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[podman-volume(1)](podman-volume.1.md)**, **mount(8)**, **xfs_quota(8)**, **xfs_quota(8)**, **projects(5)**, **projid(5)** + +## HISTORY +January 2020, updated with information on volume plugins by Matthew Heon +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-volume-exists.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-volume-exists.1.md new file mode 100644 index 000000000..1aa151289 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-volume-exists.1.md @@ -0,0 +1,48 @@ +--- +title: podman-volume-exists +version: v5.4.2 +--- + +% podman-volume-exists 1 + +## NAME +podman\-volume\-exists - Check if the given volume exists + +## SYNOPSIS +**podman volume exists** *volume* + +## DESCRIPTION +**podman volume exists** checks if a volume exists. Podman returns an exit code +of `0` when the volume is found. A `1` is returned otherwise. An exit code of +`125` indicates there was another issue. + + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLE + +Check if a volume called `myvol` exists (the volume does actually exist). +``` +$ podman volume exists myvol +$ echo $? +0 +$ +``` + +Check if a volume called `mysql` exists (the volume does not actually exist). +``` +$ podman volume exists mysql +$ echo $? +1 +$ +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** + +## HISTORY +January 2021, Originally compiled by Paul Holzinger `` diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-volume-export.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-volume-export.1.md new file mode 100644 index 000000000..84b1cee34 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-volume-export.1.md @@ -0,0 +1,43 @@ +--- +title: podman-volume-export +version: v5.4.2 +--- + +% podman-volume-export 1 + +## NAME +podman\-volume\-export - Export volume to external tar + +## SYNOPSIS +**podman volume export** [*options*] *volume* + +## DESCRIPTION + +**podman volume export** exports the contents of a podman volume and saves it as a tarball +on the local machine. **podman volume export** writes to STDOUT by default and can be +redirected to a file using the `--output` flag. + +Note: Following command is not supported by podman-remote. + +**podman volume export [OPTIONS] VOLUME** + +## OPTIONS + +#### **--help** + +Print usage statement + +#### **--output**, **-o**=*file* + +Write to a file, default is STDOUT + +## EXAMPLES + +Export named volume content into the specified file. +``` +$ podman volume export myvol --output myvol.tar + +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-volume-import(1)](podman-volume-import.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-volume-import.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-volume-import.1.md new file mode 100644 index 000000000..65c98f817 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-volume-import.1.md @@ -0,0 +1,46 @@ +--- +title: podman-volume-import +version: v5.4.2 +--- + +% podman-volume-import 1 + +## NAME +podman\-volume\-import - Import tarball contents into an existing podman volume + +## SYNOPSIS +**podman volume import** *volume* [*source*] + +## DESCRIPTION + +**podman volume import** imports the contents of a tarball into the podman volume's mount point. +The contents of the volume is merged with the content of the tarball with the latter taking precedence. +**podman volume import** can consume piped input when using `-` as source path. + +The given volume must already exist and is not created by podman volume import. + +Note: Following command is not supported by podman-remote. + +#### **--help** + +Print usage statement + +## EXAMPLES + +Import named volume content from the specified file. +``` +$ podman volume import myvol test.tar +``` + +Import named volume content from stdin. +``` +$ gunzip -c hello.tar.gz | podman volume import myvol - +``` + +Export the content from named volume and pipe it into the named volume via stdin. +``` +$ podman volume export oldmyvol | podman volume import myvol - +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-volume-export(1)](podman-volume-export.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-volume-inspect.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-volume-inspect.1.md new file mode 100644 index 000000000..4246507e7 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-volume-inspect.1.md @@ -0,0 +1,109 @@ +--- +title: podman-volume-inspect +version: v5.4.2 +--- + +% podman-volume-inspect 1 + +## NAME +podman\-volume\-inspect - Get detailed information on one or more volumes + +## SYNOPSIS +**podman volume inspect** [*options*] *volume* [...] + +## DESCRIPTION + +Display detailed information on one or more volumes. The output can be formatted using +the **--format** flag and a Go template. To get detailed information about all the +existing volumes, use the **--all** flag. +Volumes can be queried individually by providing their full name or a unique partial name. + + +## OPTIONS + +#### **--all**, **-a** + +Inspect all volumes. + +#### **--format**, **-f**=*format* + +Format volume output using Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------- | --------------------------------------------------------------------------- | +| .Anonymous | Indicates whether volume is anonymous | +| .CreatedAt ... | Volume creation time | +| .Driver | Volume driver | +| .GID | GID the volume was created with | +| .Labels ... | Label information associated with the volume | +| .LockNumber | Number of the volume's Libpod lock | +| .MountCount | Number of times the volume is mounted | +| .Mountpoint | Source of volume mount point | +| .Name | Volume name | +| .NeedsChown | Indicates volume will be chowned on next use | +| .NeedsCopyUp | Indicates data at the destination will be copied into the volume on next use| +| .Options ... | Volume options | +| .Scope | Volume scope | +| .Status ... | Status of the volume | +| .StorageID | StorageID of the volume | +| .Timeout | Timeout of the volume | +| .UID | UID the volume was created with | + +#### **--help** + +Print usage statement + + +## EXAMPLES + +Inspect named volume. +``` +$ podman volume inspect myvol +[ + { + "Name": "myvol", + "Driver": "local", + "Mountpoint": "/home/myusername/.local/share/containers/storage/volumes/myvol/_data", + "CreatedAt": "2023-03-13T16:26:48.423069028-04:00", + "Labels": {}, + "Scope": "local", + "Options": {}, + "MountCount": 0, + "NeedsCopyUp": true, + "NeedsChown": true + } +] +``` + +Inspect all volumes. +``` +$ podman volume inspect --all +[ + { + "Name": "myvol", + "Driver": "local", + "Mountpoint": "/home/myusername/.local/share/containers/storage/volumes/myvol/_data", + "CreatedAt": "2023-03-13T16:26:48.423069028-04:00", + "Labels": {}, + "Scope": "local", + "Options": {}, + "MountCount": 0, + "NeedsCopyUp": true, + "NeedsChown": true + } +] +``` + +Inspect named volume and display its Driver and Scope field. +``` +$ podman volume inspect --format "{{.Driver}} {{.Scope}}" myvol +local local +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-volume-ls.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-volume-ls.1.md new file mode 100644 index 000000000..3623a7576 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-volume-ls.1.md @@ -0,0 +1,117 @@ +--- +title: podman-volume-ls +version: v5.4.2 +--- + +% podman-volume-ls 1 + +## NAME +podman\-volume\-ls - List all the available volumes + +## SYNOPSIS +**podman volume ls** [*options*] + +## DESCRIPTION + +Lists all the volumes that exist. The output can be filtered using the **--filter** +flag and can be formatted to either JSON or a Go template using the **--format** +flag. Use the **--quiet** flag to print only the volume names. + +## OPTIONS + +#### **--filter**, **-f**=*filter* + +Filter what volumes are shown in the output. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive, with the only exception being `label` +which is exclusive. Filters with different keys always work exclusive. + +Volumes can be filtered by the following attributes: + +| **Filter** | **Description** | +| ---------- | ------------------------------------------------------------------------------------- | +| dangling | [Dangling] Matches all volumes not referenced by any containers | +| driver | [Driver] Matches volumes based on their driver | +| label | [Key] or [Key=Value] Label assigned to a volume | +| name | [Name] Volume name (accepts regex) | +| opt | Matches a storage driver options | +| scope | Filters volume by scope | +| after/since | Filter by volumes created after the given VOLUME (name or tag) | +| until | Only remove volumes created before given timestamp | + +#### **--format**=*format* + +Format volume output using Go template. + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------------- | -------------------------------------------- | +| .Anonymous | Indicates whether volume is anonymous | +| .CreatedAt ... | Volume creation time | +| .Driver | Volume driver | +| .GID | GID of volume | +| .InspectVolumeData ... | Don't use | +| .Labels ... | Label information associated with the volume | +| .LockNumber | Number of the volume's Libpod lock | +| .MountCount | Number of times the volume is mounted | +| .Mountpoint | Source of volume mount point | +| .Name | Volume name | +| .NeedsChown | Indicates whether volume needs to be chowned | +| .NeedsCopyUp | Indicates if volume needs to be copied up to | +| .Options ... | Volume options | +| .Scope | Volume scope | +| .Status ... | Status of the volume | +| .StorageID | StorageID of the volume | +| .Timeout | Timeout of the volume | +| .UID | UID of volume | +| .VolumeConfigResponse ... | Don't use | + +#### **--help** + +Print usage statement. + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Print volume output in quiet mode. Only print the volume names. + +## EXAMPLES + +List all volumes. +``` +$ podman volume ls +``` + +List all volumes and display content as json format. +``` +$ podman volume ls --format json +``` + +List all volumes and display their Driver and Scope fields +``` +$ podman volume ls --format "{{.Driver}} {{.Scope}}" +``` + +List volumes with the name foo and label blue. +``` +$ podman volume ls --filter name=foo,label=blue +``` + +List volumes with the label key=value. +``` +$ podman volume ls --filter label=key=value +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-volume-mount.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-volume-mount.1.md new file mode 100644 index 000000000..a2ae379a9 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-volume-mount.1.md @@ -0,0 +1,41 @@ +--- +title: podman-volume-mount +version: v5.4.2 +--- + +% podman-volume-mount 1 + +## NAME +podman\-volume\-mount - Mount a volume filesystem + +## SYNOPSIS +**podman volume mount** [*volume* ...] + +## DESCRIPTION +Mounts the specified volumes' file system in a location which can be +accessed from the host, and returns its location. + +Rootless mode only supports mounting file volumes unless Podman is run within the user namespace +via the `podman unshare` command. All other volume types fail to mount. + +## RETURN VALUE +The location of the mounted file system. On error an empty string and errno is +returned. + +## EXAMPLE + +Mount specified volume. As Root: +``` +# podman volume mount foo +/home/dwalsh/.local/share/containers/storage/volumes/foo/_data +``` + +In rootless mode, volume mounting only works after executing the podman unshare command to enter the user namespace. +``` +$ podman unshare +# podman volume mount foo +/home/dwalsh/.local/share/containers/storage/volumes/foo/_data +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-volume-unmount(1)](podman-volume-unmount.1.md)**, **[podman-unshare(1)](podman-unshare.1.md)**, **mount(8)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-volume-prune.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-volume-prune.1.md new file mode 100644 index 000000000..d00cc611b --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-volume-prune.1.md @@ -0,0 +1,77 @@ +--- +title: podman-volume-prune +version: v5.4.2 +--- + +% podman-volume-prune 1 + +## NAME +podman\-volume\-prune - Remove all unused volumes + +## SYNOPSIS +**podman volume prune** [*options*] + +## DESCRIPTION + +Removes unused volumes. By default all unused volumes are removed, the **--filter** flag can +be used to filter specific volumes. Users are prompted to confirm the removal of all the +unused volumes. To bypass the confirmation, use the **--force** flag. + + +## OPTIONS + +#### **--filter** + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:-----------:|------------------------------------------------------------------------------------------------------------| +| dangling | [Bool] Only remove volumes not referenced by any containers | +| driver | [String] Only remove volumes with the given driver | +| label | [String] Only remove volumes, with (or without, in the case of label!=[...] is used) the specified labels. | +| name | [String] Only remove volume with the given name | +| opt | [String] Only remove volumes created with the given options | +| scope | [String] Only remove volumes with the given scope | +| until | [DateTime] Only remove volumes created before given timestamp. | +| after/since | [Volume] Filter by volumes created after the given VOLUME (name or tag) | + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes volumes with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes volumes without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not prompt for confirmation. + +#### **--help** + +Print usage statement + + +## EXAMPLES + + +Prune all unused volumes. +``` +$ podman volume prune +``` + +Prune all volumes. Note: this command will also remove all containers that are using a volume. +``` +$ podman volume prune --force +``` + +Prune all volumes that contain the specified label. +``` +$ podman volume prune --filter label=mylabel=mylabelvalue +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-volume-reload.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-volume-reload.1.md new file mode 100644 index 000000000..6986077ad --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-volume-reload.1.md @@ -0,0 +1,35 @@ +--- +title: podman-volume-reload +version: v5.4.2 +--- + +% podman-volume-reload 1 + +## NAME +podman\-volume\-reload - Reload all volumes from volumes plugins + +## SYNOPSIS +**podman volume reload** + +## DESCRIPTION + +**podman volume reload** checks all configured volume plugins and updates the libpod database with all available volumes. +Existing volumes are also removed from the database when they are no longer present in the plugin. + +This command it is best effort and cannot guarantee a perfect state because plugins can be modified from the outside at any time. + +Note: This command is not supported with podman-remote. + +## EXAMPLES + +Reload the volume plugins. +``` +$ podman volume reload +Added: +vol6 +Removed: +t3 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-volume-rm.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-volume-rm.1.md new file mode 100644 index 000000000..c18882837 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-volume-rm.1.md @@ -0,0 +1,70 @@ +--- +title: podman-volume-rm +version: v5.4.2 +--- + +% podman-volume-rm 1 + +## NAME +podman\-volume\-rm - Remove one or more volumes + +## SYNOPSIS +**podman volume rm** [*options*] *volume* [...] + +## DESCRIPTION + +Removes one or more volumes. Only volumes that are not being used are removed. +If a volume is being used by a container, an error is returned unless the **--force** +flag is being used. To remove all volumes, use the **--all** flag. +Volumes can be removed individually by providing their full name or a unique partial name. + +## OPTIONS + +#### **--all**, **-a** + +Remove all volumes. + +#### **--force**, **-f** + +Remove a volume by force. +If it is being used by containers, the containers are removed first. + +#### **--help** + +Print usage statement + +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping running containers that are using the specified volume. The --force option must be specified to use the --time option. Use -1 for infinite wait. + +## EXAMPLES + +Remove multiple specified volumes. +``` +$ podman volume rm myvol1 myvol2 +``` + +Remove all volumes. +``` +$ podman volume rm --all +``` + +Remove the specified volume even if it is in use. Note, this removes all containers using the volume. +``` +$ podman volume rm --force myvol +``` + +## Exit Status + **0** All specified volumes removed + + **1** One of the specified volumes did not exist, and no other failures + + **2** One of the specified volumes is being used by a container + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-volume-unmount.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-volume-unmount.1.md new file mode 100644 index 000000000..0778887f3 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-volume-unmount.1.md @@ -0,0 +1,37 @@ +--- +title: podman-volume-unmount +version: v5.4.2 +--- + +% podman-volume-unmount 1 + +## NAME +podman\-volume\-unmount - Unmount a volume + +## SYNOPSIS +**podman volume unmount** *volume* [...] + +**podman volume umount** *volume* [...] + +## DESCRIPTION +Unmounts the specified volume, if there are no other containers +using it. + +Volume storage increments a mount counter each time a volume is mounted. +When a volume is unmounted, the mount counter is decremented, and the +volume's filesystem is physically unmounted only when the mount +counter reaches zero indicating no other processes are using the mount. + +## EXAMPLE + +Unmount volume with a given ID: +``` +podman volume unmount volumeID +``` + +Unmount multiple volumes with given IDs: +``` +podman volume unmount volumeID1 volumeID2 volumeID3 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-volume-mount(1)](podman-volume-mount.1.md)** diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-volume.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-volume.1.md new file mode 100644 index 000000000..97f50480d --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-volume.1.md @@ -0,0 +1,37 @@ +--- +title: podman-volume +version: v5.4.2 +--- + +% podman-volume 1 + +## NAME +podman\-volume - Simple management tool for volumes + +## SYNOPSIS +**podman volume** *subcommand* + +## DESCRIPTION +podman volume is a set of subcommands that manage volumes. + +## SUBCOMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------------ | ------------------------------------------------------------------------------ | +| create | [podman-volume-create(1)](podman-volume-create.1.md) | Create a new volume. | +| exists | [podman-volume-exists(1)](podman-volume-exists.1.md) | Check if the given volume exists. | +| export | [podman-volume-export(1)](podman-volume-export.1.md) | Export volume to external tar. | +| import | [podman-volume-import(1)](podman-volume-import.1.md) | Import tarball contents into an existing podman volume. | +| inspect | [podman-volume-inspect(1)](podman-volume-inspect.1.md) | Get detailed information on one or more volumes. | +| ls | [podman-volume-ls(1)](podman-volume-ls.1.md) | List all the available volumes. | +| mount | [podman-volume-mount(1)](podman-volume-mount.1.md) | Mount a volume filesystem. | +| prune | [podman-volume-prune(1)](podman-volume-prune.1.md) | Remove all unused volumes. | +| reload | [podman-volume-reload(1)](podman-volume-reload.1.md) | Reload all volumes from volumes plugins. | +| rm | [podman-volume-rm(1)](podman-volume-rm.1.md) | Remove one or more volumes. | +| unmount | [podman-volume-unmount(1)](podman-volume-unmount.1.md) | Unmount a volume. | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.4.2/source/markdown/podman-wait.1.md b/versioned_docs/version-5.4.2/source/markdown/podman-wait.1.md new file mode 100644 index 000000000..17f3cfa77 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman-wait.1.md @@ -0,0 +1,103 @@ +--- +title: podman-wait +version: v5.4.2 +--- + +% podman-wait 1 + +## NAME +podman\-wait - Wait on one or more containers to stop and print their exit codes + +## SYNOPSIS +**podman wait** [*options*] *container* [...] + +**podman container wait** [*options*] *container* [...] + +## DESCRIPTION +Waits on one or more containers to stop. The container can be referred to by its +name or ID. In the case of multiple containers, Podman waits on each consecutively. +After all conditions are satisfied, the containers' return codes are printed +separated by newline in the same order as they were given to the command. An +exit code of -1 is emitted for all conditions other than "stopped" and +"exited". + +When waiting for containers with a restart policy of `always` or `on-failure`, +such as those created by `podman kube play`, the containers may be repeatedly +exiting and restarting, possibly with different exit codes. `podman wait` will +only display and detect the first exit after the wait command was started. + +When running a container with podman run --rm wait does not wait for the +container to be fully removed. To wait for the removal of a container use +`--condition=removing`. + +## OPTIONS + +#### **--condition**=*state* +Container state or condition to wait for. Can be specified multiple times where at least one condition must match for the command to return. Supported values are "configured", "created", "exited", "healthy", "initialized", "paused", "removing", "running", "stopped", "stopping", "unhealthy". The default condition is "stopped". + +#### **--help**, **-h** + + Print usage statement + + +#### **--ignore** +Ignore errors when a specified container is missing and mark its return code as -1. + +#### **--interval**, **-i**=*duration* + Time interval to wait before polling for completion. A duration string is a sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". Time unit defaults to "ms". + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLES + +Wait for the specified container to exit. +``` +$ podman wait mywebserver +0 +``` + +Wait for the latest container to exit. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman wait --latest +0 +``` + +Wait for the container to exit, checking every two seconds. +``` +$ podman wait --interval 2s mywebserver +0 +``` + +Wait for the container by ID. This container exits with error status 1: +``` +$ podman wait 860a4b23 +1 +``` + +Wait for both specified containers to exit. +``` +$ podman wait mywebserver myftpserver +0 +125 +``` + +Wait for the named container to exit, but do not fail if the container does not exist. +``` +$ podman wait --ignore does-not-exist +-1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +September 2017, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.4.2/source/markdown/podman.1.md b/versioned_docs/version-5.4.2/source/markdown/podman.1.md new file mode 100644 index 000000000..e5c9b3262 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podman.1.md @@ -0,0 +1,487 @@ +--- +title: podman +version: v5.4.2 +--- + +% podman 1 + +## NAME +podman - Simple management tool for pods, containers and images + +## SYNOPSIS +**podman** [*options*] *command* + +## DESCRIPTION +Podman (Pod Manager) is a fully featured container engine that is a simple daemonless tool. +Podman provides a Docker-CLI comparable command line that eases the transition from other +container engines and allows the management of pods, containers and images. Simply put: `alias docker=podman`. +Most Podman commands can be run as a regular user, without requiring additional +privileges. + +Podman uses Buildah(1) internally to create container images. Both tools share image +(not container) storage, hence each can use or manipulate images (but not containers) +created by the other. + +Default settings for flags are defined in `containers.conf`. Most settings for +Remote connections use the server's containers.conf, except when documented in +man pages. + +**podman [GLOBAL OPTIONS]** + +## GLOBAL OPTIONS + +#### **--cgroup-manager**=*manager* + +The CGroup manager to use for container cgroups. Supported values are __cgroupfs__ or __systemd__. Default is _systemd_ unless overridden in the containers.conf file. + +Note: Setting this flag can cause certain commands to break when called on containers previously created by the other CGroup manager type. +Note: CGroup manager is not supported in rootless mode when using CGroups Version V1. + +#### **--config** +Location of config file. Mainly for docker compatibility, only the authentication parts of the config are supported. + +#### **--conmon** +Path of the conmon binary (Default path is configured in `containers.conf`) + +#### **--connection**, **-c** +Connection to use for remote podman, including Mac and Windows (excluding WSL2) machines, (Default connection is configured in `containers.conf`) +Setting this option switches the **--remote** option to true. +Remote connections use local containers.conf for default. + +#### **--events-backend**=*type* + +Backend to use for storing events. Allowed values are **file**, **journald**, and +**none**. When *file* is specified, the events are stored under +`/events/events.log` (see **--tmpdir** below). + +#### **--help**, **-h** + +Print usage statement + +#### **--hooks-dir**=*path* + +Each `*.json` file in the path configures a hook for Podman containers. For more details on the syntax of the JSON files and the semantics of hook injection, see `oci-hooks(5)`. Podman and libpod currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. + +This option may be set multiple times; paths from later options have higher precedence (`oci-hooks(5)` discusses directory precedence). + +For the annotation conditions, libpod uses any annotations set in the generated OCI configuration. + +For the bind-mount conditions, only mounts explicitly requested by the caller via `--volume` are considered. Bind mounts that libpod inserts by default (e.g. `/dev/shm`) are not considered. + +If `--hooks-dir` is unset for root callers, Podman and libpod currently default to `/usr/share/containers/oci/hooks.d` and `/etc/containers/oci/hooks.d` in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting `--hooks-dir`. + +Podman and libpod currently support an additional `precreate` state which is called before the runtime's `create` operation. Unlike the other stages, which receive the container state on their standard input, `precreate` hooks receive the proposed runtime configuration on their standard input. They may alter that configuration as they see fit, and write the altered form to their standard output. + +**WARNING**: the `precreate` hook allows powerful changes to occur, such as adding additional mounts to the runtime configuration. That power also makes it easy to break things. Before reporting libpod errors, try running a container with `precreate` hooks disabled to see if the problem is due to one of the hooks. + +#### **--identity**=*path* + +Path to ssh identity file. If the identity file has been encrypted, podman prompts the user for the passphrase. +If no identity file is provided and no user is given, podman defaults to the user running the podman command. +Podman prompts for the login password on the remote server. + +Identity value resolution precedence: + - command line value + - environment variable `CONTAINER_SSHKEY`, if `CONTAINER_HOST` is found + - `containers.conf` +Remote connections use local containers.conf for default. + +#### **--imagestore**=*path* + +Path of the imagestore where images are stored. By default, the storage library stores all the images in the graphroot but if an imagestore is provided, then the storage library will store newly pulled images in the provided imagestore and keep using the graphroot for everything else. If the user is using the overlay driver, then the images which were already part of the graphroot will still be accessible. + +This will override *imagestore* option in `containers-storage.conf(5)`, refer to `containers-storage.conf(5)` for more details. + +#### **--log-level**=*level* + +Log messages at and above specified level: __debug__, __info__, __warn__, __error__, __fatal__ or __panic__ (default: _warn_) + +#### **--module**=*path* + +Load the specified `containers.conf(5)` module. Can be an absolute or relative path. Please refer to `containers.conf(5)` for details. + +This flag is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. +Further note that the flag is a root-level flag and must be specified before any Podman sub-command. + +#### **--network-cmd-path**=*path* +Path to the `slirp4netns(1)` command binary to use for setting up a slirp4netns network. +If "" is used, then the binary will first be searched using the `helper_binaries_dir` option in `containers.conf`, and second using the `$PATH` environment variable. +**Note:** This option is deprecated and will be removed with Podman 6.0. Use the `helper_binaries_dir` option in `containers.conf` instead. + +#### **--network-config-dir**=*directory* + +Path to the directory where network configuration files are located. +For the netavark backend "/etc/containers/networks" is used as root +and "$graphroot/networks" as rootless. +For the CNI backend the default is "/etc/cni/net.d" as root +and "$HOME/.config/cni/net.d" as rootless. +CNI is deprecated and will be removed in the next major Podman version 5.0 in preference of Netavark. + +#### **--out**=*path* +Redirect the output of podman to the specified path without affecting the container output or its logs. This parameter can be used to capture the output from any of podman's commands directly into a file and enable suppression of podman's output by specifying /dev/null as the path. To explicitly disable the container logging, the **--log-driver** option should be used. + +#### **--remote**, **-r** +When true, access to the Podman service is remote. Defaults to false. +Settings can be modified in the containers.conf file. If the CONTAINER_HOST +environment variable is set, the **--remote** option defaults to true. + +#### **--root**=*value* + +Storage root dir in which data, including images, is stored (default: "/var/lib/containers/storage" for UID 0, "$HOME/.local/share/containers/storage" for other users). +Default root dir configured in `containers-storage.conf(5)`. + +Overriding this option causes the *storage-opt* settings in `containers-storage.conf(5)` to be ignored. The user must specify additional options via the `--storage-opt` flag. + +#### **--runroot**=*value* + +Storage state directory where all state information is stored (default: "/run/containers/storage" for UID 0, "/run/user/$UID/run" for other users). +Default state dir configured in `containers-storage.conf(5)`. + +#### **--runtime**=*value* + +Name of the OCI runtime as specified in containers.conf or absolute path to the OCI compatible binary used to run containers. + +#### **--runtime-flag**=*flag* + +Adds global flags for the container runtime. To list the supported flags, please +consult the manpages of the selected container runtime (`runc` is the default +runtime, the manpage to consult is `runc(8)`. When the machine is configured +for cgroup V2, the default runtime is `crun`, the manpage to consult is `crun(8)`.). + +Note: Do not pass the leading `--` to the flag. To pass the runc flag `--log-format json` +to podman build, the option given can be `--runtime-flag log-format=json`. + + +#### **--ssh**=*value* + +This option allows the user to change the ssh mode, meaning that rather than using the default **golang** mode, one can instead use **--ssh=native** +to use the installed ssh binary and config file declared in containers.conf. + +#### **--storage-driver**=*value* + +Storage driver. The default storage driver for UID 0 is configured in `containers-storage.conf(5)` in rootless mode), and is *vfs* for non-root users when *fuse-overlayfs* is not available. The `STORAGE_DRIVER` environment variable overrides the default. The --storage-driver specified driver overrides all. + +Overriding this option causes the *storage-opt* settings in `containers-storage.conf(5)` to be ignored. The user must +specify additional options via the `--storage-opt` flag. + +#### **--storage-opt**=*value* + +Specify a storage driver option. Default storage driver options are configured in `containers-storage.conf(5)`. The `STORAGE_OPTS` environment variable overrides the default. The --storage-opt specified options override all. Specify --storage-opt="" so no storage options is used. + +#### **--syslog** + +Output logging information to syslog as well as the console (default *false*). + +On remote clients, including Mac and Windows (excluding WSL2) machines, logging is directed to the file $HOME/.config/containers/podman.log. + +#### **--tmpdir**=*path* + +Path to the tmp directory, for libpod runtime content. Defaults to `$XDG_RUNTIME_DIR/libpod/tmp` as rootless and `/run/libpod/tmp` as rootful. + +NOTE --tmpdir is not used for the temporary storage of downloaded images. Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + +#### **--transient-store** + +Enables a global transient storage mode where all container metadata is stored on non-persistent media (i.e. in the location specified by `--runroot`). +This mode allows starting containers faster, as well as guaranteeing a fresh state on boot in case of unclean shutdowns or other problems. However +it is not compatible with a traditional model where containers persist across reboots. + +Default value for this is configured in `containers-storage.conf(5)`. + +#### **--url**=*value* +URL to access Podman service (default from `containers.conf`, rootless `unix:///run/user/$UID/podman/podman.sock` or as root `unix:///run/podman/podman.sock`). +Setting this option switches the **--remote** option to true. + + - `CONTAINER_HOST` is of the format `://[]@][:][]` + +Details: + - `schema` is one of: + * `ssh` (default): a local unix(7) socket on the named `host` and `port`, reachable via SSH + * `tcp`: an unencrypted, unauthenticated TCP connection to the named `host` and `port` + * `unix`: a local unix(7) socket at the specified `path`, or the default for the user + - `user` defaults to either `root` or the current running user (`ssh` only) + - `password` has no default (`ssh` only) + - `host` must be provided and is either the IP or name of the machine hosting the Podman service (`ssh` and `tcp`) + - `port` defaults to 22 (`ssh` and `tcp`) + - `path` defaults to either `/run/podman/podman.sock`, or `/run/user/$UID/podman/podman.sock` if running rootless (`unix`), or must be explicitly specified (`ssh`) + +URL value resolution precedence: + - command line value + - environment variable `CONTAINER_HOST` + - `engine.service_destinations` table in containers.conf, excluding the /usr/share/containers directory + - `unix:///run/podman/podman.sock` + +Remote connections use local containers.conf for default. + +Some example URL values in valid formats: + - unix:///run/podman/podman.sock + - unix:///run/user/$UID/podman/podman.sock + - ssh://notroot@localhost:22/run/user/$UID/podman/podman.sock + - ssh://root@localhost:22/run/podman/podman.sock + - tcp://localhost:34451 + - tcp://127.0.0.1:34451 + +#### **--version**, **-v** + +Print the version + +#### **--volumepath**=*value* + +Volume directory where builtin volume information is stored (default: "/var/lib/containers/storage/volumes" for UID 0, "$HOME/.local/share/containers/storage/volumes" for other users). Default volume path can be overridden in `containers.conf`. + +## Environment Variables + +Podman can set up environment variables from env of [engine] table in containers.conf. These variables can be overridden by passing environment variables before the `podman` commands. + +#### **CONTAINERS_CONF** + +Set default locations of containers.conf file + +#### **CONTAINERS_REGISTRIES_CONF** + +Set default location of the registries.conf file. + +#### **CONTAINERS_STORAGE_CONF** + +Set default location of the storage.conf file. + +#### **CONTAINER_CONNECTION** + +Override default `--connection` value to access Podman service. Automatically enables the --remote option. + +#### **CONTAINER_HOST** + +Set default `--url` value to access Podman service. Automatically enables --remote option. + +#### **CONTAINER_SSHKEY** + +Set default `--identity` path to ssh key file value used to access Podman service. + +#### **PODMAN_CONNECTIONS_CONF** + +The path to the file where the system connections and farms created with `podman system connection add` +and `podman farm add` are stored, by default it uses `~/.config/containers/podman-connections.json`. + +#### **STORAGE_DRIVER** + +Set default `--storage-driver` value. + +#### **STORAGE_OPTS** + +Set default `--storage-opt` value. + +#### **TMPDIR** + +Set the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + +#### **XDG_CONFIG_HOME** + +In Rootless mode configuration files are read from `XDG_CONFIG_HOME` when +specified, otherwise in the home directory of the user under +`$HOME/.config/containers`. + +#### **XDG_DATA_HOME** + +In Rootless mode images are pulled under `XDG_DATA_HOME` when specified, +otherwise in the home directory of the user under +`$HOME/.local/share/containers/storage`. + +#### **XDG_RUNTIME_DIR** + +In Rootless mode temporary configuration data is stored in `${XDG_RUNTIME_DIR}/containers`. + +## Remote Access + +The Podman command can be used with remote services using the `--remote` flag. Connections can +be made using local unix domain sockets, ssh or directly to tcp sockets. When specifying the +podman --remote flag, only the global options `--url`, `--identity`, `--log-level`, `--connection` are used. + +Connection information can also be managed using the containers.conf file. + +## Exit Codes + +The exit code from `podman` gives information about why the container +failed to run or why it exited. When `podman` commands exit with a non-zero code, +the exit codes follow the `chroot` standard, see below: + + **125** The error is with podman **_itself_** + + $ podman run --foo busybox; echo $? + Error: unknown flag: --foo + 125 + + **126** Executing a _container command_ and the _command_ cannot be invoked + + $ podman run busybox /etc; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error + 126 + + **127** Executing a _container command_ and the _command_ cannot be found + + $ podman run busybox foo; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error + 127 + + **Exit code** otherwise, `podman` returns the exit code of the _container command_ + + $ podman run busybox /bin/sh -c 'exit 3'; echo $? + 3 + + +## COMMANDS + +| Command | Description | +|--------------------------------------------------|------------------------------------------------------------------------------| +| [podman-artifact(1)](podman-artifact.1.md) | Manage OCI artifacts. | +| [podman-attach(1)](podman-attach.1.md) | Attach to a running container. | +| [podman-auto-update(1)](podman-auto-update.1.md) | Auto update containers according to their auto-update policy | +| [podman-build(1)](podman-build.1.md) | Build a container image using a Containerfile. | +| [podman-farm(1)](podman-farm.1.md) | Farm out builds to machines running podman for different architectures | +| [podman-commit(1)](podman-commit.1.md) | Create new image based on the changed container. | +| [podman-completion(1)](podman-completion.1.md) | Generate shell completion scripts | +| [podman-compose(1)](podman-compose.1.md) | Run Compose workloads via an external compose provider. | +| [podman-container(1)](podman-container.1.md) | Manage containers. | +| [podman-cp(1)](podman-cp.1.md) | Copy files/folders between a container and the local filesystem. | +| [podman-create(1)](podman-create.1.md) | Create a new container. | +| [podman-diff(1)](podman-diff.1.md) | Inspect changes on a container or image's filesystem. | +| [podman-events(1)](podman-events.1.md) | Monitor Podman events | +| [podman-exec(1)](podman-exec.1.md) | Execute a command in a running container. | +| [podman-export(1)](podman-export.1.md) | Export a container's filesystem contents as a tar archive. | +| [podman-generate(1)](podman-generate.1.md) | Generate structured data based on containers, pods or volumes. | +| [podman-healthcheck(1)](podman-healthcheck.1.md) | Manage healthchecks for containers | +| [podman-history(1)](podman-history.1.md) | Show the history of an image. | +| [podman-image(1)](podman-image.1.md) | Manage images. | +| [podman-images(1)](podman-images.1.md) | List images in local storage. | +| [podman-import(1)](podman-import.1.md) | Import a tarball and save it as a filesystem image. | +| [podman-info(1)](podman-info.1.md) | Display Podman related system information. | +| [podman-init(1)](podman-init.1.md) | Initialize one or more containers | +| [podman-inspect(1)](podman-inspect.1.md) | Display a container, image, volume, network, or pod's configuration. | +| [podman-kill(1)](podman-kill.1.md) | Kill the main process in one or more containers. | +| [podman-load(1)](podman-load.1.md) | Load image(s) from a tar archive into container storage. | +| [podman-login(1)](podman-login.1.md) | Log in to a container registry. | +| [podman-logout(1)](podman-logout.1.md) | Log out of a container registry. | +| [podman-logs(1)](podman-logs.1.md) | Display the logs of one or more containers. | +| [podman-machine(1)](podman-machine.1.md) | Manage Podman's virtual machine | +| [podman-manifest(1)](podman-manifest.1.md) | Create and manipulate manifest lists and image indexes. | +| [podman-mount(1)](podman-mount.1.md) | Mount a working container's root filesystem. | +| [podman-network(1)](podman-network.1.md) | Manage Podman networks. | +| [podman-pause(1)](podman-pause.1.md) | Pause one or more containers. | +| [podman-kube(1)](podman-kube.1.md) | Play containers, pods or volumes based on a structured input file. | +| [podman-pod(1)](podman-pod.1.md) | Management tool for groups of containers, called pods. | +| [podman-port(1)](podman-port.1.md) | List port mappings for a container. | +| [podman-ps(1)](podman-ps.1.md) | Print out information about containers. | +| [podman-pull(1)](podman-pull.1.md) | Pull an image from a registry. | +| [podman-push(1)](podman-push.1.md) | Push an image, manifest list or image index from local storage to elsewhere. | +| [podman-rename(1)](podman-rename.1.md) | Rename an existing container. | +| [podman-restart(1)](podman-restart.1.md) | Restart one or more containers. | +| [podman-rm(1)](podman-rm.1.md) | Remove one or more containers. | +| [podman-rmi(1)](podman-rmi.1.md) | Remove one or more locally stored images. | +| [podman-run(1)](podman-run.1.md) | Run a command in a new container. | +| [podman-save(1)](podman-save.1.md) | Save image(s) to an archive. | +| [podman-search(1)](podman-search.1.md) | Search a registry for an image. | +| [podman-secret(1)](podman-secret.1.md) | Manage podman secrets. | +| [podman-start(1)](podman-start.1.md) | Start one or more containers. | +| [podman-stats(1)](podman-stats.1.md) | Display a live stream of one or more container's resource usage statistics. | +| [podman-stop(1)](podman-stop.1.md) | Stop one or more running containers. | +| [podman-system(1)](podman-system.1.md) | Manage podman. | +| [podman-tag(1)](podman-tag.1.md) | Add an additional name to a local image. | +| [podman-top(1)](podman-top.1.md) | Display the running processes of a container. | +| [podman-unmount(1)](podman-unmount.1.md) | Unmount a working container's root filesystem. | +| [podman-unpause(1)](podman-unpause.1.md) | Unpause one or more containers. | +| [podman-unshare(1)](podman-unshare.1.md) | Run a command inside of a modified user namespace. | +| [podman-untag(1)](podman-untag.1.md) | Remove one or more names from a locally-stored image. | +| [podman-update(1)](podman-update.1.md) | Update the configuration of a given container. | +| [podman-version(1)](podman-version.1.md) | Display the Podman version information. | +| [podman-volume(1)](podman-volume.1.md) | Simple management tool for volumes. | +| [podman-wait(1)](podman-wait.1.md) | Wait on one or more containers to stop and print their exit codes. | + +## CONFIGURATION FILES + +**containers.conf** (`/usr/share/containers/containers.conf`, `/etc/containers/containers.conf`, `$HOME/.config/containers/containers.conf`) + +Podman has builtin defaults for command line options. These defaults can be overridden using the containers.conf configuration files. + +Distributions ship the `/usr/share/containers/containers.conf` file with their default settings. Administrators can override fields in this file by creating the `/etc/containers/containers.conf` file. Users can further modify defaults by creating the `$HOME/.config/containers/containers.conf` file. Podman merges its builtin defaults with the specified fields from these files, if they exist. Fields specified in the users file override the administrator's file, which overrides the distribution's file, which override the built-in defaults. + +Podman uses builtin defaults if no containers.conf file is found. + +If the **CONTAINERS_CONF** environment variable is set, then its value is used for the containers.conf file rather than the default. + +**mounts.conf** (`/usr/share/containers/mounts.conf`) + +The mounts.conf file specifies volume mount directories that are automatically mounted inside containers when executing the `podman run` or `podman start` commands. Administrators can override the defaults file by creating `/etc/containers/mounts.conf`. + +When Podman runs in rootless mode, the file `$HOME/.config/containers/mounts.conf` overrides the default if it exists. For details, see containers-mounts.conf(5). + +**policy.json** (`/etc/containers/policy.json`, `$HOME/.config/containers/policy.json`) + +Signature verification policy files are used to specify policy, e.g. trusted keys, applicable when deciding whether to accept an image, or individual signatures of that image, as valid. For details, see containers-policy.json(5). + +**registries.conf** (`/etc/containers/registries.conf`, `$HOME/.config/containers/registries.conf`) + +registries.conf is the configuration file which specifies which container registries is consulted when completing image names which do not include a registry or domain portion. + +Non root users of Podman can create the `$HOME/.config/containers/registries.conf` file to be used instead of the system defaults. + +If the **CONTAINERS_REGISTRIES_CONF** environment variable is set, then its value is used for the registries.conf file rather than the default. + +**storage.conf** (`/etc/containers/storage.conf`, `$HOME/.config/containers/storage.conf`) + +storage.conf is the storage configuration file for all tools using containers/storage + +The storage configuration file specifies all of the available container storage options for tools using shared container storage. + +When Podman runs in rootless mode, the file `$HOME/.config/containers/storage.conf` is used instead of the system defaults. + +If the **CONTAINERS_STORAGE_CONF** environment variable is set, then its value is used for the storage.conf file rather than the default. + +## Rootless mode +Podman can also be used as non-root user. When podman runs in rootless mode, a user namespace is automatically created for the user, defined in /etc/subuid and /etc/subgid. + +Containers created by a non-root user are not visible to other users and are not seen or managed by Podman running as root. + +It is required to have multiple UIDS/GIDS set for a user. Be sure the user is present in the files `/etc/subuid` and `/etc/subgid`. + +Execute the following commands to add the ranges to the files + + $ sudo usermod --add-subuids 10000-75535 USERNAME + $ sudo usermod --add-subgids 10000-75535 USERNAME + +Or just add the content manually. + + $ echo USERNAME:10000:65536 >> /etc/subuid + $ echo USERNAME:10000:65536 >> /etc/subgid + +See the `subuid(5)` and `subgid(5)` man pages for more information. + + + +Note: whitespace in any row of /etc/subuid or /etc/subgid, including trailing blanks, may result in no entry failures. + +Images are pulled under `XDG_DATA_HOME` when specified, otherwise in the home directory of the user under `.local/share/containers/storage`. + +Currently slirp4netns or pasta is required to be installed to create a network +device, otherwise rootless containers need to run in the network namespace of +the host. + +In certain environments like HPC (High Performance Computing), users cannot take advantage of the additional UIDs and GIDs from the /etc/subuid and /etc/subgid systems. However, in this environment, rootless Podman can operate with a single UID. To make this work, set the `ignore_chown_errors` option in the `containers-storage.conf(5)` file. This option tells Podman when pulling an image to ignore chown errors when attempting to change a file in a container image to match the non-root UID in the image. This means all files get saved as the user's UID. Note this can cause issues when running the container. + +### **NOTE:** Unsupported file systems in rootless mode + +The Overlay file system (OverlayFS) is not supported with kernels prior to 5.12.9 in rootless mode. The fuse-overlayfs package is a tool that provides the functionality of OverlayFS in user namespace that allows mounting file systems in rootless environments. It is recommended to install the fuse-overlayfs package. In rootless mode, Podman automatically uses the fuse-overlayfs program as the mount_program if installed, as long as the $HOME/.config/containers/storage.conf file was not previously created. If storage.conf exists in the homedir, add `mount_program = "/usr/bin/fuse-overlayfs"` under `[storage.options.overlay]` to enable this feature. + +The Network File System (NFS) and other distributed file systems (for example: Lustre, Spectrum Scale, the General Parallel File System (GPFS)) are not supported when running in rootless mode as these file systems do not understand user namespace. However, rootless Podman can make use of an NFS Homedir by modifying the `$HOME/.config/containers/storage.conf` to have the `graphroot` option point to a directory stored on local (Non NFS) storage. + +## SEE ALSO +**[containers-mounts.conf(5)](https://github.com/containers/common/blob/main/docs/containers-mounts.conf.5.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **oci-hooks(5)**, **[containers-policy.json(5)](https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/main/man/runc.8.md)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, **[pasta(1)](https://passt.top/builds/latest/web/passt.1.html)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +See [podman-rootless(7)](https://github.com/containers/podman/blob/main/rootless.md) +for rootless issues. + +## HISTORY +Dec 2016, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.4.2/source/markdown/podmansh.1.md b/versioned_docs/version-5.4.2/source/markdown/podmansh.1.md new file mode 100644 index 000000000..0e4f1bb90 --- /dev/null +++ b/versioned_docs/version-5.4.2/source/markdown/podmansh.1.md @@ -0,0 +1,138 @@ +--- +title: podmansh +version: v5.4.2 +--- + +% podmansh 1 + +## NAME +podmansh - Execute login shell within the Podman `podmansh` container + +## SYNOPSIS +**podmansh** + +## DESCRIPTION + +Execute a user shell within a container when the user logs into the system. The container that the users get added to can be defined via a Podman Quadlet file. This user only has access to volumes and capabilities configured into the Quadlet file. + +Administrators can create a Quadlet in /etc/containers/systemd/users, which systemd will start for all users when they log in. The administrator can create a specific Quadlet with the container name `podmansh`, then enable users to use the login shell /usr/bin/podmansh. These user login shells are automatically executed inside the `podmansh` container via Podman. + +Optionally, the administrator can place Quadlet files in the /etc/containers/systemd/users/${UID} directory for a user. Only this UID will execute these Quadlet services when that user logs in. + +The user is confined to the container environment via all of the security mechanisms, including SELinux. The only information that will be available from the system comes from volumes leaked into the container. + +Systemd will automatically create the container when the user session is started. Systemd will take down the container when all connections to the user session are removed. This means users can log in to the system multiple times, with each session connected to the same container. + +Administrators can use volumes to expose specific host data from the host system to the user, without the user being exposed to other parts of the system. + +Timeout for podmansh can be set using the `podmansh_timeout` option in containers.conf. + +## Setup +Create user login session using useradd while running as root. + +``` +# useradd -s /usr/bin/podmansh lockedu +# grep lockedu /etc/passwd +lockedu:x:4008:4008::/home/lockedu:/usr/bin/podmansh +``` + +Create a Podman Quadlet file that looks something like one of the following. + +Fully locked down container, no access to host OS. + +``` +# USERID=$(id -u lockedu) +# mkdir -p /etc/containers/systemd/users/${USERID} +# cat > /etc/containers/systemd/users/${USERID}/podmansh.container << _EOF +[Unit] +Description=The podmansh container +After=local-fs.target + +[Container] +Image=registry.fedoraproject.org/fedora +ContainerName=podmansh +RemapUsers=keep-id +RunInit=yes +DropCapability=all +NoNewPrivileges=true + +Exec=sleep infinity + +[Install] +RequiredBy=default.target +_EOF +``` + +Alternatively, while running as root, create a Quadlet where the user is allowed to become root within the user namespace. They can also permanently read/write content from their home directory which is volume mounted from the actual host's users account, rather than being inside of the container. + +``` +# useradd -s /usr/bin/podmansh confinedu +# grep confinedu /etc/passwd +confinedu:x:4009:4009::/home/confinedu:/usr/bin/podmansh +# USERID=$(id -u confinedu) +# mkdir -p /etc/containers/systemd/users/${USERID} +# cat > /etc/containers/systemd/users/${USERID}/podmansh.container << _EOF +[Unit] +Description=The podmansh container +After=local-fs.target + +[Container] +Image=registry.fedoraproject.org/fedora +ContainerName=podmansh +RemapUsers=keep-id +RunInit=yes + +Volume=%h/data:%h:Z +Exec=sleep infinity + +[Service] +ExecStartPre=/usr/bin/mkdir -p %h/data + +[Install] +RequiredBy=default.target +_EOF +``` + +Another example, while running as root, create a Quadlet where the users inside this container are allowed to execute containers with SELinux separation and able to read and write content in the $HOME/data directory. + +``` +# useradd -s /usr/bin/podmansh fullu +# grep fullu /etc/passwd +fullu:x:4010:4010::/home/fullu:/usr/bin/podmansh +# USERID=$(id -u fullu) +# mkdir -p /etc/containers/systemd/users/${USERID} +# cat > /etc/containers/systemd/users/${USERID}/podmansh.container << _EOF +[Unit] +Description=The podmansh container +After=local-fs.target + +[Container] +Image=registry.fedoraproject.org/fedora +ContainerName=podmansh +RemapUsers=keep-id +RunInit=yes +PodmanArgs=--security-opt=unmask=/sys/fs/selinux \ + --security-opt=label=nested \ + --security-opt=label=user:container_user_u \ + --security-opt=label=type:container_user_t \ + --security-opt=label=role:container_user_r \ + --security-opt=label=level:s0-s0:c0.c1023 + +Volume=%h/data:%h:Z +WorkingDir=%h +Volume=/sys/fs/selinux:/sys/fs/selinux +Exec=sleep infinity + +[Service] +ExecStartPre=/usr/bin/mkdir -p %h/data + +[Install] +RequiredBy=default.target +_EOF +``` + +## SEE ALSO +**[containers.conf(5)](containers.conf.5.md)**, **[podman(1)](podman.1.md)**, **[podman-exec(1)](podman-exec.1.md)**, **[podman-systemd.unit(5)](podman-systemd.unit.5.md)** + +## HISTORY +May 2023, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.4.2/tutorials/README.md b/versioned_docs/version-5.4.2/tutorials/README.md new file mode 100644 index 000000000..643688c98 --- /dev/null +++ b/versioned_docs/version-5.4.2/tutorials/README.md @@ -0,0 +1,46 @@ +--- +title: Podman Tutorials +version: v5.4.2 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +# Podman Tutorials + +## Links to a number of useful tutorials for the Podman utility. + +**[Introduction Tutorial](podman_tutorial.md)** + +Learn how to set up Podman and perform some basic commands with the utility. + +**[Basic Setup and Use of Podman in a Rootless environment](rootless_tutorial.md)** + +The steps required to set up rootless Podman are enumerated. + +**[Setup Mac/Windows](mac_win_client.md)** + +Special setup for running the Podman remote client on a Mac or Windows PC and connecting to Podman running on a Linux VM are documented. + +**[Remote Client](remote_client.md)** + +A brief how-to on using the Podman remote-client. + +**[How to use libpod for custom/derivative projects](podman-derivative-api.md)** + +How the libpod API can be used within your own project. + +**[Image Signing](image_signing.md)** + +Learn how to set up and use image signing with Podman. + +**[Basic Networking](basic_networking.md)** + +A basic guide to common network setups with Podman + +**[Socket activation](socket_activation.md)** + +Learn how to run containers that support socket activation. + +**[Performance](performance.md)** + +Performance guide regarding Podman configuration and usage. diff --git a/versioned_docs/version-5.4.2/tutorials/basic_networking.md b/versioned_docs/version-5.4.2/tutorials/basic_networking.md new file mode 100644 index 000000000..f7acb8714 --- /dev/null +++ b/versioned_docs/version-5.4.2/tutorials/basic_networking.md @@ -0,0 +1,336 @@ +--- +title: Basic Networking Guide for Podman +version: v5.4.2 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + + +# Basic Networking Guide for Podman + + +It seems once people understand the basics of containers, networking is one of the first +aspects they begin experimenting with. And regarding networking, it takes very +little experimentation before ending up on the deep end of the pool. The following +guide shows the most common network setups for Podman rootful and rootless containers. +Each setup is supported with an example. + + +## Differences between rootful and rootless container networking + +One of the guiding factors on networking for containers with Podman is going to +be whether or not the container is run by a root user or not. This is because +unprivileged users cannot create networking interfaces on the host. Therefore, +for rootless containers, the default network mode is slirp4netns. Because of the +limited privileges, slirp4netns lacks some of the features of networking +compared to rootful Podman's networking; for example, slirp4netns cannot give +containers a routable IP address. The default networking mode for rootful +containers on the other side is netavark, which allows a container to have a +routable IP address. + +## Firewalls + +The role of a firewall will not impact the setup and configuration of networking, +but it will impact traffic on those networks. The most obvious is inbound network +traffic to the container host, which is being passed onto containers usually with +port mapping. Depending on the firewall implementation, we have observed firewall +ports being opened automatically due to running a container with a port mapping (for +example). If container traffic does not seem to work properly, check the firewall +and allow traffic on ports the container is using. A common problem is that +reloading the firewall deletes the netavark iptables rules resulting in a loss of +network connectivity for rootful containers. Podman v3 provides the podman +network reload command to restore this without having to restart the container. + +## Basic Network Setups + +Most containers and pods being run with Podman adhere to a couple of simple scenarios. +By default, rootful Podman will create a bridged network. This is the most straightforward +and preferred network setup for Podman. Bridge networking creates an interface for +the container on an internal bridge network, which is then connected to the internet +via Network Address Translation(NAT). We also see users wanting to use `macvlan` +for networking as well. The `macvlan` plugin forwards an entire network interface +from the host into the container, allowing it access to the network the host is connected +to. And finally, the default network configuration for rootless containers is slirp4netns. +The slirp4netns network mode has limited capabilities but can be run on users without +root privileges. It creates a tunnel from the host into the container to forward +traffic. + +### Bridge + +A bridge network is defined as an internal network is created where both the +container and host are attached. Then this network is capable of allowing the containers +to communicate outside the host. + + +*[Image: bridge_network]* + +Consider the above illustration. It depicts a laptop user running two containers: +a web and db instance. These two containers are on the virtual network with the +host. Additionally, by default, these containers can initiate communications outside +the laptop (to the Internet for example). The containers on the virtual network +typically have non-routable, also known as private IP addresses. + +When dealing with communication that is being initiated outside the host, the outside +client typically must address the laptop’s external network interface and given port +number. Assuming the host allows incoming traffic, the host will know to forward +the incoming traffic on that port to the specific container. To accomplish this, +firewall rules are added to forward traffic when a container requests a specific +port be forwarded. + +Bridge networking is the default for Podman containers created as root. Podman provides +a default bridge network, but you can create others using the `podman network create` +command. Containers can be joined to a network when they are created with the +`--network` flag, or after they are created via the `podman network connect` and +`podman network disconnect` commands. + +As mentioned earlier, slirp4netns is the default network configuration for rootless +users. But as of Podman version 4.0, rootless users can also use netavark. +The user experience of rootless netavark is very akin to a rootful netavark, except that +there is no default network configuration provided. You simply need to create a +network, and the one will be created as a bridge network. If you would like to switch from +CNI networking to netavark, you must issue the `podman system reset --force` command. +This will delete all of your images, containers, and custom networks. + +``` +$ podman network create +``` + +When rootless containers are run, network operations +will be executed inside an extra network namespace. To join this namespace, use +`podman unshare --rootless-netns`. + +#### Default Network + +The default network `podman` with netavark is memory-only. It does not support dns resolution because of backwards compatibility with Docker. To change settings, export the in-memory network and change the file. + +For the default rootful network use +``` +podman network inspect podman | jq .[] > /etc/containers/networks/podman.json +``` + +And for the rootless network use + +``` +podman network inspect podman | jq .[] > ~/.local/share/containers/storage/networks/podman.json +``` + + +#### Example + +By default, rootful containers use the netavark for its default network if +you have not migrated from Podman v3. +In this case, no network name must be passed to Podman. However, you can create +additional bridged networks with the podman create command. + +The following example shows how to set up a web server and expose it to the network +outside the host as both rootful and rootless. It will also show how an outside +client can connect to the container. + +``` +(rootful) $ sudo podman run -dt --name webserver -p 8080:80 quay.io/libpod/banner +00f3440c7576aae2d5b193c40513c29c7964e96bf797cf0cc352c2b68ccbe66a +``` + +Now run the container. +``` +$ podman run -dt --name webserver --network podman1 -p 8081:80 quay.io/libpod/banner +269fd0d6b2c8ed60f2ca41d7beceec2471d72fb9a33aa8ca45b81dc9a0abbb12 +``` +Note in the above run command, the container’s port 80 (where the Nginx server is +running) was mapped to the host’s port 8080. Port 8080 was chosen to demonstrate +how the host and container ports can be mapped for external access. The port could +very well have been 80 as well (except for rootless users). + +To connect from an outside client to the webserver, simply point an HTTP client to +the host’s IP address at port 8080 for rootful and port 8081 for rootless. +``` +(outside_host): $ curl 192.168.99.109:8080 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ + +(outside_host): $ curl 192.168.99.109:8081 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ +``` + +### Macvlan + +With macvlan, the container is given access to a physical network interface on the +host. This interface can configure multiple subinterfaces. And each subinterface +is capable of having its own MAC and IP address. In the case of Podman containers, +the container will present itself as if it is on the same network as the host. + +*[Image: macvlan_network]* + +In the illustration, outside clients will be able to access the web container by +its IP address directly. Usually the network information, including IP address, +is leased from a DHCP server like most other network clients on the network. If +the laptop is running a firewall, such as firewalld, then accommodations will need +to be made for proper access. + +Note that Podman has to be run as root in order to use macvlan. + +#### Example + +The following example demonstrates how to set up a web container on a macvlan and +how to access that container from outside the host. First, create the macvlan network. + You need to know the network interface on the host that connects to the routable +network. In the example case, it is eth0. + +``` +$ sudo podman network create -d macvlan -o parent=eth0 webnetwork +webnetwork +``` + +The next step is to ensure that the DHCP service is running. This handles +the DHCP leases from the network. If DHCP is not needed, the `--subnet` option +can be used to assign a static subnet in the `network create` command above. + +CNI and netavark both use their own DHCP service; therefore, you need to know +what backend you are using. To see what you are using, run this command: +``` +$ sudo podman info --format {{.Host.NetworkBackend}} +``` +If this command does not work, you are using an older version prior to Podman +v4.0 which means you are using CNI. +If the netavark backend is used, at least Podman v4.5 with netavark v1.6 is +required to use DHCP. + +For netavark use: +``` +$ sudo systemctl enable --now netavark-dhcp-proxy.socket +``` +Or if the system doesn't use systemd, start the daemon manually: +``` +$ /usr/libexec/podman/netavark dhcp-proxy --activity-timeout 0 +``` + +With CNI use: +``` +$ sudo systemctl enable --now cni-dhcp.socket +``` +Or if the system doesn't use systemd, start the daemon manually: +``` +$ sudo /usr/libexec/cni/dhcp daemon +``` +Note that depending on the distribution, the binary location may differ. + +Now run the container and be certain to attach it to the network we created earlier. +``` +$ sudo podman run -dt --name webserver --network webnetwork quay.io/libpod/banner +03d82083c434d7e937fc0b87c25401f46ab5050007df403bf988e25e52c5cc40 +[baude@localhost ~]$ sudo podman exec webserver ip address show eth0 +2: eth0@if3: mtu 1500 qdisc noqueue state +UP +link/ether 0a:3c:e2:eb:87:0f brd ff:ff:ff:ff:ff:ff +inet 192.168.99.186/24 brd 192.168.99.255 scope global eth0 +valid_lft forever preferred_lft forever +inet6 fe80::83c:e2ff:feeb:870f/64 scope link +valid_lft forever preferred_lft forever +``` +Because the container has a routable IP address (on this network) and is not being +managed by firewalld, no change to the firewall is needed. +``` +(outside_host): $ curl http://192.168.99.186 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ +``` + + + +### Slirp4netns + +Slirp4netns is the default network setup for rootless containers and pods. It was +invented because unprivileged users are not allowed to make network interfaces on +the host. Slirp4netns creates a TAP device in the container’s network namespace +and connects to the usermode TCP/IP stack. Consider the following illustration. + +*[Image: slirp_network]* + +The unprivileged user on this laptop has created two containers: a DB container and +a web container. Both of these containers have the ability to access content on +networks outside the laptop. And outside clients can access the containers if the +container is bound to a host port and the laptop firewall allows it. Remember, unprivileged +users must use ports 1024 through 65535 as lower ports require root privileges. (CAP_NET_BIND_SERVICE) +Note: this can be adjusted using the `sysctl net.ipv4.ip_unprivileged_port_start` + +One of the drawbacks of slirp4netns is that the containers are completely isolated +from each other. Unlike the bridge approach, there is no virtual network. For containers +to communicate with each other, they can use the port mappings with the host system, +or they can be put into a Pod where they share the same network namespace. See [Communicating +between containers and pods](#Communicating-between-containers-and-pods) for more information. + +#### Example + +The following example will show how two rootless containers can communicate with +each other where one is a web server. Then it will show how a client on the host’s +network can communicate with the rootless web server. + +First, run the rootless web server and map port 80 from the container to a non-privileged +port like 8080. +``` +$ podman run -dt --name webserver -p 8080:80 quay.io/libpod/banner +17ea33ccd7f55ff45766b3ec596b990a5f2ba66eb9159cb89748a85dc3cebfe0 +``` +Because rootless containers cannot communicate with each other directly with TCP/IP +via IP addresses, the host and the port mapping are used. To do so, the IP address +of the host (interface) must be known. +``` +$ ip address show eth0 +3: eth0: mtu 1500 qdisc fq_codel state UP group +default qlen 1000 +link/ether 3c:e1:a1:c1:7a:3f brd ff:ff:ff:ff:ff:ff +altname eth0 +inet 192.168.99.109/24 brd 192.168.99.255 scope global dynamic noprefixroute eth0 +valid_lft 78808sec preferred_lft 78808sec +inet6 fe80::5632:6f10:9e76:c33/64 scope link noprefixroute +valid_lft forever preferred_lft forever +``` +From another rootless container, use the host’s IP address and port to communicate +between the two rootless containers successfully. +``` +$ podman run -it quay.io/libpod/banner curl http://192.168.99.109:8080 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ +``` + +From a client outside the host, the IP address and port can also be used: +``` +(outside_host): $ curl http://192.168.99.109:8080 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ +``` + +## Communicating between containers and pods + +Most users of containers have a decent understanding of how containers communicate +with each other and the rest of the world. Usually each container has its own IP +address and networking information. They communicate amongst each other using regular +TCP/IP means like IP addresses or, in many cases, using DNS names often based on +the container name. But pods are a collection of one or more containers, and with +that, some uniqueness is inherited. + +By definition, all containers in a Podman pod share the same network namespace. This +fact means that they will have the same IP address, MAC addresses, and port mappings. +You can conveniently communicate between containers in a pod by using localhost. + +*[Image: slirp_network]* + +The above illustration describes a Pod on a bridged network. As depicted, the Pod +has two containers “inside” it: a DB and a Web container. Because they share the +same network namespace, the DB and Web container can communicate with each other +using localhost (127.0.0.1). Furthermore, they are also both addressable by the +IP address (and DNS name if applicable) assigned to the Pod itself. + +For more information on container to container networking, see [Configuring container +networking with Podman](https://www.redhat.com/sysadmin/container-networking-podman). diff --git a/versioned_docs/version-5.4.2/tutorials/image_signing.md b/versioned_docs/version-5.4.2/tutorials/image_signing.md new file mode 100644 index 000000000..47fbfed7f --- /dev/null +++ b/versioned_docs/version-5.4.2/tutorials/image_signing.md @@ -0,0 +1,199 @@ +--- +title: How to sign and distribute container images using Podman +version: v5.4.2 +--- + +# How to sign and distribute container images using Podman + +Signing container images originates from the motivation of trusting only +dedicated image providers to mitigate man-in-the-middle (MITM) attacks or +attacks on container registries. One way to sign images is to utilize a GNU +Privacy Guard ([GPG][0]) key. This technique is generally compatible with any +OCI compliant container registry like [Quay.io][1]. It is worth mentioning that +the OpenShift integrated container registry supports this signing mechanism out +of the box, which makes separate signature storage unnecessary. + +[0]: https://gnupg.org +[1]: https://quay.io + +From a technical perspective, we can utilize Podman to sign the image before +pushing it into a remote registry. After that, all systems running Podman have +to be configured to retrieve the signatures from a remote server, which can +be any simple web server. This means that every unsigned image will be rejected +during an image pull operation. But how does this work? + +First of all, we have to create a GPG key pair or select an already locally +available one. To generate a new GPG key, just run `gpg --full-gen-key` and +follow the interactive dialog. Now we should be able to verify that the key +exists locally: + +```bash +> gpg --list-keys sgrunert@suse.com +pub rsa2048 2018-11-26 [SC] [expires: 2020-11-25] + XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX +uid [ultimate] Sascha Grunert +sub rsa2048 2018-11-26 [E] [expires: 2020-11-25] +``` + +Now let’s assume that we run a container registry. For example we could simply +start one on our local machine: + +```bash +sudo podman run -d -p 5000:5000 docker.io/registry +``` + +The registry does not know anything about image signing, it just provides the remote +storage for the container images. This means if we want to sign an image, we +have to take care of how to distribute the signatures. + +Let’s choose a standard `alpine` image for our signing experiment: + +```bash +sudo podman pull docker://docker.io/alpine:latest +``` + +```bash +sudo podman images alpine +REPOSITORY TAG IMAGE ID CREATED SIZE +docker.io/library/alpine latest e7d92cdc71fe 6 weeks ago 5.86 MB +``` + +Now we can re-tag the image to point it to our local registry: + +```bash +sudo podman tag alpine localhost:5000/alpine +``` + +```bash +sudo podman images alpine +REPOSITORY TAG IMAGE ID CREATED SIZE +localhost:5000/alpine latest e7d92cdc71fe 6 weeks ago 5.86 MB +docker.io/library/alpine latest e7d92cdc71fe 6 weeks ago 5.86 MB +``` + +Podman would now be able to push the image and sign it in one command. But to +let this work, we have to modify our system-wide registries configuration at +`/etc/containers/registries.d/default.yaml`: + +```yaml +default-docker: + sigstore: http://localhost:8000 # Added by us + sigstore-staging: file:///var/lib/containers/sigstore +``` + +We can see that we have two signature stores configured: + +- `sigstore`: referencing a web server for signature reading +- `sigstore-staging`: referencing a file path for signature writing + +Now, let’s push and sign the image: + +```bash +sudo -E GNUPGHOME=$HOME/.gnupg \ + podman push \ + --tls-verify=false \ + --sign-by sgrunert@suse.com \ + localhost:5000/alpine +… +Storing signatures +``` + +If we now take a look at the systems signature storage, then we see that there +is a new signature available, which was caused by the image push: + +```bash +sudo ls /var/lib/containers/sigstore +'alpine@sha256=e9b65ef660a3ff91d28cc50eba84f21798a6c5c39b4dd165047db49e84ae1fb9' +``` + +The default signature store in our edited version of +`/etc/containers/registries.d/default.yaml` references a web server listening at +`http://localhost:8000`. For our experiment, we simply start a new server inside +the local staging signature store: + +```bash +sudo bash -c 'cd /var/lib/containers/sigstore && python3 -m http.server' +Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ... +``` + +Let’s remove the local images for our verification test: + +``` +sudo podman rmi docker.io/alpine localhost:5000/alpine +``` + +We have to write a policy to enforce that the signature has to be valid. This +can be done by adding a new rule in `/etc/containers/policy.json`. From the +below example, copy the `"docker"` entry into the `"transports"` section of your +`policy.json`. + +```json +{ + "default": [{ "type": "insecureAcceptAnything" }], + "transports": { + "docker": { + "localhost:5000": [ + { + "type": "signedBy", + "keyType": "GPGKeys", + "keyPath": "/tmp/key.gpg" + } + ] + } + } +} +``` + +The `keyPath` does not exist yet, so we have to put the GPG key there: + +```bash +gpg --output /tmp/key.gpg --armor --export sgrunert@suse.com +``` + +If we now pull the image: + +```bash +sudo podman pull --tls-verify=false localhost:5000/alpine +… +Storing signatures +e7d92cdc71feacf90708cb59182d0df1b911f8ae022d29e8e95d75ca6a99776a +``` + +Then we can see in the logs of the web server that the signature has been +accessed: + +``` +127.0.0.1 - - [04/Mar/2020 11:18:21] "GET /alpine@sha256=e9b65ef660a3ff91d28cc50eba84f21798a6c5c39b4dd165047db49e84ae1fb9/signature-1 HTTP/1.1" 200 - +``` + +As a counterpart example, if we specify the wrong key at `/tmp/key.gpg`: + +```bash +gpg --output /tmp/key.gpg --armor --export mail@saschagrunert.de +File '/tmp/key.gpg' exists. Overwrite? (y/N) y +``` + +Then a pull is not possible any more: + +```bash +sudo podman pull --tls-verify=false localhost:5000/alpine +Trying to pull localhost:5000/alpine... +Error: pulling image "localhost:5000/alpine": unable to pull localhost:5000/alpine: unable to pull image: Source image rejected: Invalid GPG signature: … +``` + +So in general there are four main things to be taken into consideration when +signing container images with Podman and GPG: + +1. We need a valid private GPG key on the signing machine and corresponding + public keys on every system which would pull the image +2. A web server has to run somewhere which has access to the signature storage +3. The web server has to be configured in any + `/etc/containers/registries.d/*.yaml` file +4. Every image pulling system has to be configured to contain the enforcing + policy configuration via `policy.conf` + +That’s it for image signing and GPG. The cool thing is that this setup works out +of the box with [CRI-O][2] as well and can be used to sign container images in +Kubernetes environments. + +[2]: https://cri-o.io diff --git a/versioned_docs/version-5.4.2/tutorials/mac_client.md b/versioned_docs/version-5.4.2/tutorials/mac_client.md new file mode 100644 index 000000000..022c522c5 --- /dev/null +++ b/versioned_docs/version-5.4.2/tutorials/mac_client.md @@ -0,0 +1,7 @@ +--- +title: "[Podman Mac Client tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md)" +version: v5.4.2 +--- + +# [Podman Mac Client tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) +This tutorial has moved! You can find out how to set up Podman on macOS (as well as Windows) [here](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) diff --git a/versioned_docs/version-5.4.2/tutorials/mac_win_client.md b/versioned_docs/version-5.4.2/tutorials/mac_win_client.md new file mode 100644 index 000000000..8bf281376 --- /dev/null +++ b/versioned_docs/version-5.4.2/tutorials/mac_win_client.md @@ -0,0 +1,120 @@ +--- +title: Podman Remote clients for macOS and Windows +version: v5.4.2 +--- + +# Podman Remote clients for macOS and Windows + +*** +**_NOTE:_** For running Podman on Windows, refer to the [Podman for Windows](podman-for-windows.md) guide, which uses the recommended approach of a Podman-managed Linux backend. For Mac, see the [Podman installation instructions](https://podman.io/getting-started/installation). This guide covers the advanced usage of Podman with a custom Linux VM or a remote external Linux system. +*** + +## Introduction + +The core Podman runtime environment can only run on Linux operating systems. But other operating systems can use the “remote client” to manage their containers to a Linux backend. This remote client is nearly identical to the standard Podman program. Certain functions that do not make sense for remote clients have been removed. For example, the “--latest” switch for container commands has been removed. + +### Brief architecture + +The remote client uses a client-server model. You need Podman installed on a Linux machine or VM that also has the SSH daemon running. On the local operating system, when you execute a Podman command, Podman connects to the server via SSH. It then connects to the Podman service by using systemd socket activation. The Podman commands are executed on the server. From the client's point of view, it seems like Podman runs locally. + +## Obtaining and installing Podman + +### Windows + +Installing the Windows Podman client begins by downloading the Podman Windows installer. The Windows installer is built with each Podman release and is downloadable from its [release description page](https://github.com/containers/podman/releases/latest). The Windows installer file is named `podman-#.#.#-setup.exe`, where the `#` symbols represent the version number of Podman. + +Once you have downloaded the installer to your Windows host, simply double click the installer and Podman will be installed. The path is also set to put `podman` in the default user path. + +Podman must be run at a command prompt using the Windows Command Prompt (`cmd.exe`) or PowerShell (`pwsh.exe`) applications. + +### macOS + +The Mac Client is available through [Homebrew](https://brew.sh/). You can download homebrew via the instructions on their site. Install podman using: +``` +$ brew install podman +``` + +## Creating the first connection + +### Enable the Podman service on the server machine. + +Before performing any Podman client commands, you must enable the podman.sock SystemD service on the Linux server. In these examples, we are running Podman as a normal, unprivileged user, also known as a rootless user. By default, the rootless socket listens at `/run/user/${UID}/podman/podman.sock`. You can enable and start this socket permanently, using the following commands: +``` +$ systemctl --user enable --now podman.socket +``` +You will need to enable linger for this user in order for the socket to work when the user is not logged in. + +``` +sudo loginctl enable-linger $USER +``` + +You can verify that the socket is listening with a simple Podman command. + +``` +$ podman --remote info +host: + arch: amd64 + buildahVersion: 1.16.0-dev + cgroupVersion: v2 + conmon: + package: conmon-2.0.19-1.fc32.x86_64 +``` + +#### Enable sshd + +In order for the client to communicate with the server you need to enable and start the SSH daemon on your Linux machine, if it is not currently enabled. +``` +sudo systemctl enable --now sshd +``` + +#### Setting up SSH +Remote podman uses SSH to communicate between the client and server. The remote client works considerably smoother using SSH keys. To set up your ssh connection, you need to generate an ssh key pair from your client machine. +``` +$ ssh-keygen +``` +Your public key by default should be in your home directory under .ssh\id_rsa.pub. You then need to copy the contents of id_rsa.pub and append it into ~/.ssh/authorized_keys on the Linux server. On a Mac, you can automate this using ssh-copy-id. + +If you do not wish to use SSH keys, you will be prompted with each Podman command for your login password. + +## Using the client + +The first step in using the Podman remote client is to configure a connection.. + +You can add a connection by using the `podman system connection add` command. + +``` +C:\Users\baude> podman system connection add baude --identity c:\Users\baude\.ssh\id_rsa ssh://192.168.122.1/run/user/1000/podman/podman.sock +``` + +This will add a remote connection to Podman and if it is the first connection added, it will mark the connection as the default. You can observe your connections with `podman system connection list` + +``` +C:\Users\baude> podman system connection list +Name Identity URI +baude* id_rsa ssh://baude@192.168.122.1/run/user/1000/podman/podman.sock +``` + +Now we can test the connection with `podman info`. + +``` +C:\Users\baude> podman info +host: + arch: amd64 + buildahVersion: 1.16.0-dev + cgroupVersion: v2 + conmon: + package: conmon-2.0.19-1.fc32.x86_64 +``` + +Podman has also introduced a “--connection” flag where you can use other connections you have defined. If no connection is provided, the default connection will be used. + +``` +C:\Users\baude> podman system connection --help +``` + +## Wrap up + +You can use the podman remote clients to manage your containers running on a Linux server. The communication between client and server relies heavily on SSH connections and the use of SSH keys are encouraged. Once you have Podman installed on your remote client, you should set up a connection using `podman system connection add` which will then be used by subsequent Podman commands. + +## History +Originally published on [Red Hat Enable Sysadmin](https://www.redhat.com/sysadmin/podman-clients-macos-windows) diff --git a/versioned_docs/version-5.4.2/tutorials/performance.md b/versioned_docs/version-5.4.2/tutorials/performance.md new file mode 100644 index 000000000..3899645f7 --- /dev/null +++ b/versioned_docs/version-5.4.2/tutorials/performance.md @@ -0,0 +1,249 @@ +--- +title: Podman performance guide +version: v5.4.2 +--- + +# Podman performance guide + +The performance of Podman may be influenced by a number of factors, such as, + +* the specified Podman command-line options and configuration +* the OCI runtime +* the host file system +* the container image + +Changing any of these may or may not have any noticeable effect on the performance of Podman on your system. + +## Using a separate user account for benchmarking + +Some performance tips, such as using a different storage driver would require the user to run `podman system reset`, +which erases all containers and container images for the user. +Instead of benchmarking different alternatives in your own home directory, you could create a new user +that afterwards can be removed. + +### Example: Specify the storage driver _vfs_ and run `/bin/true` in an Alpine container + +Interactively + +``` +sudo useradd testuser +sudo machinectl shell testuser@ +podman pull docker.io/library/alpine +/usr/bin/time -v podman --storage-driver=vfs run --rm docker.io/library/alpine /bin/true +exit +``` + +Noninteractively + +``` +sudo useradd testuser +systemd-run --machine=testuser@ --quiet --user --collect --pipe --wait \ + podman --storage-driver=vfs pull docker.io/library/alpine +systemd-run --machine=testuser@ --quiet --user --collect --pipe --wait \ + /usr/bin/time -v podman --storage-driver=vfs run --rm docker.io/library/alpine /bin/true +``` + +The command `/usr/bin/time -v` measures and displays benchmarking information. + +## Performance considerations + +### Use a fast OCI runtime + +Podman uses an OCI runtime when running containers. +The fastest OCI runtime is probably [__crun__](https://github.com/containers/crun). + +Check that you are using crun + +``` +$ podman info --format={{.Host.OCIRuntime.Name}} +crun +``` + +To benchmark an OCI runtime, create a test user account and +specify the OCI runtime path with [__--runtime__](https://docs.podman.io/en/latest/markdown/podman.1.html#runtime-value). + +### Choosing a storage driver + +The following storage drivers are listed from fastest to slowest: + +1. native overlayfs +2. fuse-overlayfs +3. vfs + +There is one notable exception to this speed ranking. +Creating a container takes significantly longer with _native overlayfs_ than _fuse-overlayfs_ +when these conditions are all met: + +* rootless Podman is used +* a modified UID/GID mapping is used +* _native overlayfs_ is used +* no container has yet been created with the specified container image and UID/GID mapping + +Runtime speed is not affected. Only __podman create__ and the container creation phases of +__podman run__ and __podman build__ are affected. +For more details, see [GitHub comment](https://github.com/containers/podman/issues/16541#issuecomment-1352790422). +Command-line options that modify the UID/GID mapping are for example __--userns__, __--uidmap__ and __--gidmap__. +The command-line option `--userns auto` is particularly affected by this performance penalty, +because different UID/GID mappings could potentially be used on each invocation. For other uses of +__--userns__, __--uidmap__ and __--gidmap__ the performance penalty is a one-time cost +that only occurs the first time the command is run. + +Using native overlayfs as an unprivileged user is available for Podman version >= 3.1 on a Linux kernel version >= 5.13. +If SELinux is not used, then Linux kernel version 5.11 or later is sufficient. +Native overlayfs support is included in RHEL >= 8.5, see [release notes](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/8.5_release_notes/index). + +To show the current storage driver + +``` +$ podman info -f {{.Store.GraphDriverName}} +overlay +$ podman info -f '{{index .Store.GraphStatus "Native Overlay Diff"}}' +true +``` + +Storage driver | Result of `podman info -f {{.Store.GraphDriverName}}` | Result of `podman info -f '{{index .Store.GraphStatus "Native Overlay Diff"}}` +---- | ------ | ----- +native overlayfs | overlay | true +fuse-overlayfs | overlay | false +VFS | vfs | false + +Before changing the storage driver, running `podman system reset` is required. +The command erases all containers and container images for the user. +See the example above "_Using a separate user account for benchmarking_" for how to benchmark a storage driver in a separate test account. + +#### Specifying the storage driver with command-line options + +Storage driver | Podman command +---- | ------ +native overlayfs | `podman --storage-driver=overlay run ...` +fuse-overlayfs | `podman --storage-driver=overlay --storage-opt overlay.mount_program=/usr/bin/fuse-overlayfs run ...` +VFS | `podman --storage-driver=vfs run ...` + +#### Configuring the default storage driver + +The default storage driver can be configured in +_/etc/containers/storage.conf_ and overridden by a user in +_~/.config/containers/storage.conf_ + +To configure native overlayfs: +``` +[storage] +driver = "overlay" +``` + +To configure fuse-overlayfs: +``` +[storage] +driver = "overlay" +[storage.options.overlay] +mount_program = "/usr/bin/fuse-overlayfs" +``` + +To configure VFS: +``` +[storage] +driver = "vfs" +``` + +See storage.conf(5) for all available configuration settings. + +### Network performance for rootless Podman + +When using rootless Podman, network traffic is normally passed through the network driver +[pasta](https://passt.top/passt/about/#pasta). This comes with a performance penalty. + +You can avoid using _pasta_ in the following ways: + +* Use socket activation for listening network sockets. Communication over the activated socket does not pass through + pasta, so it has the same performance characteristics as the normal network on the host. + Socket-activated services can be started and stopped in different ways: + + Let systemd start the service when the first client connects. Let the service terminate by itself after some time of inactivity. + Using a service on demand, can free up compute resources. + + Start the service explicitly (`systemctl --user enable foobar.service`). If the service is already + running when the first client connects, there will be no delay due to container startup. + The [socket activation tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/socket_activation.md) + provides more information about socket activation support in Podman. + +* Set up the network manually as root. Create a bridge and virtual ethernet pair (VETH). Note: compared to other methods, + this setup doesn't provide any network isolation. In containers granted CAP_NET_ADMIN or CAP_NET_RAW, processes can + open packet or raw sockets directly facing the host, which allows them to send arbitrary frames, including + crafted Ethernet and IP packets, as well as receiving packets that were not originally intended for the container, + by means of ARP spoofing. + For more information, see + + An [example](https://lists.podman.io/archives/list/podman@lists.podman.io/thread/W6MCYO6RY5YFRTSUDAOEZA7SC2EFXRZE/) posted on the Podman mailing list + + The section _DIY networking_ in [Podman-Rootless-Networking.pdf](https://containers.github.io/podman.io_old/old/community/meeting/notes/2021-10-05/Podman-Rootless-Networking.pdf) + +* Use `--network=host`. No network namespace is created. The container will use the host’s network. + Note: By using `--network=host`, the container is given full access to local system services such as D-bus and is therefore considered insecure. + +Side note: Pasta is faster than the network driver [slirp4netns](https://github.com/containers/podman/blob/main/docs/tutorials/basic_networking.md#slirp4netns). +Pasta is the default network driver since Podman 5.0.0. + +Since Podman 5.1.0 the default network driver can be shown with + +``` +$ podman info -f '{{.Host.RootlessNetworkCmd}}' +pasta +``` + +### Lazy pulling of container images + +Podman supports lazy pulling for the following container image formats: + +* __zstd:chunked__ + +* __eStargz__ + +__zstd:chunked__ has better performance than __eStargz__. + +See the article [_Pull container images faster with partial pulls_](https://www.redhat.com/sysadmin/faster-container-image-pulls) by Giuseppe Scrivano and Dan Walsh. + +### Choosing a host file system + +Lazy pulling of container images can run more efficiently when the file system has reflink support. The file systems XFS and BTRFS have reflink support. + +### Option --log-driver + +The `podman run` option [__--log-driver__](https://docs.podman.io/en/latest/markdown/podman-run.1.html#log-driver-driver) specifies the logging driver for the container. + +If logging is not needed, consider using `--log-driver=none` to disable logging. + +### Reuse the package repository cache when building container images + +The first step of a container build is often to download metadata from +the package repositories and post-process that data. + +To speed up container builds, you could prepare a directory on the host +that contains the package metadata and then make the directory available +to the container build by using an _overlay mount_. + +#### Example : Speed up _podman build_ by reusing the DNF metadata cache + +In this example the containers are based on Fedora 36. + +First create an empty directory on the host, for example *$HOME/dnf_cache_f36*. + +``` +$ mkdir $HOME/dnf_cache_f36 +``` + +Fill the directory with the most recent __dnf__ metadata cache. + +``` +$ podman run --rm -v $HOME/dnf_cache_f36:/var/cache/dnf:Z registry.fedoraproject.org/fedora:36 dnf makecache +``` + +Create a new directory, for example, _$HOME/ctr_ and a file _$HOME/ctr/Containerfile_ with these contents + +``` +FROM registry.fedoraproject.org/fedora:36 +RUN dnf -y update && dnf -y install cowsay && dnf clean all +``` + +To build the Containerfile using the prepared metadata cache, provide the directory _$HOME/dnf_cache_f36_ as an _overlay mount_ (volume option `:O`) + +``` +$ podman build -v $HOME/dnf_cache_f36:/var/cache/dnf:O -t cowsay $HOME/ctr +``` + +The article [_Speeding up container image builds with Buildah_](https://www.redhat.com/sysadmin/speeding-container-buildah) by Dan Walsh provides more details. diff --git a/versioned_docs/version-5.4.2/tutorials/podman-derivative-api.md b/versioned_docs/version-5.4.2/tutorials/podman-derivative-api.md new file mode 100644 index 000000000..c1a457718 --- /dev/null +++ b/versioned_docs/version-5.4.2/tutorials/podman-derivative-api.md @@ -0,0 +1,60 @@ +--- +title: How to use libpod for custom/derivative projects +version: v5.4.2 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +# How to use libpod for custom/derivative projects + +libpod today is a Golang library and a CLI. The choice of interface you make has advantages and disadvantages. + +Using the REST API +--- + +Advantages: + + - Stable, versioned API + - Language-agnostic + - [Well-documented](http://docs.podman.io/en/latest/_static/api.html) API + +Disadvantages: + + - Error handling is less verbose than Golang API + - May be slower + +Running as a subprocess +--- + +Advantages: + + - Many commands output JSON + - Works with languages other than Golang + - Easy to get started + +Disadvantages: + + - Error handling is harder + - May be slower + - Can't hook into or control low-level things like how images are pulled + +Vendoring into a Go project +--- + +Advantages: + + - Significant power and control + +Disadvantages: + + - You are now on the hook for container runtime security updates (partially, `runc`/`crun` are separate) + - Binary size + - Potential skew between multiple libpod versions operating on the same storage can cause problems + +Making the choice +--- + +A good question to ask first is: Do you want users to be able to use `podman` to manipulate the containers created by your project? +If so, that makes it more likely that you want to run `podman` as a subprocess or using the HTTP API. If you want a separate image store and a fundamentally +different experience; if what you're doing with containers is quite different from those created by the `podman` CLI, +that may drive you towards vendoring. diff --git a/versioned_docs/version-5.4.2/tutorials/podman-for-windows.md b/versioned_docs/version-5.4.2/tutorials/podman-for-windows.md new file mode 100644 index 000000000..4239de83d --- /dev/null +++ b/versioned_docs/version-5.4.2/tutorials/podman-for-windows.md @@ -0,0 +1,426 @@ +--- +title: Documentation +version: v5.4.2 +--- + +![](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +Podman for Windows +================== + +While "containers are Linux," Podman also runs on Mac and Windows, where it +provides a native CLI and embeds a guest Linux system to launch your +containers. This guest is referred to as a Podman machine and is managed with +the `podman machine` command. On Windows, each Podman machine is backed by a +virtualized Windows Subsystem for Linux (WSLv2) distribution. The podman command +can be run directly from your Windows PowerShell (or CMD) prompt, where it +remotely communicates with the podman service running in the WSL environment. +Alternatively, you can access Podman directly from the WSL instance if you +prefer a Linux prompt and Linux tooling. In addition to command-line access, +Podman also listens for Docker API clients, supporting direct usage of +Docker-based tools and programmatic access from your language of choice. + +Prerequisites +------------- + +Since Podman uses WSL, you need a recent release of Windows 10 or Windows 11. +On x64, WSL requires build 18362 or later, and 19041 or later is required for +arm64 systems. Internally, WSL uses virtualization, so your system must +support and have hardware virtualization enabled. If you are running Windows +on a VM, you must have a VM that supports nested virtualization. + +It is also recommended to install the modern "Windows Terminal," which +provides a superior user experience to the standard PowerShell and CMD +prompts, as well as a WSL prompt, should you want it. + +You can install it by searching the Windows Store or by running the following +`winget` command: + +`winget install Microsoft.WindowsTerminal` + + +Installing Podman +----------------- + +Installing the Windows Podman client begins by downloading the Podman Windows +installer. The Windows installer is built with each Podman release and can be +downloaded from the official + [GitHub release page](https://github.com/containers/podman/releases). +Be sure to download a 4.1 or later release for the capabilities discussed +in this guide. + +*[Image: Installing Podman 4.1.0]* + +Once downloaded, simply run the EXE file, and relaunch a new terminal. After +this point, podman.exe will be present on your PATH, and you will be able to run +the `podman machine init` command to create your first machine. + +`PS C:\Users\User> podman machine init` + +Automatic WSL Installation +-------------------------- + +If WSL has not been installed on your system, the first machine init command +will prompt a dialog to begin an automated install. If accepted, this process +will install the necessary Windows components, restart the system, and after +login, relaunch the machine creation process in a terminal window. Be sure to +wait a minute or two for the relaunch to occur, as Windows has a delay before +executing startup items. Alternatively, you can decline automatic installation +and install WSL manually. However, this will require additional download and +setup time. + +Machine Init Process +-------------------- + +After WSL is installed, the init command will install a minimal installation +of Fedora, customizing it to run podman. + +``` +PS C:\Users\User> podman machine init +Extracting compressed file +Importing operating system into WSL (this may take 5+ minutes on a new WSL install)... +Installing packages (this will take a while)... +Complete! +Configuring system... +Generating public/private ed25519 key pair. +Your identification has been saved in podman-machine-default +Your public key has been saved in podman-machine-default.pub +The key fingerprint is: +SHA256:RGTGg2Q/LX7ijN+mzu8+BzcS3cEWP6Hir6pYllJtceA root@WINPC +Machine init complete +To start your machine run: + + podman machine start +``` + + +Starting Machine +---------------- + +After the machine init process completes, it can then be started and stopped +as desired: + +``` +PS C:\Users\User> podman machine start + +Starting machine "podman-machine-default" + +This machine is currently configured in rootless mode. If your containers +require root permissions (e.g. ports < 1024), or if you run into compatibility +issues with non-podman clients, you can switch using the following command: + + podman machine set --rootful + +API forwarding listening on: npipe:////./pipe/docker_engine + +Docker API clients default to this address. You do not need to set DOCKER_HOST. +Machine "podman-machine-default" started successfully +``` + +First Podman Command +-------------------- + +From this point on, podman commands operate similarly to how they would on +Linux. + +For a quick working example with a small image, you can run the Linux date +command on PowerShell. + +``` +PS C:\Users\User> podman run ubi8-micro date +Thu May 5 21:56:42 UTC 2022 +``` + +Port Forwarding +--------------- + +Port forwarding also works as expected; ports will be bound against localhost +(127.0.0.1). Note: When running as rootless (the default), you must use a port +greater than 1023. See the Rootful and Rootless section for more details. + +To launch httpd, you can run: + +``` +PS C:\Users\User> podman run --rm -d -p 8080:80 --name httpd docker.io/library/httpd +f708641300564a6caf90c145e64cd852e76f77f6a41699478bb83a162dceada9 +``` + +A curl command against localhost on the PowerShell prompt will return a +successful HTTP response: + +``` +PS C:\Users\User> curl http://localhost:8080/ -UseBasicParsing + +StatusCode : 200 +StatusDescription : OK +Content :

It works!

+``` + +As with Linux, to stop, run: + +`podman stop httpd` + + +Using API Forwarding +-------------------- + +API forwarding allows Docker API tools and clients to use podman as if it was +Docker. Provided there is no other service listening on the Docker API pipe; +no special settings will be required. + +``` +PS C:\Users\User> .\docker.exe run -it fedora echo "Hello Podman!" +Hello Podman! +``` + +Otherwise, after starting the machine, you will be notified of an environment +variable you can set for tools to point to podman. Alternatively, you can shut +down both the conflicting service and podman, then finally run `podman machine +start` to restart, which should grab the Docker API address. + + +``` +Another process was listening on the default Docker API pipe address. +You can still connect Docker API clients by setting DOCKER HOST using the +following PowerShell command in your terminal session: + + $Env:DOCKER_HOST = 'npipe:////./pipe/podman-machine-default' + +Or in a classic CMD prompt: + + set DOCKER_HOST=npipe:////./pipe/podman-machine-default + +Alternatively, terminate the other process and restart podman machine. +Machine "podman-machine-default" started successfully + +PS C:\Users\User> $Env:DOCKER_HOST = 'npipe:////./pipe/podman-machine-default' +PS C:\Users\User>.\docker.exe version --format '{{(index .Server.Components 0).Name}}' +Podman Engine +``` + +Rootful & Rootless +------------------ + +On the embedded WSL Linux distro, podman can either be run under the root user +(rootful) or a non-privileged user (rootless). For behavioral consistency with +Podman on Linux, rootless is the default. Note: Rootful and Rootless +containers are distinct and isolated from one another. Podman commands against +one (e.g., podman ps) will not represent results/state for the other. + +While most containers run fine in a rootless setting, you may find a case +where the container only functions with root privileges. If this is the case, +you can switch the machine to rootful by stopping it and using the set +command: + +``` +podman machine stop +podman machine set --rootful +``` + +To restore rootless execution, set rootful to false: + +``` +podman machine stop +podman machine set --rootful=false +``` + +Another case in which you may wish to use rootful execution is binding a port +less than 1024. However, future versions of podman will likely drop this to a +lower number to improve compatibility with defaults on system port services (such +as MySQL) + +Volume Mounting +--------------- + +New in Podman v4.1 is the ability to perform volume mounts from Windows paths into a +Linux container. This supports several notation schemes, including: + +Windows Style Paths: + +`podman run --rm -v c:\Users\User\myfolder:/myfolder ubi8-micro ls /myfolder` + +Unixy Windows Paths: + +`podman run --rm -v /c/Users/User/myfolder:/myfolder ubi8-micro ls /myfolder` + +Linux paths local to the WSL filesystem: + +`podman run --rm -v /var/myfolder:/myfolder ubi-micro ls /myfolder` + +All of the above conventions work, whether running on a Windows prompt or the +WSL Linux shell. Although when using Windows paths on Linux, appropriately quote +or escape the Windows path portion of the argument. + + +Listing Podman Machine(s) +------------------------- + +To list the available podman machine instances and their current resource +usage, use the `podman machine ls` command: + +``` +PS C:\Users\User> podman machine ls + + +NAME VM TYPE CREATED LAST UP CPUS MEMORY DISK SIZE +podman-machine-default wsl 2 hours ago Currently running 4 331.1MB 768MB +``` + +Since WSL shares the same virtual machine and Linux kernel across multiple +distributions, the CPU and Memory values represent the total resources shared +across running systems. The opposite applies to the Disk value. It is +independent and represents the amount of storage for each individual +distribution. + + +Accessing the Podman Linux Environment +-------------------------------------- + +While using the podman.exe client on the Windows environment provides a +seamless native experience supporting the usage of local desktop tools and +APIs, there are a few scenarios in which you may wish to access the Linux +environment: + ++ Updating to the latest stable packages on the embedded Fedora instance ++ Using Linux development tools directly ++ Using a workflow that relies on EXT4 filesystem performance or behavior + semantics + +There are three mechanisms to access the embedded WSL distribution: +1. SSH using `podman machine ssh` +2. WSL command on the Windows PowerShell prompt +3. Windows Terminal Integration + +### Using SSH + +SSH access provides a similar experience as Podman on Mac. It immediately +drops you into the appropriate user based on your machine's rootful/rootless +configuration (root in the former, 'user' in the latter). The --username +option can be used to override with a specific user. + +An example task using SSH is updating your Linux environment to pull down the +latest OS bugfixes: + +`podman machine ssh sudo dnf upgrade -y` + +### Using the WSL Command + +The `wsl` command provides direct access to the Linux system but enters the +shell as root first. This is due to design limitations of WSL, where running +systemd (Linux's system services) requires the usage of a privileged process +namespace. + +Unless you have no other distributions of WSL installed, it's recommended to +use the `-d` option with the name of your podman machine (podman-machine-default +is the default) + +``` +PS C:\Users\User> wsl -d podman-machine-default +``` + +You will be automatically entered into a nested process namespace where +systemd is running. If you need to access the parent namespace, hit `ctrl-d` +or type exit. This also means to log out, you need to exit twice. + +``` +[root@WINPC /]# podman --version +podman version 4.1.0 +``` + + +To access commands as the non-privileged user (rootless podman), you must +first type `su user`. Alternatively, you can prefix the `wsl` command to use the +special `enterns`: + +``` +wsl -d podman-machine-default enterns su user +[user@WINPC /]$ id +uid=1000(user) gid=1000(user) groups=1000(user),10(wheel) +``` + +Likewise, running commands as root without entering a prompt should also be +prefixed with `enterns`. + +`wsl -d podman-machine-default enterns systemctl status` + +Accessing the WSL instance as a specific user using `wsl -u` or using inline +commands without `enterns` is not recommended since commands will execute +against the incorrect namespace. + +### Using Windows Terminal Integration + +Entering WSL as root is a 2-click operation. Simply click the drop-down tag, +and pick 'podman-machine-default,' where you will be entered directly as root. + +*[Image: Using WSL in Windows Terminal]* + +As before, to switch to a non-privileged user for rootless podman commands, +type `su user`. + +``` +[root@WINPC /]# su user +[user@WINPC /]$ podman info --format '{{.Store.RunRoot}}' +/run/user/1000/containers +``` + +Stopping a Podman Machine +------------------------- + +To stop a running podman machine, use the `podman machine stop` command: + +``` +PS C:\Users\User> podman machine stop +Machine "podman-machine-default" stopped successfully +``` + +Removing a Podman Machine +------------------------- + +To remove a machine, use the `podman machine rm` command: + +``` +PS C:\Users\User> podman machine rm + +The following files will be deleted: + +C:\Users\User\.ssh\podman-machine-default +C:\Users\User\.ssh\podman-machine-default.pub +C:\Users\User\.local\share\containers\podman\machine\wsl\podman-machine-default_fedora-35-x86_64.tar +C:\Users\User\.config\containers\podman\machine\wsl\podman-machine-default.json +C:\Users\User\.local\share\containers\podman\machine\wsl\wsldist\podman-machine-default + + +Are you sure you want to continue? [y/N] y +``` + + + +Troubleshooting +--------------- + +Recovering from a failed auto-installation of WSL + +If auto-install fails and retrying is unsuccessful, you can attempt to reset +your WSL system state and perform a manual WSL installation using the `wsl +--install` command. To do so, perform the following steps: + +1. Launch PowerShell as administrator + ``` + Start-Process powershell -Verb RunAs + ``` +2. Disable WSL Features + ``` + dism.exe /online /disable-feature /featurename:Microsoft-Windows-Subsystem-Linux /norestart + dism.exe /online /disable-feature /featurename:VirtualMachinePlatform /norestart + ``` +3. Reboot +4. Run manual WSL install + ``` + wsl --install + ``` +5. Continue with podman machine init + +Install Certificate Authority +============================= + +Instructions for installing a CA certificate can be found [here](podman-install-certificate-authority.md). diff --git a/versioned_docs/version-5.4.2/tutorials/podman-install-certificate-authority.md b/versioned_docs/version-5.4.2/tutorials/podman-install-certificate-authority.md new file mode 100644 index 000000000..7e7cd5701 --- /dev/null +++ b/versioned_docs/version-5.4.2/tutorials/podman-install-certificate-authority.md @@ -0,0 +1,114 @@ +--- +title: Documentation +version: v5.4.2 +--- + +*[Image: PODMAN logo]* + +Install Certificate Authority +============================= + +Organizations may create their own local certificate authority (CA) or acquire one from a third party. This may mean more than one certificate, such as one or more intermediate certificates and a root certificate, for example. In any case, it is necessary to add the certificate authority (CA) certificate(s) so that it can be employed for various use cases. + +### Method one + +Certificates may be either individual or concatenated (bundles). The following steps are one method to add such certificates to Podman. It is assumed that Podman is running and the certificate(s) to be installed are available on an accessible server via curl. If such access is not possible, an alternative method follows. + +First, assuming a running Podman machine, ssh into the machine: +``` +podman machine ssh +``` + +If Podman is running in the default rootless mode, an additional command is required to get to a root shell: + +``` +[core@localhost ~]$ sudo su - +``` + +After issuing the above command, the prompt should change to indicate the "root" instead of the "core" user. + +Next, while in the machine, change to the directory where the certificate(s) should be installed: +``` +[root@localhost ~]# cd /etc/pki/ca-trust/source/anchors +``` + +Then use curl to download the certificate. Notes: +* The -k is only necessary if connecting securely to a server for which the certificate is not yet trusted +* The MY-SERVER.COM/SOME-CERTIFICATE.pem should be replaced as appropriate +``` +[root@localhost anchors]# curl -k -o some-certificate.pem https://MY-SERVER.COM/SOME-CERTIFICATE.pem +``` + +Repeat as necessary for multiple certificates. + +Once all of the certificates have been downloaded, run the command to add the certificates to the list of trusted CAs: +``` +[root@localhost anchors]# update-ca-trust +``` + +Exit the machine: +``` +[root@localhost anchors]# exit +``` + +If the "sudo su -" command was used to switch to a root shell as described above, an additional exit command is needed to exit the machine: + +``` +[core@localhost ~]$ exit +``` + +If the certificates are still not accepted, it might be necessary to restart the Podman machine. To do this, issue the following commands on the host (and not inside the Podman machine): + +``` +podman machine stop +podman machine start +``` + +### Alternative Method + +If the above method is for some reason not practical or desirable, the certificate may be created using vi. + +As above, assuming a running Podman machine, ssh into the machine: + +``` +podman machine ssh +``` + +If the prompt starts with "core" instead of "root", switch to a root shell: + +``` +[core@localhost ~]$ sudo su - +``` + +Next, change to the directory where the certificate(s) should be installed: +``` +[root@localhost ~]# cd /etc/pki/ca-trust/source/anchors +``` + +Then use vi to create the certificate. +``` +[root@localhost ~]# vi SOME-CERTIFICATE.pem +``` +After vi opens, copy the certificate to the clipboard, then in insert mode, paste the clipboard contents to vi. Lastly, save the file and close vi. + +Repeat as necessary for multiple certificates. + +Once all of the certificates have been created, run the command to add the certificates to the list of trusted CAs: +``` +[root@localhost anchors]# update-ca-trust +``` + +Exit the machine: +``` +[root@localhost anchors]# exit +``` + +If the "sudo su -" command described above was used, an additional exit command is needed: + +``` +[core@localhost ~]$ exit +``` + +### Final Notes + +The certificate installation will persist during machine restarts. There is no need to stop and start the machine to begin using the certificate. diff --git a/versioned_docs/version-5.4.2/tutorials/podman_tutorial.md b/versioned_docs/version-5.4.2/tutorials/podman_tutorial.md new file mode 100644 index 000000000..5143ba9d2 --- /dev/null +++ b/versioned_docs/version-5.4.2/tutorials/podman_tutorial.md @@ -0,0 +1,149 @@ +--- +title: Basic Setup and Use of Podman +version: v5.4.2 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +# Basic Setup and Use of Podman +Podman is a utility provided as part of the libpod library. It can be used to create and maintain +containers. The following tutorial will teach you how to set up Podman and perform some basic +commands with Podman. + +If you are running on a Mac or Windows PC, you should instead follow the [Mac and Windows tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) +to set up the remote Podman client. + +**NOTE**: the code samples are intended to be run as a non-root user, and use `sudo` where +root escalation is required. + +## Installing Podman + +For installing or building Podman, see the [installation instructions](https://podman.io/getting-started/installation). + +## Familiarizing yourself with Podman + +### Running a sample container +This sample container will run a very basic httpd server (named basic_httpd) that serves only its index +page. +```console +podman run --name basic_httpd -dt -p 8080:80/tcp docker.io/nginx +``` +Because the container is being run in detached mode, represented by the *-d* in the `podman run` command, Podman +will print the container ID after it has run. Note that we use port forwarding to be able to +access the HTTP server. For successful running at least slirp4netns v0.3.0 is needed. + +### Listing running containers +The Podman *ps* command is used to list creating and running containers. +```console +podman ps +``` + +Note: If you add *-a* to the *ps* command, Podman will show all containers. +### Inspecting a running container +You can "inspect" a running container for metadata and details about itself. We can even use +the inspect subcommand to see what IP address was assigned to the container. As the container is running in rootless mode, an IP address is not assigned and the value will be listed as "none" in the output from inspect. +```console +podman inspect basic_httpd | grep IPAddress\": + "SecondaryIPAddresses": null, + "IPAddress": "", +``` + +### Testing the httpd server +As we do not have the IP address of the container, we can test the network communication between the host +operating system and the container using curl. The following command should display the index page of our +containerized httpd server. +```console +curl http://localhost:8080 +``` + +### Viewing the container's logs +You can view the container's logs with Podman as well: +```console +podman logs +10.88.0.1 - - [07/Feb/2018:15:22:11 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:30 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:30 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:31 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:31 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +``` + +### Viewing the container's pids +And you can observe the httpd pid in the container with *top*. +```console +podman top + UID PID PPID C STIME TTY TIME CMD + 0 31873 31863 0 09:21 ? 00:00:00 nginx: master process nginx -g daemon off; + 101 31889 31873 0 09:21 ? 00:00:00 nginx: worker process +``` + +### Checkpointing the container +Checkpointing a container stops the container while writing the state of all processes in the container to disk. +With this a container can later be restored and continue running at exactly the same point in time as the +checkpoint. This capability requires CRIU 3.11 or later installed on the system. +This feature is not supported as rootless; as such, if you wish to try it, you'll need to re-create your container as root, using the same command but with sudo. + +To checkpoint the container use: +```console +sudo podman container checkpoint +``` + +### Restoring the container +Restoring a container is only possible for a previously checkpointed container. The restored container will +continue to run at exactly the same point in time it was checkpointed. +To restore the container use: +```console +sudo podman container restore +``` + +After being restored, the container will answer requests again as it did before checkpointing. +```console +curl http://:8080 +``` + +### Migrate the container +To live migrate a container from one host to another the container is checkpointed on the source +system of the migration, transferred to the destination system and then restored on the destination +system. When transferring the checkpoint, it is possible to specify an output-file. + +On the source system: +```console +sudo podman container checkpoint -e /tmp/checkpoint.tar.gz +scp /tmp/checkpoint.tar.gz :/tmp +``` + +On the destination system: +```console +sudo podman container restore -i /tmp/checkpoint.tar.gz +``` + +After being restored, the container will answer requests again as it did before checkpointing. This +time the container will continue to run on the destination system. +```console +curl http://:8080 +``` + +### Stopping the container +To stop the httpd container: +```console +podman stop +``` +You can also check the status of one or more containers using the *ps* subcommand. In this case, we should +use the *-a* argument to list all containers. +```console +podman ps -a +``` + +### Removing the container +To remove the httpd container: +```console +podman rm +``` +You can verify the deletion of the container by running *podman ps -a*. + +## Integration Tests +For more information on how to set up and run the integration tests in your environment, checkout the Integration Tests [README.md](https://github.com/containers/podman/blob/main/test/README.md) + +## More information + +For more information on Podman and its subcommands, checkout the asciiart demos on the [README.md](https://github.com/containers/podman/blob/main/README.md#commands) +page. diff --git a/versioned_docs/version-5.4.2/tutorials/podman_tutorial_cn.md b/versioned_docs/version-5.4.2/tutorials/podman_tutorial_cn.md new file mode 100644 index 000000000..a8d6d48c2 --- /dev/null +++ b/versioned_docs/version-5.4.2/tutorials/podman_tutorial_cn.md @@ -0,0 +1,175 @@ +--- +title: Documentation +version: v5.4.2 +--- + +> - 译文出自：[掘金翻译计划](https://juejin.cn/translate) + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +Podman是由libpod库提供一个实用的程序，可以被用于创建和管理容器。 + +下面的教程会教你如何启动 Podman 并使用 Podman 执行一些基本的命令。 + +如果你正在使用 Mac 或者 Windows +，你应该先查看[Mac 和 Windows 使用说明](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md)来设置 Podman +远程客户端。 + +**注意**：示例中所有命令皆以非 root 的用户运行，必要的时候通过 `sudo` 命令来获取 root 权限。 + +## 安装Podman + +安装或者编译 Podman ，请参照[安装说明](https://podman.io/getting-started/installation)。 + +## 熟悉podman + +### 运行一个示例容器 + +这个示例容器会运行一个简单的只有主页的 httpd 服务器。 + +```console +podman run --name basic_httpd -dt -p 8080:80/tcp docker.io/nginx +``` + +因为命令中的 *-d* 参数表明容器以 "detached" 模式运行，所以 Podman 会在容器运行后打印容器的 ID。 + +注意为了访问这个 HTTP 服务器，我们将使用端口转发。成功运行需要 slirp4netns 的 v0.3.0+ 版本。 + +Podman 的 *ps* 命令用于列出正在创建和运行的容器。 + +```console +podman ps +``` + +**注意**：如果为 *ps* 命令添加 *-a* 参数，Podman 将展示所有的容器。 + +### 查看正在运行的容器 + +你可以 "inspect" (查看)一个正在运行的容器的元数据以及其他详细信息。我们甚至可以使用 inspect 的子命令查看分配给容器的 IP 地址。由于容器以非 root 模式运行，没有分配 IP 地址，inspect 的输出会是 " +none" 。 + +```console +podman inspect -l | grep IPAddress\": + "SecondaryIPAddresses": null, + "IPAddress": "", +``` + +**注意**：*-l* 参数是**最近的容器**的指代，你也可以使用容器的ID 代替 *-l* + +### 测试httpd服务器 + +由于我们没有容器的 IP 地址，我们可以使用 curl 测试主机和容器之间的网络通信。下面的命令应该显示我们的容器化 httpd 服务器 的主页。 + +```console +curl http://localhost:8080 +``` + +### 查看容器的日志 + +你也可以使用 podman 查看容器的日志 + +```console +podman logs --latest +10.88.0.1 - - [07/Feb/2018:15:22:11 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:30 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:30 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:31 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:31 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +``` + +### 查看容器中的进程pid + +你可以使用 *top* 命令查看容器中 httpd 的 pid + +```console +podman top + UID PID PPID C STIME TTY TIME CMD + 0 31873 31863 0 09:21 ? 00:00:00 nginx: master process nginx -g daemon off; + 101 31889 31873 0 09:21 ? 00:00:00 nginx: worker process +``` + +### 设置容器的检查点 + +设置检查点会在停止容器的同时把容器中所有进程的状态写入磁盘。 + +有了它，容器后续可以被恢复，并在与检查点完全相同的时间点继续运行。 这个功能需要在系统上安装 CRIU 的 3.11+ 版本。 + +这个功能不支持非 root 模式，因此，如果你想尝试使用它，你需要使用 sudo 方式重新创建容器。 + +设置容器检查点请使用： + +```console +sudo podman container checkpoint +``` + +### 恢复容器 + +恢复容器只能在以前设置过检查点的容器上使用。恢复的容器会在与设置检查点时完全相同的时间点继续运行。 + +恢复容器请使用： + +```console +sudo podman container restore +``` + +恢复之后。容器会像设置检查点之前一样回复请求 + +```console +curl http://:8080 +``` + +### 迁移容器 + +为了将容器从一个主机上热迁移到另一个主机，容器可以在在源系统上创建检查点，传输到目的系统，然后再在目的系统上恢复。 +为了便于传输容器的检查点，可以将其存储在一个指定的输出文件中。 + +在源系统上： + +```console +sudo podman container checkpoint -e /tmp/checkpoint.tar.gz +scp /tmp/checkpoint.tar.gz :/tmp +``` + +在目标系统上： + +```console +sudo podman container restore -i /tmp/checkpoint.tar.gz +``` + +恢复之后，容器会像设置检查点之前一样回复请求。这时，容器会在目标系统上继续运行。 + +```console +curl http://:8080 +``` + +### 停止容器 + +停止 httpd 容器 + +```console +podman stop --latest +``` + +你还可以使用 *ps* 命令检查一个或多个容器的状态，在这个例子中，我们使用 *-a* 参数列出所有的容器。 + +```console +podman ps -a +``` + +### 移除容器 + +移除 httpd 容器 + +```console +podman rm --latest +``` + +你可以使用 *podman ps -a* 验证容器的删除。 + +## 集成测试 + +在环境中如何设置并运行集成测试请查看集成测试的[自述页面](https://github.com/containers/podman/blob/main/test/README.md) + +## 更多信息 + +有关podman 和它的子命令的更多信息请查看 podman 的[自述页面](https://github.com/containers/podman/blob/main/README.md#commands) diff --git a/versioned_docs/version-5.4.2/tutorials/qemu-remote-tutorial.md b/versioned_docs/version-5.4.2/tutorials/qemu-remote-tutorial.md new file mode 100644 index 000000000..c541ea52a --- /dev/null +++ b/versioned_docs/version-5.4.2/tutorials/qemu-remote-tutorial.md @@ -0,0 +1,137 @@ +--- +title: Podman-remote client for Windows with QEMU VM +version: v5.4.2 +--- + +# Podman-remote client for Windows with QEMU VM + +*** +**_NOTE:_** For running Podman on Windows, refer to the [Podman for Windows](podman-for-windows.md) guide, which uses the recommended approach of a Podman-managed Linux backend. For Mac, see the [Podman installation instructions](https://podman.io/getting-started/installation). This guide covers the advanced usage of Podman with a custom Linux VM. +*** + +## Introduction + +This is an experimental setup using QEMU VM for running Podman for the already supported [Podman-remote](https://docs.podman.io/en/latest/markdown/podman-remote.1.html) client on Windows. +The officially supported and recommended way of running Podman on Windows is using [Podman machine](https://docs.podman.io/en/latest/markdown/podman-machine.1.html). + +## Prerequisites + +* Windows 10 Build 18362 or later (Build 19044/Version 21H2 or later recommended) +* SSH client feature installed on the machine +* Hyper-V acceleration should be operational on the machine +* Directory `C:\qemu-remote\` will be used for storing needed assets +* Port `57561` is free to use for ssh over a loopback interface + +## Obtaining and installing + +### QEMU + +Download QEMU (7.2.0 minimal) from https://qemu.weilnetz.de/w64/ + +Then download the Fedora CoreOS (FCOS) image for QEMU from https://getfedora.org/coreos/download?tab=metal_virtualized&stream=testing&arch=x86_64 + +One will need `.xz` format extraction tool like xz itself or 7-zip. Use it to extract the `.qcow2` image to C:\qemu-remote\fedora-coreos-37.20221127.2.0-qemu.x86_64.qcow2 + +With xz the command line (when run from the same directory) will be +``` +xz -d fedora-coreos-37.20221127.2.0-qemu.x86_64.qcow2.xz +``` + +### Podman + +Download and install the latest release of Podman for Windows. Podman releases can be obtained from the official Podman GitHub release page: https://github.com/containers/podman/releases + +#### Older Podman releases + +When using older Podman releases (4.3.x and earlier), where `gvproxy.exe` is missing from the installation directory, +it could be obtained from the official releases https://github.com/containers/gvisor-tap-vsock/releases +One would need version `0.5.0` or a more recent release. Download `gvproxy-windows.exe` and copy it to +the Podman installation directory (or any other location, which is added to the PATH environment variable) +renaming the binary to `gvproxy.exe`. + +### SSH + +Generate ssh keys with an empty passphrase + +ssh-keygen -t ed25519 -f C:\qemu-remote\remote + +### Ignition for FCOS + +Create ignition file C:\qemu-remote\remote.ign with the content of +``` +{"ignition":{"config":{"replace":{"verification":{}}},"proxy":{},"security":{"tls":{}},"timeouts":{},"version":"3.2.0"},"passwd":{"users":[{"name":"core","sshAuthorizedKeys":["YOURSSHKEYHERE"],"uid":501},{"name":"root","sshAuthorizedKeys":["YOURSSHKEYHERE"]}]},"storage":{"directories":[{"group":{"name":"core"},"path":"/home/core/.config","user":{"name":"core"},"mode":493},{"group":{"name":"core"},"path":"/home/core/.config/containers","user":{"name":"core"},"mode":493},{"group":{"name":"core"},"path":"/home/core/.config/systemd","user":{"name":"core"},"mode":493},{"group":{"name":"core"},"path":"/home/core/.config/systemd/user","user":{"name":"core"},"mode":493},{"group":{"name":"core"},"path":"/home/core/.config/systemd/user/default.target.wants","user":{"name":"core"},"mode":493},{"group":{"name":"root"},"path":"/etc/containers/registries.conf.d","user":{"name":"root"},"mode":493},{"group":{"name":"root"},"path":"/etc/systemd/system.conf.d","user":{"name":"root"},"mode":493},{"group":{"name":"root"},"path":"/etc/environment.d","user":{"name":"root"},"mode":493}],"files":[{"group":{"name":"core"},"path":"/home/core/.config/systemd/user/linger-example.service","user":{"name":"core"},"contents":{"source":"data:,%5BUnit%5D%0ADescription=A%20systemd%20user%20unit%20demo%0AAfter=network-online.target%0AWants=network-online.target%20podman.socket%0A%5BService%5D%0AExecStart=%2Fusr%2Fbin%2Fsleep%20infinity%0A","verification":{}},"mode":484},{"group":{"name":"core"},"path":"/home/core/.config/containers/containers.conf","user":{"name":"core"},"contents":{"source":"data:,%5Bcontainers%5D%0Anetns=%22bridge%22%0A","verification":{}},"mode":484},{"group":{"name":"root"},"overwrite":true,"path":"/etc/subuid","user":{"name":"root"},"contents":{"source":"data:,core:100000:1000000","verification":{}},"mode":484},{"group":{"name":"root"},"overwrite":true,"path":"/etc/subgid","user":{"name":"root"},"contents":{"source":"data:,core:100000:1000000","verification":{}},"mode":484},{"group":{"name":"root"},"path":"/etc/systemd/system/user@.service.d/delegate.conf","user":{"name":"root"},"contents":{"source":"data:,%5BService%5D%0ADelegate=memory%20pids%20cpu%20io%0A","verification":{}},"mode":420},{"group":{"name":"core"},"path":"/var/lib/systemd/linger/core","user":{"name":"core"},"contents":{"verification":{}},"mode":420},{"group":{"name":"root"},"path":"/etc/containers/containers.conf","user":{"name":"root"},"contents":{"source":"data:,%5Bengine%5D%0Amachine_enabled=true%0A","verification":{}},"mode":420},{"group":{"name":"root"},"path":"/etc/containers/podman-machine","user":{"name":"root"},"contents":{"source":"data:,qemu%0A","verification":{}},"mode":420},{"group":{"name":"root"},"path":"/etc/containers/registries.conf.d/999-podman-machine.conf","user":{"name":"root"},"contents":{"source":"data:,unqualified-search-registries=%5B%22docker.io%22%5D%0A","verification":{}},"mode":420},{"group":{},"path":"/etc/tmpfiles.d/podman-docker.conf","user":{},"contents":{"source":"data:,L+%20%20%2Frun%2Fdocker.sock%20%20%20-%20%20%20%20-%20%20%20%20-%20%20%20%20%20-%20%20%20%2Frun%2Fpodman%2Fpodman.sock%0A","verification":{}},"mode":420},{"group":{"name":"root"},"path":"/etc/profile.d/docker-host.sh","user":{"name":"root"},"contents":{"source":"data:,export%20DOCKER_HOST=%22unix:%2F%2F$%28podman%20info%20-f%20%22%7B%7B.Host.RemoteSocket.Path%7D%7D%22%29%22%0A","verification":{}},"mode":420}],"links":[{"group":{"name":"core"},"path":"/home/core/.config/systemd/user/default.target.wants/linger-example.service","user":{"name":"core"},"hard":false,"target":"/home/core/.config/systemd/user/linger-example.service"},{"group":{"name":"root"},"overwrite":true,"path":"/usr/local/bin/docker","user":{"name":"root"},"hard":false,"target":"/usr/bin/podman"},{"group":{"name":"root"},"overwrite":false,"path":"/etc/localtime","user":{"name":"root"},"hard":false,"target":"\\usr\\share\\zoneinfo"}]},"systemd":{"units":[{"enabled":true,"name":"podman.socket"},{"contents":"[Unit]\nRequires=dev-virtio\\\\x2dports-vport1p1.device\nAfter=remove-moby.service sshd.socket sshd.service\nOnFailure=emergency.target\nOnFailureJobMode=isolate\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/bin/sh -c '/usr/bin/echo Ready \u003e/dev/vport1p1'\n[Install]\nRequiredBy=default.target\n","enabled":true,"name":"ready.service"},{"enabled":false,"mask":true,"name":"docker.service"},{"enabled":false,"mask":true,"name":"docker.socket"},{"contents":"[Unit]\nDescription=Remove moby-engine\n# Run once for the machine\nAfter=systemd-machine-id-commit.service\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/rpm-ostree override remove moby-engine\nExecStart=/usr/bin/rpm-ostree ex apply-live --allow-replacement\nExecStartPost=/bin/touch /var/lib/%N.stamp\n\n[Install]\nWantedBy=default.target\n","enabled":true,"name":"remove-moby.service"},{"contents":"[Unit]\nDescription=Environment setter from QEMU FW_CFG\n[Service]\nType=oneshot\nRemainAfterExit=yes\nEnvironment=FWCFGRAW=/sys/firmware/qemu_fw_cfg/by_name/opt/com.coreos/environment/raw\nEnvironment=SYSTEMD_CONF=/etc/systemd/system.conf.d/default-env.conf\nEnvironment=ENVD_CONF=/etc/environment.d/default-env.conf\nEnvironment=PROFILE_CONF=/etc/profile.d/default-env.sh\nExecStart=/usr/bin/bash -c '/usr/bin/test -f ${FWCFGRAW} \u0026\u0026\\\n\techo \"[Manager]\\n#Got from QEMU FW_CFG\\nDefaultEnvironment=$(/usr/bin/base64 -d ${FWCFGRAW} | sed -e \"s+|+ +g\")\\n\" \u003e ${SYSTEMD_CONF} ||\\\n\techo \"[Manager]\\n#Got nothing from QEMU FW_CFG\\n#DefaultEnvironment=\\n\" \u003e ${SYSTEMD_CONF}'\nExecStart=/usr/bin/bash -c '/usr/bin/test -f ${FWCFGRAW} \u0026\u0026 (\\\n\techo \"#Got from QEMU FW_CFG\"\u003e ${ENVD_CONF};\\\n\tIFS=\"|\";\\\n\tfor iprxy in $(/usr/bin/base64 -d ${FWCFGRAW}); do\\\n\t\techo \"$iprxy\" \u003e\u003e ${ENVD_CONF}; done ) || \\\n\techo \"#Got nothing from QEMU FW_CFG\"\u003e ${ENVD_CONF}'\nExecStart=/usr/bin/bash -c '/usr/bin/test -f ${FWCFGRAW} \u0026\u0026 (\\\n\techo \"#Got from QEMU FW_CFG\"\u003e ${PROFILE_CONF};\\\n\tIFS=\"|\";\\\n\tfor iprxy in $(/usr/bin/base64 -d ${FWCFGRAW}); do\\\n\t\techo \"export $iprxy\" \u003e\u003e ${PROFILE_CONF}; done ) || \\\n\techo \"#Got nothing from QEMU FW_CFG\"\u003e ${PROFILE_CONF}'\nExecStartPost=/usr/bin/systemctl daemon-reload\n[Install]\nWantedBy=sysinit.target\n","enabled":true,"name":"envset-fwcfg.service"}]}} +``` + +Replace "YOURSSHKEYHERE" with the actual pub keys you generated. + +## Launching + +### gvproxy + +One needs to run gvproxy first to make it ready for the QEMU VM launched afterward. Run it with the command below: +``` +gvproxy.exe -listen-qemu unix://C:/qemu-remote/vlan_remote.sock -pid-file C:\qemu-remote\proxy.pid -ssh-port 57561 -forward-sock C:\qemu-remote\podman.sock -forward-dest /run/user/501/podman/podman.sock -forward-user core -forward-identity C:\qemu-remote\remote +``` + +### QEMU + +Launch QEMU with the following command (the following configures it to use 4 CPUs and 8 GB RAM, but it could be adjusted for less): + +``` +qemu-system-x86_64w.exe -m 8192 -smp 4 -fw_cfg name=opt/com.coreos/config,file=C:\qemu-remote\remote.ign -netdev stream,id=vlan,server=off,addr.type=unix,addr.path=C:\qemu-remote\vlan_remote.sock -device virtio-net-pci,netdev=vlan,mac=5a:94:ef:e4:0c:ee -device virtio-serial -chardev socket,path=C:\qemu-remote\ready.sock,server=on,wait=off,id=apodman-machine-default_ready -device virtserialport,chardev=apodman-machine-default_ready,name=org.fedoraproject.port.0 -pidfile C:\qemu-remote\vm.pid -machine q35,accel=whpx:tcg -cpu max,vmx=off,monitor=off -drive if=virtio,file=C:\qemu-remote\fedora-coreos-37.20221127.2.0-qemu.x86_64.qcow2 +``` + +### First time launch extras + +Observe QEMU loading and wait for the message of SSH keys being provisioned to the machine. Next, before making the first ssh connection, one would need to add it to known hosts. +We are using `127.0.0.1` instead of `localhost` to force IPv4. + +``` +ssh-keyscan -p 57561 127.0.0.1 >> %USERPROFILE%\.ssh\known_hosts +``` + +### Add new connection to Podman + +Create a connection named "qemuremote" + +``` +podman system connection add --identity C:\qemu-remote\remote -p 57561 qemuremote ssh://core@127.0.0.1 +``` + +#### Optional + +Make it default for simplicity of operation/testing + +``` +podman system connection default qemuremote +``` + +## Using Podman + +Choose the active connection to be "qemuremote" (not needed if one made it default). + +Run some basic network enabled workload: + +``` +podman run -d --rm -p 8080:80 nginx +``` + +Test it with + +``` +curl http -v http://localhost:8080 +``` + +## Shutting down the machine + +The built-in machinery of Podman machine will not work for a custom machine. One needs to gracefully shut it down by connecting via SSH: + +``` +ssh -i C:\qemu-remote\remote -p 57561 core@127.0.0.1 +``` + +And then executing + +``` +sudo poweroff +``` diff --git a/versioned_docs/version-5.4.2/tutorials/remote_client.md b/versioned_docs/version-5.4.2/tutorials/remote_client.md new file mode 100644 index 000000000..866dc693c --- /dev/null +++ b/versioned_docs/version-5.4.2/tutorials/remote_client.md @@ -0,0 +1,124 @@ +--- +title: Podman remote-client tutorial +version: v5.4.2 +--- + +# Podman remote-client tutorial + +## Introduction +The purpose of the Podman remote-client is to allow users to interact with a Podman "backend" while on a separate client. The command line interface of the remote client is exactly the same as the regular Podman commands with the exception of some flags being removed as they do not apply to the remote-client. + +The remote client takes advantage of a client-server model. You need Podman installed on a Linux machine or VM that also has the SSH daemon running. On the local operating system, when you execute a Podman command, Podman connects to the server via SSH. It then connects to the Podman service by using systemd socket activation, and hitting our [Rest API](https://docs.podman.io/en/latest/_static/api.html). The Podman commands are executed on the server. From the client's point of view, it seems like Podman runs locally. + +This tutorial is for running Podman remotely on Linux. If you are using a Mac or a Windows PC, please follow the [Mac and Windows tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) + +## Obtaining and installing Podman + +### Client machine +You will need either Podman or the podman-remote client. The difference between the two is that the compiled podman-remote client can only act as a remote client connecting to a backend, while Podman can run local, standard Podman commands, as well as act as a remote client (using `podman --remote`) + +If you already have Podman installed, you do not need to install podman-remote. + +You can find out how to [install Podman here](https://podman.io/getting-started/installation) + +If you would like to install only the podman-remote client, it is downloadable from its [release description page](https://github.com/containers/podman/releases/latest). You can also build it from source using the `make podman-remote` + + +### Server Machine +You will need to [install Podman](https://podman.io/getting-started/installation) on your server machine. + + +## Creating the first connection + +### Enable the Podman service on the server machine. + +Before performing any Podman client commands, you must enable the podman.sock SystemD service on the Linux server. In these examples, we are running Podman as a normal, unprivileged user, also known as a rootless user. By default, the rootless socket listens at `/run/user/${UID}/podman/podman.sock`. You can enable this socket permanently using the following command: +``` +systemctl --user enable --now podman.socket +``` +You will need to enable linger for this user in order for the socket to work when the user is not logged in: + +``` +sudo loginctl enable-linger $USER +``` +This is only required if you are not running Podman as root. + +You can verify that the socket is listening with a simple Podman command. + +``` +podman --remote info +host: + arch: amd64 + buildahVersion: 1.16.0-dev + cgroupVersion: v2 + conmon: + package: conmon-2.0.19-1.fc32.x86_64 +``` + +#### Enable sshd + +In order for the Podman client to communicate with the server you need to enable and start the SSH daemon on your Linux machine, if it is not currently enabled. +``` +sudo systemctl enable --now sshd +``` + +#### Setting up SSH +Remote Podman uses SSH to communicate between the client and server. The remote client works considerably smoother using SSH keys. To set up your ssh connection, you need to generate an ssh key pair from your client machine. *NOTE:* in some instances, using a `rsa` key will cause connection issues, be sure to create an `ed25519` key. +``` +ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 +``` +Your public key by default should be in your home directory under `~/.ssh/id_ed25519.pub`. You then need to copy the contents of `id_ed25519.pub` and append it into `~/.ssh/authorized_keys` on the Linux server. You can automate this using `ssh-copy-id`: +``` +ssh-copy-id -i ~/.ssh/id_ed25519.pub 192.168.122.1 +``` + +If you do not wish to use SSH keys, you will be prompted with each Podman command for your login password. + +## Using the client + +Note: `podman-remote` is equivalent to `podman --remote` here, depending on what you have chosen to install. + +The first step in using the Podman remote client is to configure a connection. + +You can add a connection by using the `podman-remote system connection add` command. + +``` +podman-remote system connection add myuser --identity ~/.ssh/id_ed25519 ssh://myuser@192.168.122.1/run/user/1000/podman/podman.sock +``` + +This will add a remote connection to Podman and if it is the first connection added, it will mark the connection as the default. You can observe your connections with `podman-remote system connection list`: + +``` +podman-remote system connection list +Name Identity URI +myuser* id_ed25519 ssh://myuser@192.168.122.1/run/user/1000/podman/podman.sock +``` + +Now we can test the connection with `podman info`: + +``` +podman-remote info +host: + arch: amd64 + buildahVersion: 1.16.0-dev + cgroupVersion: v2 + conmon: + package: conmon-2.0.19-1.fc32.x86_64 +``` + +Podman-remote has also introduced a “--connection” flag where you can use other connections you have defined. If no connection is provided, the default connection will be used. + +``` +podman-remote system connection --help +``` + +## Wrap up + +You can use the Podman remote clients to manage your containers running on a Linux server. The communication between client and server relies heavily on SSH connections and the use of SSH keys are encouraged. Once you have Podman installed on your remote client, you should set up a connection using `podman-remote system connection add` which will then be used by subsequent Podman commands. + +# Troubleshooting + +See the [Troubleshooting](https://github.com/containers/podman/blob/main/troubleshooting.md) document if you run into issues. + +## History +Adapted from the [Mac and Windows tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) diff --git a/versioned_docs/version-5.4.2/tutorials/rootless_tutorial.md b/versioned_docs/version-5.4.2/tutorials/rootless_tutorial.md new file mode 100644 index 000000000..46d8348fc --- /dev/null +++ b/versioned_docs/version-5.4.2/tutorials/rootless_tutorial.md @@ -0,0 +1,221 @@ +--- +title: Basic Setup and Use of Podman in a Rootless environment. +version: v5.4.2 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +# Basic Setup and Use of Podman in a Rootless environment. + +Prior to allowing users without root privileges to run Podman, the administrator must install or build Podman and complete the following configurations. + +## Administrator Actions + +### Installing Podman + +For installing Podman, see the [installation instructions](https://podman.io/getting-started/installation). + +### Building Podman + +For building Podman, see the [build instructions](https://podman.io/getting-started/installation#building-from-scratch). + +### Networking configuration + +A user-mode networking tool for unprivileged network namespaces must be installed on the machine in order for Podman to run in a rootless environment. + +Podman supports two rootless networking tools: [pasta](https://passt.top/passt/about/#pasta) (provided by [passt](https://passt.top/passt/about/)) and [slirp4netns](https://github.com/rootless-containers/slirp4netns). + +pasta is the default since Podman 5.0, while slirp4netns was the default for previous versions. Passt is a more modern replacement for SLIRP that amongst other things fully supports IPv6 and is more secure architecturally (runs in a separate process, uses modern Linux mechanisms for isolation etc). + +Passt is [available on most Linux distributions](https://passt.top/passt/about/#availability) via their package distribution software such as `yum`, `dnf`, `apt`, `zypper`, etc. under the name `passt`. If the package is not available, you can build and install `passt` from [its upstream](https://passt.top/passt/about/#try-it). + +Alternatively, slirp4netns can be installed in the same fashion either from your distribution's repositories or by following [the instructions](https://github.com/rootless-containers/slirp4netns?tab=readme-ov-file#install) provided on its GitHub. + +The major user-facing difference between the two is outlined in [Shortcomings of Rootless Podman](https://github.com/containers/podman/blob/main/rootless.md?plain=1#L11) and expanded upon in **[podman-network(1)](https://github.com/containers/podman/blob/main/docs/source/markdown/podman-network.1.md#pasta)**. + +> [!note] +> pasta's default situation of not being being able to communicate between the container and the host has been fixed in Podman 5.3: see [Podman 5.3 changes for improved networking experience with pasta](https://blog.podman.io/2024/10/podman-5-3-changes-for-improved-networking-experience-with-pasta/). + +The default rootless networking tool can be selected in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** under the `[network]` section with `default_rootless_network_cmd`, which can be set to `pasta` (default) or `slirp4netns`. + +### `/etc/subuid` and `/etc/subgid` configuration + +Rootless Podman requires the user running it to have a range of UIDs listed in the files `/etc/subuid` and `/etc/subgid`. The `shadow-utils` or `newuid` package provides these files on different distributions and they must be installed on the system. Root privileges are required to add or update entries within these files. The following is a summary from the [How does rootless Podman work?](https://opensource.com/article/19/2/how-does-rootless-podman-work) article by Dan Walsh on [opensource.com](https://opensource.com) + +For each user that will be allowed to create containers, update `/etc/subuid` and `/etc/subgid` for the user with fields that look like the following. Note that the values for each user must be unique. If there is overlap, there is a potential for a user to use another user's namespace and they could corrupt it. + +``` +# cat /etc/subuid +johndoe:100000:65536 +test:165536:65536 +``` + +The format of this file is `USERNAME:UID:RANGE` + +* username as listed in `/etc/passwd` or in the output of [`getpwent`](https://man7.org/linux/man-pages/man3/getpwent.3.html). +* The initial UID allocated for the user. +* The size of the range of UIDs allocated for the user. + +This means the user `johndoe` is allocated UIDs 100000-165535 as well as their standard UID in the `/etc/passwd` file. NOTE: this is not currently supported with network installs; these files must be available locally to the host machine. It is not possible to configure this with LDAP or Active Directory. + +Rather than updating the files directly, the `usermod` program can be used to assign UIDs and GIDs to a user. + +``` +# usermod --add-subuids 100000-165535 --add-subgids 100000-165535 johndoe +grep johndoe /etc/subuid /etc/subgid +/etc/subuid:johndoe:100000:65536 +/etc/subgid:johndoe:100000:65536 +``` + +If you update either `/etc/subuid` or `/etc/subgid`, you need to stop all the running containers owned by the user and kill the pause process that is running on the system for that user. This can be done automatically by running [`podman system migrate`](https://github.com/containers/podman/blob/main/docs/source/markdown/podman-system-migrate.1.md) as that user. + +#### Giving access to additional groups + +Users can fully map additional groups to a container namespace if +those groups subordinated to the user: + +``` +# usermod --add-subgids 2000-2000 johndoe +grep johndoe /etc/subgid +``` + +This means the user `johndoe` can "impersonate" the group `2000` inside the +container. Note that it is usually not a good idea to subordinate active +user ids to other users, because it would allow user impersonation. + +`johndoe` can use `--group-add keep-groups` to preserve the additional +groups, and `--gidmap="+g102000:@2000"` to map the group `2000` in the host +to the group `102000` in the container: + +``` +$ podman run \ + --rm \ + --group-add keep-groups \ + --gidmap="+g102000:@2000" \ + --volume "$PWD:/data:ro" \ + --workdir /data \ + alpine ls -lisa +``` + +### Enable unprivileged `ping` + +(It is very unlikely that you will need to do this on a modern distro). + +Users running in a non-privileged container may not be able to use the `ping` utility from that container. + +If this is required, the administrator must verify that the UID of the user is part of the range in the `/proc/sys/net/ipv4/ping_group_range` file. + +To change its value the administrator can use a call similar to: `sysctl -w "net.ipv4.ping_group_range=0 2000000"`. + +To make the change persist, the administrator will need to add a file with the `.conf` file extension in `/etc/sysctl.d` that contains `net.ipv4.ping_group_range=0 $MAX_GID`, where `$MAX_GID` is the highest assignable GID of the user running the container. + + +## User Actions + +The majority of the work necessary to run Podman in a rootless environment is on the shoulders of the machine’s administrator. + +Once the Administrator has completed the setup on the machine and then the configurations for the user in `/etc/subuid` and `/etc/subgid`, the user can just start using any Podman command that they wish. + +### User Configuration Files + +The Podman configuration files for root reside in `/usr/share/containers` with overrides in `/etc/containers`. In the rootless environment they reside in `${XDG_CONFIG_HOME}/containers` and are owned by each individual user. + +Note: in environments without `XDG` environment variables, Podman internally sets the following defaults: + +- `$XDG_CONFIG_HOME` = `$HOME/.config` +- `$XDG_DATA_HOME` = `$HOME/.local/share` +- `$XDG_RUNTIME_DIR` = + - `/run/user/$UID` on `systemd` environments + - `$TMPDIR/podman-run-$UID` otherwise + +The three main configuration files are [containers.conf](https://github.com/containers/common/blob/main/docs/containers.conf.5.md), [storage.conf](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md) and [registries.conf](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md). The user can modify these files as they wish. + +#### containers.conf +Podman reads + +1. `/usr/share/containers/containers.conf` +2. `/etc/containers/containers.conf` +3. `${XDG_CONFIG_HOME}/containers/containers.conf` + +if they exist, in that order. Each file can override the previous for particular fields. + +#### storage.conf +For `storage.conf` the order is + +1. `/etc/containers/storage.conf` +2. `${XDG_CONFIG_HOME}/containers/storage.conf` + +In rootless Podman, certain fields in `/etc/containers/storage.conf` are ignored. These fields are: +``` +graphroot="" + container storage graph dir (default: "/var/lib/containers/storage") + Default directory to store all writable content created by container storage programs. + +runroot="" + container storage run dir (default: "/run/containers/storage") + Default directory to store all temporary writable content created by container storage programs. +``` +In rootless Podman these fields default to +``` +graphroot="${XDG_DATA_HOME}/containers/storage" +runroot="${XDG_RUNTIME_DIR}/containers" +``` +[\$XDG_RUNTIME_DIR](https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html#variables) defaults on most systems to `/run/user/$UID`. + +#### registries +Registry configuration is read in this order + +1. `/etc/containers/registries.conf` +2. `/etc/containers/registries.d/*` +3. `${XDG_CONFIG_HOME}/containers/registries.conf` + +The files in the home directory should be used to configure rootless Podman for personal needs. These files are not created by default. Users can copy the files from `/usr/share/containers` or `/etc/containers` and modify them. + +#### Authorization files +The default authorization file used by the `podman login` and `podman logout` commands is `${XDG_RUNTIME_DIR}/containers/auth.json`. + +### Using volumes + +Rootless Podman is not, and will never be, root; it's not a `setuid` binary, and gains no privileges when it runs. Instead, Podman makes use of a user namespace to shift the UIDs and GIDs of a block of users it is given access to on the host (via the `newuidmap` and `newgidmap` executables) and your own user within the containers that Podman creates. + +If your container runs with the root user, then `root` in the container is actually your user on the host. UID/GID 1 is the first UID/GID specified in your user's mapping in `/etc/subuid` and `/etc/subgid`, etc. If you mount a directory from the host into a container as a rootless user, and create a file in that directory as root in the container, you'll see it's actually owned by your user on the host. + +So, for example, + +``` +host$ whoami +john + +# a folder which is empty +host$ ls /home/john/folder +host$ podman run -it -v /home/john/folder:/container/volume mycontainer /bin/bash + +# Now I'm in the container +root@container# whoami +root +root@container# touch /container/volume/test +root@container# ls -l /container/volume +total 0 +-rw-r--r-- 1 root root 0 May 20 21:47 test +root@container# exit + +# I check again +host$ ls -l /home/john/folder +total 0 +-rw-r--r-- 1 john john 0 May 20 21:47 test +``` + +We do recognize that this doesn't really match how many people intend to use rootless Podman - they want their UID inside and outside the container to match. Thus, we provide the `--userns=keep-id` flag, which ensures that your user is mapped to its own UID and GID inside the container. + +It is also helpful to distinguish between running Podman as a rootless user, and a container which is built to run rootless. If the container you're trying to run has a `USER` which is not root, then when mounting volumes you **must** use `--userns=keep-id`. This is because the container user would not be able to become `root` and access the mounted volumes. + +Another consideration in regards to volumes: + +- When providing the path of a directory you'd like to bind-mount, the path needs to be provided as an absolute path + or a relative path that starts with `.` (a dot), otherwise the string will be interpreted as the name of a named volume. + +## More information + +If you are still experiencing problems running Podman in a rootless environment, please refer to the [Shortcomings of Rootless Podman](https://github.com/containers/podman/blob/main/rootless.md) page which lists known issues and solutions to known issues in this environment. + +For more information on Podman and its subcommands, follow the links on the main [README.md](https://github.com/containers/podman/blob/main/README.md#podman-information-for-developers) page or the [podman.io](https://podman.io) web site. diff --git a/versioned_docs/version-5.4.2/tutorials/socket_activation.md b/versioned_docs/version-5.4.2/tutorials/socket_activation.md new file mode 100644 index 000000000..b15a4541b --- /dev/null +++ b/versioned_docs/version-5.4.2/tutorials/socket_activation.md @@ -0,0 +1,289 @@ +--- +title: Podman socket activation +version: v5.4.2 +--- + +# Podman socket activation + +Socket activation conceptually works by having systemd create a socket (e.g. TCP, UDP or Unix +socket). As soon as a client connects to the socket, systemd will start the systemd service that is +configured for the socket. The newly started program inherits the file descriptor of the socket +and can then accept the incoming connection (in other words run the system call `accept()`). +This description corresponds to the default systemd socket configuration +[`Accept=no`](https://www.freedesktop.org/software/systemd/man/systemd.socket.html#Accept=) +that lets the service accept the socket. + +Podman supports two forms of socket activation: + +* Socket activation of the API service +* Socket activation of containers + +## Socket activation of the API service + +The architecture looks like this + +``` mermaid +stateDiagram-v2 + [*] --> systemd: first client connects + systemd --> podman: socket inherited via fork/exec +``` + +The file _/usr/lib/systemd/user/podman.socket_ on a Fedora system defines the Podman API socket for +rootless users: + +``` +$ cat /usr/lib/systemd/user/podman.socket +[Unit] +Description=Podman API Socket +Documentation=man:podman-system-service(1) + +[Socket] +ListenStream=%t/podman/podman.sock +SocketMode=0660 + +[Install] +WantedBy=sockets.target +``` + +The socket is configured to be a Unix socket and can be started like this + +``` +$ systemctl --user start podman.socket +$ ls $XDG_RUNTIME_DIR/podman/podman.sock +/run/user/1000/podman/podman.sock +$ +``` +The socket can later be used by for instance __docker-compose__ that needs a Docker-compatible API + +``` +$ export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock +$ docker-compose up +``` + +When __docker-compose__ or any other client connects to the UNIX socket `$XDG_RUNTIME_DIR/podman/podman.sock`, +the service _podman.service_ is started. See its definition in the file _/usr/lib/systemd/user/podman.service_. + +## Socket activation of containers + +Since version 3.4.0 Podman supports socket activation of containers, i.e., passing +a socket-activated socket to the container. Thanks to the fork/exec model of Podman, the socket will be first +inherited by conmon and then by the OCI runtime and finally by the container +as can be seen in the following diagram: + + +``` mermaid +stateDiagram-v2 + [*] --> systemd: first client connects + systemd --> podman: socket inherited via fork/exec + state "OCI runtime" as s2 + podman --> conmon: socket inherited via double fork/exec + conmon --> s2: socket inherited via fork/exec + s2 --> container: socket inherited via exec +``` + +This type of socket activation can be used in systemd services that are generated from container unit files (see [podman-systemd.unit(5)](https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html)) (Note, quadlet requires the use of cgroup v2) or from the command [`podman generate systemd`](https://docs.podman.io/en/latest/markdown/podman-generate-systemd.1.html). +The container must also support socket activation. Not all software daemons support socket activation +but it's getting more popular. For instance Apache HTTP server, MariaDB, DBUS, PipeWire, Gunicorn, CUPS +all have socket activation support. + +### Example: socket-activated echo server container in a systemd service + +This example shows how to run the socket-activated echo server +[socket-activate-echo](https://github.com/eriksjolund/socket-activate-echo/pkgs/container/socket-activate-echo) +in a systemd user service. Podman version 4.4.0 or higher is required. + +Enable lingering for your regular user + +``` +$ loginctl enable-linger $USER +``` + +The command has these effects on your enabled systemd user units: + +* the units are automatically started after a reboot +* the units are not automatically stopped after you log out + +Create directories + +``` +$ mkdir -p ~/.config/systemd/user +$ mkdir -p ~/.config/containers/systemd +``` + +Create the file _~/.config/containers/systemd/echo.container_ with the file contents: + +``` +[Unit] +Description=Example echo service +Requires=echo.socket +After=echo.socket + +[Container] +Image=ghcr.io/eriksjolund/socket-activate-echo +Network=none + +[Install] +WantedBy=default.target +``` + +The file follows the syntax described in [__podman-systemd.unit__(5)](https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html). + +The `[Install]` section is optional. If you remove the two last lines, the _echo.service_ will not +be automatically started after a reboot. Instead, the _echo.service_ is started when the first +client connects to the socket. + +The line `Network=none` is optional. It improves security by removing network connectivity for the container. +The container can still be serving the internet because `Network=none` has no effect on activated sockets. + +A socket-activated service also requires a systemd socket unit. +Create the file _~/.config/systemd/user/echo.socket_ that defines the +sockets that the container should use + +``` +[Unit] +Description=Example echo socket + +[Socket] +ListenStream=127.0.0.1:3000 +ListenDatagram=127.0.0.1:3000 +ListenStream=[::1]:3000 +ListenDatagram=[::1]:3000 +ListenStream=%h/echo_stream_sock + +# VMADDR_CID_ANY (-1U) = 2^32 -1 = 4294967295 +# See "man vsock" +ListenStream=vsock:4294967295:3000 + +[Install] +WantedBy=sockets.target +``` + +`%h` is a systemd specifier that expands to the user's home directory. + +After editing the unit files, systemd needs to reload its configuration. + +``` +$ systemctl --user daemon-reload +``` + +While reloading its configuration systemd generates the unit _echo.service_ +from the file _~/.config/containers/systemd/echo.container_ +by executing the unit generator `/usr/lib/systemd/system-generators/podman-system-generator`. + +Optional: View the generated _echo.service_ to see the `podman run` command that +will be run. + +``` +$ systemctl --user cat echo.service +``` + +Configure systemd to automatically start _echo.socket_ after reboots. + +``` +$ systemctl --user enable echo.socket +``` + +Pull the container image beforehand + +``` +$ podman pull ghcr.io/eriksjolund/socket-activate-echo +``` + +Start the socket unit + +``` +$ systemctl --user start echo.socket +``` + +Test the echo server with the program __socat__ + +``` +$ echo hello | socat -t 30 - tcp4:127.0.0.1:3000 +hello +$ echo hello | socat -t 30 - tcp6:[::1]:3000 +hello +$ echo hello | socat -t 30 - udp4:127.0.0.1:3000 +hello +$ echo hello | socat -t 30 - udp6:[::1]:3000 +hello +$ echo hello | socat -t 30 - unix:$HOME/echo_stream_sock +hello +$ echo hello | socat -t 30 - VSOCK-CONNECT:1:3000 +hello +``` + +The option `-t 30` configures socat to use a timeout of 30 seconds when socat reads from the socket awaiting to get an EOF (End-Of-File). +As the container image has already been pulled, such a long timeout is not really needed. + +The echo server works as expected. It replies _"hello"_ after receiving the text _"hello"_. + +### Example: socket activate an Apache HTTP server with systemd-socket-activate + +Instead of setting up a systemd service to test out socket activation, an alternative is to use the command-line +tool [__systemd-socket-activate__](https://www.freedesktop.org/software/systemd/man/systemd-socket-activate.html#). + +Let's build a container image for the Apache HTTP server that is configured to support socket activation on port 8080. + +Create a new directory _ctr_ and a file _ctr/Containerfile_ with this contents + +``` +FROM docker.io/library/fedora +RUN dnf -y update && dnf install -y httpd && dnf clean all +RUN sed -i "s/Listen 80/Listen 127.0.0.1:8080/g" /etc/httpd/conf/httpd.conf +CMD ["/usr/sbin/httpd", "-DFOREGROUND"] +``` + +Build the container image + +``` +$ podman build -t socket-activate-httpd ctr +``` + +In one shell, start __systemd-socket-activate__. + +``` +$ systemd-socket-activate -l 8080 podman run --rm --network=none localhost/socket-activate-httpd +``` + +The TCP port number 8080 is given as an option to __systemd-socket-activate__. The __--publish__ (__-p__) +option for `podman run` is not used. + +In another shell, fetch a web page from _localhost:8080_ + +``` +$ curl -s localhost:8080 | head -6 + + + + + +Test Page for the HTTP Server on Fedora +$ +``` + +### Disabling the network with _--network=none_ + +If the container only needs to communicate over the socket-activated socket, it's possible to disable +the network by passing __--network=none__ to `podman run`. This improves security because the +container then runs with less privileges. + +### Native network performance over the socket-activated socket + +When using rootless Podman, network traffic is normally passed through slirp4netns. This comes with +a performance penalty. Fortunately, communication over the socket-activated socket does not pass through +slirp4netns so it has the same performance characteristics as the normal network on the host. + +### Starting a socket-activated service + +There is a delay when the first connection is made because the container needs to +start up. To minimize this delay, consider passing __--pull=never__ to `podman run` and instead +pull the container image beforehand. Instead of waiting for the start of the service to be triggered by the +first client connecting to it, the service can also be explicitly started (`systemctl --user start echo.service`). + +### Stopping a socket-activated service + +Some services run a command (configured by the systemd directive __ExecStart__) that exits after some time of inactivity. +Depending on the restart configuration for the service +(systemd directive [__Restart__](https://www.freedesktop.org/software/systemd/man/systemd.service.html#Restart=)), +it may then be stopped. An example of this is _podman.service_ that stops after some time of inactivity. +The service will be started again when the next client connects to the socket. diff --git a/versioned_docs/version-5.5.0/MANPAGE_SYNTAX.md b/versioned_docs/version-5.5.0/MANPAGE_SYNTAX.md new file mode 100644 index 000000000..b20a26fd8 --- /dev/null +++ b/versioned_docs/version-5.5.0/MANPAGE_SYNTAX.md @@ -0,0 +1,147 @@ +--- +title: podman-command +version: v5.5.0 +--- + +% podman-command(1) + +## NAME +podman\-command - short description + +## SYNOPSIS +(Shows the command structure. If the command can be written in two different ways, both of them have to be shown.\ +Many manpages include the OPTIONS **--all**, **-a** and/or **--latest**, **-l**. In this case, there is no `container name` or `ID` needed after the initial command. Because most of the other OPTIONS still need the `container name` or ` ID`, it is defined that the *container* argument in the command should **not** be put in brackets. It should also be noted in the *IMPORTANT* section in the description of the OPTION with the following sentence: *IMPORTANT: This OPTION does not need a container name or ID as input argument.*.) + +**podman command** [*optional*] *mandatory value* + +**podman subcommand command** [*optional*] *mandatory value* + +(If there is the possibility to chose between two or more mandatory command values. There should also always be a space before and after a vertical bar to ensure better readability.) + +**podman command** [*optional*] *value1* | *value2* + +**podman subcommand command** [*optional*] *value1* | *value2* + +(If an optional value follows a mandatory one.) + +**podman command** [*optional*] *value1* | *value2* [*optional*] + +**podman subcommand command** [*optional*] *value1* | *value2* [*optional*] + +(If the command accepts an infinite number of values.) + +**podman command** [*optional*] *value* [*value* ...] + +**podman subcommand command** [*optional*] *value* [*value* ...] + +## DESCRIPTION +**podman command** is always the beginning of the DESCRIPTION section. Putting the command as the first part of the DESCRIPTION ensures uniformity. All commands mentioned in the text retain their appearance and form.\ +Example for the first sentence: **podman command** is an example command. + +Commands or files that are quoted from other podman manpages or podman repositories have to be linked to those. Non-podman commands are not to be linked.\ +Example sentence: Use **[podman-run](podman-run.1.md)** or **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** for the problem. + +It should also be specified if the command can only be run as root. In addition, it should be described when a command, OPTION, or other content cannot be executed with the remote client or in combination with other commands, OPTIONS, or content. In this case, the following sentence is put at the end of a command, OPTION, or content:\ +*IMPORTANT: This command/OPTION/content is not available with the command/OPTION/content/on the remote Podman client.*\ +For a command, this should be done in the DESCRIPTION section. For the OPTIONS, it should be done in the DESCRIPTION of the specified OPTION. + +Do not use pronouns in the man pages, especially the word `you`. + +There should be **no** new line after H2-headers (`##`). + +## OPTIONS +All flags are referred to as OPTIONS. The term flags should not be used. All OPTIONS are listed in this section. OPTIONS that appear in descriptions of other OPTIONS and sections retain their appearance, for example: **--exit**. + +OPTIONS that are quoted from other podman manpages or podman repositories have to be linked to those.\ +Example sentence: Use **[podman-generate-systemd --new](./source/markdown/podman-generate-systemd.1.md#--new)** for the problem. + + Each OPTION should be explained to the fullest extent below the OPTION itself. Each OPTION is behind an H4-header (`####`). If the OPTION has a default argument, it has to be explained in the description of the OPTION. If the OPTION is also not available with a command/OPTION/content/ on the remote Podman client, the sentence about the default argument should the second to last sentence. The sentence about the default argument should be in a new line as well as the *IMPORTANT* sentence. + + All OPTIONS are to be sorted in alphabetical order. + + Tables should be used when there is a different definition for multiple arguments, and these have to be explained. This is shown with the OPTION **--test**.\ + Lists should be used when arguments are used that do not need a definition for each argument and a single description explains them. An example is shown with **[podman-commit --change](./source/markdown/podman-commit.1.md#--change--cinstruction)** + + +#### **--version**, **-v** + +OPTIONS can be put after the command in two different ways. Either the long version with **--option** or as the short version **-o**. If there are two ways to write an OPTION they are separated by a comma. If there are two versions of one command the long version is always shown in front. If OPTION is boolean, *true/false* are not enumerated. The default boolean argument is shown in the same way normal default arguments are displayed.\ +Example: The default is **false**.\ +*IMPORTANT: This OPTION is not available with the remote Podman client.* + +#### **--exit** + +An example of a boolean OPTION that is only available in long form. + +#### **--answer**, **-a**=**active** | *disable* + +The **--answer** OPTION above is an example of an OPTION that accepts two possible arguments as inputs. If a default argument is selected when the OPTION is not used in the command, it is shown in **bold**. If the OPTION is used, it must include an argument afterward. It must always be ensured that the standard argument is in the first position after the OPTION. In this example, there are two different ways to execute the command. Both possible OPTIONS have to be shown with the arguments following them.\ +The default value is shown as **active**. + +#### **--status**=**good** | *better* | *best* + +This is an example of three arguments following an OPTION. If the number of arguments is greater than three, the arguments are **not** listed after the equal sign. The arguments must be shown in a table like in **--test**=**_test_**. This form should also be used if the understanding of the content is in danger of becoming incomprehensible. An example for this is **[podman-container-prune --filters](./source/markdown/podman-container-prune.1.md#--filterfilters)**.\ +The default value is shown as **good**. + +#### **--test**=**test** + +OPTIONS that are followed by an equal sign include an argument after the equal sign in **bold** or *italic*. If there is a default argument that is used if the OPTION is not specified in the command, the argument after the equal sign is displayed in **bold**. All arguments must be listed and explained in the text below the OPTION. + +| Argument | Description | +| ------------------ | --------------------------------------------------------------------------- | +| **example one** | This argument is the default argument if the OPTION is not specified. | +| *example two* | If one refers to a command, one should use **bold** marks. | +| *example three* | Example: In combination with **podman command** highly effective. | +| *example four* | Example: Can be combined with **--exit**. | +| *example five* | The fifth description | + +The table shows an example for a listing of arguments. The contents in the table should be aligned left. If the content in the table conflicts with this, it can be aligned to support the understanding of the content. If there is a default argument, it **must** be listed as the first entry in the table.\ +The default value is shown as **example one**. + +If the number of arguments is smaller than four they have to be listed behind the OPTION as seen in the OPTION **--status**. + +#### **--problem**=*problem* + +OPTIONS that are followed by an equal sign that is then followed by an unspecified argument, have no default argument. If this OPTION is written with an equal sign and the argument is left empty, there will be no error, but the OPTION will be ignored. The meaning of the argument is described preferably in `one` word after the equal sign in *italic* format. + +## SUBCHAPTER +For chapters that are made specifically as an individual SUBCHAPTER in a man page, the previous conditions regarding formatting apply. + +There are no restrictions for the use of paragraphs and tables. Within these paragraphs and tables the previous conditions regarding formatting apply. + +Strings of characters or numbers can be highlighted with `backticks`. Paths of any kind **must** be highlighted. + +IMPORTANT: Only characters that are **not** part of categories mentioned before can be highlighted. This includes headers. For example it is not advised to highlight an OPTION or a **command**. + +SUBHEADINGS are displayed as follows: +### SUBHEADING +Text for SUBHEADINGS. + +## EXAMPLES +All EXAMPLES are listed in this section. This section should be at the end of each man page. Each EXAMPLE is always in one box. The box starts and ends with the last written line, **not** with a blank line. The `$` in front of the commands indicates that it can be run as a normal user, while the commands starting with `#` can only be run as root. If there is the need for a comment in a box the comment should have `###` in front of it. + +Description of the EXAMPLE +``` +### Example comment +$ podman command +$ podman command -o +$ cat $HOME/Dockerfile | podman command --option +``` + +Description of the EXAMPLE two +``` +# podman command --status=better +``` +## SEE ALSO +All commands, including commands with OPTIONS, and config-files mentioned in the manpage have to be listed here. Podman commands, including commands with OPTIONS, and config-files have to be linked. If a command is mentioned several times with different OPTIONS it just have to be linked once. All other commands, including commands with OPTIONS, and config-files just have to be mentioned. If a command is mentioned several times with different OPTIONS it just has to be linked once. + +Example: +**[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-create(1)](podman-create.1.md)** + +## HISTORY +Normally, the dates of changes, the content of the changes and the person who provided them is listed here. Most manpages don't keep this record. + +Example:\ +December 2021, Originally compiled by Alexander Richter + +`Every manpage should end with an empty line.` diff --git a/versioned_docs/version-5.5.0/index.md b/versioned_docs/version-5.5.0/index.md new file mode 100644 index 000000000..ed97badb6 --- /dev/null +++ b/versioned_docs/version-5.5.0/index.md @@ -0,0 +1,42 @@ +--- +title: Podman Documentation +version: v5.5.0 +--- + +# Podman Documentation (v5.5.0) + +Welcome to the Podman documentation for version v5.5.0. + +## Getting Started + +- [Installation Instructions](https://podman.io/get-started) +- [Basic Tutorial](tutorials/podman_tutorial.md) +- [Rootless Containers](tutorials/rootless_tutorial.md) + +## Commands + +- [podman](source/markdown/podman.1.md) +- [podman-build](source/markdown/podman-build.1.md) +- [podman-run](source/markdown/podman-run.1.md) +- [podman-ps](source/markdown/podman-ps.1.md) + +## Tutorials + +- [Basic Networking](tutorials/basic_networking.md) +- [Rootless Tutorial](tutorials/rootless_tutorial.md) +- [Podman Tutorial](tutorials/podman_tutorial.md) +- [Performance](tutorials/performance.md) + +## System & Management + +- [System Commands](source/markdown/podman-system.1.md) +- [Machine Commands](source/markdown/podman-machine.1.md) +- [Pod Management](source/markdown/podman-pod.1.md) +- [Volume Management](source/markdown/podman-volume.1.md) + +## Advanced Features + +- [Systemd Integration](source/markdown/podman-systemd.unit.5.md) +- [Kubernetes Support](source/markdown/podman-kube.1.md) +- [Secret Management](source/markdown/podman-secret.1.md) +- [Code Generation](source/markdown/podman-generate.1.md) diff --git a/versioned_docs/version-5.5.0/kubernetes_support.md b/versioned_docs/version-5.5.0/kubernetes_support.md new file mode 100644 index 000000000..7edb18d60 --- /dev/null +++ b/versioned_docs/version-5.5.0/kubernetes_support.md @@ -0,0 +1,208 @@ +--- +title: Podman Kube Play Support +version: v5.5.0 +--- + +# Podman Kube Play Support + +This document outlines the kube yaml fields that are currently supported by the **podman kube play** command. + +Note: **N/A** means that the option cannot be supported in a single-node Podman environment. + +## Pod Fields + +| Field | Support | +|-----------------------------------------------------|---------| +| containers | ✅ | +| initContainers | ✅ | +| imagePullSecrets | no | +| enableServiceLinks | no | +| os\.name | no | +| volumes | ✅ | +| nodeSelector | N/A | +| nodeName | N/A | +| affinity\.nodeAffinity | N/A | +| affinity\.podAffinity | N/A | +| affinity\.podAntiAffinity | N/A | +| tolerations\.key | N/A | +| tolerations\.operator | N/A | +| tolerations\.effect | N/A | +| tolerations\.tolerationSeconds | N/A | +| schedulerName | N/A | +| runtimeClassName | no | +| priorityClassName | no | +| priority | no | +| topologySpreadConstraints\.maxSkew | N/A | +| topologySpreadConstraints\.topologyKey | N/A | +| topologySpreadConstraints\.whenUnsatisfiable | N/A | +| topologySpreadConstraints\.labelSelector | N/A | +| topologySpreadConstraints\.minDomains | N/A | +| restartPolicy | ✅ | +| terminationGracePeriodSeconds | ✅ | +| activeDeadlineSeconds | no | +| readinessGates\.conditionType | no | +| hostname | ✅ | +| setHostnameAsFQDN | no | +| subdomain | no | +| hostAliases\.hostnames | ✅ | +| hostAliases\.ip | ✅ | +| dnsConfig\.nameservers | ✅ | +| dnsConfig\.options\.name | ✅ | +| dnsConfig\.options\.value | ✅ | +| dnsConfig\.searches | ✅ | +| dnsPolicy | no | +| hostNetwork | ✅ | +| hostPID | ✅ | +| hostIPC | ✅ | +| shareProcessNamespace | ✅ | +| serviceAccountName | no | +| automountServiceAccountToken | no | +| securityContext\.runAsUser | ✅ | +| securityContext\.runAsNonRoot | no | +| securityContext\.runAsGroup | ✅ | +| securityContext\.supplementalGroups | ✅ | +| securityContext\.fsGroup | no | +| securityContext\.fsGroupChangePolicy | no | +| securityContext\.seccompProfile\.type | no | +| securityContext\.seccompProfile\.localhostProfile | no | +| securityContext\.seLinuxOptions\.level | ✅ | +| securityContext\.seLinuxOptions\.role | ✅ | +| securityContext\.seLinuxOptions\.type | ✅ | +| securityContext\.seLinuxOptions\.user | ✅ | +| securityContext\.sysctls\.name | ✅ | +| securityContext\.sysctls\.value | ✅ | +| securityContext\.windowsOptions\.gmsaCredentialSpec | no | +| securityContext\.windowsOptions\.hostProcess | no | +| securityContext\.windowsOptions\.runAsUserName | no | + +## Container Fields + +| Field | Support | +|-----------------------------------------------------|---------| +| name | ✅ | +| image | ✅ | +| imagePullPolicy | ✅ | +| command | ✅ | +| args | ✅ | +| workingDir | ✅ | +| ports\.containerPort | ✅ | +| ports\.hostIP | ✅ | +| ports\.hostPort | ✅ | +| ports\.name | ✅ | +| ports\.protocol | ✅ | +| env\.name | ✅ | +| env\.value | ✅ | +| env\.valueFrom\.configMapKeyRef\.key | ✅ | +| env\.valueFrom\.configMapKeyRef\.name | ✅ | +| env\.valueFrom\.configMapKeyRef\.optional | ✅ | +| env\.valueFrom\.fieldRef | ✅ | +| env\.valueFrom\.resourceFieldRef | ✅ | +| env\.valueFrom\.secretKeyRef\.key | ✅ | +| env\.valueFrom\.secretKeyRef\.name | ✅ | +| env\.valueFrom\.secretKeyRef\.optional | ✅ | +| envFrom\.configMapRef\.name | ✅ | +| envFrom\.configMapRef\.optional | ✅ | +| envFrom\.prefix | no | +| envFrom\.secretRef\.name | ✅ | +| envFrom\.secretRef\.optional | ✅ | +| volumeMounts\.mountPath | ✅ | +| volumeMounts\.name | ✅ | +| volumeMounts\.mountPropagation | no | +| volumeMounts\.readOnly | ✅ | +| volumeMounts\.subPath | ✅ | +| volumeMounts\.subPathExpr | no | +| volumeDevices\.devicePath | no | +| volumeDevices\.name | no | +| resources\.limits | ✅ | +| resources\.requests | ✅ | +| lifecycle\.postStart | no | +| lifecycle\.preStop | no | +| terminationMessagePath | no | +| terminationMessagePolicy | no | +| livenessProbe | ✅ | +| readinessProbe | no | +| startupProbe | no | +| securityContext\.runAsUser | ✅ | +| securityContext\.runAsNonRoot | no | +| securityContext\.runAsGroup | ✅ | +| securityContext\.readOnlyRootFilesystem | ✅ | +| securityContext\.procMount | ✅ | +| securityContext\.privileged | ✅ | +| securityContext\.allowPrivilegeEscalation | ✅ | +| securityContext\.capabilities\.add | ✅ | +| securityContext\.capabilities\.drop | ✅ | +| securityContext\.seccompProfile\.type | no | +| securityContext\.seccompProfile\.localhostProfile | no | +| securityContext\.seLinuxOptions\.level | ✅ | +| securityContext\.seLinuxOptions\.role | ✅ | +| securityContext\.seLinuxOptions\.type | ✅ | +| securityContext\.seLinuxOptions\.user | ✅ | +| securityContext\.windowsOptions\.gmsaCredentialSpec | no | +| securityContext\.windowsOptions\.hostProcess | no | +| securityContext\.windowsOptions\.runAsUserName | no | +| stdin | no | +| stdinOnce | no | +| tty | no | + +## PersistentVolumeClaim Fields + +| Field | Support | +|---------------------|---------| +| volumeName | no | +| storageClassName | ✅ | +| volumeMode | no | +| accessModes | ✅ | +| selector | no | +| resources\.limits | no | +| resources\.requests | ✅ | + +## ConfigMap Fields + +| Field | Support | +|------------|---------| +| binaryData | ✅ | +| data | ✅ | +| immutable | no | + +## Deployment Fields + +| Field | Support | +|-----------------------------------------|-------------------------------------------------------| +| replicas | ✅ (the actual replica count is ignored and set to 1) | +| selector | ✅ | +| template | ✅ | +| minReadySeconds | no | +| strategy\.type | no | +| strategy\.rollingUpdate\.maxSurge | no | +| strategy\.rollingUpdate\.maxUnavailable | no | +| revisionHistoryLimit | no | +| progressDeadlineSeconds | no | +| paused | no | + +## DaemonSet Fields + +| Field | Support | +|-----------------------------------------|---------| +| selector | ✅ | +| template | ✅ | +| minReadySeconds | no | +| strategy\.type | no | +| strategy\.rollingUpdate\.maxSurge | no | +| strategy\.rollingUpdate\.maxUnavailable | no | +| revisionHistoryLimit | no | + +## Job Fields + +| Field | Support | +|-------------------------|----------------------------------| +| activeDeadlineSeconds | no | +| selector | no (automatically set by k8s) | +| template | ✅ | +| backoffLimit | no | +| completionMode | no | +| completions | no (set to 1 with kube generate) | +| manualSelector | no | +| parallelism | no (set to 1 with kube generate) | +| podFailurePolicy | no | +| suspend | no | +| ttlSecondsAfterFinished | no | diff --git a/versioned_docs/version-5.5.0/source/markdown/options/README.md b/versioned_docs/version-5.5.0/source/markdown/options/README.md new file mode 100644 index 000000000..610890989 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/README.md @@ -0,0 +1,68 @@ +--- +title: Documentation +version: v5.5.0 +--- + +Common Man Page Options +======================= + +This subdirectory contains option (flag) names and descriptions +common to multiple podman man pages. Each file is one option. The +filename does not necessarily need to be identical to the option +name: for instance, `hostname.container.md` and `hostname.pod.md` +exist because the **--hostname** option is sufficiently different +between `podman-{create,run}` and `podman-pod-{create,run}` to +warrant living separately. + +How +=== + +The files here are included in `podman-*.md.in` files using the `@@option` +mechanism: + +``` +@@option foo ! includes options/foo.md +``` + +The tool that does this is `hack/markdown-preprocess`. It is a python +script because it needs to run on `readthedocs.io`. From a given `.md.in` +file, this script creates a `.md` file that can then be read by +`go-md2man`, `sphinx`, anything that groks markdown. This runs as +part of `make docs`. + +Special Substitutions +===================== + +Some options are almost identical except for 'pod' vs 'container' +differences. For those, use `<>`. +Order is immaterial: the important thing is the presence of the +string "`pod`" in one half but not the other. The correct string +is chosen based on the filename: if the file contains `-pod`, +such as `podman-pod-create`, the string with `pod` (case-insensitive) +in it is chosen. + +The string `<>` is replaced with the podman subcommand +as determined from the filename, e.g., `create` for `podman-create.1.md.in`. +This allows the shared use of examples in the option file: +``` + Example: podman <> --foo --bar +``` +As a special case, `podman-pod-X` becomes just `X` (the "pod" is removed). +This makes the `pod-id-file` man page more useful. To get the full +subcommand including 'pod', use `<>`. + +Restrictions +============ + +There is a restriction for having a single text line with three +back-ticks in the front and the end of the line. For instance: + +\`\`\`Some man page text\`\`\` + +This is currently not allowed and causes a corruption of the +compiled man page. Instead, put the three back-ticks on separate +lines like: + +\`\`\` +Some man page text +\`\`\` diff --git a/versioned_docs/version-5.5.0/source/markdown/options/add-host.md b/versioned_docs/version-5.5.0/source/markdown/options/add-host.md new file mode 100644 index 000000000..4c41df56a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/add-host.md @@ -0,0 +1,44 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, create, farm build, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the <>'s `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/annotation.container.md b/versioned_docs/version-5.5.0/source/markdown/options/annotation.container.md new file mode 100644 index 000000000..04755c65e --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/annotation.container.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, kube play, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--annotation**=*key=value* + +Add an annotation to the container<<| or pod>>. This option can be set multiple times. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/annotation.image.md b/versioned_docs/version-5.5.0/source/markdown/options/annotation.image.md new file mode 100644 index 000000000..50bddcf41 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/annotation.image.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--annotation**=*annotation=value* + +Add an image *annotation* (e.g. annotation=*value*) to the image metadata. Can +be used multiple times. + +Note: this information is not present in Docker image formats, so it is +discarded when writing images in Docker formats. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/annotation.manifest.md b/versioned_docs/version-5.5.0/source/markdown/options/annotation.manifest.md new file mode 100644 index 000000000..789e57520 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/annotation.manifest.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman artifact add, manifest add, manifest annotate +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--annotation**=*annotation=value* + +Set an annotation on the entry for the specified image or artifact. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/arch.md b/versioned_docs/version-5.5.0/source/markdown/options/arch.md new file mode 100644 index 000000000..626dd6b0a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/arch.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--arch**=*ARCH* +Override the architecture, defaults to hosts, of the image to be pulled. For example, `arm`. +Unless overridden, subsequent lookups of the same image in the local storage matches this architecture, regardless of the host. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/attach.md b/versioned_docs/version-5.5.0/source/markdown/options/attach.md new file mode 100644 index 000000000..0fadc855e --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/attach.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--attach**, **-a**=*stdin* | *stdout* | *stderr* + +Attach to STDIN, STDOUT or STDERR. + +In foreground mode (the default when **-d** +is not specified), **podman run** can start the process in the container +and attach the console to the process's standard input, output, and +error. It can even pretend to be a TTY (this is what most command-line +executables expect) and pass along signals. The **-a** option can be set for +each of **stdin**, **stdout**, and **stderr**. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/authfile.md b/versioned_docs/version-5.5.0/source/markdown/options/authfile.md new file mode 100644 index 000000000..1c0de64c9 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/authfile.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, auto update, build, container runlabel, create, farm build, image sign, kube play, login, logout, manifest add, manifest inspect, manifest push, pull, push, run, search +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/blkio-weight-device.md b/versioned_docs/version-5.5.0/source/markdown/options/blkio-weight-device.md new file mode 100644 index 000000000..b2f201559 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/blkio-weight-device.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman container clone, create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/blkio-weight.md b/versioned_docs/version-5.5.0/source/markdown/options/blkio-weight.md new file mode 100644 index 000000000..442171416 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/blkio-weight.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman container clone, create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/build-arg-file.md b/versioned_docs/version-5.5.0/source/markdown/options/build-arg-file.md new file mode 100644 index 000000000..e75a09370 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/build-arg-file.md @@ -0,0 +1,27 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--build-arg-file**=*path* + +Specifies a file containing lines of build arguments of the form `arg=value`. +The suggested file name is `argfile.conf`. + +Comment lines beginning with `#` are ignored, along with blank lines. +All others must be of the `arg=value` format passed to `--build-arg`. + +If several arguments are provided via the `--build-arg-file` +and `--build-arg` options, the build arguments are merged across all +of the provided files and command line arguments. + +Any file provided in a `--build-arg-file` option is read before +the arguments supplied via the `--build-arg` option. + +When a given argument name is specified several times, the last instance +is the one that is passed to the resulting builds. This means `--build-arg` +values always override those in a `--build-arg-file`. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/build-arg.md b/versioned_docs/version-5.5.0/source/markdown/options/build-arg.md new file mode 100644 index 000000000..ae75e8496 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/build-arg.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--build-arg**=*arg=value* + +Specifies a build argument and its value, which is interpolated in +instructions read from the Containerfiles in the same way that environment variables are, but which are not added to environment variable list in the resulting image's configuration. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/build-context.md b/versioned_docs/version-5.5.0/source/markdown/options/build-context.md new file mode 100644 index 000000000..218f66b8b --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/build-context.md @@ -0,0 +1,35 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--build-context**=*name=value* + +Specify an additional build context using its short name and its location. +Additional build contexts can be referenced in the same manner as we access +different stages in COPY instruction. + +Valid values are: + +* Local directory – e.g. --build-context project2=../path/to/project2/src (This option is not available with the remote Podman client. On Podman machine setup (i.e macOS and Windows) path must exists on the machine VM) +* HTTP URL to a tarball – e.g. --build-context src=https://example.org/releases/src.tar +* Container image – specified with a container-image:// prefix, e.g. --build-context alpine=container-image://alpine:3.15, (also accepts docker://, docker-image://) + +On the Containerfile side, reference the build context on all +commands that accept the “from” parameter. Here’s how that might look: + +```dockerfile +FROM [name] +COPY --from=[name] ... +RUN --mount=from=[name] … +``` + +The value of [name] is matched with the following priority order: + +* Named build context defined with --build-context [name]=.. +* Stage defined with AS [name] inside Containerfile +* Image [name], either local or in a remote registry diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cache-from.md b/versioned_docs/version-5.5.0/source/markdown/options/cache-from.md new file mode 100644 index 000000000..b139d32a6 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cache-from.md @@ -0,0 +1,26 @@ +--- +title: populate a cache and also consult it +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cache-from**=*image* + +Repository to utilize as a potential cache source. When specified, Buildah tries to look for +cache images in the specified repository and attempts to pull cache images instead of actually +executing the build steps locally. Buildah only attempts to pull previously cached images if they +are considered as valid cache hits. + +Use the `--cache-to` option to populate a remote repository with cache content. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-from` option is ignored unless `--layers` is specified. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cache-to.md b/versioned_docs/version-5.5.0/source/markdown/options/cache-to.md new file mode 100644 index 000000000..1d78086ba --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cache-to.md @@ -0,0 +1,24 @@ +--- +title: populate a cache and also consult it +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cache-to**=*image* + +Set this flag to specify a remote repository that is used to store cache images. Buildah attempts to +push newly built cache image to the remote repository. + +Note: Use the `--cache-from` option in order to use cache content in a remote repository. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-to` option is ignored unless `--layers` is specified. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cache-ttl.md b/versioned_docs/version-5.5.0/source/markdown/options/cache-ttl.md new file mode 100644 index 000000000..57e75a2c0 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cache-ttl.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cache-ttl** + +Limit the use of cached images to only consider images with created timestamps less than *duration* ago. +For example if `--cache-ttl=1h` is specified, Buildah considers intermediate cache images which are created +under the duration of one hour, and intermediate cache images outside this duration is ignored. + +Note: Setting `--cache-ttl=0` manually is equivalent to using `--no-cache` in the +implementation since this means that the user does not want to use cache at all. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cap-add.image.md b/versioned_docs/version-5.5.0/source/markdown/options/cap-add.image.md new file mode 100644 index 000000000..b92ccc4c8 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cap-add.image.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cap-add**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability added to its capability set. +Certain capabilities are granted by default; this option can be used to add +more. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cap-add.md b/versioned_docs/version-5.5.0/source/markdown/options/cap-add.md new file mode 100644 index 000000000..1d3686e7a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cap-add.md @@ -0,0 +1,24 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cap-add**=*capability* + +Add Linux capabilities. + +Granting additional capabilities increases the privileges of the +processes running inside the container and potentially allow it to +break out of confinement. Capabilities like `CAP_SYS_ADMIN`, +`CAP_SYS_PTRACE`, `CAP_MKNOD` and `CAP_SYS_MODULE` are particularly +dangerous when they are not used within a user namespace. Please +refer to **user_namespaces(7)** for a more detailed explanation of the +interaction between user namespaces and capabilities. + +Before adding any capability, review its security implications and +ensure it is really necessary for the container’s functionality. See +**capabilities(7)** for more information. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cap-drop.image.md b/versioned_docs/version-5.5.0/source/markdown/options/cap-drop.image.md new file mode 100644 index 000000000..1103f8b22 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cap-drop.image.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cap-drop**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability removed from its capability set. +The CAP\_CHOWN, CAP\_DAC\_OVERRIDE, CAP\_FOWNER, +CAP\_FSETID, CAP\_KILL, CAP\_NET\_BIND\_SERVICE, CAP\_SETFCAP, +CAP\_SETGID, CAP\_SETPCAP, and CAP\_SETUID capabilities are +granted by default; this option can be used to remove them. + +If a capability is specified to both the **--cap-add** and **--cap-drop** +options, it is dropped, regardless of the order in which the options were +given. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cap-drop.md b/versioned_docs/version-5.5.0/source/markdown/options/cap-drop.md new file mode 100644 index 000000000..6b42f3aac --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cap-drop.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cap-drop**=*capability* + +Drop Linux capabilities. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cert-dir.md b/versioned_docs/version-5.5.0/source/markdown/options/cert-dir.md new file mode 100644 index 000000000..0646fcb1f --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cert-dir.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, build, container runlabel, farm build, image sign, kube play, login, manifest add, manifest push, pull, push, search +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cgroup-conf.md b/versioned_docs/version-5.5.0/source/markdown/options/cgroup-conf.md new file mode 100644 index 000000000..333ece633 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cgroup-conf.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroup-conf**=*KEY=VALUE* + +When running on cgroup v2, specify the cgroup file to write to and its value. For example **--cgroup-conf=memory.high=1073741824** sets the memory.high limit to 1GB. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cgroup-parent.md b/versioned_docs/version-5.5.0/source/markdown/options/cgroup-parent.md new file mode 100644 index 000000000..7ab9dc7cc --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cgroup-parent.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, create, farm build, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the <> is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cgroupns.image.md b/versioned_docs/version-5.5.0/source/markdown/options/cgroupns.image.md new file mode 100644 index 000000000..a94b81145 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cgroupns.image.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroupns**=*how* + +Sets the configuration for cgroup namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "private" to indicate +that a new cgroup namespace is created, or it can be "host" to indicate +that the cgroup namespace in which `buildah` itself is being run is reused. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cgroupns.md b/versioned_docs/version-5.5.0/source/markdown/options/cgroupns.md new file mode 100644 index 000000000..1320fd4bc --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cgroupns.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroupns**=*mode* + +Set the cgroup namespace mode for the container. + +- **host**: use the host's cgroup namespace inside the container. +- **container:**_id_: join the namespace of the specified container. +- **private**: create a new cgroup namespace. +- **ns:**_path_: join the namespace at the specified path. + +If the host uses cgroups v1, the default is set to **host**. On cgroups v2, the default is **private**. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cgroups.md b/versioned_docs/version-5.5.0/source/markdown/options/cgroups.md new file mode 100644 index 000000000..3af63c44b --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cgroups.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroups**=*how* + +Determines whether the container creates CGroups. + +Default is **enabled**. + +The **enabled** option creates a new cgroup under the cgroup-parent. +The **disabled** option forces the container to not create CGroups, and thus conflicts with CGroup options (**--cgroupns** and **--cgroup-parent**). +The **no-conmon** option disables a new CGroup only for the **conmon** process. +The **split** option splits the current CGroup in two sub-cgroups: one for conmon and one for the container payload. It is not possible to set **--cgroup-parent** with **split**. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/chrootdirs.md b/versioned_docs/version-5.5.0/source/markdown/options/chrootdirs.md new file mode 100644 index 000000000..6dacdee7d --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/chrootdirs.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--chrootdirs**=*path* + +Path to a directory inside the container that is treated as a `chroot` directory. +Any Podman managed file (e.g., /etc/resolv.conf, /etc/hosts, etc/hostname) that is mounted into the root directory is mounted into that location as well. +Multiple directories are separated with a comma. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cidfile.read.md b/versioned_docs/version-5.5.0/source/markdown/options/cidfile.read.md new file mode 100644 index 000000000..ea1755a50 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cidfile.read.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman kill, pause, rm, stop, unpause +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cidfile**=*file* + +Read container ID from the specified *file* and <> the container. +Can be specified multiple times. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cidfile.write.md b/versioned_docs/version-5.5.0/source/markdown/options/cidfile.write.md new file mode 100644 index 000000000..354e081e8 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cidfile.write.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cidfile**=*file* + +Write the container ID to *file*. The file is removed along with the container, except +when used with podman --remote run on detached containers. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/color.md b/versioned_docs/version-5.5.0/source/markdown/options/color.md new file mode 100644 index 000000000..100faf062 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/color.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--color** + +Output the containers with different colors in the log. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/compat-auth-file.md b/versioned_docs/version-5.5.0/source/markdown/options/compat-auth-file.md new file mode 100644 index 000000000..fb17a9bcf --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/compat-auth-file.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman login, logout +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compat-auth-file**=*path* + +Instead of updating the default credentials file, update the one at *path*, and use a Docker-compatible format. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/compat-volumes.md b/versioned_docs/version-5.5.0/source/markdown/options/compat-volumes.md new file mode 100644 index 000000000..5f0b9668a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/compat-volumes.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compat-volumes** + +Handle directories marked using the VOLUME instruction (both in this build, and +those inherited from base images) such that their contents can only be modified +by ADD and COPY instructions. Any changes made in those locations by RUN +instructions will be reverted. Before the introduction of this option, this +behavior was the default, but it is now disabled by default. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/compression-format.md b/versioned_docs/version-5.5.0/source/markdown/options/compression-format.md new file mode 100644 index 000000000..b4f2b7c3b --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/compression-format.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compression-format**=**gzip** | *zstd* | *zstd:chunked* + +Specifies the compression format to use. Supported values are: `gzip`, `zstd` and `zstd:chunked`. The default is `gzip` unless overridden in the containers.conf file. +`zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning in that case. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/compression-level.md b/versioned_docs/version-5.5.0/source/markdown/options/compression-level.md new file mode 100644 index 000000000..6761ae351 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/compression-level.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compression-level**=*level* + +Specifies the compression level to use. The value is specific to the compression algorithm used, e.g. for zstd the accepted values are in the range 1-20 (inclusive) with a default of 3, while for gzip it is 1-9 (inclusive) and has a default of 5. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/conmon-pidfile.md b/versioned_docs/version-5.5.0/source/markdown/options/conmon-pidfile.md new file mode 100644 index 000000000..2a42b1265 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/conmon-pidfile.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--conmon-pidfile**=*file* + +Write the pid of the **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to restart Podman containers. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cpp-flag.md b/versioned_docs/version-5.5.0/source/markdown/options/cpp-flag.md new file mode 100644 index 000000000..49b35c23e --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cpp-flag.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpp-flag**=*flags* + +Set additional flags to pass to the C Preprocessor cpp(1). Containerfiles ending with a ".in" suffix is preprocessed via cpp(1). This option can be used to pass additional flags to cpp.Note: You can also set default CPPFLAGS by setting the BUILDAH_CPPFLAGS environment variable (e.g., export BUILDAH_CPPFLAGS="-DDEBUG"). diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cpu-period.md b/versioned_docs/version-5.5.0/source/markdown/options/cpu-period.md new file mode 100644 index 000000000..61bf6c810 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cpu-period.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cpu-quota.md b/versioned_docs/version-5.5.0/source/markdown/options/cpu-quota.md new file mode 100644 index 000000000..be19ba22d --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cpu-quota.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cpu-rt-period.md b/versioned_docs/version-5.5.0/source/markdown/options/cpu-rt-period.md new file mode 100644 index 000000000..5b8c149ee --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cpu-rt-period.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman container clone, create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cpu-rt-runtime.md b/versioned_docs/version-5.5.0/source/markdown/options/cpu-rt-runtime.md new file mode 100644 index 000000000..6fdae68e7 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cpu-rt-runtime.md @@ -0,0 +1,19 @@ +--- +title: of +version: v5.5.0 +--- + +####> This option file is used in: +####> podman container clone, create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cpu-shares.md b/versioned_docs/version-5.5.0/source/markdown/options/cpu-shares.md new file mode 100644 index 000000000..c819134b7 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cpu-shares.md @@ -0,0 +1,50 @@ +--- +title: of +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cpus.container.md b/versioned_docs/version-5.5.0/source/markdown/options/cpus.container.md new file mode 100644 index 000000000..88a0e7a47 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cpus.container.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpus**=*number* + +Number of CPUs. The default is *0.0* which means no limit. This is shorthand +for **--cpu-period** and **--cpu-quota**, therefore the option cannot be specified with +**--cpu-period** or **--cpu-quota**. + +On some systems, changing the CPU limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cpuset-cpus.md b/versioned_docs/version-5.5.0/source/markdown/options/cpuset-cpus.md new file mode 100644 index 000000000..d4b91fe4a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cpuset-cpus.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/cpuset-mems.md b/versioned_docs/version-5.5.0/source/markdown/options/cpuset-mems.md new file mode 100644 index 000000000..4194c7db4 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/cpuset-mems.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/creds.md b/versioned_docs/version-5.5.0/source/markdown/options/creds.md new file mode 100644 index 000000000..437fb42e8 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/creds.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, build, container runlabel, farm build, kube play, manifest add, manifest push, pull, push, search +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--creds**=*[username[\\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/decryption-key.md b/versioned_docs/version-5.5.0/source/markdown/options/decryption-key.md new file mode 100644 index 000000000..ccf915aeb --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/decryption-key.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman artifact pull, build, create, farm build, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--decryption-key**=*key[\\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/destroy.md b/versioned_docs/version-5.5.0/source/markdown/options/destroy.md new file mode 100644 index 000000000..6e0450d7e --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/destroy.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman container clone, pod clone +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--destroy** + +Remove the original <> that we are cloning once used to mimic the configuration. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/detach-keys.md b/versioned_docs/version-5.5.0/source/markdown/options/detach-keys.md new file mode 100644 index 000000000..b6f0e5e1a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/detach-keys.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman attach, exec, run, start +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/device-cgroup-rule.md b/versioned_docs/version-5.5.0/source/markdown/options/device-cgroup-rule.md new file mode 100644 index 000000000..f000637f2 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/device-cgroup-rule.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-cgroup-rule**=*"type major\\:minor mode"* + +Add a rule to the cgroup allowed devices list. The rule is expected to be +in the format specified in the Linux kernel documentation +[admin-guide/cgroup-v1/devices](https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.html): +- *type*: `a` (all), `c` (char), or `b` (block); +- *major* and *minor*: either a number, or `*` for all; +- *mode*: a composition of `r` (read), `w` (write), and `m` (mknod(2)). diff --git a/versioned_docs/version-5.5.0/source/markdown/options/device-read-bps.md b/versioned_docs/version-5.5.0/source/markdown/options/device-read-bps.md new file mode 100644 index 000000000..d38c051a7 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/device-read-bps.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman container clone, create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/device-read-iops.md b/versioned_docs/version-5.5.0/source/markdown/options/device-read-iops.md new file mode 100644 index 000000000..15945adb7 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/device-read-iops.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-read-iops**=*path:rate* + +Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/device-write-bps.md b/versioned_docs/version-5.5.0/source/markdown/options/device-write-bps.md new file mode 100644 index 000000000..42f56cc38 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/device-write-bps.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman container clone, create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/device-write-iops.md b/versioned_docs/version-5.5.0/source/markdown/options/device-write-iops.md new file mode 100644 index 000000000..d27bbe9d2 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/device-write-iops.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-write-iops**=*path:rate* + +Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/device.md b/versioned_docs/version-5.5.0/source/markdown/options/device.md new file mode 100644 index 000000000..494c1d6bf --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/device.md @@ -0,0 +1,31 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, create, farm build, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device**=*host-device[:container-device][\\\:permissions]* + +Add a host device to the <>. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The <> only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true diff --git a/versioned_docs/version-5.5.0/source/markdown/options/digestfile.md b/versioned_docs/version-5.5.0/source/markdown/options/digestfile.md new file mode 100644 index 000000000..09abf3aa4 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/digestfile.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman artifact push, manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--digestfile**=*Digestfile* + +After copying the image, write the digest of the resulting image to the file. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/dir-compress.md b/versioned_docs/version-5.5.0/source/markdown/options/dir-compress.md new file mode 100644 index 000000000..8e8a34851 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/dir-compress.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman push, save +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compress** + +Compress tarball image layers when pushing to a directory using the 'dir' transport. (default is same compression type, compressed or uncompressed, as source) diff --git a/versioned_docs/version-5.5.0/source/markdown/options/disable-compression.md b/versioned_docs/version-5.5.0/source/markdown/options/disable-compression.md new file mode 100644 index 000000000..53102d0f3 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/disable-compression.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--disable-compression**, **-D** + +Don't compress filesystem layers when building the image unless it is required +by the location where the image is being written. This is the default setting, +because image layers are compressed automatically when they are pushed to +registries, and images being written to local storage only need to be +decompressed again to be stored. Compression can be forced in all cases by +specifying **--disable-compression=false**. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/disable-content-trust.md b/versioned_docs/version-5.5.0/source/markdown/options/disable-content-trust.md new file mode 100644 index 000000000..604b98f9e --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/disable-content-trust.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, create, pull, push, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/dns-option.container.md b/versioned_docs/version-5.5.0/source/markdown/options/dns-option.container.md new file mode 100644 index 000000000..649247779 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/dns-option.container.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns-option**=*option* + +Set custom DNS options. Invalid if using **--dns-option** with **--network** that is set to **none** or **container:**_id_. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/dns-option.image.md b/versioned_docs/version-5.5.0/source/markdown/options/dns-option.image.md new file mode 100644 index 000000000..80e3e7370 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/dns-option.image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns-option**=*option* + +Set custom DNS options to be used during the build. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/dns-search.container.md b/versioned_docs/version-5.5.0/source/markdown/options/dns-search.container.md new file mode 100644 index 000000000..6bdfcdf98 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/dns-search.container.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns-search**=*domain* + +Set custom DNS search domains. Invalid if using **--dns-search** with **--network** that is set to **none** or **container:**_id_. +Use **--dns-search=.** to remove the search domain. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/dns-search.image.md b/versioned_docs/version-5.5.0/source/markdown/options/dns-search.image.md new file mode 100644 index 000000000..dc3fbab0d --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/dns-search.image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns-search**=*domain* + +Set custom DNS search domains to be used during the build. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/dns.md b/versioned_docs/version-5.5.0/source/markdown/options/dns.md new file mode 100644 index 000000000..86f35c2e0 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/dns.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, create, farm build, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/entrypoint.md b/versioned_docs/version-5.5.0/source/markdown/options/entrypoint.md new file mode 100644 index 000000000..f996054ed --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/entrypoint.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--entrypoint**=*"command"* | *'["command", "arg1", ...]'* + +Override the default ENTRYPOINT from the image. + +The ENTRYPOINT of an image is similar to a COMMAND +because it specifies what executable to run when the container starts, but it is +(purposely) more difficult to override. The ENTRYPOINT gives a container its +default nature or behavior. When the ENTRYPOINT is set, the +container runs as if it were that binary, complete with default options. More options can be +passed in via the COMMAND. But, if a user wants to run +something else inside the container, the **--entrypoint** option allows a new +ENTRYPOINT to be specified. + +Specify multi option commands in the form of a JSON string. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/env-file.md b/versioned_docs/version-5.5.0/source/markdown/options/env-file.md new file mode 100644 index 000000000..d64697805 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/env-file.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env-file**=*file* + +Read in a line-delimited file of environment variables. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/env-host.md b/versioned_docs/version-5.5.0/source/markdown/options/env-host.md new file mode 100644 index 000000000..4a5c0d1b5 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/env-host.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env-host** + +Use host environment inside of the container. See **Environment** note below for precedence. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.0/source/markdown/options/env-merge.md b/versioned_docs/version-5.5.0/source/markdown/options/env-merge.md new file mode 100644 index 000000000..543357fda --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/env-merge.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env-merge**=*env* + +Preprocess default environment variables for the containers. For example +if image contains environment variable `hello=world` user can preprocess +it using `--env-merge hello=${hello}-some` so new value is `hello=world-some`. + +Please note that if the environment variable `hello` is not present in the image, +then it'll be replaced by an empty string and so using `--env-merge hello=${hello}-some` +would result in the new value of `hello=-some`, notice the leading `-` delimiter. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/env.image.md b/versioned_docs/version-5.5.0/source/markdown/options/env.image.md new file mode 100644 index 000000000..2d559bf08 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/env.image.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env**=*env[=value]* + +Add a value (e.g. env=*value*) to the built image. Can be used multiple times. +If neither `=` nor a *value* are specified, but *env* is set in the current +environment, the value from the current environment is added to the image. +To remove an environment variable from the built image, use the `--unsetenv` +option. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/env.md b/versioned_docs/version-5.5.0/source/markdown/options/env.md new file mode 100644 index 000000000..c54d1c10e --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/env.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env**, **-e**=*env* + +Set environment variables. + +This option allows arbitrary environment variables that are available for the process to be launched inside of the container. If an environment variable is specified without a value, Podman checks the host environment for a value and set the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the container. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/env.update.md b/versioned_docs/version-5.5.0/source/markdown/options/env.update.md new file mode 100644 index 000000000..557f6956f --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/env.update.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env**, **-e**=*env* + +Add a value (e.g. env=*value*) to the container. Can be used multiple times. +If the value already exists in the container, it is overridden. +To remove an environment variable from the container, use the `--unsetenv` +option. + +Note that the env updates only affect the main container process after +the next start. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/expose.md b/versioned_docs/version-5.5.0/source/markdown/options/expose.md new file mode 100644 index 000000000..a94dd9d34 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/expose.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--expose**=*port[/protocol]* + +Expose a port or a range of ports (e.g. **--expose=3300-3310**). +The protocol can be `tcp`, `udp` or `sctp` and if not given `tcp` is assumed. +This option matches the EXPOSE instruction for image builds and has no effect on +the actual networking rules unless **-P/--publish-all** is used to forward to all +exposed ports from random host ports. To forward specific ports from the host +into the container use the **-p/--publish** option instead. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/farm.md b/versioned_docs/version-5.5.0/source/markdown/options/farm.md new file mode 100644 index 000000000..00bb1775f --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/farm.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--farm** + +This option specifies the name of the farm to be used in the build process. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/features.md b/versioned_docs/version-5.5.0/source/markdown/options/features.md new file mode 100644 index 000000000..5c29817ef --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/features.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman manifest add, manifest annotate +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--features**=*feature* + +Specify the features list which the list or index records as requirements for +the image. This option is rarely used. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/file.md b/versioned_docs/version-5.5.0/source/markdown/options/file.md new file mode 100644 index 000000000..7513d7e5a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/file.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--file**, **-f**=*Containerfile* + +Specifies a Containerfile which contains instructions for building the image, +either a local file or an **http** or **https** URL. If more than one +Containerfile is specified, *FROM* instructions are only be accepted from the +last specified file. + +If a build context is not specified, and at least one Containerfile is a +local file, the directory in which it resides is used as the build +context. + +Specifying the option `-f -` causes the Containerfile contents to be read from stdin. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/follow.md b/versioned_docs/version-5.5.0/source/markdown/options/follow.md new file mode 100644 index 000000000..c4e0407b4 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/follow.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--follow**, **-f** + +Follow log output. Default is false. + +Note: When following a <> which is removed by `podman <> rm` +or removed on exit (`podman run --rm ...`), there is a chance that the log +file is removed before `podman<< pod|>> logs` reads the final content. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/force-compression.md b/versioned_docs/version-5.5.0/source/markdown/options/force-compression.md new file mode 100644 index 000000000..ed4380e16 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/force-compression.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--force-compression** + +If set, push uses the specified compression algorithm even if the destination contains a differently-compressed variant already. +Defaults to `true` if `--compression-format` is explicitly specified on the command-line, `false` otherwise. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/force-rm.md b/versioned_docs/version-5.5.0/source/markdown/options/force-rm.md new file mode 100644 index 000000000..7b6c84dcc --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/force-rm.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--force-rm** + +Always remove intermediate containers after a build, even if the build fails (default true). diff --git a/versioned_docs/version-5.5.0/source/markdown/options/format.md b/versioned_docs/version-5.5.0/source/markdown/options/format.md new file mode 100644 index 000000000..a3b1b5204 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/format.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--format** + +Control the format for the built image's manifest and configuration data. +Recognized formats include *oci* (OCI image-spec v1.0, the default) and +*docker* (version 2, using schema format 2 for the manifest). + +Note: You can also override the default format by setting the BUILDAH\_FORMAT +environment variable. `export BUILDAH_FORMAT=docker` diff --git a/versioned_docs/version-5.5.0/source/markdown/options/from.md b/versioned_docs/version-5.5.0/source/markdown/options/from.md new file mode 100644 index 000000000..f7e568dfa --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/from.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--from** + +Overrides the first `FROM` instruction within the Containerfile. If there are multiple +FROM instructions in a Containerfile, only the first is changed. + +With the remote podman client, not all container transports work as +expected. For example, oci-archive:/x.tar references /x.tar on the remote +machine instead of on the client. When using podman remote clients it is +best to restrict use to *containers-storage*, and *docker:// transports*. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/gidmap.container.md b/versioned_docs/version-5.5.0/source/markdown/options/gidmap.container.md new file mode 100644 index 000000000..7f719ad91 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/gidmap.container.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--gidmap**=*[flags]container_uid\:from_uid[\\:amount]* + +Run the container in a new user namespace using the supplied GID mapping. This +option conflicts with the **--userns** and **--subgidname** options. This +option provides a way to map host GIDs to container GIDs in the same way as +__--uidmap__ maps host UIDs to container UIDs. For details see __--uidmap__. + +Note: the **--gidmap** option cannot be called in conjunction with the **--pod** option as a gidmap cannot be set on the container level when in a pod. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/gidmap.pod.md b/versioned_docs/version-5.5.0/source/markdown/options/gidmap.pod.md new file mode 100644 index 000000000..92719b7d2 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/gidmap.pod.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--gidmap**=*pod_gid\:host_gid\\:amount* + +GID map for the user namespace. Using this flag runs all containers in the pod with user namespace enabled. +It conflicts with the **--userns** and **--subgidname** flags. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/gpus.md b/versioned_docs/version-5.5.0/source/markdown/options/gpus.md new file mode 100644 index 000000000..c870fc17c --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/gpus.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/group-add.md b/versioned_docs/version-5.5.0/source/markdown/options/group-add.md new file mode 100644 index 000000000..6a62183cf --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/group-add.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, create, farm build, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.0/source/markdown/options/group-entry.md b/versioned_docs/version-5.5.0/source/markdown/options/group-entry.md new file mode 100644 index 000000000..818a1dfc2 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/group-entry.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--group-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/group` file within the container when `--user` is used. + +The variables $GROUPNAME, $GID, and $USERLIST are automatically replaced with their value at runtime if present. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/health-cmd.md b/versioned_docs/version-5.5.0/source/markdown/options/health-cmd.md new file mode 100644 index 000000000..be288f7b1 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/health-cmd.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set or alter a healthcheck command for a container. The command is a command to be executed inside the +container that determines the container health. The command is required for other healthcheck options +to be applied. A value of **none** disables existing healthchecks. + +Multiple options can be passed in the form of a JSON array; otherwise, the command is interpreted +as an argument to **/bin/sh -c**. + +Note: The default values are used even if healthcheck is configured in the image. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/health-interval.md b/versioned_docs/version-5.5.0/source/markdown/options/health-interval.md new file mode 100644 index 000000000..0324d920d --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/health-interval.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-interval**=*interval* + +Set an interval for the healthchecks. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +Note: This parameter will overwrite related healthcheck configuration from the image. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/health-log-destination.md b/versioned_docs/version-5.5.0/source/markdown/options/health-log-destination.md new file mode 100644 index 000000000..2b55be658 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/health-log-destination.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-log-destination**=*directory_path* + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) (Default: local) + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/health-max-log-count.md b/versioned_docs/version-5.5.0/source/markdown/options/health-max-log-count.md new file mode 100644 index 000000000..10a7b0d98 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/health-max-log-count.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-max-log-count**=*number of stored logs* + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) (Default: 5 attempts) diff --git a/versioned_docs/version-5.5.0/source/markdown/options/health-max-log-size.md b/versioned_docs/version-5.5.0/source/markdown/options/health-max-log-size.md new file mode 100644 index 000000000..0cd02d0e4 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/health-max-log-size.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-max-log-size**=*size of stored logs* + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) (Default: 500 characters) diff --git a/versioned_docs/version-5.5.0/source/markdown/options/health-on-failure.md b/versioned_docs/version-5.5.0/source/markdown/options/health-on-failure.md new file mode 100644 index 000000000..55087f980 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/health-on-failure.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-on-failure**=*action* + +Action to take once the container transitions to an unhealthy state. The default is **none**. + +- **none**: Take no action. +- **kill**: Kill the container. +- **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. +- **stop**: Stop the container. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/health-retries.md b/versioned_docs/version-5.5.0/source/markdown/options/health-retries.md new file mode 100644 index 000000000..28a827e94 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/health-retries.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-retries**=*retries* + +The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is **3**. + +Note: This parameter can overwrite the healthcheck configuration from the image. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/health-start-period.md b/versioned_docs/version-5.5.0/source/markdown/options/health-start-period.md new file mode 100644 index 000000000..f03bdbcbb --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/health-start-period.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-start-period**=*period* + +The initialization time needed for a container to bootstrap. The value can be expressed in time format like +**2m3s**. The default value is **0s**. + +Note: The health check command is executed as soon as a container is started, if the health check is successful +the container's health state will be updated to `healthy`. However, if the health check fails, the health state will +stay as `starting` until either the health check is successful or until the `--health-start-period` time is over. If the +health check command fails after the `--health-start-period` time is over, the health state will be updated to `unhealthy`. +The health check command is executed periodically based on the value of `--health-interval`. + +Note: This parameter will overwrite related healthcheck configuration from the image. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/health-startup-cmd.md b/versioned_docs/version-5.5.0/source/markdown/options/health-startup-cmd.md new file mode 100644 index 000000000..ef2e9f30a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/health-startup-cmd.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set a startup healthcheck command for a container. This command is executed inside the container and is used to gate the regular +healthcheck. When the startup command succeeds, the regular healthcheck begins and the startup healthcheck ceases. Optionally, +if the command fails for a set number of attempts, the container is restarted. A startup healthcheck can be used to ensure that +containers with an extended startup period are not marked as unhealthy until they are fully started. Startup healthchecks can only be +used when a regular healthcheck (from the container's image or the **--health-cmd** option) is also set. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/health-startup-interval.md b/versioned_docs/version-5.5.0/source/markdown/options/health-startup-interval.md new file mode 100644 index 000000000..1db91a458 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/health-startup-interval.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-interval**=*interval* + +Set an interval for the startup healthcheck. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/health-startup-retries.md b/versioned_docs/version-5.5.0/source/markdown/options/health-startup-retries.md new file mode 100644 index 000000000..ebf6c937e --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/health-startup-retries.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-retries**=*retries* + +The number of attempts allowed before the startup healthcheck restarts the container. If set to **0**, the container is never restarted. The default is **0**. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/health-startup-success.md b/versioned_docs/version-5.5.0/source/markdown/options/health-startup-success.md new file mode 100644 index 000000000..83e8840e2 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/health-startup-success.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-success**=*retries* + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value +of **0** means that any success begins the regular healthcheck. The default is **0**. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/health-startup-timeout.md b/versioned_docs/version-5.5.0/source/markdown/options/health-startup-timeout.md new file mode 100644 index 000000000..2410a3b12 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/health-startup-timeout.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-timeout**=*timeout* + +The maximum time a startup healthcheck command has to complete before it is marked as failed. The value can be expressed in a time +format like **2m3s**. The default value is **30s**. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/health-timeout.md b/versioned_docs/version-5.5.0/source/markdown/options/health-timeout.md new file mode 100644 index 000000000..e67596e25 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/health-timeout.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-timeout**=*timeout* + +The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the +value can be expressed in a time format such as **1m22s**. The default value is **30s**. + +Note: A timeout marks the healthcheck as failed but does not terminate the running process. +This ensures that a slow but eventually successful healthcheck does not disrupt the container +but is still accounted for in the health status. + +Note: This parameter will overwrite related healthcheck configuration from the image. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/help.md b/versioned_docs/version-5.5.0/source/markdown/options/help.md new file mode 100644 index 000000000..2b0241371 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/help.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--help**, **-h** + +Print usage statement diff --git a/versioned_docs/version-5.5.0/source/markdown/options/hooks-dir.md b/versioned_docs/version-5.5.0/source/markdown/options/hooks-dir.md new file mode 100644 index 000000000..fadec2e8b --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/hooks-dir.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hooks-dir**=*path* + +Each *.json file in the path configures a hook for buildah build containers. For more details on the syntax of the JSON files and the semantics of hook injection. Buildah currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. + +This option may be set multiple times; paths from later options have higher precedence. + +For the annotation conditions, buildah uses any annotations set in the generated OCI configuration. + +For the bind-mount conditions, only mounts explicitly requested by the caller via --volume are considered. Bind mounts that buildah inserts by default (e.g. /dev/shm) are not considered. + +If --hooks-dir is unset for root callers, Buildah currently defaults to /usr/share/containers/oci/hooks.d and /etc/containers/oci/hooks.d in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting --hooks-dir. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/hostname.container.md b/versioned_docs/version-5.5.0/source/markdown/options/hostname.container.md new file mode 100644 index 000000000..5062f3c24 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/hostname.container.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hostname**, **-h**=*name* + +Set the container's hostname inside the container. + +This option can only be used with a private UTS namespace `--uts=private` +(default). If `--pod` is given and the pod shares the same UTS namespace +(default), the pod's hostname is used. The given hostname is also added to the +`/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). diff --git a/versioned_docs/version-5.5.0/source/markdown/options/hostname.pod.md b/versioned_docs/version-5.5.0/source/markdown/options/hostname.pod.md new file mode 100644 index 000000000..6cbe09229 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/hostname.pod.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hostname**=*name* + +Set the pod's hostname inside all containers. + +The given hostname is also added to the `/etc/hosts` file using the container's +primary IP address (also see the **--add-host** option). diff --git a/versioned_docs/version-5.5.0/source/markdown/options/hosts-file.md b/versioned_docs/version-5.5.0/source/markdown/options/hosts-file.md new file mode 100644 index 000000000..5ec205b06 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/hosts-file.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hosts-file**=*path* | *none* | *image* + +Base file to create the `/etc/hosts` file inside the container. This must either +be an absolute path to a file on the host system, or one of the following +special flags: + "" Follow the `base_hosts_file` configuration in _containers.conf_ (the default) + `none` Do not use a base file (i.e. start with an empty file) + `image` Use the container image's `/etc/hosts` file as base file diff --git a/versioned_docs/version-5.5.0/source/markdown/options/hostuser.md b/versioned_docs/version-5.5.0/source/markdown/options/hostuser.md new file mode 100644 index 000000000..4ba063b5e --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/hostuser.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hostuser**=*name* + +Add a user account to /etc/passwd from the host to the container. The Username +or UID must exist on the host system. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/http-proxy.md b/versioned_docs/version-5.5.0/source/markdown/options/http-proxy.md new file mode 100644 index 000000000..358fa3c52 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/http-proxy.md @@ -0,0 +1,25 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, create, farm build, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/identity-label.md b/versioned_docs/version-5.5.0/source/markdown/options/identity-label.md new file mode 100644 index 000000000..6a1eb5112 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/identity-label.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--identity-label** + +Adds default identity label `io.buildah.version` if set. (default true). diff --git a/versioned_docs/version-5.5.0/source/markdown/options/ignore.md b/versioned_docs/version-5.5.0/source/markdown/options/ignore.md new file mode 100644 index 000000000..653f859fc --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/ignore.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman pod rm, pod stop, rm, stop +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ignore**, **-i** + +Ignore errors when specified <> are not in the container store. A user +might have decided to manually remove a <> which leads to a failure +during the ExecStop directive of a systemd service referencing that <>. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/ignorefile.md b/versioned_docs/version-5.5.0/source/markdown/options/ignorefile.md new file mode 100644 index 000000000..dd18064ed --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/ignorefile.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ignorefile** + +Path to an alternative .containerignore file. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/iidfile.md b/versioned_docs/version-5.5.0/source/markdown/options/iidfile.md new file mode 100644 index 000000000..a512a74c9 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/iidfile.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--iidfile**=*ImageIDfile* + +Write the built image's ID to the file. When `--platform` is specified more than once, attempting to use this option triggers an error. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/image-volume.md b/versioned_docs/version-5.5.0/source/markdown/options/image-volume.md new file mode 100644 index 000000000..6b5f5328c --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/image-volume.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--image-volume**=**bind** | *tmpfs* | *ignore* + +Tells Podman how to handle the builtin image volumes. Default is **bind**. + +- **bind**: An anonymous named volume is created and mounted into the container. +- **tmpfs**: The volume is mounted onto the container as a tmpfs, which allows the users to create +content that disappears when the container is stopped. +- **ignore**: All volumes are just ignored and no action is taken. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/infra-command.md b/versioned_docs/version-5.5.0/source/markdown/options/infra-command.md new file mode 100644 index 000000000..420e41d71 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/infra-command.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--infra-command**=*command* + +The command that is run to start the infra container. Default: "/pause". diff --git a/versioned_docs/version-5.5.0/source/markdown/options/infra-conmon-pidfile.md b/versioned_docs/version-5.5.0/source/markdown/options/infra-conmon-pidfile.md new file mode 100644 index 000000000..cce63c76a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/infra-conmon-pidfile.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--infra-conmon-pidfile**=*file* + +Write the pid of the infra container's **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to manage Podman containers and pods. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/infra-name.md b/versioned_docs/version-5.5.0/source/markdown/options/infra-name.md new file mode 100644 index 000000000..b83a1b54e --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/infra-name.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--infra-name**=*name* + +The name that is used for the pod's infra container. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/inherit-labels.md b/versioned_docs/version-5.5.0/source/markdown/options/inherit-labels.md new file mode 100644 index 000000000..2b5b00959 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/inherit-labels.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--inherit-labels** + +Inherit the labels from the base image or base stages. (default true). diff --git a/versioned_docs/version-5.5.0/source/markdown/options/init-path.md b/versioned_docs/version-5.5.0/source/markdown/options/init-path.md new file mode 100644 index 000000000..580ed73b2 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/init-path.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--init-path**=*path* + +Path to the container-init binary. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/init.md b/versioned_docs/version-5.5.0/source/markdown/options/init.md new file mode 100644 index 000000000..06b5e8568 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/init.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--init** + +Run an init inside the container that forwards signals and reaps processes. +The container-init binary is mounted at `/run/podman-init`. +Mounting over `/run` breaks container execution. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/interactive.md b/versioned_docs/version-5.5.0/source/markdown/options/interactive.md new file mode 100644 index 000000000..19e11f529 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/interactive.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, exec, run, start +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/ip.md b/versioned_docs/version-5.5.0/source/markdown/options/ip.md new file mode 100644 index 000000000..a49a47727 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/ip.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ip**=*ipv4* + +Specify a static IPv4 address for the <>, for example **10.88.64.128**. +This option can only be used if the <> is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the <> is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IP address pool (default **10.88.0.0/16**). + +To specify multiple static IP addresses per <>, set multiple networks using the **--network** option with a static IP address specified for each using the `ip` mode for that option. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/ip6.md b/versioned_docs/version-5.5.0/source/markdown/options/ip6.md new file mode 100644 index 000000000..3abf18496 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/ip6.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ip6**=*ipv6* + +Specify a static IPv6 address for the <>, for example **fd46:db93:aa76\:ac37::10**. +This option can only be used if the <> is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the <> is not joining another container's network namespace via **--network=container\\:_id_**. +The address must be within the network's IPv6 address pool. + +To specify multiple static IPv6 addresses per <>, set multiple networks using the **--network** option with a static IPv6 address specified for each using the `ip6` mode for that option. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/ipc.image.md b/versioned_docs/version-5.5.0/source/markdown/options/ipc.image.md new file mode 100644 index 000000000..42270e426 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/ipc.image.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ipc**=*how* + +Sets the configuration for IPC namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate +that a new IPC namespace is created, or it can be "host" to indicate +that the IPC namespace in which `podman` itself is being run is reused, +or it can be the path to an IPC namespace which is already in use by +another process. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/ipc.md b/versioned_docs/version-5.5.0/source/markdown/options/ipc.md new file mode 100644 index 000000000..ab14487d5 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/ipc.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ipc**=*ipc* + +Set the IPC namespace mode for a container. The default is to create +a private IPC namespace. + +- "": Use Podman's default, defined in containers.conf. +- **container:**_id_: reuses another container's shared memory, semaphores, and message queues +- **host**: use the host's shared memory, semaphores, and message queues inside the container. Note: the host mode gives the container full access to local shared memory and is therefore considered insecure. +- **none**: private IPC namespace, with /dev/shm not mounted. +- **ns:**_path_: path to an IPC namespace to join. +- **private**: private IPC namespace. +- **shareable**: private IPC namespace with a possibility to share it with other containers. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/isolation.md b/versioned_docs/version-5.5.0/source/markdown/options/isolation.md new file mode 100644 index 000000000..e8ee3d8c5 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/isolation.md @@ -0,0 +1,22 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--isolation**=*type* + +Controls what type of isolation is used for running processes as part of `RUN` +instructions. Recognized types include *oci* (OCI-compatible runtime, the +default), *rootless* (OCI-compatible runtime invoked using a modified +configuration and its --rootless option enabled, with *--no-new-keyring +--no-pivot* added to its *create* invocation, with network and UTS namespaces +disabled, and IPC, PID, and user namespaces enabled; the default for +unprivileged users), and *chroot* (an internal wrapper that leans more toward +chroot(1) than container technology). + +Note: You can also override the default isolation type by setting the +BUILDAH\_ISOLATION environment variable. `export BUILDAH_ISOLATION=oci` diff --git a/versioned_docs/version-5.5.0/source/markdown/options/jobs.md b/versioned_docs/version-5.5.0/source/markdown/options/jobs.md new file mode 100644 index 000000000..b6d7c8ca5 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/jobs.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--jobs**=*number* + +Run up to N concurrent stages in parallel. If the number of jobs is greater +than 1, stdin is read from /dev/null. If 0 is specified, then there is +no limit in the number of jobs that run in parallel. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/label-file.md b/versioned_docs/version-5.5.0/source/markdown/options/label-file.md new file mode 100644 index 000000000..7301a3776 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/label-file.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--label-file**=*file* + +Read in a line-delimited file of labels. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/label.image.md b/versioned_docs/version-5.5.0/source/markdown/options/label.image.md new file mode 100644 index 000000000..bb06a7fcc --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/label.image.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--label**=*label* + +Add an image *label* (e.g. label=*value*) to the image metadata. Can be used +multiple times. + +Users can set a special LABEL **io.containers.capabilities=CAP1,CAP2,CAP3** in +a Containerfile that specifies the list of Linux capabilities required for the +container to run properly. This label specified in a container image tells +Podman to run the container with just these capabilities. Podman launches the +container with just the specified capabilities, as long as this list of +capabilities is a subset of the default list. + +If the specified capabilities are not in the default set, Podman prints an error +message and runs the container with the default capabilities. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/label.md b/versioned_docs/version-5.5.0/source/markdown/options/label.md new file mode 100644 index 000000000..6aef5de91 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/label.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--label**, **-l**=*key=value* + +Add metadata to a <>. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/latest.md b/versioned_docs/version-5.5.0/source/markdown/options/latest.md new file mode 100644 index 000000000..bef760bc4 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/latest.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman attach, container diff, container inspect, diff, exec, init, inspect, kill, logs, mount, network reload, pause, pod inspect, pod kill, pod logs, pod rm, pod start, pod stats, pod stop, pod top, port, restart, rm, start, stats, stop, top, unmount, unpause, wait +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--latest**, **-l** + +Instead of providing the <> name or ID, use the last created <>. +Note: the last started <> can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.0/source/markdown/options/layer-label.md b/versioned_docs/version-5.5.0/source/markdown/options/layer-label.md new file mode 100644 index 000000000..9f00efe38 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/layer-label.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--layer-label**=*label[=value]* + +Add an intermediate image *label* (e.g. label=*value*) to the intermediate +image metadata. It can be used multiple times. + +If *label* is named, but neither `=` nor a `value` is provided, then +the *label* is set to an empty value. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/layers.md b/versioned_docs/version-5.5.0/source/markdown/options/layers.md new file mode 100644 index 000000000..343ad25a0 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/layers.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--layers** + +Cache intermediate images during the build process (Default is `true`). + +Note: You can also override the default value of layers by setting the +BUILDAH\_LAYERS environment variable. `export BUILDAH_LAYERS=true` diff --git a/versioned_docs/version-5.5.0/source/markdown/options/link-local-ip.md b/versioned_docs/version-5.5.0/source/markdown/options/link-local-ip.md new file mode 100644 index 000000000..27e7a93f6 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/link-local-ip.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--link-local-ip**=*ip* + +Not implemented. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/log-driver.md b/versioned_docs/version-5.5.0/source/markdown/options/log-driver.md new file mode 100644 index 000000000..622c8f5ae --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/log-driver.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--log-driver**=*driver* + +Logging driver for the container. Currently available options are **k8s-file**, **journald**, **none**, **passthrough** and **passthrough-tty**, with **json-file** aliased to **k8s-file** for scripting compatibility. (Default **journald**). + +The podman info command below displays the default log-driver for the system. +``` +$ podman info --format '{{ .Host.LogDriver }}' +journald +``` +The **passthrough** driver passes down the standard streams (stdin, stdout, stderr) to the +container. It is not allowed with the remote Podman client, including Mac and Windows (excluding WSL2) machines, and on a tty, since it is +vulnerable to attacks via TIOCSTI. + +The **passthrough-tty** driver is the same as **passthrough** except that it also allows it to be used on a TTY if the user really wants it. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/log-opt.md b/versioned_docs/version-5.5.0/source/markdown/options/log-opt.md new file mode 100644 index 000000000..4588999d1 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/log-opt.md @@ -0,0 +1,25 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, kube play, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--log-opt**=*name=value* + +Logging driver specific options. + +Set custom logging configuration. The following *name*s are supported: + +**path**: specify a path to the log file + (e.g. **--log-opt path=/var/log/container/mycontainer.json**); + +**max-size**: specify a max size of the log file + (e.g. **--log-opt max-size=10mb**); + +**tag**: specify a custom log tag for the container + (e.g. **--log-opt tag="{{.ImageName}}"**. +It supports the same keys as **podman inspect --format**. +This option is currently supported only by the **journald** log driver. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/logfile.md b/versioned_docs/version-5.5.0/source/markdown/options/logfile.md new file mode 100644 index 000000000..bda36c855 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/logfile.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--logfile**=*filename* + +Log output which is sent to standard output and standard error to the +specified file instead of to standard output and standard error. +This option is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/mac-address.md b/versioned_docs/version-5.5.0/source/markdown/options/mac-address.md new file mode 100644 index 000000000..510ab4c04 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/mac-address.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--mac-address**=*address* + +<> network interface MAC address (e.g. 92:d0\:c6:0a:29:33) +This option can only be used if the <> is joined to only a single network - i.e., **--network=_network-name_** is used at most once - +and if the <> is not joining another container's network namespace via **--network=container\:_id_**. + +Remember that the MAC address in an Ethernet network must be unique. +The IPv6 link-local address is based on the device's MAC address +according to RFC4862. + +To specify multiple static MAC addresses per <>, set multiple networks using the **--network** option with a static MAC address specified for each using the `mac` mode for that option. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/manifest.md b/versioned_docs/version-5.5.0/source/markdown/options/manifest.md new file mode 100644 index 000000000..0f169c61e --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/manifest.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--manifest**=*manifest* + +Name of the manifest list to which the image is added. Creates the manifest list if it does not exist. This option is useful for building multi architecture images. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/memory-reservation.md b/versioned_docs/version-5.5.0/source/markdown/options/memory-reservation.md new file mode 100644 index 000000000..3f5fc9656 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/memory-reservation.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman container clone, create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/memory-swap.md b/versioned_docs/version-5.5.0/source/markdown/options/memory-swap.md new file mode 100644 index 000000000..c5e6ce844 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/memory-swap.md @@ -0,0 +1,22 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/memory-swappiness.md b/versioned_docs/version-5.5.0/source/markdown/options/memory-swappiness.md new file mode 100644 index 000000000..e45aaae7d --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/memory-swappiness.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman container clone, create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/memory.md b/versioned_docs/version-5.5.0/source/markdown/options/memory.md new file mode 100644 index 000000000..f303b7909 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/memory.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/mount.md b/versioned_docs/version-5.5.0/source/markdown/options/mount.md new file mode 100644 index 000000000..8979ede41 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/mount.md @@ -0,0 +1,133 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--mount**=*type=TYPE,TYPE-SPECIFIC-OPTION[,...]* + +Attach a filesystem mount to the container. + +Current supported mount TYPEs are **artifact**, **bind**, **devpts**, **glob**, **image**, **ramfs**, **tmpfs** and **volume**. + +Options common to all mount types: + +- *src*, *source*: mount source spec for **bind**, **glob**, and **volume**. + Mandatory for **artifact**, **bind**, **glob**, **image** and **volume**. + +- *dst*, *destination*, *target*: mount destination spec. + +When source globs are specified without the destination directory, +the files and directories are mounted with their complete path +within the container. When the destination is specified, the +files and directories matching the glob on the base file name +on the destination directory are mounted. The option +`type=glob,src=/foo*,destination=/tmp/bar` tells container engines +to mount host files matching /foo* to the /tmp/bar/ +directory in the container. + +Options specific to type=**artifact**: + +- *digest*: If the artifact source contains multiple blobs a digest can be + specified to only mount the one specific blob with the digest. + +- *title*: If the artifact source contains multiple blobs a title can be set + which is compared against `org.opencontainers.image.title` annotation. + +The *src* argument contains the name of the artifact, which must already exist locally. +The *dst* argument contains the target path, if the path in the container is a +directory or does not exist the blob title (`org.opencontainers.image.title` +annotation) will be used as filename and joined to the path. If the annotation +does not exist the digest will be used as filename instead. This results in all blobs +of the artifact mounted into the container at the given path. + +However, if the *dst* path is an existing file in the container, then the blob will be +mounted directly on it. This only works when the artifact contains a single blob +or when either *digest* or *title* are specified. + +Options specific to type=**volume**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *idmap*: If specified, create an idmapped mount to the target user namespace in the container. + The idmap option is only supported by Podman in rootful mode. The Linux kernel does not allow the use of idmapped file systems for unprivileged users. + The idmap option supports a custom mapping that can be different than the user namespace used by the container. + The mapping can be specified after the idmap option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the first value is the + start of the backing file system IDs that are mapped to the second value on the host. The length of this mapping is given in the third value. + Multiple ranges are separated with #. If the specified mapping is prepended with a '@', then the mapping is considered relative to the container + user namespace. The host ID for the mapping is changed to account for the relative position of the container user in the container user namespace. + +Options specific to type=**image**: + +- *rw*, *readwrite*: *true* or *false* (default if unspecified: *false*). + +- *subpath*: Mount only a specific path within the image, instead of the whole image. + +Options specific to **bind** and **glob**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *bind-propagation*: *shared*, *slave*, *private*, *unbindable*, *rshared*, *rslave*, *runbindable*, or **rprivate** (default).[[1]](#Footnote1) See also mount(2). + +- *bind-nonrecursive*: do not set up a recursive bind mount. By default it is recursive. + +- *relabel*: *shared*, *private*. + +- *idmap*: *true* or *false* (default if unspecified: *false*). If true, create an idmapped mount to the target user namespace in the container. The idmap option is only supported by Podman in rootful mode. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *no-dereference*: do not dereference symlinks but copy the link source into the mount destination. + +Options specific to type=**tmpfs** and **ramfs**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *tmpfs-size*: Size of the tmpfs/ramfs mount, in bytes. Unlimited by default in Linux. + +- *tmpfs-mode*: Octal file mode of the tmpfs/ramfs (e.g. 700 or 0700.). + +- *tmpcopyup*: Enable copyup from the image directory at the same location to the tmpfs/ramfs. Used by default. + +- *notmpcopyup*: Disable copying files from the image to the tmpfs/ramfs. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +Options specific to type=**devpts**: + +- *uid*: numeric UID of the file owner (default: 0). + +- *gid*: numeric GID of the file owner (default: 0). + +- *mode*: octal permission mask for the file (default: 600). + +- *max*: maximum number of PTYs (default: 1048576). + +Examples: + +- `type=bind,source=/path/on/host,destination=/path/in/container` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared,U=true` + +- `type=devpts,destination=/dev/pts` + +- `type=glob,src=/usr/lib/libfoo*,destination=/usr/lib,ro=true` + +- `type=image,source=fedora,destination=/fedora-image,rw=true` + +- `type=ramfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,destination=/path/in/container,noswap` + +- `type=artifact,src=quay.io/libpod/testartifact:20250206-single,dst=/data` + +- `type=artifact,src=quay.io/libpod/testartifact:20250206-multi,dst=/data,title=test1` diff --git a/versioned_docs/version-5.5.0/source/markdown/options/name.container.md b/versioned_docs/version-5.5.0/source/markdown/options/name.container.md new file mode 100644 index 000000000..85f38b632 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/name.container.md @@ -0,0 +1,25 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--name**=*name* + +Assign a name to the container. + +The operator can identify a container in three ways: + +- UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”); +- UUID short identifier (“f78375b1c487”); +- Name (“jonah”). + +Podman generates a UUID for each container, and if no name is assigned to the +container using **--name**, Podman generates a random string name. The name can +be useful as a more human-friendly way to identify containers. This works for +both background and foreground containers. The container's name is also added +to the `/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). diff --git a/versioned_docs/version-5.5.0/source/markdown/options/names.md b/versioned_docs/version-5.5.0/source/markdown/options/names.md new file mode 100644 index 000000000..81f53d7dd --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/names.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--names**, **-n** + +Output the container names instead of the container IDs in the log. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/network-alias.md b/versioned_docs/version-5.5.0/source/markdown/options/network-alias.md new file mode 100644 index 000000000..9b514d0f5 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/network-alias.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--network-alias**=*alias* + +Add a network-scoped alias for the <>, setting the alias for all networks that the container joins. To set a +name only for a specific network, use the alias option as described under the **--network** option. +If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. This option can be specified multiple times. +NOTE: When using CNI a <> only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/network.image.md b/versioned_docs/version-5.5.0/source/markdown/options/network.image.md new file mode 100644 index 000000000..1894f6a42 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/network.image.md @@ -0,0 +1,68 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--network**=*mode*, **--net** + +Sets the configuration for network namespaces when handling `RUN` instructions. + +Valid _mode_ values are: + +- **none**: no networking. +- **host**: use the Podman host network stack. Note: the host mode gives the +container full access to local system services such as D-bus and is therefore +considered insecure. +- **ns:**_path_: path to a network namespace to join. +- **private**: create a new namespace for the container (default) +- **\**: Join the network with the given name or ID, e.g. use `--network mynet` to join the network with the name mynet. Only supported for rootful users. +- **slirp4netns[\\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=MTU**: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=CIDR**: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=INTERFACE**: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=IPv4**: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=INTERFACE**: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=IPv6**: Specify the outbound ipv6 address slirp binds to. +- **pasta[\\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance diff --git a/versioned_docs/version-5.5.0/source/markdown/options/network.md b/versioned_docs/version-5.5.0/source/markdown/options/network.md new file mode 100644 index 000000000..d2db40f0c --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/network.md @@ -0,0 +1,99 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, kube play, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--network**=*mode*, **--net** + +Set the network mode for the <>. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + For better integration with DNS handling, **--dns-forward 169.254.1.1** is passed, + and this address is added to resolv.conf(5) as first resolver. It is possible to pass + **--dns-forward** explicitly in case a different IP address should be used. + To make the `host.containers.internal` /etc/hosts entry work and allow connections + to the host, **--map-guest-addr 169.254.1.2** is passed. Again, it can be set + explicitly to choose a different IP address. \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured (via Podman's + **--publish** or by passing the pasta **-t**/**-u** options directly), + to disable automatic port forwarding based on bound ports. Similarly, **-T none** + and **-U none** are given to disable the same functionality from container to + host. \ + All options can also be set in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**; + see the `pasta_options` key under the network section in that file. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance diff --git a/versioned_docs/version-5.5.0/source/markdown/options/no-cache.md b/versioned_docs/version-5.5.0/source/markdown/options/no-cache.md new file mode 100644 index 000000000..6bd314bf5 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/no-cache.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-cache** + +Do not use existing cached images for the container build. Build from the start with a new set of cached layers. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/no-healthcheck.md b/versioned_docs/version-5.5.0/source/markdown/options/no-healthcheck.md new file mode 100644 index 000000000..9bc927672 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/no-healthcheck.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-healthcheck** + +Disable any defined healthchecks for container. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/no-hostname.md b/versioned_docs/version-5.5.0/source/markdown/options/no-hostname.md new file mode 100644 index 000000000..bb3732697 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/no-hostname.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, create, farm build, kube play, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/no-hosts.md b/versioned_docs/version-5.5.0/source/markdown/options/no-hosts.md new file mode 100644 index 000000000..25432b39d --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/no-hosts.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, create, farm build, kube play, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the <>. + +Podman assumes control over the <>'s `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/no-reset.md b/versioned_docs/version-5.5.0/source/markdown/options/no-reset.md new file mode 100644 index 000000000..54899a244 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/no-reset.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman pod stats, stats +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-reset** + +Do not clear the terminal/screen in between reporting intervals diff --git a/versioned_docs/version-5.5.0/source/markdown/options/no-stream.md b/versioned_docs/version-5.5.0/source/markdown/options/no-stream.md new file mode 100644 index 000000000..037ec5d98 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/no-stream.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman pod stats, stats +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-stream** + +Disable streaming <<|pod >>stats and only pull the first result, default setting is false diff --git a/versioned_docs/version-5.5.0/source/markdown/options/no-trunc.md b/versioned_docs/version-5.5.0/source/markdown/options/no-trunc.md new file mode 100644 index 000000000..f79b85a2e --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/no-trunc.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman artifact ls, images +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-trunc** + +Do not truncate the output (default *false*). diff --git a/versioned_docs/version-5.5.0/source/markdown/options/noheading.md b/versioned_docs/version-5.5.0/source/markdown/options/noheading.md new file mode 100644 index 000000000..a60a14772 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/noheading.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman artifact ls, image trust, images, machine list, network ls, pod ps, secret ls, volume ls +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--noheading**, **-n** + +Omit the table headings from the listing. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/omit-history.md b/versioned_docs/version-5.5.0/source/markdown/options/omit-history.md new file mode 100644 index 000000000..fce691f2a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/omit-history.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--omit-history** + +Omit build history information in the built image. (default false). + +This option is useful for the cases where end users explicitly +want to set `--omit-history` to omit the optional `History` from +built images or when working with images built using build tools that +do not include `History` information in their images. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/oom-kill-disable.md b/versioned_docs/version-5.5.0/source/markdown/options/oom-kill-disable.md new file mode 100644 index 000000000..e6204d366 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/oom-kill-disable.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--oom-kill-disable** + +Whether to disable OOM Killer for the container or not. + +This flag is not supported on cgroups V2 systems. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/oom-score-adj.md b/versioned_docs/version-5.5.0/source/markdown/options/oom-score-adj.md new file mode 100644 index 000000000..9fc68a28a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/oom-score-adj.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--oom-score-adj**=*num* + +Tune the host's OOM preferences for containers (accepts values from **-1000** to **1000**). + +When running in rootless mode, the specified value can't be lower than +the oom_score_adj for the current process. In this case, the +oom-score-adj is clamped to the current process value. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/os-feature.md b/versioned_docs/version-5.5.0/source/markdown/options/os-feature.md new file mode 100644 index 000000000..1b4b7c136 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/os-feature.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os-feature**=*feature* + +Set the name of a required operating system *feature* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS feature list is kept, if the base image specified any. This option is typically only meaningful when the image's OS is Windows. + +If *feature* has a trailing `-`, then the *feature* is removed from the set of required features which is listed in the image. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/os-version.image.md b/versioned_docs/version-5.5.0/source/markdown/options/os-version.image.md new file mode 100644 index 000000000..05c9b406e --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/os-version.image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os-version**=*version* + +Set the exact required operating system *version* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS version is kept, if the base image specified one. This option is typically only meaningful when the image's OS is Windows, and is typically set in Windows base images, so using this option is usually unnecessary. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/os-version.md b/versioned_docs/version-5.5.0/source/markdown/options/os-version.md new file mode 100644 index 000000000..1db4b4701 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/os-version.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman manifest add, manifest annotate +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os-version**=*version* + +Specify the OS version which the list or index records as a requirement for the +image. This option is rarely used. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/os.md b/versioned_docs/version-5.5.0/source/markdown/options/os.md new file mode 100644 index 000000000..5871bbdce --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/os.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os**=*string* + +Set the OS of the image to be built, and that of the base image to be pulled, if the build uses one, instead of using the current operating system of the build host. Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/os.pull.md b/versioned_docs/version-5.5.0/source/markdown/options/os.pull.md new file mode 100644 index 000000000..4561d1ee7 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/os.pull.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os**=*OS* + +Override the OS, defaults to hosts, of the image to be pulled. For example, `windows`. +Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/passwd-entry.md b/versioned_docs/version-5.5.0/source/markdown/options/passwd-entry.md new file mode 100644 index 000000000..401465ce1 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/passwd-entry.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--passwd-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/passwd` file within the container when `--passwd` is used. + +The variables $USERNAME, $UID, $GID, $NAME, $HOME are automatically replaced with their value at runtime. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/personality.md b/versioned_docs/version-5.5.0/source/markdown/options/personality.md new file mode 100644 index 000000000..e0339dffe --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/personality.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--personality**=*persona* + +Personality sets the execution domain via Linux personality(2). diff --git a/versioned_docs/version-5.5.0/source/markdown/options/pid.container.md b/versioned_docs/version-5.5.0/source/markdown/options/pid.container.md new file mode 100644 index 000000000..2a2d27684 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/pid.container.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pid**=*mode* + +Set the PID namespace mode for the container. +The default is to create a private PID namespace for the container. + +- **container:**_id_: join another container's PID namespace; +- **host**: use the host's PID namespace for the container. Note the host mode gives the container full access to local PID and is therefore considered insecure; +- **ns:**_path_: join the specified PID namespace; +- **private**: create a new namespace for the container (default). diff --git a/versioned_docs/version-5.5.0/source/markdown/options/pid.image.md b/versioned_docs/version-5.5.0/source/markdown/options/pid.image.md new file mode 100644 index 000000000..9a2274b85 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/pid.image.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pid**=*pid* + +Sets the configuration for PID namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new PID namespace is created, or it can be "host" to indicate that the PID namespace in which `podman` itself is being run is reused, or it can be the path to a PID namespace which is already in use by another +process. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/pid.pod.md b/versioned_docs/version-5.5.0/source/markdown/options/pid.pod.md new file mode 100644 index 000000000..be48dfbc1 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/pid.pod.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pid**=*pid* + +Set the PID mode for the pod. The default is to create a private PID namespace for the pod. Requires the PID namespace to be shared via --share. + + host: use the host’s PID namespace for the pod + ns: join the specified PID namespace + private: create a new namespace for the pod (default) diff --git a/versioned_docs/version-5.5.0/source/markdown/options/pidfile.md b/versioned_docs/version-5.5.0/source/markdown/options/pidfile.md new file mode 100644 index 000000000..20ddf05b0 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/pidfile.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pidfile**=*path* + +When the pidfile location is specified, the container process' PID is written to the pidfile. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +If the pidfile option is not specified, the container process' PID is written to /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile. + +After the container is started, the location for the pidfile can be discovered with the following `podman inspect` command: + + $ podman inspect --format '{{ .PidFile }}' $CID + /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile diff --git a/versioned_docs/version-5.5.0/source/markdown/options/pids-limit.md b/versioned_docs/version-5.5.0/source/markdown/options/pids-limit.md new file mode 100644 index 000000000..d16b7880e --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/pids-limit.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pids-limit**=*limit* + +Tune the container's pids limit. Set to **-1** to have unlimited pids for the container. The default is **2048** on systems that support "pids" cgroup controller. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/platform.md b/versioned_docs/version-5.5.0/source/markdown/options/platform.md new file mode 100644 index 000000000..d320ba98c --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/platform.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with --arch and --os) +The `--platform` option can be used to override the current architecture and operating system. +Unless overridden, subsequent lookups of the same image in the local storage matches this platform, regardless of the host. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/pod-id-file.container.md b/versioned_docs/version-5.5.0/source/markdown/options/pod-id-file.container.md new file mode 100644 index 000000000..d3e7dbef6 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/pod-id-file.container.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pod-id-file**=*file* + +Run container in an existing pod and read the pod's ID from the specified *file*. +When a container is run within a pod which has an infra-container, the infra-container starts first. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/pod-id-file.pod.md b/versioned_docs/version-5.5.0/source/markdown/options/pod-id-file.pod.md new file mode 100644 index 000000000..7d80fe263 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/pod-id-file.pod.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman pod rm, pod start, pod stop +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pod-id-file**=*file* + +Read pod ID from the specified *file* and <> the pod. Can be specified multiple times. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/pod.run.md b/versioned_docs/version-5.5.0/source/markdown/options/pod.run.md new file mode 100644 index 000000000..3520deccb --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/pod.run.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pod**=*name* + +Run container in an existing pod. Podman makes the pod automatically if the pod name is prefixed with **new:**. +To make a pod with more granular options, use the **podman pod create** command before creating a container. +When a container is run with a pod with an infra-container, the infra-container is started first. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/preserve-fd.md b/versioned_docs/version-5.5.0/source/markdown/options/preserve-fd.md new file mode 100644 index 000000000..f02d8ca82 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/preserve-fd.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--preserve-fd**=*FD1[,FD2,...]* + +Pass down to the process the additional file descriptors specified in the comma separated list. It can be specified multiple times. +This option is only supported with the crun OCI runtime. It might be a security risk to use this option with other OCI runtimes. + +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.0/source/markdown/options/preserve-fds.md b/versioned_docs/version-5.5.0/source/markdown/options/preserve-fds.md new file mode 100644 index 000000000..8c76ed628 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/preserve-fds.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--preserve-fds**=*N* + +Pass down to the process N additional file descriptors (in addition to 0, 1, 2). +The total FDs are 3+N. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.0/source/markdown/options/privileged.md b/versioned_docs/version-5.5.0/source/markdown/options/privileged.md new file mode 100644 index 000000000..aa738f127 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/privileged.md @@ -0,0 +1,28 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--privileged** + +Give extended privileges to this container. The default is **false**. + +By default, Podman containers are unprivileged (**=false**) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read-only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. +Due to the disabled security features, the privileged field should almost never +be set as containers can easily break out of confinement. + +Containers running in a user namespace (e.g., rootless containers) cannot have +more privileges than the user that launched them. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/publish-all.md b/versioned_docs/version-5.5.0/source/markdown/options/publish-all.md new file mode 100644 index 000000000..4e5a4d200 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/publish-all.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--publish-all**, **-P** + +Publish all exposed ports to random ports on the host interfaces. The default is **false**. + +When set to **true**, publish all exposed ports to the host interfaces. +If the operator uses **-P** (or **-p**) then Podman makes the +exposed port accessible on the host and the ports are available to any +client that can reach the host. + +When using this option, Podman binds any exposed port to a random port on the host +within an ephemeral port range defined by */proc/sys/net/ipv4/ip_local_port_range*. +To find the mapping between the host ports and the exposed ports, use **podman port**. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/publish.md b/versioned_docs/version-5.5.0/source/markdown/options/publish.md new file mode 100644 index 000000000..ea042f443 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/publish.md @@ -0,0 +1,31 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--publish**, **-p**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Publish a container's port, or range of ports,<<| within this pod>> to the host. + +Both *hostPort* and *containerPort* can be specified as a range of ports. +When specifying ranges for both, the number of container ports in the +range must match the number of host ports in the range. + +If host IP is set to 0.0.0.0 or not set at all, the port is bound on all IPs on the host. + +By default, Podman publishes TCP ports. To publish a UDP port instead, give +`udp` as protocol. To publish both TCP and UDP ports, set `--publish` twice, +with `tcp`, and `udp` as protocols respectively. Rootful containers can also +publish ports using the `sctp` protocol. + +Host port does not have to be specified (e.g. `podman run -p 127.0.0.1::80`). +If it is not, the container port is randomly assigned a port on the host. + +Use **podman port** to see the actual mapping: `podman port $CONTAINER $CONTAINERPORT`. + +Note that the network drivers `macvlan` and `ipvlan` do not support port forwarding, +therefore this option will have no effect on such networks. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/pull.image.md b/versioned_docs/version-5.5.0/source/markdown/options/pull.image.md new file mode 100644 index 000000000..af83d8b21 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/pull.image.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Only pull the image when it does not exist in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error when no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/pull.md b/versioned_docs/version-5.5.0/source/markdown/options/pull.md new file mode 100644 index 000000000..b04ba1ceb --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/pull.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Pull the image only when the image is not in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error if no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/quiet.md b/versioned_docs/version-5.5.0/source/markdown/options/quiet.md new file mode 100644 index 000000000..e785aec26 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/quiet.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--quiet**, **-q** + +Suppress output messages which indicate which instruction is being processed, and of progress when pulling images from a registry, and when writing the output image. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/rdt-class.md b/versioned_docs/version-5.5.0/source/markdown/options/rdt-class.md new file mode 100644 index 000000000..b84857bd4 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/rdt-class.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--rdt-class**=*intel-rdt-class-of-service* + +Rdt-class sets the class of service (CLOS or COS) for the container to run in. Based on the Cache Allocation Technology (CAT) feature that is part of Intel's Resource Director Technology (RDT) feature set, all container processes will run within the pre-configured COS, representing a part of the cache. The COS has to be created and configured using a pseudo file system (usually mounted at `/sys/fs/resctrl`) that the resctrl kernel driver provides. Assigning the container to a COS requires root privileges and thus doesn't work in a rootless environment. Currently, the feature is only supported using `runc` as a runtime. See for more details on creating a COS before a container can be assigned to it. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/read-only-tmpfs.md b/versioned_docs/version-5.5.0/source/markdown/options/read-only-tmpfs.md new file mode 100644 index 000000000..f2de431f8 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/read-only-tmpfs.md @@ -0,0 +1,31 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--read-only-tmpfs** + +When running --read-only containers, mount a read-write tmpfs on _/dev_, _/dev/shm_, _/run_, _/tmp_, and _/var/tmp_. The default is **true**. + +| --read-only | --read-only-tmpfs | / | /run, /tmp, /var/tmp| +| ----------- | ----------------- | ---- | ----------------------------------- | +| true | true | r/o | r/w | +| true | false | r/o | r/o | +| false | false | r/w | r/w | +| false | true | r/w | r/w | + +When **--read-only=true** and **--read-only-tmpfs=true** additional tmpfs are mounted on +the /tmp, /run, and /var/tmp directories. + +When **--read-only=true** and **--read-only-tmpfs=false** /dev and /dev/shm are marked +Read/Only and no tmpfs are mounted on /tmp, /run and /var/tmp. The directories +are exposed from the underlying image, meaning they are read-only by default. +This makes the container totally read-only. No writable directories exist within +the container. In this mode writable directories need to be added via external +volumes or mounts. + +By default, when **--read-only=false**, the /dev and /dev/shm are read/write, and the /tmp, /run, and /var/tmp are read/write directories from the container image. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/read-only.md b/versioned_docs/version-5.5.0/source/markdown/options/read-only.md new file mode 100644 index 000000000..848af967b --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/read-only.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--read-only** + +Mount the container's root filesystem as read-only. + +By default, container root filesystems are writable, allowing processes +to write files anywhere. By specifying the **--read-only** flag, the containers root filesystem are mounted read-only prohibiting any writes. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/replace.md b/versioned_docs/version-5.5.0/source/markdown/options/replace.md new file mode 100644 index 000000000..c70b194ff --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/replace.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--replace** + +If another <> with the same name already exists, replace and remove it. The default is **false**. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/requires.md b/versioned_docs/version-5.5.0/source/markdown/options/requires.md new file mode 100644 index 000000000..8f33711f5 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/requires.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--requires**=*container* + +Specify one or more requirements. +A requirement is a dependency container that is started before this container. +Containers can be specified by name or ID, with multiple containers being separated by commas. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/restart.md b/versioned_docs/version-5.5.0/source/markdown/options/restart.md new file mode 100644 index 000000000..b7421fcc5 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/restart.md @@ -0,0 +1,27 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). diff --git a/versioned_docs/version-5.5.0/source/markdown/options/retry-delay.md b/versioned_docs/version-5.5.0/source/markdown/options/retry-delay.md new file mode 100644 index 000000000..14c51a973 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/retry-delay.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, build, create, farm build, pull, push, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/retry.md b/versioned_docs/version-5.5.0/source/markdown/options/retry.md new file mode 100644 index 000000000..0a0f9ae90 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/retry.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, build, create, farm build, pull, push, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/rm.md b/versioned_docs/version-5.5.0/source/markdown/options/rm.md new file mode 100644 index 000000000..435bce944 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/rm.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--rm** + +Remove intermediate containers after a successful build (default true). diff --git a/versioned_docs/version-5.5.0/source/markdown/options/rootfs.md b/versioned_docs/version-5.5.0/source/markdown/options/rootfs.md new file mode 100644 index 000000000..595a39d77 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/rootfs.md @@ -0,0 +1,39 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--rootfs** + +If specified, the first argument refers to an exploded container on the file system. + +This is useful to run a container without requiring any image management, the rootfs +of the container is assumed to be managed externally. + + `Overlay Rootfs Mounts` + + The `\:O` flag tells Podman to mount the directory from the rootfs path as +storage using the `overlay file system`. The container processes +can modify content within the mount point which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +Note: On **SELinux** systems, the rootfs needs the correct label, which is by default +**unconfined_u:object_r:container_file_t\\:s0**. + + `idmap` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. +The idmap option supports a custom mapping that can be different than the user +namespace used by the container. The mapping can be specified after the idmap +option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the +first value is the start of the backing file system IDs that are mapped to the +second value on the host. The length of this mapping is given in the third value. +Multiple ranges are separated with #. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/runtime-flag.md b/versioned_docs/version-5.5.0/source/markdown/options/runtime-flag.md new file mode 100644 index 000000000..6cab9d5c2 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/runtime-flag.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--runtime-flag**=*flag* + +Adds global flags for the container runtime. To list the supported flags, please consult the manpages of the selected container runtime. + +Note: Do not pass the leading -- to the flag. To pass the runc flag --log-format json to buildah build, the option given is --runtime-flag log-format=json. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/runtime.md b/versioned_docs/version-5.5.0/source/markdown/options/runtime.md new file mode 100644 index 000000000..47c691aa8 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/runtime.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--runtime**=*path* + +The *path* to an alternate OCI-compatible runtime, which is used to run +commands specified by the **RUN** instruction. + +Note: You can also override the default runtime by setting the BUILDAH\_RUNTIME environment variable. `export BUILDAH_RUNTIME=/usr/local/bin/runc` diff --git a/versioned_docs/version-5.5.0/source/markdown/options/sbom-image-output.md b/versioned_docs/version-5.5.0/source/markdown/options/sbom-image-output.md new file mode 100644 index 000000000..f9cd04ba0 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/sbom-image-output.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-image-output**=*path* + +When generating SBOMs, store the generated SBOM in the specified path in the +output image. There is no default. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/sbom-image-purl-output.md b/versioned_docs/version-5.5.0/source/markdown/options/sbom-image-purl-output.md new file mode 100644 index 000000000..8e1d7ef37 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/sbom-image-purl-output.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-image-purl-output**=*path* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the specified path in the output +image. There is no default. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/sbom-merge-strategy.md b/versioned_docs/version-5.5.0/source/markdown/options/sbom-merge-strategy.md new file mode 100644 index 000000000..2da1380b6 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/sbom-merge-strategy.md @@ -0,0 +1,29 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-merge-strategy**=*method* + +If more than one **--sbom-scanner-command** value is being used, use the +specified method to merge the output from later commands with output from +earlier commands. Recognized values include: + + - cat + Concatenate the files. + - merge-cyclonedx-by-component-name-and-version + Merge the "component" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "version" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + - merge-spdx-by-package-name-and-versioninfo + Merge the "package" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "versionInfo" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/sbom-output.md b/versioned_docs/version-5.5.0/source/markdown/options/sbom-output.md new file mode 100644 index 000000000..4fba8bcd5 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/sbom-output.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-output**=*file* + +When generating SBOMs, store the generated SBOM in the named file on the local +filesystem. There is no default. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/sbom-purl-output.md b/versioned_docs/version-5.5.0/source/markdown/options/sbom-purl-output.md new file mode 100644 index 000000000..3899a9051 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/sbom-purl-output.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-purl-output**=*file* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the named file in the local +filesystem. There is no default. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/sbom-scanner-command.md b/versioned_docs/version-5.5.0/source/markdown/options/sbom-scanner-command.md new file mode 100644 index 000000000..23a86ee8d --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/sbom-scanner-command.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-scanner-command**=*image* + +Generate SBOMs by running the specified command from the scanner image. If +multiple commands are specified, they are run in the order in which they are +specified. These text substitutions are performed: + - {ROOTFS} + The root of the built image's filesystem, bind mounted. + - {CONTEXT} + The build context and additional build contexts, bind mounted. + - {OUTPUT} + The name of a temporary output file, to be read and merged with others or copied elsewhere. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/sbom-scanner-image.md b/versioned_docs/version-5.5.0/source/markdown/options/sbom-scanner-image.md new file mode 100644 index 000000000..bb7587333 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/sbom-scanner-image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-scanner-image**=*image* + +Generate SBOMs using the specified scanner image. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/sbom.md b/versioned_docs/version-5.5.0/source/markdown/options/sbom.md new file mode 100644 index 000000000..ca1d9dcd4 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/sbom.md @@ -0,0 +1,38 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom**=*preset* + +Generate SBOMs (Software Bills Of Materials) for the output image by scanning +the working container and build contexts using the named combination of scanner +image, scanner commands, and merge strategy. Must be specified with one or +more of **--sbom-image-output**, **--sbom-image-purl-output**, **--sbom-output**, +and **--sbom-purl-output**. Recognized presets, and the set of options which +they equate to: + + - "syft", "syft-cyclonedx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output cyclonedx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output cyclonedx-json={OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "syft-spdx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output spdx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output spdx-json={OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + - "trivy", "trivy-cyclonedx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "trivy-spdx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo diff --git a/versioned_docs/version-5.5.0/source/markdown/options/sdnotify.md b/versioned_docs/version-5.5.0/source/markdown/options/sdnotify.md new file mode 100644 index 000000000..5e4156d5f --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/sdnotify.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sdnotify**=**container** | *conmon* | *healthy* | *ignore* + +Determines how to use the NOTIFY_SOCKET, as passed with systemd and Type=notify. + +Default is **container**, which means allow the OCI runtime to proxy the socket into the +container to receive ready notification. Podman sets the MAINPID to conmon's pid. +The **conmon** option sets MAINPID to conmon's pid, and sends READY when the container +has started. The socket is never passed to the runtime or the container. +The **healthy** option sets MAINPID to conmon's pid, and sends READY when the container +has turned healthy; requires a healthcheck to be set. The socket is never passed to the runtime or the container. +The **ignore** option removes NOTIFY_SOCKET from the environment for itself and child processes, +for the case where some other process above Podman uses NOTIFY_SOCKET and Podman does not use it. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/seccomp-policy.md b/versioned_docs/version-5.5.0/source/markdown/options/seccomp-policy.md new file mode 100644 index 000000000..12424e1d6 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/seccomp-policy.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--seccomp-policy**=*policy* + +Specify the policy to select the seccomp profile. If set to *image*, Podman looks for a "io.containers.seccomp.profile" label in the container-image config and use its value as a seccomp profile. Otherwise, Podman follows the *default* policy by applying the default profile unless specified otherwise via *--security-opt seccomp* as described below. + +Note that this feature is experimental and may change in the future. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/secret.image.md b/versioned_docs/version-5.5.0/source/markdown/options/secret.image.md new file mode 100644 index 000000000..18010614a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/secret.image.md @@ -0,0 +1,28 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--secret**=**id=id[,src=*envOrFile*][,env=*ENV*][,type=*file* | *env*]** + +Pass secret information to be used in the Containerfile for building images +in a safe way that will not end up stored in the final image, or be seen in other stages. +The value of the secret will be read from an environment variable or file named +by the "id" option, or named by the "src" option if it is specified, or from an +environment variable specified by the "env" option. See [EXAMPLES](#examples). +The secret will be mounted in the container at `/run/secrets/id` by default. + +To later use the secret, use the --mount flag in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret` + +The location of the secret in the container can be overridden using the +"target", "dst", or "destination" option of the `RUN --mount` flag. + +`RUN --mount=type=secret,id=mysecret,target=/run/secrets/myothersecret cat /run/secrets/myothersecret` + +Note: changing the contents of secret files will not trigger a rebuild of layers that use said secrets. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/secret.md b/versioned_docs/version-5.5.0/source/markdown/options/secret.md new file mode 100644 index 000000000..c5e61677c --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/secret.md @@ -0,0 +1,59 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--secret**=*secret[,opt=opt ...]* + +Give the container access to a secret. Can be specified multiple times. + +A secret is a blob of sensitive data which a container needs at runtime but +is not stored in the image or in source control, such as usernames and passwords, +TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 512 kB in size). + +When secrets are specified as type `mount`, the secrets are copied and mounted into the container when a container is created. +When secrets are specified as type `env`, the secret is set as an environment variable within the container. +Secrets are written in the container at the time of container creation, and modifying the secret using `podman secret` commands +after the container is created affects the secret inside the container. + +Secrets and its storage are managed using the `podman secret` command. + +Secret Options + +- `type=mount|env` : How the secret is exposed to the container. + `mount` mounts the secret into the container as a file. + `env` exposes the secret as an environment variable. + Defaults to `mount`. +- `target=target` : Target of secret. + For mounted secrets, this is the path to the secret inside the container. + If a fully qualified path is provided, the secret is mounted at that location. + Otherwise, the secret is mounted to + `/run/secrets/target` for Linux containers or + `/var/run/secrets/target` for FreeBSD containers. + If the target is not set, the secret is mounted to `/run/secrets/secretname` by default. + For env secrets, this is the environment variable key. Defaults to `secretname`. +- `uid=0` : UID of secret. Defaults to 0. Mount secret type only. +- `gid=0` : GID of secret. Defaults to 0. Mount secret type only. +- `mode=0` : Mode of secret. Defaults to 0444. Mount secret type only. + + +Examples + +Mount at `/my/location/mysecret` with UID 1: +``` +--secret mysecret,target=/my/location/mysecret,uid=1 +``` + +Mount at `/run/secrets/customtarget` with mode 0777: +``` +--secret mysecret,target=customtarget,mode=0777 +``` + +Create a secret environment variable called `ENVSEC`: +``` +--secret mysecret,type=env,target=ENVSEC +``` diff --git a/versioned_docs/version-5.5.0/source/markdown/options/security-opt.image.md b/versioned_docs/version-5.5.0/source/markdown/options/security-opt.image.md new file mode 100644 index 000000000..8b11545ae --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/security-opt.image.md @@ -0,0 +1,27 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--security-opt**=*option* + +Security Options + +- `apparmor=unconfined` : Turn off apparmor confinement for the container +- `apparmor=alternate-profile` : Set the apparmor confinement profile for the +container + +- `label=user:USER` : Set the label user for the container processes +- `label=role:ROLE` : Set the label role for the container processes +- `label=type:TYPE` : Set the label process type for the container processes +- `label=level:LEVEL` : Set the label level for the container processes +- `label=filetype:TYPE` : Set the label file type for the container files +- `label=disable` : Turn off label separation for the container +- `no-new-privileges` : Disable container processes from gaining additional privileges + +- `seccomp=unconfined` : Turn off seccomp confinement for the container +- `seccomp=profile.json` : JSON file to be used as the seccomp filter for the container. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/security-opt.md b/versioned_docs/version-5.5.0/source/markdown/options/security-opt.md new file mode 100644 index 000000000..739157b3f --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/security-opt.md @@ -0,0 +1,41 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the <> +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the <> + +- **label=user:**_USER_: Set the label user for the <> processes +- **label=role:**_ROLE_: Set the label role for the <> processes +- **label=type:**_TYPE_: Set the label process type for the <> processes +- **label=level:**_LEVEL_: Set the label level for the <> processes +- **label=filetype:**_TYPE_: Set the label file type for the <> files +- **label=disable**: Turn off label separation for the <> + +Note: Labeling can be disabled for all <<|pods/>>containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the container<>. + +- **no-new-privileges**: Disable container processes from gaining additional privileges through the `execve(2)` system call (e.g. via setuid or setgid bits, or via file capabilities). Programs that rely on setuid/setgid bits set on their executable to change user id or group id are no longer able to do so, and any file capabilities added to the executable (e.g. via `setcap`) are not added to the permitted capability set. For more details, see: https://docs.kernel.org/userspace-api/no_new_privs.html. + +- **seccomp=unconfined**: Turn off seccomp confinement for the <>. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/shm-size-systemd.md b/versioned_docs/version-5.5.0/source/markdown/options/shm-size-systemd.md new file mode 100644 index 000000000..3665cd35d --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/shm-size-systemd.md @@ -0,0 +1,15 @@ +--- +title: of +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/shm-size.md b/versioned_docs/version-5.5.0/source/markdown/options/shm-size.md new file mode 100644 index 000000000..384b38892 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/shm-size.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, create, farm build, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the <>. +This option conflicts with **--ipc=host**. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/sig-proxy.md b/versioned_docs/version-5.5.0/source/markdown/options/sig-proxy.md new file mode 100644 index 000000000..3e37808dd --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/sig-proxy.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman attach, run, start +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sig-proxy** + +Proxy received signals to the container process. SIGCHLD, SIGURG, SIGSTOP, and SIGKILL are not proxied. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/sign-by-sigstore.md b/versioned_docs/version-5.5.0/source/markdown/options/sign-by-sigstore.md new file mode 100644 index 000000000..dc564ef53 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/sign-by-sigstore.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman artifact push, manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sign-by-sigstore**=*param-file* + +Add a sigstore signature based on further options specified in a container's sigstore signing parameter file *param-file*. +See containers-sigstore-signing-params.yaml(5) for details about the file format. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/sign-passphrase-file.md b/versioned_docs/version-5.5.0/source/markdown/options/sign-passphrase-file.md new file mode 100644 index 000000000..2de189728 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/sign-passphrase-file.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman artifact push, manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sign-passphrase-file**=*path* + +If signing the image (using either **--sign-by** or **--sign-by-sigstore-private-key**), read the passphrase to use from the specified path. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/signal.md b/versioned_docs/version-5.5.0/source/markdown/options/signal.md new file mode 100644 index 000000000..f56021bec --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/signal.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman kill, pod kill +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--signal**, **-s**=**signal** + +Signal to send to the container<<|s in the pod>>. For more information on Linux signals, refer to *signal(7)*. +The default is **SIGKILL**. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/since.md b/versioned_docs/version-5.5.0/source/markdown/options/since.md new file mode 100644 index 000000000..36522467d --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/since.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--since**=*TIMESTAMP* + +Show logs since TIMESTAMP. The --since option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/skip-unused-stages.md b/versioned_docs/version-5.5.0/source/markdown/options/skip-unused-stages.md new file mode 100644 index 000000000..4a1ce6837 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/skip-unused-stages.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--skip-unused-stages** + +Skip stages in multi-stage builds which don't affect the target stage. (Default: **true**). diff --git a/versioned_docs/version-5.5.0/source/markdown/options/squash-all.md b/versioned_docs/version-5.5.0/source/markdown/options/squash-all.md new file mode 100644 index 000000000..b24df1bdd --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/squash-all.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--squash-all** + +Squash all of the new image's layers (including those inherited from a base image) into a single new layer. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/squash.md b/versioned_docs/version-5.5.0/source/markdown/options/squash.md new file mode 100644 index 000000000..1fd0beaff --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/squash.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--squash** + +Squash all of the image's new layers into a single new layer; any preexisting layers are not squashed. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/ssh.md b/versioned_docs/version-5.5.0/source/markdown/options/ssh.md new file mode 100644 index 000000000..acbfaf123 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/ssh.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ssh**=*default* | *id[=socket>* + +SSH agent socket or keys to expose to the build. +The socket path can be left empty to use the value of `default=$SSH_AUTH_SOCK` + +To later use the ssh agent, use the --mount option in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=ssh,id=id mycmd` diff --git a/versioned_docs/version-5.5.0/source/markdown/options/stop-signal.md b/versioned_docs/version-5.5.0/source/markdown/options/stop-signal.md new file mode 100644 index 000000000..19d4a0df6 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/stop-signal.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--stop-signal**=*signal* + +Signal to stop a container. Default is **SIGTERM**. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/stop-timeout.md b/versioned_docs/version-5.5.0/source/markdown/options/stop-timeout.md new file mode 100644 index 000000000..8e1e53c28 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/stop-timeout.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--stop-timeout**=*seconds* + +Timeout to stop a container. Default is **10**. +Remote connections use local containers.conf for defaults. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/subgidname.md b/versioned_docs/version-5.5.0/source/markdown/options/subgidname.md new file mode 100644 index 000000000..7afdc5625 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/subgidname.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/subuidname.md b/versioned_docs/version-5.5.0/source/markdown/options/subuidname.md new file mode 100644 index 000000000..760ee2834 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/subuidname.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/sysctl.md b/versioned_docs/version-5.5.0/source/markdown/options/sysctl.md new file mode 100644 index 000000000..c5f105b36 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/sysctl.md @@ -0,0 +1,30 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters <>. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: <>, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: <>, the above sysctls are not allowed. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/systemd.md b/versioned_docs/version-5.5.0/source/markdown/options/systemd.md new file mode 100644 index 000000000..d23584d51 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/systemd.md @@ -0,0 +1,42 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--systemd**=*true* | *false* | *always* + +Run container in systemd mode. The default is **true**. + +- **true** enables systemd mode only when the command executed inside the container is *systemd*, */usr/sbin/init*, +*/sbin/init* or */usr/local/sbin/init*. + +- **false** disables systemd mode. + +- **always** enforces the systemd mode to be enabled. + +Running the container in systemd mode causes the following changes: + +* Podman mounts tmpfs file systems on the following directories + * _/run_ + * _/run/lock_ + * _/tmp_ + * _/sys/fs/cgroup/systemd_ (on a cgroup v1 system) + * _/var/lib/journal_ +* Podman sets the default stop signal to **SIGRTMIN+3**. +* Podman sets **container_uuid** environment variable in the container to the +first 32 characters of the container ID. +* Podman does not mount virtual consoles (_/dev/tty\d+_) when running with **--privileged**. +* On cgroup v2, */sys/fs/cgroup* is mounted writable. + +This allows systemd to run in a confined container without any modifications. + +Note that on **SELinux** systems, systemd attempts to write to the cgroup +file system. Containers writing to the cgroup file system are denied by default. +The **container_manage_cgroup** boolean must be enabled for this to be allowed on an SELinux separated system. +``` +setsebool -P container_manage_cgroup true +``` diff --git a/versioned_docs/version-5.5.0/source/markdown/options/tag.md b/versioned_docs/version-5.5.0/source/markdown/options/tag.md new file mode 100644 index 000000000..06a24392a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/tag.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tag**, **-t**=*imageName* + +Specifies the name which is assigned to the resulting image if the build process completes successfully. +If _imageName_ does not include a registry name, the registry name *localhost* is prepended to the image name. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/tail.md b/versioned_docs/version-5.5.0/source/markdown/options/tail.md new file mode 100644 index 000000000..23200e9da --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/tail.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tail**=*LINES* + +Output the specified number of LINES at the end of the logs. LINES must be an integer. Defaults to -1, +which prints all lines diff --git a/versioned_docs/version-5.5.0/source/markdown/options/target.md b/versioned_docs/version-5.5.0/source/markdown/options/target.md new file mode 100644 index 000000000..f30c1b968 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/target.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--target**=*stageName* + +Set the target build stage to build. When building a Containerfile with multiple build stages, --target can be used to specify an intermediate build stage by name as the final stage for the resulting image. Commands after the target stage is skipped. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/time.md b/versioned_docs/version-5.5.0/source/markdown/options/time.md new file mode 100644 index 000000000..c64fe0eed --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/time.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman pod rm, pod stop, restart, rm, stop +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping <>. +Use -1 for infinite wait. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/timeout.md b/versioned_docs/version-5.5.0/source/markdown/options/timeout.md new file mode 100644 index 000000000..2f3efd45a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/timeout.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--timeout**=*seconds* + +Maximum time a container is allowed to run before conmon sends it the kill +signal. By default containers run until they exit or are stopped by +`podman stop`. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/timestamp.md b/versioned_docs/version-5.5.0/source/markdown/options/timestamp.md new file mode 100644 index 000000000..0f0a33a11 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/timestamp.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--timestamp**=*seconds* + +Set the create timestamp to seconds since epoch to allow for deterministic builds (defaults to current time). By default, the created timestamp is changed and written into the image manifest with every commit, causing the image's sha256 hash to be different even if the sources are exactly the same otherwise. +When --timestamp is set, the created timestamp is always set to the time specified and therefore not changed, allowing the image's sha256 hash to remain the same. All files committed to the layers of the image is created with the timestamp. + +If the only instruction in a Containerfile is `FROM`, this flag has no effect. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/timestamps.md b/versioned_docs/version-5.5.0/source/markdown/options/timestamps.md new file mode 100644 index 000000000..7254765a6 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/timestamps.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--timestamps**, **-t** + +Show timestamps in the log outputs. The default is false diff --git a/versioned_docs/version-5.5.0/source/markdown/options/tls-verify.md b/versioned_docs/version-5.5.0/source/markdown/options/tls-verify.md new file mode 100644 index 000000000..597bacc27 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/tls-verify.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, auto update, build, container runlabel, create, farm build, kube play, login, manifest add, manifest create, manifest inspect, manifest push, pull, push, run, search +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/options/tmpfs.md b/versioned_docs/version-5.5.0/source/markdown/options/tmpfs.md new file mode 100644 index 000000000..14c380215 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/tmpfs.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tmpfs**=*fs* + +Create a tmpfs mount. + +Mount a temporary filesystem (**tmpfs**) mount into a container, for example: + +``` +$ podman <> -d --tmpfs /tmp\:rw,size=787448k,mode=1777 my_image +``` + +This command mounts a **tmpfs** at _/tmp_ within the container. The supported mount +options are the same as the Linux default mount flags. If no options are specified, +the system uses the following options: +**rw,noexec,nosuid,nodev**. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/tty.md b/versioned_docs/version-5.5.0/source/markdown/options/tty.md new file mode 100644 index 000000000..1b59ad5fc --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/tty.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tty**, **-t** + +Allocate a pseudo-TTY. The default is **false**. + +When set to **true**, Podman allocates a pseudo-tty and attach to the standard +input of the container. This can be used, for example, to run a throwaway +interactive shell. + +**NOTE**: The --tty flag prevents redirection of standard output. It combines STDOUT and STDERR, it can insert control characters, and it can hang pipes. This option is only used when run interactively in a terminal. When feeding input to Podman, use -i only, not -it. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/tz.md b/versioned_docs/version-5.5.0/source/markdown/options/tz.md new file mode 100644 index 000000000..5afe3256b --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/tz.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tz**=*timezone* + +Set timezone in container. This flag takes area-based timezones, GMT time, as well as `local`, which sets the timezone in the container to match the host machine. See `/usr/share/zoneinfo/` for valid timezones. +Remote connections use local containers.conf for defaults diff --git a/versioned_docs/version-5.5.0/source/markdown/options/uidmap.container.md b/versioned_docs/version-5.5.0/source/markdown/options/uidmap.container.md new file mode 100644 index 000000000..a9aa3a5f2 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/uidmap.container.md @@ -0,0 +1,201 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uidmap**=*[flags]container_uid\:from_uid[\\:amount]* + +Run the container in a new user namespace using the supplied UID mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +The possible values of the optional *flags* are discussed further down on this page. +The *amount* value is optional and assumed to be **1** if not given. + +The *from_uid* value is based upon the user running the command, either rootful or rootless users. + +* rootful user: [*flags*]*container_uid*:*host_uid*[:*amount*] +* rootless user: [*flags*]*container_uid*:*intermediate_uid*[:*amount*] + + `Rootful mappings` + + +When **podman <>** is called by a privileged user, the option **--uidmap** +works as a direct mapping between host UIDs and container UIDs. + +host UID -> container UID + +The _amount_ specifies the number of consecutive UIDs that is mapped. +If for example _amount_ is **4** the mapping looks like: + +| host UID | container UID | +| ---------- | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | + + `Rootless mappings` + +When **podman <>** is called by an unprivileged user (i.e. running rootless), +the value *from_uid* is interpreted as an "intermediate UID". In the rootless +case, host UIDs are not mapped directly to container UIDs. Instead the mapping +happens over two mapping steps: + +host UID -> intermediate UID -> container UID + +The **--uidmap** option only influences the second mapping step. + +The first mapping step is derived by Podman from the contents of the file +_/etc/subuid_ and the UID of the user calling Podman. + +First mapping step: + +| host UID | intermediate UID | +| -------- | ---------------- | +| UID for Podman user | 0 | +| 1st subordinate UID | 1 | +| 2nd subordinate UID | 2 | +| 3rd subordinate UID | 3 | +| nth subordinate UID | n | + +To be able to use intermediate UIDs greater than zero, the user needs to have +subordinate UIDs configured in _/etc/subuid_. See **subuid**(5). + +The second mapping step is configured with **--uidmap**. + +If for example _amount_ is **5** the second mapping step looks like: + +| intermediate UID | container UID | +| ------------------ | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | +| *from_uid* + 4 | *container_uid* + 4 | + +When running as rootless, Podman uses all the ranges configured in the _/etc/subuid_ file. + +The current user ID is mapped to UID=0 in the rootless user namespace. +Every additional range is added sequentially afterward: + +| host | rootless user namespace | length | +| ------ | ----------------------- | ------ | +| $UID | 0 | 1 | +| 1 | $FIRST_RANGE_ID | $FIRST_RANGE_LENGTH | +| 1+$FIRST_RANGE_LENGTH | $SECOND_RANGE_ID | $SECOND_RANGE_LENGTH| + + `Referencing a host ID from the parent namespace` + +As a rootless user, the given host ID in **--uidmap** or **--gidmap** +is mapped from the *intermediate namespace* generated by Podman. Sometimes +it is desirable to refer directly at the *host namespace*. It is possible +to manually do so, by running `podman unshare cat /proc/self/gid_map`, +finding the desired host id at the second column of the output, and getting +the corresponding intermediate id from the first column. + +Podman can perform all that by preceding the host id in the mapping +with the `@` symbol. For instance, by specifying `--gidmap 100000:@2000:1`, +podman will look up the intermediate id corresponding to host id `2000` and +it will map the found intermediate id to the container id `100000`. The +given host id must have been subordinated (otherwise it would not be mapped +into the intermediate space in the first place). + +If the length is greater than one, for instance with `--gidmap 100000:@2000:2`, +Podman will map host ids `2000` and `2001` to `100000` and `100001`, respectively, +regardless of how the intermediate mapping is defined. + + `Extending previous mappings` + +Some mapping modifications may be cumbersome. For instance, a user +starts with a mapping such as `--gidmap="0:0:65000"`, that needs to be +changed such as the parent id `1000` is mapped to container id `100000` +instead, leaving container id `1` unassigned. The corresponding `--gidmap` +becomes `--gidmap="0:0:1" --gidmap="2:2:65534" --gidmap="100000:1:1"`. + +This notation can be simplified using the `+` flag, that takes care of +breaking previous mappings removing any conflicting assignment with +the given mapping. The flag is given before the container id +as follows: `--gidmap="0:0:65000" --gidmap="+100000:1:1"` + + + Flag | Example | Description +-----------|---------------|------------- + `+` | `+100000:1:1` | Extend the previous mapping + +This notation leads to gaps in the assignment, so it may be convenient to +fill those gaps afterwards: `--gidmap="0:0:65000" --gidmap="+100000:1:1" --gidmap="1:65001:1"` + +One specific use case for this flag is in the context of rootless +users. A rootless user may specify mappings with the `+` flag as +in `--gidmap="+100000:1:1"`. Podman will then "fill the gaps" starting +from zero with all the remaining intermediate ids. This is convenient when +a user wants to map a specific intermediate id to a container id, leaving +the rest of subordinate ids to be mapped by Podman at will. + + `Passing only one of --uidmap or --gidmap` + +Usually, subordinated user and group ids are assigned simultaneously, and +for any user the subordinated user ids match the subordinated group ids. +For convenience, if only one of **--uidmap** or **--gidmap** is given, +podman assumes the mapping refers to both UIDs and GIDs and applies the +given mapping to both. If only one value of the two needs to be changed, +the mappings should include the `u` or the `g` flags to specify that +they only apply to UIDs or GIDs and should not be copied over. + + flag | Example | Description +---------|-----------------|----------------- + `u` | `u20000:2000:1` |The mapping only applies to UIDs + `g` | `g10000:1000:1` |The mapping only applies to GIDs + +For instance given the command + + podman <> --gidmap "0:0:1000" --gidmap "g2000:2000:1" + +Since no **--uidmap** is given, the **--gidmap** is copied to **--uidmap**, +giving a command equivalent to + + podman <> --gidmap "0:0:1000" --gidmap "2000:2000:1" --uidmap "0:0:1000" + +The `--gidmap "g2000:2000:1"` used the `g` flag and therefore it was +not copied to **--uidmap**. + + `Rootless mapping of additional host GIDs` + +A rootless user may desire to map a specific host group that has already been +subordinated within _/etc/subgid_ without specifying the rest of the mapping. + +This can be done with **--gidmap "+g*container_gid*:@*host_gid*"** + +Where: + +- The host GID is given through the `@` symbol +- The mapping of this GID is not copied over to **--usermap** thanks to the `g` flag. +- The rest of the container IDs will be mapped starting from 0 to n, + with all the remaining subordinated GIDs, thanks to the `+` flag. + +For instance, if a user belongs to the group `2000` and that group is +subordinated to that user (with `usermod --add-subgids 2000-2000 $USER`), +the user can map the group into the container with: **--gidmap=+g100000:@2000**. + +If this mapping is combined with the option, **--group-add=keep-groups**, the +process in the container will belong to group `100000`, and files belonging +to group `2000` in the host will appear as being owned by group `100000` +inside the container. + + podman run --group-add=keep-groups --gidmap="+g100000:@2000" ... + + `No subordinate UIDs` + +Even if a user does not have any subordinate UIDs in _/etc/subuid_, +**--uidmap** can be used to map the normal UID of the user to a +container UID by running `podman <> --uidmap $container_uid:0:1 --user $container_uid ...`. + + `Pods` + +The **--uidmap** option cannot be called in conjunction with the **--pod** option as a uidmap cannot be set on the container level when in a pod. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/uidmap.pod.md b/versioned_docs/version-5.5.0/source/markdown/options/uidmap.pod.md new file mode 100644 index 000000000..720addc63 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/uidmap.pod.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uidmap**=*container_uid\:from_uid\\:amount* + +Run all containers in the pod in a new user namespace using the supplied mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/ulimit.image.md b/versioned_docs/version-5.5.0/source/markdown/options/ulimit.image.md new file mode 100644 index 000000000..1d05ad034 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/ulimit.image.md @@ -0,0 +1,27 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ulimit**=*type=soft-limit[\\:hard-limit]* + +Specifies resource limits to apply to processes launched when processing `RUN` instructions. This option can be specified multiple times. Recognized resource types include: + "core": maximum core dump size (ulimit -c) + "cpu": maximum CPU time (ulimit -t) + "data": maximum size of a process's data segment (ulimit -d) + "fsize": maximum size of new files (ulimit -f) + "locks": maximum number of file locks (ulimit -x) + "memlock": maximum amount of locked memory (ulimit -l) + "msgqueue": maximum amount of data in message queues (ulimit -q) + "nice": niceness adjustment (nice -n, ulimit -e) + "nofile": maximum number of open files (ulimit -n) + "nproc": maximum number of processes (ulimit -u) + "rss": maximum size of a process's (ulimit -m) + "rtprio": maximum real-time scheduling priority (ulimit -r) + "rttime": maximum amount of real-time execution between blocking syscalls + "sigpending": maximum number of pending signals (ulimit -i) + "stack": maximum stack size (ulimit -s) diff --git a/versioned_docs/version-5.5.0/source/markdown/options/ulimit.md b/versioned_docs/version-5.5.0/source/markdown/options/ulimit.md new file mode 100644 index 000000000..30e3cf203 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/ulimit.md @@ -0,0 +1,33 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ulimit**=*option* + +Ulimit options. Sets the ulimits values inside of the container. + +--ulimit with a soft and hard limit in the format =[:]. For example: + +$ podman run --ulimit nofile=1024:1024 --rm ubi9 ulimit -n +1024 + +Set -1 for the soft or hard limit to set the limit to the maximum limit of the current +process. In rootful mode this is often unlimited. + + +If nofile and nproc are unset, a default value of 1048576 will be used, unless overridden +in containers.conf(5). However, if the default value exceeds the hard limit for the current +rootless user, the current hard limit will be applied instead. + +Use **host** to copy the current configuration from the host. + +Don't use nproc with the ulimit flag as Linux uses nproc to set the +maximum number of processes available to a user, not to a container. + +Use the --pids-limit option to modify the cgroup control to limit the number +of processes within a container. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/umask.md b/versioned_docs/version-5.5.0/source/markdown/options/umask.md new file mode 100644 index 000000000..bd6af2c00 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/umask.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--umask**=*umask* + +Set the umask inside the container. Defaults to `0022`. +Remote connections use the local `containers.conf` for defaults. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/unsetenv-all.md b/versioned_docs/version-5.5.0/source/markdown/options/unsetenv-all.md new file mode 100644 index 000000000..d351514e5 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/unsetenv-all.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetenv-all** + +Unset all default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/unsetenv.image.md b/versioned_docs/version-5.5.0/source/markdown/options/unsetenv.image.md new file mode 100644 index 000000000..ee9c69869 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/unsetenv.image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetenv**=*env* + +Unset environment variables from the final image. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/unsetenv.md b/versioned_docs/version-5.5.0/source/markdown/options/unsetenv.md new file mode 100644 index 000000000..97b12b367 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/unsetenv.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetenv**=*env* + +Unset default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/unsetenv.update.md b/versioned_docs/version-5.5.0/source/markdown/options/unsetenv.update.md new file mode 100644 index 000000000..53a15b4bb --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/unsetenv.update.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetenv**=*env* + +Unset environment variables from the container. + +Note that the env updates only affect the main container process after +the next start. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/unsetlabel.md b/versioned_docs/version-5.5.0/source/markdown/options/unsetlabel.md new file mode 100644 index 000000000..28dd54cef --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/unsetlabel.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetlabel**=*label* + +Unset the image label, causing the label not to be inherited from the base image. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/until.md b/versioned_docs/version-5.5.0/source/markdown/options/until.md new file mode 100644 index 000000000..78604e790 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/until.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--until**=*TIMESTAMP* + +Show logs until TIMESTAMP. The --until option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/user-mode-networking.md b/versioned_docs/version-5.5.0/source/markdown/options/user-mode-networking.md new file mode 100644 index 000000000..4eb58f521 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/user-mode-networking.md @@ -0,0 +1,26 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman machine init, machine set +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--user-mode-networking** + +Indicates that this machine relays traffic from the guest through a user-space +process running on the host. In some VPN configurations the VPN may drop +traffic from alternate network interfaces, including VM network devices. By +enabling user-mode networking (a setting of `true`), VPNs observe all +podman machine traffic as coming from the host, bypassing the problem. + +When the qemu backend is used (Linux, Mac), user-mode networking is +mandatory and the only allowed value is `true`. In contrast, The Windows/WSL +backend defaults to `false`, and follows the standard WSL network setup. +Changing this setting to `true` on Windows/WSL informs Podman to replace +the WSL networking setup on start of this machine instance with a user-mode +networking distribution. Since WSL shares the same kernel across +distributions, all other running distributions reuses this network. +Likewise, when the last machine instance with a `true` setting stops, the +original networking setup is restored. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/user.md b/versioned_docs/version-5.5.0/source/markdown/options/user.md new file mode 100644 index 000000000..2fd456b25 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/user.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--user**, **-u**=*user[\:group]* + +Sets the username or UID used and, optionally, the groupname or GID for the specified command. Both *user* and *group* may be symbolic or numeric. + +Without this argument, the command runs as the user specified in the container image. Unless overridden by a `USER` command in the Containerfile or by a value passed to this option, this user generally defaults to root. + +When a user namespace is not in use, the UID and GID used within the container and on the host match. When user namespaces are in use, however, the UID and GID in the container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container by default corresponds to the UID and GID of the user invoking Podman. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/userns-gid-map-group.md b/versioned_docs/version-5.5.0/source/markdown/options/userns-gid-map-group.md new file mode 100644 index 000000000..c9ee91371 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/userns-gid-map-group.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns-gid-map-group**=*group* + +Specifies that a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subgid` file which correspond to the specified group. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-uid-map-user is specified, but --userns-gid-map-group is not specified, `podman` assumes that the specified user name is also a +suitable group name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/userns-gid-map.md b/versioned_docs/version-5.5.0/source/markdown/options/userns-gid-map.md new file mode 100644 index 000000000..c9f7ce83f --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/userns-gid-map.md @@ -0,0 +1,24 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns-gid-map**=*mapping* + +Directly specifies a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container GID, a corresponding starting host-level GID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-gids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-gid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-gid-map are specified, but --userns-uid-map is specified, the GID map is set to use the same numeric values as the UID map. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/userns-uid-map-user.md b/versioned_docs/version-5.5.0/source/markdown/options/userns-uid-map-user.md new file mode 100644 index 000000000..d1db682b7 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/userns-uid-map-user.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns-uid-map-user**=*user* + +Specifies that a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subuid` file which correspond to the specified user. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-gid-map-group is specified, but --userns-uid-map-user is not specified, `podman` assumes that the specified group name is also a +suitable user name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/userns-uid-map.md b/versioned_docs/version-5.5.0/source/markdown/options/userns-uid-map.md new file mode 100644 index 000000000..8f7d0d571 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/userns-uid-map.md @@ -0,0 +1,24 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns-uid-map**=*mapping* + +Directly specifies a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions default to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container UID, a corresponding starting host-level UID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-uids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-uid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-uid-map are specified, but --userns-gid-map is specified, the UID map is set to use the same numeric values as the GID map. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/userns.container.md b/versioned_docs/version-5.5.0/source/markdown/options/userns.container.md new file mode 100644 index 000000000..20b154721 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/userns.container.md @@ -0,0 +1,74 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, kube play, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns**=*mode* + +Set the user namespace mode for the container. + +If `--userns` is not set, the default value is determined as follows. +- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used. +- If the environment variable **PODMAN_USERNS** is set its value is used. +- If `userns` is specified in `containers.conf` this value is used. +- Otherwise, `--userns=host` is assumed. + +`--userns=""` (i.e., an empty string) is an alias for `--userns=host`. + +This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +------------------------|-----------|--------------------- +auto | $UID | nil (Host User UID is not mapped into container.) +host | $UID | 0 (Default User account mapped to root user in container.) +keep-id | $UID | $UID (Map user account to same UID within container.) +keep-id\:uid=200,gid=210 | $UID | 200:210 (Map user account to specified UID, GID value within container.) +nomap | $UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + +**auto**[\:_OPTIONS,..._]: automatically create a unique user namespace. + +* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. + + Example: `containers:2147483647:2147483648`. + +* `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5). + +Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user IDs. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. + +The option `--userns=keep-id` uses all the subuids and subgids of the user. +The option `--userns=nomap` uses all the subuids and subgids of the user except the user's own ID. +Using `--userns=auto` when starting new containers does not work as long as any containers exist that were started with `--userns=nomap` or `--userns=keep-id` without limiting the user namespace size. + + Valid `auto` options: + + - *gidmapping*=_CONTAINER\_GID\:HOST\_GID\:SIZE_: to force a GID mapping to be present in the user namespace. + - *size*=_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates a size for the user namespace. + - *uidmapping*=_CONTAINER\_UID\:HOST\_UID\:SIZE_: to force a UID mapping to be present in the user namespace. + +The host UID and GID in *gidmapping* and *uidmapping* can optionally be prefixed with the `@` symbol. +In this case, podman will look up the intermediate ID corresponding to host ID and it will map the found intermediate ID to the container id. +For details see **--uidmap**. + +**container:**_id_: join the user namespace of the specified container. + +**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user. + +**keep-id**: creates a user namespace where the current user's UID\:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace. + + Valid `keep-id` options: + + - *uid*=UID: override the UID inside the container that is used to map the current user to. + - *gid*=GID: override the GID inside the container that is used to map the current user to. + - *size*=SIZE: override the size of the configured user namespace. It is useful to not saturate all the available IDs. Not supported when running as root. + +**nomap**: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +**ns:**_namespace_: run the <> in the given existing user namespace. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/userns.image.md b/versioned_docs/version-5.5.0/source/markdown/options/userns.image.md new file mode 100644 index 000000000..5018ee6f4 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/userns.image.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns**=*how* + +Sets the configuration for user namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new user namespace is created, it can be "host" to indicate that the user namespace in which `podman` itself is being run is reused, or it can be the path to a user namespace which is already in use by another process. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/userns.pod.md b/versioned_docs/version-5.5.0/source/markdown/options/userns.pod.md new file mode 100644 index 000000000..cdbd0acea --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/userns.pod.md @@ -0,0 +1,38 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns**=*mode* + +Set the user namespace mode for all the containers in a pod. It defaults to the `PODMAN_USERNS` environment variable. An empty value ("") means user namespaces are disabled. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +----------|---------------|--------------------- +"" |$UID |0 (Default User account mapped to root user in container.) +host |$UID |0 (Default User account mapped to root user in container.) +keep-id |$UID |$UID (Map user account to same UID within container.) +auto |$UID | nil (Host User UID is not mapped into container.) +nomap |$UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + + - *auto[:*_OPTIONS,..._*]*: automatically create a namespace. It is possible to specify these options to `auto`: + + - *gidmapping=*_CONTAINER\_GID\:HOST\_GID\:SIZE_ to force a GID mapping to be present in the user namespace. + + - *size=*_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates the size for the user namespace. + + - *uidmapping=*_CONTAINER\_UID\:HOST\_UID\:SIZE_ to force a UID mapping to be present in the user namespace. + + - *host*: run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user (default). + + - *keep-id*: creates a user namespace where the current rootless user's UID\:GID are mapped to the same values in the container. This option is not allowed for containers created by the root user. + + - *nomap*: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/uts.container.md b/versioned_docs/version-5.5.0/source/markdown/options/uts.container.md new file mode 100644 index 000000000..eea00a0fe --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/uts.container.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uts**=*mode* + +Set the UTS namespace mode for the container. The following values are supported: + +- **host**: use the host's UTS namespace inside the container. +- **private**: create a new namespace for the container (default). +- **ns:[path]**: run the container in the given existing UTS namespace. +- **container:[container]**: join the UTS namespace of the specified container. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/uts.md b/versioned_docs/version-5.5.0/source/markdown/options/uts.md new file mode 100644 index 000000000..4ad0ab88d --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/uts.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uts**=*how* + +Sets the configuration for UTS namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new UTS namespace to be created, or it can be "host" to indicate that the UTS namespace in which `podman` itself is being run is reused, or it can be the path to a UTS namespace which is already in use by another process. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/uts.pod.md b/versioned_docs/version-5.5.0/source/markdown/options/uts.pod.md new file mode 100644 index 000000000..41628e119 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/uts.pod.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uts**=*mode* + +Set the UTS namespace mode for the pod. The following values are supported: + +- **host**: use the host's UTS namespace inside the pod. +- **private**: create a new namespace for the pod (default). +- **ns:[path]**: run the pod in the given existing UTS namespace. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/variant.container.md b/versioned_docs/version-5.5.0/source/markdown/options/variant.container.md new file mode 100644 index 000000000..08c2b2575 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/variant.container.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--variant**=*VARIANT* + +Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/variant.manifest.md b/versioned_docs/version-5.5.0/source/markdown/options/variant.manifest.md new file mode 100644 index 000000000..4aa7c9a6e --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/variant.manifest.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman manifest add, manifest annotate +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--variant** + +Specify the variant which the list or index records for the image. This option +is typically used to distinguish between multiple entries which share the same +architecture value, but which expect different versions of its instruction set. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/volume.image.md b/versioned_docs/version-5.5.0/source/markdown/options/volume.image.md new file mode 100644 index 000000000..609d719fe --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/volume.image.md @@ -0,0 +1,125 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--volume**, **-v**=*[HOST-DIR\:CONTAINER-DIR[\\\:OPTIONS]]* + +Mount a host directory into containers when executing RUN instructions during +the build. + +The `OPTIONS` are a comma-separated list and can be one or more of: + + * [rw|ro] + * [z|Z|O] + * [U] + * [`[r]shared`|`[r]slave`|`[r]private`][[1]](#Footnote1) + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR` +must be an absolute path as well. Podman bind-mounts the `HOST-DIR` to the +specified path when processing RUN instructions. + +You can specify multiple **-v** options to mount one or more mounts. + +You can add the `:ro` or `:rw` suffix to a volume to mount it read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted. When running using user namespaces, the UID and GID inside +the namespace may correspond to another UID and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the namespace, to change recursively the owner and group of +the source volume. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add one of these two suffixes +`:z` or `:Z` to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The `z` option tells Podman that two containers +share the volume content. As a result, Podman labels the content with a shared +content label. Shared volume labels allow all containers to read/write content. +The `Z` option tells Podman to label the content with a private unshared label. +Only the current container can use a private volume. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the host machine to fail. For these types +of containers, disabling SELinux separation is recommended. The option +`--security-opt label=disable` disables SELinux separation for the container. +For example, if a user wanted to volume mount their entire home directory into the build containers, they need to disable SELinux separation. + + $ podman build --security-opt label=disable -v $HOME:/home/user . + +`Overlay Volume Mounts` + +The `:O` flag tells Podman to mount the directory from the host as a +temporary storage using the Overlay file system. The `RUN` command containers +are allowed to modify contents within the mountpoint and are stored in the +container storage in a separate directory. In Overlay FS terms the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the `RUN` command +finishes executing, similar to a tmpfs mount point. + +Any subsequent execution of `RUN` commands sees the original source directory +content, any changes from previous RUN commands no longer exists. + +One use case of the `overlay` mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: + +- Overlay mounts are not currently supported in rootless mode. +- The `O` flag is not allowed to be specified with the `Z` or `z` flags. + Content mounted into the container is labeled with the private label. + On SELinux systems, labels in the source directory needs to be readable + by the container label. If not, SELinux container separation must be disabled + for the container to work. +- Modification of the directory volume mounted into the container with an + overlay mount can cause unexpected failures. Do not modify the directory until + the container finishes running. + +By default bind mounted volumes are `private`. That means any mounts done +inside containers are not be visible on the host and vice versa. This behavior +can be changed by specifying a volume mount propagation property. + +When the mount propagation policy is set to `shared`, any mounts completed +inside the container on that volume is visible to both the host and +container. When the mount propagation policy is set to `slave`, one way mount +propagation is enabled and any mounts completed on the host for that volume is +visible only inside of the container. To control the mount propagation +property of volume use the `:[r]shared`, `:[r]slave` or `:[r]private` +propagation flag. For mount propagation to work on the source mount point (mount +point where source dir is mounted on) has to have the right propagation properties. +For shared volumes, the source mount point has to be shared. And for slave volumes, +the source mount has to be either shared or slave. [[1]](#Footnote1) + +Use `df ` to determine the source mount and then use +`findmnt -o TARGET,PROPAGATION ` to determine propagation +properties of source mount, if `findmnt` utility is not available, the source +mount point can be determined by looking at the mount entry in +`/proc/self/mountinfo`. Look at `optional fields` and see if any propagation +properties are specified. +`shared:X` means the mount is `shared`, `master:X` means the mount is `slave` +and if nothing is there that means the mount is `private`. [[1]](#Footnote1) + +To change propagation properties of a mount point use the `mount` command. For +example, to bind mount the source directory `/foo` do +`mount --bind /foo /foo` and `mount --make-private --make-shared /foo`. This +converts /foo into a `shared` mount point. The propagation properties of +the source mount can be changed directly. For instance if `/` is the source +mount for `/foo`, then use `mount --make-shared /` to convert `/` into a +`shared` mount. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/volume.md b/versioned_docs/version-5.5.0/source/markdown/options/volume.md new file mode 100644 index 000000000..ef41635a6 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/volume.md @@ -0,0 +1,216 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the <> is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +<>. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a <> is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the <>, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the <>. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a <>. Without a label, the security system +might prevent the processes running inside the <> from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the <> context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +<> share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label. Only the current <> can use a private +volume. + +Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any one of the containers. Relabeling walks +the file system under the volume and changes the label on each file; if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the <>. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually changed with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the <>. +For example if a user wanted to volume mount their entire home directory into a +<>, they need to disable SELinux separation. + + $ podman <> --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The <> processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the <> +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous <> executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the <<|pod infra>> container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the <<|pod or infra>> container +to work. + +Do not modify the source directory mounted into the <> with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the <> are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the <> +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +<>, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +<>. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the <>. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the <>. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless <> fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/volumes-from.md b/versioned_docs/version-5.5.0/source/markdown/options/volumes-from.md new file mode 100644 index 000000000..aa097338e --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/volumes-from.md @@ -0,0 +1,41 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--volumes-from**=*CONTAINER[\\\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers<<| and pods>>. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +<>. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a <>. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the <> context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target <>, then the volume hides +that data on the target. diff --git a/versioned_docs/version-5.5.0/source/markdown/options/workdir.md b/versioned_docs/version-5.5.0/source/markdown/options/workdir.md new file mode 100644 index 000000000..2556699e9 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/options/workdir.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.0 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--workdir**, **-w**=*dir* + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (**/**). +The image developer can set a different default with the WORKDIR instruction. The operator +can override the working directory by using the **-w** option. diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-artifact-add.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-artifact-add.1.md new file mode 100644 index 000000000..6e4e746c6 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-artifact-add.1.md @@ -0,0 +1,88 @@ +--- +title: podman-artifact-add +version: v5.5.0 +--- + +% podman-artifact-add 1 + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-add - Add an OCI artifact to the local store + +## SYNOPSIS +**podman artifact add** *name* *file* [*file*]... + +## DESCRIPTION + +Add an OCI artifact to the local store from the local filesystem. You must +provide at least one file to create the artifact, but several can also be +added. + + +## OPTIONS + + +[//]: # (BEGIN included file options/annotation.manifest.md) +#### **--annotation**=*annotation=value* + +Set an annotation on the entry for the specified image or artifact. + +[//]: # (END included file options/annotation.manifest.md) + +Note: Set annotations for each file being added. + +#### **--append**, **-a** + +Append files to an existing artifact. This option cannot be used with the **--type** option. + +#### **--file-type** + +Set the media type of the artifact file instead of allowing detection to determine the type + +#### **--help** + +Print usage statement. + +#### **--type** + +Set a type for the artifact being added. + +## EXAMPLES + +Add a single file to an artifact + +``` +$ podman artifact add quay.io/myartifact/myml:latest /tmp/foobar.ml +0fe1488ecdef8cc4093e11a55bc048d9fc3e13a4ba846efd24b5a715006c95b3 +``` + +Add multiple files to an artifact +``` +$ podman artifact add quay.io/myartifact/myml:latest /tmp/foobar1.ml /tmp/foobar2.ml +1487acae11b5a30948c50762882036b41ac91a7b9514be8012d98015c95ddb78 +``` + +Set an annotation for an artifact +``` +$ podman artifact add --annotation date=2025-01-30 quay.io/myartifact/myml:latest /tmp/foobar1.ml +``` + +Append a file to an existing artifact +``` +$ podman artifact add --append quay.io/myartifact/tarballs:latest /tmp/foobar.tar.gz +``` + +Override the media type of the artifact being added +``` +$ podman artifact add --file-type text/yaml quay.io/myartifact/descriptors\:latest /tmp/info.yaml +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-artifact-extract.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-artifact-extract.1.md new file mode 100644 index 000000000..154666653 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-artifact-extract.1.md @@ -0,0 +1,88 @@ +--- +title: podman-artifact-extract +version: v5.5.0 +--- + +% podman-artifact-extract 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-extract - Extract an OCI artifact to a local path + +## SYNOPSIS +**podman artifact extract** *artifact* *target* + +## DESCRIPTION + +Extract the blobs of an OCI artifact to a local file or directory. + +If the target path is a file or does not exist, the artifact must either consist +of one blob (layer) or if it has multiple blobs (layers) then the **--digest** or +**--title** option must be used to select only a single blob. If the file already +exists it will be overwritten. + +If the target is a directory (it must exist), all blobs will be copied to the +target directory. As the target file name the value from the `org.opencontainers.image.title` +annotation is used. If the annotation is missing, the target file name will be the +digest of the blob (with `:` replaced by `-` in the name). +If the target file already exists in the directory, it will be overwritten. + +## OPTIONS + +#### **--digest**=**digest** + +When extracting blobs from the artifact only use the one with the specified digest. +If the target is a directory then the digest is always used as file name instead even +when the title annotation exists on the blob. +Conflicts with **--title**. + +#### **--help** + +Print usage statement. + +#### **--title**=**title** + +When extracting blobs from the artifact only use the one with the specified title. +It looks for the `org.opencontainers.image.title` annotation and compares that +against the given title. +Conflicts with **--digest**. + +## EXAMPLES + +Extract an artifact with a single blob + +``` +$ podman artifact extract quay.io/artifact/foobar1:test /tmp/myfile +``` + +Extract an artifact with multiple blobs + +``` +$ podman artifact extract quay.io/artifact/foobar2:test /tmp/mydir +$ ls /tmp/mydir +CONTRIBUTING.md README.md +``` + +Extract only a single blob from an artifact with multiple blobs + +``` +$ podman artifact extract --title README.md quay.io/artifact/foobar2:test /tmp/mydir +$ ls /tmp/mydir +README.md +``` +Or using the digest instead of the title +``` +$ podman artifact extract --digest sha256:c0594e012b17fd9e6548355ceb571a79613f7bb988d7d883f112513601ac6e9a quay.io/artifact/foobar2\:test /tmp/mydir +$ ls /tmp/mydir +README.md +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Feb 2025, Originally compiled by Paul Holzinger diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-artifact-inspect.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-artifact-inspect.1.md new file mode 100644 index 000000000..4a96b9e28 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-artifact-inspect.1.md @@ -0,0 +1,43 @@ +--- +title: podman-artifact-inspect +version: v5.5.0 +--- + +% podman-artifact-inspect 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-inspect - Inspect an OCI artifact + +## SYNOPSIS +**podman artifact inspect** [*name*] ... + +## DESCRIPTION + +Inspect an artifact in the local store. The artifact can be referred to with either: + +1. Fully qualified artifact name +2. Full or partial digest of the artifact's manifest + +## OPTIONS + +#### **--help** + +Print usage statement. + +## EXAMPLES + +Inspect an OCI image in the local store. +``` +$ podman artifact inspect quay.io/myartifact/myml\:latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Sept 2024, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-artifact-ls.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-artifact-ls.1.md new file mode 100644 index 000000000..039f00698 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-artifact-ls.1.md @@ -0,0 +1,90 @@ +--- +title: podman-artifact-ls +version: v5.5.0 +--- + +% podman-artifact-ls 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-ls - List OCI artifacts in local store + +## SYNOPSIS +**podman artifact ls** [*options*] + +## DESCRIPTION + +List all local artifacts in your local store. + +## OPTIONS + +#### **--format** + +Print results with a Go template. + +| **Placeholder** | **Description** | +|-----------------|------------------------------------------------| +| .Digest | The computed digest of the artifact's manifest | +| .Repository | Repository name of the artifact | +| .Size | Size artifact in human readable units | +| .Tag | Tag of the artifact name | + + +[//]: # (BEGIN included file options/no-trunc.md) +#### **--no-trunc** + +Do not truncate the output (default *false*). + +[//]: # (END included file options/no-trunc.md) + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +## EXAMPLES + +List artifacts in the local store +``` +$ podman artifact ls +REPOSITORY TAG DIGEST SIZE +quay.io/artifact/foobar1 latest ab609fad386d 2.097GB +quay.io/artifact/foobar2 special cd734b558ceb 12.58MB +``` + +List artifacts in the local store without truncating the digest +``` +$ podman artifact ls --no-trunc +REPOSITORY TAG DIGEST SIZE +quay.io/artifact/foobar1 latest ab609fad386df1433f461b0643d9cf575560baf633809dcc9c190da6cc3a3c29 2.097GB +quay.io/artifact/foobar2 special cd734b558ceb8ccc0281ca76530e1dea1eb479407d3163f75fb601bffb6f73d0 12.58MB +``` + +List artifacts in the local store without the title header +``` +$ podman artifact ls --noheading +quay.io/artifact/foobar1 latest ab609fad386d 2.097GB +quay.io/artifact/foobar2 special cd734b558ceb 12.58MB +``` + +List artifact digests and size using a --format +``` +$ podman artifact ls --format "{{.Digest}} {{.Size}}" +ab609fad386d 2.097GB +cd734b558ceb 12.58MB +``` + + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-artifact-pull.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-artifact-pull.1.md new file mode 100644 index 000000000..ee4f8f5a1 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-artifact-pull.1.md @@ -0,0 +1,140 @@ +--- +title: podman-artifact-pull +version: v5.5.0 +--- + +% podman-artifact-pull 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-pull - Pulls an artifact from a registry and stores it locally + +## SYNOPSIS +**podman artifact pull** [*options*] *source* + + +## DESCRIPTION +podman artifact pull copies an artifact from a registry onto the local machine. + + +## SOURCE +SOURCE is the location from which the artifact image is obtained. + +``` +# Pull from a registry +$ podman artifact pull quay.io/foobar/artifact\:special +``` + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +#### **--help**, **-h** + +Print the usage statement. + +#### **--quiet**, **-q** + +Suppress output information when pulling images + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## FILES + +## EXAMPLES +Pull an artifact from a registry + +``` +podman artifact pull quay.io/baude/artifact\:josey +Getting image source signatures +Copying blob e741c35a27bb done | +Copying config 44136fa355 done | +Writing manifest to image destination + +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-artifact-push.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-artifact-push.1.md new file mode 100644 index 000000000..71e55426a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-artifact-push.1.md @@ -0,0 +1,149 @@ +--- +title: podman-artifact-push +version: v5.5.0 +--- + +% podman-artifact-push 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-push - Push an OCI artifact from local storage to an image registry + +## SYNOPSIS +**podman artifact push** [*options*] *image* + +## DESCRIPTION +Pushes an artifact from the local artifact store to an image registry. + +``` +# Push artifact to a container registry +$ podman artifact push quay.io/artifact/foobar1\:latest +``` + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\\\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/digestfile.md) +#### **--digestfile**=*Digestfile* + +After copying the image, write the digest of the resulting image to the file. + +[//]: # (END included file options/digestfile.md) + +#### **--quiet**, **-q** + +When writing the output image, suppress progress output + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + +#### **--sign-by**=*key* + +Add a “simple signing” signature at the destination using the specified key. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-by-sigstore.md) +#### **--sign-by-sigstore**=*param-file* + +Add a sigstore signature based on further options specified in a container's sigstore signing parameter file *param-file*. +See containers-sigstore-signing-params.yaml(5) for details about the file format. + +[//]: # (END included file options/sign-by-sigstore.md) + + +#### **--sign-by-sigstore-private-key**=*path* + +Add a sigstore signature at the destination using a private key at the specified path. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-passphrase-file.md) +#### **--sign-passphrase-file**=*path* + +If signing the image (using either **--sign-by** or **--sign-by-sigstore-private-key**), read the passphrase to use from the specified path. + +[//]: # (END included file options/sign-passphrase-file.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLE + +Push the specified iage to a container registry: +``` +$ podman artifact push quay.io/baude/artifact\:single +Getting image source signatures +Copying blob 3ddc0a3cdb61 done | +Copying config 44136fa355 done | +Writing manifest to image destination +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)**, **[podman-pull(1)](podman-pull.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** + + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-artifact-rm.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-artifact-rm.1.md new file mode 100644 index 000000000..9b6a08b7e --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-artifact-rm.1.md @@ -0,0 +1,63 @@ +--- +title: podman-artifact-rm +version: v5.5.0 +--- + +% podman-artifact-rm 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-rm - Remove an OCI from local storage + +## SYNOPSIS +**podman artifact rm** [*options*] *name* + +## DESCRIPTION + +Remove an artifact from the local artifact store. The input may be the fully +qualified artifact name or a full or partial artifact digest. + +## OPTIONS + +#### **--all**, **-a** + +Remove all artifacts in the local store. The use of this option conflicts with +providing a name or digest of the artifact. + +#### **--help** + +Print usage statement. + + +## EXAMPLES + +Remove an artifact by name + +``` +$ podman artifact rm quay.io/artifact/foobar2\:test +Deleted: e7b417f49fc24fc7ead6485da0ebd5bc4419d8a3f394c169fee5a6f38faa4056 +``` + +Remove an artifact by partial digest + +``` +$ podman artifact rm e7b417f49fc +Deleted: e7b417f49fc24fc7ead6485da0ebd5bc4419d8a3f394c169fee5a6f38faa4056 +``` + +Remove all artifacts in local storage +``` +$ podman artifact rm -a +Deleted: cee15f7c5ce3e86ae6ce60d84bebdc37ad34acfa9a2611cf47501469ac83a1ab +Deleted: 72875f8f6f78d5b8ba98b2dd2c0a6f395fde8f05ff63a1df580d7a88f5afa97b +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-artifact.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-artifact.1.md new file mode 100644 index 000000000..d82f6191a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-artifact.1.md @@ -0,0 +1,42 @@ +--- +title: podman-artifact +version: v5.5.0 +--- + +% podman-artifact 1 + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact - Manage OCI artifacts + +## SYNOPSIS +**podman artifact** *subcommand* + +## DESCRIPTION +`podman artifact` is a set of subcommands that manage OCI artifacts. + +OCI artifacts are a common way to distribute files that are associated with OCI images and +containers. Podman is capable of managing (pulling, inspecting, pushing) these artifacts +from its local "artifact store". + +## SUBCOMMANDS + +| Command | Man Page | Description | +|---------|------------------------------------------------------------|--------------------------------------------------------------| +| add | [podman-artifact-add(1)](podman-artifact-add.1.md) | Add an OCI artifact to the local store | +| extract | [podman-artifact-extract(1)](podman-artifact-extract.1.md) | Extract an OCI artifact to a local path | +| inspect | [podman-artifact-inspect(1)](podman-artifact-inspect.1.md) | Inspect an OCI artifact | +| ls | [podman-artifact-ls(1)](podman-artifact-ls.1.md) | List OCI artifacts in local store | +| pull | [podman-artifact-pull(1)](podman-artifact-pull.1.md) | Pulls an artifact from a registry and stores it locally | +| push | [podman-artifact-push(1)](podman-artifact-push.1.md) | Push an OCI artifact from local storage to an image registry | +| rm | [podman-artifact-rm(1)](podman-artifact-rm.1.md) | Remove an OCI from local storage | + + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +Sept 2024, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-attach.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-attach.1.md new file mode 100644 index 000000000..8b7bbb9a0 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-attach.1.md @@ -0,0 +1,78 @@ +--- +title: podman-attach +version: v5.5.0 +--- + +% podman-attach 1 + +## NAME +podman\-attach - Attach to a running container + +## SYNOPSIS +**podman attach** [*options*] *container* + +**podman container attach** [*options*] *container* + +## DESCRIPTION +**podman attach** attaches to a running *container* using the *container's name* or *ID*, to either view its ongoing output or to control it interactively.\ +The *container* can be detached from (and leave it running) using a configurable key sequence. The default sequence is `ctrl-p,ctrl-q`. Configure the keys sequence using the **--detach-keys** OPTION, or specifying it in the `containers.conf` file: see **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** for more information. + +## OPTIONS + +[//]: # (BEGIN included file options/detach-keys.md) +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. + +[//]: # (END included file options/detach-keys.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--no-stdin** + +Do not attach STDIN. The default is **false**. + + +[//]: # (BEGIN included file options/sig-proxy.md) +#### **--sig-proxy** + +Proxy received signals to the container process. SIGCHLD, SIGURG, SIGSTOP, and SIGKILL are not proxied. + +[//]: # (END included file options/sig-proxy.md) + +The default is **true**. + +## EXAMPLES +Attach to a container called "foobar". +``` +$ podman attach foobar +``` + +Attach to the latest created container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman attach --latest +``` + +Attach to a container that start with the ID "1234". +``` +$ podman attach 1234 +``` + +Attach to a container without attaching STDIN. +``` +$ podman attach --no-stdin foobar +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-exec(1)](podman-exec.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-auto-update.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-auto-update.1.md new file mode 100644 index 000000000..267a6bc06 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-auto-update.1.md @@ -0,0 +1,146 @@ +--- +title: podman-auto-update +version: v5.5.0 +--- + +% podman-auto-update 1 + +## NAME +podman\-auto-update - Auto update containers according to their auto-update policy + +## SYNOPSIS +**podman auto-update** [*options*] + +## DESCRIPTION +**podman auto-update** pulls down new container images and restarts containers configured for auto updates. +To make use of auto updates, the container or Kubernetes workloads must run inside a systemd unit. +After a successful update of an image, the containers using the image get updated by restarting the systemd units they run in. +Please refer to `podman-systemd.unit(5)` on how to run Podman under systemd. + +To configure a container for auto updates, it must be created with the `io.containers.autoupdate` label or the `AutoUpdate` field in `podman-systemd.unit(5)` with one of the following two values: + +* `registry`: If the label is present and set to `registry`, Podman reaches out to the corresponding registry to check if the image has been updated. +The label `image` is an alternative to `registry` maintained for backwards compatibility. +An image is considered updated if the digest in the local storage is different than the one of the remote image. +If an image must be updated, Podman pulls it down and restarts the systemd unit executing the container. +The registry policy requires a fully-qualified image reference (e.g., quay.io/podman/stable\\:latest) to be used to create the container. +This enforcement is necessary to know which image to actually check and pull. +If an image ID was used, Podman would not know which image to check/pull anymore. + +* `local`: If the autoupdate label is set to `local`, Podman compares the image digest of the container to the one in the local container storage. +If they differ, the local image is considered to be newer and the systemd unit gets restarted. + +### Auto Updates and Kubernetes YAML + +Podman supports auto updates for Kubernetes workloads. The auto-update policy can be configured directly via `podman-systemd.unit(5)` or inside the Kubernetes YAML with the Podman-specific annotations mentioned below: + +* `io.containers.autoupdate`: "registry|local" to apply the auto-update policy to all containers +* `io.containers.autoupdate/$container`: "registry|local" to apply the auto-update policy to `$container` only +* `io.containers.sdnotify`: "conmon|container" to apply the sdnotify policy to all containers +* `io.containers.sdnotify/$container`: "conmon|container" to apply the sdnotify policy to `$container` only + +By default, the autoupdate policy is set to "disabled", the sdnotify policy is set to "conmon". + +### Systemd Unit and Timer + +Podman ships with a `podman-auto-update.service` systemd unit. This unit is triggered daily at midnight by the `podman-auto-update.timer` systemd timer. +The timer can be altered for custom time-based updates if desired. +The unit can further be invoked by other systemd units (e.g., via the dependency tree) or manually via **systemctl start podman-auto-update.service**. + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + +Alternatively, the `io.containers.autoupdate.authfile` container label can be configured. In that case, Podman will use the specified label's value instead. + +#### **--dry-run** + +Check for the availability of new images but do not perform any pull operation or restart any service or container. +The `UPDATED` field indicates the availability of a new image with "pending". + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| --------------- | -------------------------------------- | +| .Container | ID and name of the container | +| .ContainerID | ID of the container | +| .ContainerName | Name of the container | +| .Image | Name of the image | +| .Policy | Auto-update policy of the container | +| .Unit | Name of the systemd unit | +| .Updated | Update status: true,false,failed | + +#### **--rollback** + +If restarting a systemd unit after updating the image has failed, rollback to using the previous image and restart the unit another time. Default is true. + +Note that detecting if a systemd unit has failed is best done by the container sending the READY message via SDNOTIFY. +This way, restarting the unit waits until having received the message or a timeout kicked in. +Without that, restarting the systemd unit may succeed even if the container has failed shortly after. + +For a container to send the READY message via SDNOTIFY it must be created with the `--sdnotify=container` option (see podman-run(1)). +The application running inside the container can then execute `systemd-notify --ready` when ready or use the sdnotify bindings of the specific programming language (e.g., sd_notify(3)). + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Create a Quadlet file configured for auto updates: +``` +$ cat ~/.config/containers/systemd/sleep.container +[Container] +Image=registry.fedoraproject.org/fedora:latest +Exec=sleep infinity +AutoUpdate=registry +``` + +Generate a systemd service from the Quadlet file by reloading the systemd user daemon: +``` +$ systemctl --user daemon-reload +``` + +Start the systemd service and make sure the container is running +``` +$ systemctl --user start sleep.service +$ podman ps +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +f8e4759798d4 registry.fedoraproject.org/fedora:latest sleep infinity 2 seconds ago Up 2 seconds systemd-sleep +``` + +Check if a new image is available via `--dry-run`: +``` +$ podman auto-update --dry-run --format "{{.Image}} {{.Updated}}" +registry.fedoraproject.org/fedora:latest pending +``` + +Update the service: +``` +$ podman auto-update +UNIT CONTAINER IMAGE POLICY UPDATED +sleep.service f8e4759798d4 (systemd-sleep) registry.fedoraproject.org/fedora\\:latest registry true +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-generate-systemd(1)](podman-generate-systemd.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-systemd.unit(5)](podman-systemd.unit.5.md)**, **sd_notify(3)**, **[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-build.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-build.1.md new file mode 100644 index 000000000..e5baa8892 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-build.1.md @@ -0,0 +1,1951 @@ +--- +title: podman-build +version: v5.5.0 +--- + +% podman-build 1 + +## NAME +podman\-build - Build a container image using a Containerfile + +## SYNOPSIS +**podman build** [*options*] [*context*] + +**podman image build** [*options*] [*context*] + +## DESCRIPTION +**podman build** Builds an image using instructions from one or more +Containerfiles or Dockerfiles and a specified build context directory. A +Containerfile uses the same syntax as a Dockerfile internally. For this +document, a file referred to as a Containerfile can be a file named +either 'Containerfile' or 'Dockerfile' exclusively. Any file that has additional +extension attached will not be recognized by `podman build .` unless a `-f` flag is +used to specify the file. + +The build context directory can be specified as the http(s) URL of an archive, +git repository or Containerfile. + +When invoked with `-f` and a path to a Containerfile, with no explicit CONTEXT +directory, Podman uses the Containerfile's parent directory as its build context. + +Containerfiles ending with a ".in" suffix are preprocessed via CPP(1). This +can be useful to decompose Containerfiles into several reusable parts that can +be used via CPP's **#include** directive. Containerfiles ending in .in are +restricted to no comment lines unless they are CPP commands. +Note, a Containerfile.in file can still be used by other tools when manually +preprocessing them via `cpp -E`. + +When the URL is an archive, the contents of the URL is downloaded to a temporary +location and extracted before execution. + +When the URL is a Containerfile, the Containerfile is downloaded to a temporary +location. + +When a Git repository is set as the URL, the repository is cloned locally and +then set as the context. A URL is treated as a Git repository if it +has a `git://` prefix or a `.git` suffix. + +NOTE: `podman build` uses code sourced from the `Buildah` project to build +container images. This `Buildah` code creates `Buildah` containers for the +`RUN` options in container storage. In certain situations, when the +`podman build` crashes or users kill the `podman build` process, these external +containers can be left in container storage. Use the `podman ps --all --external` +command to see these containers. + +`podman buildx build` command is an alias of `podman build`. Not all `buildx build` features are available in Podman. The `buildx build` option is provided for scripting compatibility. + +## OPTIONS + + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the container's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + +#### **--all-platforms** + +Instead of building for a set of platforms specified using the **--platform** option, inspect the build's base images, and build for all of the platforms for which they are all available. Stages that use *scratch* as a starting point can not be inspected, so at least one non-*scratch* stage must be present for detection to work usefully. + + +[//]: # (BEGIN included file options/annotation.image.md) +#### **--annotation**=*annotation=value* + +Add an image *annotation* (e.g. annotation=*value*) to the image metadata. Can +be used multiple times. + +Note: this information is not present in Docker image formats, so it is +discarded when writing images in Docker formats. + +[//]: # (END included file options/annotation.image.md) + +#### **--arch**=*arch* + +Set the architecture of the image to be built, and that of the base image to be +pulled, if the build uses one, to the provided value instead of using the +architecture of the build host. Unless overridden, subsequent lookups of the +same image in the local storage matches this architecture, regardless of the +host. (Examples: arm, arm64, 386, amd64, ppc64le, s390x) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/build-arg.md) +#### **--build-arg**=*arg=value* + +Specifies a build argument and its value, which is interpolated in +instructions read from the Containerfiles in the same way that environment variables are, but which are not added to environment variable list in the resulting image's configuration. + +[//]: # (END included file options/build-arg.md) + + +[//]: # (BEGIN included file options/build-arg-file.md) +#### **--build-arg-file**=*path* + +Specifies a file containing lines of build arguments of the form `arg=value`. +The suggested file name is `argfile.conf`. + +Comment lines beginning with `#` are ignored, along with blank lines. +All others must be of the `arg=value` format passed to `--build-arg`. + +If several arguments are provided via the `--build-arg-file` +and `--build-arg` options, the build arguments are merged across all +of the provided files and command line arguments. + +Any file provided in a `--build-arg-file` option is read before +the arguments supplied via the `--build-arg` option. + +When a given argument name is specified several times, the last instance +is the one that is passed to the resulting builds. This means `--build-arg` +values always override those in a `--build-arg-file`. + +[//]: # (END included file options/build-arg-file.md) + + +[//]: # (BEGIN included file options/build-context.md) +#### **--build-context**=*name=value* + +Specify an additional build context using its short name and its location. +Additional build contexts can be referenced in the same manner as we access +different stages in COPY instruction. + +Valid values are: + +* Local directory – e.g. --build-context project2=../path/to/project2/src (This option is not available with the remote Podman client. On Podman machine setup (i.e macOS and Windows) path must exists on the machine VM) +* HTTP URL to a tarball – e.g. --build-context src=https://example.org/releases/src.tar +* Container image – specified with a container-image:// prefix, e.g. --build-context alpine=container-image://alpine:3.15, (also accepts docker://, docker-image://) + +On the Containerfile side, reference the build context on all +commands that accept the “from” parameter. Here’s how that might look: + +```dockerfile +FROM [name] +COPY --from=[name] ... +RUN --mount=from=[name] … +``` + +The value of [name] is matched with the following priority order: + +* Named build context defined with --build-context [name]=.. +* Stage defined with AS [name] inside Containerfile +* Image [name], either local or in a remote registry + +[//]: # (END included file options/build-context.md) + + +[//]: # (BEGIN included file options/cache-from.md) +#### **--cache-from**=*image* + +Repository to utilize as a potential cache source. When specified, Buildah tries to look for +cache images in the specified repository and attempts to pull cache images instead of actually +executing the build steps locally. Buildah only attempts to pull previously cached images if they +are considered as valid cache hits. + +Use the `--cache-to` option to populate a remote repository with cache content. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-from` option is ignored unless `--layers` is specified. + +[//]: # (END included file options/cache-from.md) + + +[//]: # (BEGIN included file options/cache-to.md) +#### **--cache-to**=*image* + +Set this flag to specify a remote repository that is used to store cache images. Buildah attempts to +push newly built cache image to the remote repository. + +Note: Use the `--cache-from` option in order to use cache content in a remote repository. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-to` option is ignored unless `--layers` is specified. + +[//]: # (END included file options/cache-to.md) + + +[//]: # (BEGIN included file options/cache-ttl.md) +#### **--cache-ttl** + +Limit the use of cached images to only consider images with created timestamps less than *duration* ago. +For example if `--cache-ttl=1h` is specified, Buildah considers intermediate cache images which are created +under the duration of one hour, and intermediate cache images outside this duration is ignored. + +Note: Setting `--cache-ttl=0` manually is equivalent to using `--no-cache` in the +implementation since this means that the user does not want to use cache at all. + +[//]: # (END included file options/cache-ttl.md) + + +[//]: # (BEGIN included file options/cap-add.image.md) +#### **--cap-add**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability added to its capability set. +Certain capabilities are granted by default; this option can be used to add +more. + +[//]: # (END included file options/cap-add.image.md) + + +[//]: # (BEGIN included file options/cap-drop.image.md) +#### **--cap-drop**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability removed from its capability set. +The CAP\_CHOWN, CAP\_DAC\_OVERRIDE, CAP\_FOWNER, +CAP\_FSETID, CAP\_KILL, CAP\_NET\_BIND\_SERVICE, CAP\_SETFCAP, +CAP\_SETGID, CAP\_SETPCAP, and CAP\_SETUID capabilities are +granted by default; this option can be used to remove them. + +If a capability is specified to both the **--cap-add** and **--cap-drop** +options, it is dropped, regardless of the order in which the options were +given. + +[//]: # (END included file options/cap-drop.image.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the container is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cgroupns.image.md) +#### **--cgroupns**=*how* + +Sets the configuration for cgroup namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "private" to indicate +that a new cgroup namespace is created, or it can be "host" to indicate +that the cgroup namespace in which `buildah` itself is being run is reused. + +[//]: # (END included file options/cgroupns.image.md) + + +[//]: # (BEGIN included file options/compat-volumes.md) +#### **--compat-volumes** + +Handle directories marked using the VOLUME instruction (both in this build, and +those inherited from base images) such that their contents can only be modified +by ADD and COPY instructions. Any changes made in those locations by RUN +instructions will be reverted. Before the introduction of this option, this +behavior was the default, but it is now disabled by default. + +[//]: # (END included file options/compat-volumes.md) + +#### **--compress** + +This option is added to be aligned with other containers CLIs. +Podman doesn't communicate with a daemon or a remote server. +Thus, compressing the data before sending it is irrelevant to Podman. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/cpp-flag.md) +#### **--cpp-flag**=*flags* + +Set additional flags to pass to the C Preprocessor cpp(1). Containerfiles ending with a ".in" suffix is preprocessed via cpp(1). This option can be used to pass additional flags to cpp.Note: You can also set default CPPFLAGS by setting the BUILDAH_CPPFLAGS environment variable (e.g., export BUILDAH_CPPFLAGS="-DDEBUG"). + +[//]: # (END included file options/cpp-flag.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + +#### **--cw**=*options* + +Produce an image suitable for use as a confidential workload running in a +trusted execution environment (TEE) using krun (i.e., *crun* built with the +libkrun feature enabled and invoked as *krun*). Instead of the conventional +contents, the root filesystem of the image will contain an encrypted disk image +and configuration information for krun. + +The value for *options* is a comma-separated list of key=value pairs, supplying +configuration information which is needed for producing the additional data +which will be included in the container image. + +Recognized _keys_ are: + +*attestation_url*: The location of a key broker / attestation server. +If a value is specified, the new image's workload ID, along with the passphrase +used to encrypt the disk image, will be registered with the server, and the +server's location will be stored in the container image. +At run-time, krun is expected to contact the server to retrieve the passphrase +using the workload ID, which is also stored in the container image. +If no value is specified, a *passphrase* value *must* be specified. + +*cpus*: The number of virtual CPUs which the image expects to be run with at +run-time. If not specified, a default value will be supplied. + +*firmware_library*: The location of the libkrunfw-sev shared library. If not +specified, `buildah` checks for its presence in a number of hard-coded +locations. + +*memory*: The amount of memory which the image expects to be run with at +run-time, as a number of megabytes. If not specified, a default value will be +supplied. + +*passphrase*: The passphrase to use to encrypt the disk image which will be +included in the container image. +If no value is specified, but an *attestation_url* value is specified, a +randomly-generated passphrase will be used. +The authors recommend setting an *attestation_url* but not a *passphrase*. + +*slop*: Extra space to allocate for the disk image compared to the size of the +container image's contents, expressed either as a percentage (..%) or a size +value (bytes, or larger units if suffixes like KB or MB are present), or a sum +of two or more such specifications. If not specified, `buildah` guesses that +25% more space than the contents will be enough, but this option is provided in +case its guess is wrong. + +*type*: The type of trusted execution environment (TEE) which the image should +be marked for use with. Accepted values are "SEV" (AMD Secure Encrypted +Virtualization - Encrypted State) and "SNP" (AMD Secure Encrypted +Virtualization - Secure Nested Paging). If not specified, defaults to "SNP". + +*workload_id*: A workload identifier which will be recorded in the container +image, to be used at run-time for retrieving the passphrase which was used to +encrypt the disk image. If not specified, a semi-random value will be derived +from the base image's image ID. + +This option is not supported on the remote client, including Mac and Windows +(excluding WSL2) machines. + + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the container. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The container only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: if the user only has access rights via a group, accessing the device +from inside a rootless container fails. The **[crun(1)](https://github.com/containers/crun/tree/main/crun.1.md)** runtime offers a +workaround for this by adding the option +**--annotation run.oci.keep_original_groups=1**. + + +[//]: # (BEGIN included file options/disable-compression.md) +#### **--disable-compression**, **-D** + +Don't compress filesystem layers when building the image unless it is required +by the location where the image is being written. This is the default setting, +because image layers are compressed automatically when they are pushed to +registries, and images being written to local storage only need to be +decompressed again to be stored. Compression can be forced in all cases by +specifying **--disable-compression=false**. + +[//]: # (END included file options/disable-compression.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + + +[//]: # (BEGIN included file options/dns.md) +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. + +[//]: # (END included file options/dns.md) + +This option cannot be combined with **--network** that is set to **none**. + +Note: this option takes effect only during *RUN* instructions in the build. +It does not affect _/etc/resolv.conf_ in the final image. + + +[//]: # (BEGIN included file options/dns-option.image.md) +#### **--dns-option**=*option* + +Set custom DNS options to be used during the build. + +[//]: # (END included file options/dns-option.image.md) + + +[//]: # (BEGIN included file options/dns-search.image.md) +#### **--dns-search**=*domain* + +Set custom DNS search domains to be used during the build. + +[//]: # (END included file options/dns-search.image.md) + + +[//]: # (BEGIN included file options/env.image.md) +#### **--env**=*env[=value]* + +Add a value (e.g. env=*value*) to the built image. Can be used multiple times. +If neither `=` nor a *value* are specified, but *env* is set in the current +environment, the value from the current environment is added to the image. +To remove an environment variable from the built image, use the `--unsetenv` +option. + +[//]: # (END included file options/env.image.md) + + +[//]: # (BEGIN included file options/file.md) +#### **--file**, **-f**=*Containerfile* + +Specifies a Containerfile which contains instructions for building the image, +either a local file or an **http** or **https** URL. If more than one +Containerfile is specified, *FROM* instructions are only be accepted from the +last specified file. + +If a build context is not specified, and at least one Containerfile is a +local file, the directory in which it resides is used as the build +context. + +Specifying the option `-f -` causes the Containerfile contents to be read from stdin. + +[//]: # (END included file options/file.md) + + +[//]: # (BEGIN included file options/force-rm.md) +#### **--force-rm** + +Always remove intermediate containers after a build, even if the build fails (default true). + +[//]: # (END included file options/force-rm.md) + + +[//]: # (BEGIN included file options/format.md) +#### **--format** + +Control the format for the built image's manifest and configuration data. +Recognized formats include *oci* (OCI image-spec v1.0, the default) and +*docker* (version 2, using schema format 2 for the manifest). + +Note: You can also override the default format by setting the BUILDAH\_FORMAT +environment variable. `export BUILDAH_FORMAT=docker` + +[//]: # (END included file options/format.md) + + +[//]: # (BEGIN included file options/from.md) +#### **--from** + +Overrides the first `FROM` instruction within the Containerfile. If there are multiple +FROM instructions in a Containerfile, only the first is changed. + +With the remote podman client, not all container transports work as +expected. For example, oci-archive:/x.tar references /x.tar on the remote +machine instead of on the client. When using podman remote clients it is +best to restrict use to *containers-storage*, and *docker:// transports*. + +[//]: # (END included file options/from.md) + + +[//]: # (BEGIN included file options/group-add.md) +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/group-add.md) + + +[//]: # (BEGIN included file options/help.md) +#### **--help**, **-h** + +Print usage statement + +[//]: # (END included file options/help.md) + + +[//]: # (BEGIN included file options/hooks-dir.md) +#### **--hooks-dir**=*path* + +Each *.json file in the path configures a hook for buildah build containers. For more details on the syntax of the JSON files and the semantics of hook injection. Buildah currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. + +This option may be set multiple times; paths from later options have higher precedence. + +For the annotation conditions, buildah uses any annotations set in the generated OCI configuration. + +For the bind-mount conditions, only mounts explicitly requested by the caller via --volume are considered. Bind mounts that buildah inserts by default (e.g. /dev/shm) are not considered. + +If --hooks-dir is unset for root callers, Buildah currently defaults to /usr/share/containers/oci/hooks.d and /etc/containers/oci/hooks.d in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting --hooks-dir. + +[//]: # (END included file options/hooks-dir.md) + + +[//]: # (BEGIN included file options/http-proxy.md) +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. + +[//]: # (END included file options/http-proxy.md) + + +[//]: # (BEGIN included file options/identity-label.md) +#### **--identity-label** + +Adds default identity label `io.buildah.version` if set. (default true). + +[//]: # (END included file options/identity-label.md) + + +[//]: # (BEGIN included file options/ignorefile.md) +#### **--ignorefile** + +Path to an alternative .containerignore file. + +[//]: # (END included file options/ignorefile.md) + + +[//]: # (BEGIN included file options/iidfile.md) +#### **--iidfile**=*ImageIDfile* + +Write the built image's ID to the file. When `--platform` is specified more than once, attempting to use this option triggers an error. + +[//]: # (END included file options/iidfile.md) + + +[//]: # (BEGIN included file options/inherit-labels.md) +#### **--inherit-labels** + +Inherit the labels from the base image or base stages. (default true). + +[//]: # (END included file options/inherit-labels.md) + + +[//]: # (BEGIN included file options/ipc.image.md) +#### **--ipc**=*how* + +Sets the configuration for IPC namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate +that a new IPC namespace is created, or it can be "host" to indicate +that the IPC namespace in which `podman` itself is being run is reused, +or it can be the path to an IPC namespace which is already in use by +another process. + +[//]: # (END included file options/ipc.image.md) + + +[//]: # (BEGIN included file options/isolation.md) +#### **--isolation**=*type* + +Controls what type of isolation is used for running processes as part of `RUN` +instructions. Recognized types include *oci* (OCI-compatible runtime, the +default), *rootless* (OCI-compatible runtime invoked using a modified +configuration and its --rootless option enabled, with *--no-new-keyring +--no-pivot* added to its *create* invocation, with network and UTS namespaces +disabled, and IPC, PID, and user namespaces enabled; the default for +unprivileged users), and *chroot* (an internal wrapper that leans more toward +chroot(1) than container technology). + +Note: You can also override the default isolation type by setting the +BUILDAH\_ISOLATION environment variable. `export BUILDAH_ISOLATION=oci` + +[//]: # (END included file options/isolation.md) + + +[//]: # (BEGIN included file options/jobs.md) +#### **--jobs**=*number* + +Run up to N concurrent stages in parallel. If the number of jobs is greater +than 1, stdin is read from /dev/null. If 0 is specified, then there is +no limit in the number of jobs that run in parallel. + +[//]: # (END included file options/jobs.md) + + +[//]: # (BEGIN included file options/label.image.md) +#### **--label**=*label* + +Add an image *label* (e.g. label=*value*) to the image metadata. Can be used +multiple times. + +Users can set a special LABEL **io.containers.capabilities=CAP1,CAP2,CAP3** in +a Containerfile that specifies the list of Linux capabilities required for the +container to run properly. This label specified in a container image tells +Podman to run the container with just these capabilities. Podman launches the +container with just the specified capabilities, as long as this list of +capabilities is a subset of the default list. + +If the specified capabilities are not in the default set, Podman prints an error +message and runs the container with the default capabilities. + +[//]: # (END included file options/label.image.md) + + +[//]: # (BEGIN included file options/layer-label.md) +#### **--layer-label**=*label[=value]* + +Add an intermediate image *label* (e.g. label=*value*) to the intermediate +image metadata. It can be used multiple times. + +If *label* is named, but neither `=` nor a `value` is provided, then +the *label* is set to an empty value. + +[//]: # (END included file options/layer-label.md) + + +[//]: # (BEGIN included file options/layers.md) +#### **--layers** + +Cache intermediate images during the build process (Default is `true`). + +Note: You can also override the default value of layers by setting the +BUILDAH\_LAYERS environment variable. `export BUILDAH_LAYERS=true` + +[//]: # (END included file options/layers.md) + + +[//]: # (BEGIN included file options/logfile.md) +#### **--logfile**=*filename* + +Log output which is sent to standard output and standard error to the +specified file instead of to standard output and standard error. +This option is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. + +[//]: # (END included file options/logfile.md) + +#### **--logsplit**=*bool-value* + +If `--logfile` and `--platform` are specified, the `--logsplit` option allows +end-users to split the log file for each platform into different files in the +following format: `${logfile}_${platform-os}_${platform-arch}`. +This option is not supported on the remote client, including Mac and Windows +(excluding WSL2) machines. + + +[//]: # (BEGIN included file options/manifest.md) +#### **--manifest**=*manifest* + +Name of the manifest list to which the image is added. Creates the manifest list if it does not exist. This option is useful for building multi architecture images. + +[//]: # (END included file options/manifest.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/network.image.md) +#### **--network**=*mode*, **--net** + +Sets the configuration for network namespaces when handling `RUN` instructions. + +Valid _mode_ values are: + +- **none**: no networking. +- **host**: use the Podman host network stack. Note: the host mode gives the +container full access to local system services such as D-bus and is therefore +considered insecure. +- **ns:**_path_: path to a network namespace to join. +- **private**: create a new namespace for the container (default) +- **\**: Join the network with the given name or ID, e.g. use `--network mynet` to join the network with the name mynet. Only supported for rootful users. +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=MTU**: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=CIDR**: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=INTERFACE**: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=IPv4**: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=INTERFACE**: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=IPv6**: Specify the outbound ipv6 address slirp binds to. +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.image.md) + + +[//]: # (BEGIN included file options/no-cache.md) +#### **--no-cache** + +Do not use existing cached images for the container build. Build from the start with a new set of cached layers. + +[//]: # (END included file options/no-cache.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the container. + +Podman assumes control over the container's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/omit-history.md) +#### **--omit-history** + +Omit build history information in the built image. (default false). + +This option is useful for the cases where end users explicitly +want to set `--omit-history` to omit the optional `History` from +built images or when working with images built using build tools that +do not include `History` information in their images. + +[//]: # (END included file options/omit-history.md) + + +[//]: # (BEGIN included file options/os.md) +#### **--os**=*string* + +Set the OS of the image to be built, and that of the base image to be pulled, if the build uses one, instead of using the current operating system of the build host. Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. + +[//]: # (END included file options/os.md) + + +[//]: # (BEGIN included file options/os-feature.md) +#### **--os-feature**=*feature* + +Set the name of a required operating system *feature* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS feature list is kept, if the base image specified any. This option is typically only meaningful when the image's OS is Windows. + +If *feature* has a trailing `-`, then the *feature* is removed from the set of required features which is listed in the image. + +[//]: # (END included file options/os-feature.md) + + +[//]: # (BEGIN included file options/os-version.image.md) +#### **--os-version**=*version* + +Set the exact required operating system *version* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS version is kept, if the base image specified one. This option is typically only meaningful when the image's OS is Windows, and is typically set in Windows base images, so using this option is usually unnecessary. + +[//]: # (END included file options/os-version.image.md) + +#### **--output**, **-o**=*output-opts* + +Output destination (format: type=local,dest=path) + +The --output (or -o) option extends the default behavior of building a container image by allowing users to export the contents of the image as files on the local filesystem, which can be useful for generating local binaries, code generation, etc. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +The value for --output is a comma-separated sequence of key=value pairs, defining the output type and options. + +Supported _keys_ are: +- **dest**: Destination path for exported output. Valid value is absolute or relative path, `-` means the standard output. +- **type**: Defines the type of output to be used. Valid values is documented below. + +Valid _type_ values are: +- **local**: write the resulting build files to a directory on the client-side. +- **tar**: write the resulting files as a single tarball (.tar). + +If no type is specified, the value defaults to **local**. +Alternatively, instead of a comma-separated sequence, the value of **--output** can be just a destination (in the **dest** format) (e.g. `--output some-path`, `--output -`) where `--output some-path` is treated as if **type=local** and `--output -` is treated as if **type=tar**. + + +[//]: # (BEGIN included file options/pid.image.md) +#### **--pid**=*pid* + +Sets the configuration for PID namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new PID namespace is created, or it can be "host" to indicate that the PID namespace in which `podman` itself is being run is reused, or it can be the path to a PID namespace which is already in use by another +process. + +[//]: # (END included file options/pid.image.md) + +#### **--platform**=*os/arch[/variant][,...]* + +Set the *os/arch* of the built image (and its base image, when using one) +to the provided value instead of using the current operating system and +architecture of the host (for example `linux/arm`). Unless overridden, +subsequent lookups of the same image in the local storage matches this +platform, regardless of the host. + +If `--platform` is set, then the values of the `--arch`, `--os`, and +`--variant` options is overridden. + +The `--platform` option can be specified more than once, or given a +comma-separated list of values as its argument. When more than one platform is +specified, the `--manifest` option is used instead of the `--tag` +option. + +Os/arch pairs are those used by the Go Programming Language. In several cases +the *arch* value for a platform differs from one produced by other tools such as +the `arch` command. Valid OS and architecture name combinations are listed as +values for $GOOS and $GOARCH at https://golang.org/doc/install/source#environment, +and can also be found by running `go tool dist list`. + +While `podman build` is happy to use base images and build images for any +platform that exists, `RUN` instructions are unable to succeed without +the help of emulation provided by packages like `qemu-user-static`. + + +[//]: # (BEGIN included file options/pull.image.md) +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Only pull the image when it does not exist in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error when no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. + +[//]: # (END included file options/pull.image.md) + + +[//]: # (BEGIN included file options/quiet.md) +#### **--quiet**, **-q** + +Suppress output messages which indicate which instruction is being processed, and of progress when pulling images from a registry, and when writing the output image. + +[//]: # (END included file options/quiet.md) + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + + +[//]: # (BEGIN included file options/rm.md) +#### **--rm** + +Remove intermediate containers after a successful build (default true). + +[//]: # (END included file options/rm.md) + + +[//]: # (BEGIN included file options/runtime.md) +#### **--runtime**=*path* + +The *path* to an alternate OCI-compatible runtime, which is used to run +commands specified by the **RUN** instruction. + +Note: You can also override the default runtime by setting the BUILDAH\_RUNTIME environment variable. `export BUILDAH_RUNTIME=/usr/local/bin/runc` + +[//]: # (END included file options/runtime.md) + + +[//]: # (BEGIN included file options/runtime-flag.md) +#### **--runtime-flag**=*flag* + +Adds global flags for the container runtime. To list the supported flags, please consult the manpages of the selected container runtime. + +Note: Do not pass the leading -- to the flag. To pass the runc flag --log-format json to buildah build, the option given is --runtime-flag log-format=json. + +[//]: # (END included file options/runtime-flag.md) + +#### **--sbom**=*preset* + +Generate SBOMs (Software Bills Of Materials) for the output image by scanning +the working container and build contexts using the named combination of scanner +image, scanner commands, and merge strategy. Must be specified with one or +more of **--sbom-image-output**, **--sbom-image-purl-output**, **--sbom-output**, +and **--sbom-purl-output**. Recognized presets, and the set of options which +they equate to: + + - "syft", "syft-cyclonedx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output cyclonedx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output cyclonedx-json={OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "syft-spdx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output spdx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output spdx-json={OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + - "trivy", "trivy-cyclonedx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "trivy-spdx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + +#### **--sbom-image-output**=*path* + +When generating SBOMs, store the generated SBOM in the specified path in the +output image. There is no default. + +#### **--sbom-image-purl-output**=*path* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the specified path in the output +image. There is no default. + +#### **--sbom-merge-strategy**=*method* + +If more than one **--sbom-scanner-command** value is being used, use the +specified method to merge the output from later commands with output from +earlier commands. Recognized values include: + + - cat + Concatenate the files. + - merge-cyclonedx-by-component-name-and-version + Merge the "component" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "version" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + - merge-spdx-by-package-name-and-versioninfo + Merge the "package" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "versionInfo" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + +#### **--sbom-output**=*file* + +When generating SBOMs, store the generated SBOM in the named file on the local +filesystem. There is no default. + +#### **--sbom-purl-output**=*file* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the named file in the local +filesystem. There is no default. + +#### **--sbom-scanner-command**=*image* + +Generate SBOMs by running the specified command from the scanner image. If +multiple commands are specified, they are run in the order in which they are +specified. These text substitutions are performed: + - {ROOTFS} + The root of the built image's filesystem, bind mounted. + - {CONTEXT} + The build context and additional build contexts, bind mounted. + - {OUTPUT} + The name of a temporary output file, to be read and merged with others or copied elsewhere. + +#### **--sbom-scanner-image**=*image* + +Generate SBOMs using the specified scanner image. + + +[//]: # (BEGIN included file options/secret.image.md) +#### **--secret**=**id=id[,src=*envOrFile*][,env=*ENV*][,type=*file* | *env*]** + +Pass secret information to be used in the Containerfile for building images +in a safe way that will not end up stored in the final image, or be seen in other stages. +The value of the secret will be read from an environment variable or file named +by the "id" option, or named by the "src" option if it is specified, or from an +environment variable specified by the "env" option. See [EXAMPLES](#examples). +The secret will be mounted in the container at `/run/secrets/id` by default. + +To later use the secret, use the --mount flag in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret` + +The location of the secret in the container can be overridden using the +"target", "dst", or "destination" option of the `RUN --mount` flag. + +`RUN --mount=type=secret,id=mysecret,target=/run/secrets/myothersecret cat /run/secrets/myothersecret` + +Note: changing the contents of secret files will not trigger a rebuild of layers that use said secrets. + +[//]: # (END included file options/secret.image.md) + + +[//]: # (BEGIN included file options/security-opt.image.md) +#### **--security-opt**=*option* + +Security Options + +- `apparmor=unconfined` : Turn off apparmor confinement for the container +- `apparmor=alternate-profile` : Set the apparmor confinement profile for the +container + +- `label=user:USER` : Set the label user for the container processes +- `label=role:ROLE` : Set the label role for the container processes +- `label=type:TYPE` : Set the label process type for the container processes +- `label=level:LEVEL` : Set the label level for the container processes +- `label=filetype\:TYPE` : Set the label file type for the container files +- `label=disable` : Turn off label separation for the container +- `no-new-privileges` : Disable container processes from gaining additional privileges + +- `seccomp=unconfined` : Turn off seccomp confinement for the container +- `seccomp=profile.json` : JSON file to be used as the seccomp filter for the container. + +[//]: # (END included file options/security-opt.image.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the container. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + +#### **--sign-by**=*fingerprint* + +Sign the image using a GPG key with the specified FINGERPRINT. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines,) + + +[//]: # (BEGIN included file options/skip-unused-stages.md) +#### **--skip-unused-stages** + +Skip stages in multi-stage builds which don't affect the target stage. (Default: **true**). + +[//]: # (END included file options/skip-unused-stages.md) + + +[//]: # (BEGIN included file options/squash.md) +#### **--squash** + +Squash all of the image's new layers into a single new layer; any preexisting layers are not squashed. + +[//]: # (END included file options/squash.md) + + +[//]: # (BEGIN included file options/squash-all.md) +#### **--squash-all** + +Squash all of the new image's layers (including those inherited from a base image) into a single new layer. + +[//]: # (END included file options/squash-all.md) + + +[//]: # (BEGIN included file options/ssh.md) +#### **--ssh**=*default* | *id[=socket>* + +SSH agent socket or keys to expose to the build. +The socket path can be left empty to use the value of `default=$SSH_AUTH_SOCK` + +To later use the ssh agent, use the --mount option in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=ssh,id=id mycmd` + +[//]: # (END included file options/ssh.md) + +#### **--stdin** + +Pass stdin into the RUN containers. Sometime commands being RUN within a Containerfile +want to request information from the user. For example apt asking for a confirmation for install. +Use --stdin to be able to interact from the terminal during the build. + + +[//]: # (BEGIN included file options/tag.md) +#### **--tag**, **-t**=*imageName* + +Specifies the name which is assigned to the resulting image if the build process completes successfully. +If _imageName_ does not include a registry name, the registry name *localhost* is prepended to the image name. + +[//]: # (END included file options/tag.md) + + +[//]: # (BEGIN included file options/target.md) +#### **--target**=*stageName* + +Set the target build stage to build. When building a Containerfile with multiple build stages, --target can be used to specify an intermediate build stage by name as the final stage for the resulting image. Commands after the target stage is skipped. + +[//]: # (END included file options/target.md) + + +[//]: # (BEGIN included file options/timestamp.md) +#### **--timestamp**=*seconds* + +Set the create timestamp to seconds since epoch to allow for deterministic builds (defaults to current time). By default, the created timestamp is changed and written into the image manifest with every commit, causing the image's sha256 hash to be different even if the sources are exactly the same otherwise. +When --timestamp is set, the created timestamp is always set to the time specified and therefore not changed, allowing the image's sha256 hash to remain the same. All files committed to the layers of the image is created with the timestamp. + +If the only instruction in a Containerfile is `FROM`, this flag has no effect. + +[//]: # (END included file options/timestamp.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/ulimit.image.md) +#### **--ulimit**=*type=soft-limit[\:hard-limit]* + +Specifies resource limits to apply to processes launched when processing `RUN` instructions. This option can be specified multiple times. Recognized resource types include: + "core": maximum core dump size (ulimit -c) + "cpu": maximum CPU time (ulimit -t) + "data": maximum size of a process's data segment (ulimit -d) + "fsize": maximum size of new files (ulimit -f) + "locks": maximum number of file locks (ulimit -x) + "memlock": maximum amount of locked memory (ulimit -l) + "msgqueue": maximum amount of data in message queues (ulimit -q) + "nice": niceness adjustment (nice -n, ulimit -e) + "nofile": maximum number of open files (ulimit -n) + "nproc": maximum number of processes (ulimit -u) + "rss": maximum size of a process's (ulimit -m) + "rtprio": maximum real-time scheduling priority (ulimit -r) + "rttime": maximum amount of real-time execution between blocking syscalls + "sigpending": maximum number of pending signals (ulimit -i) + "stack": maximum stack size (ulimit -s) + +[//]: # (END included file options/ulimit.image.md) + + +[//]: # (BEGIN included file options/unsetenv.image.md) +#### **--unsetenv**=*env* + +Unset environment variables from the final image. + +[//]: # (END included file options/unsetenv.image.md) + + +[//]: # (BEGIN included file options/unsetlabel.md) +#### **--unsetlabel**=*label* + +Unset the image label, causing the label not to be inherited from the base image. + +[//]: # (END included file options/unsetlabel.md) + + +[//]: # (BEGIN included file options/userns.image.md) +#### **--userns**=*how* + +Sets the configuration for user namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new user namespace is created, it can be "host" to indicate that the user namespace in which `podman` itself is being run is reused, or it can be the path to a user namespace which is already in use by another process. + +[//]: # (END included file options/userns.image.md) + + +[//]: # (BEGIN included file options/userns-gid-map.md) +#### **--userns-gid-map**=*mapping* + +Directly specifies a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container GID, a corresponding starting host-level GID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-gids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-gid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-gid-map are specified, but --userns-uid-map is specified, the GID map is set to use the same numeric values as the UID map. + +[//]: # (END included file options/userns-gid-map.md) + + +[//]: # (BEGIN included file options/userns-gid-map-group.md) +#### **--userns-gid-map-group**=*group* + +Specifies that a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subgid` file which correspond to the specified group. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-uid-map-user is specified, but --userns-gid-map-group is not specified, `podman` assumes that the specified user name is also a +suitable group name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. + +[//]: # (END included file options/userns-gid-map-group.md) + + +[//]: # (BEGIN included file options/userns-uid-map.md) +#### **--userns-uid-map**=*mapping* + +Directly specifies a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions default to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container UID, a corresponding starting host-level UID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-uids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-uid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-uid-map are specified, but --userns-gid-map is specified, the UID map is set to use the same numeric values as the GID map. + +[//]: # (END included file options/userns-uid-map.md) + + +[//]: # (BEGIN included file options/userns-uid-map-user.md) +#### **--userns-uid-map-user**=*user* + +Specifies that a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subuid` file which correspond to the specified user. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-gid-map-group is specified, but --userns-uid-map-user is not specified, `podman` assumes that the specified group name is also a +suitable user name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. + +[//]: # (END included file options/userns-uid-map-user.md) + + +[//]: # (BEGIN included file options/uts.md) +#### **--uts**=*how* + +Sets the configuration for UTS namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new UTS namespace to be created, or it can be "host" to indicate that the UTS namespace in which `podman` itself is being run is reused, or it can be the path to a UTS namespace which is already in use by another process. + +[//]: # (END included file options/uts.md) + +#### **--variant**=*variant* + +Set the architecture variant of the image to be built, and that of the base +image to be pulled, if the build uses one, to the provided value instead of +using the architecture variant of the build host. + + +[//]: # (BEGIN included file options/volume.image.md) +#### **--volume**, **-v**=*[HOST-DIR\:CONTAINER-DIR[\:OPTIONS]]* + +Mount a host directory into containers when executing RUN instructions during +the build. + +The `OPTIONS` are a comma-separated list and can be one or more of: + + * [rw|ro] + * [z|Z|O] + * [U] + * [`[r]shared`|`[r]slave`|`[r]private`][[1]](#Footnote1) + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR` +must be an absolute path as well. Podman bind-mounts the `HOST-DIR` to the +specified path when processing RUN instructions. + +You can specify multiple **-v** options to mount one or more mounts. + +You can add the `:ro` or `:rw` suffix to a volume to mount it read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted. When running using user namespaces, the UID and GID inside +the namespace may correspond to another UID and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the namespace, to change recursively the owner and group of +the source volume. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add one of these two suffixes +`:z` or `:Z` to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The `z` option tells Podman that two containers +share the volume content. As a result, Podman labels the content with a shared +content label. Shared volume labels allow all containers to read/write content. +The `Z` option tells Podman to label the content with a private unshared label. +Only the current container can use a private volume. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the host machine to fail. For these types +of containers, disabling SELinux separation is recommended. The option +`--security-opt label=disable` disables SELinux separation for the container. +For example, if a user wanted to volume mount their entire home directory into the build containers, they need to disable SELinux separation. + + $ podman build --security-opt label=disable -v $HOME:/home/user . + +`Overlay Volume Mounts` + +The `:O` flag tells Podman to mount the directory from the host as a +temporary storage using the Overlay file system. The `RUN` command containers +are allowed to modify contents within the mountpoint and are stored in the +container storage in a separate directory. In Overlay FS terms the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the `RUN` command +finishes executing, similar to a tmpfs mount point. + +Any subsequent execution of `RUN` commands sees the original source directory +content, any changes from previous RUN commands no longer exists. + +One use case of the `overlay` mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: + +- Overlay mounts are not currently supported in rootless mode. +- The `O` flag is not allowed to be specified with the `Z` or `z` flags. + Content mounted into the container is labeled with the private label. + On SELinux systems, labels in the source directory needs to be readable + by the container label. If not, SELinux container separation must be disabled + for the container to work. +- Modification of the directory volume mounted into the container with an + overlay mount can cause unexpected failures. Do not modify the directory until + the container finishes running. + +By default bind mounted volumes are `private`. That means any mounts done +inside containers are not be visible on the host and vice versa. This behavior +can be changed by specifying a volume mount propagation property. + +When the mount propagation policy is set to `shared`, any mounts completed +inside the container on that volume is visible to both the host and +container. When the mount propagation policy is set to `slave`, one way mount +propagation is enabled and any mounts completed on the host for that volume is +visible only inside of the container. To control the mount propagation +property of volume use the `:[r]shared`, `:[r]slave` or `:[r]private` +propagation flag. For mount propagation to work on the source mount point (mount +point where source dir is mounted on) has to have the right propagation properties. +For shared volumes, the source mount point has to be shared. And for slave volumes, +the source mount has to be either shared or slave. [[1]](#Footnote1) + +Use `df ` to determine the source mount and then use +`findmnt -o TARGET,PROPAGATION ` to determine propagation +properties of source mount, if `findmnt` utility is not available, the source +mount point can be determined by looking at the mount entry in +`/proc/self/mountinfo`. Look at `optional fields` and see if any propagation +properties are specified. +`shared:X` means the mount is `shared`, `master:X` means the mount is `slave` +and if nothing is there that means the mount is `private`. [[1]](#Footnote1) + +To change propagation properties of a mount point use the `mount` command. For +example, to bind mount the source directory `/foo` do +`mount --bind /foo /foo` and `mount --make-private --make-shared /foo`. This +converts /foo into a `shared` mount point. The propagation properties of +the source mount can be changed directly. For instance if `/` is the source +mount for `/foo`, then use `mount --make-shared /` to convert `/` into a +`shared` mount. + +[//]: # (END included file options/volume.image.md) + +## EXAMPLES + +### Build an image using local Containerfiles + +Build image using Containerfile with content from current directory: +``` +$ podman build . +``` + +Build image using specified Containerfile with content from current directory: +``` +$ podman build -f Containerfile.simple . +``` + +Build image using Containerfile from stdin with content from current directory: +``` +$ cat $HOME/Containerfile | podman build -f - . +``` + +Build image using multiple Containerfiles with content from current directory: +``` +$ podman build -f Containerfile.simple -f Containerfile.notsosimple . +``` + +Build image with specified Containerfile with content from $HOME directory. Note `cpp` is applied to Containerfile.in before processing as Containerfile: +``` +$ podman build -f Containerfile.in $HOME +``` + +Build image with the specified tag with Containerfile and content from current directory: +``` +$ podman build -t imageName . +``` + +Build image ignoring registry verification for any images pulled via the Containerfile: +``` +$ podman build --tls-verify=false -t imageName . +``` + +Build image with the specified logging format: +``` +$ podman build --runtime-flag log-format=json . +``` + +Build image using debug mode for logging: +``` +$ podman build --runtime-flag debug . +``` + +Build image using specified registry attributes when pulling images from the selected Containerfile: +``` +$ podman build --authfile /tmp/auths/myauths.json --cert-dir $HOME/auth --tls-verify=true --creds=username:password -t imageName -f Containerfile.simple . +``` + +Build image using specified resource controls when running containers during the build: +``` +$ podman build --memory 40m --cpu-period 10000 --cpu-quota 50000 --ulimit nofile=1024:1028 -t imageName . +``` + +Build image using specified SELinux labels and cgroup config running containers during the build: +``` +$ podman build --security-opt label=level:s0:c100,c200 --cgroup-parent /path/to/cgroup/parent -t imageName . +``` + +Build image with read-only and SELinux relabeled volume mounted from the host into running containers during the build: +``` +$ podman build --volume /home/test:/myvol:ro,Z -t imageName . +``` + +Build image with overlay volume mounted from the host into running containers during the build: +``` +$ podman build -v /var/lib/yum:/var/lib/yum\:O -t imageName . +``` + +Build image using layers and then removing intermediate containers even if the build fails. +``` +$ podman build --layers --force-rm -t imageName . +``` + +Build image ignoring cache and not removing intermediate containers even if the build succeeds: +``` +$ podman build --no-cache --rm=false -t imageName . +``` + +Build image using the specified network when running containers during the build: +``` +$ podman build --network mynet . +``` + +Build an image using a secret stored in an environment variable or file named `mysecret` to be used with the instruction `RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret`: +``` +$ podman build --secret=id=mysecret . +``` + +Build an image using a secret stored in an environment variable named `MYSECRET` to be used with the instruction `RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret`: +``` +$ podman build --secret=id=mysecret,env=MYSECRET . +$ podman build --secret=id=mysecret,src=MYSECRET,type=env . +``` + +Build an image using a secret stored in a file named `.mysecret` to be used with the instruction `RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret`: +``` +$ podman build --secret=id=mysecret,src=.mysecret . +$ podman build --secret=id=mysecret,src=.mysecret,type=file . +``` + +### Building a multi-architecture image using the --manifest option (requires emulation software) + +Build image using the specified architectures and link to a single manifest on successful completion: +``` +$ podman build --arch arm --manifest myimage /tmp/mysrc +$ podman build --arch amd64 --manifest myimage /tmp/mysrc +$ podman build --arch s390x --manifest myimage /tmp/mysrc +``` + +Similarly build using a single command +``` +$ podman build --platform linux/s390x,linux/ppc64le,linux/amd64 --manifest myimage /tmp/mysrc +``` + +Build image using multiple specified architectures and link to single manifest on successful completion: +``` +$ podman build --platform linux/arm64 --platform linux/amd64 --manifest myimage /tmp/mysrc +``` + +### Building an image using a URL, Git repo, or archive + + The build context directory can be specified as a URL to a Containerfile, a +Git repository, or URL to an archive. If the URL is a Containerfile, it is +downloaded to a temporary location and used as the context. When a Git +repository is set as the URL, the repository is cloned locally to a temporary +location and then used as the context. Lastly, if the URL is an archive, it is +downloaded to a temporary location and extracted before being used as the +context. + +#### Building an image using a URL to a Containerfile + +Build image from Containerfile downloaded into temporary location used as the build context: +``` +$ podman build https://10.10.10.1/podman/Containerfile +``` + +#### Building an image using a Git repository + + Podman clones the specified GitHub repository to a temporary location and +uses it as the context. The Containerfile at the root of the repository is used +and it only works if the GitHub repository is a dedicated repository. + +Build image from specified git repository downloaded into temporary location used as the build context: +``` +$ podman build -t hello https://github.com/containers/PodmanHello.git +$ podman run hello +``` + + Note: GitHub does not support using `git://` for performing `clone` operation due to recent changes in their security guidance (https://github.blog/2021-09-01-improving-git-protocol-security-github/). Use an `https://` URL if the source repository is hosted on GitHub. + +#### Building an image using a URL to an archive + + Podman fetches the archive file, decompresses it, and uses its contents as the +build context. The Containerfile at the root of the archive and the rest of the +archive are used as the context of the build. Passing the +`-f PATH/Containerfile` option as well tells the system to look for that file +inside the contents of the archive. + +``` +$ podman build -f dev/Containerfile https://10.10.10.1/podman/context.tar.gz +``` + + Note: supported compression formats are 'xz', 'bzip2', 'gzip' and 'identity' +(no compression). + +## Files + +### .containerignore/.dockerignore + +If the file *.containerignore* or *.dockerignore* exists in the context directory, +`podman build` reads its contents. Use the `--ignorefile` option to override the +.containerignore path location. +Podman uses the content to exclude files and directories from the context +directory, when executing COPY and ADD directives in the +Containerfile/Dockerfile + +The .containerignore and .dockerignore files use the same syntax; if both +are in the context directory, podman build only uses .containerignore. + +Users can specify a series of Unix shell globs in a .containerignore file to +identify files/directories to exclude. + +Podman supports a special wildcard string `**` which matches any number of +directories (including zero). For example, **/*.go excludes all files that +end with .go that are found in all directories. + +Example .containerignore file: + +``` +# exclude this content for image +*/*.c +**/output* +src +``` + +`*/*.c` +Excludes files and directories whose names ends with .c in any top level +subdirectory. For example, the source file include/rootless.c. + +`**/output*` +Excludes files and directories starting with `output` from any directory. + +`src` +Excludes files named src and the directory src as well as any content in it. + +Lines starting with ! (exclamation mark) can be used to make exceptions to +exclusions. The following is an example .containerignore file that uses this +mechanism: +``` +*.doc +!Help.doc +``` + +Exclude all doc files except Help.doc from the image. + +This functionality is compatible with the handling of .containerignore files +described here: **[containerignore(5)](https://github.com/containers/common/blob/main/docs/containerignore.5.md)** + +### registries.conf (`/etc/containers/registries.conf`) + +registries.conf is the configuration file which specifies which container +registries is consulted when completing image names which do not include +a registry or domain portion. +See **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + + +## Troubleshooting + +### lastlog sparse file + +Using a useradd command within a Containerfile with a large UID/GID creates +a large sparse file `/var/log/lastlog`. This can cause the +build to hang forever. Go language does not support sparse files correctly, +which can lead to some huge files being created in the container image. + +When using the `useradd` command within the build script, pass the +`--no-log-init or -l` option to the `useradd` command. This option tells +useradd to stop creating the lastlog file. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/main/man/runc.8.md)**, **[useradd(8)](https://www.unix.com/man-page/redhat/8/useradd)**, **[podman-ps(1)](podman-ps.1.md)**, **[podman-rm(1)](podman-rm.1.md)**, **[Containerfile(5)](https://github.com/containers/common/blob/main/docs/Containerfile.5.md)**, **[containerignore(5)](https://github.com/containers/common/blob/main/docs/containerignore.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +See [podman-rootless(7)](https://github.com/containers/podman/blob/main/rootless.md) +for rootless issues. + +## HISTORY +Aug 2020, Additional options and .containerignore added by Dan Walsh `` + +May 2018, Minor revisions added by Joe Doss `` + +December 2017, Originally compiled by Tom Sweeney `` + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a +core value of open source. The `master` and `slave` mount propagation +terminology used here is problematic and divisive, and needs to be changed. +However, these terms are currently used within the Linux kernel and must be +used as-is at this time. When the kernel maintainers rectify this usage, +Podman will follow suit immediately. diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-commit.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-commit.1.md new file mode 100644 index 000000000..cd4b156d1 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-commit.1.md @@ -0,0 +1,139 @@ +--- +title: podman-commit +version: v5.5.0 +--- + +% podman-commit 1 + +## NAME +podman\-commit - Create new image based on the changed container + +## SYNOPSIS +**podman commit** [*options*] *container* [*image*] + +**podman container commit** [*options*] *container* [*image*] + +## DESCRIPTION +**podman commit** creates an image based on a changed *container*. The author of the image can be set using the **--author** OPTION. Various image instructions can be configured with the **--change** OPTION and a commit message can be set using the **--message** OPTION. The *container* and its processes aren't paused while the image is committed. If this is not desired, the **--pause** OPTION can be set to *true*. When the commit is complete, Podman prints out the ID of the new image. + +If `image` does not begin with a registry name component, `localhost` is added to the name. +If `image` is not provided, the values for the `REPOSITORY` and `TAG` values of the created image is set to ``. + +## OPTIONS +#### **--author**, **-a**=*author* + +Set the author for the committed image. + +#### **--change**, **-c**=*instruction* + +Apply the following possible instructions to the created image: + +- *CMD* +- *ENTRYPOINT* +- *ENV* +- *EXPOSE* +- *LABEL* +- *ONBUILD* +- *STOPSIGNAL* +- *USER* +- *VOLUME* +- *WORKDIR* + +Can be set multiple times. + +#### **--config**=*ConfigBlobFile* + +Merge the container configuration from the specified file into the configuration for the image +as it is being committed. The file contents should be a JSON-encoded version of +a Schema2Config structure, which is defined at +https://github.com/containers/image/blob/v5.29.0/manifest/docker_schema2.go#L67. + +#### **--format**, **-f**=**oci** | *docker* + +Set the format of the image manifest and metadata. The currently supported formats are **oci** and *docker*.\ +The default is **oci**. + +#### **--iidfile**=*ImageIDfile* + +Write the image ID to the file. + +#### **--include-volumes** + +Include in the committed image any volumes added to the container by the **--volume** or **--mount** OPTIONS to the **[podman create](podman-create.1.md)** and **[podman run](podman-run.1.md)** commands.\ +The default is **false**. + +#### **--message**, **-m**=*message* + +Set commit message for committed image.\ +*IMPORTANT: The message field is not supported in `oci` format.* + +#### **--pause**, **-p** + +Pause the container when creating an image.\ +The default is **false**. + +#### **--quiet**, **-q** + +Suppresses output.\ +The default is **false**. + +#### **--squash**, **-s** + +Squash newly built layers into a single new layer.\ +The default is **false**. + +## EXAMPLES +Create image from container with entrypoint and label: +``` +$ podman commit --change CMD=/bin/bash --change ENTRYPOINT=/bin/sh --change "LABEL blue=image" reverent_golick image-committed +Getting image source signatures +Copying blob sha256:b41deda5a2feb1f03a5c1bb38c598cbc12c9ccd675f438edc6acd815f7585b86 + 25.80 MB / 25.80 MB [======================================================] 0s +Copying config sha256\:c16a6d30f3782288ec4e7521c754acc29d37155629cb39149756f486dae2d4cd + 448 B / 448 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Create image from container with commit message: +``` +$ podman commit -q --message "committing container to image" +reverent_golick image-committed +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Create image from container with author: +``` +$ podman commit -q --author "firstName lastName" reverent_golick image-committed +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Pause running container while creating image: +``` +$ podman commit -q --pause=true containerID image-committed +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Create image from container with default image tag: +``` +$ podman commit containerID +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Create image from container with default required capabilities: +``` +$ podman commit -q --change LABEL=io.containers.capabilities=setuid,setgid epic_nobel privimage +400d31a3f36dca751435e80a0e16da4859beb51ff84670ce6bdc5edb30b94066 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-create(1)](podman-create.1.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +December 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-completion.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-completion.1.md new file mode 100644 index 000000000..242d6f55d --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-completion.1.md @@ -0,0 +1,83 @@ +--- +title: podman-completion +version: v5.5.0 +--- + +% podman-completion 1 + +## NAME +podman\-completion - Generate shell completion scripts + +## SYNOPSIS +**podman completion** [*options*] *bash* | *zsh* | *fish* | *powershell* + +## DESCRIPTION +**podman completion** generates shell completion scripts for a variety of shells. Supported shells are *bash*, *zsh*, *fish* and *powershell*. + +These script are used by the shell to provide suggestions and complete commands when the command is typed and `[TAB]` is pressed. + +Usually these scripts are automatically installed via the package manager. + +## OPTIONS +#### **--file**, **-f**=*file* + +Write the generated output to a file. + +#### **--no-desc** + +Do not provide description in the completions.\ +The default is **false**. + +## Installation + +### BASH +`bash-completion` has to be installed on the system. + +To load the completion script into the current session run: +``` +source <(podman completion bash) +``` + +To make it available for all bash sessions run: +``` +podman completion -f /etc/bash_completion.d/podman bash +``` + + +### ZSH +Shell completion needs to be already enabled in the environment. The following can be executed: +``` +echo "autoload -U compinit; compinit" >> ~/.zshrc +``` + +To make it available for all zsh sessions run: +``` +podman completion -f "${fpath[1]}/_podman" zsh +``` + +Once the shell is reloaded the auto-completion works. + + +### FISH +To load the completion script into the current session run: +``` +podman completion fish | source +``` + +To make it available for all fish sessions run: +``` +podman completion -f ~/.config/fish/completions/podman.fish fish +``` + +### POWERSHELL +To load the completion script into the current session run: +``` +podman.exe completion powershell | Out-String | Invoke-Expression +``` + +To make it available in all powershell sessions that a user has, write the +completion output to a file and source that to the user's powershell profile. +More information about profiles is available with **Get-Help about_Profiles**. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **zsh(1)**, **fish(1)**, **powershell(1)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-compose.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-compose.1.md new file mode 100644 index 000000000..0ac48827b --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-compose.1.md @@ -0,0 +1,28 @@ +--- +title: podman-compose +version: v5.5.0 +--- + +% podman-compose 1 + +## NAME +podman\-compose - Run Compose workloads via an external compose provider + +## SYNOPSIS +**podman compose** [*options*] [*command* [*arg* ...]] + +## DESCRIPTION +**podman compose** is a thin wrapper around an external compose provider such as docker-compose or podman-compose. This means that `podman compose` is executing another tool that implements the compose functionality but sets up the environment in a way to let the compose provider communicate transparently with the local Podman socket. The specified options as well the command and argument are passed directly to the compose provider. + +The default compose providers are `docker-compose` and `podman-compose`. If installed, `docker-compose` takes precedence since it is the original implementation of the Compose specification and is widely used on the supported platforms (i.e., Linux, Mac OS, Windows). + +If you want to change the default behavior or have a custom installation path for your provider of choice, please change the `compose_providers` field in `containers.conf(5)` to `compose_providers = ["/path/to/provider"]`. You may also set the `PODMAN_COMPOSE_PROVIDER` environment variable. + +By default, `podman compose` will emit a warning saying that it executes an external command. This warning can be disabled by setting `compose_warning_logs` to false in `containers.conf(5)` or setting the `PODMAN_COMPOSE_WARNING_LOGS` environment variable to false. See the man page for `containers.conf(5)` for more information. + +## OPTIONS + +To see supported options of the installed compose provider, please run `podman compose --help`. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-container-checkpoint.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-container-checkpoint.1.md new file mode 100644 index 000000000..1e4bd46ec --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-container-checkpoint.1.md @@ -0,0 +1,231 @@ +--- +title: podman-container-checkpoint +version: v5.5.0 +--- + +% podman-container-checkpoint 1 + +## NAME +podman\-container\-checkpoint - Checkpoint one or more running containers + +## SYNOPSIS +**podman container checkpoint** [*options*] *container* [*container* ...] + +## DESCRIPTION +**podman container checkpoint** checkpoints all the processes in one or more *containers*. A *container* can be restored from a checkpoint with **[podman-container-restore](podman-container-restore.1.md)**. The *container IDs* or *names* are used as input. + +*IMPORTANT: If the container is using __systemd__ as __entrypoint__ checkpointing the container might not be possible.* + +## OPTIONS +#### **--all**, **-a** + +Checkpoint all running *containers*.\ +The default is **false**.\ +*IMPORTANT: This OPTION does not need a container name or ID as input argument.* + +#### **--compress**, **-c**=**zstd** | *none* | *gzip* + +Specify the compression algorithm used for the checkpoint archive created +with the **--export, -e** OPTION. Possible algorithms are **zstd**, *none* +and *gzip*.\ +One possible reason to use *none* is to enable faster creation of checkpoint +archives. Not compressing the checkpoint archive can result in faster checkpoint +archive creation.\ +The default is **zstd**. + +#### **--create-image**=*image* + +Create a checkpoint image from a running container. This is a standard OCI image +created in the local image store. It consists of a single layer that contains +all of the checkpoint files. The content of this image layer is in the same format as a +checkpoint created with **--export**. A checkpoint image can be pushed to a +standard container registry and pulled on a different system to enable container +migration. In addition, the image can be exported with **podman image save** and +inspected with **podman inspect**. Inspecting a checkpoint image displays +additional information, stored as annotations, about the host environment used +to do the checkpoint: + +- **io.podman.annotations.checkpoint.name**: Human-readable name of the original + container. + +- **io.podman.annotations.checkpoint.rawImageName**: Unprocessed name of the + image used to create the original container (as specified by the user). + +- **io.podman.annotations.checkpoint.rootfsImageID**: ID of the image used to + create the original container. + +- **io.podman.annotations.checkpoint.rootfsImageName**: Image name used to + create the original container. + +- **io.podman.annotations.checkpoint.podman.version**: Version of Podman used to + create the checkpoint. + +- **io.podman.annotations.checkpoint.criu.version**: Version of CRIU used to + create the checkpoint. + +- **io.podman.annotations.checkpoint.runtime.name**: Container runtime (e.g., + runc, crun) used to create the checkpoint. + +- **io.podman.annotations.checkpoint.runtime.version**: Version of the container + runtime used to create the checkpoint. + +- **io.podman.annotations.checkpoint.conmon.version**: Version of conmon used + with the original container. + +- **io.podman.annotations.checkpoint.host.arch**: CPU architecture of the host + on which the checkpoint was created. + +- **io.podman.annotations.checkpoint.host.kernel**: Version of Linux kernel + of the host where the checkpoint was created. + +- **io.podman.annotations.checkpoint.cgroups.version**: cgroup version used by + the host where the checkpoint was created. + +- **io.podman.annotations.checkpoint.distribution.version**: Version of host + distribution on which the checkpoint was created. + +- **io.podman.annotations.checkpoint.distribution.name**: Name of host + distribution on which the checkpoint was created. + +#### **--export**, **-e**=*archive* + +Export the checkpoint to a tar.gz file. The exported checkpoint can be used +to import the *container* on another system and thus enabling container live +migration. This checkpoint archive also includes all changes to the *container's* +root file-system, if not explicitly disabled using **--ignore-rootfs**. + +#### **--file-locks** + +Checkpoint a *container* with file locks. If an application running in the container +is using file locks, this OPTION is required during checkpoint and restore. Otherwise +checkpointing *containers* with file locks is expected to fail. If file locks are not +used, this option is ignored.\ +The default is **false**. + +#### **--ignore-rootfs** + +If a checkpoint is exported to a tar.gz file it is possible with the help of **--ignore-rootfs** to explicitly disable including changes to the root file-system into the checkpoint archive file.\ +The default is **false**.\ +*IMPORTANT: This OPTION only works in combination with __--export, -e__.* + +#### **--ignore-volumes** + +This OPTION must be used in combination with the **--export, -e** OPTION. +When this OPTION is specified, the content of volumes associated with +the *container* is not included into the checkpoint tar.gz file.\ +The default is **false**. + +#### **--keep**, **-k** + +Keep all temporary log and statistics files created by CRIU during checkpointing. These files are not deleted if checkpointing fails for further debugging. If checkpointing succeeds these files are theoretically not needed, but if these files are needed Podman can keep the files for further analysis.\ +The default is **false**. + +#### **--latest**, **-l** + +Instead of providing the *container ID* or *name*, use the last created *container*. The default is **false**. +*IMPORTANT: This OPTION is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines. This OPTION does not need a container name or ID as input argument.* + +#### **--leave-running**, **-R** + +Leave the *container* running after checkpointing instead of stopping it.\ +The default is **false**. + +#### **--pre-checkpoint**, **-P** + +Dump the *container's* memory information only, leaving the *container* running. Later +operations supersedes prior dumps. It only works on `runc 1.0-rc3` or `higher`.\ +The default is **false**. + +The functionality to only checkpoint the memory of the container and in a second +checkpoint only write out the memory pages which have changed since the first +checkpoint relies on the Linux kernel's soft-dirty bit, which is not available +on all systems as it depends on the system architecture and the configuration +of the Linux kernel. Podman verifies if the current system supports this +functionality and return an error if the current system does not support it. + +#### **--print-stats** + +Print out statistics about checkpointing the container(s). The output is +rendered in a JSON array and contains information about how much time different +checkpoint operations required. Many of the checkpoint statistics are created +by CRIU and just passed through to Podman. The following information is provided +in the JSON array: + +- **podman_checkpoint_duration**: Overall time (in microseconds) needed to create + all checkpoints. + +- **runtime_checkpoint_duration**: Time (in microseconds) the container runtime + needed to create the checkpoint. + +- **freezing_time**: Time (in microseconds) CRIU needed to pause (freeze) all + processes in the container (measured by CRIU). + +- **frozen_time**: Time (in microseconds) all processes in the container were + paused (measured by CRIU). + +- **memdump_time**: Time (in microseconds) needed to extract all required memory + pages from all container processes (measured by CRIU). + +- **memwrite_time**: Time (in microseconds) needed to write all required memory + pages to the corresponding checkpoint image files (measured by CRIU). + +- **pages_scanned**: Number of memory pages scanned to determine if they need + to be checkpointed (measured by CRIU). + +- **pages_written**: Number of memory pages actually written to the checkpoint + image files (measured by CRIU). + +The default is **false**. + +#### **--tcp-established** + +Checkpoint a *container* with established TCP connections. If the checkpoint +image contains established TCP connections, this OPTION is required during +restore. Defaults to not checkpointing *containers* with established TCP +connections.\ +The default is **false**. + +#### **--with-previous** + +Check out the *container* with previous criu image files in pre-dump. It only works on `runc 1.0-rc3` or `higher`.\ +The default is **false**.\ +*IMPORTANT: This OPTION is not available with __--pre-checkpoint__*. + +This option requires that the option __--pre-checkpoint__ has been used before on the +same container. Without an existing pre-checkpoint, this option fails. + +Also see __--pre-checkpoint__ for additional information about __--pre-checkpoint__ +availability on different systems. + +## EXAMPLES +Make a checkpoint for the container "mywebserver". +``` +# podman container checkpoint mywebserver +``` + +Create a checkpoint image for the container "mywebserver". +``` +# podman container checkpoint --create-image mywebserver-checkpoint-1 mywebserver +``` + +Dumps the container's memory information of the latest container into an archive. +``` +# podman container checkpoint -P -e pre-checkpoint.tar.gz -l +``` + +Keep the container's memory information from an older dump and add the new container's memory information. +``` +# podman container checkpoint --with-previous -e checkpoint.tar.gz -l +``` + +Dump the container's memory information of the latest container into an archive with the specified compress method. +``` +# podman container checkpoint -l --compress=none --export=dump.tar +# podman container checkpoint -l --compress=gzip --export=dump.tar.gz +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container-restore(1)](podman-container-restore.1.md)**, **criu(8)** + +## HISTORY +September 2018, Originally compiled by Adrian Reber diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-container-cleanup.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-container-cleanup.1.md new file mode 100644 index 000000000..011de2b2d --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-container-cleanup.1.md @@ -0,0 +1,61 @@ +--- +title: podman-container-cleanup +version: v5.5.0 +--- + +% podman-container-cleanup 1 + +## NAME +podman\-container\-cleanup - Clean up the container's network and mountpoints + +## SYNOPSIS +**podman container cleanup** [*options*] *container* [*container* ...] + +## DESCRIPTION +**podman container cleanup** cleans up exited *containers* by removing all mountpoints and network configurations from the host. The *container name* or *ID* can be used. The cleanup command does not remove the *containers*. Running *containers* are not cleaned up.\ +Sometimes container mount points and network stacks can remain if the podman command was killed or the *container* ran in daemon mode. This command is automatically executed when *containers* are run in daemon mode by the `conmon process` when the *container* exits. + +## OPTIONS +#### **--all**, **-a** + +Clean up all *containers*.\ +The default is **false**.\ +*IMPORTANT: This OPTION does not need a container name or ID as input argument.* + +#### **--exec**=*session* + +Clean up an exec session for a single *container*. +It can only be specified if a single *container* is being cleaned up (conflicts with **--all** as such). If **--rm** is not specified, temporary files for the exec session are cleaned up; if it is, the exec session is removed from the *container*.\ +*IMPORTANT: Conflicts with **--rmi** as the container is not being cleaned up so the image cannot be removed.* + +#### **--latest**, **-l** + +Instead of providing the *container ID* or *name*, use the last created *container*. The default is **false**. +*IMPORTANT: This OPTION is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines. This OPTION does not need a container name or ID as input argument.* + +#### **--rm** + +After cleanup, remove the *container* entirely.\ +The default is **false**. + +#### **--rmi** + +After cleanup, remove the image entirely.\ +The default is **false**. + +## EXAMPLES +Clean up the container "mywebserver". +``` +$ podman container cleanup mywebserver +``` + +Clean up the containers with the names "mywebserver", "myflaskserver", "860a4b23". +``` +$ podman container cleanup mywebserver myflaskserver 860a4b23 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)** + +## HISTORY +Jun 2018, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-container-clone.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-container-clone.1.md new file mode 100644 index 000000000..3bd42d082 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-container-clone.1.md @@ -0,0 +1,362 @@ +--- +title: podman-container-clone +version: v5.5.0 +--- + +% podman-container-clone 1 + +## NAME +podman\-container\-clone - Create a copy of an existing container + +## SYNOPSIS +**podman container clone** [*options*] *container* *name* *image* + +## DESCRIPTION +**podman container clone** creates a copy of a container, recreating the original with an identical configuration. This command takes three arguments: the first being the container ID or name to clone, the second argument in this command can change the name of the clone from the default of $ORIGINAL_NAME-clone, and the third is a new image to use in the cloned container. + +## OPTIONS + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + +If none is specified, the original container's cpu period is used + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + +If none is specified, the original container's CPU quota are used. + + +[//]: # (BEGIN included file options/cpu-rt-period.md) +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-period.md) + +If none is specified, the original container's CPU runtime period is used. + + +[//]: # (BEGIN included file options/cpu-rt-runtime.md) +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-runtime.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + +If none are specified, the original container's CPU shares are used. + +#### **--cpus** + +Set a number of CPUs for the container that overrides the original containers CPU limits. If none are specified, the original container's Nano CPUs are used. + +This is shorthand +for **--cpu-period** and **--cpu-quota**, so only **--cpus** or either both the **--cpu-period** and **--cpu-quota** options can be set. + +This option is not supported on cgroups V1 rootless systems. + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + +If none are specified, the original container's CPUset is used. + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + +If none are specified, the original container's CPU memory nodes are used. + + +[//]: # (BEGIN included file options/destroy.md) +#### **--destroy** + +Remove the original container that we are cloning once used to mimic the configuration. + +[//]: # (END included file options/destroy.md) + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + +#### **--force**, **-f** + +Force removal of the original container that we are cloning. Can only be used in conjunction with **--destroy**. + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + +If no memory limits are specified, the original container's memory limits are used. + + +[//]: # (BEGIN included file options/memory-reservation.md) +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-reservation.md) + +If unspecified, memory reservation is the same as memory limit from the +container being cloned. + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + +If unspecified, the container being cloned is used to derive +the swap value. + + +[//]: # (BEGIN included file options/memory-swappiness.md) +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/memory-swappiness.md) + +#### **--name** + +Set a custom name for the cloned container. The default if not specified is of the syntax: **\-clone** + +#### **--pod**=*name* + +Clone the container in an existing pod. It is helpful to move a container to an +existing pod. The container joins the pod shared namespaces, losing its configuration +that conflicts with the shared namespaces. + +#### **--run** + +When set to true, this flag runs the newly created container after the +clone process has completed, this specifies a detached running mode. + +## EXAMPLES + +Clone specified container into a new container: +``` +# podman container clone d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone specified container into a newly named container: +``` +# podman container clone --name=clone d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Replace specified container with selected resource constraints into a new container, removing original container: +``` +# podman container clone --destroy --cpus=5 d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone specified container giving a new name and then replacing the image of the original container with the specified image name: +``` +# podman container clone 2d4d4fca7219b4437e0d74fcdc272c4f031426a6eacd207372691207079551de new_name fedora +Resolved "fedora" as an alias (/etc/containers/registries.conf.d/shortnames.conf) +Trying to pull registry.fedoraproject.org/fedora\:latest... +Getting image source signatures +Copying blob c6183d119aa8 done +Copying config e417cd49a8 done +Writing manifest to image destination +Storing signatures +5a9b7851013d326aa4ac4565726765901b3ecc01fcbc0f237bc7fd95588a24f9 +``` + +## SEE ALSO +**[podman-create(1)](podman-create.1.md)**, **[cgroups(7)](https://man7.org/linux/man-pages/man7/cgroups.7.html)** + +## HISTORY +January 2022, Originally written by Charlie Doern diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-container-diff.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-container-diff.1.md new file mode 100644 index 000000000..9ef7a18f6 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-container-diff.1.md @@ -0,0 +1,65 @@ +--- +title: podman-container-diff +version: v5.5.0 +--- + +% podman-container-diff 1 + +## NAME +podman\-container\-diff - Inspect changes on a container's filesystem + +## SYNOPSIS +**podman container diff** [*options*] *container* [*container*] + +## DESCRIPTION +Displays changes on a container's filesystem. The container is compared to its parent layer or the second argument when given. + +The output is prefixed with the following symbols: + +| Symbol | Description | +|--------|-------------| +| A | A file or directory was added. | +| D | A file or directory was deleted. | +| C | A file or directory was changed. | + +## OPTIONS + +#### **--format** + +Alter the output into a different format. The only valid format for **podman container diff** is `json`. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +``` +# podman container diff container1 +C /usr +C /usr/local +C /usr/local/bin +A /usr/local/bin/docker-entrypoint.sh +``` + +``` +$ podman container diff --format json container1 container2 +{ + "added": [ + "/test" + ] +} +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)** + +## HISTORY +July 2021, Originally compiled by Paul Holzinger diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-container-exists.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-container-exists.1.md new file mode 100644 index 000000000..0bd0534ca --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-container-exists.1.md @@ -0,0 +1,56 @@ +--- +title: podman-container-exists +version: v5.5.0 +--- + +% podman-container-exists 1 + +## NAME +podman\-container\-exists - Check if a container exists in local storage + +## SYNOPSIS +**podman container exists** [*options*] *container* + +## DESCRIPTION +**podman container exists** checks if a container exists in local storage. The *container ID* or *name* is used as input. Podman returns an exit code +of `0` when the container is found. A `1` is returned otherwise. An exit code of `125` indicates there was an issue accessing the local storage. + +## OPTIONS +#### **--external** + +Check for external *containers* as well as Podman *containers*. These external *containers* are generally created via other container technology such as `Buildah` or `CRI-O`.\ +The default is **false**. + +**-h**, **--help** + +Prints usage statement.\ +The default is **false**. + +## EXAMPLES + +Check if a container called "webclient" exists in local storage. Here, the container does exist. +``` +$ podman container exists webclient +$ echo $? +0 +``` + +Check if a container called "webbackend" exists in local storage. Here, the container does not exist. +``` +$ podman container exists webbackend +$ echo $? +1 +``` + +Check if a container called "ubi8-working-container" created via Buildah exists in local storage. Here, the container does not exist. +``` +$ podman container exists --external ubi8-working-container +$ echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +November 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-container-inspect.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-container-inspect.1.md new file mode 100644 index 000000000..b4e04c34d --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-container-inspect.1.md @@ -0,0 +1,349 @@ +--- +title: podman-container-inspect +version: v5.5.0 +--- + +% podman-container-inspect 1 + +## NAME +podman\-container\-inspect - Display a container's configuration + +## SYNOPSIS +**podman container inspect** [*options*] *container* [*container* ...] + +## DESCRIPTION + +This displays the low-level information on containers identified by name or ID. By default, this renders +all results in a JSON array. If a format is specified, the given template is executed for each result. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Format the output using the given Go template. +The keys of the returned JSON can be used as the values for the --format flag (see examples below). + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------------ | -------------------------------------------------- | +| .AppArmorProfile | AppArmor profile (string) | +| .Args | Command-line arguments (array of strings) | +| .BoundingCaps | Bounding capability set (array of strings) | +| .Config ... | Structure with config info | +| .ConmonPidFile | Path to file containing conmon pid (string) | +| .Created ... | Container creation time (string, ISO3601) | +| .Dependencies | Dependencies (array of strings) | +| .Driver | Storage driver (string) | +| .EffectiveCaps | Effective capability set (array of strings) | +| .ExecIDs | Exec IDs (array of strings) | +| .GraphDriver ... | Further details of graph driver (struct) | +| .HostConfig ... | Host config details (struct) | +| .HostnamePath | Path to file containing hostname (string) | +| .HostsPath | Path to container /etc/hosts file (string) | +| .ID | Container ID (full 64-char hash) | +| .Image | Container image ID (64-char hash) | +| .ImageDigest | Container image digest (sha256:+64-char hash) | +| .ImageName | Container image name (string) | +| .IsInfra | Is this an infra container? (string: true/false) | +| .IsService | Is this a service container? (string: true/false) | +| .KubeExitCodePropagation | Kube exit-code propagation (string) | +| .LockNumber | Number of the container's Libpod lock | +| .MountLabel | SELinux label of mount (string) | +| .Mounts | Mounts (array of strings) | +| .Name | Container name (string) | +| .Namespace | Container namespace (string) | +| .NetworkSettings ... | Network settings (struct) | +| .OCIConfigPath | Path to OCI config file (string) | +| .OCIRuntime | OCI runtime name (string) | +| .Path | Path to container command (string) | +| .PidFile | Path to file containing container PID (string) | +| .Pod | Parent pod (string) | +| .ProcessLabel | SELinux label of process (string) | +| .ResolvConfPath | Path to container's resolv.conf file (string) | +| .RestartCount | Number of times container has been restarted (int) | +| .Rootfs | Container rootfs (string) | +| .SizeRootFs | Size of rootfs, in bytes [1] | +| .SizeRw | Size of upper (R/W) container layer, in bytes [1] | +| .State ... | Container state info (struct) | +| .StaticDir | Path to container metadata dir (string) | +| .UseImageHostname | Use /etc/hostname from the image if it exists? (string: true/false) +| +| .UseImageHosts | Use /etc/hosts from the image? (string: true/false) +| + +[1] This format specifier requires the **--size** option + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--size**, **-s** + +In addition to normal output, display the total file size if the type is a container. + + +## EXAMPLE + +Inspect the specified container and print its information in json format. +``` +$ podman container inspect foobar +[ + { + "Id": "99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6", + "Created": "2021-09-16T06:09:08.936623325-04:00", + "Path": "echo", + "Args": [ + "hi" + ], + "State": { + "OciVersion": "1.0.2-dev", + "Status": "exited", + "Running": false, + "Paused": false, + "Restarting": false, + "OOMKilled": false, + "Dead": false, + "Pid": 0, + "ExitCode": 0, + "Error": "", + "StartedAt": "2021-09-16T06:09:09.033564436-04:00", + "FinishedAt": "2021-09-16T06:09:09.036184314-04:00", + "Healthcheck": { + "Status": "", + "FailingStreak": 0, + "Log": null + } + }, + "Image": "14119a10abf4669e8cdbdff324a9f9605d99697215a0d21c360fe8dfa8471bab", + "ImageName": "docker.io/library/alpine:latest", + "Rootfs": "", + "Pod": "", + "ResolvConfPath": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/resolv.conf", + "HostnamePath": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/hostname", + "HostsPath": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/hosts", + "StaticDir": "/home/dwalsh/.local/share/containers/storage/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata", + "OCIConfigPath": "/home/dwalsh/.local/share/containers/storage/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/config.json", + "OCIRuntime": "crun", + "ConmonPidFile": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/conmon.pid", + "PidFile": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/pidfile", + "Name": "foobar", + "RestartCount": 0, + "Driver": "overlay", + "MountLabel": "system_u:object_r:container_file_t:s0:c25,c695", + "ProcessLabel": "system_u:system_r:container_t:s0:c25,c695", + "AppArmorProfile": "", + "EffectiveCaps": [ + "CAP_CHOWN", + "CAP_DAC_OVERRIDE", + "CAP_FOWNER", + "CAP_FSETID", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_SETFCAP", + "CAP_SETGID", + "CAP_SETPCAP", + "CAP_SETUID", + ], + "BoundingCaps": [ + "CAP_CHOWN", + "CAP_DAC_OVERRIDE", + "CAP_FOWNER", + "CAP_FSETID", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_SETFCAP", + "CAP_SETGID", + "CAP_SETPCAP", + "CAP_SETUID", + ], + "ExecIDs": [], + "GraphDriver": { + "Name": "overlay", + "Data": { + "LowerDir": "/home/dwalsh/.local/share/containers/storage/overlay/e2eb06d8af8218cfec8210147357a68b7e13f7c485b991c288c2d01dc228bb68/diff", + "UpperDir": "/home/dwalsh/.local/share/containers/storage/overlay/8f3d70434a3db17410ec4710caf4f251f3e4ed0a96a08124e4b3d4af0a0ea300/diff", + "WorkDir": "/home/dwalsh/.local/share/containers/storage/overlay/8f3d70434a3db17410ec4710caf4f251f3e4ed0a96a08124e4b3d4af0a0ea300/work" + } + }, + "Mounts": [], + "Dependencies": [], + "NetworkSettings": { + "EndpointID": "", + "Gateway": "", + "IPAddress": "", + "IPPrefixLen": 0, + "IPv6Gateway": "", + "GlobalIPv6Address": "", + "GlobalIPv6PrefixLen": 0, + "MacAddress": "", + "Bridge": "", + "SandboxID": "", + "HairpinMode": false, + "LinkLocalIPv6Address": "", + "LinkLocalIPv6PrefixLen": 0, + "Ports": {}, + "SandboxKey": "" + }, + "Namespace": "", + "IsInfra": false, + "Config": { + "Hostname": "99f66530fe9c", + "Domainname": "", + "User": "", + "AttachStdin": false, + "AttachStdout": false, + "AttachStderr": false, + "Tty": false, + "OpenStdin": false, + "StdinOnce": false, + "Env": [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "TERM=xterm", + "container=podman", + "HOME=/root", + "HOSTNAME=99f66530fe9c" + ], + "Cmd": [ + "echo", + "hi" + ], + "Image": "docker.io/library/alpine:latest", + "Volumes": null, + "WorkingDir": "/", + "Entrypoint": "", + "OnBuild": null, + "Labels": null, + "Annotations": { + "io.container.manager": "libpod", + "io.kubernetes.cri-o.Created": "2021-09-16T06:09:08.936623325-04:00", + "org.opencontainers.image.stopSignal": "15" + }, + "StopSignal": 15, + "CreateCommand": [ + "podman", + "run", + "--name", + "foobar", + "alpine", + "echo", + "hi" + ], + "Timezone": "local", + "Umask": "0022", + "Timeout": 0, + "StopTimeout": 10 + }, + "HostConfig": { + "Binds": [], + "CgroupManager": "systemd", + "CgroupMode": "private", + "ContainerIDFile": "", + "LogConfig": { + "Type": "journald", + "Config": null, + "Path": "", + "Tag": "", + "Size": "0B" + }, + "NetworkMode": "slirp4netns", + "PortBindings": {}, + "RestartPolicy": { + "Name": "", + "MaximumRetryCount": 0 + }, + "AutoRemove": false, + "VolumeDriver": "", + "VolumesFrom": null, + "CapAdd": [], + "CapDrop": [], + "Dns": [], + "DnsOptions": [], + "DnsSearch": [], + "ExtraHosts": [], + "GroupAdd": [], + "IpcMode": "shareable", + "Cgroup": "", + "Cgroups": "default", + "Links": null, + "OomScoreAdj": 0, + "PidMode": "private", + "Privileged": false, + "PublishAllPorts": false, + "ReadonlyRootfs": false, + "SecurityOpt": [], + "Tmpfs": {}, + "UTSMode": "private", + "UsernsMode": "", + "ShmSize": 65536000, + "Runtime": "oci", + "ConsoleSize": [ + 0, + 0 + ], + "Isolation": "", + "CpuShares": 0, + "Memory": 0, + "NanoCpus": 0, + "CgroupParent": "user.slice", + "BlkioWeight": 0, + "BlkioWeightDevice": null, + "BlkioDeviceReadBps": null, + "BlkioDeviceWriteBps": null, + "BlkioDeviceReadIOps": null, + "BlkioDeviceWriteIOps": null, + "CpuPeriod": 0, + "CpuQuota": 0, + "CpuRealtimePeriod": 0, + "CpuRealtimeRuntime": 0, + "CpusetCpus": "", + "CpusetMems": "", + "Devices": [], + "DiskQuota": 0, + "KernelMemory": 0, + "MemoryReservation": 0, + "MemorySwap": 0, + "MemorySwappiness": 0, + "OomKillDisable": false, + "PidsLimit": 2048, + "Ulimits": [], + "CpuCount": 0, + "CpuPercent": 0, + "IOMaximumIOps": 0, + "IOMaximumBandwidth": 0, + "CgroupConf": null + } + } +] +``` + +Inspect the specified container for the Image Name it is based on. +``` +$ podman container inspect nervous_fermi --format "{{.ImageName}}" +registry.access.redhat.com/ubi8:latest +``` + +Inspect the specified container for the GraphDriver Name it is running with. +``` +$ podman container inspect foobar --format "{{.GraphDriver.Name}}" +overlay +``` + +Inspect the latest container created for its EffectiveCaps field. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman container inspect --latest --format {{.EffectiveCaps}} +[CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_FSETID CAP_KILL CAP_NET_BIND_SERVICE CAP_SETFCAP CAP_SETGID CAP_SETPCAP CAP_SETUID] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +Sep 2021, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-container-prune.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-container-prune.1.md new file mode 100644 index 000000000..66c51a58a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-container-prune.1.md @@ -0,0 +1,83 @@ +--- +title: podman-container-prune +version: v5.5.0 +--- + +% podman-container-prune 1 + +## NAME +podman\-container\-prune - Remove all stopped containers from local storage + +## SYNOPSIS +**podman container prune** [*options*] + +## DESCRIPTION +**podman container prune** removes all stopped containers from local storage. + +## OPTIONS +#### **--filter**=*filters* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------:|------------------------------------------------------------------------------------------------------| +| label | Only remove containers, with (or without, in the case of label!=[...] is used) the specified labels. | +| until | Only remove containers created before given timestamp. | + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes containers with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes containers without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not provide an interactive prompt for container removal.\ +The default is **false**. + +**-h**, **--help** + +Print usage statement.\ +The default is **false**. + +## EXAMPLES +Remove all stopped containers from local storage: +``` +$ podman container prune +WARNING! This will remove all stopped containers. +Are you sure you want to continue? [y/N] y +878392adf2e6c5c9bb1fc19b69d37d2e98c8abf9d539c0bce4b15b46bbcce471 +37664467fbe3618bf9479c34393ac29c02696675addf1750f9e346581636cde7 +ed0c6468b8e1cb641b4621d1fe30cb477e1fefc5c0bceb66feaf2f7cb50e5962 +6ac6c8f0067b7a4682e6b8e18902665b57d1a0e07e885d9abcd382232a543ccd +fff1c5b6c3631746055ec40598ce8ecaa4b82aef122f9e3a85b03b55c0d06c23 +602d343cd47e7cb3dfc808282a9900a3e4555747787ec6723bb68cedab8384d5 +``` + +Remove all stopped containers from local storage without confirmation: +``` +$ podman container prune -f +878392adf2e6c5c9bb1fc19b69d37d2e98c8abf9d539c0bce4b15b46bbcce471 +37664467fbe3618bf9479c34393ac29c02696675addf1750f9e346581636cde7 +ed0c6468b8e1cb641b4621d1fe30cb477e1fefc5c0bceb66feaf2f7cb50e5962 +6ac6c8f0067b7a4682e6b8e18902665b57d1a0e07e885d9abcd382232a543ccd +fff1c5b6c3631746055ec40598ce8ecaa4b82aef122f9e3a85b03b55c0d06c23 +602d343cd47e7cb3dfc808282a9900a3e4555747787ec6723bb68cedab8384d5 +``` + +Remove all stopped containers from local storage created before the last 10 minutes: +``` +$ podman container prune --filter until="10m" +WARNING! This will remove all stopped containers. +Are you sure you want to continue? [y/N] y +3d366295e33d8cc612c4d873199bacadd55088d90d17dcafaa9a2d317ad50b4e +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-ps(1)](podman-ps.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude \ +December 2020, converted filter information from docs.docker.com documentation by Dan Walsh diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-container-restore.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-container-restore.1.md new file mode 100644 index 000000000..ba5171169 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-container-restore.1.md @@ -0,0 +1,198 @@ +--- +title: podman-container-restore +version: v5.5.0 +--- + +% podman-container-restore 1 + +## NAME +podman\-container\-restore - Restore one or more containers from a checkpoint + +## SYNOPSIS +**podman container restore** [*options*] *name* [...] + +## DESCRIPTION +**podman container restore** restores a container from a container checkpoint or +checkpoint image. The *container IDs*, *image IDs* or *names* are used as input. + +## OPTIONS +#### **--all**, **-a** + +Restore all checkpointed *containers*.\ +The default is **false**.\ +*IMPORTANT: This OPTION does not need a container name or ID as input argument.* + +#### **--file-locks** + +Restore a *container* with file locks. This option is required to +restore file locks from a checkpoint image. If the checkpoint image +does not contain file locks, this option is ignored. Defaults to not +restoring file locks.\ +The default is **false**. + +#### **--ignore-rootfs** + +If a *container* is restored from a checkpoint tar.gz file it is possible that it also contains all root file-system changes. With **--ignore-rootfs** it is possible to explicitly disable applying these root file-system changes to the restored *container*.\ +The default is **false**.\ +*IMPORTANT: This OPTION is only available in combination with __--import, -i__.* + +#### **--ignore-static-ip** + +If the *container* was started with **--ip** the restored *container* also tries to use that +IP address and restore fails if that IP address is already in use. This can happen, if +a *container* is restored multiple times from an exported checkpoint with **--name, -n**. + +Using **--ignore-static-ip** tells Podman to ignore the IP address if it was configured +with **--ip** during *container* creation. + +The default is **false**. + +#### **--ignore-static-mac** + +If the *container* was started with **--mac-address** the restored *container* also +tries to use that MAC address and restore fails if that MAC address is already +in use. This can happen, if a *container* is restored multiple times from an +exported checkpoint with **--name, -n**. + +Using **--ignore-static-mac** tells Podman to ignore the MAC address if it was +configured with **--mac-address** during *container* creation. + +The default is **false**. + +#### **--ignore-volumes** + +This option must be used in combination with the **--import, -i** option. +When restoring *containers* from a checkpoint tar.gz file with this option, +the content of associated volumes are not restored.\ +The default is **false**. + +#### **--import**, **-i**=*file* + +Import a checkpoint tar.gz file, which was exported by Podman. This can be used +to import a checkpointed *container* from another host.\ +*IMPORTANT: This OPTION does not need a container name or ID as input argument.* + +During the import of a checkpoint file Podman selects the same container runtime +which was used during checkpointing. This is especially important if a specific +(non-default) container runtime was specified during container creation. Podman +also aborts the restore if the container runtime specified during restore does +not much the container runtime used for container creation. + +#### **--import-previous**=*file* + +Import a pre-checkpoint tar.gz file which was exported by Podman. This option +must be used with **-i** or **--import**. It only works on `runc 1.0-rc3` or `higher`. +*IMPORTANT: This OPTION is not supported on the remote client, including Mac and Windows (excluding WSL2) machines.* + +#### **--keep**, **-k** + +Keep all temporary log and statistics files created by `CRIU` during +checkpointing as well as restoring. These files are not deleted if restoring +fails for further debugging. If restoring succeeds these files are +theoretically not needed, but if these files are needed Podman can keep the +files for further analysis. This includes the checkpoint directory with all +files created during checkpointing. The size required by the checkpoint +directory is roughly the same as the amount of memory required by the +processes in the checkpointed *container*.\ +Without the **--keep**, **-k** option, the checkpoint is consumed and cannot be used again.\ +The default is **false**. + +#### **--latest**, **-l** + +Instead of providing the *container ID* or *name*, use the last created *container*. The default is **false**. +*IMPORTANT: This OPTION is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines. This OPTION does not need a container name or ID as input argument.* + +#### **--name**, **-n**=*name* + +If a *container* is restored from a checkpoint tar.gz file it is possible to rename it with **--name, -n**. This way it is possible to restore a *container* from a checkpoint multiple times with different +names. + +If the **--name, -n** option is used, Podman does not attempt to assign the same IP +address to the *container* it was using before checkpointing as each IP address can only +be used once, and the restored *container* has another IP address. This also means +that **--name, -n** cannot be used in combination with **--tcp-established**.\ +*IMPORTANT: This OPTION is only available for a checkpoint image or in combination +with __--import, -i__.* + +#### **--pod**=*name* + +Restore a container into the pod *name*. The destination pod for this restore +has to have the same namespaces shared as the pod this container was checkpointed +from (see **[podman pod create --share](podman-pod-create.1.md#--share)**).\ +*IMPORTANT: This OPTION is only available for a checkpoint image or in combination +with __--import, -i__.* + +This option requires at least CRIU 3.16. + +#### **--print-stats** + +Print out statistics about restoring the container(s). The output is +rendered in a JSON array and contains information about how much time different +restore operations required. Many of the restore statistics are created +by CRIU and just passed through to Podman. The following information is provided +in the JSON array: + +- **podman_restore_duration**: Overall time (in microseconds) needed to restore + all checkpoints. + +- **runtime_restore_duration**: Time (in microseconds) the container runtime + needed to restore the checkpoint. + +- **forking_time**: Time (in microseconds) CRIU needed to create (fork) all + processes in the restored container (measured by CRIU). + +- **restore_time**: Time (in microseconds) CRIU needed to restore all processes + in the container (measured by CRIU). + +- **pages_restored**: Number of memory pages restored (measured by CRIU). + +The default is **false**. + +#### **--publish**, **-p**=*port* + +Replaces the ports that the *container* publishes, as configured during the +initial *container* start, with a new set of port forwarding rules. + +For more details, see **[podman run --publish](podman-run.1.md#--publish)**. + +#### **--tcp-established** + +Restore a *container* with established TCP connections. If the checkpoint image +contains established TCP connections, this option is required during restore. +If the checkpoint image does not contain established TCP connections this +option is ignored. Defaults to not restoring *containers* with established TCP +connections.\ +The default is **false**. + +## EXAMPLE +Restore the container "mywebserver". +``` +# podman container restore mywebserver +``` + +Import a checkpoint file and a pre-checkpoint file. +``` +# podman container restore --import-previous pre-checkpoint.tar.gz --import checkpoint.tar.gz +``` + +Start the container "mywebserver". Make a checkpoint of the container and export it. Restore the container with other port ranges from the exported file. +``` +$ podman run --rm -p 2345:80 -d webserver +# podman container checkpoint -l --export=dump.tar +# podman container restore -p 5432:8080 --import=dump.tar +``` + +Start a container with the name "foobar-1". Create a checkpoint image "foobar-checkpoint". Restore the container from the checkpoint image with a different name. +``` +# podman run --name foobar-1 -d webserver +# podman container checkpoint --create-image foobar-checkpoint foobar-1 +# podman inspect foobar-checkpoint +# podman container restore --name foobar-2 foobar-checkpoint +# podman container restore --name foobar-3 foobar-checkpoint +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container-checkpoint(1)](podman-container-checkpoint.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-pod-create(1)](podman-pod-create.1.md)**, **criu(8)** + +## HISTORY +September 2018, Originally compiled by Adrian Reber diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-container-runlabel.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-container-runlabel.1.md new file mode 100644 index 000000000..2f7b7302e --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-container-runlabel.1.md @@ -0,0 +1,128 @@ +--- +title: podman-container-runlabel +version: v5.5.0 +--- + +% podman-container-runlabel 1 + +## NAME +podman-container-runlabel - Execute a command as described by a container-image label + +## SYNOPSIS +**podman container runlabel** [*options*] *label* *image* [*arg...*] + +## DESCRIPTION +**podman container runlabel** reads the specified `label` of the `image` and executes it as command on the host. If the label does not exist, Podman exits with an error. Additional arguments are appended to the command. + +Historically, container images describe the contents (e.g., layers) and how a container runtime (e.g., crun(1) or runc(1)) executes the container. For instance, an image may set the environment and the command in its configuration. However, a container image cannot directly specify how a container engine such as Podman executes it. For instance, an image configuration does not include information about log drivers, namespaces, or which capabilities it needs to run correctly. + +`podman container runlabel` addresses the limitation of container images in a simple yet efficient way. Podman reads the contents of the label and interpret it as a command that is executed on the host. This way an image can describe exactly how it is executed by Podman. For instance, a label with the content `/usr/bin/podman run -d --pid=host --privileged \${IMAGE}` instructs the image to be executed in a detached, privileged container that is using the PID namespace of the host. This lifts the self-description of a container image from "what" to "how". + +Note that the `runlabel` command is intended to be run in trusted environments exclusively. Using the command on untrusted images is not recommended. + +## VARIABLES + +The contents of a label may refer to the following variables which is substituted while processing the label. + +**IMAGE** +The name of the image. When executing `podman container runlabel label fedora` the `IMAGE` variable is replaced with `fedora`. Valid formats are `IMAGE`, `$IMAGE`, `${IMAGE}` and `=IMAGE`. + +**NAME** +As specified by the `--name` option. The format is identical to the one of the IMAGE attribute. + +**PWD** +Will be replaced with the current working directory. + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + +#### **--display** + +Display the label's value of the image having populated its environment variables. The runlabel command is not executed if --display is specified. + +#### **--help**, **-h** +Print usage statement + +#### **--name**, **-n**=*name* + +Use this name for creating content for the container. If not specified, name defaults to the name of the image. + +#### **--quiet**, **-q** + +Suppress output information when pulling images + +#### **--replace** + +If a container exists with the current name, it is stopped, deleted and a new container is created from this image. + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Execute the `run` label of an image called foobar. +``` +$ podman container runlabel run foobar +``` + +Execute the `install` label of an image called foobar with additional arguments. +``` +$ podman container runlabel install foobar apples oranges +``` + +Display the contents of the `run` label of image foobar. +``` +$ podman container runlabel --display run foobar +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/main/man/runc.8.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-auth.json(5)](https://github.com/containers/image/blob/main/docs/containers-auth.json.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +## HISTORY +August 2021, Refinements by Valentin Rothberg (rothberg at redhat dot com) + +September 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-container.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-container.1.md new file mode 100644 index 000000000..a29ee3849 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-container.1.md @@ -0,0 +1,58 @@ +--- +title: podman-container +version: v5.5.0 +--- + +% podman-container 1 + +## NAME +podman\-container - Manage containers + +## SYNOPSIS +**podman container** *subcommand* + +## DESCRIPTION +The container command allows management of containers + +## COMMANDS + +| Command | Man Page | Description | +| --------- | --------------------------------------------------- | ---------------------------------------------------------------------------- | +| attach | [podman-attach(1)](podman-attach.1.md) | Attach to a running container. | +| checkpoint | [podman-container-checkpoint(1)](podman-container-checkpoint.1.md) | Checkpoint one or more running containers. | +| cleanup | [podman-container-cleanup(1)](podman-container-cleanup.1.md) | Clean up the container's network and mountpoints. | +| clone | [podman-container-clone(1)](podman-container-clone.1.md) | Create a copy of an existing container. | +| commit | [podman-commit(1)](podman-commit.1.md) | Create new image based on the changed container. | +| cp | [podman-cp(1)](podman-cp.1.md) | Copy files/folders between a container and the local filesystem. | +| create | [podman-create(1)](podman-create.1.md) | Create a new container. | +| diff | [podman-container-diff(1)](podman-container-diff.1.md) | Inspect changes on a container's filesystem | +| exec | [podman-exec(1)](podman-exec.1.md) | Execute a command in a running container. | +| exists | [podman-container-exists(1)](podman-container-exists.1.md) | Check if a container exists in local storage | +| export | [podman-export(1)](podman-export.1.md) | Export a container's filesystem contents as a tar archive. | +| init | [podman-init(1)](podman-init.1.md) | Initialize a container | +| inspect | [podman-container-inspect(1)](podman-container-inspect.1.md)| Display a container's configuration. | +| kill | [podman-kill(1)](podman-kill.1.md) | Kill the main process in one or more containers. | +| list | [podman-ps(1)](podman-ps.1.md) | List the containers on the system.(alias ls) | +| logs | [podman-logs(1)](podman-logs.1.md) | Display the logs of a container. | +| mount | [podman-mount(1)](podman-mount.1.md) | Mount a working container's root filesystem. | +| pause | [podman-pause(1)](podman-pause.1.md) | Pause one or more containers. | +| port | [podman-port(1)](podman-port.1.md) | List port mappings for the container. | +| prune | [podman-container-prune(1)](podman-container-prune.1.md)| Remove all stopped containers from local storage. | +| ps | [podman-ps(1)](podman-ps.1.md) | Print out information about containers. | +| rename | [podman-rename(1)](podman-rename.1.md) | Rename an existing container. | +| restart | [podman-restart(1)](podman-restart.1.md) | Restart one or more containers. | +| restore | [podman-container-restore(1)](podman-container-restore.1.md) | Restore one or more containers from a checkpoint. | +| rm | [podman-rm(1)](podman-rm.1.md) | Remove one or more containers. | +| run | [podman-run(1)](podman-run.1.md) | Run a command in a container. | +| runlabel | [podman-container-runlabel(1)](podman-container-runlabel.1.md) | Execute a command as described by a container-image label. | +| start | [podman-start(1)](podman-start.1.md) | Start one or more containers. | +| stats | [podman-stats(1)](podman-stats.1.md) | Display a live stream of one or more container's resource usage statistics. | +| stop | [podman-stop(1)](podman-stop.1.md) | Stop one or more running containers. | +| top | [podman-top(1)](podman-top.1.md) | Display the running processes of a container. | +| unmount | [podman-unmount(1)](podman-unmount.1.md) | Unmount a working container's root filesystem.(Alias unmount) | +| unpause | [podman-unpause(1)](podman-unpause.1.md) | Unpause one or more containers. | +| update | [podman-update(1)](podman-update.1.md) | Update the cgroup configuration of a given container. | +| wait | [podman-wait(1)](podman-wait.1.md) | Wait on one or more containers to stop and print their exit codes. | + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-exec(1)](podman-exec.1.md)**, **[podman-run(1)](podman-run.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-cp.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-cp.1.md new file mode 100644 index 000000000..2890e1568 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-cp.1.md @@ -0,0 +1,140 @@ +--- +title: podman-cp +version: v5.5.0 +--- + +% podman-cp 1 + +## NAME +podman\-cp - Copy files/folders between a container and the local filesystem + +## SYNOPSIS +**podman cp** [*options*] [*container*:]*src_path* [*container*:]*dest_path* + +**podman container cp** [*options*] [*container*:]*src_path* [*container*:]*dest_path* + +## DESCRIPTION +**podman cp** allows copying the contents of **src_path** to the **dest_path**. Files can be copied from a container to the local machine and vice versa or between two containers. +If `-` is specified for either the `SRC_PATH` or `DEST_PATH`, one can also stream a tar archive from `STDIN` or to `STDOUT`. + +The containers can be either running or stopped and the *src_path* or *dest_path* can be a file or directory. + +*IMPORTANT: The **podman cp** command assumes container paths are relative to the container's root directory (`/`), which means supplying the initial forward slash is optional and therefore sees `compassionate_darwin:/tmp/foo/myfile.txt` and `compassionate_darwin\:tmp/foo/myfile.txt` as identical.* + +Local machine paths can be an absolute or relative value. +The command interprets a local machine's relative paths as relative to the current working directory where **podman cp** is run. + +Assuming a path separator of `/`, a first argument of **src_path** and second argument of **dest_path**, the behavior is as follows: + +**src_path** specifies a file: + - **dest_path** does not exist + - the file is saved to a file created at **dest_path** (note that parent directory must exist). + - **dest_path** exists and is a file + - the destination is overwritten with the source file's contents. + - **dest_path** exists and is a directory + - the file is copied into this directory using the base name from **src_path**. + +**src_path** specifies a directory: + - **dest_path** does not exist + - **dest_path** is created as a directory and the contents of the source directory are copied into this directory. + - **dest_path** exists and is a file + - Error condition: cannot copy a directory to a file. + - **dest_path** exists and is a directory + - **src_path** ends with `/` + - the source directory is copied into this directory. + - **src_path** ends with `/.` (i.e., slash followed by dot) + - the content of the source directory is copied into this directory. + +The command requires **src_path** and **dest_path** to exist according to the above rules. + +If **src_path** is local and is a symbolic link, the symbolic target, is copied by default. + +A *colon* ( : ) is used as a delimiter between a container and its path, it can also be used when specifying paths to a **src_path** or **dest_path** on a local machine, for example, `file:name.txt`. + +*IMPORTANT: while using a *colon* ( : ) in a local machine path, one must be explicit with a relative or absolute path, for example: `/path/to/file:name.txt` or `./file:name.txt`* + +Using `-` as the **src_path** streams the contents of `STDIN` as a tar archive. The command extracts the content of the tar to the `DEST_PATH` in the container. In this case, **dest_path** must specify a directory. Using `-` as the **dest_path** streams the contents of the resource (can be a directory) as a tar archive to `STDOUT`. + +Note that `podman cp` ignores permission errors when copying from a running rootless container. The TTY devices inside a rootless container are owned by the host's root user and hence cannot be read inside the container's user namespace. + +Further note that `podman cp` does not support globbing (e.g., `cp dir/*.txt`). To copy multiple files from the host to the container use xargs(1) or find(1) (or similar tools for chaining commands) in conjunction with `podman cp`. To copy multiple files from the container to the host, use `podman mount CONTAINER` and operate on the returned mount point instead (see ALTERNATIVES below). + +## OPTIONS + +#### **--archive**, **-a** + +Archive mode (copy all UID/GID information). +When set to true, files copied to a container have changed ownership to the primary UID/GID of the container. +When set to false, maintain UID/GID from archive sources instead of changing them to the primary UID/GID of the destination container. +The default is **true**. + +#### **--overwrite** + +Allow directories to be overwritten with non-directories and vice versa. By default, `podman cp` errors out when attempting to overwrite, for instance, a regular file with a directory. + +## ALTERNATIVES + +Podman has much stronger capabilities than just `podman cp` to achieve copying files between the host and containers. + +Using standard **[podman-mount(1)](podman-mount.1.md)** and **[podman-unmount(1)](podman-unmount.1.md)** takes advantage of the entire Linux tool chain, rather than just `cp`. + +Copying contents out of a container or into a container can be achieved with a few simple commands. For example: + +To copy the `/etc/foobar` directory out of a container and onto `/tmp` on the host, the following commands can be executed: + + mnt=$(podman mount CONTAINERID) + cp -R ${mnt}/etc/foobar /tmp + podman umount CONTAINERID + +To untar a tar ball into a container, following commands can be executed: + + mnt=$(podman mount CONTAINERID) + tar xf content.tgz -C ${mnt} + podman umount CONTAINERID + +To install a package into a container that +does not have dnf installed, following commands can be executed: + + mnt=$(podman mount CONTAINERID) + dnf install --installroot=${mnt} httpd + chroot ${mnt} rm -rf /var/log/dnf /var/cache/dnf + podman umount CONTAINERID + +By using `podman mount` and `podman unmount`, one can use all of the +standard Linux tools for moving files into and out of containers, not just +the `cp` command. + +## EXAMPLES + +Copy a file from the host to a container: +``` +podman cp /myapp/app.conf containerID:/myapp/app.conf +``` + +Copy a file from a container to a directory on another container: +``` +podman cp containerID1:/myfile.txt containerID2:/tmp +``` + +Copy a directory on a container to a directory on the host: +``` +podman cp containerID:/myapp/ /myapp/ +``` + +Copy the contents of a directory on a container to a directory on the host: +``` +podman cp containerID:/home/myuser/. /home/myuser/ +``` + +Copy a directory on a container into a directory on another: +``` +podman cp containerA:/myapp containerB:/newapp +``` + +Stream a tar archive from `STDIN` to a container: +``` +podman cp - containerID:/myfiles.tar.gz < myfiles.tar.gz +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-mount(1)](podman-mount.1.md)**, **[podman-unmount(1)](podman-unmount.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-create.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-create.1.md new file mode 100644 index 000000000..b8a549526 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-create.1.md @@ -0,0 +1,2905 @@ +--- +title: podman-create +version: v5.5.0 +--- + +% podman-create 1 + +## NAME +podman\-create - Create a new container + +## SYNOPSIS +**podman create** [*options*] *image* [*command* [*arg* ...]] + +**podman container create** [*options*] *image* [*command* [*arg* ...]] + +## DESCRIPTION + +Creates a writable container layer over the specified image and prepares it for +running the specified command. The container ID is then printed to STDOUT. This +is similar to **podman run -d** except the container is never started. Use the +**podman start** *container* command to start the container at any point. + +The initial status of the container created with **podman create** is 'created'. + +Default settings for flags are defined in `containers.conf`. Most settings for +remote connections use the server's containers.conf, except when documented in +man pages. + +## IMAGE + + The image is specified using transport\:path format. If no transport is specified, the `docker` (container registry) +transport is used by default. For remote Podman, including Mac and Windows (excluding WSL2) machines, `docker` is the only allowed transport. + + **dir:**_path_ + An existing local directory _path_ storing the manifest, layer tarballs and signatures as individual files. This +is a non-standardized format, primarily useful for debugging or noninvasive container inspection. + + $ podman save --format docker-dir fedora -o /tmp/fedora + $ podman create dir:/tmp/fedora echo hello + + **docker://**_docker-reference_ (Default) + An image reference stored in a remote container image registry. Example: "quay.io/podman/stable:latest". +The reference can include a path to a specific registry; if it does not, the +registries listed in registries.conf is queried to find a matching image. +By default, credentials from `podman login` (stored at +$XDG_RUNTIME_DIR/containers/auth.json by default) is used to authenticate; +otherwise it falls back to using credentials in $HOME/.docker/config.json. + + $ podman create registry.fedoraproject.org/fedora\:latest echo hello + + **docker-archive:**_path_[**:**_docker-reference_] +An image stored in the `docker save` formatted file. _docker-reference_ is only used when creating such a +file, and it must not contain a digest. + + $ podman save --format docker-archive fedora -o /tmp/fedora + $ podman create docker-archive:/tmp/fedora echo hello + + **docker-daemon:**_docker-reference_ + An image in _docker-reference_ format stored in the docker daemon internal storage. The _docker-reference_ can also be an image ID (docker-daemon\:algo\:digest). + + $ sudo docker pull fedora + $ sudo podman create docker-daemon\:docker.io/library/fedora echo hello + + **oci-archive:**_path_**:**_tag_ + An image in a directory compliant with the "Open Container Image Layout Specification" at the specified _path_ +and specified with a _tag_. + + $ podman save --format oci-archive fedora -o /tmp/fedora + $ podman create oci-archive:/tmp/fedora echo hello + +## OPTIONS + + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the container's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + + +[//]: # (BEGIN included file options/annotation.container.md) +#### **--annotation**=*key=value* + +Add an annotation to the container. This option can be set multiple times. + +[//]: # (END included file options/annotation.container.md) + + +[//]: # (BEGIN included file options/arch.md) +#### **--arch**=*ARCH* +Override the architecture, defaults to hosts, of the image to be pulled. For example, `arm`. +Unless overridden, subsequent lookups of the same image in the local storage matches this architecture, regardless of the host. + +[//]: # (END included file options/arch.md) + + +[//]: # (BEGIN included file options/attach.md) +#### **--attach**, **-a**=*stdin* | *stdout* | *stderr* + +Attach to STDIN, STDOUT or STDERR. + +In foreground mode (the default when **-d** +is not specified), **podman run** can start the process in the container +and attach the console to the process's standard input, output, and +error. It can even pretend to be a TTY (this is what most command-line +executables expect) and pass along signals. The **-a** option can be set for +each of **stdin**, **stdout**, and **stderr**. + +[//]: # (END included file options/attach.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cap-add.md) +#### **--cap-add**=*capability* + +Add Linux capabilities. + +Granting additional capabilities increases the privileges of the +processes running inside the container and potentially allow it to +break out of confinement. Capabilities like `CAP_SYS_ADMIN`, +`CAP_SYS_PTRACE`, `CAP_MKNOD` and `CAP_SYS_MODULE` are particularly +dangerous when they are not used within a user namespace. Please +refer to **user_namespaces(7)** for a more detailed explanation of the +interaction between user namespaces and capabilities. + +Before adding any capability, review its security implications and +ensure it is really necessary for the container’s functionality. See +**capabilities(7)** for more information. + +[//]: # (END included file options/cap-add.md) + + +[//]: # (BEGIN included file options/cap-drop.md) +#### **--cap-drop**=*capability* + +Drop Linux capabilities. + +[//]: # (END included file options/cap-drop.md) + + +[//]: # (BEGIN included file options/cgroup-conf.md) +#### **--cgroup-conf**=*KEY=VALUE* + +When running on cgroup v2, specify the cgroup file to write to and its value. For example **--cgroup-conf=memory.high=1073741824** sets the memory.high limit to 1GB. + +[//]: # (END included file options/cgroup-conf.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the container is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cgroupns.md) +#### **--cgroupns**=*mode* + +Set the cgroup namespace mode for the container. + +- **host**: use the host's cgroup namespace inside the container. +- **container:**_id_: join the namespace of the specified container. +- **private**: create a new cgroup namespace. +- **ns:**_path_: join the namespace at the specified path. + +If the host uses cgroups v1, the default is set to **host**. On cgroups v2, the default is **private**. + +[//]: # (END included file options/cgroupns.md) + + +[//]: # (BEGIN included file options/cgroups.md) +#### **--cgroups**=*how* + +Determines whether the container creates CGroups. + +Default is **enabled**. + +The **enabled** option creates a new cgroup under the cgroup-parent. +The **disabled** option forces the container to not create CGroups, and thus conflicts with CGroup options (**--cgroupns** and **--cgroup-parent**). +The **no-conmon** option disables a new CGroup only for the **conmon** process. +The **split** option splits the current CGroup in two sub-cgroups: one for conmon and one for the container payload. It is not possible to set **--cgroup-parent** with **split**. + +[//]: # (END included file options/cgroups.md) + + +[//]: # (BEGIN included file options/chrootdirs.md) +#### **--chrootdirs**=*path* + +Path to a directory inside the container that is treated as a `chroot` directory. +Any Podman managed file (e.g., /etc/resolv.conf, /etc/hosts, etc/hostname) that is mounted into the root directory is mounted into that location as well. +Multiple directories are separated with a comma. + +[//]: # (END included file options/chrootdirs.md) + + +[//]: # (BEGIN included file options/cidfile.write.md) +#### **--cidfile**=*file* + +Write the container ID to *file*. The file is removed along with the container, except +when used with podman --remote run on detached containers. + +[//]: # (END included file options/cidfile.write.md) + + +[//]: # (BEGIN included file options/conmon-pidfile.md) +#### **--conmon-pidfile**=*file* + +Write the pid of the **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to restart Podman containers. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/conmon-pidfile.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-rt-period.md) +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-period.md) + + +[//]: # (BEGIN included file options/cpu-rt-runtime.md) +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-runtime.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpus.container.md) +#### **--cpus**=*number* + +Number of CPUs. The default is *0.0* which means no limit. This is shorthand +for **--cpu-period** and **--cpu-quota**, therefore the option cannot be specified with +**--cpu-period** or **--cpu-quota**. + +On some systems, changing the CPU limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpus.container.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the container. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The container only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: if the user only has access rights via a group, accessing the device +from inside a rootless container fails. Use the `--group-add keep-groups` +flag to pass the user's supplementary group access into the container. + + +[//]: # (BEGIN included file options/device-cgroup-rule.md) +#### **--device-cgroup-rule**=*"type major\:minor mode"* + +Add a rule to the cgroup allowed devices list. The rule is expected to be +in the format specified in the Linux kernel documentation +[admin-guide/cgroup-v1/devices](https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.html): +- *type*: `a` (all), `c` (char), or `b` (block); +- *major* and *minor*: either a number, or `*` for all; +- *mode*: a composition of `r` (read), `w` (write), and `m` (mknod(2)). + +[//]: # (END included file options/device-cgroup-rule.md) + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-read-iops.md) +#### **--device-read-iops**=*path:rate* + +Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-iops.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + + +[//]: # (BEGIN included file options/device-write-iops.md) +#### **--device-write-iops**=*path:rate* + +Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-iops.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + + +[//]: # (BEGIN included file options/dns.md) +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. + +[//]: # (END included file options/dns.md) + +This option cannot be combined with **--network** that is set to **none** or **container:**_id_. + + +[//]: # (BEGIN included file options/dns-option.container.md) +#### **--dns-option**=*option* + +Set custom DNS options. Invalid if using **--dns-option** with **--network** that is set to **none** or **container:**_id_. + +[//]: # (END included file options/dns-option.container.md) + + +[//]: # (BEGIN included file options/dns-search.container.md) +#### **--dns-search**=*domain* + +Set custom DNS search domains. Invalid if using **--dns-search** with **--network** that is set to **none** or **container:**_id_. +Use **--dns-search=.** to remove the search domain. + +[//]: # (END included file options/dns-search.container.md) + + +[//]: # (BEGIN included file options/entrypoint.md) +#### **--entrypoint**=*"command"* | *'["command", "arg1", ...]'* + +Override the default ENTRYPOINT from the image. + +The ENTRYPOINT of an image is similar to a COMMAND +because it specifies what executable to run when the container starts, but it is +(purposely) more difficult to override. The ENTRYPOINT gives a container its +default nature or behavior. When the ENTRYPOINT is set, the +container runs as if it were that binary, complete with default options. More options can be +passed in via the COMMAND. But, if a user wants to run +something else inside the container, the **--entrypoint** option allows a new +ENTRYPOINT to be specified. + +Specify multi option commands in the form of a JSON string. + +[//]: # (END included file options/entrypoint.md) + + +[//]: # (BEGIN included file options/env.md) +#### **--env**, **-e**=*env* + +Set environment variables. + +This option allows arbitrary environment variables that are available for the process to be launched inside of the container. If an environment variable is specified without a value, Podman checks the host environment for a value and set the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the container. + +[//]: # (END included file options/env.md) + +See [**Environment**](#environment) note below for precedence and examples. + + +[//]: # (BEGIN included file options/env-file.md) +#### **--env-file**=*file* + +Read in a line-delimited file of environment variables. + +[//]: # (END included file options/env-file.md) + +See [**Environment**](#environment) note below for precedence and examples. + + +[//]: # (BEGIN included file options/env-host.md) +#### **--env-host** + +Use host environment inside of the container. See **Environment** note below for precedence. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/env-host.md) + + +[//]: # (BEGIN included file options/env-merge.md) +#### **--env-merge**=*env* + +Preprocess default environment variables for the containers. For example +if image contains environment variable `hello=world` user can preprocess +it using `--env-merge hello=${hello}-some` so new value is `hello=world-some`. + +Please note that if the environment variable `hello` is not present in the image, +then it'll be replaced by an empty string and so using `--env-merge hello=${hello}-some` +would result in the new value of `hello=-some`, notice the leading `-` delimiter. + +[//]: # (END included file options/env-merge.md) + + +[//]: # (BEGIN included file options/expose.md) +#### **--expose**=*port[/protocol]* + +Expose a port or a range of ports (e.g. **--expose=3300-3310**). +The protocol can be `tcp`, `udp` or `sctp` and if not given `tcp` is assumed. +This option matches the EXPOSE instruction for image builds and has no effect on +the actual networking rules unless **-P/--publish-all** is used to forward to all +exposed ports from random host ports. To forward specific ports from the host +into the container use the **-p/--publish** option instead. + +[//]: # (END included file options/expose.md) + + +[//]: # (BEGIN included file options/gidmap.container.md) +#### **--gidmap**=*[flags]container_uid\:from_uid[\:amount]* + +Run the container in a new user namespace using the supplied GID mapping. This +option conflicts with the **--userns** and **--subgidname** options. This +option provides a way to map host GIDs to container GIDs in the same way as +__--uidmap__ maps host UIDs to container UIDs. For details see __--uidmap__. + +Note: the **--gidmap** option cannot be called in conjunction with the **--pod** option as a gidmap cannot be set on the container level when in a pod. + +[//]: # (END included file options/gidmap.container.md) + + +[//]: # (BEGIN included file options/gpus.md) +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. + +[//]: # (END included file options/gpus.md) + + +[//]: # (BEGIN included file options/group-add.md) +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/group-add.md) + + +[//]: # (BEGIN included file options/group-entry.md) +#### **--group-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/group` file within the container when `--user` is used. + +The variables $GROUPNAME, $GID, and $USERLIST are automatically replaced with their value at runtime if present. + +[//]: # (END included file options/group-entry.md) + + +[//]: # (BEGIN included file options/health-cmd.md) +#### **--health-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set or alter a healthcheck command for a container. The command is a command to be executed inside the +container that determines the container health. The command is required for other healthcheck options +to be applied. A value of **none** disables existing healthchecks. + +Multiple options can be passed in the form of a JSON array; otherwise, the command is interpreted +as an argument to **/bin/sh -c**. + +Note: The default values are used even if healthcheck is configured in the image. + +[//]: # (END included file options/health-cmd.md) + + +[//]: # (BEGIN included file options/health-interval.md) +#### **--health-interval**=*interval* + +Set an interval for the healthchecks. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-interval.md) + + +[//]: # (BEGIN included file options/health-log-destination.md) +#### **--health-log-destination**=*directory_path* + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) (Default: local) + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. + +[//]: # (END included file options/health-log-destination.md) + + +[//]: # (BEGIN included file options/health-max-log-count.md) +#### **--health-max-log-count**=*number of stored logs* + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) (Default: 5 attempts) + +[//]: # (END included file options/health-max-log-count.md) + + +[//]: # (BEGIN included file options/health-max-log-size.md) +#### **--health-max-log-size**=*size of stored logs* + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) (Default: 500 characters) + +[//]: # (END included file options/health-max-log-size.md) + + +[//]: # (BEGIN included file options/health-on-failure.md) +#### **--health-on-failure**=*action* + +Action to take once the container transitions to an unhealthy state. The default is **none**. + +- **none**: Take no action. +- **kill**: Kill the container. +- **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. +- **stop**: Stop the container. + +[//]: # (END included file options/health-on-failure.md) + + +[//]: # (BEGIN included file options/health-retries.md) +#### **--health-retries**=*retries* + +The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is **3**. + +Note: This parameter can overwrite the healthcheck configuration from the image. + +[//]: # (END included file options/health-retries.md) + + +[//]: # (BEGIN included file options/health-start-period.md) +#### **--health-start-period**=*period* + +The initialization time needed for a container to bootstrap. The value can be expressed in time format like +**2m3s**. The default value is **0s**. + +Note: The health check command is executed as soon as a container is started, if the health check is successful +the container's health state will be updated to `healthy`. However, if the health check fails, the health state will +stay as `starting` until either the health check is successful or until the `--health-start-period` time is over. If the +health check command fails after the `--health-start-period` time is over, the health state will be updated to `unhealthy`. +The health check command is executed periodically based on the value of `--health-interval`. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-start-period.md) + + +[//]: # (BEGIN included file options/health-startup-cmd.md) +#### **--health-startup-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set a startup healthcheck command for a container. This command is executed inside the container and is used to gate the regular +healthcheck. When the startup command succeeds, the regular healthcheck begins and the startup healthcheck ceases. Optionally, +if the command fails for a set number of attempts, the container is restarted. A startup healthcheck can be used to ensure that +containers with an extended startup period are not marked as unhealthy until they are fully started. Startup healthchecks can only be +used when a regular healthcheck (from the container's image or the **--health-cmd** option) is also set. + +[//]: # (END included file options/health-startup-cmd.md) + + +[//]: # (BEGIN included file options/health-startup-interval.md) +#### **--health-startup-interval**=*interval* + +Set an interval for the startup healthcheck. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-startup-interval.md) + + +[//]: # (BEGIN included file options/health-startup-retries.md) +#### **--health-startup-retries**=*retries* + +The number of attempts allowed before the startup healthcheck restarts the container. If set to **0**, the container is never restarted. The default is **0**. + +[//]: # (END included file options/health-startup-retries.md) + + +[//]: # (BEGIN included file options/health-startup-success.md) +#### **--health-startup-success**=*retries* + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value +of **0** means that any success begins the regular healthcheck. The default is **0**. + +[//]: # (END included file options/health-startup-success.md) + + +[//]: # (BEGIN included file options/health-startup-timeout.md) +#### **--health-startup-timeout**=*timeout* + +The maximum time a startup healthcheck command has to complete before it is marked as failed. The value can be expressed in a time +format like **2m3s**. The default value is **30s**. + +[//]: # (END included file options/health-startup-timeout.md) + + +[//]: # (BEGIN included file options/health-timeout.md) +#### **--health-timeout**=*timeout* + +The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the +value can be expressed in a time format such as **1m22s**. The default value is **30s**. + +Note: A timeout marks the healthcheck as failed but does not terminate the running process. +This ensures that a slow but eventually successful healthcheck does not disrupt the container +but is still accounted for in the health status. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-timeout.md) + +#### **--help** + +Print usage statement + + +[//]: # (BEGIN included file options/hostname.container.md) +#### **--hostname**, **-h**=*name* + +Set the container's hostname inside the container. + +This option can only be used with a private UTS namespace `--uts=private` +(default). If `--pod` is given and the pod shares the same UTS namespace +(default), the pod's hostname is used. The given hostname is also added to the +`/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). + +[//]: # (END included file options/hostname.container.md) + + +[//]: # (BEGIN included file options/hosts-file.md) +#### **--hosts-file**=*path* | *none* | *image* + +Base file to create the `/etc/hosts` file inside the container. This must either +be an absolute path to a file on the host system, or one of the following +special flags: + "" Follow the `base_hosts_file` configuration in _containers.conf_ (the default) + `none` Do not use a base file (i.e. start with an empty file) + `image` Use the container image's `/etc/hosts` file as base file + +[//]: # (END included file options/hosts-file.md) + + +[//]: # (BEGIN included file options/hostuser.md) +#### **--hostuser**=*name* + +Add a user account to /etc/passwd from the host to the container. The Username +or UID must exist on the host system. + +[//]: # (END included file options/hostuser.md) + + +[//]: # (BEGIN included file options/http-proxy.md) +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. + +[//]: # (END included file options/http-proxy.md) + + +[//]: # (BEGIN included file options/image-volume.md) +#### **--image-volume**=**bind** | *tmpfs* | *ignore* + +Tells Podman how to handle the builtin image volumes. Default is **bind**. + +- **bind**: An anonymous named volume is created and mounted into the container. +- **tmpfs**: The volume is mounted onto the container as a tmpfs, which allows the users to create +content that disappears when the container is stopped. +- **ignore**: All volumes are just ignored and no action is taken. + +[//]: # (END included file options/image-volume.md) + + +[//]: # (BEGIN included file options/init.md) +#### **--init** + +Run an init inside the container that forwards signals and reaps processes. +The container-init binary is mounted at `/run/podman-init`. +Mounting over `/run` breaks container execution. + +[//]: # (END included file options/init.md) + +#### **--init-ctr**=*type* + +(Pods only). +When using pods, create an init style container, which is run after the infra container is started +but before regular pod containers are started. Init containers are useful for running +setup operations for the pod's applications. + +Valid values for `init-ctr` type are *always* or *once*. The *always* value +means the container runs with each and every `pod start`, whereas the *once* +value means the container only runs once when the pod is started and then the container is removed. + +Init containers are only run on pod `start`. Restarting a pod does not execute +any init containers. Furthermore, init containers can only be created in a +pod when that pod is not running. + + +[//]: # (BEGIN included file options/init-path.md) +#### **--init-path**=*path* + +Path to the container-init binary. + +[//]: # (END included file options/init-path.md) + + +[//]: # (BEGIN included file options/interactive.md) +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. + +[//]: # (END included file options/interactive.md) + + +[//]: # (BEGIN included file options/ip.md) +#### **--ip**=*ipv4* + +Specify a static IPv4 address for the container, for example **10.88.64.128**. +This option can only be used if the container is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IP address pool (default **10.88.0.0/16**). + +To specify multiple static IP addresses per container, set multiple networks using the **--network** option with a static IP address specified for each using the `ip` mode for that option. + +[//]: # (END included file options/ip.md) + + +[//]: # (BEGIN included file options/ip6.md) +#### **--ip6**=*ipv6* + +Specify a static IPv6 address for the container, for example **fd46\:db93\:aa76\:ac37::10**. +This option can only be used if the container is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IPv6 address pool. + +To specify multiple static IPv6 addresses per container, set multiple networks using the **--network** option with a static IPv6 address specified for each using the `ip6` mode for that option. + +[//]: # (END included file options/ip6.md) + + +[//]: # (BEGIN included file options/ipc.md) +#### **--ipc**=*ipc* + +Set the IPC namespace mode for a container. The default is to create +a private IPC namespace. + +- "": Use Podman's default, defined in containers.conf. +- **container:**_id_: reuses another container's shared memory, semaphores, and message queues +- **host**: use the host's shared memory, semaphores, and message queues inside the container. Note: the host mode gives the container full access to local shared memory and is therefore considered insecure. +- **none**: private IPC namespace, with /dev/shm not mounted. +- **ns:**_path_: path to an IPC namespace to join. +- **private**: private IPC namespace. +- **shareable**: private IPC namespace with a possibility to share it with other containers. + +[//]: # (END included file options/ipc.md) + + +[//]: # (BEGIN included file options/label.md) +#### **--label**, **-l**=*key=value* + +Add metadata to a container. + +[//]: # (END included file options/label.md) + + +[//]: # (BEGIN included file options/label-file.md) +#### **--label-file**=*file* + +Read in a line-delimited file of labels. + +[//]: # (END included file options/label-file.md) + + +[//]: # (BEGIN included file options/link-local-ip.md) +#### **--link-local-ip**=*ip* + +Not implemented. + +[//]: # (END included file options/link-local-ip.md) + + +[//]: # (BEGIN included file options/log-driver.md) +#### **--log-driver**=*driver* + +Logging driver for the container. Currently available options are **k8s-file**, **journald**, **none**, **passthrough** and **passthrough-tty**, with **json-file** aliased to **k8s-file** for scripting compatibility. (Default **journald**). + +The podman info command below displays the default log-driver for the system. +``` +$ podman info --format '{{ .Host.LogDriver }}' +journald +``` +The **passthrough** driver passes down the standard streams (stdin, stdout, stderr) to the +container. It is not allowed with the remote Podman client, including Mac and Windows (excluding WSL2) machines, and on a tty, since it is +vulnerable to attacks via TIOCSTI. + +The **passthrough-tty** driver is the same as **passthrough** except that it also allows it to be used on a TTY if the user really wants it. + +[//]: # (END included file options/log-driver.md) + + +[//]: # (BEGIN included file options/log-opt.md) +#### **--log-opt**=*name=value* + +Logging driver specific options. + +Set custom logging configuration. The following *name*s are supported: + +**path**: specify a path to the log file + (e.g. **--log-opt path=/var/log/container/mycontainer.json**); + +**max-size**: specify a max size of the log file + (e.g. **--log-opt max-size=10mb**); + +**tag**: specify a custom log tag for the container + (e.g. **--log-opt tag="{{.ImageName}}"**. +It supports the same keys as **podman inspect --format**. +This option is currently supported only by the **journald** log driver. + +[//]: # (END included file options/log-opt.md) + + +[//]: # (BEGIN included file options/mac-address.md) +#### **--mac-address**=*address* + +Container network interface MAC address (e.g. 92\:d0\:c6:0a:29:33) +This option can only be used if the container is joined to only a single network - i.e., **--network=_network-name_** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. + +Remember that the MAC address in an Ethernet network must be unique. +The IPv6 link-local address is based on the device's MAC address +according to RFC4862. + +To specify multiple static MAC addresses per container, set multiple networks using the **--network** option with a static MAC address specified for each using the `mac` mode for that option. + +[//]: # (END included file options/mac-address.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-reservation.md) +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-reservation.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/memory-swappiness.md) +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/memory-swappiness.md) + + +[//]: # (BEGIN included file options/mount.md) +#### **--mount**=*type=TYPE,TYPE-SPECIFIC-OPTION[,...]* + +Attach a filesystem mount to the container. + +Current supported mount TYPEs are **artifact**, **bind**, **devpts**, **glob**, **image**, **ramfs**, **tmpfs** and **volume**. + +Options common to all mount types: + +- *src*, *source*: mount source spec for **bind**, **glob**, and **volume**. + Mandatory for **artifact**, **bind**, **glob**, **image** and **volume**. + +- *dst*, *destination*, *target*: mount destination spec. + +When source globs are specified without the destination directory, +the files and directories are mounted with their complete path +within the container. When the destination is specified, the +files and directories matching the glob on the base file name +on the destination directory are mounted. The option +`type=glob,src=/foo*,destination=/tmp/bar` tells container engines +to mount host files matching /foo* to the /tmp/bar/ +directory in the container. + +Options specific to type=**artifact**: + +- *digest*: If the artifact source contains multiple blobs a digest can be + specified to only mount the one specific blob with the digest. + +- *title*: If the artifact source contains multiple blobs a title can be set + which is compared against `org.opencontainers.image.title` annotation. + +The *src* argument contains the name of the artifact, which must already exist locally. +The *dst* argument contains the target path, if the path in the container is a +directory or does not exist the blob title (`org.opencontainers.image.title` +annotation) will be used as filename and joined to the path. If the annotation +does not exist the digest will be used as filename instead. This results in all blobs +of the artifact mounted into the container at the given path. + +However, if the *dst* path is an existing file in the container, then the blob will be +mounted directly on it. This only works when the artifact contains a single blob +or when either *digest* or *title* are specified. + +Options specific to type=**volume**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *idmap*: If specified, create an idmapped mount to the target user namespace in the container. + The idmap option is only supported by Podman in rootful mode. The Linux kernel does not allow the use of idmapped file systems for unprivileged users. + The idmap option supports a custom mapping that can be different than the user namespace used by the container. + The mapping can be specified after the idmap option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the first value is the + start of the backing file system IDs that are mapped to the second value on the host. The length of this mapping is given in the third value. + Multiple ranges are separated with #. If the specified mapping is prepended with a '@', then the mapping is considered relative to the container + user namespace. The host ID for the mapping is changed to account for the relative position of the container user in the container user namespace. + +Options specific to type=**image**: + +- *rw*, *readwrite*: *true* or *false* (default if unspecified: *false*). + +- *subpath*: Mount only a specific path within the image, instead of the whole image. + +Options specific to **bind** and **glob**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *bind-propagation*: *shared*, *slave*, *private*, *unbindable*, *rshared*, *rslave*, *runbindable*, or **rprivate** (default).[[1]](#Footnote1) See also mount(2). + +- *bind-nonrecursive*: do not set up a recursive bind mount. By default it is recursive. + +- *relabel*: *shared*, *private*. + +- *idmap*: *true* or *false* (default if unspecified: *false*). If true, create an idmapped mount to the target user namespace in the container. The idmap option is only supported by Podman in rootful mode. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *no-dereference*: do not dereference symlinks but copy the link source into the mount destination. + +Options specific to type=**tmpfs** and **ramfs**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *tmpfs-size*: Size of the tmpfs/ramfs mount, in bytes. Unlimited by default in Linux. + +- *tmpfs-mode*: Octal file mode of the tmpfs/ramfs (e.g. 700 or 0700.). + +- *tmpcopyup*: Enable copyup from the image directory at the same location to the tmpfs/ramfs. Used by default. + +- *notmpcopyup*: Disable copying files from the image to the tmpfs/ramfs. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +Options specific to type=**devpts**: + +- *uid*: numeric UID of the file owner (default: 0). + +- *gid*: numeric GID of the file owner (default: 0). + +- *mode*: octal permission mask for the file (default: 600). + +- *max*: maximum number of PTYs (default: 1048576). + +Examples: + +- `type=bind,source=/path/on/host,destination=/path/in/container` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared,U=true` + +- `type=devpts,destination=/dev/pts` + +- `type=glob,src=/usr/lib/libfoo*,destination=/usr/lib,ro=true` + +- `type=image,source=fedora,destination=/fedora-image,rw=true` + +- `type=ramfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,destination=/path/in/container,noswap` + +- `type=artifact,src=quay.io/libpod/testartifact:20250206-single,dst=/data` + +- `type=artifact,src=quay.io/libpod/testartifact:20250206-multi,dst=/data,title=test1` + +[//]: # (END included file options/mount.md) + + +[//]: # (BEGIN included file options/name.container.md) +#### **--name**=*name* + +Assign a name to the container. + +The operator can identify a container in three ways: + +- UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”); +- UUID short identifier (“f78375b1c487”); +- Name (“jonah”). + +Podman generates a UUID for each container, and if no name is assigned to the +container using **--name**, Podman generates a random string name. The name can +be useful as a more human-friendly way to identify containers. This works for +both background and foreground containers. The container's name is also added +to the `/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). + +[//]: # (END included file options/name.container.md) + + +[//]: # (BEGIN included file options/network.md) +#### **--network**=*mode*, **--net** + +Set the network mode for the container. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + For better integration with DNS handling, **--dns-forward 169.254.1.1** is passed, + and this address is added to resolv.conf(5) as first resolver. It is possible to pass + **--dns-forward** explicitly in case a different IP address should be used. + To make the `host.containers.internal` /etc/hosts entry work and allow connections + to the host, **--map-guest-addr 169.254.1.2** is passed. Again, it can be set + explicitly to choose a different IP address. \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured (via Podman's + **--publish** or by passing the pasta **-t**/**-u** options directly), + to disable automatic port forwarding based on bound ports. Similarly, **-T none** + and **-U none** are given to disable the same functionality from container to + host. \ + All options can also be set in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**; + see the `pasta_options` key under the network section in that file. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.md) + +Invalid if using **--dns**, **--dns-option**, or **--dns-search** with **--network** set to **none** or **container:**_id_. + +If used together with **--pod**, the container does not join the pod's network namespace. + + +[//]: # (BEGIN included file options/network-alias.md) +#### **--network-alias**=*alias* + +Add a network-scoped alias for the container, setting the alias for all networks that the container joins. To set a +name only for a specific network, use the alias option as described under the **--network** option. +If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. This option can be specified multiple times. +NOTE: When using CNI a container only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. + +[//]: # (END included file options/network-alias.md) + + +[//]: # (BEGIN included file options/no-healthcheck.md) +#### **--no-healthcheck** + +Disable any defined healthchecks for container. + +[//]: # (END included file options/no-healthcheck.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the container. + +Podman assumes control over the container's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/oom-kill-disable.md) +#### **--oom-kill-disable** + +Whether to disable OOM Killer for the container or not. + +This flag is not supported on cgroups V2 systems. + +[//]: # (END included file options/oom-kill-disable.md) + + +[//]: # (BEGIN included file options/oom-score-adj.md) +#### **--oom-score-adj**=*num* + +Tune the host's OOM preferences for containers (accepts values from **-1000** to **1000**). + +When running in rootless mode, the specified value can't be lower than +the oom_score_adj for the current process. In this case, the +oom-score-adj is clamped to the current process value. + +[//]: # (END included file options/oom-score-adj.md) + + +[//]: # (BEGIN included file options/os.pull.md) +#### **--os**=*OS* + +Override the OS, defaults to hosts, of the image to be pulled. For example, `windows`. +Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. + +[//]: # (END included file options/os.pull.md) + + +[//]: # (BEGIN included file options/passwd-entry.md) +#### **--passwd-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/passwd` file within the container when `--passwd` is used. + +The variables $USERNAME, $UID, $GID, $NAME, $HOME are automatically replaced with their value at runtime. + +[//]: # (END included file options/passwd-entry.md) + + +[//]: # (BEGIN included file options/personality.md) +#### **--personality**=*persona* + +Personality sets the execution domain via Linux personality(2). + +[//]: # (END included file options/personality.md) + + +[//]: # (BEGIN included file options/pid.container.md) +#### **--pid**=*mode* + +Set the PID namespace mode for the container. +The default is to create a private PID namespace for the container. + +- **container:**_id_: join another container's PID namespace; +- **host**: use the host's PID namespace for the container. Note the host mode gives the container full access to local PID and is therefore considered insecure; +- **ns:**_path_: join the specified PID namespace; +- **private**: create a new namespace for the container (default). + +[//]: # (END included file options/pid.container.md) + + +[//]: # (BEGIN included file options/pidfile.md) +#### **--pidfile**=*path* + +When the pidfile location is specified, the container process' PID is written to the pidfile. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +If the pidfile option is not specified, the container process' PID is written to /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile. + +After the container is started, the location for the pidfile can be discovered with the following `podman inspect` command: + + $ podman inspect --format '{{ .PidFile }}' $CID + /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile + +[//]: # (END included file options/pidfile.md) + + +[//]: # (BEGIN included file options/pids-limit.md) +#### **--pids-limit**=*limit* + +Tune the container's pids limit. Set to **-1** to have unlimited pids for the container. The default is **2048** on systems that support "pids" cgroup controller. + +[//]: # (END included file options/pids-limit.md) + + +[//]: # (BEGIN included file options/platform.md) +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with --arch and --os) +The `--platform` option can be used to override the current architecture and operating system. +Unless overridden, subsequent lookups of the same image in the local storage matches this platform, regardless of the host. + +[//]: # (END included file options/platform.md) + + +[//]: # (BEGIN included file options/pod.run.md) +#### **--pod**=*name* + +Run container in an existing pod. Podman makes the pod automatically if the pod name is prefixed with **new:**. +To make a pod with more granular options, use the **podman pod create** command before creating a container. +When a container is run with a pod with an infra-container, the infra-container is started first. + +[//]: # (END included file options/pod.run.md) + + +[//]: # (BEGIN included file options/pod-id-file.container.md) +#### **--pod-id-file**=*file* + +Run container in an existing pod and read the pod's ID from the specified *file*. +When a container is run within a pod which has an infra-container, the infra-container starts first. + +[//]: # (END included file options/pod-id-file.container.md) + + +[//]: # (BEGIN included file options/privileged.md) +#### **--privileged** + +Give extended privileges to this container. The default is **false**. + +By default, Podman containers are unprivileged (**=false**) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read-only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. +Due to the disabled security features, the privileged field should almost never +be set as containers can easily break out of confinement. + +Containers running in a user namespace (e.g., rootless containers) cannot have +more privileges than the user that launched them. + +[//]: # (END included file options/privileged.md) + + +[//]: # (BEGIN included file options/publish.md) +#### **--publish**, **-p**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Publish a container's port, or range of ports, to the host. + +Both *hostPort* and *containerPort* can be specified as a range of ports. +When specifying ranges for both, the number of container ports in the +range must match the number of host ports in the range. + +If host IP is set to 0.0.0.0 or not set at all, the port is bound on all IPs on the host. + +By default, Podman publishes TCP ports. To publish a UDP port instead, give +`udp` as protocol. To publish both TCP and UDP ports, set `--publish` twice, +with `tcp`, and `udp` as protocols respectively. Rootful containers can also +publish ports using the `sctp` protocol. + +Host port does not have to be specified (e.g. `podman run -p 127.0.0.1::80`). +If it is not, the container port is randomly assigned a port on the host. + +Use **podman port** to see the actual mapping: `podman port $CONTAINER $CONTAINERPORT`. + +Note that the network drivers `macvlan` and `ipvlan` do not support port forwarding, +therefore this option will have no effect on such networks. + +[//]: # (END included file options/publish.md) + +**Note:** If a container runs within a pod, it is not necessary to publish the port for +the containers in the pod. The port must only be published by the pod itself. Pod network +stacks act like the network stack on the host - when there are a variety of containers in the pod, +and programs in the container, all sharing a single interface and IP address, and +associated ports. If one container binds to a port, no other container can use that port +within the pod while it is in use. Containers in the pod can also communicate over localhost +by having one container bind to localhost in the pod, and another connect to that port. + + +[//]: # (BEGIN included file options/publish-all.md) +#### **--publish-all**, **-P** + +Publish all exposed ports to random ports on the host interfaces. The default is **false**. + +When set to **true**, publish all exposed ports to the host interfaces. +If the operator uses **-P** (or **-p**) then Podman makes the +exposed port accessible on the host and the ports are available to any +client that can reach the host. + +When using this option, Podman binds any exposed port to a random port on the host +within an ephemeral port range defined by */proc/sys/net/ipv4/ip_local_port_range*. +To find the mapping between the host ports and the exposed ports, use **podman port**. + +[//]: # (END included file options/publish-all.md) + + +[//]: # (BEGIN included file options/pull.md) +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Pull the image only when the image is not in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error if no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. + +[//]: # (END included file options/pull.md) + +#### **--quiet**, **-q** + +Suppress output information when pulling images + + +[//]: # (BEGIN included file options/rdt-class.md) +#### **--rdt-class**=*intel-rdt-class-of-service* + +Rdt-class sets the class of service (CLOS or COS) for the container to run in. Based on the Cache Allocation Technology (CAT) feature that is part of Intel's Resource Director Technology (RDT) feature set, all container processes will run within the pre-configured COS, representing a part of the cache. The COS has to be created and configured using a pseudo file system (usually mounted at `/sys/fs/resctrl`) that the resctrl kernel driver provides. Assigning the container to a COS requires root privileges and thus doesn't work in a rootless environment. Currently, the feature is only supported using `runc` as a runtime. See for more details on creating a COS before a container can be assigned to it. + +[//]: # (END included file options/rdt-class.md) + + +[//]: # (BEGIN included file options/read-only.md) +#### **--read-only** + +Mount the container's root filesystem as read-only. + +By default, container root filesystems are writable, allowing processes +to write files anywhere. By specifying the **--read-only** flag, the containers root filesystem are mounted read-only prohibiting any writes. + +[//]: # (END included file options/read-only.md) + + +[//]: # (BEGIN included file options/read-only-tmpfs.md) +#### **--read-only-tmpfs** + +When running --read-only containers, mount a read-write tmpfs on _/dev_, _/dev/shm_, _/run_, _/tmp_, and _/var/tmp_. The default is **true**. + +| --read-only | --read-only-tmpfs | / | /run, /tmp, /var/tmp| +| ----------- | ----------------- | ---- | ----------------------------------- | +| true | true | r/o | r/w | +| true | false | r/o | r/o | +| false | false | r/w | r/w | +| false | true | r/w | r/w | + +When **--read-only=true** and **--read-only-tmpfs=true** additional tmpfs are mounted on +the /tmp, /run, and /var/tmp directories. + +When **--read-only=true** and **--read-only-tmpfs=false** /dev and /dev/shm are marked +Read/Only and no tmpfs are mounted on /tmp, /run and /var/tmp. The directories +are exposed from the underlying image, meaning they are read-only by default. +This makes the container totally read-only. No writable directories exist within +the container. In this mode writable directories need to be added via external +volumes or mounts. + +By default, when **--read-only=false**, the /dev and /dev/shm are read/write, and the /tmp, /run, and /var/tmp are read/write directories from the container image. + +[//]: # (END included file options/read-only-tmpfs.md) + + +[//]: # (BEGIN included file options/replace.md) +#### **--replace** + +If another container with the same name already exists, replace and remove it. The default is **false**. + +[//]: # (END included file options/replace.md) + + +[//]: # (BEGIN included file options/requires.md) +#### **--requires**=*container* + +Specify one or more requirements. +A requirement is a dependency container that is started before this container. +Containers can be specified by name or ID, with multiple containers being separated by commas. + +[//]: # (END included file options/requires.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + +#### **--rm** + +Automatically remove the container and any anonymous unnamed volume associated with +the container when it exits. The default is **false**. + + +[//]: # (BEGIN included file options/rootfs.md) +#### **--rootfs** + +If specified, the first argument refers to an exploded container on the file system. + +This is useful to run a container without requiring any image management, the rootfs +of the container is assumed to be managed externally. + + `Overlay Rootfs Mounts` + + The `\:O` flag tells Podman to mount the directory from the rootfs path as +storage using the `overlay file system`. The container processes +can modify content within the mount point which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +Note: On **SELinux** systems, the rootfs needs the correct label, which is by default +**unconfined_u\:object_r\:container_file_t\:s0**. + + `idmap` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. +The idmap option supports a custom mapping that can be different than the user +namespace used by the container. The mapping can be specified after the idmap +option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the +first value is the start of the backing file system IDs that are mapped to the +second value on the host. The length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/rootfs.md) + + +[//]: # (BEGIN included file options/sdnotify.md) +#### **--sdnotify**=**container** | *conmon* | *healthy* | *ignore* + +Determines how to use the NOTIFY_SOCKET, as passed with systemd and Type=notify. + +Default is **container**, which means allow the OCI runtime to proxy the socket into the +container to receive ready notification. Podman sets the MAINPID to conmon's pid. +The **conmon** option sets MAINPID to conmon's pid, and sends READY when the container +has started. The socket is never passed to the runtime or the container. +The **healthy** option sets MAINPID to conmon's pid, and sends READY when the container +has turned healthy; requires a healthcheck to be set. The socket is never passed to the runtime or the container. +The **ignore** option removes NOTIFY_SOCKET from the environment for itself and child processes, +for the case where some other process above Podman uses NOTIFY_SOCKET and Podman does not use it. + +[//]: # (END included file options/sdnotify.md) + + +[//]: # (BEGIN included file options/seccomp-policy.md) +#### **--seccomp-policy**=*policy* + +Specify the policy to select the seccomp profile. If set to *image*, Podman looks for a "io.containers.seccomp.profile" label in the container-image config and use its value as a seccomp profile. Otherwise, Podman follows the *default* policy by applying the default profile unless specified otherwise via *--security-opt seccomp* as described below. + +Note that this feature is experimental and may change in the future. + +[//]: # (END included file options/seccomp-policy.md) + + +[//]: # (BEGIN included file options/secret.md) +#### **--secret**=*secret[,opt=opt ...]* + +Give the container access to a secret. Can be specified multiple times. + +A secret is a blob of sensitive data which a container needs at runtime but +is not stored in the image or in source control, such as usernames and passwords, +TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 512 kB in size). + +When secrets are specified as type `mount`, the secrets are copied and mounted into the container when a container is created. +When secrets are specified as type `env`, the secret is set as an environment variable within the container. +Secrets are written in the container at the time of container creation, and modifying the secret using `podman secret` commands +after the container is created affects the secret inside the container. + +Secrets and its storage are managed using the `podman secret` command. + +Secret Options + +- `type=mount|env` : How the secret is exposed to the container. + `mount` mounts the secret into the container as a file. + `env` exposes the secret as an environment variable. + Defaults to `mount`. +- `target=target` : Target of secret. + For mounted secrets, this is the path to the secret inside the container. + If a fully qualified path is provided, the secret is mounted at that location. + Otherwise, the secret is mounted to + `/run/secrets/target` for Linux containers or + `/var/run/secrets/target` for FreeBSD containers. + If the target is not set, the secret is mounted to `/run/secrets/secretname` by default. + For env secrets, this is the environment variable key. Defaults to `secretname`. +- `uid=0` : UID of secret. Defaults to 0. Mount secret type only. +- `gid=0` : GID of secret. Defaults to 0. Mount secret type only. +- `mode=0` : Mode of secret. Defaults to 0444. Mount secret type only. + + +Examples + +Mount at `/my/location/mysecret` with UID 1: +``` +--secret mysecret,target=/my/location/mysecret,uid=1 +``` + +Mount at `/run/secrets/customtarget` with mode 0777: +``` +--secret mysecret,target=customtarget,mode=0777 +``` + +Create a secret environment variable called `ENVSEC`: +``` +--secret mysecret,type=env,target=ENVSEC +``` + +[//]: # (END included file options/secret.md) + + +[//]: # (BEGIN included file options/security-opt.md) +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the container +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the container + +- **label=user:**_USER_: Set the label user for the container processes +- **label=role:**_ROLE_: Set the label role for the container processes +- **label=type:**_TYPE_: Set the label process type for the container processes +- **label=level:**_LEVEL_: Set the label level for the container processes +- **label=filetype:**_TYPE_: Set the label file type for the container files +- **label=disable**: Turn off label separation for the container + +Note: Labeling can be disabled for all containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the container. + +- **no-new-privileges**: Disable container processes from gaining additional privileges through the `execve(2)` system call (e.g. via setuid or setgid bits, or via file capabilities). Programs that rely on setuid/setgid bits set on their executable to change user id or group id are no longer able to do so, and any file capabilities added to the executable (e.g. via `setcap`) are not added to the permitted capability set. For more details, see: https://docs.kernel.org/userspace-api/no_new_privs.html. + +- **seccomp=unconfined**: Turn off seccomp confinement for the container. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. + +[//]: # (END included file options/security-opt.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the container. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/shm-size-systemd.md) +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. + +[//]: # (END included file options/shm-size-systemd.md) + + +[//]: # (BEGIN included file options/stop-signal.md) +#### **--stop-signal**=*signal* + +Signal to stop a container. Default is **SIGTERM**. + +[//]: # (END included file options/stop-signal.md) + + +[//]: # (BEGIN included file options/stop-timeout.md) +#### **--stop-timeout**=*seconds* + +Timeout to stop a container. Default is **10**. +Remote connections use local containers.conf for defaults. + +[//]: # (END included file options/stop-timeout.md) + + +[//]: # (BEGIN included file options/subgidname.md) +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. + +[//]: # (END included file options/subgidname.md) + + +[//]: # (BEGIN included file options/subuidname.md) +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. + +[//]: # (END included file options/subuidname.md) + + +[//]: # (BEGIN included file options/sysctl.md) +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters at runtime. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: if using the **--ipc=host** option, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: if using the **--network=host** option, the above sysctls are not allowed. + +[//]: # (END included file options/sysctl.md) + + +[//]: # (BEGIN included file options/systemd.md) +#### **--systemd**=*true* | *false* | *always* + +Run container in systemd mode. The default is **true**. + +- **true** enables systemd mode only when the command executed inside the container is *systemd*, */usr/sbin/init*, +*/sbin/init* or */usr/local/sbin/init*. + +- **false** disables systemd mode. + +- **always** enforces the systemd mode to be enabled. + +Running the container in systemd mode causes the following changes: + +* Podman mounts tmpfs file systems on the following directories + * _/run_ + * _/run/lock_ + * _/tmp_ + * _/sys/fs/cgroup/systemd_ (on a cgroup v1 system) + * _/var/lib/journal_ +* Podman sets the default stop signal to **SIGRTMIN+3**. +* Podman sets **container_uuid** environment variable in the container to the +first 32 characters of the container ID. +* Podman does not mount virtual consoles (_/dev/tty\d+_) when running with **--privileged**. +* On cgroup v2, */sys/fs/cgroup* is mounted writable. + +This allows systemd to run in a confined container without any modifications. + +Note that on **SELinux** systems, systemd attempts to write to the cgroup +file system. Containers writing to the cgroup file system are denied by default. +The **container_manage_cgroup** boolean must be enabled for this to be allowed on an SELinux separated system. +``` +setsebool -P container_manage_cgroup true +``` + +[//]: # (END included file options/systemd.md) + + +[//]: # (BEGIN included file options/timeout.md) +#### **--timeout**=*seconds* + +Maximum time a container is allowed to run before conmon sends it the kill +signal. By default containers run until they exit or are stopped by +`podman stop`. + +[//]: # (END included file options/timeout.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/tmpfs.md) +#### **--tmpfs**=*fs* + +Create a tmpfs mount. + +Mount a temporary filesystem (**tmpfs**) mount into a container, for example: + +``` +$ podman create -d --tmpfs /tmp\:rw,size=787448k,mode=1777 my_image +``` + +This command mounts a **tmpfs** at _/tmp_ within the container. The supported mount +options are the same as the Linux default mount flags. If no options are specified, +the system uses the following options: +**rw,noexec,nosuid,nodev**. + +[//]: # (END included file options/tmpfs.md) + + +[//]: # (BEGIN included file options/tty.md) +#### **--tty**, **-t** + +Allocate a pseudo-TTY. The default is **false**. + +When set to **true**, Podman allocates a pseudo-tty and attach to the standard +input of the container. This can be used, for example, to run a throwaway +interactive shell. + +**NOTE**: The --tty flag prevents redirection of standard output. It combines STDOUT and STDERR, it can insert control characters, and it can hang pipes. This option is only used when run interactively in a terminal. When feeding input to Podman, use -i only, not -it. + +[//]: # (END included file options/tty.md) + + +[//]: # (BEGIN included file options/tz.md) +#### **--tz**=*timezone* + +Set timezone in container. This flag takes area-based timezones, GMT time, as well as `local`, which sets the timezone in the container to match the host machine. See `/usr/share/zoneinfo/` for valid timezones. +Remote connections use local containers.conf for defaults + +[//]: # (END included file options/tz.md) + + +[//]: # (BEGIN included file options/uidmap.container.md) +#### **--uidmap**=*[flags]container_uid\:from_uid[\:amount]* + +Run the container in a new user namespace using the supplied UID mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +The possible values of the optional *flags* are discussed further down on this page. +The *amount* value is optional and assumed to be **1** if not given. + +The *from_uid* value is based upon the user running the command, either rootful or rootless users. + +* rootful user: [*flags*]*container_uid*:*host_uid*[:*amount*] +* rootless user: [*flags*]*container_uid*:*intermediate_uid*[:*amount*] + + `Rootful mappings` + + +When **podman create** is called by a privileged user, the option **--uidmap** +works as a direct mapping between host UIDs and container UIDs. + +host UID -> container UID + +The _amount_ specifies the number of consecutive UIDs that is mapped. +If for example _amount_ is **4** the mapping looks like: + +| host UID | container UID | +| ---------- | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | + + `Rootless mappings` + +When **podman create** is called by an unprivileged user (i.e. running rootless), +the value *from_uid* is interpreted as an "intermediate UID". In the rootless +case, host UIDs are not mapped directly to container UIDs. Instead the mapping +happens over two mapping steps: + +host UID -> intermediate UID -> container UID + +The **--uidmap** option only influences the second mapping step. + +The first mapping step is derived by Podman from the contents of the file +_/etc/subuid_ and the UID of the user calling Podman. + +First mapping step: + +| host UID | intermediate UID | +| -------- | ---------------- | +| UID for Podman user | 0 | +| 1st subordinate UID | 1 | +| 2nd subordinate UID | 2 | +| 3rd subordinate UID | 3 | +| nth subordinate UID | n | + +To be able to use intermediate UIDs greater than zero, the user needs to have +subordinate UIDs configured in _/etc/subuid_. See **subuid**(5). + +The second mapping step is configured with **--uidmap**. + +If for example _amount_ is **5** the second mapping step looks like: + +| intermediate UID | container UID | +| ------------------ | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | +| *from_uid* + 4 | *container_uid* + 4 | + +When running as rootless, Podman uses all the ranges configured in the _/etc/subuid_ file. + +The current user ID is mapped to UID=0 in the rootless user namespace. +Every additional range is added sequentially afterward: + +| host | rootless user namespace | length | +| ------ | ----------------------- | ------ | +| $UID | 0 | 1 | +| 1 | $FIRST_RANGE_ID | $FIRST_RANGE_LENGTH | +| 1+$FIRST_RANGE_LENGTH | $SECOND_RANGE_ID | $SECOND_RANGE_LENGTH| + + `Referencing a host ID from the parent namespace` + +As a rootless user, the given host ID in **--uidmap** or **--gidmap** +is mapped from the *intermediate namespace* generated by Podman. Sometimes +it is desirable to refer directly at the *host namespace*. It is possible +to manually do so, by running `podman unshare cat /proc/self/gid_map`, +finding the desired host id at the second column of the output, and getting +the corresponding intermediate id from the first column. + +Podman can perform all that by preceding the host id in the mapping +with the `@` symbol. For instance, by specifying `--gidmap 100000:@2000:1`, +podman will look up the intermediate id corresponding to host id `2000` and +it will map the found intermediate id to the container id `100000`. The +given host id must have been subordinated (otherwise it would not be mapped +into the intermediate space in the first place). + +If the length is greater than one, for instance with `--gidmap 100000:@2000:2`, +Podman will map host ids `2000` and `2001` to `100000` and `100001`, respectively, +regardless of how the intermediate mapping is defined. + + `Extending previous mappings` + +Some mapping modifications may be cumbersome. For instance, a user +starts with a mapping such as `--gidmap="0:0:65000"`, that needs to be +changed such as the parent id `1000` is mapped to container id `100000` +instead, leaving container id `1` unassigned. The corresponding `--gidmap` +becomes `--gidmap="0:0:1" --gidmap="2:2:65534" --gidmap="100000:1:1"`. + +This notation can be simplified using the `+` flag, that takes care of +breaking previous mappings removing any conflicting assignment with +the given mapping. The flag is given before the container id +as follows: `--gidmap="0:0:65000" --gidmap="+100000:1:1"` + + + Flag | Example | Description +-----------|---------------|------------- + `+` | `+100000:1:1` | Extend the previous mapping + +This notation leads to gaps in the assignment, so it may be convenient to +fill those gaps afterwards: `--gidmap="0:0:65000" --gidmap="+100000:1:1" --gidmap="1:65001:1"` + +One specific use case for this flag is in the context of rootless +users. A rootless user may specify mappings with the `+` flag as +in `--gidmap="+100000:1:1"`. Podman will then "fill the gaps" starting +from zero with all the remaining intermediate ids. This is convenient when +a user wants to map a specific intermediate id to a container id, leaving +the rest of subordinate ids to be mapped by Podman at will. + + `Passing only one of --uidmap or --gidmap` + +Usually, subordinated user and group ids are assigned simultaneously, and +for any user the subordinated user ids match the subordinated group ids. +For convenience, if only one of **--uidmap** or **--gidmap** is given, +podman assumes the mapping refers to both UIDs and GIDs and applies the +given mapping to both. If only one value of the two needs to be changed, +the mappings should include the `u` or the `g` flags to specify that +they only apply to UIDs or GIDs and should not be copied over. + + flag | Example | Description +---------|-----------------|----------------- + `u` | `u20000:2000:1` |The mapping only applies to UIDs + `g` | `g10000:1000:1` |The mapping only applies to GIDs + +For instance given the command + + podman create --gidmap "0:0:1000" --gidmap "g2000:2000:1" + +Since no **--uidmap** is given, the **--gidmap** is copied to **--uidmap**, +giving a command equivalent to + + podman create --gidmap "0:0:1000" --gidmap "2000:2000:1" --uidmap "0:0:1000" + +The `--gidmap "g2000:2000:1"` used the `g` flag and therefore it was +not copied to **--uidmap**. + + `Rootless mapping of additional host GIDs` + +A rootless user may desire to map a specific host group that has already been +subordinated within _/etc/subgid_ without specifying the rest of the mapping. + +This can be done with **--gidmap "+g*container_gid*:@*host_gid*"** + +Where: + +- The host GID is given through the `@` symbol +- The mapping of this GID is not copied over to **--usermap** thanks to the `g` flag. +- The rest of the container IDs will be mapped starting from 0 to n, + with all the remaining subordinated GIDs, thanks to the `+` flag. + +For instance, if a user belongs to the group `2000` and that group is +subordinated to that user (with `usermod --add-subgids 2000-2000 $USER`), +the user can map the group into the container with: **--gidmap=+g100000:@2000**. + +If this mapping is combined with the option, **--group-add=keep-groups**, the +process in the container will belong to group `100000`, and files belonging +to group `2000` in the host will appear as being owned by group `100000` +inside the container. + + podman run --group-add=keep-groups --gidmap="+g100000:@2000" ... + + `No subordinate UIDs` + +Even if a user does not have any subordinate UIDs in _/etc/subuid_, +**--uidmap** can be used to map the normal UID of the user to a +container UID by running `podman create --uidmap $container_uid:0:1 --user $container_uid ...`. + + `Pods` + +The **--uidmap** option cannot be called in conjunction with the **--pod** option as a uidmap cannot be set on the container level when in a pod. + +[//]: # (END included file options/uidmap.container.md) + + +[//]: # (BEGIN included file options/ulimit.md) +#### **--ulimit**=*option* + +Ulimit options. Sets the ulimits values inside of the container. + +--ulimit with a soft and hard limit in the format =[:]. For example: + +$ podman run --ulimit nofile=1024:1024 --rm ubi9 ulimit -n +1024 + +Set -1 for the soft or hard limit to set the limit to the maximum limit of the current +process. In rootful mode this is often unlimited. + + +If nofile and nproc are unset, a default value of 1048576 will be used, unless overridden +in containers.conf(5). However, if the default value exceeds the hard limit for the current +rootless user, the current hard limit will be applied instead. + +Use **host** to copy the current configuration from the host. + +Don't use nproc with the ulimit flag as Linux uses nproc to set the +maximum number of processes available to a user, not to a container. + +Use the --pids-limit option to modify the cgroup control to limit the number +of processes within a container. + +[//]: # (END included file options/ulimit.md) + + +[//]: # (BEGIN included file options/umask.md) +#### **--umask**=*umask* + +Set the umask inside the container. Defaults to `0022`. +Remote connections use the local `containers.conf` for defaults. + +[//]: # (END included file options/umask.md) + + +[//]: # (BEGIN included file options/unsetenv.md) +#### **--unsetenv**=*env* + +Unset default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. + +[//]: # (END included file options/unsetenv.md) + + +[//]: # (BEGIN included file options/unsetenv-all.md) +#### **--unsetenv-all** + +Unset all default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. + +[//]: # (END included file options/unsetenv-all.md) + + +[//]: # (BEGIN included file options/user.md) +#### **--user**, **-u**=*user[\:group]* + +Sets the username or UID used and, optionally, the groupname or GID for the specified command. Both *user* and *group* may be symbolic or numeric. + +Without this argument, the command runs as the user specified in the container image. Unless overridden by a `USER` command in the Containerfile or by a value passed to this option, this user generally defaults to root. + +When a user namespace is not in use, the UID and GID used within the container and on the host match. When user namespaces are in use, however, the UID and GID in the container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container by default corresponds to the UID and GID of the user invoking Podman. + +[//]: # (END included file options/user.md) + + +[//]: # (BEGIN included file options/userns.container.md) +#### **--userns**=*mode* + +Set the user namespace mode for the container. + +If `--userns` is not set, the default value is determined as follows. +- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used. +- If the environment variable **PODMAN_USERNS** is set its value is used. +- If `userns` is specified in `containers.conf` this value is used. +- Otherwise, `--userns=host` is assumed. + +`--userns=""` (i.e., an empty string) is an alias for `--userns=host`. + +This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +------------------------|-----------|--------------------- +auto | $UID | nil (Host User UID is not mapped into container.) +host | $UID | 0 (Default User account mapped to root user in container.) +keep-id | $UID | $UID (Map user account to same UID within container.) +keep-id\:uid=200,gid=210 | $UID | 200:210 (Map user account to specified UID, GID value within container.) +nomap | $UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + +**auto**[\:_OPTIONS,..._]: automatically create a unique user namespace. + +* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. + + Example: `containers:2147483647:2147483648`. + +* `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5). + +Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user IDs. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. + +The option `--userns=keep-id` uses all the subuids and subgids of the user. +The option `--userns=nomap` uses all the subuids and subgids of the user except the user's own ID. +Using `--userns=auto` when starting new containers does not work as long as any containers exist that were started with `--userns=nomap` or `--userns=keep-id` without limiting the user namespace size. + + Valid `auto` options: + + - *gidmapping*=_CONTAINER\_GID\:HOST\_GID\:SIZE_: to force a GID mapping to be present in the user namespace. + - *size*=_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates a size for the user namespace. + - *uidmapping*=_CONTAINER\_UID\:HOST\_UID\:SIZE_: to force a UID mapping to be present in the user namespace. + +The host UID and GID in *gidmapping* and *uidmapping* can optionally be prefixed with the `@` symbol. +In this case, podman will look up the intermediate ID corresponding to host ID and it will map the found intermediate ID to the container id. +For details see **--uidmap**. + +**container:**_id_: join the user namespace of the specified container. + +**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user. + +**keep-id**: creates a user namespace where the current user's UID\:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace. + + Valid `keep-id` options: + + - *uid*=UID: override the UID inside the container that is used to map the current user to. + - *gid*=GID: override the GID inside the container that is used to map the current user to. + - *size*=SIZE: override the size of the configured user namespace. It is useful to not saturate all the available IDs. Not supported when running as root. + +**nomap**: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +**ns:**_namespace_: run the container in the given existing user namespace. + +[//]: # (END included file options/userns.container.md) + + +[//]: # (BEGIN included file options/uts.container.md) +#### **--uts**=*mode* + +Set the UTS namespace mode for the container. The following values are supported: + +- **host**: use the host's UTS namespace inside the container. +- **private**: create a new namespace for the container (default). +- **ns:[path]**: run the container in the given existing UTS namespace. +- **container:[container]**: join the UTS namespace of the specified container. + +[//]: # (END included file options/uts.container.md) + + +[//]: # (BEGIN included file options/variant.container.md) +#### **--variant**=*VARIANT* + +Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. + +[//]: # (END included file options/variant.container.md) + + +[//]: # (BEGIN included file options/volume.md) +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the container is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +container. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a container is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the container, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the container. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system +might prevent the processes running inside the container from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the container context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +containers share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label. Only the current container can use a private +volume. + +Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any one of the containers. Relabeling walks +the file system under the volume and changes the label on each file; if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the container. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually changed with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the container. +For example if a user wanted to volume mount their entire home directory into a +container, they need to disable SELinux separation. + + $ podman create --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The container processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous container executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the container +to work. + +Do not modify the source directory mounted into the container with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the container are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the container +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +container, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +container. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the container. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the container. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless container fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/volume.md) + +Use the **--group-add keep-groups** option to pass the user's supplementary group access into the container. + + +[//]: # (BEGIN included file options/volumes-from.md) +#### **--volumes-from**=*CONTAINER[\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +container. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target container, then the volume hides +that data on the target. + +[//]: # (END included file options/volumes-from.md) + + +[//]: # (BEGIN included file options/workdir.md) +#### **--workdir**, **-w**=*dir* + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (**/**). +The image developer can set a different default with the WORKDIR instruction. The operator +can override the working directory by using the **-w** option. + +[//]: # (END included file options/workdir.md) + +## EXAMPLES + +Create a container using a local image: +``` +$ podman create alpine ls +``` + +Create a container using a local image and annotate it: +``` +$ podman create --annotation HELLO=WORLD alpine ls +``` + +Create a container using a local image, allocating a pseudo-TTY, keeping stdin open and name it myctr: +``` + podman create -t -i --name myctr alpine ls +``` + +Running a container in a new user namespace requires a mapping of +the UIDs and GIDs from the host: +``` +$ podman create --uidmap 0:30000:7000 --gidmap 0:30000:7000 fedora echo hello +``` + +Setting automatic user-namespace separated containers: +``` +# podman create --userns=auto\:size=65536 ubi8-init +``` + +Configure the timezone in a container: +``` +$ podman create --tz=local alpine date +$ podman create --tz=Asia/Shanghai alpine date +$ podman create --tz=US/Eastern alpine date +``` + +Ensure the first container (container1) is running before the second container (container2) is started: +``` +$ podman create --name container1 -t -i fedora bash +$ podman create --name container2 --requires container1 -t -i fedora bash +$ podman start --attach container2 +``` + +Create a container which requires multiple containers: +``` +$ podman create --name container1 -t -i fedora bash +$ podman create --name container2 -t -i fedora bash +$ podman create --name container3 --requires container1,container2 -t -i fedora bash +$ podman start --attach container3 +``` + +Expose shared libraries inside of container as read-only using a glob: +``` +$ podman create --mount type=glob,src=/usr/lib64/libnvidia\*,ro -i -t fedora /bin/bash +``` + +Create a container allowing supplemental groups to have access to the volume: +``` +$ podman create -v /var/lib/design:/var/lib/design --group-add keep-groups ubi8 +``` + +Configure execution domain for containers using the personality option: +``` +$ podman create --name container1 --personality=LINUX32 fedora bash +``` + +Create a container with external rootfs mounted as an overlay: +``` +$ podman create --name container1 --rootfs /path/to/rootfs:O bash +``` + +Create a container connected to two networks (called net1 and net2) with a static ip: +``` +$ podman create --network net1\:ip=10.89.1.5 --network net2:ip=10.89.10.10 alpine ip addr +``` + +### Rootless Containers + +Podman runs as a non-root user on most systems. This feature requires that a new enough version of shadow-utils +be installed. The shadow-utils package must include the newuidmap and newgidmap executables. + +In order for users to run rootless, there must be an entry for their username in /etc/subuid and /etc/subgid which lists the UIDs for their user namespace. + +Rootless Podman works better if the fuse-overlayfs and slirp4netns packages are installed. +The fuse-overlayfs package provides a userspace overlay storage driver, otherwise users need to use +the vfs storage driver, which can be disk space expensive and less performant +than other drivers. + +To enable VPN on the container, slirp4netns or pasta needs to be specified; +without either, containers need to be run with the --network=host flag. + +## ENVIRONMENT + +Environment variables within containers can be set using multiple different options: This section describes the precedence. + +Precedence order (later entries override earlier entries): + +- **--env-host** : Host environment of the process executing Podman is added. +- **--http-proxy**: By default, several environment variables are passed in from the host, such as **http_proxy** and **no_proxy**. See **--http-proxy** for details. +- Container image : Any environment variables specified in the container image. +- **--env-file** : Any environment variables specified via env-files. If multiple files specified, then they override each other in order of entry. +- **--env** : Any environment variables specified overrides previous settings. + +Create containers and set the environment ending with a __*__. +The trailing __*__ glob functionality is only active when no value is specified: + +``` +$ export ENV1=a +$ podman create --name ctr1 --env 'ENV*' alpine env +$ podman start --attach ctr1 | grep ENV +ENV1=a +$ podman create --name ctr2 --env 'ENV*=b' alpine env +$ podman start --attach ctr2 | grep ENV +ENV*=b +``` + +## CONMON + +When Podman starts a container it actually executes the conmon program, which +then executes the OCI Runtime. Conmon is the container monitor. It is a small +program whose job is to watch the primary process of the container, and if the +container dies, save the exit code. It also holds open the tty of the +container, so that it can be attached to later. This is what allows Podman to +run in detached mode (backgrounded), so Podman can exit but conmon continues to +run. Each container has their own instance of conmon. Conmon waits for the +container to exit, gathers and saves the exit code, and then launches a Podman +process to complete the container cleanup, by shutting down the network and +storage. For more information about conmon, see the conmon(8) man +page. + +## FILES + +**/etc/subuid** +**/etc/subgid** + +NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-save(1)](podman-save.1.md)**, **[podman-ps(1)](podman-ps.1.md)**, **[podman-attach(1)](podman-attach.1.md)**, **[podman-pod-create(1)](podman-pod-create.1.md)**, **[podman-port(1)](podman-port.1.md)**, **[podman-start(1)](podman-start.1.md)**, **[podman-kill(1)](podman-kill.1.md)**, **[podman-stop(1)](podman-stop.1.md)**, **[podman-generate-systemd(1)](podman-generate-systemd.1.md)**, **[podman-rm(1)](podman-rm.1.md)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)**, **[setsebool(8)](https://man7.org/linux/man-pages/man8/setsebool.8.html)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, **[pasta(1)](https://passt.top/builds/latest/web/passt.1.html)**, **[fuse-overlayfs(1)](https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md)**, **proc(5)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)**, **personality(2)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +See [podman-rootless(7)](https://github.com/containers/podman/blob/main/rootless.md) +for rootless issues. + +## HISTORY +October 2017, converted from Docker documentation to Podman by Dan Walsh for Podman `` + +November 2014, updated by Sven Dowideit `` + +September 2014, updated by Sven Dowideit `` + +August 2014, updated by Sven Dowideit `` + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a core value of open source. The `master` and `slave` mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately. diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-diff.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-diff.1.md new file mode 100644 index 000000000..8006c9282 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-diff.1.md @@ -0,0 +1,75 @@ +--- +title: podman-diff +version: v5.5.0 +--- + +% podman-diff 1 + +## NAME +podman\-diff - Inspect changes on a container or image's filesystem + +## SYNOPSIS +**podman diff** [*options*] *container|image* [*container|image*] + +## DESCRIPTION +Displays changes on a container or image's filesystem. The container or image is compared to its parent layer or the second argument when given. + +The output is prefixed with the following symbols: + +| Symbol | Description | +|--------|-------------| +| A | A file or directory was added. | +| D | A file or directory was deleted. | +| C | A file or directory was changed. | + +## OPTIONS + +#### **--format** + +Alter the output into a different format. The only valid format for **podman diff** is `json`. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Show container-modified files versus the container's image: +``` +$ podman diff container1 +A /myscript.sh +``` + +Show container-modified files versus the container's image in JSON format: +``` +$ podman diff --format json myimage +{ + "changed": [ + "/usr", + "/usr/local", + "/usr/local/bin" + ], + "added": [ + "/usr/local/bin/docker-entrypoint.sh" + ] +} +``` + +Show the difference between the specified container and the image: +``` +$ podman diff container1 image1 +A /test +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container-diff(1)](podman-container-diff.1.md)**, **[podman-image-diff(1)](podman-image-diff.1.md)** + +## HISTORY +August 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-events.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-events.1.md new file mode 100644 index 000000000..29cf948b1 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-events.1.md @@ -0,0 +1,226 @@ +--- +title: podman-events +version: v5.5.0 +--- + +% podman-events 1 + +## NAME +podman\-events - Monitor Podman events + +## SYNOPSIS +**podman events** [*options*] + +**podman system events** [*options*] + +## DESCRIPTION + +Monitor and print events that occur in Podman. Each event includes a timestamp, +a type, a status, name (if applicable), and image (if applicable). The default logging +mechanism is *journald*. This can be changed in containers.conf by changing the `events_logger` +value to `file`. Only `file` and `journald` are accepted. A `none` logger is also +available, but this logging mechanism completely disables events; nothing is reported by +`podman events`. + +By default, streaming mode is used, printing new events as they occur. Previous events can be listed via `--since` and `--until`. + +The *container* event type reports the follow statuses: + * attach + * checkpoint + * cleanup + * commit + * connect + * create + * died + * disconnect + * exec + * exec_died + * exited + * export + * import + * init + * kill + * mount + * pause + * prune + * remove + * rename + * restart + * restore + * start + * stop + * sync + * unmount + * unpause + * update + +The *pod* event type reports the follow statuses: + * create + * kill + * pause + * remove + * start + * stop + * unpause + +The *image* event type reports the following statuses: + * loadFromArchive, + * mount + * pull + * pull-error + * push + * remove + * save + * tag + * unmount + * untag + +The *system* type reports the following statuses: + * refresh + * renumber + +The *volume* type reports the following statuses: + * create + * prune + * remove + +The *secret* type reports the following statuses: + * create + * remove + +#### Verbose Create Events + +Setting `events_container_create_inspect_data=true` in containers.conf(5) instructs Podman to create more verbose container-create events which include a JSON payload with detailed information about the containers. The JSON payload is identical to the one of podman-container-inspect(1). The associated field in journald is named `PODMAN_CONTAINER_INSPECT_DATA`. + +## OPTIONS + +#### **--filter**, **-f**=*filter* + +Filter events that are displayed. They must be in the format of "filter=value". The following +filters are supported: + +| **Filter** | **Description** | +|------------|-------------------------------------| +| container | [Name or ID] Container's name or ID | +| event | event_status (described above) | +| image | [Name or ID] Image name or ID | +| label | [key=value] label | +| pod | [Name or ID] Pod name or ID | +| volume | [Name or ID] Volume name or ID | +| type | Event_type (described above) | + +In the case where an ID is used, the ID may be in its full or shortened form. The "die" event is mapped to "died" for Docker compatibility. + +#### **--format** + +Format the output to JSON Lines or using the given Go template. + +| **Placeholder** | **Description** | +| --------------------- | -------------------------------------------------------------------- | +| .Attributes ... | created_at, _by, labels, and more (map[]) | +| .ContainerExitCode | Exit code (int) | +| .ContainerInspectData | Payload of the container's inspect | +| .Error | Error message in case the event status is an error (e.g. pull-error) | +| .HealthStatus | Health Status (string) | +| .ID | Container ID (full 64-bit SHA) | +| .Image | Name of image being run (string) | +| .Name | Container name (string) | +| .Network | Name of network being used (string) | +| .PodID | ID of pod associated with container, if any | +| .Status | Event status (e.g., create, start, died, ...) | +| .Time | Event timestamp (string) | +| .TimeNano | Event timestamp with nanosecond precision (int64) | +| .Type | Event type (e.g., image, container, pod, ...) | + +#### **--help** + +Print usage statement. + +#### **--no-trunc** + +Do not truncate the output (default *true*). + +#### **--since**=*timestamp* + +Show all events created since the given timestamp + +#### **--stream** + +Stream events and do not exit after reading the last known event (default *true*). + +#### **--until**=*timestamp* + +Show all events created until the given timestamp + +The *since* and *until* values can be RFC3339Nano time stamps or a Go duration string such as 10m, 5h. If no +*since* or *until* values are provided, only new events are shown. + +## JOURNALD IDENTIFIERS + +The journald events-backend of Podman uses the following journald identifiers. You can use the identifiers to filter Podman events directly with `journalctl`. + +| **Identifier** | **Description** | +|-------------------------------|---------------------------------------------------------| +| SYSLOG_IDENTIFIER | Always set to "podman" | +| PODMAN_EVENT | The event status as described above | +| PODMAN_TYPE | The event type as described above | +| PODMAN_TIME | The time stamp when the event was written | +| PODMAN_NAME | Name of the event object (e.g., container, image) | +| PODMAN_ID | ID of the event object (e.g., container, image) | +| PODMAN_EXIT_CODE | Exit code of the container | +| PODMAN_POD_ID | Pod ID of the container | +| PODMAN_LABELS | Labels of the container | +| PODMAN_HEALTH_STATUS | Health status of the container | +| PODMAN_CONTAINER_INSPECT_DATA | The JSON payload of `podman-inspect` as described above | +| PODMAN_NETWORK_NAME | The name of the network | + +## EXAMPLES + +Show Podman events: +``` +$ podman events +2019-03-02 10:33:42.312377447 -0600 CST container create 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +2019-03-02 10:33:46.958768077 -0600 CST container init 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +2019-03-02 10:33:46.973661968 -0600 CST container start 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +2019-03-02 10:33:50.833761479 -0600 CST container stop 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +2019-03-02 10:33:51.047104966 -0600 CST container cleanup 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +``` + +Show only Podman container create events: +``` +$ podman events -f event=create +2019-03-02 10:36:01.375685062 -0600 CST container create 20dc581f6fbf (image=docker.io/library/alpine:latest, name=sharp_morse) +2019-03-02 10:36:08.561188337 -0600 CST container create 58e7e002344c (image=registry.k8s.io/pause:3.1, name=3e701f270d54-infra) +2019-03-02 10:36:13.146899437 -0600 CST volume create cad6dc50e087 (image=, name=cad6dc50e0879568e7d656bd004bd343d6035e7fc4024e1711506fe2fd459e6f) +2019-03-02 10:36:29.978806894 -0600 CST container create d81e30f1310f (image=docker.io/library/busybox:latest, name=musing_newton) +``` + +Show only Podman pod create events: +``` +$ podman events --filter event=create --filter type=pod +2019-03-02 10:44:29.601746633 -0600 CST pod create 1df5ebca7b44 (image=, name=confident_hawking) +2019-03-02 10:44:42.374637304 -0600 CST pod create ca731231718e (image=, name=webapp) +2019-03-02 10:44:47.486759133 -0600 CST pod create 71e807fc3a8e (image=, name=reverent_swanson) +``` + +Show only Podman events created in the last five minutes: +``` +$ sudo podman events --since 5m +2019-03-02 10:44:29.598835409 -0600 CST container create b629d10d3831 (image=registry.k8s.io/pause:3.1, name=1df5ebca7b44-infra) +2019-03-02 10:44:29.601746633 -0600 CST pod create 1df5ebca7b44 (image=, name=confident_hawking) +2019-03-02 10:44:42.371100253 -0600 CST container create 170a0f457d00 (image=registry.k8s.io/pause:3.1, name=ca731231718e-infra) +2019-03-02 10:44:42.374637304 -0600 CST pod create ca731231718e (image=, name=webapp) +``` + +Show Podman events in JSON Lines format: +``` +$ podman events --format json +{"ID":"683b0909d556a9c02fa8cd2b61c3531a965db42158627622d1a67b391964d519","Image":"localhost/myshdemo:latest","Name":"agitated_diffie","Status":"cleanup","Time":"2019-04-27T22:47:00.849932843-04:00","Type":"container"} +{"ID":"a0f8ab051bfd43f9c5141a8a2502139707e4b38d98ac0872e57c5315381e88ad","Image":"docker.io/library/alpine:latest","Name":"friendly_tereshkova","Status":"unmount","Time":"2019-04-28T13:43:38.063017276-04:00","Type":"container"} +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +## HISTORY +March 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-exec.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-exec.1.md new file mode 100644 index 000000000..e8cadc5b9 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-exec.1.md @@ -0,0 +1,212 @@ +--- +title: podman-exec +version: v5.5.0 +--- + +% podman-exec 1 + +## NAME +podman\-exec - Execute a command in a running container + +## SYNOPSIS +**podman exec** [*options*] *container* *command* [*arg* ...] + +**podman container exec** [*options*] *container* *command* [*arg* ...] + +## DESCRIPTION +**podman exec** executes a command in a running container. + +## OPTIONS + +#### **--cidfile**=*file* + +Read the ID of the target container from the specified *file*. + +#### **--detach**, **-d** + +Start the exec session, but do not attach to it. The command runs in the background, and the exec session is automatically removed when it completes. The **podman exec** command prints the ID of the exec session and exits immediately after it starts. + + +[//]: # (BEGIN included file options/detach-keys.md) +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. + +[//]: # (END included file options/detach-keys.md) + + +[//]: # (BEGIN included file options/env.md) +#### **--env**, **-e**=*env* + +Set environment variables. + +This option allows arbitrary environment variables that are available for the process to be launched inside of the container. If an environment variable is specified without a value, Podman checks the host environment for a value and set the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the container. + +[//]: # (END included file options/env.md) + + +[//]: # (BEGIN included file options/env-file.md) +#### **--env-file**=*file* + +Read in a line-delimited file of environment variables. + +[//]: # (END included file options/env-file.md) + + +[//]: # (BEGIN included file options/interactive.md) +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. + +[//]: # (END included file options/interactive.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/preserve-fd.md) +#### **--preserve-fd**=*FD1[,FD2,...]* + +Pass down to the process the additional file descriptors specified in the comma separated list. It can be specified multiple times. +This option is only supported with the crun OCI runtime. It might be a security risk to use this option with other OCI runtimes. + +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/preserve-fd.md) + + +[//]: # (BEGIN included file options/preserve-fds.md) +#### **--preserve-fds**=*N* + +Pass down to the process N additional file descriptors (in addition to 0, 1, 2). +The total FDs are 3+N. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/preserve-fds.md) + + +[//]: # (BEGIN included file options/privileged.md) +#### **--privileged** + +Give extended privileges to this container. The default is **false**. + +By default, Podman containers are unprivileged (**=false**) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read-only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. +Due to the disabled security features, the privileged field should almost never +be set as containers can easily break out of confinement. + +Containers running in a user namespace (e.g., rootless containers) cannot have +more privileges than the user that launched them. + +[//]: # (END included file options/privileged.md) + + +[//]: # (BEGIN included file options/tty.md) +#### **--tty**, **-t** + +Allocate a pseudo-TTY. The default is **false**. + +When set to **true**, Podman allocates a pseudo-tty and attach to the standard +input of the container. This can be used, for example, to run a throwaway +interactive shell. + +**NOTE**: The --tty flag prevents redirection of standard output. It combines STDOUT and STDERR, it can insert control characters, and it can hang pipes. This option is only used when run interactively in a terminal. When feeding input to Podman, use -i only, not -it. + +[//]: # (END included file options/tty.md) + + +[//]: # (BEGIN included file options/user.md) +#### **--user**, **-u**=*user[:group]* + +Sets the username or UID used and, optionally, the groupname or GID for the specified command. Both *user* and *group* may be symbolic or numeric. + +Without this argument, the command runs as the user specified in the container image. Unless overridden by a `USER` command in the Containerfile or by a value passed to this option, this user generally defaults to root. + +When a user namespace is not in use, the UID and GID used within the container and on the host match. When user namespaces are in use, however, the UID and GID in the container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container by default corresponds to the UID and GID of the user invoking Podman. + +[//]: # (END included file options/user.md) + + +[//]: # (BEGIN included file options/workdir.md) +#### **--workdir**, **-w**=*dir* + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (**/**). +The image developer can set a different default with the WORKDIR instruction. The operator +can override the working directory by using the **-w** option. + +[//]: # (END included file options/workdir.md) + +## Exit Status + +The exit code from `podman exec` gives information about why the command within the container failed to run or why it exited. When `podman exec` exits with a +non-zero code, the exit codes follow the `chroot` standard, see below: + + **125** The error is with Podman itself + + $ podman exec --foo ctrID /bin/sh; echo $? + Error: unknown flag: --foo + 125 + + **126** The _contained command_ cannot be invoked + + $ podman exec ctrID /etc; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error + 126 + + **127** The _contained command_ cannot be found + + $ podman exec ctrID foo; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error + 127 + + **Exit code** The _contained command_ exit code + + $ podman exec ctrID /bin/sh -c 'exit 3'; echo $? + 3 + +## EXAMPLES + +Execute command in selected container with a stdin and a tty allocated: +``` +$ podman exec -it ctrID ls +``` + +Execute command with the overridden working directory in selected container with a stdin and a tty allocated: +``` +$ podman exec -it -w /tmp myCtr pwd +``` + +Execute command as the specified user in selected container: +``` +$ podman exec --user root ctrID ls +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)** + +## HISTORY +December 2017, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-export.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-export.1.md new file mode 100644 index 000000000..a71f8b2b2 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-export.1.md @@ -0,0 +1,56 @@ +--- +title: podman-export +version: v5.5.0 +--- + +% podman-export 1 + +## NAME +podman\-export - Export a container's filesystem contents as a tar archive + +## SYNOPSIS +**podman export** [*options*] *container* + +**podman container export** [*options*] *container* + +## DESCRIPTION +**podman export** exports the filesystem of a container and saves it as a tarball +on the local machine. **podman export** writes to STDOUT by default and can be +redirected to a file using the `--output` flag. +The image of the container exported by **podman export** can be imported by **podman import**. +To export image(s) with parent layers, use **podman save**. +Note: `:` is a restricted character and cannot be part of the file name. + +**podman [GLOBAL OPTIONS]** + +**podman export [GLOBAL OPTIONS]** + +**podman export [OPTIONS] CONTAINER** + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--output**, **-o** + +Write to a file, default is STDOUT + +## EXAMPLES + +Export container into specified tar ball: +``` +$ podman export -o redis-container.tar 883504668ec465463bc0fe7e63d53154ac3b696ea8d7b233748918664ea90e57 +``` + +Export container to stdout: +``` +$ podman export 883504668ec465463bc0fe7e63d53154ac3b696ea8d7b233748918664ea90e57 > redis-container.tar +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-import(1)](podman-import.1.md)** + +## HISTORY +August 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-farm-build.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-farm-build.1.md new file mode 100644 index 000000000..50cbbbdf5 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-farm-build.1.md @@ -0,0 +1,1572 @@ +--- +title: podman-farm-build +version: v5.5.0 +--- + +% podman-farm-build 1 + +## NAME +podman\-farm\-build - Build images on farm nodes, then bundle them into a manifest list + +## SYNOPSIS +**podman farm build** [*options*] [*context*] + +## DESCRIPTION +**podman farm build** Builds an image on all nodes in a farm and bundles them up into a manifest list. +It executes the `podman build` command on the nodes in the farm with the given Containerfile. Once the +images are built on all the farm nodes, the images will be pushed to the registry given via the **--tag** +flag. Once all the images have been pushed, a manifest list will be created locally and pushed to the registry +as well. + +The manifest list will contain an image per native architecture type that is present in the farm. + +The primary function of this command is to create multi-architecture builds that will be faster than doing it +via emulation using `podman build --arch --platform`. + +If no farm is specified, the build will be sent out to all the nodes that `podman system connection` knows of. + +Note: Since the images built are directly pushed to a registry, the user must pass in a full image name using the +**--tag** option in the format _registry_**/**_repository_**/**_imageName_[**:**_tag_]`. + +## OPTIONS + + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the container's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + + +[//]: # (BEGIN included file options/annotation.image.md) +#### **--annotation**=*annotation=value* + +Add an image *annotation* (e.g. annotation=*value*) to the image metadata. Can +be used multiple times. + +Note: this information is not present in Docker image formats, so it is +discarded when writing images in Docker formats. + +[//]: # (END included file options/annotation.image.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/build-arg.md) +#### **--build-arg**=*arg=value* + +Specifies a build argument and its value, which is interpolated in +instructions read from the Containerfiles in the same way that environment variables are, but which are not added to environment variable list in the resulting image's configuration. + +[//]: # (END included file options/build-arg.md) + + +[//]: # (BEGIN included file options/build-arg-file.md) +#### **--build-arg-file**=*path* + +Specifies a file containing lines of build arguments of the form `arg=value`. +The suggested file name is `argfile.conf`. + +Comment lines beginning with `#` are ignored, along with blank lines. +All others must be of the `arg=value` format passed to `--build-arg`. + +If several arguments are provided via the `--build-arg-file` +and `--build-arg` options, the build arguments are merged across all +of the provided files and command line arguments. + +Any file provided in a `--build-arg-file` option is read before +the arguments supplied via the `--build-arg` option. + +When a given argument name is specified several times, the last instance +is the one that is passed to the resulting builds. This means `--build-arg` +values always override those in a `--build-arg-file`. + +[//]: # (END included file options/build-arg-file.md) + + +[//]: # (BEGIN included file options/build-context.md) +#### **--build-context**=*name=value* + +Specify an additional build context using its short name and its location. +Additional build contexts can be referenced in the same manner as we access +different stages in COPY instruction. + +Valid values are: + +* Local directory – e.g. --build-context project2=../path/to/project2/src (This option is not available with the remote Podman client. On Podman machine setup (i.e macOS and Windows) path must exists on the machine VM) +* HTTP URL to a tarball – e.g. --build-context src=https://example.org/releases/src.tar +* Container image – specified with a container-image:// prefix, e.g. --build-context alpine=container-image://alpine:3.15, (also accepts docker://, docker-image://) + +On the Containerfile side, reference the build context on all +commands that accept the “from” parameter. Here’s how that might look: + +```dockerfile +FROM [name] +COPY --from=[name] ... +RUN --mount=from=[name] … +``` + +The value of [name] is matched with the following priority order: + +* Named build context defined with --build-context [name]=.. +* Stage defined with AS [name] inside Containerfile +* Image [name], either local or in a remote registry + +[//]: # (END included file options/build-context.md) + + +[//]: # (BEGIN included file options/cache-from.md) +#### **--cache-from**=*image* + +Repository to utilize as a potential cache source. When specified, Buildah tries to look for +cache images in the specified repository and attempts to pull cache images instead of actually +executing the build steps locally. Buildah only attempts to pull previously cached images if they +are considered as valid cache hits. + +Use the `--cache-to` option to populate a remote repository with cache content. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-from` option is ignored unless `--layers` is specified. + +[//]: # (END included file options/cache-from.md) + + +[//]: # (BEGIN included file options/cache-to.md) +#### **--cache-to**=*image* + +Set this flag to specify a remote repository that is used to store cache images. Buildah attempts to +push newly built cache image to the remote repository. + +Note: Use the `--cache-from` option in order to use cache content in a remote repository. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-to` option is ignored unless `--layers` is specified. + +[//]: # (END included file options/cache-to.md) + + +[//]: # (BEGIN included file options/cache-ttl.md) +#### **--cache-ttl** + +Limit the use of cached images to only consider images with created timestamps less than *duration* ago. +For example if `--cache-ttl=1h` is specified, Buildah considers intermediate cache images which are created +under the duration of one hour, and intermediate cache images outside this duration is ignored. + +Note: Setting `--cache-ttl=0` manually is equivalent to using `--no-cache` in the +implementation since this means that the user does not want to use cache at all. + +[//]: # (END included file options/cache-ttl.md) + + +[//]: # (BEGIN included file options/cap-add.image.md) +#### **--cap-add**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability added to its capability set. +Certain capabilities are granted by default; this option can be used to add +more. + +[//]: # (END included file options/cap-add.image.md) + + +[//]: # (BEGIN included file options/cap-drop.image.md) +#### **--cap-drop**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability removed from its capability set. +The CAP\_CHOWN, CAP\_DAC\_OVERRIDE, CAP\_FOWNER, +CAP\_FSETID, CAP\_KILL, CAP\_NET\_BIND\_SERVICE, CAP\_SETFCAP, +CAP\_SETGID, CAP\_SETPCAP, and CAP\_SETUID capabilities are +granted by default; this option can be used to remove them. + +If a capability is specified to both the **--cap-add** and **--cap-drop** +options, it is dropped, regardless of the order in which the options were +given. + +[//]: # (END included file options/cap-drop.image.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the container is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cgroupns.image.md) +#### **--cgroupns**=*how* + +Sets the configuration for cgroup namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "private" to indicate +that a new cgroup namespace is created, or it can be "host" to indicate +that the cgroup namespace in which `buildah` itself is being run is reused. + +[//]: # (END included file options/cgroupns.image.md) + +#### **--cleanup** + +Remove built images from farm nodes on success (Default: false). + + +[//]: # (BEGIN included file options/compat-volumes.md) +#### **--compat-volumes** + +Handle directories marked using the VOLUME instruction (both in this build, and +those inherited from base images) such that their contents can only be modified +by ADD and COPY instructions. Any changes made in those locations by RUN +instructions will be reverted. Before the introduction of this option, this +behavior was the default, but it is now disabled by default. + +[//]: # (END included file options/compat-volumes.md) + + +[//]: # (BEGIN included file options/cpp-flag.md) +#### **--cpp-flag**=*flags* + +Set additional flags to pass to the C Preprocessor cpp(1). Containerfiles ending with a ".in" suffix is preprocessed via cpp(1). This option can be used to pass additional flags to cpp.Note: You can also set default CPPFLAGS by setting the BUILDAH_CPPFLAGS environment variable (e.g., export BUILDAH_CPPFLAGS="-DDEBUG"). + +[//]: # (END included file options/cpp-flag.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the container. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The container only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: if the user only has access rights via a group, accessing the device +from inside a rootless container fails. The **[crun(1)](https://github.com/containers/crun/tree/main/crun.1.md)** runtime offers a +workaround for this by adding the option +**--annotation run.oci.keep_original_groups=1**. + + +[//]: # (BEGIN included file options/disable-compression.md) +#### **--disable-compression**, **-D** + +Don't compress filesystem layers when building the image unless it is required +by the location where the image is being written. This is the default setting, +because image layers are compressed automatically when they are pushed to +registries, and images being written to local storage only need to be +decompressed again to be stored. Compression can be forced in all cases by +specifying **--disable-compression=false**. + +[//]: # (END included file options/disable-compression.md) + + +[//]: # (BEGIN included file options/dns.md) +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. + +[//]: # (END included file options/dns.md) + +This option cannot be combined with **--network** that is set to **none**. + +Note: this option takes effect only during *RUN* instructions in the build. +It does not affect _/etc/resolv.conf_ in the final image. + + +[//]: # (BEGIN included file options/dns-option.image.md) +#### **--dns-option**=*option* + +Set custom DNS options to be used during the build. + +[//]: # (END included file options/dns-option.image.md) + + +[//]: # (BEGIN included file options/dns-search.image.md) +#### **--dns-search**=*domain* + +Set custom DNS search domains to be used during the build. + +[//]: # (END included file options/dns-search.image.md) + + +[//]: # (BEGIN included file options/env.image.md) +#### **--env**=*env[=value]* + +Add a value (e.g. env=*value*) to the built image. Can be used multiple times. +If neither `=` nor a *value* are specified, but *env* is set in the current +environment, the value from the current environment is added to the image. +To remove an environment variable from the built image, use the `--unsetenv` +option. + +[//]: # (END included file options/env.image.md) + + +[//]: # (BEGIN included file options/farm.md) +#### **--farm** + +This option specifies the name of the farm to be used in the build process. + +[//]: # (END included file options/farm.md) + +This option specifies the name of the farm to be used in the build process. + + +[//]: # (BEGIN included file options/file.md) +#### **--file**, **-f**=*Containerfile* + +Specifies a Containerfile which contains instructions for building the image, +either a local file or an **http** or **https** URL. If more than one +Containerfile is specified, *FROM* instructions are only be accepted from the +last specified file. + +If a build context is not specified, and at least one Containerfile is a +local file, the directory in which it resides is used as the build +context. + +Specifying the option `-f -` causes the Containerfile contents to be read from stdin. + +[//]: # (END included file options/file.md) + + +[//]: # (BEGIN included file options/force-rm.md) +#### **--force-rm** + +Always remove intermediate containers after a build, even if the build fails (default true). + +[//]: # (END included file options/force-rm.md) + + +[//]: # (BEGIN included file options/format.md) +#### **--format** + +Control the format for the built image's manifest and configuration data. +Recognized formats include *oci* (OCI image-spec v1.0, the default) and +*docker* (version 2, using schema format 2 for the manifest). + +Note: You can also override the default format by setting the BUILDAH\_FORMAT +environment variable. `export BUILDAH_FORMAT=docker` + +[//]: # (END included file options/format.md) + + +[//]: # (BEGIN included file options/from.md) +#### **--from** + +Overrides the first `FROM` instruction within the Containerfile. If there are multiple +FROM instructions in a Containerfile, only the first is changed. + +With the remote podman client, not all container transports work as +expected. For example, oci-archive:/x.tar references /x.tar on the remote +machine instead of on the client. When using podman remote clients it is +best to restrict use to *containers-storage*, and *docker:// transports*. + +[//]: # (END included file options/from.md) + + +[//]: # (BEGIN included file options/group-add.md) +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/group-add.md) + + +[//]: # (BEGIN included file options/help.md) +#### **--help**, **-h** + +Print usage statement + +[//]: # (END included file options/help.md) + + +[//]: # (BEGIN included file options/hooks-dir.md) +#### **--hooks-dir**=*path* + +Each *.json file in the path configures a hook for buildah build containers. For more details on the syntax of the JSON files and the semantics of hook injection. Buildah currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. + +This option may be set multiple times; paths from later options have higher precedence. + +For the annotation conditions, buildah uses any annotations set in the generated OCI configuration. + +For the bind-mount conditions, only mounts explicitly requested by the caller via --volume are considered. Bind mounts that buildah inserts by default (e.g. /dev/shm) are not considered. + +If --hooks-dir is unset for root callers, Buildah currently defaults to /usr/share/containers/oci/hooks.d and /etc/containers/oci/hooks.d in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting --hooks-dir. + +[//]: # (END included file options/hooks-dir.md) + + +[//]: # (BEGIN included file options/http-proxy.md) +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. + +[//]: # (END included file options/http-proxy.md) + + +[//]: # (BEGIN included file options/identity-label.md) +#### **--identity-label** + +Adds default identity label `io.buildah.version` if set. (default true). + +[//]: # (END included file options/identity-label.md) + + +[//]: # (BEGIN included file options/ignorefile.md) +#### **--ignorefile** + +Path to an alternative .containerignore file. + +[//]: # (END included file options/ignorefile.md) + + +[//]: # (BEGIN included file options/iidfile.md) +#### **--iidfile**=*ImageIDfile* + +Write the built image's ID to the file. When `--platform` is specified more than once, attempting to use this option triggers an error. + +[//]: # (END included file options/iidfile.md) + + +[//]: # (BEGIN included file options/inherit-labels.md) +#### **--inherit-labels** + +Inherit the labels from the base image or base stages. (default true). + +[//]: # (END included file options/inherit-labels.md) + + +[//]: # (BEGIN included file options/ipc.image.md) +#### **--ipc**=*how* + +Sets the configuration for IPC namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate +that a new IPC namespace is created, or it can be "host" to indicate +that the IPC namespace in which `podman` itself is being run is reused, +or it can be the path to an IPC namespace which is already in use by +another process. + +[//]: # (END included file options/ipc.image.md) + + +[//]: # (BEGIN included file options/isolation.md) +#### **--isolation**=*type* + +Controls what type of isolation is used for running processes as part of `RUN` +instructions. Recognized types include *oci* (OCI-compatible runtime, the +default), *rootless* (OCI-compatible runtime invoked using a modified +configuration and its --rootless option enabled, with *--no-new-keyring +--no-pivot* added to its *create* invocation, with network and UTS namespaces +disabled, and IPC, PID, and user namespaces enabled; the default for +unprivileged users), and *chroot* (an internal wrapper that leans more toward +chroot(1) than container technology). + +Note: You can also override the default isolation type by setting the +BUILDAH\_ISOLATION environment variable. `export BUILDAH_ISOLATION=oci` + +[//]: # (END included file options/isolation.md) + + +[//]: # (BEGIN included file options/jobs.md) +#### **--jobs**=*number* + +Run up to N concurrent stages in parallel. If the number of jobs is greater +than 1, stdin is read from /dev/null. If 0 is specified, then there is +no limit in the number of jobs that run in parallel. + +[//]: # (END included file options/jobs.md) + + +[//]: # (BEGIN included file options/label.image.md) +#### **--label**=*label* + +Add an image *label* (e.g. label=*value*) to the image metadata. Can be used +multiple times. + +Users can set a special LABEL **io.containers.capabilities=CAP1,CAP2,CAP3** in +a Containerfile that specifies the list of Linux capabilities required for the +container to run properly. This label specified in a container image tells +Podman to run the container with just these capabilities. Podman launches the +container with just the specified capabilities, as long as this list of +capabilities is a subset of the default list. + +If the specified capabilities are not in the default set, Podman prints an error +message and runs the container with the default capabilities. + +[//]: # (END included file options/label.image.md) + + +[//]: # (BEGIN included file options/layer-label.md) +#### **--layer-label**=*label[=value]* + +Add an intermediate image *label* (e.g. label=*value*) to the intermediate +image metadata. It can be used multiple times. + +If *label* is named, but neither `=` nor a `value` is provided, then +the *label* is set to an empty value. + +[//]: # (END included file options/layer-label.md) + + +[//]: # (BEGIN included file options/layers.md) +#### **--layers** + +Cache intermediate images during the build process (Default is `true`). + +Note: You can also override the default value of layers by setting the +BUILDAH\_LAYERS environment variable. `export BUILDAH_LAYERS=true` + +[//]: # (END included file options/layers.md) + +#### **--local**, **-l** + +Build image on local machine as well as on farm nodes. + + +[//]: # (BEGIN included file options/logfile.md) +#### **--logfile**=*filename* + +Log output which is sent to standard output and standard error to the +specified file instead of to standard output and standard error. +This option is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. + +[//]: # (END included file options/logfile.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/network.image.md) +#### **--network**=*mode*, **--net** + +Sets the configuration for network namespaces when handling `RUN` instructions. + +Valid _mode_ values are: + +- **none**: no networking. +- **host**: use the Podman host network stack. Note: the host mode gives the +container full access to local system services such as D-bus and is therefore +considered insecure. +- **ns:**_path_: path to a network namespace to join. +- **private**: create a new namespace for the container (default) +- **\**: Join the network with the given name or ID, e.g. use `--network mynet` to join the network with the name mynet. Only supported for rootful users. +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=MTU**: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=CIDR**: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=INTERFACE**: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=IPv4**: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=INTERFACE**: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=IPv6**: Specify the outbound ipv6 address slirp binds to. +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.image.md) + + +[//]: # (BEGIN included file options/no-cache.md) +#### **--no-cache** + +Do not use existing cached images for the container build. Build from the start with a new set of cached layers. + +[//]: # (END included file options/no-cache.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the container. + +Podman assumes control over the container's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/omit-history.md) +#### **--omit-history** + +Omit build history information in the built image. (default false). + +This option is useful for the cases where end users explicitly +want to set `--omit-history` to omit the optional `History` from +built images or when working with images built using build tools that +do not include `History` information in their images. + +[//]: # (END included file options/omit-history.md) + + +[//]: # (BEGIN included file options/os-feature.md) +#### **--os-feature**=*feature* + +Set the name of a required operating system *feature* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS feature list is kept, if the base image specified any. This option is typically only meaningful when the image's OS is Windows. + +If *feature* has a trailing `-`, then the *feature* is removed from the set of required features which is listed in the image. + +[//]: # (END included file options/os-feature.md) + + +[//]: # (BEGIN included file options/os-version.image.md) +#### **--os-version**=*version* + +Set the exact required operating system *version* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS version is kept, if the base image specified one. This option is typically only meaningful when the image's OS is Windows, and is typically set in Windows base images, so using this option is usually unnecessary. + +[//]: # (END included file options/os-version.image.md) + + +[//]: # (BEGIN included file options/pid.image.md) +#### **--pid**=*pid* + +Sets the configuration for PID namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new PID namespace is created, or it can be "host" to indicate that the PID namespace in which `podman` itself is being run is reused, or it can be the path to a PID namespace which is already in use by another +process. + +[//]: # (END included file options/pid.image.md) + +#### **--platforms**=*p1,p2,p3...* + +Build only on farm nodes that match the given platforms. + + +[//]: # (BEGIN included file options/pull.image.md) +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Only pull the image when it does not exist in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error when no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. + +[//]: # (END included file options/pull.image.md) + + +[//]: # (BEGIN included file options/quiet.md) +#### **--quiet**, **-q** + +Suppress output messages which indicate which instruction is being processed, and of progress when pulling images from a registry, and when writing the output image. + +[//]: # (END included file options/quiet.md) + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + + +[//]: # (BEGIN included file options/rm.md) +#### **--rm** + +Remove intermediate containers after a successful build (default true). + +[//]: # (END included file options/rm.md) + + +[//]: # (BEGIN included file options/runtime.md) +#### **--runtime**=*path* + +The *path* to an alternate OCI-compatible runtime, which is used to run +commands specified by the **RUN** instruction. + +Note: You can also override the default runtime by setting the BUILDAH\_RUNTIME environment variable. `export BUILDAH_RUNTIME=/usr/local/bin/runc` + +[//]: # (END included file options/runtime.md) + + +[//]: # (BEGIN included file options/runtime-flag.md) +#### **--runtime-flag**=*flag* + +Adds global flags for the container runtime. To list the supported flags, please consult the manpages of the selected container runtime. + +Note: Do not pass the leading -- to the flag. To pass the runc flag --log-format json to buildah build, the option given is --runtime-flag log-format=json. + +[//]: # (END included file options/runtime-flag.md) + + +[//]: # (BEGIN included file options/sbom.md) +#### **--sbom**=*preset* + +Generate SBOMs (Software Bills Of Materials) for the output image by scanning +the working container and build contexts using the named combination of scanner +image, scanner commands, and merge strategy. Must be specified with one or +more of **--sbom-image-output**, **--sbom-image-purl-output**, **--sbom-output**, +and **--sbom-purl-output**. Recognized presets, and the set of options which +they equate to: + + - "syft", "syft-cyclonedx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output cyclonedx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output cyclonedx-json={OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "syft-spdx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output spdx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output spdx-json={OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + - "trivy", "trivy-cyclonedx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "trivy-spdx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + +[//]: # (END included file options/sbom.md) + + +[//]: # (BEGIN included file options/sbom-image-output.md) +#### **--sbom-image-output**=*path* + +When generating SBOMs, store the generated SBOM in the specified path in the +output image. There is no default. + +[//]: # (END included file options/sbom-image-output.md) + + +[//]: # (BEGIN included file options/sbom-image-purl-output.md) +#### **--sbom-image-purl-output**=*path* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the specified path in the output +image. There is no default. + +[//]: # (END included file options/sbom-image-purl-output.md) + + +[//]: # (BEGIN included file options/sbom-merge-strategy.md) +#### **--sbom-merge-strategy**=*method* + +If more than one **--sbom-scanner-command** value is being used, use the +specified method to merge the output from later commands with output from +earlier commands. Recognized values include: + + - cat + Concatenate the files. + - merge-cyclonedx-by-component-name-and-version + Merge the "component" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "version" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + - merge-spdx-by-package-name-and-versioninfo + Merge the "package" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "versionInfo" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + +[//]: # (END included file options/sbom-merge-strategy.md) + + +[//]: # (BEGIN included file options/sbom-output.md) +#### **--sbom-output**=*file* + +When generating SBOMs, store the generated SBOM in the named file on the local +filesystem. There is no default. + +[//]: # (END included file options/sbom-output.md) + + +[//]: # (BEGIN included file options/sbom-purl-output.md) +#### **--sbom-purl-output**=*file* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the named file in the local +filesystem. There is no default. + +[//]: # (END included file options/sbom-purl-output.md) + + +[//]: # (BEGIN included file options/sbom-scanner-command.md) +#### **--sbom-scanner-command**=*image* + +Generate SBOMs by running the specified command from the scanner image. If +multiple commands are specified, they are run in the order in which they are +specified. These text substitutions are performed: + - {ROOTFS} + The root of the built image's filesystem, bind mounted. + - {CONTEXT} + The build context and additional build contexts, bind mounted. + - {OUTPUT} + The name of a temporary output file, to be read and merged with others or copied elsewhere. + +[//]: # (END included file options/sbom-scanner-command.md) + + +[//]: # (BEGIN included file options/sbom-scanner-image.md) +#### **--sbom-scanner-image**=*image* + +Generate SBOMs using the specified scanner image. + +[//]: # (END included file options/sbom-scanner-image.md) + + +[//]: # (BEGIN included file options/secret.image.md) +#### **--secret**=**id=id[,src=*envOrFile*][,env=*ENV*][,type=*file* | *env*]** + +Pass secret information to be used in the Containerfile for building images +in a safe way that will not end up stored in the final image, or be seen in other stages. +The value of the secret will be read from an environment variable or file named +by the "id" option, or named by the "src" option if it is specified, or from an +environment variable specified by the "env" option. See [EXAMPLES](#examples). +The secret will be mounted in the container at `/run/secrets/id` by default. + +To later use the secret, use the --mount flag in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret` + +The location of the secret in the container can be overridden using the +"target", "dst", or "destination" option of the `RUN --mount` flag. + +`RUN --mount=type=secret,id=mysecret,target=/run/secrets/myothersecret cat /run/secrets/myothersecret` + +Note: changing the contents of secret files will not trigger a rebuild of layers that use said secrets. + +[//]: # (END included file options/secret.image.md) + + +[//]: # (BEGIN included file options/security-opt.image.md) +#### **--security-opt**=*option* + +Security Options + +- `apparmor=unconfined` : Turn off apparmor confinement for the container +- `apparmor=alternate-profile` : Set the apparmor confinement profile for the +container + +- `label=user:USER` : Set the label user for the container processes +- `label=role:ROLE` : Set the label role for the container processes +- `label=type:TYPE` : Set the label process type for the container processes +- `label=level:LEVEL` : Set the label level for the container processes +- `label=filetype\:TYPE` : Set the label file type for the container files +- `label=disable` : Turn off label separation for the container +- `no-new-privileges` : Disable container processes from gaining additional privileges + +- `seccomp=unconfined` : Turn off seccomp confinement for the container +- `seccomp=profile.json` : JSON file to be used as the seccomp filter for the container. + +[//]: # (END included file options/security-opt.image.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the container. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/skip-unused-stages.md) +#### **--skip-unused-stages** + +Skip stages in multi-stage builds which don't affect the target stage. (Default: **true**). + +[//]: # (END included file options/skip-unused-stages.md) + + +[//]: # (BEGIN included file options/squash.md) +#### **--squash** + +Squash all of the image's new layers into a single new layer; any preexisting layers are not squashed. + +[//]: # (END included file options/squash.md) + + +[//]: # (BEGIN included file options/squash-all.md) +#### **--squash-all** + +Squash all of the new image's layers (including those inherited from a base image) into a single new layer. + +[//]: # (END included file options/squash-all.md) + + +[//]: # (BEGIN included file options/ssh.md) +#### **--ssh**=*default* | *id[=socket>* + +SSH agent socket or keys to expose to the build. +The socket path can be left empty to use the value of `default=$SSH_AUTH_SOCK` + +To later use the ssh agent, use the --mount option in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=ssh,id=id mycmd` + +[//]: # (END included file options/ssh.md) + + +[//]: # (BEGIN included file options/tag.md) +#### **--tag**, **-t**=*imageName* + +Specifies the name which is assigned to the resulting image if the build process completes successfully. +If _imageName_ does not include a registry name, the registry name *localhost* is prepended to the image name. + +[//]: # (END included file options/tag.md) + + +[//]: # (BEGIN included file options/target.md) +#### **--target**=*stageName* + +Set the target build stage to build. When building a Containerfile with multiple build stages, --target can be used to specify an intermediate build stage by name as the final stage for the resulting image. Commands after the target stage is skipped. + +[//]: # (END included file options/target.md) + + +[//]: # (BEGIN included file options/timestamp.md) +#### **--timestamp**=*seconds* + +Set the create timestamp to seconds since epoch to allow for deterministic builds (defaults to current time). By default, the created timestamp is changed and written into the image manifest with every commit, causing the image's sha256 hash to be different even if the sources are exactly the same otherwise. +When --timestamp is set, the created timestamp is always set to the time specified and therefore not changed, allowing the image's sha256 hash to remain the same. All files committed to the layers of the image is created with the timestamp. + +If the only instruction in a Containerfile is `FROM`, this flag has no effect. + +[//]: # (END included file options/timestamp.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/ulimit.image.md) +#### **--ulimit**=*type=soft-limit[\:hard-limit]* + +Specifies resource limits to apply to processes launched when processing `RUN` instructions. This option can be specified multiple times. Recognized resource types include: + "core": maximum core dump size (ulimit -c) + "cpu": maximum CPU time (ulimit -t) + "data": maximum size of a process's data segment (ulimit -d) + "fsize": maximum size of new files (ulimit -f) + "locks": maximum number of file locks (ulimit -x) + "memlock": maximum amount of locked memory (ulimit -l) + "msgqueue": maximum amount of data in message queues (ulimit -q) + "nice": niceness adjustment (nice -n, ulimit -e) + "nofile": maximum number of open files (ulimit -n) + "nproc": maximum number of processes (ulimit -u) + "rss": maximum size of a process's (ulimit -m) + "rtprio": maximum real-time scheduling priority (ulimit -r) + "rttime": maximum amount of real-time execution between blocking syscalls + "sigpending": maximum number of pending signals (ulimit -i) + "stack": maximum stack size (ulimit -s) + +[//]: # (END included file options/ulimit.image.md) + + +[//]: # (BEGIN included file options/unsetenv.image.md) +#### **--unsetenv**=*env* + +Unset environment variables from the final image. + +[//]: # (END included file options/unsetenv.image.md) + + +[//]: # (BEGIN included file options/unsetlabel.md) +#### **--unsetlabel**=*label* + +Unset the image label, causing the label not to be inherited from the base image. + +[//]: # (END included file options/unsetlabel.md) + + +[//]: # (BEGIN included file options/userns.image.md) +#### **--userns**=*how* + +Sets the configuration for user namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new user namespace is created, it can be "host" to indicate that the user namespace in which `podman` itself is being run is reused, or it can be the path to a user namespace which is already in use by another process. + +[//]: # (END included file options/userns.image.md) + + +[//]: # (BEGIN included file options/userns-gid-map.md) +#### **--userns-gid-map**=*mapping* + +Directly specifies a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container GID, a corresponding starting host-level GID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-gids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-gid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-gid-map are specified, but --userns-uid-map is specified, the GID map is set to use the same numeric values as the UID map. + +[//]: # (END included file options/userns-gid-map.md) + + +[//]: # (BEGIN included file options/userns-gid-map-group.md) +#### **--userns-gid-map-group**=*group* + +Specifies that a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subgid` file which correspond to the specified group. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-uid-map-user is specified, but --userns-gid-map-group is not specified, `podman` assumes that the specified user name is also a +suitable group name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. + +[//]: # (END included file options/userns-gid-map-group.md) + + +[//]: # (BEGIN included file options/userns-uid-map.md) +#### **--userns-uid-map**=*mapping* + +Directly specifies a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions default to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container UID, a corresponding starting host-level UID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-uids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-uid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-uid-map are specified, but --userns-gid-map is specified, the UID map is set to use the same numeric values as the GID map. + +[//]: # (END included file options/userns-uid-map.md) + + +[//]: # (BEGIN included file options/userns-uid-map-user.md) +#### **--userns-uid-map-user**=*user* + +Specifies that a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subuid` file which correspond to the specified user. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-gid-map-group is specified, but --userns-uid-map-user is not specified, `podman` assumes that the specified group name is also a +suitable user name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. + +[//]: # (END included file options/userns-uid-map-user.md) + + +[//]: # (BEGIN included file options/uts.md) +#### **--uts**=*how* + +Sets the configuration for UTS namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new UTS namespace to be created, or it can be "host" to indicate that the UTS namespace in which `podman` itself is being run is reused, or it can be the path to a UTS namespace which is already in use by another process. + +[//]: # (END included file options/uts.md) + + +[//]: # (BEGIN included file options/volume.image.md) +#### **--volume**, **-v**=*[HOST-DIR\:CONTAINER-DIR[\:OPTIONS]]* + +Mount a host directory into containers when executing RUN instructions during +the build. + +The `OPTIONS` are a comma-separated list and can be one or more of: + + * [rw|ro] + * [z|Z|O] + * [U] + * [`[r]shared`|`[r]slave`|`[r]private`][[1]](#Footnote1) + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR` +must be an absolute path as well. Podman bind-mounts the `HOST-DIR` to the +specified path when processing RUN instructions. + +You can specify multiple **-v** options to mount one or more mounts. + +You can add the `:ro` or `:rw` suffix to a volume to mount it read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted. When running using user namespaces, the UID and GID inside +the namespace may correspond to another UID and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the namespace, to change recursively the owner and group of +the source volume. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add one of these two suffixes +`:z` or `:Z` to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The `z` option tells Podman that two containers +share the volume content. As a result, Podman labels the content with a shared +content label. Shared volume labels allow all containers to read/write content. +The `Z` option tells Podman to label the content with a private unshared label. +Only the current container can use a private volume. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the host machine to fail. For these types +of containers, disabling SELinux separation is recommended. The option +`--security-opt label=disable` disables SELinux separation for the container. +For example, if a user wanted to volume mount their entire home directory into the build containers, they need to disable SELinux separation. + + $ podman build --security-opt label=disable -v $HOME:/home/user . + +`Overlay Volume Mounts` + +The `:O` flag tells Podman to mount the directory from the host as a +temporary storage using the Overlay file system. The `RUN` command containers +are allowed to modify contents within the mountpoint and are stored in the +container storage in a separate directory. In Overlay FS terms the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the `RUN` command +finishes executing, similar to a tmpfs mount point. + +Any subsequent execution of `RUN` commands sees the original source directory +content, any changes from previous RUN commands no longer exists. + +One use case of the `overlay` mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: + +- Overlay mounts are not currently supported in rootless mode. +- The `O` flag is not allowed to be specified with the `Z` or `z` flags. + Content mounted into the container is labeled with the private label. + On SELinux systems, labels in the source directory needs to be readable + by the container label. If not, SELinux container separation must be disabled + for the container to work. +- Modification of the directory volume mounted into the container with an + overlay mount can cause unexpected failures. Do not modify the directory until + the container finishes running. + +By default bind mounted volumes are `private`. That means any mounts done +inside containers are not be visible on the host and vice versa. This behavior +can be changed by specifying a volume mount propagation property. + +When the mount propagation policy is set to `shared`, any mounts completed +inside the container on that volume is visible to both the host and +container. When the mount propagation policy is set to `slave`, one way mount +propagation is enabled and any mounts completed on the host for that volume is +visible only inside of the container. To control the mount propagation +property of volume use the `:[r]shared`, `:[r]slave` or `:[r]private` +propagation flag. For mount propagation to work on the source mount point (mount +point where source dir is mounted on) has to have the right propagation properties. +For shared volumes, the source mount point has to be shared. And for slave volumes, +the source mount has to be either shared or slave. [[1]](#Footnote1) + +Use `df ` to determine the source mount and then use +`findmnt -o TARGET,PROPAGATION ` to determine propagation +properties of source mount, if `findmnt` utility is not available, the source +mount point can be determined by looking at the mount entry in +`/proc/self/mountinfo`. Look at `optional fields` and see if any propagation +properties are specified. +`shared:X` means the mount is `shared`, `master\:X` means the mount is `slave` +and if nothing is there that means the mount is `private`. [[1]](#Footnote1) + +To change propagation properties of a mount point use the `mount` command. For +example, to bind mount the source directory `/foo` do +`mount --bind /foo /foo` and `mount --make-private --make-shared /foo`. This +converts /foo into a `shared` mount point. The propagation properties of +the source mount can be changed directly. For instance if `/` is the source +mount for `/foo`, then use `mount --make-shared /` to convert `/` into a +`shared` mount. + +[//]: # (END included file options/volume.image.md) + +## EXAMPLES + +Build named image and manifest list using specified Containerfile with default farm: +``` +$ podman farm build --local -t name -f /path/to/containerfile . +``` + +Build named image and manifest list using the specified farm: +``` +$ podman farm build --farm myfarm -t name . +``` + +Build named image and manifest list using the specified farm, removing all images from farm nodes, after they are pushed to registry: +``` +$ podman farm build --farm myfarm --cleanup -t name . +``` + +Build named images and manifest list for specified platforms using default farm: +``` +$ podman farm build --platforms arm64,amd64 -t name . +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/main/man/runc.8.md)**, **[useradd(8)](https://www.unix.com/man-page/redhat/8/useradd)**, **[Containerfile(5)](https://github.com/containers/common/blob/main/docs/Containerfile.5.md)**, **[containerignore(5)](https://github.com/containers/common/blob/main/docs/containerignore.5.md)** + +## HISTORY + +September 2023, Originally compiled by Urvashi Mohnani `` + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a +core value of open source. The `master` and `slave` mount propagation +terminology used here is problematic and divisive, and needs to be changed. +However, these terms are currently used within the Linux kernel and must be +used as-is at this time. When the kernel maintainers rectify this usage, +Podman will follow suit immediately. diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-farm-create.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-farm-create.1.md new file mode 100644 index 000000000..42a5863e3 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-farm-create.1.md @@ -0,0 +1,39 @@ +--- +title: podman-farm-create +version: v5.5.0 +--- + +% podman-farm-create 1 + +## NAME +podman\-farm\-create - Create a new farm + +## SYNOPSIS +**podman farm create** *name* [*connections*] + +## DESCRIPTION +Create a new farm with connections that Podman knows about which were added via the +*podman system connection add* command. + +An empty farm can be created without adding any connections to it. Add or remove +connections from a farm via the *podman farm update* command. + +## EXAMPLE + + + +Create the specified farm: +``` +$ podman farm create farm2 +``` + +Create multiple farms: +``` +$ podman farm create farm1 f37 f38 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)**, **[podman-system-connection-add(1)](podman-system-connection-add.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-farm-list.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-farm-list.1.md new file mode 100644 index 000000000..885dbf761 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-farm-list.1.md @@ -0,0 +1,47 @@ +--- +title: podman-farm-list +version: v5.5.0 +--- + +% podman-farm-list 1 + +## NAME +podman\-farm\-list - List the existing farms + +## SYNOPSIS +**podman farm list** [*options*] + +**podman farm ls** [*options*] + +## DESCRIPTION +List all the existing farms. + +## OPTIONS + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' or a Go template. +Valid placeholders for the Go template listed below: + +| **Placeholder** | **Description** | +| --------------- | --------------------------------------------------------------------- | +| .Connections | List of all system connections in the farm | +| .Default | Indicates whether farm is the default | +| .Name | Farm name | +| .ReadWrite | Indicates if this farm can be modified using the podman farm commands | + +## EXAMPLE + +List all farms: +``` +$ podman farm list +Name Connections Default ReadWrite +farm1 [f38 f37] false true +farm2 [f37] true true +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-farm-remove.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-farm-remove.1.md new file mode 100644 index 000000000..97eea7f20 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-farm-remove.1.md @@ -0,0 +1,41 @@ +--- +title: podman-farm-remove +version: v5.5.0 +--- + +% podman-farm-remove 1 + +## NAME +podman\-farm\-remove - Delete one or more farms + +## SYNOPSIS +**podman farm remove** [*options*] *name* + +**podman farm rm** [*options*] *name* + +## DESCRIPTION +Delete one or more farms. + +## OPTIONS + +#### **--all**, **-a** + +Remove all farms. + +## EXAMPLE + +Remove specified farm: +``` +$ podman farm remove farm1 +``` + +Remove all farms: +``` +$ podman farm rm --all +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com)s diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-farm-update.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-farm-update.1.md new file mode 100644 index 000000000..0847603c2 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-farm-update.1.md @@ -0,0 +1,53 @@ +--- +title: podman-farm-update +version: v5.5.0 +--- + +% podman-farm-update 1 + +## NAME +podman\-farm\-update - Update an existing farm + +## SYNOPSIS +**podman farm update** [*options*] *name* + +## DESCRIPTION +Update a farm by either adding connections to it, removing connections from it, or setting it as the new +default farm. + +## OPTIONS + +#### **--add**, **-a** + +Add new connections to an existing farm. Multiple connections can be added at once. + +#### **--default**, **-d** + +Set the current farm as the default. + +#### **--remove**, **-r** + +Remove one or more connections from an existing farm. + +## EXAMPLE + +Add two connections to specified farm: +``` +$ podman farm update --add f35,f38 farm1 +``` + +Add connection to specified farm: +``` +$ podman farm update --remove f35 farm1 +``` + +Change specified farm to be default: +``` +$ podman farm update --default farm2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com)s diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-farm.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-farm.1.md new file mode 100644 index 000000000..d79f107df --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-farm.1.md @@ -0,0 +1,46 @@ +--- +title: podman-farm +version: v5.5.0 +--- + +% podman-farm 1 + +## NAME +podman\-farm - Farm out builds to machines running podman for different architectures + +## SYNOPSIS +**podman farm** *subcommand* + +## DESCRIPTION +Farm out builds to machines running Podman for different architectures. + +Manage farms by creating, updating, and removing them. + +Note: All farm machines must have a minimum podman version of v4.9.0. + +Podman manages the farms by writing and reading the `podman-connections.json` file located under +`$XDG_CONFIG_HOME/containers` or if the env is not set it defaults to `$HOME/.config/containers`. +Or the `PODMAN_CONNECTIONS_CONF` environment variable can be set to a full file path which podman +will use instead. +This file is managed by the podman commands and should never be edited by users directly. To manually +configure the farms use the `[farm]` section in containers.conf. + +If the ReadWrite column in the **podman farm list** output is set to true the farm is stored in the +`podman-connections.json` file otherwise it is stored in containers.conf and can therefore not be +edited with the **podman farm remove/update** commands. It can still be used with **podman farm build**. + +## COMMANDS + +| Command | Man Page | Description | +| -------- | ----------------------------------------------------| ----------------------------------------------------------------- | +| build | [podman-farm\-build(1)](podman-farm-build.1.md) | Build images on farm nodes, then bundle them into a manifest list | +| create | [podman-farm\-create(1)](podman-farm-create.1.md) | Create a new farm | +| list | [podman-farm\-list(1)](podman-farm-list.1.md) | List the existing farms | +| remove | [podman-farm\-remove(1)](podman-farm-remove.1.md) | Delete one or more farms | +| update | [podman-farm\-update(1)](podman-farm-update.1.md) | Update an existing farm | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-generate-spec.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-generate-spec.1.md new file mode 100644 index 000000000..5930112eb --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-generate-spec.1.md @@ -0,0 +1,31 @@ +--- +title: podman-generate-spec +version: v5.5.0 +--- + +% podman-generate-spec 1 + +## NAME +podman\-generate\-spec - Generate Specgen JSON based on containers or pods + +## SYNOPSIS +**podman generate spec** [*options*] *container | *pod* + +## DESCRIPTION +**podman generate spec** generates SpecGen JSON from Podman Containers and Pods. This JSON can be printed to a file, directly to the command line, or both. + +This JSON can then be used as input for the Podman API, specifically for Podman container and pod creation. Specgen is Podman's internal structure for formulating new container-related entities. + +## OPTIONS + +#### **--compact**, **-c** + +Print the output in a compact, one line format. This is useful when piping the data to the Podman API + +#### **--filename**, **-f**=**filename** + +Output to the given file. + +#### **--name**, **-n** + +Rename the pod or container, so that it does not conflict with the existing entity. This is helpful when the JSON is to be used before the source pod or container is deleted. diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-generate-systemd.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-generate-systemd.1.md new file mode 100644 index 000000000..ad99abbf1 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-generate-systemd.1.md @@ -0,0 +1,326 @@ +--- +title: podman-generate-systemd +version: v5.5.0 +--- + +% podman-generate-systemd 1 + +## NAME +podman\-generate\-systemd - [DEPRECATED] Generate systemd unit file(s) for a container or pod + +## SYNOPSIS +**podman generate systemd** [*options*] *container|pod* + +## DESCRIPTION +DEPRECATED: +Note: **podman generate systemd** is deprecated. We recommend using [Quadlet](podman-systemd.unit.5.md) +files when running Podman containers or pods under systemd. There are no plans to remove the command. +It will receive urgent bug fixes but no new features. + +**podman generate systemd** creates a systemd unit file that can be used to control a container or pod. +By default, the command prints the content of the unit files to stdout. + +Generating unit files for a pod requires the pod to be created with an infra container (see `--infra=true`). An infra container runs across the entire lifespan of a pod and is hence required for systemd to manage the life cycle of the pod's main unit. + +- Note: When using this command with the remote client, including Mac and Windows (excluding WSL2) machines, place the generated units on the remote system. Moreover, make sure that the `XDG_RUNTIME_DIR` environment variable is set. If unset, set it via `export XDG_RUNTIME_DIR=/run/user/$(id -u)`._ + +- Note: The generated `podman run` command contains an `--sdnotify` option with the value taken from the container. +If the container does not have any explicitly set value or the value is set to __ignore__, the value __conmon__ is used. +The reason for overriding the default value __container__ is that almost no container workloads send notify messages. +Systemd waits for a ready message that never comes, if the value __container__ is used for a container +that does not send notify messages. The use of the default value might have been unintentional by the user, +therefore the overridden default value._ + +### Kubernetes Integration + +A Kubernetes YAML can be executed in systemd via the `podman-kube@.service` systemd template. The template's argument is the path to the YAML file. Given a `workload.yaml` file in the home directory, it can be executed as follows: + +``` +$ escaped=$(systemd-escape ~/workload.yaml) +$ systemctl --user start podman-kube@$escaped.service +$ systemctl --user is-active podman-kube@$escaped.service +active +``` + +## OPTIONS + +#### **--after**=*dependency_name* + +Add the systemd unit after (`After=`) option, that ordering dependencies between the list of dependencies and this service. This option may be specified more than once. + +User-defined dependencies are appended to the generated unit file, but any existing options needed or defined by default (e.g., `online.target`) are **not** removed or overridden. + +#### **--container-prefix**=*prefix* + +Set the systemd unit name prefix for containers. The default is *container*. + +#### **--env**, **-e**=*env* + +Set environment variables to the systemd unit files. + +If an environment variable is specified without a value, Podman checks the host environment for a value and sets the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the systemd unit files. + +#### **--files**, **-f** + +Generate files instead of printing to stdout. The generated files are named {container,pod}-{ID,name}.service and are placed in the current working directory. + +Note: On a system with SELinux enabled, the generated files inherits contexts from the current working directory. Depending on the SELinux setup, changes to the generated files using `restorecon`, `chcon`, or `semanage` may be required to allow systemd to access these files. Alternatively, use the `-Z` option when running `mv` or `cp`. + +#### **--format**=*format* + +Print the created units in the specified format (json). If `--files` is specified, the paths to the created files are printed instead of the unit content. + +#### **--name**, **-n** + +Use the name of the container for the start, stop, and description in the unit file + +#### **--new** + +This option yields unit files that do not expect containers and pods to exist. Instead, new containers and pods are created based on their configuration files. The unit files are created best effort and may need further editing; please review the generated files carefully before using them in production. + +Note that `--new` only works on containers and pods created directly via Podman (i.e., `podman [container] {create,run}` or `podman pod create`). It does not work on containers or pods created via the REST API or via `podman kube play`. For `podman kube play`, use the `podman-kube@.service` systemd template instead. + +#### **--no-header** + +Do not generate the header including meta data such as the Podman version and the timestamp. + +#### **--pod-prefix**=*prefix* + +Set the systemd unit name prefix for pods. The default is *pod*. + +#### **--requires**=*dependency_name* + +Set the systemd unit requires (`Requires=`) option. Similar to wants, but declares a stronger requirement dependency. + +#### **--restart-policy**=*policy* + +Set the systemd restart policy. The restart-policy must be one of: "no", "on-success", "on-failure", "on-abnormal", +"on-watchdog", "on-abort", or "always". The default policy is *on-failure* unless the container was created with a custom restart policy. + +Note that generating a unit without `--new` on a container with a custom restart policy can lead to issues on shutdown; systemd attempts to stop the unit while Podman tries to restart it. Creating the container without `--restart` and using the `--restart-policy` option when generating the unit file is recommended. + +#### **--restart-sec**=*time* + +Set the systemd service restartsec value. Configures the time to sleep before restarting a service (as configured with restart-policy). +Takes a value in seconds. + +#### **--separator**=*separator* + +Set the systemd unit name separator between the name/id of a container/pod and the prefix. The default is *-*. + +#### **--start-timeout**=*value* + +Override the default start timeout for the container with the given value in seconds. + +#### **--stop-timeout**=*value* + +Override the default stop timeout for the container with the given value in seconds. + +#### **--template** + +Add template specifiers to run multiple services from the systemd unit file. + +Note that if `--new` was not set to true, it is set to true by default. However, the command fails if `--new` is set to `false` explicitly. + +#### **--wants**=*dependency_name* + +Add the systemd unit wants (`Wants=`) option, that this service is (weak) dependent on. This option may be specified more than once. This option does not influence the order in which services are started or stopped. + +User-defined dependencies are appended to the generated unit file, but any existing options needed or defined by default (e.g., `online.target`) are **not** removed or overridden. + +## EXAMPLES + +### Generate and print a systemd unit file for a container + +Generate a systemd unit file for a container running nginx with an *always* restart policy and 1-second timeout to stdout. Note that the **RequiresMountsFor** option in the **Unit** section ensures that the container storage for both the GraphRoot and the RunRoot are mounted prior to starting the service. For systems with container storage on disks like iSCSI or other remote block protocols, this ensures that Podman is not executed prior to any necessary storage operations coming online. + +``` +$ podman create --name nginx nginx:latest +$ podman generate systemd --restart-policy=always -t 1 nginx +# container-de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6.service +# autogenerated by Podman 1.8.0 +# Wed Mar 09 09:46:45 CEST 2020 + +[Unit] +Description=Podman container-de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6.service +Documentation=man:podman-generate-systemd(1) +Wants=network-online.target +After=network-online.target +RequiresMountsFor=/var/run/container/storage + +[Service] +Restart=always +ExecStart=/usr/bin/podman start de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6 +ExecStop=/usr/bin/podman stop \ + -t 1 de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6 +KillMode=none +Type=forking +PIDFile=/run/user/1000/overlay-containers/de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6/userdata/conmon.pid + +[Install] +WantedBy=default.target +``` + +### Generate systemd unit file for a container with `--new` flag + + The `--new` flag generates systemd unit files that create and remove containers at service start and stop commands (see ExecStartPre and ExecStopPost service actions). Such unit files are not tied to a single machine and can easily be shared and used on other machines. + +``` +$ sudo podman generate systemd --new --files --name bb310a0780ae +# container-busy_moser.service +# autogenerated by Podman 1.8.3 +# Fri Apr 3 09:40:47 EDT 2020 + +[Unit] +Description=Podman container-busy_moser.service +Documentation=man:podman-generate-systemd(1) +Wants=network-online.target +After=network-online.target +RequiresMountsFor=/var/run/container/storage + +[Service] +Environment=PODMAN_SYSTEMD_UNIT=%n +Restart=on-failure +ExecStartPre=/bin/rm -f %t/%n-pid %t/%n-cid +ExecStart=/usr/local/bin/podman run \ + --conmon-pidfile %t/%n-pid \ + --cidfile %t/%n-cid \ + --cgroups=no-conmon \ + -d \ + -dit alpine +ExecStop=/usr/local/bin/podman stop \ + --ignore \ + --cidfile %t/%n-cid -t 10 +ExecStopPost=/usr/local/bin/podman rm \ + --ignore \ + -f \ + --cidfile %t/%n-cid +PIDFile=%t/%n-pid +KillMode=none +Type=forking + +[Install] +WantedBy=default.target +``` + +### Generate systemd unit files for a pod with two simple alpine containers + +Note `systemctl` must only be used on the pod unit and not used to start or stop containers individually. The containers are managed by the pod service along with the internal infra-container. + +Use `systemctl status` or `journalctl` to examine container or pod unit files. +``` +$ podman pod create --name systemd-pod +$ podman create --pod systemd-pod alpine top +$ podman create --pod systemd-pod alpine top +$ podman generate systemd --files --name systemd-pod +/home/user/pod-systemd-pod.service +/home/user/container-amazing_chandrasekhar.service +/home/user/container-jolly_shtern.service +$ cat pod-systemd-pod.service +# pod-systemd-pod.service +# autogenerated by Podman 1.8.0 +# Wed Mar 09 09:52:37 CEST 2020 + +[Unit] +Description=Podman pod-systemd-pod.service +Documentation=man:podman-generate-systemd(1) +Requires=container-amazing_chandrasekhar.service container-jolly_shtern.service +Before=container-amazing_chandrasekhar.service container-jolly_shtern.service +Wants=network-online.target +After=network-online.target +RequiresMountsFor=/var/run/container/storage + +[Service] +Restart=on-failure +ExecStart=/usr/bin/podman start 77a818221650-infra +ExecStop=/usr/bin/podman stop \ + -t 10 77a818221650-infra +KillMode=none +Type=forking +PIDFile=/run/user/1000/overlay-containers/ccfd5c71a088768774ca7bd05888d55cc287698dde06f475c8b02f696a25adcd/userdata/conmon.pid + +[Install] +WantedBy=default.target +``` + +### Installation of generated systemd unit files. + +Podman-generated unit files include an `[Install]` section, which carries installation information for the unit. It is used by the enable and disable commands of systemctl(1) during installation. + +Once the systemd unit file is generated, install it to */etc/systemd/system* to be run by the root user or to *$HOME/.config/systemd/user* for installing it as a non-root user. Enable the copied unit file or files using `systemctl enable`. + +Note: Copying unit files to */etc/systemd/system* and enabling it marks the unit file to be automatically started at boot. And similarly, copying a unit file to *$HOME/.config/systemd/user* and enabling it marks the unit file to be automatically started on user login. + + +``` +# Generated systemd files. +$ podman pod create --name systemd-pod +$ podman create --pod systemd-pod alpine top +$ podman generate systemd --files --name systemd-pod + +# Copy all the generated files. + +$ sudo cp pod-systemd-pod.service container-great_payne.service /etc/systemd/system +$ systemctl enable pod-systemd-pod.service +Created symlink /etc/systemd/system/multi-user.target.wants/pod-systemd-pod.service → /etc/systemd/system/pod-systemd-pod.service. +Created symlink /etc/systemd/system/default.target.wants/pod-systemd-pod.service → /etc/systemd/system/pod-systemd-pod.service. +$ systemctl is-enabled pod-systemd-pod.service +enabled +``` +To run the user services placed in `$HOME/.config/systemd/user` on first login of that user, enable the service with --user flag. + +``` +$ systemctl --user enable <.service> +``` +The systemd user instance is killed after the last session for the user is closed. The systemd user instance can be started at boot and kept running even after the user logs out by enabling `lingering` using + +``` +$ loginctl enable-linger +``` +### Use `systemctl` to perform operations on generated installed unit files. + +Create and enable systemd unit files for a pod using the above examples as reference and use `systemctl` to perform operations. + +Since systemctl defaults to using the root user, all the changes using the systemctl can be seen by appending sudo to the podman cli commands. To perform `systemctl` actions as a non-root user use the `--user` flag when interacting with `systemctl`. + +Note: If the previously created containers or pods are using shared resources, such as ports, make sure to remove them before starting the generated systemd units. + +``` +$ systemctl --user start pod-systemd-pod.service +$ podman pod ps +POD ID NAME STATUS CREATED # OF CONTAINERS INFRA ID +0815c7b8e7f5 systemd-pod Running 29 minutes ago 2 6c5d116f4bbe +$ sudo podman ps # 0 Number of pods on root. +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +$ systemctl stop pod-systemd-pod.service +$ podman pod ps +POD ID NAME STATUS CREATED # OF CONTAINERS INFRA ID +272d2813c798 systemd-pod Exited 29 minutes ago 2 6c5d116f4bbe +``` + +Create a simple alpine container and generate the systemd unit file with `--new` flag. +Enable the service and control operations using the systemctl commands. + +Note: When starting the container using `systemctl start` rather than altering the already running container it spins up a "new" container with similar configuration. + +``` +# Enable the service. + +$ sudo podman ps -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +bb310a0780ae docker.io/library/alpine:latest /bin/sh 2 minutes ago Created busy_moser +$ sudo systemctl start container-busy_moser.service +$ sudo podman ps -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +772df2f8cf3b docker.io/library/alpine:latest /bin/sh 1 second ago Up 1 second distracted_albattani +bb310a0780ae docker.io/library/alpine\:latest /bin/sh 3 minutes ago Created busy_moser +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **systemctl(1)**, **systemd.unit(5)**, **systemd.service(5)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)**, **[podman-systemd.unit(5)](podman-systemd.unit.5.md)** + +## HISTORY +April 2020, Updated details and added use case to use generated .service files as root and non-root, by Sujil Shah (sushah at redhat dot com) + +August 2019, Updated with pod support by Valentin Rothberg (rothberg at redhat dot com) + +April 2019, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-generate.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-generate.1.md new file mode 100644 index 000000000..18c31ee82 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-generate.1.md @@ -0,0 +1,27 @@ +--- +title: podman-generate +version: v5.5.0 +--- + +% podman-generate 1 + +## NAME +podman\-generate - Generate structured data based on containers, pods or volumes + +## SYNOPSIS +**podman generate** *subcommand* + +## DESCRIPTION +The generate command creates structured output (like YAML) based on a container, pod or volume. + +## COMMANDS + +| Command | Man Page | Description | +|---------|------------------------------------------------------------|-------------------------------------------------------------------------------------| +| kube | [podman-kube-generate(1)](podman-kube-generate.1.md) | Generate Kubernetes YAML based on containers, pods or volumes. | +| spec | [podman-generate-spec(1)](podman-generate-spec.1.md) | Generate Specgen JSON based on containers or pods. | +| systemd | [podman-generate-systemd(1)](podman-generate-systemd.1.md) | [DEPRECATED] Generate systemd unit file(s) for a container or pod. | + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-container(1)](podman-container.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-healthcheck-run.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-healthcheck-run.1.md new file mode 100644 index 000000000..62fa293bd --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-healthcheck-run.1.md @@ -0,0 +1,45 @@ +--- +title: podman-healthcheck-run +version: v5.5.0 +--- + +% podman-healthcheck-run 1 + +## NAME +podman\-healthcheck\-run - Run a container healthcheck + +## SYNOPSIS +**podman healthcheck run** *container* + +## DESCRIPTION + +Runs the healthcheck command defined in a running container manually. The resulting error codes are defined +as follows: + +* 0 = healthcheck command succeeded +* 1 = healthcheck command failed +* 125 = an error has occurred + +Possible errors that can occur during the healthcheck are: +* unable to find the container +* container has no defined healthcheck +* container is not running + +## OPTIONS +#### **--help** + +Print usage statement + + +## EXAMPLES + +Run healthchecks in specified container: +``` +$ podman healthcheck run mywebapp +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-healthcheck(1)](podman-healthcheck.1.md)** + +## HISTORY +Feb 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-healthcheck.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-healthcheck.1.md new file mode 100644 index 000000000..0abfc2bdd --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-healthcheck.1.md @@ -0,0 +1,27 @@ +--- +title: podman-healthcheck +version: v5.5.0 +--- + +% podman-healthcheck 1 + +## NAME +podman\-healthcheck - Manage healthchecks for containers + +## SYNOPSIS +**podman healthcheck** *subcommand* + +## DESCRIPTION +podman healthcheck is a set of subcommands that manage container healthchecks + +## SUBCOMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------- | ------------------------------------------------------------------------------ | +| run | [podman-healthcheck-run(1)](podman-healthcheck-run.1.md) | Run a container healthcheck | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +Feb 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-history.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-history.1.md new file mode 100644 index 000000000..e3426c291 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-history.1.md @@ -0,0 +1,110 @@ +--- +title: podman-history +version: v5.5.0 +--- + +% podman-history 1 + +## NAME +podman\-history - Show the history of an image + +## SYNOPSIS +**podman history** [*options*] *image*[:*tag*|@*digest*] + +**podman image history** [*options*] *image*[:*tag*|@*digest*] + +## DESCRIPTION +**podman history** displays the history of an image by printing out information +about each layer used in the image. The information printed out for each layer +include Created (time and date), Created By, Size, and Comment. The output can +be truncated or not using the **--no-trunc** flag. If the **--human** flag is +set, the time of creation and size are printed out in a human readable format. +The **--quiet** flag displays the ID of the image only when set and the **--format** +flag is used to print the information using the Go template provided by the user. + +## OPTIONS + +#### **--format**=*format* + +Alter the output for a format like 'json' or a Go template. + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|------------------------|---------------------------------------------------------------------------| +| .Comment | Comment for the layer | +| .Created | if --human, time elapsed since creation, otherwise time stamp of creation | +| .CreatedAt | Time when the image layer was created | +| .CreatedBy | Command used to create the layer | +| .CreatedSince | Elapsed time since the image layer was created | +| .ID | Image ID | +| .Size | Size of layer on disk | +| .Tags | Image tags | + +#### **--help**, **-h** + +Print usage statement + +#### **--human**, **-H** + +Display sizes and dates in human readable format (default *true*). + +#### **--no-trunc** + +Do not truncate the output (default *false*). + +#### **--quiet**, **-q** + +Print the numeric IDs only (default *false*). + +## EXAMPLES + +Show the history of the specified image: +``` +$ podman history debian +ID CREATED CREATED BY SIZE COMMENT +b676ca55e4f2c 9 weeks ago /bin/sh -c #(nop) CMD ["bash"] 0 B + 9 weeks ago /bin/sh -c #(nop) ADD file:ebba725fb97cea4... 45.14 MB +``` + +Show the history of the specified image without truncating content and using raw data: +``` +$ podman history --no-trunc=true --human=false debian +ID CREATED CREATED BY SIZE COMMENT +b676ca55e4f2c 2017-07-24T16:52:55Z /bin/sh -c #(nop) CMD ["bash"] 0 + 2017-07-24T16:52:54Z /bin/sh -c #(nop) ADD file:ebba725fb97cea4... 45142935 +``` + +Show the formatted history of the specified image: +``` +$ podman history --format "{{.ID}} {{.Created}}" debian +b676ca55e4f2c 9 weeks ago + 9 weeks ago +``` + +Show the history in JSON format for the specified image: +``` +$ podman history --format json debian +[ + { + "id": "b676ca55e4f2c0ce53d0636438c5372d3efeb5ae99b676fa5a5d1581bad46060", + "created": "2017-07-24T16:52:55.195062314Z", + "createdBy": "/bin/sh -c #(nop) CMD [\"bash\"]", + "size": 0, + "comment": "" + }, + { + "id": "b676ca55e4f2c0ce53d0636438c5372d3efeb5ae99b676fa5a5d1581bad46060", + "created": "2017-07-24T16:52:54.898893387Z", + "createdBy": "/bin/sh -c #(nop) ADD file:ebba725fb97cea45d0b1b35ccc8144e766fcfc9a78530465c23b0c4674b14042 in / ", + "size": 45142935, + "comment": "" + } +] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-image-diff.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-image-diff.1.md new file mode 100644 index 000000000..2bce9adee --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-image-diff.1.md @@ -0,0 +1,61 @@ +--- +title: podman-image-diff +version: v5.5.0 +--- + +% podman-image-diff 1 + +## NAME +podman-image-diff - Inspect changes on an image's filesystem + +## SYNOPSIS +**podman image diff** [*options*] *image* [*image*] + +## DESCRIPTION +Displays changes on an image's filesystem. The image is compared to its parent layer or the second argument when given. + +The output is prefixed with the following symbols: + +| Symbol | Description | +|--------|-------------| +| A | A file or directory was added. | +| D | A file or directory was deleted. | +| C | A file or directory was changed. | + +## OPTIONS + +#### **--format** + +Alter the output into a different format. The only valid format for **podman image diff** is `json`. + +## EXAMPLE + +Display image differences from images parent layer: +``` +$ podman image diff redis:old +C /usr +C /usr/local +C /usr/local/bin +A /usr/local/bin/docker-entrypoint.sh +``` + +Display image differences between two different images in JSON format: +``` +$ podman image diff --format json redis:old redis\:alpine +{ + "changed": [ + "/usr", + "/usr/local", + "/usr/local/bin" + ], + "added": [ + "/usr/local/bin/docker-entrypoint.sh" + ] +} +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image(1)](podman-image.1.md)** + +## HISTORY +August 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-image-exists.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-image-exists.1.md new file mode 100644 index 000000000..aa0ecf5fd --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-image-exists.1.md @@ -0,0 +1,46 @@ +--- +title: podman-image-exists +version: v5.5.0 +--- + +% podman-image-exists 1 + +## NAME +podman-image-exists - Check if an image exists in local storage + +## SYNOPSIS +**podman image exists** *image* + +## DESCRIPTION +**podman image exists** checks if an image exists in local storage. The **ID** or **Name** +of the image may be used as input. Podman returns an exit code +of `0` when the image is found. A `1` is returned otherwise. An exit code of `125` indicates there +was an issue accessing the local storage. + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Check if an image called `webclient` exists in local storage (the image does actually exist): +``` +$ podman image exists webclient +$ echo $? +0 +``` + +Check if an image called `webbackend` exists in local storage (the image does not actually exist): +``` +$ podman image exists webbackend +$ echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image(1)](podman-image.1.md)** + +## HISTORY +November 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-image-inspect.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-image-inspect.1.md new file mode 100644 index 000000000..5e1260b84 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-image-inspect.1.md @@ -0,0 +1,139 @@ +--- +title: podman-image-inspect +version: v5.5.0 +--- + +% podman-image-inspect 1 + +## NAME +podman\-image\-inspect - Display an image's configuration + +## SYNOPSIS +**podman image inspect** [*options*] *image* [*image* ...] + +## DESCRIPTION + +This displays the low-level information on images identified by name or ID. By default, this renders all results in a JSON array. If a format is specified, the given template is executed for each result. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Format the output using the given Go template. +The keys of the returned JSON can be used as the values for the --format flag (see examples below). + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ----------------- | ------------------ | +| .Annotations ... | Annotation information included in the image | +| .Architecture | Architecture of software in the image | +| .Author | Image author | +| .Comment | Image comment | +| .Config ... | Structure with config info | +| .Created ... | Image creation time (string, ISO3601) | +| .Digest | Image digest (sha256:+64-char hash) | +| .GraphDriver ... | Structure for the graph driver info | +| .HealthCheck ... | Structure for the health check info | +| .History | History information stored in image | +| .ID | Image ID (full 64-char hash) | +| .Labels ... | Label information included in the image | +| .ManifestType | Manifest type of the image | +| .NamesHistory | Name history information stored in image | +| .Os | Operating system of software in the image | +| .Parent | Parent image of the specified image | +| .RepoDigests | Repository digests for the image | +| .RepoTags | Repository tags for the image | +| .RootFS ... | Structure for the root file system info | +| .Size | Size of image, in bytes | +| .User | Default user to execute the image as | +| .Version | Image Version | +| .VirtualSize | Virtual size of image, in bytes | + +## EXAMPLE + +Inspect information on the specified image: +``` +$ podman image inspect fedora +[ + { + "Id": "37e5619f4a8ca9dbc4d6c0ae7890625674a10dbcfb76201399e2aaddb40da17d", + "Digest": "sha256:1b0d4ddd99b1a8c8a80e885aafe6034c95f266da44ead992aab388e6aa91611a", + "RepoTags": [ + "registry.fedoraproject.org/fedora:latest" + ], + "RepoDigests": [ + "registry.fedoraproject.org/fedora@sha256:1b0d4ddd99b1a8c8a80e885aafe6034c95f266da44ead992aab388e6aa91611a", + "registry.fedoraproject.org/fedora@sha256:b5290db40008aae9272ad3a6bd8070ef7ecd547c3bef014b894c327960acc582" + ], + "Parent": "", + "Comment": "Created by Image Factory", + "Created": "2021-08-09T05:48:47Z", + "Config": { + "Env": [ + "DISTTAG=f34container", + "FGC=f34", + "container=oci" + ], + "Cmd": [ + "/bin/bash" + ], + "Labels": { + "license": "MIT", + "name": "fedora", + "vendor": "Fedora Project", + "version": "34" + } + }, + "Version": "1.10.1", + "Author": "", + "Architecture": "amd64", + "Os": "linux", + "Size": 183852302, + "VirtualSize": 183852302, + "GraphDriver": { + "Name": "overlay", + "Data": { + "UpperDir": "/home/dwalsh/.local/share/containers/storage/overlay/0203e243f1ca4b6bb49371ecd21363212467ec6d7d3fa9f324cd4e78cc6b5fa2/diff", + "WorkDir": "/home/dwalsh/.local/share/containers/storage/overlay/0203e243f1ca4b6bb49371ecd21363212467ec6d7d3fa9f324cd4e78cc6b5fa2/work" + } + }, + "RootFS": { + "Type": "layers", + "Layers": [ + "sha256:0203e243f1ca4b6bb49371ecd21363212467ec6d7d3fa9f324cd4e78cc6b5fa2" + ] + }, + "Labels": { + "license": "MIT", + "name": "fedora", + "vendor": "Fedora Project", + "version": "34" + }, + "Annotations": {}, + "ManifestType": "application/vnd.docker.distribution.manifest.v2+json", + "User": "", + "History": [ + { + "created": "2021-08-09T05:48:47Z", + "comment": "Created by Image Factory" + } + ], + "NamesHistory": [ + "registry.fedoraproject.org/fedora:latest" + ] + } +] +``` + +Inspect image ID for the specified image: +``` +$ podman image inspect --format '{{ .Id }}' fedora +37e5619f4a8ca9dbc4d6c0ae7890625674a10dbcfb76201399e2aaddb40da17d +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image(1)](podman-image.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +Sep 2021, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-image-mount.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-image-mount.1.md new file mode 100644 index 000000000..cf9d276ce --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-image-mount.1.md @@ -0,0 +1,82 @@ +--- +title: podman-image-mount +version: v5.5.0 +--- + +% podman-image-mount 1 + +## NAME +podman\-image\-mount - Mount an image's root filesystem + +## SYNOPSIS +**podman image mount** [*options*] [*image* ...] + +## DESCRIPTION +Mounts the specified images' root file system in a location which can be +accessed from the host, and returns its location. + +The `podman image mount` command without any arguments lists all of the +currently mounted images. + +Rootless mode only supports mounting VFS driver, unless podman is run in a user namespace. +Use the `podman unshare` command to enter the user namespace. All other storage drivers fail to mount. + +## RETURN VALUE +The location of the mounted file system. On error an empty string and errno is +returned. + +## OPTIONS + +#### **--all**, **-a** + +Mount all images. + +#### **--format**=*format* + +Print the mounted images in specified format (json). + +## EXAMPLE + +Mount multiple images. Note: In rootless mode, image mounting works only after executing the podman unshare command to enter the user namespace. +``` +podman image mount fedora ubi8-init +/var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +/var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged +``` + +List mounted images: +``` +podman image mount +registry.fedoraproject.org/fedora:latest /var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +registry.access.redhat.com/ubi8-init:latest /var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged +``` + +List mounted images in JSON format: +``` +podman image mount --format json +[ + { + "id": "00ff39a8bf19f810a7e641f7eb3ddc47635913a19c4996debd91fafb6b379069", + "Names": [ + "sha256:58de585a231aca14a511347bc85b912a6f000159b49bc2b0582032911e5d3a6c" + ], + "Repositories": [ + "registry.fedoraproject.org/fedora:latest" + ], + "mountpoint": "/var/lib/containers/storage/overlay/0ccfac04663bbe8813b5f24502ee0b7371ce5bf3c5adeb12e4258d191c2cf7bc/merged" + }, + { + "id": "bcc2dc9a261774ad25a15e07bb515f9b77424266abf2a1252ec7bcfed1dd0ac2", + "Names": [ + "sha256:d5f260b2e51b3ee9d05de1c31d261efc9af28e7d2d47cedf054c496d71424d63" + ], + "Repositories": [ + "registry.access.redhat.com/ubi8-init:latest" + ], + "mountpoint": "/var/lib/containers/storage/overlay/d66b58e3391ea8ce4c81316c72e22b332618f2a28b461a32ed673e8998cdaeb8/merged" + } +] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image(1)](podman-image.1.md)**, **[podman-image-unmount(1)](podman-image-unmount.1.md)**, **[podman-unshare(1)](podman-unshare.1.md)**, **mount(8)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-image-prune.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-image-prune.1.md new file mode 100644 index 000000000..abf21d735 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-image-prune.1.md @@ -0,0 +1,121 @@ +--- +title: podman-image-prune +version: v5.5.0 +--- + +% podman-image-prune 1 + +## NAME +podman-image-prune - Remove all unused images from the local store + +## SYNOPSIS +**podman image prune** [*options*] + +## DESCRIPTION +**podman image prune** removes all dangling images from local storage. With the `all` option, +all unused images are deleted (i.e., images not in use by any container). + +The image prune command does not prune cache images that only use layers that are necessary for other images. + +## OPTIONS +#### **--all**, **-a** + +Remove dangling images and images that have no associated containers. + +#### **--build-cache** + +Remove persistent build cache created for `--mount=type=cache`. + +#### **--external** + +Remove images even when they are used by external containers (e.g., build containers). + +#### **--filter**=*filters* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------:|--------------------------------------------------------------------------------------------------| +| label | Only remove images, with (or without, in the case of label!=[...] is used) the specified labels. | +| until | Only remove images created before given timestamp. | + + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes containers with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes containers without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not provide an interactive prompt for container removal. + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Remove all dangling images from local storage: +``` +$ sudo podman image prune + +WARNING! This will remove all dangling images. +Are you sure you want to continue? [y/N] y +f3e20dc537fb04cb51672a5cb6fdf2292e61d411315549391a0d1f64e4e3097e +324a7a3b2e0135f4226ffdd473e4099fd9e477a74230cdc35de69e84c0f9d907 +``` + +Remove all unused images from local storage without confirming: +``` +$ sudo podman image prune -a -f +f3e20dc537fb04cb51672a5cb6fdf2292e61d411315549391a0d1f64e4e3097e +324a7a3b2e0135f4226ffdd473e4099fd9e477a74230cdc35de69e84c0f9d907 +6125002719feb1ddf3030acab1df6156da7ce0e78e571e9b6e9c250424d6220c +91e732da5657264c6f4641b8d0c4001c218ae6c1adb9dcef33ad00cafd37d8b6 +e4e5109420323221f170627c138817770fb64832da7d8fe2babd863148287fca +77a57fa8285e9656dbb7b23d9efa837a106957409ddd702f995605af27a45ebe + +``` + +Remove all unused images from local storage since given time/hours: +``` +$ sudo podman image prune -a --filter until=2019-11-14T06:15:42.937792374Z + +WARNING! This will remove all dangling images. +Are you sure you want to continue? [y/N] y +e813d2135f17fadeffeea8159a34cfdd4c30b98d8111364b913a91fd930643e9 +5e6572320437022e2746467ddf5b3561bf06e099e8e6361df27e0b2a7ed0b17b +58fda2abf5042b35dfe04e5f8ee458a3cc26375bf309efb42c078b551a2055c7 +6d2bd30fe924d3414b64bd3920760617e6ced872364bc3bc6959a623252da002 +33d1c829be64a1e1d379caf4feec1f05a892c3ef7aa82c0be53d3c08a96c59c5 +f9f0a8a58c9e02a2b3250b88cc5c95b1e10245ca2c4161d19376580aaa90f55c +1ef14d5ede80db78978b25ad677fd3e897a578c3af614e1fda608d40c8809707 +45e1482040e441a521953a6da2eca9bafc769e15667a07c23720d6e0cafc3ab2 + +$ sudo podman image prune -f --filter until=10h +f3e20dc537fb04cb51672a5cb6fdf2292e61d411315549391a0d1f64e4e3097e +324a7a3b2e0135f4226ffdd473e4099fd9e477a74230cdc35de69e84c0f9d907 +``` + +Remove all unused images from local storage with label version 1.0: +``` +$ sudo podman image prune -a -f --filter label=version=1.0 +e813d2135f17fadeffeea8159a34cfdd4c30b98d8111364b913a91fd930643e9 +5e6572320437022e2746467ddf5b3561bf06e099e8e6361df27e0b2a7ed0b17b +58fda2abf5042b35dfe04e5f8ee458a3cc26375bf309efb42c078b551a2055c7 +6d2bd30fe924d3414b64bd3920760617e6ced872364bc3bc6959a623252da002 +33d1c829be64a1e1d379caf4feec1f05a892c3ef7aa82c0be53d3c08a96c59c5 +f9f0a8a58c9e02a2b3250b88cc5c95b1e10245ca2c4161d19376580aaa90f55c +1ef14d5ede80db78978b25ad677fd3e897a578c3af614e1fda608d40c8809707 +45e1482040e441a521953a6da2eca9bafc769e15667a07c23720d6e0cafc3ab2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-images(1)](podman-images.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) +December 2020, converted filter information from docs.docker.com documentation by Dan Walsh (dwalsh at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-image-scp.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-image-scp.1.md new file mode 100644 index 000000000..64e7e7fc9 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-image-scp.1.md @@ -0,0 +1,107 @@ +--- +title: podman-image-scp +version: v5.5.0 +--- + +% podman-image-scp 1 + +## NAME +podman-image-scp - Securely copy an image from one host to another + +## SYNOPSIS +**podman image scp** [*options*] *name*[:*tag*] + +## DESCRIPTION +**podman image scp** copies container images between hosts on a network. This command can copy images to the remote host or from the remote host as well as between two remote hosts. +Note: `::` is used to specify the image name depending on Podman is saving or loading. Images can also be transferred from rootful to rootless storage on the same machine without using sshd. This feature is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. + +**podman image scp [GLOBAL OPTIONS]** + +**podman image** *scp [OPTIONS] NAME[:TAG] [HOSTNAME::]* + +**podman image** *scp [OPTIONS] [HOSTNAME::]IMAGENAME* + +**podman image** *scp [OPTIONS] [HOSTNAME::]IMAGENAME [HOSTNAME::]* + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--quiet**, **-q** + +Suppress the output + +## EXAMPLES + +Copy specified image to local storage: +``` +$ podman image scp alpine +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image from local storage to remote connection: +``` +$ podman image scp alpine Fedora::/home/charliedoern/Documents/alpine +Getting image source signatures +Copying blob 72e830a4dff5 done +Copying config 85f9dc67c7 done +Writing manifest to image destination +Storing signatures +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image from remote connection to remote connection: +``` +$ podman image scp Fedora::alpine RHEL:: +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image via ssh to local storage: +``` +$ podman image scp charliedoern@192.168.68.126:22/run/user/1000/podman/podman.sock::alpine +WARN[0000] Unknown connection name given. Please use system connection add to specify the default remote socket location +Getting image source signatures +Copying blob 9450ef9feb15 [--------------------------------------] 0.0b / 0.0b +Copying config 1f97f0559c done +Writing manifest to image destination +Storing signatures +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image from root account to user accounts local storage: +``` +$ sudo podman image scp root@localhost::alpine username@localhost:: +Copying blob e2eb06d8af82 done +Copying config 696d33ca15 done +Writing manifest to image destination +Storing signatures +Getting image source signatures +Copying blob 5eb901baf107 skipped: already exists +Copying config 696d33ca15 done +Writing manifest to image destination +Storing signatures +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image from root account to local storage: +``` +$ sudo podman image scp root@localhost::alpine +Copying blob e2eb06d8af82 done +Copying config 696d33ca15 done +Writing manifest to image destination +Storing signatures +Getting image source signatures +Copying blob 5eb901baf107 +Copying config 696d33ca15 done +Writing manifest to image destination +Storing signatures +Loaded image: docker.io/library/alpine:latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-load(1)](podman-load.1.md)**, **[podman-save(1)](podman-save.1.md)**, **[podman-remote(1)](podman-remote.1.md)**, **[podman-system-connection-add(1)](podman-system-connection-add.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** + +## HISTORY +July 2021, Originally written by Charlie Doern diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-image-sign.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-image-sign.1.md new file mode 100644 index 000000000..c43004526 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-image-sign.1.md @@ -0,0 +1,94 @@ +--- +title: podman-image-sign +version: v5.5.0 +--- + +% podman-image-sign 1 + +## NAME +podman-image-sign - Create a signature for an image + +## SYNOPSIS +**podman image sign** [*options*] *image* [*image* ...] + +## DESCRIPTION +**podman image sign** creates a local signature for one or more local images that have +been pulled from a registry. The signature is written to a directory +derived from the registry configuration files in `$HOME/.config/containers/registries.d` if it exists, +otherwise `/etc/containers/registries.d` (unless overridden at compile-time), see **containers-registries.d(5)** for more information. +By default, the signature is written into `/var/lib/containers/sigstore` for root and `$HOME/.local/share/containers/sigstore` for non-root users + +## OPTIONS + +#### **--all**, **-a** + +Sign all the manifests of the multi-architecture image (default false). + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + +#### **--directory**, **-d**=*dir* + +Store the signatures in the specified directory. Default: /var/lib/containers/sigstore + +#### **--help**, **-h** + +Print usage statement. + +#### **--sign-by**=*identity* + +Override the default identity of the signature. + +## EXAMPLES +Sign the busybox image with the identity of foo@bar.com with a user's keyring and save the signature in /tmp/signatures/. + +```bash + $ sudo podman image sign --sign-by foo@bar.com --directory /tmp/signatures docker://privateregistry.example.com/foobar + + $ sudo podman image sign --authfile=/tmp/foobar.json --sign-by foo@bar.com --directory /tmp/signatures docker://privateregistry.example.com/foobar +``` + +## RELATED CONFIGURATION + +The write (and read) location for signatures is defined in YAML-based +configuration files in /etc/containers/registries.d/ for root, +or $HOME/.config/containers/registries.d for non-root users. When signing +an image, Podman uses those configuration files to determine +where to write the signature based on the name of the originating +registry or a default storage value unless overridden with the --directory +option. For example, consider the following configuration file. + +```yaml +docker: + privateregistry.example.com: + sigstore: file:///var/lib/containers/sigstore +``` + +When signing an image preceded with the registry name 'privateregistry.example.com', +the signature is written into sub-directories of +/var/lib/containers/sigstore/privateregistry.example.com. The use of 'sigstore' also means +the signature is 'read' from that same location on a pull-related function. + +## SEE ALSO +**[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.d(5)](https://github.com/containers/image/blob/main/docs/containers-registries.d.5.md)** + +## HISTORY +November 2018, Originally compiled by Qi Wang (qiwan at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-image-tree.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-image-tree.1.md new file mode 100644 index 000000000..fbef5aecf --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-image-tree.1.md @@ -0,0 +1,91 @@ +--- +title: podman-image-tree +version: v5.5.0 +--- + +% podman-image-tree 1 + +## NAME +podman\-image\-tree - Print layer hierarchy of an image in a tree format + +## SYNOPSIS +**podman image tree** [*options*] *image:tag*|*image-id* + + +## DESCRIPTION +Prints layer hierarchy of an image in a tree format. +If no *tag* is provided, Podman defaults to `latest` for the *image*. +Layers are indicated with image tags as `Top Layer of`, when the tag is known locally. +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--whatrequires** + +Show all child images and layers of the specified image + +## EXAMPLES + +List image tree information on specified image: +``` +$ podman image tree docker.io/library/wordpress +Image ID: 6e880d17852f +Tags: [docker.io/library/wordpress:latest] +Size: 429.9MB +Image Layers +├── ID: 3c816b4ead84 Size: 58.47MB +├── ID: e39dad2af72e Size: 3.584kB +├── ID: b2d6a702383c Size: 213.6MB +├── ID: 94609408badd Size: 3.584kB +├── ID: f4dddbf86725 Size: 43.04MB +├── ID: 8f695df43a4c Size: 11.78kB +├── ID: c29d67bf8461 Size: 9.728kB +├── ID: 23f4315918f8 Size: 7.68kB +├── ID: d082f93a18b3 Size: 13.51MB +├── ID: 7ea8bedcac69 Size: 4.096kB +├── ID: dc3bbf7b3dc0 Size: 57.53MB +├── ID: fdbbc6404531 Size: 11.78kB +├── ID: 8d24785437c6 Size: 4.608kB +├── ID: 80715f9e8880 Size: 4.608kB Top Layer of: [docker.io/library/php:7.2-apache] +├── ID: c93cbcd6437e Size: 3.573MB +├── ID: dece674f3cd1 Size: 4.608kB +├── ID: 834f4497afda Size: 7.168kB +├── ID: bfe2ce1263f8 Size: 40.06MB +└── ID: 748e99b214cf Size: 11.78kB Top Layer of: [docker.io/library/wordpress:latest] +``` + +Show all child images and layers of the specified image: +``` +$ podman image tree ae96a4ad4f3f --whatrequires +Image ID: ae96a4ad4f3f +Tags: [docker.io/library/ruby:latest] +Size: 894.2MB +Image Layers +└── ID: 9c92106221c7 Size: 2.56kB Top Layer of: [docker.io/library/ruby\:latest] + ├── ID: 1b90f2b80ba0 Size: 3.584kB + │ ├── ID: 42b7d43ae61c Size: 169.5MB + │ ├── ID: 26dc8ba99ec3 Size: 2.048kB + │ ├── ID: b4f822db8d95 Size: 3.957MB + │ ├── ID: 044e9616ef8a Size: 164.7MB + │ ├── ID: bf94b940200d Size: 11.75MB + │ ├── ID: 4938e71bfb3b Size: 8.532MB + │ └── ID: f513034bf553 Size: 1.141MB + ├── ID: 1e55901c3ea9 Size: 3.584kB + ├── ID: b62835a63f51 Size: 169.5MB + ├── ID: 9f4e8857f3fd Size: 2.048kB + ├── ID: c3b392020e8f Size: 3.957MB + ├── ID: 880163026a0a Size: 164.8MB + ├── ID: 8c78b2b14643 Size: 11.75MB + ├── ID: 830370cfa182 Size: 8.532MB + └── ID: 567fd7b7bd38 Size: 1.141MB Top Layer of: [docker.io/circleci/ruby\\:latest] + +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +Feb 2019, Originally compiled by Kunal Kushwaha `` diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-image-trust.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-image-trust.1.md new file mode 100644 index 000000000..17079214b --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-image-trust.1.md @@ -0,0 +1,211 @@ +--- +title: podman-image-trust +version: v5.5.0 +--- + +% podman-image-trust 1 + +## NAME +podman\-image\-trust - Manage container registry image trust policy + + +## SYNOPSIS +**podman image trust** set|show [*options*] *registry[/repository]* + +## DESCRIPTION +Manages which registries to trust as a source of container images based on its location. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +The location is determined +by the transport and the registry host of the image. Using this container image `docker://docker.io/library/busybox` +as an example, `docker` is the transport and `docker.io` is the registry host. + +Trust is defined in **/etc/containers/policy.json** and is enforced when a user attempts to pull +a remote image from a registry. The trust policy in policy.json describes a registry scope (registry and/or repository) for the trust. This trust can use public keys for signed images. + +The scope of the trust is evaluated from most specific to the least specific. In other words, a policy may be: + + * Defined to an entire registry. + * Defined to a particular repository in that registry. + * Defined to a specific signed image inside of the registry. + +The following list are examples of valid scope values used in policy.json from most specific to the least specific: + +docker.io/library/busybox\:notlatest + +docker.io/library/busybox + +docker.io/library + +docker.io + +If no configuration is found for any of these scopes, the default value (specified by using "default" instead of REGISTRY[/REPOSITORY]) is used. + +Trust **type** provides a way to: + +Allowlist ("accept") or +Denylist ("reject") registries or +Require a simple signing signature (“signedBy”), +Require a sigstore signature ("sigstoreSigned"). + +Trust may be updated using the command **podman image trust set** for an existing trust scope. + +## OPTIONS +#### **--help**, **-h** + Print usage statement. + +### set OPTIONS + +#### **--pubkeysfile**, **-f**=*KEY1* + A path to an exported public key on the local system. Key paths + are referenced in policy.json. Any path to a file may be used but locating the file in **/etc/pki/containers** is recommended. Options may be used multiple times to + require an image be signed by multiple keys. The **--pubkeysfile** option is required for the **signedBy** and **sigstoreSigned** types. + +#### **--type**, **-t**=*value* + The trust type for this policy entry. + Accepted values: + **signedBy** (default): Require simple signing signatures with corresponding list of + public keys + **sigstoreSigned**: Require sigstore signatures with corresponding list of + public keys + **accept**: do not require any signatures for this + registry scope + **reject**: do not accept images for this registry scope + +### show OPTIONS + +#### **--json**, **-j** + Output trust as JSON for machine parsing + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--raw** + Output trust policy file as raw JSON + +## EXAMPLES + +Accept all unsigned images from a registry: +``` +sudo podman image trust set --type accept docker.io +``` + +Modify default trust policy: +``` +sudo podman image trust set -t reject default +``` + +Display system trust policy: +``` +podman image trust show +TRANSPORT NAME TYPE ID STORE +all default reject +repository docker.io/library accept +repository registry.access.redhat.com signed security@redhat.com https://access.redhat.com/webassets/docker/content/sigstore +repository registry.redhat.io signed security@redhat.com https://registry.redhat.io/containers/sigstore +repository docker.io reject +docker-daemon accept +``` + +Display trust policy file: +``` +podman image trust show --raw +{ + "default": [ + { + "type": "reject" + } + ], + "transports": { + "docker": { + "docker.io": [ + { + "type": "reject" + } + ], + "docker.io/library": [ + { + "type": "insecureAcceptAnything" + } + ], + "registry.access.redhat.com": [ + { + "type": "signedBy", + "keyType": "GPGKeys", + "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" + } + ], + "registry.redhat.io": [ + { + "type": "signedBy", + "keyType": "GPGKeys", + "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" + } + ] + }, + "docker-daemon": { + "": [ + { + "type": "insecureAcceptAnything" + } + ] + } + } +} +``` + +Display trust as JSON: +``` +podman image trust show --json +[ + { + "transport": "all", + "name": "* (default)", + "repo_name": "default", + "type": "reject" + }, + { + "transport": "repository", + "name": "docker.io", + "repo_name": "docker.io", + "type": "reject" + }, + { + "transport": "repository", + "name": "docker.io/library", + "repo_name": "docker.io/library", + "type": "accept" + }, + { + "transport": "repository", + "name": "registry.access.redhat.com", + "repo_name": "registry.access.redhat.com", + "sigstore": "https://access.redhat.com/webassets/docker/content/sigstore", + "type": "signed", + "gpg_id": "security@redhat.com" + }, + { + "transport": "repository", + "name": "registry.redhat.io", + "repo_name": "registry.redhat.io", + "sigstore": "https://registry.redhat.io/containers/sigstore", + "type": "signed", + "gpg_id": "security@redhat.com" + }, + { + "transport": "docker-daemon", + "type": "accept" + } +] +``` + +## SEE ALSO +**[containers-policy.json(5)](https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md)** + +## HISTORY +January 2019, updated by Tom Sweeney (tsweeney at redhat dot com) +December 2018, originally compiled by Qi Wang (qiwan at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-image-unmount.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-image-unmount.1.md new file mode 100644 index 000000000..5febc9c4a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-image-unmount.1.md @@ -0,0 +1,55 @@ +--- +title: podman-image-unmount +version: v5.5.0 +--- + +% podman-image-unmount 1 + +## NAME +podman\-image\-unmount - Unmount an image's root filesystem + +## SYNOPSIS +**podman image unmount** [*options*] *image* [...] + +**podman image umount** [*options*] *image* [...] + +## DESCRIPTION +Unmounts the specified images' root file system, if no other processes +are using it. + +Image storage increments a mount counter each time an image is mounted. +When an image is unmounted, the mount counter is decremented, and the +image's root filesystem is physically unmounted only when the mount +counter reaches zero indicating no other processes are using the mount. +An unmount can be forced with the --force flag. + +## OPTIONS +#### **--all**, **-a** + +All of the currently mounted images are unmounted. + +#### **--force**, **-f** + +Force the unmounting of specified images' root file system, even if other +processes have mounted it. + +Note: Other processes using the file system can fail if the mount point is removed without their knowledge. + +## EXAMPLE + +Unmount image with a given ID: +``` +podman image unmount imageID +``` + +Unmount multiple images with given IDs: +``` +podman image unmount imageID1 imageID2 imageID3 +``` + +Unmount all images: +``` +podman image unmount --all +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image-mount(1)](podman-image-mount.1.md)**, **[podman-mount(1)](podman-mount.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-image.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-image.1.md new file mode 100644 index 000000000..bdb65680c --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-image.1.md @@ -0,0 +1,45 @@ +--- +title: podman-image +version: v5.5.0 +--- + +% podman-image 1 + +## NAME +podman\-image - Manage images + +## SYNOPSIS +**podman image** *subcommand* + +## DESCRIPTION +The image command allows the management of images + +## COMMANDS + +| Command | Man Page | Description | +| -------- | --------------------------------------------------- | ----------------------------------------------------------------------- | +| build | [podman-build(1)](podman-build.1.md) | Build a container using a Dockerfile. | +| diff | [podman-image-diff(1)](podman-image-diff.1.md) | Inspect changes on an image's filesystem. | +| exists | [podman-image-exists(1)](podman-image-exists.1.md) | Check if an image exists in local storage. | +| history | [podman-history(1)](podman-history.1.md) | Show the history of an image. | +| import | [podman-import(1)](podman-import.1.md) | Import a tarball and save it as a filesystem image. | +| inspect | [podman-image-inspect(1)](podman-image-inspect.1.md)| Display an image's configuration. | +| list | [podman-images(1)](podman-images.1.md) | List the container images on the system.(alias ls) | +| load | [podman-load(1)](podman-load.1.md) | Load an image from the docker archive. | +| mount | [podman-image-mount(1)](podman-image-mount.1.md) | Mount an image's root filesystem. | +| prune | [podman-image-prune(1)](podman-image-prune.1.md) | Remove all unused images from the local store. | +| pull | [podman-pull(1)](podman-pull.1.md) | Pull an image from a registry. | +| push | [podman-push(1)](podman-push.1.md) | Push an image from local storage to elsewhere. | +| rm | [podman-rmi(1)](podman-rmi.1.md) | Remove one or more locally stored images. | +| save | [podman-save(1)](podman-save.1.md) | Save an image to docker-archive or oci. | +| scp | [podman-image-scp(1)](podman-image-scp.1.md) | Securely copy an image from one host to another. | +| search | [podman-search(1)](podman-search.1.md) | Search a registry for an image. | +| sign | [podman-image-sign(1)](podman-image-sign.1.md) | Create a signature for an image. | +| tag | [podman-tag(1)](podman-tag.1.md) | Add an additional name to a local image. | +| tree | [podman-image-tree(1)](podman-image-tree.1.md) | Print layer hierarchy of an image in a tree format. | +| trust | [podman-image-trust(1)](podman-image-trust.1.md) | Manage container registry image trust policy. | +| unmount | [podman-image-unmount(1)](podman-image-unmount.1.md) | Unmount an image's root filesystem. | +| untag | [podman-untag(1)](podman-untag.1.md) | Remove one or more names from a locally-stored image. | + +## SEE ALSO +**[podman(1)](podman.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-images.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-images.1.md new file mode 100644 index 000000000..7fa981751 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-images.1.md @@ -0,0 +1,268 @@ +--- +title: podman-images +version: v5.5.0 +--- + +% podman-images 1 + +## NAME +podman\-images - List images in local storage + +## SYNOPSIS +**podman images** [*options*] [image] + +**podman image list** [*options*] [image] + +**podman image ls** [*options*] [image] + +## DESCRIPTION +Displays locally stored images, their names, and their IDs. + +## OPTIONS + +#### **--all**, **-a** + +Show all images (by default filter out the intermediate image layers). The default is false. + +#### **--digests** + +Show image digests + +#### **--filter**, **-f**=*filter* + +Provide filter values. + +The *filters* argument format is of `key=value` or `key!=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------------:|-----------------------------------------------------------------------------------------------| +| id | Filter by image ID. | +| before | Filter by images created before the given IMAGE (name or tag). | +| containers | Filter by images with a running container. | +| dangling | Filter by dangling (unused) images. | +| digest | Filter by digest. | +| intermediate | Filter by images that are dangling and have no children | +| label | Filter by images with (or without, in the case of label!=[...] is used) the specified labels. | +| manifest | Filter by images that are manifest lists. | +| readonly | Filter by read-only or read/write images. | +| reference | Filter by image name. | +| after/since | Filter by images created after the given IMAGE (name or tag). | +| until | Filter by images created until the given duration or time. | + +The `id` *filter* accepts the image ID string. + +The `before` *filter* accepts formats: `[:]`, `` or ``. + +The `containers` *filter* shows images that have a running container based on that image. + +The `dangling` *filter* shows images that are taking up disk space and serve no purpose. Dangling image is a file system layer that was used in a previous build of an image and is no longer referenced by any image. They are denoted with the `` tag, consume disk space and serve no active purpose. + +The `digest` *filter* accepts the image digest string. + +The `intermediate` *filter* shows images that are dangling and have no children. + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which shows images with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which shows images without the specified labels. + +The `manifest` *filter* shows images that are manifest lists. + +The `readonly` *filter* shows, as a default, both read-only and read/write images. Read-only images can be configured by modifying the `additionalimagestores` in the `/etc/containers/storage.conf` file. + +The `reference` *filter* accepts the pattern of an image reference `[:]`. + +The `after` or `since` *filter* accepts formats: `[:]`, `` or ``. + +The `until` *filter* accepts formats: golang duration, RFC3339 time, or a Unix timestamp and shows all images that are created until that time. + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|-----------------|------------------------------------------------------------| +| .Containers | Number of containers using this image | +| .Created | Elapsed time since the image was created | +| .CreatedAt | Time when the image was created, YYYY-MM-DD HH\:MM\:SS +nnnn | +| .CreatedSince | Same as .Created | +| .CreatedTime | Same as .CreatedAt | +| .Dangling | Same as .IsDangling | +| .Digest | Image digest | +| .History | History of the image layer | +| .ID | Image ID (truncated) | +| .Id | Image ID (full SHA) | +| .IsDangling | Is image dangling? (true/false) | +| .IsReadOnly | Is unage read-only? (true/false) | +| .Labels ... | map[] of labels | +| .Names | Image FQIN | +| .ParentId | Full SHA of parent image ID, or null (string) | +| .ReadOnly | Same as .IsReadOnly | +| .RepoDigests | map[] of zero or more repo/name@sha256\:SHA strings | +| .Repository | Image repository | +| .RepoTags | map[] of zero or more FQIN strings for this image | +| .SharedSize | Always seems to be 0 | +| .Size | Size of layer on disk (human-friendly string) | +| .Tag | Image tag | +| .VirtualSize | Size of layer on disk (bytes) | + +#### **--history** + +Display the history of image names. If an image gets re-tagged or untagged, then the image name history gets prepended (latest image first). This is especially useful when undoing a tag operation or an image does not contain any name because it has been untagged. + + +[//]: # (BEGIN included file options/no-trunc.md) +#### **--no-trunc** + +Do not truncate the output (default *false*). + +[//]: # (END included file options/no-trunc.md) + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Lists only the image IDs. + +#### **--sort**=*sort* + +Sort by *created*, *id*, *repository*, *size* or *tag* (default: **created**) +When sorting by *repository* it also sorts by the *tag* as second criteria to provide a stable output. + +## EXAMPLE + +List all non-dangling images in local storage: +``` +$ podman images +REPOSITORY TAG IMAGE ID CREATED SIZE +quay.io/podman/stable latest e0b7dabc3352 22 hours ago 331 MB +docker.io/library/alpine latest 9c6f07244728 5 days ago 5.83 MB +registry.fedoraproject.org/fedora latest 2ecb6df95994 3 weeks ago 169 MB +quay.io/libpod/testimage 20220615 f26aa69bb3f3 2 months ago 8.4 MB +``` + +List all images matching the specified name: +``` +$ podman images stable +REPOSITORY TAG IMAGE ID CREATED SIZE +quay.io/podman/stable latest e0b7dabc3352 22 hours ago 331 MB +``` + +List image ids of all images in containers storage: +``` +# podman image ls --quiet +e3d42bcaf643 +ebb91b73692b +4526339ae51c +``` + +List all images without showing the headers: +``` +# podman images --noheading +docker.io/kubernetes/pause latest e3d42bcaf643 3 years ago 251 kB + ebb91b73692b 4 weeks ago 27.2 MB +docker.io/library/ubuntu latest 4526339ae51c 6 weeks ago 126 MB +``` + +List all images without truncating output: +``` +# podman image list --no-trunc +REPOSITORY TAG IMAGE ID CREATED SIZE +docker.io/kubernetes/pause latest sha256:e3d42bcaf643097dd1bb0385658ae8cbe100a80f773555c44690d22c25d16b27 3 years ago 251 kB + sha256:ebb91b73692bd27890685846412ae338d13552165eacf7fcd5f139bfa9c2d6d9 4 weeks ago 27.2 MB +docker.io/library/ubuntu latest sha256:4526339ae51c3cdc97956a7a961c193c39dfc6bd9733b0d762a36c6881b5583a 6 weeks ago 126 MB +``` + +List all image content with the formatted content: +``` +# podman images --format "table {{.ID}} {{.Repository}} {{.Tag}}" +IMAGE ID REPOSITORY TAG +e3d42bcaf643 docker.io/kubernetes/pause latest +ebb91b73692b +4526339ae51c docker.io/library/ubuntu latest +``` + +List any image that is not tagged with a name (dangling): +``` +# podman images --filter dangling=true +REPOSITORY TAG IMAGE ID CREATED SIZE + ebb91b73692b 4 weeks ago 27.2 MB +``` + +List all images in JSON format: +``` +# podman images --format json +[ + { + "id": "e3d42bcaf643097dd1bb0385658ae8cbe100a80f773555c44690d22c25d16b27", + "names": [ + "docker.io/kubernetes/pause:latest" + ], + "digest": "sha256:0aecf73ff86844324847883f2e916d3f6984c5fae3c2f23e91d66f549fe7d423", + "created": "2014-07-19T07:02:32.267701596Z", + "size": 250665 + }, + { + "id": "ebb91b73692bd27890685846412ae338d13552165eacf7fcd5f139bfa9c2d6d9", + "names": [ + "\u003cnone\u003e" + ], + "digest": "sha256:ba7e4091d27e8114a205003ca6a768905c3395d961624a2c78873d9526461032", + "created": "2017-10-26T03:07:22.796184288Z", + "size": 27170520 + }, + { + "id": "4526339ae51c3cdc97956a7a961c193c39dfc6bd9733b0d762a36c6881b5583a", + "names": [ + "docker.io/library/ubuntu\:latest" + ], + "digest": "sha256:193f7734ddd68e0fb24ba9af8c2b673aecb0227b026871f8e932dab45add7753", + "created": "2017-10-10T20:59:05.10196344Z", + "size": 126085200 + } +] +``` + +List all images sorted by the specified column: +``` +# podman images --sort repository +REPOSITORY TAG IMAGE ID CREATED SIZE + 2460217d76fc About a minute ago 4.41 MB +docker.io/library/alpine latest 3fd9065eaf02 5 months ago 4.41 MB +localhost/myapp latest b2e0ad03474a About a minute ago 4.41 MB +registry.access.redhat.com/rhel7 latest 7a840db7f020 2 weeks ago 211 MB +registry.fedoraproject.org/fedora 27 801894bc0e43 6 weeks ago 246 MB +``` + +Show the difference between listed images in use versus all images, including dangling images: +``` +# podman images +REPOSITORY TAG IMAGE ID CREATED SIZE +localhost/test latest 18f0c080cd72 4 seconds ago 4.42 MB +docker.io/library/alpine latest 3fd9065eaf02 5 months ago 4.41 MB +# podman images -a +REPOSITORY TAG IMAGE ID CREATED SIZE +localhost/test latest 18f0c080cd72 6 seconds ago 4.42 MB + 270e70dc54c0 7 seconds ago 4.42 MB + 4ed6fbe43414 8 seconds ago 4.41 MB + 6b0df8e71508 8 seconds ago 4.41 MB +docker.io/library/alpine latest 3fd9065eaf02 5 months ago 4.41 MB +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +March 2017, Originally compiled by Dan Walsh `` diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-import.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-import.1.md new file mode 100644 index 000000000..d7f3f13f0 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-import.1.md @@ -0,0 +1,121 @@ +--- +title: podman-import +version: v5.5.0 +--- + +% podman-import 1 + +## NAME +podman\-import - Import a tarball and save it as a filesystem image + +## SYNOPSIS +**podman import** [*options*] *path* [*reference*] + +**podman image import** [*options*] *path* [*reference*] + +## DESCRIPTION +**podman import** imports a tarball (possibly compressed using Gzip, Bzip2, XZ or Zstd) +and saves it as a filesystem image. Remote tarballs can be specified using a URL. +Various image instructions can be configured with the **--change** flag and +a commit message can be set using the **--message** flag. +**reference**, if present, is a tag to assign to the image. +**podman import** is used for importing from the archive generated by **podman export**, that includes the container's filesystem. To import the archive of image layers created by **podman save**, use **podman load**. +Note: `:` is a restricted character and cannot be part of the file name. + +## OPTIONS + +#### **--arch** + +Set architecture of the imported image. + +#### **--change**, **-c**=*instruction* + +Apply the following possible instructions to the created image: +**CMD** | **ENTRYPOINT** | **ENV** | **EXPOSE** | **LABEL** | **STOPSIGNAL** | **USER** | **VOLUME** | **WORKDIR** + +Can be set multiple times + +#### **--help**, **-h** + +Print usage statement + +#### **--message**, **-m**=*message* + +Set commit message for imported image + +#### **--os** + +Set OS of the imported image. + +#### **--quiet**, **-q** + +Shows progress on the import + +#### **--variant** + +Set variant of the imported image. + +## EXAMPLES + +Import the selected tarball into new image, specifying the CMD, ENTRYPOINT and LABEL: +``` +$ podman import --change CMD=/bin/bash --change ENTRYPOINT=/bin/sh --change LABEL=blue=image ctr.tar image-imported +Getting image source signatures +Copying blob sha256:b41deda5a2feb1f03a5c1bb38c598cbc12c9ccd675f438edc6acd815f7585b86 + 25.80 MB / 25.80 MB [======================================================] 0s +Copying config sha256:c16a6d30f3782288ec4e7521c754acc29d37155629cb39149756f486dae2d4cd + 448 B / 448 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +db65d991f3bbf7f31ed1064db9a6ced7652e3f8166c4736aa9133dadd3c7acb3 +``` + +Import the selected tarball into new image, specifying the CMD, ENTRYPOINT and LABEL: +``` +$ podman import --change 'ENTRYPOINT ["/bin/sh","-c","test-image"]' --change LABEL=blue=image test-image.tar image-imported +Getting image source signatures +Copying blob e3b0c44298fc skipped: already exists +Copying config 1105523502 done +Writing manifest to image destination +Storing signatures +110552350206337183ceadc0bdd646dc356e06514c548b69a8917b4182414b +``` + +Import new tagged image from stdin in quiet mode: +``` +$ cat ctr.tar | podman -q import --message "importing the ctr.tar file" - image-imported +db65d991f3bbf7f31ed1064db9a6ced7652e3f8166c4736aa9133dadd3c7acb3 +``` + +Import an image from stdin: +``` +$ cat ctr.tar | podman import - +Getting image source signatures +Copying blob sha256:b41deda5a2feb1f03a5c1bb38c598cbc12c9ccd675f438edc6acd815f7585b86 + 25.80 MB / 25.80 MB [======================================================] 0s +Copying config sha256:d61387b4d5edf65edee5353e2340783703074ffeaaac529cde97a8357eea7645 + 378 B / 378 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +db65d991f3bbf7f31ed1064db9a6ced7652e3f8166c4736aa9133dadd3c7acb3 +``` + +Import named image from tarball via a URL: +``` +$ podman import http://example.com/ctr.tar url-image +Downloading from "http://example.com/ctr.tar" +Getting image source signatures +Copying blob sha256:b41deda5a2feb1f03a5c1bb38c598cbc12c9ccd675f438edc6acd815f7585b86 + 25.80 MB / 25.80 MB [======================================================] 0s +Copying config sha256:5813fe8a3b18696089fd09957a12e88bda43dc1745b5240879ffffe93240d29a + 419 B / 419 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +db65d991f3bbf7f31ed1064db9a6ced7652e3f8166c4736aa9133dadd3c7acb3 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-export(1)](podman-export.1.md)** + +## HISTORY +November 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-info.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-info.1.md new file mode 100644 index 000000000..a3e1757dd --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-info.1.md @@ -0,0 +1,409 @@ +--- +title: podman-info +version: v5.5.0 +--- + +% podman-info 1 + +## NAME +podman\-info - Display Podman related system information + +## SYNOPSIS +**podman info** [*options*] + +**podman system info** [*options*] + +## DESCRIPTION + +Displays information pertinent to the host, current storage stats, configured container registries, and build of podman. + + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change output format to "json" or a Go template. + +| **Placeholder** | **Info pertaining to ...** | +| ------------------- | --------------------------------------- | +| .Host ... | ...the host on which podman is running | +| .Plugins ... | ...external plugins | +| .Registries ... | ...configured registries | +| .Store ... | ...the storage driver and paths | +| .Version ... | ...podman version | + +Each of the above branch out into further subfields, more than can +reasonably be enumerated in this document. + +## EXAMPLES + +Run `podman info` for a YAML formatted response: +``` +$ podman info +host: + arch: amd64 + buildahVersion: 1.23.0 + cgroupControllers: [] + cgroupManager: systemd + cgroupVersion: v2 + conmon: + package: conmon-2.0.29-2.fc34.x86_64 + path: /usr/bin/conmon + version: 'conmon version 2.0.29, commit: ' + cpu_utilization: + idle_percent: 96.84 + system_percent: 0.71 + user_percent: 2.45 + cpus: 8 + distribution: + distribution: fedora + variant: workstation + version: "34" + eventLogger: journald + hostname: localhost.localdomain + idMappings: + gidmap: + - container_id: 0 + host_id: 3267 + size: 1 + - container_id: 1 + host_id: 100000 + size: 65536 + uidmap: + - container_id: 0 + host_id: 3267 + size: 1 + - container_id: 1 + host_id: 100000 + size: 65536 + kernel: 5.13.13-200.fc34.x86_64 + linkmode: dynamic + logDriver: journald + memFree: 1833385984 + memTotal: 16401895424 + networkBackend: cni + networkBackendInfo: + backend: cni + dns: + package: podman-plugins-3.4.4-1.fc34.x86_64 + path: /usr/libexec/cni/dnsname + version: |- + CNI dnsname plugin + version: 1.3.1 + commit: unknown + package: |- + containernetworking-plugins-1.0.1-1.fc34.x86_64 + podman-plugins-3.4.4-1.fc34.x86_64 + path: /usr/libexec/cni + ociRuntime: + name: crun + package: crun-1.0-1.fc34.x86_64 + path: /usr/bin/crun + version: |- + crun version 1.0 + commit: 139dc6971e2f1d931af520188763e984d6cdfbf8 + spec: 1.0.0 + +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL + os: linux + pasta: + executable: /usr/bin/passt + package: passt-0^20221116.gace074c-1.fc34.x86_64 + version: | + passt 0^20221116.gace074c-1.fc34.x86_64 + Copyright Red Hat + GNU Affero GPL version 3 or later + This is free software: you are free to change and redistribute it. + There is NO WARRANTY, to the extent permitted by law. + remoteSocket: + path: /run/user/3267/podman/podman.sock + security: + apparmorEnabled: false + capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID + rootless: true + seccompEnabled: true + seccompProfilePath: /usr/share/containers/seccomp.json + selinuxEnabled: true + serviceIsRemote: false + slirp4netns: + executable: /bin/slirp4netns + package: slirp4netns-1.1.12-2.fc34.x86_64 + version: |- + slirp4netns version 1.1.12 + commit: 7a104a101aa3278a2152351a082a6df71f57c9a3 + libslirp: 4.4.0 + SLIRP_CONFIG_VERSION_MAX: 3 + libseccomp: 2.5.0 + swapFree: 15687475200 + swapTotal: 16886259712 + uptime: 47h 15m 9.91s (Approximately 1.96 days) +plugins: + log: + - k8s-file + - none + - journald + network: + - bridge + - macvlan + volume: + - local +registries: + search: + - registry.fedoraproject.org + - registry.access.redhat.com + - docker.io + - quay.io +store: + configFile: /home/dwalsh/.config/containers/storage.conf + containerStore: + number: 9 + paused: 0 + running: 1 + stopped: 8 + graphDriverName: overlay + graphOptions: {} + graphRoot: /home/dwalsh/.local/share/containers/storage + graphRootAllocated: 510389125120 + graphRootUsed: 129170714624 + graphStatus: + Backing Filesystem: extfs + Native Overlay Diff: "true" + Supports d_type: "true" + Using metacopy: "false" + imageCopyTmpDir: /home/dwalsh/.local/share/containers/storage/tmp + imageStore: + number: 5 + runRoot: /run/user/3267/containers + transientStore: false + volumePath: /home/dwalsh/.local/share/containers/storage/volumes +version: + APIVersion: 4.0.0 + Built: 1631648722 + BuiltTime: Tue Sep 14 15:45:22 2021 + GitCommit: 23677f92dd83e96d2bc8f0acb611865fb8b1a56d + GoVersion: go1.16.6 + OsArch: linux/amd64 + Version: 4.0.0 +``` + +Run `podman info --format json` for a JSON formatted response: +``` +$ podman info --format json +{ + "host": { + "arch": "amd64", + "buildahVersion": "1.23.0", + "cgroupManager": "systemd", + "cgroupVersion": "v2", + "cgroupControllers": [], + "conmon": { + "package": "conmon-2.0.29-2.fc34.x86_64", + "path": "/usr/bin/conmon", + "version": "conmon version 2.0.29, commit: " + }, + "cpus": 8, + "distribution": { + "distribution": "fedora", + "version": "34" + }, + "eventLogger": "journald", + "hostname": "localhost.localdomain", + "idMappings": { + "gidmap": [ + { + "container_id": 0, + "host_id": 3267, + "size": 1 + }, + { + "container_id": 1, + "host_id": 100000, + "size": 65536 + } + ], + "uidmap": [ + { + "container_id": 0, + "host_id": 3267, + "size": 1 + }, + { + "container_id": 1, + "host_id": 100000, + "size": 65536 + } + ] + }, + "kernel": "5.13.13-200.fc34.x86_64", + "logDriver": "journald", + "memFree": 1785753600, + "memTotal": 16401895424, + "networkBackend": "cni", + "networkBackendInfo": { + "backend": "cni", + "package": "containernetworking-plugins-1.0.1-1.fc34.x86_64\npodman-plugins-3.4.4-1.fc34.x86_64", + "path": "/usr/libexec/cni", + "dns": { + "version": "CNI dnsname plugin\nversion: 1.3.1\ncommit: unknown", + "package": "podman-plugins-3.4.4-1.fc34.x86_64", + "path": "/usr/libexec/cni/dnsname" + } + }, + "ociRuntime": { + "name": "crun", + "package": "crun-1.0-1.fc34.x86_64", + "path": "/usr/bin/crun", + "version": "crun version 1.0\ncommit: 139dc6971e2f1d931af520188763e984d6cdfbf8\nspec: 1.0.0\n+SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL" + }, + "os": "linux", + "remoteSocket": { + "path": "/run/user/3267/podman/podman.sock" + }, + "serviceIsRemote": false, + "security": { + "apparmorEnabled": false, + "capabilities": "CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID", + "rootless": true, + "seccompEnabled": true, + "seccompProfilePath": "/usr/share/containers/seccomp.json", + "selinuxEnabled": true + }, + "slirp4netns": { + "executable": "/bin/slirp4netns", + "package": "slirp4netns-1.1.12-2.fc34.x86_64", + "version": "slirp4netns version 1.1.12\ncommit: 7a104a101aa3278a2152351a082a6df71f57c9a3\nlibslirp: 4.4.0\nSLIRP_CONFIG_VERSION_MAX: 3\nlibseccomp: 2.5.0" + }, + "pasta": { + "executable": "/usr/bin/passt", + "package": "passt-0^20221116.gace074c-1.fc34.x86_64", + "version": "passt 0^20221116.gace074c-1.fc34.x86_64\nCopyright Red Hat\nGNU Affero GPL version 3 or later \u003chttps://www.gnu.org/licenses/agpl-3.0.html\u003e\nThis is free software: you are free to change and redistribute it.\nThere is NO WARRANTY, to the extent permitted by law.\n" + }, + "swapFree": 15687475200, + "swapTotal": 16886259712, + "uptime": "47h 17m 29.75s (Approximately 1.96 days)", + "linkmode": "dynamic" + }, + "store": { + "configFile": "/home/dwalsh/.config/containers/storage.conf", + "containerStore": { + "number": 9, + "paused": 0, + "running": 1, + "stopped": 8 + }, + "graphDriverName": "overlay", + "graphOptions": { + + }, + "graphRoot": "/home/dwalsh/.local/share/containers/storage", + "graphStatus": { + "Backing Filesystem": "extfs", + "Native Overlay Diff": "true", + "Supports d_type": "true", + "Using metacopy": "false" + }, + "imageCopyTmpDir": "/home/dwalsh/.local/share/containers/storage/tmp", + "imageStore": { + "number": 5 + }, + "runRoot": "/run/user/3267/containers", + "volumePath": "/home/dwalsh/.local/share/containers/storage/volumes", + "transientStore": false + }, + "registries": { + "search": [ + "registry.fedoraproject.org", + "registry.access.redhat.com", + "docker.io", + "quay.io" +] + }, + "plugins": { + "volume": [ + "local" + ], + "network": [ + "bridge", + "macvlan" + ], + "log": [ + "k8s-file", + "none", + "journald" + ] + }, + "version": { + "APIVersion": "4.0.0", + "Version": "4.0.0", + "GoVersion": "go1.16.6", + "GitCommit": "23677f92dd83e96d2bc8f0acb611865fb8b1a56d", + "BuiltTime": "Tue Sep 14 15:45:22 2021", + "Built": 1631648722, + "OsArch": "linux/amd64" + } +} +``` + +#### Extracting the list of container registries with a Go template + +If shell completion is enabled, type `podman info --format={{.` and then press `[TAB]` twice. + +``` +$ podman info --format={{. +{{.Host. {{.Plugins. {{.Registries}} {{.Store. {{.Version. +``` + +Press `R` `[TAB]` `[ENTER]` to print the registries information. + +``` +$ podman info -f {{.Registries}} +map[search:[registry.fedoraproject.org registry.access.redhat.com docker.io quay.io]] +$ +``` + +The output still contains a map and an array. The map value can be extracted with + +``` +$ podman info -f '{{index .Registries "search"}}' +[registry.fedoraproject.org registry.access.redhat.com docker.io quay.io] +``` + +The array can be printed as one entry per line + +``` +$ podman info -f '{{range index .Registries "search"}}{{.}}\n{{end}}' +registry.fedoraproject.org +registry.access.redhat.com +docker.io +quay.io + +``` + +#### Extracting the list of container registries from JSON with jq + +The command-line JSON processor [__jq__](https://stedolan.github.io/jq/) can be used to extract the list +of container registries. + +``` +$ podman info -f json | jq '.registries["search"]' +[ + "registry.fedoraproject.org", + "registry.access.redhat.com", + "docker.io", + "quay.io" +] +``` + +The array can be printed as one entry per line + +``` +$ podman info -f json | jq -r '.registries["search"] | .[]' +registry.fedoraproject.org +registry.access.redhat.com +docker.io +quay.io +``` + +Note, the Go template struct fields start with upper case. When running `podman info` or `podman info --format=json`, the same names start with lower case. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-init.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-init.1.md new file mode 100644 index 000000000..a0377996d --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-init.1.md @@ -0,0 +1,61 @@ +--- +title: podman-init +version: v5.5.0 +--- + +% podman-init 1 + +## NAME +podman\-init - Initialize one or more containers + +## SYNOPSIS +**podman init** [*options*] *container* [*container*...] + +**podman container init** [*options*] *container* [*container*...] + +## DESCRIPTION +Initialize one or more containers. +You may use container IDs or names as input. +Initializing a container performs all tasks necessary for starting the container (mounting filesystems, creating an OCI spec, initializing the container network) but does not start the container. +If a container is not initialized, the `podman start` and `podman run` commands initialize it automatically prior to starting it. +This command is intended to be used for inspecting a container's filesystem or OCI spec prior to starting it. +This can be used to inspect the container before it runs, or debug why a container is failing to run. + +## OPTIONS + +#### **--all**, **-a** + +Initialize all containers. Containers that have already initialized (including containers that have been started and are running) are ignored. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Initialize specified container with a given ID. +``` +podman init 35480fc9d568 +``` + +Initialize specified container with a given name. +``` +podman init test1 +``` + +Initialize the latest container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +podman init --latest +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-start(1)](podman-start.1.md)** + +## HISTORY +April 2019, Originally compiled by Matthew Heon diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-inspect.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-inspect.1.md new file mode 100644 index 000000000..b72f20913 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-inspect.1.md @@ -0,0 +1,185 @@ +--- +title: podman-inspect +version: v5.5.0 +--- + +% podman-inspect 1 + +## NAME +podman\-inspect - Display a container, image, volume, network, or pod's configuration + +## SYNOPSIS +**podman inspect** [*options*] *name* [...] + +## DESCRIPTION + +This displays the low-level information on containers and images identified by name or ID. By default, this renders +all results in a JSON array. If the inspect type is all, the order of inspection is: containers, images, volumes, network, pods. + If a container has the same name as an image, then the container JSON is returned, and so on. + If a format is specified, the given template is executed for each result. + +For more inspection options, see also +[podman-container-inspect(1)](podman-container-inspect.1.md), +[podman-image-inspect(1)](podman-image-inspect.1.md), +[podman-network-inspect(1)](podman-network-inspect.1.md), +[podman-pod-inspect(1)](podman-pod-inspect.1.md), and +[podman-volume-inspect(1)](podman-volume-inspect.1.md). + +## OPTIONS + +#### **--format**, **-f**=*format* + +Format the output using the given Go template. +The keys of the returned JSON can be used as the values for the --format flag (see examples below). + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--size**, **-s** + +In addition to normal output, display the total file size if the type is a container. + +#### **--type**, **-t**=*type* + +Return JSON for the specified type. Type can be 'container', 'image', 'volume', 'network', 'pod', or 'all' (default: all) +(Only meaningful when invoked as *podman inspect*) + +## EXAMPLE + +Inspect the fedora image: +``` +# podman inspect fedora +[ + { + "Id": "f0858ad3febdf45bb2e5501cb459affffacef081f79eaa436085c3b6d9bd46ca", + "Digest": "sha256:d4f7df6b691d61af6cee7328f82f1d8afdef63bc38f58516858ae3045083924a", + "RepoTags": [ + "docker.io/library/fedora:latest" + ], + "RepoDigests": [ + "docker.io/library/fedora@sha256:8fa60b88e2a7eac8460b9c0104b877f1aa0cea7fbc03c701b7e545dacccfb433", + "docker.io/library/fedora@sha256:d4f7df6b691d61af6cee7328f82f1d8afdef63bc38f58516858ae3045083924a" + ], + "Parent": "", + "Comment": "", + "Created": "2019-10-29T03:23:37.695123423Z", + "Config": { + "Env": [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "DISTTAG=f31-updates-candidatecontainer", + "FGC=f31-updates-candidate", + "FBR=f31-updates-candidate" + ], + "Cmd": [ + "/bin/bash" + ], + "Labels": { + "maintainer": "Clement Verna \u003ccverna@fedoraproject.org\u003e" + } + }, + "Version": "18.06.1-ce", + "Author": "", + "Architecture": "amd64", + "Os": "linux", + "Size": 201096840, + "VirtualSize": 201096840, + "GraphDriver": { + "Name": "overlay", + "Data": { + "UpperDir": "/home/user/.local/share/containers/storage/overlay/2ae3cee18c8ef9e0d448649747dab81c4f1ca2714a8c4550eff49574cab262c9/diff", + "WorkDir": "/home/user/.local/share/containers/storage/overlay/2ae3cee18c8ef9e0d448649747dab81c4f1ca2714a8c4550eff49574cab262c9/work" + } + }, + "RootFS": { + "Type": "layers", + "Layers": [ + "sha256:2ae3cee18c8ef9e0d448649747dab81c4f1ca2714a8c4550eff49574cab262c9" + ] + }, + "Labels": { + "maintainer": "Clement Verna \u003ccverna@fedoraproject.org\u003e" + }, + "Annotations": {}, + "ManifestType": "application/vnd.docker.distribution.manifest.v2+json", + "User": "", + "History": [ + { + "created": "2019-01-16T21:21:55.569693599Z", + "created_by": "/bin/sh -c #(nop) LABEL maintainer=Clement Verna \u003ccverna@fedoraproject.org\u003e", + "empty_layer": true + }, + { + "created": "2019-09-27T21:21:07.784469821Z", + "created_by": "/bin/sh -c #(nop) ENV DISTTAG=f31-updates-candidatecontainer FGC=f31-updates-candidate FBR=f31-updates-candidate", + "empty_layer": true + }, + { + "created": "2019-10-29T03:23:37.355187998Z", + "created_by": "/bin/sh -c #(nop) ADD file:298f828afc880ccde9205fc4418435d5e696ad165e283f0530d0b1a74326d6dc in / " + }, + { + "created": "2019-10-29T03:23:37.695123423Z", + "created_by": "/bin/sh -c #(nop) CMD [\"/bin/bash\"]", + "empty_layer": true + } + ], + "NamesHistory": [] + } +] +``` + +Inspect the specified image with the `ImageName` format specifier: +``` +# podman inspect a04 --format "{{.ImageName}}" +fedora +``` + +Inspect the specified image for `GraphDriver` format specifier: +``` +# podman inspect a04 --format "{{.GraphDriver.Name}}" +overlay +``` + +Inspect the specified image for its `Size` format specifier: +``` +# podman image inspect --format "size: {{.Size}}" alpine +size: 4405240 +``` + +Inspect the latest container created for `EffectiveCaps` format specifier. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman container inspect --latest --format {{.EffectiveCaps}} +[CAP_CHOWN CAP_DAC_OVERRIDE CAP_FSETID CAP_FOWNER CAP_SETGID CAP_SETUID CAP_SETFCAP CAP_SETPCAP CAP_NET_BIND_SERVICE CAP_KILL] +``` + +Inspect the specified pod for the `Name` format specifier: +``` +# podman inspect myPod --type pod --format "{{.Name}}" +myPod +``` + +Inspect the specified volume for the `Name` format specifier: +``` +# podman inspect myVolume --type volume --format "{{.Name}}" +myVolume +``` + +Inspect the specified network for the `Name` format specifier: +``` +# podman inspect nyNetwork --type network --format "{{.name}}" +myNetwork +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container-inspect(1)](podman-container-inspect.1.md)**, **[podman-image-inspect(1)](podman-image-inspect.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-pod-inspect(1)](podman-pod-inspect.1.md)**, **[podman-volume-inspect(1)](podman-volume-inspect.1.md)** + +## HISTORY +July 2017, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-kill.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-kill.1.md new file mode 100644 index 000000000..174c773fd --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-kill.1.md @@ -0,0 +1,91 @@ +--- +title: podman-kill +version: v5.5.0 +--- + +% podman-kill 1 + +## NAME +podman\-kill - Kill the main process in one or more containers + +## SYNOPSIS +**podman kill** [*options*] [*container* ...] + +**podman container kill** [*options*] [*container* ...] + +## DESCRIPTION +The main process inside each container specified is sent SIGKILL or any signal specified with the `--signal` option. + +## OPTIONS +#### **--all**, **-a** + +Signal all running and paused containers. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and kill the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/signal.md) +#### **--signal**, **-s**=**signal** + +Signal to send to the container. For more information on Linux signals, refer to *signal(7)*. +The default is **SIGKILL**. + +[//]: # (END included file options/signal.md) + +## EXAMPLE + +Kill container with a given name: +``` +podman kill mywebserver +``` + +Kill container with a given ID: +``` +podman kill 860a4b23 +``` + +Terminate container by sending `TERM` signal: +``` +podman kill --signal TERM 860a4b23 +``` + +Kill the latest container. (This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines): +``` +podman kill --latest +``` + +Terminate all containers by sending `KILL` signal: +``` +podman kill --signal KILL -a +``` + +Kill containers using ID specified in a given files: +``` +podman kill --cidfile /home/user/cidfile-1 +podman kill --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-stop(1)](podman-stop.1.md)** + +## HISTORY +September 2017, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-kube-apply.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-kube-apply.1.md new file mode 100644 index 000000000..0b0e24869 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-kube-apply.1.md @@ -0,0 +1,79 @@ +--- +title: podman-kube-apply +version: v5.5.0 +--- + +% podman-kube-apply 1 + +## NAME +podman-kube-apply - Apply Kubernetes YAML based on containers, pods, or volumes to a Kubernetes cluster + +## SYNOPSIS +**podman kube apply** [*options*] [*container...* | *pod...* | *volume...*] + +## DESCRIPTION +**podman kube apply** deploys a podman container, pod, or volume to a Kubernetes cluster. Use the `--file` option to deploy a Kubernetes YAML (v1 specification) to a Kubernetes cluster as well. + +Note that the Kubernetes YAML file can be used to run the deployment in Podman via podman-play-kube(1). + +## OPTIONS + +#### **--ca-cert-file**=*ca cert file path | "insecure"* + +The path to the CA cert file for the Kubernetes cluster. Usually the kubeconfig has the CA cert file data and `generate kube` automatically picks that up if it is available in the kubeconfig. If no CA cert file data is available, set this to `insecure` to bypass the certificate verification. + +#### **--file**, **-f**=*kube yaml filepath* + +Path to the kubernetes yaml file to deploy onto the kubernetes cluster. This file can be generated using the `podman kube generate` command. The input may be in the form of a yaml file, or stdin. For stdin, use `--file=-`. + +#### **--kubeconfig**, **-k**=*kubeconfig filepath* + +Path to the kubeconfig file to be used when deploying the generated kube yaml to the Kubernetes cluster. The environment variable `KUBECONFIG` can be used to set the path for the kubeconfig file as well. +Note: A kubeconfig can have multiple cluster configurations, but `kube generate` always picks the first cluster configuration in the given kubeconfig. + +#### **--ns**=*namespace* + +The namespace or project to deploy the workloads of the generated kube yaml to in the Kubernetes cluster. + +#### **--service**, **-s** + +Used to create a service for the corresponding container or pod being deployed to the cluster. In particular, if the container or pod has portmap bindings, the service specification includes a NodePort declaration to expose the service. A random port is assigned by Podman in the service specification that is deployed to the cluster. + +## EXAMPLES + +Apply a podman volume and container to the "default" namespace in a Kubernetes cluster. +``` +$ podman kube apply --kubeconfig /tmp/kubeconfig myvol vol-test-1 +Deploying to cluster... +Successfully deployed workloads to cluster! +$ kubectl get pods +NAME READY STATUS RESTARTS AGE +vol-test-1-pod 1/1 Running 0 9m +``` + +Apply a Kubernetes YAML file to the "default" namespace in a Kubernetes cluster. +``` +$ podman kube apply --kubeconfig /tmp/kubeconfig -f vol.yaml +Deploying to cluster... +Successfully deployed workloads to cluster! +$ kubectl get pods +NAME READY STATUS RESTARTS AGE +vol-test-2-pod 1/1 Running 0 9m +``` + +Apply a Kubernetes YAML file to the "test1" namespace in a Kubernetes cluster. +``` +$ podman kube apply --kubeconfig /tmp/kubeconfig --ns test1 vol-test-3 +Deploying to cluster... +Successfully deployed workloads to cluster! +$ kubectl get pods --namespace test1 +NAME READY STATUS RESTARTS AGE +vol-test-3-pod 1/1 Running 0 9m + +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)** + +## HISTORY +September 2022, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-kube-down.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-kube-down.1.md new file mode 100644 index 000000000..29b7e7516 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-kube-down.1.md @@ -0,0 +1,76 @@ +--- +title: podman-kube-down +version: v5.5.0 +--- + +% podman-kube-down 1 + +## NAME +podman-kube-down - Remove containers and pods based on Kubernetes YAML + +## SYNOPSIS +**podman kube down** [*options*] *file.yml|-|https://website.io/file.yml* + +## DESCRIPTION +**podman kube down** reads a specified Kubernetes YAML file, tearing down pods that were created by the `podman kube play` command via the same Kubernetes YAML +file. Any volumes that were created by the previous `podman kube play` command remain intact unless the `--force` options is used. If the YAML file is +specified as `-`, `podman kube down` reads the YAML from stdin. The input can also be a URL that points to a YAML file such as https://podman.io/demo.yml. +`podman kube down` tears down the pods and containers created by `podman kube play` via the same Kubernetes YAML from the URL. However, +`podman kube down` does not work with a URL if the YAML file the URL points to has been changed or altered since the creation of the pods and containers using +`podman kube play`. + +## OPTIONS + +#### **--force** + +Tear down the volumes linked to the PersistentVolumeClaims as part --down + +## EXAMPLES + +Example YAML file `demo.yml`: +``` +apiVersion: v1 +kind: Pod +metadata: +... +spec: + containers: + - command: + - top + - name: container + value: podman + image: foobar +... +``` + +Remove the pod and containers as described in the `demo.yml` file +``` +$ podman kube down demo.yml +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Remove the pod and containers as described in the `demo.yml` file YAML sent to stdin +``` +$ cat demo.yml | podman kube play - +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Remove the pods and containers as described in the `demo.yml` file YAML read from a URL +``` +$ podman kube down https://podman.io/demo.yml +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` +`podman kube down` does not work with a URL if the YAML file the URL points to has been changed +or altered since it was used to create the pods and containers. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-kube(1)](podman-kube.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-kube-generate.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-kube-generate.1.md new file mode 100644 index 000000000..10d1a580a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-kube-generate.1.md @@ -0,0 +1,254 @@ +--- +title: podman-kube-generate +version: v5.5.0 +--- + +% podman-kube-generate 1 + +## NAME +podman-kube-generate - Generate Kubernetes YAML based on containers, pods or volumes + +## SYNOPSIS +**podman kube generate** [*options*] *container...* | *pod...* | *volume...* + +## DESCRIPTION +**podman kube generate** generates Kubernetes YAML (v1 specification) from Podman containers, pods or volumes. Regardless of whether +the input is for containers or pods, Podman generates the specification as a Pod by default. The input may be in the form +of one or more containers, pods or volumes names or IDs. + +`Podman Containers or Pods` + +Volumes appear in the generated YAML according to two different volume types. Bind-mounted volumes become *hostPath* volume types and named volumes become *persistentVolumeClaim* volume types. Generated *hostPath* volume types are one of three subtypes depending on the state of the host path: *DirectoryOrCreate* when no file or directory exists at the host, *Directory* when host path is a directory, or *File* when host path is a file. The value for *claimName* for a *persistentVolumeClaim* is the name of the named volume registered in Podman. + +Potential name conflicts between volumes are avoided by using a standard naming scheme for each volume type. The *hostPath* volume types are named according to the path on the host machine, replacing forward slashes with hyphens less any leading and trailing forward slashes. The special case of the filesystem root, `/`, translates to the name `root`. Additionally, the name is suffixed with `-host` to avoid naming conflicts with *persistentVolumeClaim* volumes. Each *persistentVolumeClaim* volume type uses the name of its associated named volume suffixed with `-pvc`. + +Note that if an init container is created with type `once` and the pod has been started, it does not show up in the generated kube YAML as `once` type init containers are deleted after they are run. If the pod has only been created and not started, it is in the generated kube YAML. +Init containers created with type `always` are always generated in the kube YAML as they are never deleted, even after running to completion. + +*Note*: When using volumes and generating a Kubernetes YAML for an unprivileged and rootless podman container on an **SELinux enabled system**, one of the following options must be completed: + * Add the "privileged: true" option to the pod spec + * Add `type: spc_t` under the `securityContext` `seLinuxOptions` in the pod spec + * Relabel the volume via the CLI command `chcon -t container_file_t -R ` + +Once completed, the correct permissions are in place to access the volume when the pod/container is created in a Kubernetes cluster. + +Note that the generated Kubernetes YAML file can be used to re-run the deployment via podman-play-kube(1). + +Note that if the pod being generated was created with the **--infra-name** flag set, then the generated kube yaml will have the **io.podman.annotations.infra.name** set where the value is the name of the infra container set by the user. + +Note that both Deployment and DaemonSet can only have `restartPolicy` set to `Always`. + +Note that Job can only have `restartPolicy` set to `OnFailure` or `Never`. By default, podman sets it to `Never` when generating a kube yaml using `kube generate`. + +## OPTIONS + +#### **--filename**, **-f**=*filename* + +Output to the given file instead of STDOUT. If the file already exists, `kube generate` refuses to replace it and returns an error. + +#### **--podman-only** + +Add podman-only reserved annotations in generated YAML file (Cannot be used by Kubernetes) + +#### **--replicas**, **-r**=*replica count* + +The value to set `replicas` to when generating a **Deployment** kind. +Note: this can only be set with the option `--type=deployment`. + +#### **--service**, **-s** + +Generate a Kubernetes service object in addition to the Pods. Used to generate a Service specification for the corresponding Pod output. In particular, if the object has portmap bindings, the service specification includes a NodePort declaration to expose the service. A random port is assigned by Podman in the specification. + +#### **--type**, **-t**=*pod* | *deployment* | *daemonset* | *job* + +The Kubernetes kind to generate in the YAML file. Currently, the only supported Kubernetes specifications are `Pod`, `Deployment`, `Job`, and `DaemonSet`. By default, the `Pod` specification is generated. + +## EXAMPLES + +Create Kubernetes Pod YAML for the specified container. +``` +$ podman kube generate some-mariadb +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-4.8.2 + +# NOTE: If you generated this yaml from an unprivileged and rootless podman container on an SELinux +# enabled system, check the podman generate kube man page for steps to follow to ensure that your pod/container +# has the right permissions to access the volumes added. +--- +apiVersion: v1 +kind: Pod +metadata: + creationTimestamp: "2024-01-09T02:24:55Z" + labels: + app: some-mariadb-pod + name: some-mariadb-pod +spec: + containers: + - args: + - mariadbd + env: + - name: MARIADB_ROOT_PASSWORD + value: x + image: docker.io/library/mariadb:10.11 + name: some-mariadb + ports: + - containerPort: 3306 + hostPort: 34891 + volumeMounts: + - mountPath: /var/lib/mysql + name: mariadb_data-pvc + volumes: + - name: mariadb_data-pvc + persistentVolumeClaim: + claimName: mariadb_data +``` + +Create Kubernetes Deployment YAML with 3 replicas for the specified container. +``` +$ podman kube generate --type deployment --replicas 3 dep-ct +r +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-4.5.0-dev +apiVersion: apps/v1 +kind: Deployment +metadata: + creationTimestamp: "2023-03-27T20:45:08Z" + labels: + app: dep-ctr-pod + name: dep-ctr-pod-deployment +spec: + replicas: 3 + selector: + matchLabels: + app: dep-ctr-pod + template: + metadata: + annotations: + io.podman.annotations.ulimit: nofile=524288:524288,nproc=127332:127332 + creationTimestamp: "2023-03-27T20:45:08Z" + labels: + app: dep-ctr-pod + name: dep-ctr-pod + spec: + containers: + - command: + - top + image: docker.io/library/alpine:latest + name: dep-ctr +``` + + +Create Kubernetes Pod YAML for the specified container with the host directory `/home/user/my-data` bind-mounted onto the container path `/volume`. +``` +$ podman kube generate my-container-with-bind-mounted-data +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-3.1.0-dev +apiVersion: v1 +kind: Pod +metadata: + creationTimestamp: "2021-03-18T16:26:08Z" + labels: + app: my-container-with-bind-mounted-data + name: my-container-with-bind-mounted-data +spec: + containers: + - command: + - /bin/sh + image: docker.io/library/alpine:latest + name: test-bind-mount + volumeMounts: + - mountPath: /volume + name: home-user-my-data-host + restartPolicy: Never + volumes: + - hostPath: + path: /home/user/my-data + type: Directory + name: home-user-my-data-host +``` + +Create Kubernetes Pod YAML for the specified container with named volume `priceless-data` mounted onto the container path `/volume`. +``` +$ podman kube generate my-container-using-priceless-data +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-3.1.0-dev +apiVersion: v1 +kind: Pod +metadata: + creationTimestamp: "2021-03-18T16:26:08Z" + labels: + app: my-container-using-priceless-data + name: my-container-using-priceless-data +spec: + containers: + - command: + - /bin/sh + image: docker.io/library/alpine:latest + name: test-bind-mount + volumeMounts: + - mountPath: /volume + name: priceless-data-pvc + restartPolicy: Never + volumes: + - name: priceless-data-pvc + persistentVolumeClaim: + claimName: priceless-data +``` + +Create Kubernetes Pod YAML for the specified pod and include a service. +``` +$ sudo podman kube generate -s demoweb +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-0.12.2-dev +apiVersion: v1 +kind: Pod +metadata: + creationTimestamp: 2018-12-18T15:16:06Z + labels: + app: demoweb + name: demoweb-libpod +spec: + containers: + - command: + - python3 + - /root/code/graph.py + image: quay.io/baude/demoweb:latest + name: practicalarchimedes + tty: true + workingDir: /root/code +--- +apiVersion: v1 +kind: Service +metadata: + creationTimestamp: 2018-12-18T15:16:06Z + labels: + app: demoweb + name: demoweb-libpod +spec: + ports: + - name: "8050" + nodePort: 31269 + port: 8050 + targetPort: 0 + selector: + app: demoweb + type: NodePort +status: + loadBalancer: {} +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-down(1)](podman-kube-down.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-kube-play.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-kube-play.1.md new file mode 100644 index 000000000..d7a418c89 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-kube-play.1.md @@ -0,0 +1,823 @@ +--- +title: podman-kube-play +version: v5.5.0 +--- + +% podman-kube-play 1 + +## NAME +podman-kube-play - Create containers, pods and volumes based on Kubernetes YAML + +## SYNOPSIS +**podman kube play** [*options*] *file.yml|-|https://website.io/file.yml* + +## DESCRIPTION +**podman kube play** reads in a structured file of Kubernetes YAML. It recreates the containers, pods, or volumes described in the YAML. Containers within a pod are then started, and the ID of the new Pod or the name of the new Volume is output. If the YAML file is specified as "-", then `podman kube play` reads the YAML file from stdin. +The input can also be a URL that points to a YAML file such as https://podman.io/demo.yml. `podman kube play` reads the YAML from the URL and create pods and containers from it. + +Using the `--down` command line option, it is also capable of tearing down the pods created by a previous run of `podman kube play`. + +Using the `--replace` command line option, it tears down the pods(if any) created by a previous run of `podman kube play` and recreate the pods with the Kubernetes YAML file. + +Ideally the input file is created by the Podman command (see podman-kube-generate(1)). This guarantees a smooth import and expected results. + +Currently, the supported Kubernetes kinds are: + +- Pod +- Deployment +- PersistentVolumeClaim +- ConfigMap +- Secret +- DaemonSet +- Job + +`Kubernetes Pods or Deployments` + +Only five volume types are supported by kube play, the *hostPath*, *emptyDir*, *configMap*, *persistentVolumeClaim*, and *image* volume types. + +- When using the *hostPath* volume type, only the *default (empty)*, *DirectoryOrCreate*, *Directory*, *FileOrCreate*, *File*, *Socket*, *CharDevice* and *BlockDevice* subtypes are supported. Podman interprets the value of *hostPath* *path* as a file path when it contains at least one forward slash, otherwise Podman treats the value as the name of a named volume. +- When using a *persistentVolumeClaim*, the value for *claimName* is the name for the Podman named volume. +- When using an *emptyDir* volume, Podman creates an anonymous volume that is attached the containers running inside the pod and is deleted once the pod is removed. +- When using an *configMap* volume, Podman creates an anonymous volume that is attached the containers running inside the pod and is deleted once the pod is removed. +- When using an *image* volume, Podman creates a read-only image volume with an empty subpath (the whole image is mounted). The image must already exist locally. It is supported in rootful mode only. + +Note: The default restart policy for containers is `always`. You can change the default by setting the `restartPolicy` field in the spec. + +Note: When playing a kube YAML with init containers, the init container is created with init type value `once`. To change the default type, use the `io.podman.annotations.init.container.type` annotation to set the type to `always`. + +Note: *hostPath* volume types created by kube play is given an SELinux shared label (z), bind mounts are not relabeled (use `chcon -t container_file_t -R `). + +Note: To set userns of a pod, use the **io.podman.annotations.userns** annotation in the pod/deployment definition. For example, **io.podman.annotations.userns=keep-id** annotation tells Podman to create a user namespace where the current rootless user's UID\:GID are mapped to the same values in the container. This can be overridden with the `--userns` flag. + +Note: Use the **io.podman.annotations.volumes-from** annotation to bind mount volumes of one container to another. You can mount volumes from multiple source containers to a target container. The source containers that belong to the same pod must be defined before the source container in the kube YAML. The annotation format is `io.podman.annotations.volumes-from/targetContainer: "sourceContainer1\:mountOpts1;sourceContainer2:mountOpts2"`. + +Note: If the `:latest` tag is used, Podman attempts to pull the image from a registry. If the image was built locally with Podman or Buildah, it has `localhost` as the domain, in that case, Podman uses the image from the local store even if it has the `\:latest` tag. + +Note: The command `podman play kube` is an alias of `podman kube play`, and performs the same function. + +Note: The command `podman kube down` can be used to stop and remove pods or containers based on the same Kubernetes YAML used +by `podman kube play` to create them. + +Note: To customize the name of the infra container created during `podman kube play`, use the **io.podman.annotations.infra.name** annotation in the pod definition. This annotation is automatically set when generating a kube yaml from a pod that was created with the `--infra-name` flag set. + +Note: Use the **io.podman.annotations.pids-limit/$ctrname** annotation to configure the pod's pids limit. + +`Kubernetes PersistentVolumeClaims` + +A Kubernetes PersistentVolumeClaim represents a Podman named volume. Only the PersistentVolumeClaim name is required by Podman to create a volume. Kubernetes annotations can be used to make use of the available options for Podman volumes. + +- volume.podman.io/driver +- volume.podman.io/device +- volume.podman.io/type +- volume.podman.io/uid +- volume.podman.io/gid +- volume.podman.io/mount-options +- volume.podman.io/import-source +- volume.podman.io/image + +Use `volume.podman.io/import-source` to import the contents of the tarball (.tar, .tar.gz, .tgz, .bzip, .tar.xz, .txz) specified in the annotation's value into the created Podman volume + +Kube play is capable of building images on the fly given the correct directory layout and Containerfiles. This +option is not available for remote clients, including Mac and Windows (excluding WSL2) machines, yet. Consider the following excerpt from a YAML file: +``` +apiVersion: v1 +kind: Pod +metadata: +... +spec: + containers: + - name: container + image: foobar +... +``` + +If there is a directory named `foobar` in the current working directory with a file named `Containerfile` or `Dockerfile`, +Podman kube play builds that image and name it `foobar`. An example directory structure for this example looks +like: +``` +|- mykubefiles + |- myplayfile.yaml + |- foobar + |- Containerfile +``` + +The build considers `foobar` to be the context directory for the build. If there is an image in local storage +called `foobar`, the image is not built unless the `--build` flag is used. Use `--build=false` to completely +disable builds. + +Kube play supports CDI (Container Device Interface) device selectors to share +host devices (e.g. GPUs) with containers. The configuration format follows +Kubernetes extended resource management: +``` +apiVersion: v1 +kind: Pod +spec: + containers: + - name: container + resources: + limits: + nvidia.com/gpu=all: 1 +``` + +To enable sharing host devices, analogous to using the `--device` flag Podman +kube supports a custom CDI selector: `podman.io/device=`. + +`Kubernetes ConfigMap` + +Kubernetes ConfigMap can be referred as a source of environment variables or volumes in Pods or Deployments. +ConfigMaps aren't a standalone object in Podman; instead, when a container uses a ConfigMap, Podman creates environment variables or volumes as needed. + +For example, the following YAML document defines a ConfigMap and then uses it in a Pod: + +``` +apiVersion: v1 +kind: ConfigMap +metadata: + name: foo +data: + FOO: bar +--- +apiVersion: v1 +kind: Pod +metadata: + name: foobar +spec: + containers: + - name: container-1 + image: foobar + envFrom: + - configMapRef: + name: foo + optional: false +``` + +and as a result environment variable `FOO` is set to `bar` for container `container-1`. + +`Kubernetes Secret` + +Kubernetes Secret represents a Podman named secret. The Kubernetes Secret is saved as a whole and may be referred to as a source of environment variables or volumes in Pods or Deployments. + +For example, the following YAML document defines a Secret and then uses it in a Pod: + +``` +kind: Secret +apiVersion: v1 +metadata: + name: foo +data: + foo: YmFy # base64 for bar +--- +apiVersion: v1 +kind: Pod +metadata: + name: foobar +spec: + containers: + - name: container-1 + image: foobar + env: + - name: FOO + valueFrom: + secretKeyRef: + name: foo + key: foo +``` + +and as a result environment variable `FOO` is set to `bar` for container `container-1`. + +`Automounting Volumes (deprecated)` + +Note: The automounting annotation is deprecated. Kubernetes has [native support for image volumes](https://kubernetes.io/docs/tasks/configure-pod-container/image-volumes/) and that should be used rather than this podman-specific annotation. + +An image can be automatically mounted into a container if the annotation `io.podman.annotations.kube.image.automount/$ctrname` is given. The following rules apply: + +- The image must already exist locally. +- The image must have at least 1 volume directive. +- The path given by the volume directive will be mounted from the image into the container. For example, an image with a volume at `/test/test_dir` will have `/test/test_dir` in the image mounted to `/test/test_dir` in the container. +- Multiple images can be specified. If multiple images have a volume at a specific path, the last image specified trumps. +- The images are always mounted read-only. +- Images to mount are defined in the annotation "io.podman.annotations.kube.image.automount/$ctrname" as a semicolon-separated list. They are mounted into a single container in the pod, not the whole pod. The annotation can be specified for additional containers if additional mounts are required. + +## OPTIONS + + +[//]: # (BEGIN included file options/annotation.container.md) +#### **--annotation**=*key=value* + +Add an annotation to the container or pod. This option can be set multiple times. + +[//]: # (END included file options/annotation.container.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + +#### **--build** + +Build images even if they are found in the local storage. Use `--build=false` to completely disable builds. (This option is not available with the remote Podman client) + +Note: You can also override the default isolation type by setting the BUILDAH_ISOLATION environment variable. export BUILDAH_ISOLATION=oci. See podman-build.1.md for more information. + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + +#### **--configmap**=*path* + +Use Kubernetes configmap YAML at path to provide a source for environment variable values within the containers of the pod. (This option is not available with the remote Podman client) + +Note: The *--configmap* option can be used multiple times or a comma-separated list of paths can be used to pass multiple Kubernetes configmap YAMLs. +The YAML file may be in a multi-doc YAML format. But, it must container only configmaps + +#### **--context-dir**=*path* + +Use *path* as the build context directory for each image. Requires --build option be true. (This option is not available with the remote Podman client) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + +#### **--force** + +Tear down the volumes linked to the PersistentVolumeClaims as part of --down + +#### **--help**, **-h** + +Print usage statement + +#### **--ip**=*IP address* + +Assign a static ip address to the pod. This option can be specified several times when kube play creates more than one pod. +Note: When joining multiple networks use the **--network name\:ip=\** syntax. + +#### **--log-driver**=*driver* + +Set logging driver for all created containers. + + +[//]: # (BEGIN included file options/log-opt.md) +#### **--log-opt**=*name=value* + +Logging driver specific options. + +Set custom logging configuration. The following *name*s are supported: + +**path**: specify a path to the log file + (e.g. **--log-opt path=/var/log/container/mycontainer.json**); + +**max-size**: specify a max size of the log file + (e.g. **--log-opt max-size=10mb**); + +**tag**: specify a custom log tag for the container + (e.g. **--log-opt tag="{{.ImageName}}"**. +It supports the same keys as **podman inspect --format**. +This option is currently supported only by the **journald** log driver. + +[//]: # (END included file options/log-opt.md) + +#### **--mac-address**=*MAC address* + +Assign a static mac address to the pod. This option can be specified several times when kube play creates more than one pod. +Note: When joining multiple networks use the **--network name\:mac=\** syntax. + + +[//]: # (BEGIN included file options/network.md) +#### **--network**=*mode*, **--net** + +Set the network mode for the pod. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + For better integration with DNS handling, **--dns-forward 169.254.1.1** is passed, + and this address is added to resolv.conf(5) as first resolver. It is possible to pass + **--dns-forward** explicitly in case a different IP address should be used. + To make the `host.containers.internal` /etc/hosts entry work and allow connections + to the host, **--map-guest-addr 169.254.1.2** is passed. Again, it can be set + explicitly to choose a different IP address. \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured (via Podman's + **--publish** or by passing the pasta **-t**/**-u** options directly), + to disable automatic port forwarding based on bound ports. Similarly, **-T none** + and **-U none** are given to disable the same functionality from container to + host. \ + All options can also be set in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**; + see the `pasta_options` key under the network section in that file. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.md) + +When no network option is specified and *host* network mode is not configured in the YAML file, a new network stack is created and pods are attached to it making possible pod to pod communication. + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the pod. + +Podman assumes control over the pod's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with host added in the Kubernetes YAML. + +#### **--publish**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Define or override a port definition in the YAML file. + +The lists of ports in the YAML file and the command line are merged. Matching is done by using the **containerPort** field. +If **containerPort** exists in both the YAML file and the option, the latter takes precedence. + +#### **--publish-all** + +Setting this option to `true` will expose all ports to the host, +even if only specified via **containerPort** in the K8 YAML. +In terms of which port will be exposed, **--publish** has higher priority than **hostPort**, has higher priority than +**containerPort**. + +If set to `false` (which is the default), only ports defined via **hostPort** +or **--publish** are published on the host. + +#### **--quiet**, **-q** + +Suppress output information when pulling images + +#### **--replace** + +Tears down the pods created by a previous run of `kube play` and recreates the pods. This option is used to keep the existing pods up to date based upon the Kubernetes YAML. + +#### **--seccomp-profile-root**=*path* + +Directory path for seccomp profiles (default: "/var/lib/kubelet/seccomp"). (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +#### **--start** + +Start the pod after creating it, set to false to only create it. + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/userns.container.md) +#### **--userns**=*mode* + +Set the user namespace mode for the container. + +If `--userns` is not set, the default value is determined as follows. +- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used. +- If the environment variable **PODMAN_USERNS** is set its value is used. +- If `userns` is specified in `containers.conf` this value is used. +- Otherwise, `--userns=host` is assumed. + +`--userns=""` (i.e., an empty string) is an alias for `--userns=host`. + +This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +------------------------|-----------|--------------------- +auto | $UID | nil (Host User UID is not mapped into container.) +host | $UID | 0 (Default User account mapped to root user in container.) +keep-id | $UID | $UID (Map user account to same UID within container.) +keep-id\:uid=200,gid=210 | $UID | 200:210 (Map user account to specified UID, GID value within container.) +nomap | $UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + +**auto**[\:_OPTIONS,..._]: automatically create a unique user namespace. + +* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. + + Example: `containers:2147483647:2147483648`. + +* `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5). + +Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user IDs. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. + +The option `--userns=keep-id` uses all the subuids and subgids of the user. +The option `--userns=nomap` uses all the subuids and subgids of the user except the user's own ID. +Using `--userns=auto` when starting new containers does not work as long as any containers exist that were started with `--userns=nomap` or `--userns=keep-id` without limiting the user namespace size. + + Valid `auto` options: + + - *gidmapping*=_CONTAINER\_GID\:HOST\_GID\:SIZE_: to force a GID mapping to be present in the user namespace. + - *size*=_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates a size for the user namespace. + - *uidmapping*=_CONTAINER\_UID\:HOST\_UID\:SIZE_: to force a UID mapping to be present in the user namespace. + +The host UID and GID in *gidmapping* and *uidmapping* can optionally be prefixed with the `@` symbol. +In this case, podman will look up the intermediate ID corresponding to host ID and it will map the found intermediate ID to the container id. +For details see **--uidmap**. + +**container:**_id_: join the user namespace of the specified container. + +**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user. + +**keep-id**: creates a user namespace where the current user's UID\:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace. + + Valid `keep-id` options: + + - *uid*=UID: override the UID inside the container that is used to map the current user to. + - *gid*=GID: override the GID inside the container that is used to map the current user to. + - *size*=SIZE: override the size of the configured user namespace. It is useful to not saturate all the available IDs. Not supported when running as root. + +**nomap**: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +**ns:**_namespace_: run the pod in the given existing user namespace. + +[//]: # (END included file options/userns.container.md) + +#### **--wait**, **-w** + +Run pods and containers in the foreground. Default is false. + +At any time you can run `podman pod ps` in another shell to view a list of +the running pods and containers. + +When attached in the tty mode, you can kill the pods and containers by pressing +Ctrl-C or receiving any other interrupt signals. + +All pods, containers, and volumes created with `podman kube play` is removed +upon exit. + +## EXAMPLES + +Recreate the pod and containers described in the specified host YAML file. +``` +$ podman kube play demo.yml +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Recreate the pod and containers specified in a YAML file sent to stdin. +``` +$ cat demo.yml | podman kube play - +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Tear down the pod and containers as described in the specified YAML file. +``` +$ podman kube play --down demo.yml +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Provide multiple configmap files as sources for environment variables within the specified pods and containers. +``` +$ podman kube play demo.yml --configmap configmap-foo.yml,configmap-bar.yml +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 + +$ podman kube play demo.yml --configmap configmap-foo.yml --configmap configmap-bar.yml +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Create a pod connected to two networks with a static ip on each. +``` +$ podman kube play demo.yml --network net1\:ip=10.89.1.5 --network net2\:ip=10.89.10.10 +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` +Please take into account that networks must be created first using podman-network-create(1). + +Create and teardown from a URL pointing to a YAML file. +``` +$ podman kube play https://podman.io/demo.yml +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 + +$ podman kube play --down https://podman.io/demo.yml +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` +`podman kube play --down` does not work with a URL if the YAML file the URL points to +has been changed or altered. + + +[//]: # (BEGIN included file ../../kubernetes_support.md) +# Podman Kube Play Support + +This document outlines the kube yaml fields that are currently supported by the **podman kube play** command. + +Note: **N/A** means that the option cannot be supported in a single-node Podman environment. + +## Pod Fields + +| Field | Support | +|-----------------------------------------------------|---------| +| containers | ✅ | +| initContainers | ✅ | +| imagePullSecrets | no | +| enableServiceLinks | no | +| os\.name | no | +| volumes | ✅ | +| nodeSelector | N/A | +| nodeName | N/A | +| affinity\.nodeAffinity | N/A | +| affinity\.podAffinity | N/A | +| affinity\.podAntiAffinity | N/A | +| tolerations\.key | N/A | +| tolerations\.operator | N/A | +| tolerations\.effect | N/A | +| tolerations\.tolerationSeconds | N/A | +| schedulerName | N/A | +| runtimeClassName | no | +| priorityClassName | no | +| priority | no | +| topologySpreadConstraints\.maxSkew | N/A | +| topologySpreadConstraints\.topologyKey | N/A | +| topologySpreadConstraints\.whenUnsatisfiable | N/A | +| topologySpreadConstraints\.labelSelector | N/A | +| topologySpreadConstraints\.minDomains | N/A | +| restartPolicy | ✅ | +| terminationGracePeriodSeconds | ✅ | +| activeDeadlineSeconds | no | +| readinessGates\.conditionType | no | +| hostname | ✅ | +| setHostnameAsFQDN | no | +| subdomain | no | +| hostAliases\.hostnames | ✅ | +| hostAliases\.ip | ✅ | +| dnsConfig\.nameservers | ✅ | +| dnsConfig\.options\.name | ✅ | +| dnsConfig\.options\.value | ✅ | +| dnsConfig\.searches | ✅ | +| dnsPolicy | no | +| hostNetwork | ✅ | +| hostPID | ✅ | +| hostIPC | ✅ | +| shareProcessNamespace | ✅ | +| serviceAccountName | no | +| automountServiceAccountToken | no | +| securityContext\.runAsUser | ✅ | +| securityContext\.runAsNonRoot | no | +| securityContext\.runAsGroup | ✅ | +| securityContext\.supplementalGroups | ✅ | +| securityContext\.fsGroup | no | +| securityContext\.fsGroupChangePolicy | no | +| securityContext\.seccompProfile\.type | no | +| securityContext\.seccompProfile\.localhostProfile | no | +| securityContext\.seLinuxOptions\.level | ✅ | +| securityContext\.seLinuxOptions\.role | ✅ | +| securityContext\.seLinuxOptions\.type | ✅ | +| securityContext\.seLinuxOptions\.user | ✅ | +| securityContext\.sysctls\.name | ✅ | +| securityContext\.sysctls\.value | ✅ | +| securityContext\.windowsOptions\.gmsaCredentialSpec | no | +| securityContext\.windowsOptions\.hostProcess | no | +| securityContext\.windowsOptions\.runAsUserName | no | + +## Container Fields + +| Field | Support | +|-----------------------------------------------------|---------| +| name | ✅ | +| image | ✅ | +| imagePullPolicy | ✅ | +| command | ✅ | +| args | ✅ | +| workingDir | ✅ | +| ports\.containerPort | ✅ | +| ports\.hostIP | ✅ | +| ports\.hostPort | ✅ | +| ports\.name | ✅ | +| ports\.protocol | ✅ | +| env\.name | ✅ | +| env\.value | ✅ | +| env\.valueFrom\.configMapKeyRef\.key | ✅ | +| env\.valueFrom\.configMapKeyRef\.name | ✅ | +| env\.valueFrom\.configMapKeyRef\.optional | ✅ | +| env\.valueFrom\.fieldRef | ✅ | +| env\.valueFrom\.resourceFieldRef | ✅ | +| env\.valueFrom\.secretKeyRef\.key | ✅ | +| env\.valueFrom\.secretKeyRef\.name | ✅ | +| env\.valueFrom\.secretKeyRef\.optional | ✅ | +| envFrom\.configMapRef\.name | ✅ | +| envFrom\.configMapRef\.optional | ✅ | +| envFrom\.prefix | no | +| envFrom\.secretRef\.name | ✅ | +| envFrom\.secretRef\.optional | ✅ | +| volumeMounts\.mountPath | ✅ | +| volumeMounts\.name | ✅ | +| volumeMounts\.mountPropagation | no | +| volumeMounts\.readOnly | ✅ | +| volumeMounts\.subPath | ✅ | +| volumeMounts\.subPathExpr | no | +| volumeDevices\.devicePath | no | +| volumeDevices\.name | no | +| resources\.limits | ✅ | +| resources\.requests | ✅ | +| lifecycle\.postStart | no | +| lifecycle\.preStop | no | +| terminationMessagePath | no | +| terminationMessagePolicy | no | +| livenessProbe | ✅ | +| readinessProbe | no | +| startupProbe | no | +| securityContext\.runAsUser | ✅ | +| securityContext\.runAsNonRoot | no | +| securityContext\.runAsGroup | ✅ | +| securityContext\.readOnlyRootFilesystem | ✅ | +| securityContext\.procMount | ✅ | +| securityContext\.privileged | ✅ | +| securityContext\.allowPrivilegeEscalation | ✅ | +| securityContext\.capabilities\.add | ✅ | +| securityContext\.capabilities\.drop | ✅ | +| securityContext\.seccompProfile\.type | no | +| securityContext\.seccompProfile\.localhostProfile | no | +| securityContext\.seLinuxOptions\.level | ✅ | +| securityContext\.seLinuxOptions\.role | ✅ | +| securityContext\.seLinuxOptions\.type | ✅ | +| securityContext\.seLinuxOptions\.user | ✅ | +| securityContext\.windowsOptions\.gmsaCredentialSpec | no | +| securityContext\.windowsOptions\.hostProcess | no | +| securityContext\.windowsOptions\.runAsUserName | no | +| stdin | no | +| stdinOnce | no | +| tty | no | + +## PersistentVolumeClaim Fields + +| Field | Support | +|---------------------|---------| +| volumeName | no | +| storageClassName | ✅ | +| volumeMode | no | +| accessModes | ✅ | +| selector | no | +| resources\.limits | no | +| resources\.requests | ✅ | + +## ConfigMap Fields + +| Field | Support | +|------------|---------| +| binaryData | ✅ | +| data | ✅ | +| immutable | no | + +## Deployment Fields + +| Field | Support | +|-----------------------------------------|-------------------------------------------------------| +| replicas | ✅ (the actual replica count is ignored and set to 1) | +| selector | ✅ | +| template | ✅ | +| minReadySeconds | no | +| strategy\.type | no | +| strategy\.rollingUpdate\.maxSurge | no | +| strategy\.rollingUpdate\.maxUnavailable | no | +| revisionHistoryLimit | no | +| progressDeadlineSeconds | no | +| paused | no | + +## DaemonSet Fields + +| Field | Support | +|-----------------------------------------|---------| +| selector | ✅ | +| template | ✅ | +| minReadySeconds | no | +| strategy\.type | no | +| strategy\.rollingUpdate\.maxSurge | no | +| strategy\.rollingUpdate\.maxUnavailable | no | +| revisionHistoryLimit | no | + +## Job Fields + +| Field | Support | +|-------------------------|----------------------------------| +| activeDeadlineSeconds | no | +| selector | no (automatically set by k8s) | +| template | ✅ | +| backoffLimit | no | +| completionMode | no | +| completions | no (set to 1 with kube generate) | +| manualSelector | no | +| parallelism | no (set to 1 with kube generate) | +| podFailurePolicy | no | +| suspend | no | +| ttlSecondsAfterFinished | no | + +[//]: # (END included file ../../kubernetes_support.md) + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-kube(1)](podman-kube.1.md)**, **[podman-kube-down(1)](podman-kube-down.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)**, **[podman-build(1)](podman-build.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-kube.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-kube.1.md new file mode 100644 index 000000000..82d6572c1 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-kube.1.md @@ -0,0 +1,35 @@ +--- +title: podman-kube +version: v5.5.0 +--- + +% podman-kube 1 + +## NAME +podman\-kube - Play containers, pods or volumes based on a structured input file + +## SYNOPSIS +**podman kube** *subcommand* + +## DESCRIPTION +The kube command recreates containers, pods or volumes based on the input from a structured (like YAML) +file input. Containers are automatically started. + +Note: The kube commands in podman focus on simplifying the process of moving containers from podman to a Kubernetes +environment and from a Kubernetes environment back to podman. Podman is not replicating the kubectl CLI. Once containers +are deployed to a Kubernetes cluster from podman, please use `kubectl` to manage the workloads in the cluster. + +## COMMANDS + +| Command | Man Page | Description | +| ------- | ---------------------------------------------------- | ----------------------------------------------------------------------------- | +| apply | [podman-kube-apply(1)](podman-kube-apply.1.md) | Apply Kubernetes YAML based on containers, pods, or volumes to a Kubernetes cluster | +| down | [podman-kube-down(1)](podman-kube-down.1.md) | Remove containers and pods based on Kubernetes YAML. | +| generate | [podman-kube-generate(1)](podman-kube-generate.1.md) | Generate Kubernetes YAML based on containers, pods or volumes. | +| play | [podman-kube-play(1)](podman-kube-play.1.md) | Create containers, pods and volumes based on Kubernetes YAML. | + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-down(1)](podman-kube-down.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)**, **[podman-kube-apply(1)](podman-kube-apply.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-load.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-load.1.md new file mode 100644 index 000000000..67c05ae13 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-load.1.md @@ -0,0 +1,92 @@ +--- +title: podman-load +version: v5.5.0 +--- + +% podman-load 1 + +## NAME +podman\-load - Load image(s) from a tar archive into container storage + +## SYNOPSIS +**podman load** [*options*] + +**podman image load** [*options*] + +## DESCRIPTION +**podman load** loads an image from either an **oci-archive** or a **docker-archive** stored on the local machine into container storage. **podman load** reads from stdin by default or a file if the **input** option is set. +**podman load** is used for loading from the archive generated by **podman save**, that includes the image parent layers. To load the archive of container's filesystem created by **podman export**, use **podman import**. + +The local client further supports loading an **oci-dir** or a **docker-dir** as created with **podman save** (1). + +The **quiet** option suppresses the progress output when set. +Note: `:` is a restricted character and cannot be part of the file name. + + +**podman [GLOBAL OPTIONS]** + +**podman load [GLOBAL OPTIONS]** + +**podman load [OPTIONS]** + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--input**, **-i**=*input* + +Load the specified input file instead of from stdin. The file can be on the local file system or on a server (e.g., https://server.com/archive.tar). Also supports loading in compressed files. + +The remote client, including Mac and Windows (excluding WSL2) machines, requires the use of this option. + +NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of container images. Podman defaults to use `/var/tmp`. + +#### **--quiet**, **-q** + +Suppress the progress output + +## EXAMPLES + +Create an image from a compressed tar file, without showing progress. +``` +$ podman load --quiet -i fedora.tar.gz +``` + +Create an image from the archive.tar file pulled from a URL, without showing progress. +``` +$ podman load -q -i https://server.com/archive.tar +``` + +Create an image from stdin using bash redirection from a tar file. +``` +$ podman load < fedora.tar +Getting image source signatures +Copying blob sha256:5bef08742407efd622d243692b79ba0055383bbce12900324f75e56f589aedb0 + 0 B / 4.03 MB [---------------------------------------------------------------] +Copying config sha256:7328f6f8b41890597575cbaadc884e7386ae0acc53b747401ebce5cf0d624560 + 0 B / 1.48 KB [---------------------------------------------------------------] +Writing manifest to image destination +Storing signatures +Loaded image: registry.fedoraproject.org/fedora:latest +``` + +Create an image from stdin using a pipe. +``` +$ cat fedora.tar | podman load +Getting image source signatures +Copying blob sha256:5bef08742407efd622d243692b79ba0055383bbce12900324f75e56f589aedb0 + 0 B / 4.03 MB [---------------------------------------------------------------] +Copying config sha256:7328f6f8b41890597575cbaadc884e7386ae0acc53b747401ebce5cf0d624560 + 0 B / 1.48 KB [---------------------------------------------------------------] +Writing manifest to image destination +Storing signatures +Loaded image: registry.fedoraproject.org/fedora:latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-save(1)](podman-save.1.md)** + +## HISTORY +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-login.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-login.1.md new file mode 100644 index 000000000..7ae0c6bf0 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-login.1.md @@ -0,0 +1,188 @@ +--- +title: podman-login +version: v5.5.0 +--- + +% podman-login 1 + +## NAME +podman\-login - Log in to a container registry + +## SYNOPSIS +**podman login** [*options*] [*registry*] + +## DESCRIPTION +**podman login** logs into a specified registry server with the correct username +and password. If the registry is not specified, the first registry under [registries.search] +from registries.conf is used. **podman login** reads in the username and password from STDIN. +The username and password can also be set using the **username** and **password** flags. +The path of the authentication file can be specified by the user by setting the **authfile** +flag. The default path for reading and writing credentials is **${XDG\_RUNTIME\_DIR}/containers/auth.json**. +Podman uses existing credentials if the user does not pass in a username. +Podman first searches for the username and password in the **${XDG\_RUNTIME\_DIR}/containers/auth.json**, if they are not valid, +Podman then uses any existing credentials found in **$HOME/.docker/config.json**. +If those credentials are not present, Podman creates **${XDG\_RUNTIME\_DIR}/containers/auth.json** (if the file does not exist) and +then stores the username and password from STDIN as a base64 encoded string in it. +For more details about format and configurations of the auth.json file, see containers-auth.json(5) + +**podman [GLOBAL OPTIONS]** + +**podman login [GLOBAL OPTIONS]** + +**podman login [OPTIONS] [REGISTRY] [GLOBAL OPTIONS]** + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/compat-auth-file.md) +#### **--compat-auth-file**=*path* + +Instead of updating the default credentials file, update the one at *path*, and use a Docker-compatible format. + +[//]: # (END included file options/compat-auth-file.md) + +#### **--get-login** + +Return the logged-in user for the registry. Return error if no login is found. + +#### **--help**, **-h** + +Print usage statement + +#### **--password**, **-p**=*password* + +Password for registry + +#### **--password-stdin** + +Take the password from stdin + +#### **--secret**=*name* + +Read the password for the registry from the podman secret `name`. +If --username is not specified --username=`name` is used. + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +#### **--username**, **-u**=*username* + +Username for registry + +#### **--verbose**, **-v** + +print detailed information about credential store + +## EXAMPLES + +Add login credentials for specified registry to default authentication file; +note that unlike the `docker` default, the default credentials are under `$XDG_RUNTIME_DIR` +which is a subdirectory of `/run` (an emphemeral directory) and hence do not persist across reboot. + +``` +$ podman login quay.io +Username: umohnani +Password: +Login Succeeded! +``` + +To explicitly preserve credentials across reboot, you will need to specify +the default persistent path: + +``` +$ podman login --authfile ~/.config/containers/auth.json quay.io +Username: umohnani +Password: +Login Succeeded! +``` + +Add login credentials using specified username and password for local registry to default authentication file. +``` +$ podman login -u testuser -p testpassword localhost:5000 +Login Succeeded! +``` + +Add login credentials for alternate authfile path for the specified registry. +``` +$ podman login --authfile authdir/myauths.json quay.io +Username: umohnani +Password: +Login Succeeded! +``` + +Add login credentials using a Podman secret for the password. +``` +$ echo -n MySecret! | podman secret create secretname - +a0ad54df3c97cf89d5ca6193c +$ podman login --secret secretname -u testuser quay.io +Login Succeeded! +``` + +Add login credentials for user test with password test to localhost:5000 registry disabling tls verification requirement. +``` +$ podman login --tls-verify=false -u test -p test localhost:5000 +Login Succeeded! +``` + +Add login credentials for user foo with password bar to localhost:5000 registry using the certificate directory /etc/containers/certs.d. +``` +$ podman login --cert-dir /etc/containers/certs.d/ -u foo -p bar localhost:5000 +Login Succeeded! +``` + +Add login credentials for specified registries to default authentication file for given user with password information provided via stdin from a file on disk. +``` +$ podman login -u testuser --password-stdin < testpassword.txt docker.io +Login Succeeded! +``` + +Add login credentials for specified registry to default authentication file for given user with password information provided via stdin from a pipe. +``` +$ echo $testpassword | podman login -u testuser --password-stdin quay.io +Login Succeeded! +``` + +Add login credentials for specified registry to default authentication file in verbose mode. +``` +$ podman login quay.io --verbose +Username: myusername +Password: +Used: /run/user/1000/containers/auth.json +Login Succeeded! +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-logout(1)](podman-logout.1.md)**, **[containers-auth.json(5)](https://github.com/containers/image/blob/main/docs/containers-auth.json.5.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[podman-secret(1)](podman-secret.1.md)**, **[podman-secret-create(1)](podman-secret-create.1.md)** + +## HISTORY +August 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-logout.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-logout.1.md new file mode 100644 index 000000000..46000fc0a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-logout.1.md @@ -0,0 +1,77 @@ +--- +title: podman-logout +version: v5.5.0 +--- + +% podman-logout 1 + +## NAME +podman\-logout - Log out of a container registry + +## SYNOPSIS +**podman logout** [*options*] *registry* + +## DESCRIPTION +**podman logout** logs out of a specified registry server by deleting the cached credentials +stored in the **auth.json** file. If the registry is not specified, the first registry under [registries.search] +from registries.conf is used. The path of the authentication file can be overridden by the user by setting the **authfile** flag. +The default path used is **${XDG\_RUNTIME\_DIR}/containers/auth.json**. For more details about format and configurations of the auth,json file, see containers-auth.json(5) +All the cached credentials can be removed by setting the **all** flag. + +**podman [GLOBAL OPTIONS]** + +**podman logout [GLOBAL OPTIONS]** + +**podman logout [OPTIONS] REGISTRY [GLOBAL OPTIONS]** + +## OPTIONS + +#### **--all**, **-a** + +Remove the cached credentials for all registries in the auth file + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/compat-auth-file.md) +#### **--compat-auth-file**=*path* + +Instead of updating the default credentials file, update the one at *path*, and use a Docker-compatible format. + +[//]: # (END included file options/compat-auth-file.md) + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Remove login credentials for the docker.io registry from the authentication file: +``` +$ podman logout docker.io +``` + +Remove login credentials for the docker.io registry from the authdir/myauths.json file: +``` +$ podman logout --authfile authdir/myauths.json docker.io +``` + +Remove login credentials for all registries: +``` +$ podman logout --all +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-auth.json(5)](https://github.com/containers/image/blob/main/docs/containers-auth.json.5.md)** + +## HISTORY +August 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-logs.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-logs.1.md new file mode 100644 index 000000000..bfdfaac1c --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-logs.1.md @@ -0,0 +1,173 @@ +--- +title: podman-logs +version: v5.5.0 +--- + +% podman-logs 1 + +## NAME +podman\-logs - Display the logs of one or more containers + +## SYNOPSIS +**podman logs** [*options*] *container* [*container...*] + +**podman container logs** [*options*] *container* [*container...*] + +## DESCRIPTION +The podman logs command batch-retrieves whatever logs are present for one or more containers at the time of execution. +This does not guarantee execution order when combined with podman run (i.e. the run may not have generated +any logs at the time podman logs was executed). + +## OPTIONS + + +[//]: # (BEGIN included file options/color.md) +#### **--color** + +Output the containers with different colors in the log. + +[//]: # (END included file options/color.md) + + +[//]: # (BEGIN included file options/follow.md) +#### **--follow**, **-f** + +Follow log output. Default is false. + +Note: When following a container which is removed by `podman container rm` +or removed on exit (`podman run --rm ...`), there is a chance that the log +file is removed before `podman logs` reads the final content. + +[//]: # (END included file options/follow.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/names.md) +#### **--names**, **-n** + +Output the container names instead of the container IDs in the log. + +[//]: # (END included file options/names.md) + + +[//]: # (BEGIN included file options/since.md) +#### **--since**=*TIMESTAMP* + +Show logs since TIMESTAMP. The --since option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. + +[//]: # (END included file options/since.md) + + +[//]: # (BEGIN included file options/tail.md) +#### **--tail**=*LINES* + +Output the specified number of LINES at the end of the logs. LINES must be an integer. Defaults to -1, +which prints all lines + +[//]: # (END included file options/tail.md) + + +[//]: # (BEGIN included file options/timestamps.md) +#### **--timestamps**, **-t** + +Show timestamps in the log outputs. The default is false + +[//]: # (END included file options/timestamps.md) + + +[//]: # (BEGIN included file options/until.md) +#### **--until**=*TIMESTAMP* + +Show logs until TIMESTAMP. The --until option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. + +[//]: # (END included file options/until.md) + +## EXAMPLE + +To view a container's logs: +``` +podman logs -t b3f2436bdb978c1d33b1387afb5d7ba7e3243ed2ce908db431ac0069da86cb45 + +2017/08/07 10:16:21 Seeked /var/log/crio/pods/eb296bd56fab164d4d3cc46e5776b54414af3bf543d138746b25832c816b933b/c49f49788da14f776b7aa93fb97a2a71f9912f4e5a3e30397fca7dfe0ee0367b.log - &{Offset:0 Whence:0} +1:C 07 Aug 14:10:09.055 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo +1:C 07 Aug 14:10:09.055 # Redis version=4.0.1, bits=64, commit=00000000, modified=0, pid=1, just started +1:C 07 Aug 14:10:09.055 # Warning: no config file specified, using the default config. In order to specify a config file use redis-server /path/to/redis.conf +1:M 07 Aug 14:10:09.055 # You requested maxclients of 10000 requiring at least 10032 max file descriptors. +1:M 07 Aug 14:10:09.055 # Server can't set maximum open files to 10032 because of OS error: Operation not permitted. +1:M 07 Aug 14:10:09.055 # Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit. If you need higher maxclients increase 'ulimit -n'. +1:M 07 Aug 14:10:09.056 * Running mode=standalone, port=6379. +1:M 07 Aug 14:10:09.056 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. +1:M 07 Aug 14:10:09.056 # Server initialized +``` + +To view only the last two lines in container's log: +``` +podman logs --tail 2 b3f2436bdb97 + +# WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. +# Server initialized +``` + +To view all containers logs: +``` +podman logs -t --since 0 myserver + +1:M 07 Aug 14:10:09.055 # Server can't set maximum open files to 10032 because of OS error: Operation not permitted. +1:M 07 Aug 14:10:09.055 # Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit. If you need higher maxclients increase 'ulimit -n'. +1:M 07 Aug 14:10:09.056 * Running mode=standalone, port=6379. +1:M 07 Aug 14:10:09.056 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. +1:M 07 Aug 14:10:09.056 # Server initialized +``` + +To view a container's logs since a certain time: +``` +podman logs -t --since 2017-08-07T10:10:09.055837383-04:00 myserver + +1:M 07 Aug 14:10:09.055 # Server can't set maximum open files to 10032 because of OS error: Operation not permitted. +1:M 07 Aug 14:10:09.055 # Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit. If you need higher maxclients increase 'ulimit -n'. +1:M 07 Aug 14:10:09.056 * Running mode=standalone, port=6379. +1:M 07 Aug 14:10:09.056 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. +1:M 07 Aug 14:10:09.056 # Server initialized +``` + +To view a container's logs generated in the last 10 minutes: +``` +podman logs --since 10m myserver + +# Server can't set maximum open files to 10032 because of OS error: Operation not permitted. +# Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit, Increase 'ulimit -n' when higher maxclients are required. +``` + +To view a container's logs until 30 minutes ago: +``` +podman logs --until 30m myserver + +AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.0.2.100. Set the 'ServerName' directive globally to suppress this message +AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.0.2.100. Set the 'ServerName' directive globally to suppress this message +[Tue Jul 20 13:18:14.223727 2021] [mpm_event:notice] [pid 1:tid 140021067187328] AH00489: Apache/2.4.48 (Unix) configured -- resuming normal operations +[Tue Jul 20 13:18:14.223819 2021] [core:notice] [pid 1:tid 140021067187328] AH00094: Command line: 'httpd -D FOREGROUND' +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-rm(1)](podman-rm.1.md)** + +## HISTORY +February 2018, Updated by Brent Baude + +August 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-machine-cp.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-machine-cp.1.md new file mode 100644 index 000000000..9b52fb2a4 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-machine-cp.1.md @@ -0,0 +1,68 @@ +--- +title: podman-machine-cp +version: v5.5.0 +--- + +% podman-machine-cp 1 + +## NAME +podman\-machine\-cp - Securely copy contents between the host and the virtual machine + +## SYNOPSIS +**podman machine cp** [*options*] *src_path* *dest_path* + +## DESCRIPTION + +Use secure copy (scp) to copy files or directories between the virtual machine +and your host machine. + +`podman machine cp` does not support copying between two virtual machines, +which would require two machines running simultaneously. + +Additionally, `podman machine cp` will automatically do a recursive copy of +files and directories. + +## OPTIONS + +#### **--help** + +Print usage statement. + +#### **--quiet**, **-q** + +Suppress copy status output. + +## EXAMPLES +Copy a file from your host to the running Podman Machine. +``` +$ podman machine cp ~/configuration.txt podman-machine-default:~/configuration.txt +... +Copy Successful +``` + +Copy a file from the running Podman Machine to your host. +``` +$ podman machine cp podman-machine-default:~/logs/log.txt ~/logs/podman-machine-default.txt +... +Copy Successful +``` + +Copy a directory from your host to the running Podman Machine. +``` +$ podman machine cp ~/.config podman-machine-default:~/.config +... +Copy Successful +``` + +Copy a directory from the running Podman Machine to your host. +``` +$ podman machine cp podman-machine-default:~/.config ~/podman-machine-default.config +... +Copy Successful +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +February 2025, Originally compiled by Jake Correnti diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-machine-info.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-machine-info.1.md new file mode 100644 index 000000000..2fdb6c04b --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-machine-info.1.md @@ -0,0 +1,107 @@ +--- +title: podman-machine-info +version: v5.5.0 +--- + +% podman-machine-info 1 + +## NAME +podman\-machine\-info - Display machine host info + +## SYNOPSIS +**podman machine info** + +## DESCRIPTION + +Display information pertaining to the machine host. +Rootless only, as all `podman machine` commands can be only be used with rootless Podman. + +*Note*: The `DefaultMachine` field in the `Host` output does not suggest that +one can set a default podman machine via system connections. This value represents +the current active system connection associated with a podman machine. Regardless +of the default system connection, the default podman machine will always be +`podman-machine-default`. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change output format to "json" or a Go template. + +| **Placeholder** | **Description** | +| ------------------- | --------------------------------- | +| .Host ... | Host information for local machine| +| .Version ... | Version of the machine | + +#### **--help** + +Print usage statement. + +## EXAMPLES + +Display default Podman machine info. +``` +$ podman machine info +Host: + Arch: amd64 + CurrentMachine: "" + DefaultMachine: "" + EventsDir: /run/user/3267/podman + MachineConfigDir: /home/myusername/.config/containers/podman/machine/qemu + MachineImageDir: /home/myusername/.local/share/containers/podman/machine/qemu + MachineState: "" + NumberOfMachines: 0 + OS: linux + VMType: qemu +Version: + APIVersion: 4.4.0 + Built: 1677097848 + BuiltTime: Wed Feb 22 15:30:48 2023 + GitCommit: aa196c0d5c9abd5800edf9e27587c60343a26c2b-dirty + GoVersion: go1.20 + Os: linux + OsArch: linux/amd64 + Version: 4.4.0 +``` + +Display default Podman machine info formatted as json. +``` +$ podman machine info --format json +{ + "Host": { + "Arch": "amd64", + "CurrentMachine": "", + "DefaultMachine": "", + "EventsDir": "/run/user/3267/podman", + "MachineConfigDir": "/home/myusername/.config/containers/podman/machine/qemu", + "MachineImageDir": "/home/myusername/.local/share/containers/podman/machine/qemu", + "MachineState": "", + "NumberOfMachines": 0, + "OS": "linux", + "VMType": "qemu" + }, + "Version": { + "APIVersion": "4.4.0", + "Version": "4.4.0", + "GoVersion": "go1.20", + "GitCommit": "aa196c0d5c9abd5800edf9e27587c60343a26c2b-dirty", + "BuiltTime": "Wed Feb 22 15:30:48 2023", + "Built": 1677097848, + "OsArch": "linux/amd64", + "Os": "linux" + } +} +``` + +Display default Podman machine Host.Arch field. +``` +$ podman machine info --format "{{ .Host.Arch }}" +amd64 + +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +June 2022, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-machine-init.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-machine-init.1.md new file mode 100644 index 000000000..70521a067 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-machine-init.1.md @@ -0,0 +1,255 @@ +--- +title: podman-machine-init +version: v5.5.0 +--- + +% podman-machine-init 1 + +## NAME +podman\-machine\-init - Initialize a new virtual machine + +## SYNOPSIS +**podman machine init** [*options*] [*name*] + +## DESCRIPTION + +Initialize a new virtual machine for Podman. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then the new machine will be named `podman-machine-default`. + +Rootless only. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +**podman machine init** initializes a new Linux virtual machine where containers are run. +SSH keys are automatically generated to access the VM, and system connections to the root account +and a user account inside the VM are added. + +By default, the VM distribution is a custom [Fedora CoreOS](https://getfedora.org/en/coreos?stream=stable) +based image pushed to quay.io/podman/machine-os (build in https://github.com/containers/podman-machine-os). +WSL is an exception and is based on a custom Fedora image. + +To check if there is an upgrade available for your machine os, you can run the following command: + +``` +$ podman machine ssh 'sudo rpm-ostree upgrade --check' + +``` +If an update is available, you can rerun the above command and remove the `--check` and your operating system will +be updated. After updating, you must stop and start your machine with `podman machine stop && podman machine start` for +it to take effect. + +The above mechanism is only used to update patch (Z) versions of podman. For updates to new major and minor +version (X.Y) use the **[podman machine os apply](podman-machine-os-apply.1.md)** command, see the docs there for +more information. + +Note: Updating as described above can result in version mismatches between Podman on the host and Podman in the +machine. Executing `podman info` should reveal versions of both. A configuration where the Podman host and machine +mismatch are unsupported. + +To update the WSL image you must run dnf update inside, use the following command: +``` +$ podman machine ssh dnf update +``` + +Default Podman machine settings can be set via the [machine] section in the containers.conf(5) file. + +## OPTIONS + +#### **--cpus**=*number* + +Number of CPUs. + +#### **--disk-size**=*number* + +Size of the disk for the guest VM in GiB. + +#### **--help** + +Print usage statement. + +#### **--ignition-path** + +Fully qualified path of the ignition file. + +If an ignition file is provided, the file +is copied into the user's CONF_DIR and renamed. Additionally, no SSH keys are generated, nor are any system connections made. It is assumed that the user does these things manually or handled otherwise. + +#### **--image** + +Fully qualified registry, path, or URL to a VM image. +Registry target must be in the form of `docker://registry/repo/image:version`. + +Note: Only images provided by podman will be supported. + +#### **--memory**, **-m**=*number* + +Memory (in MiB). Note: 1024MiB = 1GiB. + +#### **--now** + +Start the virtual machine immediately after it has been initialized. + +#### **--playbook** + +Add the provided Ansible playbook to the machine and execute it after the first boot. + +Note: The playbook will be executed with the same privileges given to the user in the virtual machine. The playbook provided cannot include other files from the host system, as they will not be copied. +Use of the `--playbook` flag will require the image to include Ansible. The default image provided will have Ansible included. + +#### **--rootful** + +Whether this machine prefers rootful (`true`) or rootless (`false`) +container execution. This option determines the remote connection default +if there is no existing remote connection configurations. + +API forwarding, if available, follows this setting. + +#### **--timezone** + +Set the timezone for the machine and containers. Valid values are `local` or +a `timezone` such as `America/Chicago`. A value of `local`, which is the default, +means to use the timezone of the machine host. + +The timezone setting is not used with WSL. WSL automatically sets the timezone to the same +as the host Windows operating system. + +#### **--usb**=*bus=number,devnum=number* or *vendor=hexadecimal,product=hexadecimal* + +Assign a USB device from the host to the VM via USB passthrough. +Only supported for QEMU Machines. + +The device needs to have proper permissions in order to be passed to the machine. This +means the device needs to be under your user group. + +Note that using bus and device number are simpler but the values can change every boot +or when the device is unplugged. + +When specifying a USB using vendor and product ID's, if more than one device has the +same vendor and product ID, the first available device is assigned. + + +[//]: # (BEGIN included file options/user-mode-networking.md) +#### **--user-mode-networking** + +Indicates that this machine relays traffic from the guest through a user-space +process running on the host. In some VPN configurations the VPN may drop +traffic from alternate network interfaces, including VM network devices. By +enabling user-mode networking (a setting of `true`), VPNs observe all +podman machine traffic as coming from the host, bypassing the problem. + +When the qemu backend is used (Linux, Mac), user-mode networking is +mandatory and the only allowed value is `true`. In contrast, The Windows/WSL +backend defaults to `false`, and follows the standard WSL network setup. +Changing this setting to `true` on Windows/WSL informs Podman to replace +the WSL networking setup on start of this machine instance with a user-mode +networking distribution. Since WSL shares the same kernel across +distributions, all other running distributions reuses this network. +Likewise, when the last machine instance with a `true` setting stops, the +original networking setup is restored. + +[//]: # (END included file options/user-mode-networking.md) + +#### **--username** + +Username to use for executing commands in remote VM. Default value is `core` +for FCOS and `user` for Fedora (default on Windows hosts). Should match the one +used inside the resulting VM image. + +#### **--volume**, **-v**=*source:target[\\\:options]* + +Mounts a volume from source to target. + +Create a mount. If /host-dir:/machine-dir is specified as the `*source:target*`, +Podman mounts _host-dir_ in the host to _machine-dir_ in the Podman machine. + +Additional options may be specified as a comma-separated string. Recognized +options are: +* **ro**: mount volume read-only +* **rw**: mount volume read/write (default) +* **security_model=[model]**: specify 9p security model (see below) + +Note: The following destinations are forbidden for volumes: `/bin`, `/boot`, `/dev`, `/etc`, +`/home`, `/proc`, `/root`, `/run`, `/sbin`, `/sys`, `/tmp`, `/usr`, and `/var`. Subdirectories +of these destinations are allowed but users should be careful to not mount to important directories +as unexpected results may occur. + + +The 9p security model [determines] https://wiki.qemu.org/Documentation/9psetup#Starting_the_Guest_directly +if and how the 9p filesystem translates some filesystem operations before +actual storage on the host. + +In order to allow symlinks to work, on MacOS the default security model is + *none*. + +The value of *mapped-xattr* specifies that 9p store symlinks and some file +attributes as extended attributes on the host. This is suitable when the host +and the guest do not need to interoperate on the shared filesystem, but has +caveats for actual shared access; notably, symlinks on the host are not usable +on the guest and vice versa. If interoperability is required, then choose +*none* instead, but keep in mind that the guest is not able to do things +that the user running the virtual machine cannot do, e.g. create files owned by +another user. Using *none* is almost certainly the best choice for read-only +volumes. + +Example: `-v "$HOME/git:$HOME/git:ro,security_model=none"` + +Default volume mounts are defined in *containers.conf*. Unless changed, the default values +is `$HOME:$HOME`. + +**Note on Windows Subsystem for Linux (WSL)** +Since all drives are mounted at `/mnt` on startup by default in WSL, passing +`--volume` is redundant and has no effect. The host home directory for a `C:` +drive will be mounted at `/mnt/c/Users/`. + +## EXAMPLES + +Initialize the default Podman machine, pulling the content from the internet. +``` +$ podman machine init +``` + +Initialize a Podman machine for the specified name pulling the content from the internet. +``` +$ podman machine init myvm +``` + +Initialize the default Podman machine pulling the content from the internet defaulting to rootful mode. The default is rootless. +``` +$ podman machine init --rootful +``` + +Initialize the default Podman machine overriding its disk size override, pulling the content from the internet. +``` +$ podman machine init --disk-size 50 +``` + +Initialize the specified Podman machine overriding its memory size, pulling the content from the internet. +``` +$ podman machine init --memory=1024 myvm +``` + +Initialize the default Podman machine with the host directory `/Users` mounted into the VM at `/Users`. +``` +$ podman machine init -v /Users:/Users +``` + +Initialize the default Podman machine with a usb device passthrough specified with options. Only supported for QEMU Machines. +``` +$ podman machine init --usb vendor=13d3,product=5406 +``` + +Initialize the default Podman machine with a usb device passthrough with specified with options. Only supported for QEMU Machines. +``` +$ podman machine init --usb bus=1,devnum=3 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**, **containers.conf(5)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-machine-inspect.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-machine-inspect.1.md new file mode 100644 index 000000000..9e88dc54e --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-machine-inspect.1.md @@ -0,0 +1,60 @@ +--- +title: podman-machine-inspect +version: v5.5.0 +--- + +% podman-machine-inspect 1 + +## NAME +podman\-machine\-inspect - Inspect one or more virtual machines + +## SYNOPSIS +**podman machine inspect** [*options*] [*name*] ... + +## DESCRIPTION + +Inspect one or more virtual machines + +Obtain greater detail about Podman virtual machines. More than one virtual machine can be +inspected at once. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be inspected. + +Rootless only. + +## OPTIONS +#### **--format** + +Print results with a Go template. + +| **Placeholder** | **Description** | +| ------------------- | --------------------------------------------------------------------- | +| .ConfigDir ... | Machine configuration directory location | +| .ConnectionInfo ... | Machine connection information | +| .Created ... | Machine creation time (string, ISO3601) | +| .LastUp ... | Time when machine was last booted | +| .Name | Name of the machine | +| .Resources ... | Resources used by the machine | +| .Rootful | Whether the machine prefers rootful or rootless container execution | +| .Rosetta | Whether this machine uses Rosetta | +| .SSHConfig ... | SSH configuration info for communicating with machine | +| .State | Machine state | +| .UserModeNetworking | Whether this machine uses user-mode networking | + +#### **--help** + +Print usage statement. + +## EXAMPLES + +Inspect the specified Podman machine. +``` +$ podman machine inspect podman-machine-default +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +April 2022, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-machine-list.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-machine-list.1.md new file mode 100644 index 000000000..af99ff0b3 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-machine-list.1.md @@ -0,0 +1,117 @@ +--- +title: podman-machine-list +version: v5.5.0 +--- + +% podman-machine-list 1 + +## NAME +podman\-machine\-list - List virtual machines + +## SYNOPSIS +**podman machine list** [*options*] + +**podman machine ls** [*options*] + +## DESCRIPTION + +List Podman managed virtual machines. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +Rootless only. + +NOTE: The podman-machine configuration file is managed under the +`$XDG_CONFIG_HOME/containers/podman/machine/` directory. Changing the `$XDG_CONFIG_HOME` +environment variable while the machines are running can lead to unexpected behavior. +(see [podman(1)](podman.1.md)) + +## OPTIONS + +#### **--all-providers** + +Show machines from all providers + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------- | ----------------------------------------- | +| .CPUs | Number of CPUs | +| .Created | Time since VM creation | +| .Default | Is default machine | +| .DiskSize | Disk size of machine | +| .IdentityPath | Path to ssh identity file | +| .LastUp | Time since the VM was last run | +| .Memory | Allocated memory for machine | +| .Name | VM name | +| .Port | SSH Port to use to connect to VM | +| .RemoteUsername | VM Username for rootless Podman | +| .Running | Is machine running | +| .Stream | Stream name | +| .UserModeNetworking | Whether machine uses user-mode networking | +| .VMType | VM type | + +#### **--help** + +Print usage statement. + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Only print the name of the machine. This also implies no table heading +is printed. + +## EXAMPLES + +List all Podman machines. +``` +$ podman machine list +NAME VM TYPE CREATED LAST UP CPUS MEMORY DISK SIZE +podman-machine-default qemu 2 weeks ago 2 weeks ago 1 2.147GB 10.74GB +``` + +List all Podman machines using the specified table format. +``` +$ podman machine ls --format "table {{.Name}}\t{{.VMType}}\t{{.Created}}\t{{.LastUp}}" +NAME VM TYPE CREATED LAST UP +podman-machine-default qemu 2 weeks ago 2 weeks ago +``` + +List all Podman machines in json format. +``` +$ podman machine ls --format json +[ + { + "Name": "podman-machine-default", + "Default": false, + "Created": "2021-12-27T10:36:14.373347492-05:00", + "Running": false, + "LastUp": "2021-12-27T11:22:50.17333371-05:00", + "Stream": "default", + "VMType": "qemu", + "CPUs": 1, + "Memory": "2147483648", + "DiskSize": "10737418240" + } +] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-machine-os-apply.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-machine-os-apply.1.md new file mode 100644 index 000000000..f6d4be23b --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-machine-os-apply.1.md @@ -0,0 +1,70 @@ +--- +title: podman-machine-os-apply +version: v5.5.0 +--- + +% podman-machine-os-apply 1 + +## NAME +podman\-machine\-os\-apply - Apply an OCI image to a Podman Machine's OS + +## SYNOPSIS +**podman machine os apply** [*options*] *image* [vm] + +## DESCRIPTION + +Apply machine OS changes from an OCI image. + +VM's that use OS's that use rpm-ostreee have the capability to rebase itself from the content of an OCI image. +`podman machine image apply` takes an OCI image with container native ostree functionality and rebases itself on that image. + +By default, Podman machines on Mac, Linux, and Windows Hyper-V use a customized rpm-ostree based distribution (Fedora CoreOS). Machines based on Microsoft WSL use a +customized Fedora distribution and cannot be updated with this command. + +Note: WSL-based machines are upgradable by using the `podman machine ssh ` command followed by `sudo dnf update`. This can, however, result in unexpected results in +Podman client and server version differences. + +Podman machine images are stored as OCI images at `quay.io/podman/machine-os`. When applying an image using this +command, the fully qualified OCI reference name must be used including tag where the tag is the +version of Podman that is inside the VM. By default, Podman will attempt to pull only the statement +version as itself. + +For more information, see the [rpm-ostree documentation](https://coreos.github.io/rpm-ostree/container/). + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then the OS changes will be applied to `podman-machine-default`. + +## OPTIONS + +#### **--help** + +Print usage statement. + +#### **--restart** + +Restart VM after applying changes. + +## EXAMPLES + +Update the default Podman machine to the latest development version of the +bootable OCI image. + +Note: This may result in having a newer Podman version inside the machine +than the client. Unexpected results may occur. + +Update the default Podman machine to the most recent Podman 5.4 bootable +OCI image. +``` +$ podman machine os apply quay.io/podman/machine-os:5.4 +``` + +Update the specified Podman machine to latest Podman 5.3 bootable OCI image. +``` +$ podman machine os apply quay.io/podman/machine-os:5.3 mymachine +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**, **[podman-machine-os(1)](podman-machine-os.1.md)** + +## HISTORY +February 2023, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-machine-os.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-machine-os.1.md new file mode 100644 index 000000000..fbe6145ae --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-machine-os.1.md @@ -0,0 +1,27 @@ +--- +title: podman-machine-os +version: v5.5.0 +--- + +% podman-machine-os 1 + +## NAME +podman\-machine\-os - Manage a Podman virtual machine's OS + +## SYNOPSIS +**podman machine os** *subcommand* + +## DESCRIPTION +`podman machine os` is a set of subcommands that manage a Podman virtual machine's operating system. + +## SUBCOMMANDS + +| Command | Man Page | Description | +|---------|--------------------------------------------------------------|----------------------------------------------| +| apply | [podman-machine-os-apply(1)](podman-machine-os-apply.1.md) | Apply an OCI image to a Podman Machine's OS | + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**, **[podman-machine-os-apply(1)](podman-machine-os-apply.1.md)** + +## HISTORY +February 2023, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-machine-reset.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-machine-reset.1.md new file mode 100644 index 000000000..7e7e683ca --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-machine-reset.1.md @@ -0,0 +1,52 @@ +--- +title: podman-machine-reset +version: v5.5.0 +--- + +% podman-machine-reset 1 + +## NAME +podman\-machine\-reset - Reset Podman machines and environment + +## SYNOPSIS +**podman machine reset** [*options*] + +## DESCRIPTION + +Reset your Podman machine environment. This command stops any running machines +and then removes them. Configuration and data files are then removed. Data files +would include machine disk images and any previously pulled cache images. When +this command is run, all of your Podman machines will have been deleted. + +## OPTIONS + +#### **--force**, **-f** + +Reset without confirmation. + +#### **--help** + +Print usage statement. + + +## EXAMPLES + +``` +$ podman machine reset +Warning: this command will delete all existing podman machines +and all of the configuration and data directories for Podman machines + +The following machine(s) will be deleted: + +dev +podman-machine-default + +Are you sure you want to continue? [y/N] y +$ +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +Feb 2024, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-machine-rm.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-machine-rm.1.md new file mode 100644 index 000000000..3867379af --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-machine-rm.1.md @@ -0,0 +1,71 @@ +--- +title: podman-machine-rm +version: v5.5.0 +--- + +% podman-machine-rm 1 + +## NAME +podman\-machine\-rm - Remove a virtual machine + +## SYNOPSIS +**podman machine rm** [*options*] [*name*] + +## DESCRIPTION + +Remove a virtual machine and its related files. What is actually deleted +depends on the virtual machine type. For all virtual machines, the generated +podman system connections are deleted. The ignition files +generated for that VM are also removed as is its image file on the filesystem. + +Users get a display of what is deleted and are required to confirm unless the option `--force` +is used. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be removed. + +Rootless only. + +## OPTIONS + +#### **--force**, **-f** + +Stop and delete without confirmation. + +#### **--help** + +Print usage statement. + +#### **--save-ignition** + +Do not delete the generated ignition file. + +#### **--save-image** + +Do not delete the VM image. + +## EXAMPLES + +Remove the specified Podman machine. +``` +$ podman machine rm test1 + +The following files will be deleted: + +/home/user/.config/containers/podman/machine/qemu/test1.ign +/home/user/.local/share/containers/podman/machine/qemu/test1_fedora-coreos-33.20210315.1.0-qemu.x86_64.qcow2 +/home/user/.config/containers/podman/machine/qemu/test1.json + +Are you sure you want to continue? [y/N] y +``` + +Remove the specified Podman machine even if it is running. +``` +$ podman machine rm -f test1 +$ +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-machine-set.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-machine-set.1.md new file mode 100644 index 000000000..463062f36 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-machine-set.1.md @@ -0,0 +1,126 @@ +--- +title: podman-machine-set +version: v5.5.0 +--- + +% podman-machine-set 1 + +## NAME +podman\-machine\-set - Set a virtual machine setting + +## SYNOPSIS +**podman machine set** [*options*] [*name*] + +## DESCRIPTION + +Change a machine setting. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then the settings will be applied to `podman-machine-default`. + +Rootless only. + +Default Podman machine settings can be set via the [machine] section in the containers.conf(5) file. + +## OPTIONS + +#### **--cpus**=*number* + +Number of CPUs. +Only supported for QEMU machines. + +#### **--disk-size**=*number* + +Size of the disk for the guest VM in GB. +Can only be increased. Only supported for QEMU machines. + +#### **--help** + +Print usage statement. + +#### **--memory**, **-m**=*number* + +Memory (in MB). +Only supported for QEMU machines. + +#### **--rootful** + +Whether this machine prefers rootful (`true`) or rootless (`false`) +container execution. This option updates the current podman +remote connection default if it is currently pointing at the specified +machine name (or `podman-machine-default` if no name is specified). + +Unlike [**podman system connection default**](podman-system-connection-default.1.md) +this option makes the API socket, if available, forward to the rootful/rootless +socket in the VM. + +Note that changing this option means that all the existing containers/images/volumes, etc... +are no longer visible with the default connection/socket. This is because the root and rootless +users in the VM are completely separated and do not share any storage. The data however is not +lost and you can always change this option back or use the other connection to access it. + +#### **--usb**=*bus=number,devnum=number* or *vendor=hexadecimal,product=hexadecimal* or *""* + +Assign a USB device from the host to the VM. +Only supported for QEMU Machines. + +The device needs to be present when the VM starts. +The device needs to have proper permissions in order to be assign to podman machine. + +Use an empty string to remove all previously set USB devices. + +Note that using bus and device number are simpler but the values can change every boot or when the +device is unplugged. Using vendor and product might lead to collision in the case of multiple +devices with the same vendor product value, the first available device is assigned. + + +[//]: # (BEGIN included file options/user-mode-networking.md) +#### **--user-mode-networking** + +Indicates that this machine relays traffic from the guest through a user-space +process running on the host. In some VPN configurations the VPN may drop +traffic from alternate network interfaces, including VM network devices. By +enabling user-mode networking (a setting of `true`), VPNs observe all +podman machine traffic as coming from the host, bypassing the problem. + +When the qemu backend is used (Linux, Mac), user-mode networking is +mandatory and the only allowed value is `true`. In contrast, The Windows/WSL +backend defaults to `false`, and follows the standard WSL network setup. +Changing this setting to `true` on Windows/WSL informs Podman to replace +the WSL networking setup on start of this machine instance with a user-mode +networking distribution. Since WSL shares the same kernel across +distributions, all other running distributions reuses this network. +Likewise, when the last machine instance with a `true` setting stops, the +original networking setup is restored. + +[//]: # (END included file options/user-mode-networking.md) + +## EXAMPLES + +To switch the default Podman machine from rootless to rootful: + +``` +$ podman machine set --rootful +``` + +or more explicitly set with value true. + +``` +$ podman machine set --rootful=true +``` + +Switch the default Podman machine from rootful to rootless. +``` +$ podman machine set --rootful=false +``` + +Switch the specified Podman machine from rootless to rootful. +``` +$ podman machine set --rootful myvm +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**, **containers.conf(5)** + +## HISTORY +February 2022, Originally compiled by Jason Greene diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-machine-ssh.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-machine-ssh.1.md new file mode 100644 index 000000000..8810366f2 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-machine-ssh.1.md @@ -0,0 +1,91 @@ +--- +title: podman-machine-ssh +version: v5.5.0 +--- + +% podman-machine-ssh 1 + +## NAME +podman\-machine\-ssh - SSH into a virtual machine + +## SYNOPSIS +**podman machine ssh** [*options*] [*name*] [*command* [*arg* ...]] + +## DESCRIPTION + +SSH into a Podman-managed virtual machine and optionally execute a command +on the virtual machine. Unless using the default virtual machine, the +first argument must be the virtual machine name. The optional command to +execute can then follow. If no command is provided, an interactive session +with the virtual machine is established. + +The exit code from ssh command is forwarded to the podman machine ssh caller, see [Exit Codes](#Exit-Codes). + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be SSH'd into. + +Rootless only. + +## OPTIONS + +#### **--help** + +Print usage statement. + +#### **--username**=*name* + +Username to use when SSH-ing into the VM. + +## Exit Codes + +The exit code from `podman machine ssh` gives information about why the command failed. +When `podman machine ssh` commands exit with a non-zero code, +the exit codes follow the `chroot` standard, see below: + + **125** The error is with podman **_itself_** + + $ podman machine ssh --foo; echo $? + Error: unknown flag: --foo + 125 + + **126** Executing a _contained command_ and the _command_ cannot be invoked + + $ podman machine ssh /etc; echo $? + Error: fork/exec /etc: permission denied + 126 + + **127** Executing a _contained command_ and the _command_ cannot be found + + $ podman machine ssh foo; echo $? + Error: fork/exec /usr/bin/bogus: no such file or directory + 127 + + **Exit code** _contained command_ exit code + + $ podman machine ssh /bin/sh -c 'exit 3'; echo $? + 3 + +## EXAMPLES + +To get an interactive session with the default Podman machine: + +SSH into the default Podman machine. +``` +$ podman machine ssh +``` + +Run command inside the default Podman machine via ssh. +``` +$ podman machine ssh myvm +``` + +Run command inside the specified Podman machine via ssh. +``` +$ podman machine ssh myvm rpm -q podman +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-machine-start.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-machine-start.1.md new file mode 100644 index 000000000..d533993ef --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-machine-start.1.md @@ -0,0 +1,58 @@ +--- +title: podman-machine-start +version: v5.5.0 +--- + +% podman-machine-start 1 + +## NAME +podman\-machine\-start - Start a virtual machine + +## SYNOPSIS +**podman machine start** [*name*] + +## DESCRIPTION + +Starts a virtual machine for Podman. + +Rootless only. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be started. + +Only one Podman managed VM can be active at a time. If a VM is already running, +`podman machine start` returns an error. + +**podman machine start** starts a Linux virtual machine where containers are run. + +## OPTIONS + +#### **--help** + +Print usage statement. + +#### **--no-info** + +Suppress informational tips. + +#### **--quiet**, **-q** + +Suppress machine starting status output. + +## EXAMPLES + +Start the specified podman machine. +``` +$ podman machine start myvm +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-machine-stop.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-machine-stop.1.md new file mode 100644 index 000000000..e5b8dc6b9 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-machine-stop.1.md @@ -0,0 +1,47 @@ +--- +title: podman-machine-stop +version: v5.5.0 +--- + +% podman-machine-stop 1 + +## NAME +podman\-machine\-stop - Stop a virtual machine + +## SYNOPSIS +**podman machine stop** [*name*] + +## DESCRIPTION + +Stops a virtual machine. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be stopped. + +Rootless only. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +**podman machine stop** stops a Linux virtual machine where containers are run. + +## OPTIONS + +#### **--help** + +Print usage statement. + +## EXAMPLES + +Stop a podman machine named myvm. +``` +$ podman machine stop myvm +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-machine.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-machine.1.md new file mode 100644 index 000000000..e2f909e22 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-machine.1.md @@ -0,0 +1,56 @@ +--- +title: podman-machine +version: v5.5.0 +--- + +% podman-machine 1 + +## NAME +podman\-machine - Manage Podman's virtual machine + +## SYNOPSIS +**podman machine** *subcommand* + +## DESCRIPTION +`podman machine` is a set of subcommands that manage Podman's virtual machine. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +All `podman machine` commands are rootless only. + +NOTE: The podman-machine configuration file is managed under the +`$XDG_CONFIG_HOME/containers/podman/machine/` directory. Changing the `$XDG_CONFIG_HOME` +environment variable while the machines are running can lead to unexpected behavior. + +Podman machine behaviour can be modified via the [machine] section in the containers.conf(5) file. + +## SUBCOMMANDS + +| Command | Man Page | Description | +|---------|----------------------------------------------------------|-----------------------------------------------------------------| +| cp | [podman-machine-cp(1)](podman-machine-cp.1.md) | Securely copy contents between the host and the virtual machine | +| info | [podman-machine-info(1)](podman-machine-info.1.md) | Display machine host info | +| init | [podman-machine-init(1)](podman-machine-init.1.md) | Initialize a new virtual machine | +| inspect | [podman-machine-inspect(1)](podman-machine-inspect.1.md) | Inspect one or more virtual machines | +| list | [podman-machine-list(1)](podman-machine-list.1.md) | List virtual machines | +| os | [podman-machine-os(1)](podman-machine-os.1.md) | Manage a Podman virtual machine's OS | +| reset | [podman-machine-reset(1)](podman-machine-reset.1.md) | Reset Podman machines and environment | +| rm | [podman-machine-rm(1)](podman-machine-rm.1.md) | Remove a virtual machine | +| set | [podman-machine-set(1)](podman-machine-set.1.md) | Set a virtual machine setting | +| ssh | [podman-machine-ssh(1)](podman-machine-ssh.1.md) | SSH into a virtual machine | +| start | [podman-machine-start(1)](podman-machine-start.1.md) | Start a virtual machine | +| stop | [podman-machine-stop(1)](podman-machine-stop.1.md) | Stop a virtual machine | + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine-cp(1)](podman-machine-cp.1.md)**, **[podman-machine-info(1)](podman-machine-info.1.md)**, **[podman-machine-init(1)](podman-machine-init.1.md)**, **[podman-machine-list(1)](podman-machine-list.1.md)**, **[podman-machine-os(1)](podman-machine-os.1.md)**, **[podman-machine-rm(1)](podman-machine-rm.1.md)**, **[podman-machine-ssh(1)](podman-machine-ssh.1.md)**, **[podman-machine-start(1)](podman-machine-start.1.md)**, **[podman-machine-stop(1)](podman-machine-stop.1.md)**, **[podman-machine-inspect(1)](podman-machine-inspect.1.md)**, **[podman-machine-reset(1)](podman-machine-reset.1.md)**, **containers.conf(5)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-manifest-add.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-manifest-add.1.md new file mode 100644 index 000000000..4d1395211 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-manifest-add.1.md @@ -0,0 +1,235 @@ +--- +title: podman-manifest-add +version: v5.5.0 +--- + +% podman-manifest-add 1 + +## NAME +podman\-manifest\-add - Add an image or artifact to a manifest list or image index + +## SYNOPSIS +**podman manifest add** [*options*] *listnameorindexname* [*transport*]:*imagename* *imageorartifactname* [...] + +## DESCRIPTION + +Adds the specified image to the specified manifest list or image index, or +creates an artifact manifest and adds it to the specified image index. + +## RETURN VALUE + +The list image's ID. + +## OPTIONS + +#### **--all** + +If the image which is added to the list or index is itself a list or +index, add all of the contents to the local list. By default, only one image +from such a list or index is added to the list or index. Combining +*--all* with any of the other options described below is NOT recommended. + + +[//]: # (BEGIN included file options/annotation.manifest.md) +#### **--annotation**=*annotation=value* + +Set an annotation on the entry for the specified image or artifact. + +[//]: # (END included file options/annotation.manifest.md) + +#### **--arch**=*architecture* + +Override the architecture which the list or index records as a requirement for +the image. If *imageName* refers to a manifest list or image index, the +architecture information is retrieved from it. Otherwise, it is +retrieved from the image's configuration information. + +#### **--artifact** + +Create an artifact manifest and add it to the image index. Arguments after the +index name will be interpreted as file names rather than as image references. +In most scenarios, the **--artifact-type** option should also be specified. + +#### **--artifact-config**=*path* + +When creating an artifact manifest and adding it to the image index, use the +specified file's contents as the configuration blob in the artifact manifest. +In most scenarios, leaving the default value, which signifies an empty +configuration, unchanged, is the preferred option. + +#### **--artifact-config-type**=*type* + +When creating an artifact manifest and adding it to the image index, use the +specified MIME type as the `mediaType` associated with the configuration blob +in the artifact manifest. In most scenarios, leaving the default value, which +signifies either an empty configuration or the standard OCI configuration type, +unchanged, is the preferred option. + +#### **--artifact-exclude-titles** + +When creating an artifact manifest and adding it to the image index, do not +set "org.opencontainers.image.title" annotations equal to the file's basename +for each file added to the artifact manifest. Tools which retrieve artifacts +from a registry may use these values to choose names for files when saving +artifacts to disk, so this option is not recommended unless it is required +for interoperability with a particular registry. + +#### **--artifact-layer-type**=*type* + +When creating an artifact manifest and adding it to the image index, use the +specified MIME type as the `mediaType` associated with the files' contents. If +not specified, guesses based on either the files names or their contents will +be made and used, but the option should be specified if certainty is needed. + +#### **--artifact-subject**=*imageName* + +When creating an artifact manifest and adding it to the image index, set the +*subject* field in the artifact manifest to mark the artifact manifest as being +associated with the specified image in some way. An artifact manifest can only +be associated with, at most, one subject. + +#### **--artifact-type**=*type* + +When creating an artifact manifest, use the specified MIME type as the +manifest's `artifactType` value instead of the less informative default value. + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/features.md) +#### **--features**=*feature* + +Specify the features list which the list or index records as requirements for +the image. This option is rarely used. + +[//]: # (END included file options/features.md) + +#### **--os**=*OS* + +Override the OS which the list or index records as a requirement for the image. +If *imagename* refers to a manifest list or image index, the OS information +is retrieved from it. Otherwise, it is retrieved from the image's +configuration information. + + +[//]: # (BEGIN included file options/os-version.md) +#### **--os-version**=*version* + +Specify the OS version which the list or index records as a requirement for the +image. This option is rarely used. + +[//]: # (END included file options/os-version.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/variant.manifest.md) +#### **--variant** + +Specify the variant which the list or index records for the image. This option +is typically used to distinguish between multiple entries which share the same +architecture value, but which expect different versions of its instruction set. + +[//]: # (END included file options/variant.manifest.md) + +## Transport + + Multiple transports are supported: + + **docker://**_docker-reference_ _(default)_ + An image in a registry implementing the "Docker Registry HTTP API V2". By default, uses the authorization state in `$XDG_RUNTIME_DIR/containers/auth.json`, which is set using `(podman login)`. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using `(docker login)`. + + $ podman manifest add mylist\:v1.11 docker://quay.io/username/myimage + + **containers-storage:**_oci-reference_ + An image in _oci-reference_ format stored in the local container storage. _oci-reference_ must contain a tag. + + $ podman manifest add mylist\:v1.11 containers-storage\:quay.io/username/myimage + + **dir:**_path_ + An existing local directory _path_ storing the manifest, layer tarballs, and signatures as individual files. This + is a non-standardized format, primarily useful for debugging or noninvasive container inspection. + + $ podman manifest add dir:/tmp/myimage + + **docker-archive:**_path_[**:**_docker-reference_] + An image is stored in the `docker save` formatted file. _docker-reference_ is only used when creating such a + file, and it must not contain a digest. + + $ podman manifest add docker-archive:/tmp/myimage + + **docker-daemon:**_docker-reference_ + An image in _docker-reference_ format stored in the docker daemon internal storage. The _docker-reference_ can also be an image ID (docker-daemon\:algo\:digest). + + $ sudo podman manifest add docker-daemon\:docker.io/library/myimage:33 + + **oci-archive:**_path_**:**_tag_ + An image _tag_ in a directory compliant with "Open Container Image Layout Specification" at _path_. + + $ podman manifest add oci-archive:/tmp/myimage + +## EXAMPLE + +Add specified default image from source manifest list to destination manifest list: +``` +podman manifest add mylist:v1.11 docker://fedora +71c201d10fffdcac52968a000d85a0a016ca1c7d5473948000d3131c1773d965 +``` + +Add all images from source manifest list to destination manifest list: +``` +podman manifest add --all mylist:v1.11 docker://fedora +71c201d10fffdcac52968a000d85a0a016ca1c7d5473948000d3131c1773d965 +``` + +Add selected image matching arch and variant from source manifest list to destination manifest list: +``` +podman manifest add --arch arm64 --variant v8 mylist\:v1.11 docker://71c201d10fffdcac52968a000d85a0a016ca1c7d5473948000d3131c1773d965 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-manifest-annotate.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-manifest-annotate.1.md new file mode 100644 index 000000000..df14789c9 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-manifest-annotate.1.md @@ -0,0 +1,95 @@ +--- +title: podman-manifest-annotate +version: v5.5.0 +--- + +% podman-manifest-annotate 1 + +## NAME +podman\-manifest\-annotate - Add and update information about an image or artifact in a manifest list or image index + +## SYNOPSIS +**podman manifest annotate** [*options*] *listnameorindexname* *imagemanifestdigestorimageorartifactname* + +## DESCRIPTION + +Adds or updates information about an image or artifact included in a manifest list or image index. + +## OPTIONS + + +[//]: # (BEGIN included file options/annotation.manifest.md) +#### **--annotation**=*annotation=value* + +Set an annotation on the entry for the specified image or artifact. + +[//]: # (END included file options/annotation.manifest.md) +If **--index** is also specified, sets the annotation on the entire image index. + +#### **--arch**=*architecture* + +Override the architecture which the list or index records as a requirement for +the image. This is usually automatically retrieved from the image's +configuration information, so it is rarely necessary to use this option. + + +[//]: # (BEGIN included file options/features.md) +#### **--features**=*feature* + +Specify the features list which the list or index records as requirements for +the image. This option is rarely used. + +[//]: # (END included file options/features.md) + +#### **--index** + +Treats arguments to the **--annotation** option as annotation values to be set +on the image index itself rather than on an entry in the image index. Implied +for **--subject**. + +#### **--os**=*OS* + +Override the OS which the list or index records as a requirement for the image. +This is usually automatically retrieved from the image's configuration +information, so it is rarely necessary to use this option. + +#### **--os-features**=*feature* + +Specify the OS features list which the list or index records as requirements +for the image. This option is rarely used. + + +[//]: # (BEGIN included file options/os-version.md) +#### **--os-version**=*version* + +Specify the OS version which the list or index records as a requirement for the +image. This option is rarely used. + +[//]: # (END included file options/os-version.md) + +#### **--subject**=*imageName* + +Set the *subject* field in the image index to mark the image index as being +associated with the specified image in some way. An image index can only be +associated with, at most, one subject. + + +[//]: # (BEGIN included file options/variant.manifest.md) +#### **--variant** + +Specify the variant which the list or index records for the image. This option +is typically used to distinguish between multiple entries which share the same +architecture value, but which expect different versions of its instruction set. + +[//]: # (END included file options/variant.manifest.md) + +## EXAMPLE + +Update arch and variant information to specified manifest list for image: +``` +podman manifest annotate --arch arm64 --variant v8 mylist:v1.11 sha256:59eec8837a4d942cc19a52b8c09ea75121acc38114a2c68b98983ce9356b8610 +07ec8dc22b5dba3a33c60b68bce28bbd2b905e383fdb32a90708fa5eeac13a07: sha256:59eec8837a4d942cc19a52b8c09ea75121acc38114a2c68b98983ce9356b8610 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-manifest-create.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-manifest-create.1.md new file mode 100644 index 000000000..32ff9156b --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-manifest-create.1.md @@ -0,0 +1,79 @@ +--- +title: podman-manifest-create +version: v5.5.0 +--- + +% podman-manifest-create 1 + +## NAME +podman\-manifest\-create - Create a manifest list or image index + +## SYNOPSIS +**podman manifest create** [*options*] *listnameorindexname* [*imagename* ...] + +## DESCRIPTION + +Creates a new manifest list and stores it as an image in local storage using +the specified name. + +If additional images are specified, they are added to the newly-created list or +index. + +## OPTIONS + +#### **--all** + +If any of the images added to the new list or index are +themselves lists or indexes, add all of their contents. By default, only one +image from such a list is added to the newly-created list or index. + +#### **--amend**, **-a** + +If a manifest list named *listnameorindexname* already exists, modify the +preexisting list instead of exiting with an error. The contents of +*listnameorindexname* are not modified if no *imagename*s are given. + +#### **--annotation**=*value* + +Set an annotation on the newly-created image index. + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Create the specified manifest. +``` +podman manifest create mylist:v1.11 +9cfd24048d5fc80903f088f1531a21bff01172abe66effa8941a4c2308dc745f +``` + +Create the specified manifest manifest or modify it if it previously exist. +``` +podman manifest create --amend mylist:v1.11 +9cfd24048d5fc80903f088f1531a21bff01172abe66effa8941a4c2308dc745f +``` + +Create the named manifest including the specified image matching the current platform. +``` +podman manifest create mylist:v1.11 docker://fedora +5c2bc76bfb4ba6665a7973f7e1c05ee0536b4580637f27adc9fa5a4b2bc03cf1 +``` + +Create the named manifest including all images referred to with the specified image reference. +``` +podman manifest create --all mylist\:v1.11 docker://fedora +30330571e79c65288a4fca421d9aed29b0210d57294d9c2056743fdcf6e3967b +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-manifest-exists.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-manifest-exists.1.md new file mode 100644 index 000000000..a0a3e39b7 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-manifest-exists.1.md @@ -0,0 +1,47 @@ +--- +title: podman-manifest-exists +version: v5.5.0 +--- + +% podman-manifest-exists 1 + +## NAME +podman\-manifest\-exists - Check if the given manifest list exists in local storage + +## SYNOPSIS +**podman manifest exists** *manifest* + +## DESCRIPTION +**podman manifest exists** checks if a manifest list exists on local storage. +Podman returns an exit code of `0` when the manifest is found. A `1` is +returned otherwise. +An exit code of `125` indicates there was another issue. + + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement. + +## EXAMPLE + +Check if a manifest list called `list1` exists (the manifest list does actually exist): +``` +$ podman manifest exists list1 +$ echo $? +0 +``` + +Check if a manifest called `mylist` exists (the manifest list does not actually exist): +``` +$ podman manifest exists mylist +$ echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** + +## HISTORY +January 2021, Originally compiled by Paul Holzinger `` diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-manifest-inspect.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-manifest-inspect.1.md new file mode 100644 index 000000000..214329382 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-manifest-inspect.1.md @@ -0,0 +1,54 @@ +--- +title: podman-manifest-inspect +version: v5.5.0 +--- + +% podman-manifest-inspect 1 + +## NAME +podman\-manifest\-inspect - Display a manifest list or image index + +## SYNOPSIS +**podman manifest inspect** [*options*] *listnameorindexname* + +## DESCRIPTION + +Displays the manifest list or image index stored using the specified image name. +## RETURN VALUE + +A formatted JSON representation of the manifest list or image index. + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Inspect the manifest of mylist:v1.11. +``` +podman manifest inspect mylist\:v1.11 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-manifest-push.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-manifest-push.1.md new file mode 100644 index 000000000..987bb0973 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-manifest-push.1.md @@ -0,0 +1,173 @@ +--- +title: podman-manifest-push +version: v5.5.0 +--- + +% podman-manifest-push 1 + +## NAME +podman\-manifest\-push - Push a manifest list or image index to a registry + +## SYNOPSIS +**podman manifest push** [*options*] *listnameorindexname* [*destination*] + +## DESCRIPTION +Pushes a manifest list or image index to a registry. + +## RETURN VALUE +The list image's ID and the digest of the image's manifest. + +## OPTIONS + +#### **--add-compression**=*compression* + +Makes sure that requested compression variant for each platform is added to the manifest list keeping original instance +intact in the same manifest list. Supported values are (`gzip`, `zstd` and `zstd:chunked`). Following flag can be used +multiple times. + +Note that `--compression-format` controls the compression format of each instance in the manifest list. `--add-compression` +will add another variant for each instance in the list with the specified compressions. `--compression-format` gzip `--add-compression` +zstd will push a manifest list with each instance being compressed with gzip plus an additional variant of each instance +being compressed with zstd. + +#### **--all** + +Push the images mentioned in the manifest list or image index, in addition to +the list or index itself. (Default true) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/compression-format.md) +#### **--compression-format**=**gzip** | *zstd* | *zstd:chunked* + +Specifies the compression format to use. Supported values are: `gzip`, `zstd` and `zstd:chunked`. The default is `gzip` unless overridden in the containers.conf file. +`zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning in that case. + +[//]: # (END included file options/compression-format.md) + + +[//]: # (BEGIN included file options/compression-level.md) +#### **--compression-level**=*level* + +Specifies the compression level to use. The value is specific to the compression algorithm used, e.g. for zstd the accepted values are in the range 1-20 (inclusive) with a default of 3, while for gzip it is 1-9 (inclusive) and has a default of 5. + +[//]: # (END included file options/compression-level.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/digestfile.md) +#### **--digestfile**=*Digestfile* + +After copying the image, write the digest of the resulting image to the file. + +[//]: # (END included file options/digestfile.md) + + +[//]: # (BEGIN included file options/force-compression.md) +#### **--force-compression** + +If set, push uses the specified compression algorithm even if the destination contains a differently-compressed variant already. +Defaults to `true` if `--compression-format` is explicitly specified on the command-line, `false` otherwise. + +[//]: # (END included file options/force-compression.md) + +#### **--format**, **-f**=*format* + +Manifest list type (oci or v2s2) to use when pushing the list (default is oci). + +#### **--quiet**, **-q** + +When writing the manifest, suppress progress output + +#### **--remove-signatures** + +Don't copy signatures when pushing images. + +#### **--rm** + +Delete the manifest list or image index from local storage if pushing succeeds. + +#### **--sign-by**=*fingerprint* + +Sign the pushed images with a “simple signing” signature using the specified key. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-by-sigstore.md) +#### **--sign-by-sigstore**=*param-file* + +Add a sigstore signature based on further options specified in a container's sigstore signing parameter file *param-file*. +See containers-sigstore-signing-params.yaml(5) for details about the file format. + +[//]: # (END included file options/sign-by-sigstore.md) + +#### **--sign-by-sigstore-private-key**=*path* + +Sign the pushed images with a sigstore signature using a private key at the specified path. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-passphrase-file.md) +#### **--sign-passphrase-file**=*path* + +If signing the image (using either **--sign-by** or **--sign-by-sigstore-private-key**), read the passphrase to use from the specified path. + +[//]: # (END included file options/sign-passphrase-file.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## DESTINATION + + DESTINATION is the location the container image is pushed to. It supports all transports from `containers-transports(5)`. If no transport is specified, the `docker` (i.e., container registry) transport is used. For remote clients, including Mac and Windows (excluding WSL2) machines, `docker` is the only supported transport. + +## EXAMPLE + +Push manifest list to container registry: +``` +podman manifest push mylist:v1.11 docker://registry.example.org/mylist:v1.11 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-manifest-remove.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-manifest-remove.1.md new file mode 100644 index 000000000..196297392 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-manifest-remove.1.md @@ -0,0 +1,29 @@ +--- +title: podman-manifest-remove +version: v5.5.0 +--- + +% podman-manifest-remove 1 + +## NAME +podman\-manifest\-remove - Remove an item from a manifest list or image index + +## SYNOPSIS +**podman manifest remove** *listnameorindexname* *digest* + +## DESCRIPTION +Removes the item with the specified digest from the specified manifest list or image index. + +## RETURN VALUE +The list image's ID and the digest of the removed image's manifest. + +## EXAMPLE + +Remove specified digest from the manifest list: +``` +podman manifest remove mylist:v1.11 sha256:cb8a924afdf0229ef7515d9e5b3024e23b3eb03ddbba287f4a19c6ac90b8d221 +podman manifest remove e604eabaaee4858232761b4fef84e2316ed8f93e15eceafce845966ee3400036 sha256\:cb8a924afdf0229ef7515d9e5b3024e23b3eb03ddbba287f4a19c6ac90b8d221 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-manifest-rm.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-manifest-rm.1.md new file mode 100644 index 000000000..0bf3c28a0 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-manifest-rm.1.md @@ -0,0 +1,36 @@ +--- +title: podman-manifest-rm +version: v5.5.0 +--- + +% podman-manifest-rm 1 + +## NAME +podman\-manifest\-rm - Remove manifest list or image index from local storage + +## SYNOPSIS +**podman manifest rm** [*options*] *list-or-index* [...] + +## DESCRIPTION +Removes one or more locally stored manifest lists. + +## OPTIONS + +#### **--ignore**, **-i** + +If a specified manifest does not exist in the local storage, ignore it and do not throw an error. + +## EXAMPLE + +podman manifest rm `` + +podman manifest rm listid1 listid2 + +**storage.conf** (`/etc/containers/storage.conf`) + +storage.conf is the storage configuration file for all tools using containers/storage + +The storage configuration file specifies all of the available container storage options for tools using shared container storage. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-manifest.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-manifest.1.md new file mode 100644 index 000000000..027c40dc3 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-manifest.1.md @@ -0,0 +1,76 @@ +--- +title: podman-manifest +version: v5.5.0 +--- + +% podman-manifest 1 + +## NAME +podman\-manifest - Create and manipulate manifest lists and image indexes + +## SYNOPSIS +**podman manifest** *subcommand* + +## DESCRIPTION +The `podman manifest` command provides subcommands which can be used to: + + * Create a working Docker manifest list or OCI image index. + +## SUBCOMMANDS + +| Command | Man Page | Description | +| -------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------------------- | +| add | [podman-manifest-add(1)](podman-manifest-add.1.md) | Add an image or artifact to a manifest list or image index. | +| annotate | [podman-manifest-annotate(1)](podman-manifest-annotate.1.md) | Add and update information about an image or artifact in a manifest list or image index. | +| create | [podman-manifest-create(1)](podman-manifest-create.1.md) | Create a manifest list or image index. | +| exists | [podman-manifest-exists(1)](podman-manifest-exists.1.md) | Check if the given manifest list exists in local storage | +| inspect | [podman-manifest-inspect(1)](podman-manifest-inspect.1.md) | Display a manifest list or image index. | +| push | [podman-manifest-push(1)](podman-manifest-push.1.md) | Push a manifest list or image index to a registry. | +| remove | [podman-manifest-remove(1)](podman-manifest-remove.1.md) | Remove an item from a manifest list or image index. | +| rm | [podman-manifest-rm(1)](podman-manifest-rm.1.md) | Remove manifest list or image index from local storage. | + +## EXAMPLES + +### Building a multi-arch manifest list from a Containerfile + +Assuming the `Containerfile` uses `RUN` instructions, the host needs +a way to execute non-native binaries. Configuring this is beyond +the scope of this example. Building a multi-arch manifest list +`shazam` in parallel across 4-threads can be done like this: + + $ platarch=linux/amd64,linux/ppc64le,linux/arm64,linux/s390x + $ podman build --jobs=4 --platform=$platarch --manifest shazam . + +**Note:** The `--jobs` argument is optional. Do not use the `podman build` command's `--tag` (or `-t`) option when building a multi-arch manifest list. + +### Assembling a multi-arch manifest from separately built images + +Assuming `example.com/example/shazam:$arch` images are built separately +on other hosts and pushed to the `example.com` registry. They may +be combined into a manifest list, and pushed using a simple loop: + + $ REPO=example.com/example/shazam + $ podman manifest create $REPO:latest + $ for IMGTAG in amd64 s390x ppc64le arm64; do \ + podman manifest add $REPO:latest docker://$REPO\:IMGTAG; \ + done + $ podman manifest push --all $REPO\:latest + +**Note:** The `add` instruction argument order is `` then ``. +Also, the `--all` push option is required to ensure all contents are +pushed, not just the native platform/arch. + +### Removing and tagging a manifest list before pushing + +Special care is needed when removing and pushing manifest lists, as opposed +to the contents. You almost always want to use the `manifest rm` and +`manifest push --all` subcommands. For example, a rename and push can +be performed like this: + + $ podman tag localhost/shazam example.com/example/shazam + $ podman manifest rm localhost/shazam + $ podman manifest push --all example.com/example/shazam + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest-add(1)](podman-manifest-add.1.md)**, **[podman-manifest-annotate(1)](podman-manifest-annotate.1.md)**, **[podman-manifest-create(1)](podman-manifest-create.1.md)**, **[podman-manifest-inspect(1)](podman-manifest-inspect.1.md)**, **[podman-manifest-push(1)](podman-manifest-push.1.md)**, **[podman-manifest-remove(1)](podman-manifest-remove.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-mount.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-mount.1.md new file mode 100644 index 000000000..ac979f367 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-mount.1.md @@ -0,0 +1,86 @@ +--- +title: podman-mount +version: v5.5.0 +--- + +% podman-mount 1 + +## NAME +podman\-mount - Mount a working container's root filesystem + +## SYNOPSIS +**podman mount** [*options*] [*container* ...] + +**podman container mount** [*options*] [*container* ...] + +## DESCRIPTION +Mounts the specified containers' root file system in a location which can be +accessed from the host, and returns its location. + +Podman lists all of the currently mounted containers, including external containers, when the command is executed +without any arguments. External containers are containers in container/storage by tools other than Podman. +For example Buildah and CRI-O. + +Rootless mode only supports mounting VFS driver, unless Podman is run within the user namespace +via the `podman unshare` command. All other storage drivers fails to mount. + +## RETURN VALUE +The location of the mounted file system. On error an empty string and errno is +returned. + +## OPTIONS + +#### **--all**, **-a** + +Mount all podman containers. (External containers are not mounted) + +#### **--format**=*format* + +Print the mounted containers in specified format (json). + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--no-trunc** + +Do not truncate the output (default *false*). + +## EXAMPLE + +In rootful mode, Mount specified container. +``` +# podman mount c831414b10a3 +/var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +``` + +In rootless mode, container mounting only works from inside the user namespace. +``` +$ podman unshare +# podman mount affectionate_mcnulty +/home/dwalsh/.local/share/containers/storage/overlay/4218326b9a80619aef005ff95067f76687ad975ce101c176598fb416f6186906/merged +``` + +List the currently mounted containers: +``` +podman mount +c831414b10a3 /var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +a7060253093b /var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged +``` + +Mount multiple containers: +``` +podman mount c831414b10a3 a7060253093b +/var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +/var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-unmount(1)](podman-unmount.1.md)**, **[podman-unshare(1)](podman-unshare.1.md)**, **mount(8)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-network-connect.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-network-connect.1.md new file mode 100644 index 000000000..78c4964b4 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-network-connect.1.md @@ -0,0 +1,55 @@ +--- +title: podman-network-connect +version: v5.5.0 +--- + +% podman-network-connect 1 + +## NAME +podman\-network\-connect - Connect a container to a network + +## SYNOPSIS +**podman network connect** [*options*] network container + +## DESCRIPTION +Connects a container to a network. A container can be connected to a network by name or by ID. +Once connected, the container can communicate with other containers in the same network. + +## OPTIONS +#### **--alias**=*name* +Add network-scoped alias for the container. If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. Multiple *--alias* options may be specified as input. +NOTE: When using CNI, a container only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. + +#### **--ip**=*address* +Set a static ipv4 address for this container on this network. + +#### **--ip6**=*address* +Set a static ipv6 address for this container on this network. + +#### **--mac-address**=*address* +Set a static mac address for this container on this network. + +## EXAMPLE + +Connect specified container to a named network: +``` +podman network connect test web +``` + +Connect specified container to named network with two aliases: +``` +podman network connect --alias web1 --alias web2 test web +``` + +Connect specified container to named network with a static ip: +``` +podman network connect --ip 10.89.1.13 test web +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-network-disconnect(1)](podman-network-disconnect.1.md)** + +## HISTORY +November 2020, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-network-create.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-network-create.1.md new file mode 100644 index 000000000..8f5d24d40 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-network-create.1.md @@ -0,0 +1,220 @@ +--- +title: podman-network-create +version: v5.5.0 +--- + +% podman-network-create 1 + +## NAME +podman\-network-create - Create a Podman network + +## SYNOPSIS +**podman network create** [*options*] [*name*] + +## DESCRIPTION +Create a network configuration for use with Podman. By default, Podman creates a bridge connection. +A *Macvlan* connection can be created with the *-d macvlan* option. A parent device for macvlan or +ipvlan can be designated with the *-o parent=``* or *--network-interface=``* option. + +If no options are provided, Podman assigns a free subnet and name for the network. + +Upon completion of creating the network, Podman displays the name of the newly added network. + +## OPTIONS +#### **--disable-dns** + +Disables the DNS plugin for this network which if enabled, can perform container to container name +resolution. It is only supported with the `bridge` driver, for other drivers it is always disabled. + +#### **--dns**=*ip* + +Set network-scoped DNS resolver/nameserver for containers in this network. If not set, the host servers from `/etc/resolv.conf` is used. It can be overwritten on the container level with the `podman run/create --dns` option. This option can be specified multiple times to set more than one IP. + +#### **--driver**, **-d**=*driver* + +Driver to manage the network. Currently `bridge`, `macvlan` and `ipvlan` are supported. Defaults to `bridge`. +As rootless the `macvlan` and `ipvlan` driver have no access to the host network interfaces because rootless networking requires a separate network namespace. + +The netavark backend allows the use of so called *netavark plugins*, see the +[plugin-API.md](https://github.com/containers/netavark/blob/main/plugin-API.md) +documentation in netavark. The binary must be placed in a specified directory +so podman can discover it, this list is set in `netavark_plugin_dirs` in +**[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** +under the `[network]` section. + +The name of the plugin can then be used as driver to create a network for your plugin. +The list of all supported drivers and plugins can be seen with `podman info --format {{.Plugins.Network}}`. + +Note that the `macvlan` and `ipvlan` drivers do not support port forwarding. Support for port forwarding +with a plugin depends on the implementation of the plugin. + +#### **--gateway**=*ip* + +Define a gateway for the subnet. To provide a gateway address, a +*subnet* option is required. Can be specified multiple times. +The argument order of the **--subnet**, **--gateway** and **--ip-range** options must match. + +#### **--ignore** + +Ignore the create request if a network with the same name already exists instead of failing. +Note, trying to create a network with an existing name and different parameters does not change the configuration of the existing one. + +#### **--interface-name**=*name* + +This option maps the *network_interface* option in the network config, see **podman network inspect**. +Depending on the driver, this can have different effects; for `bridge`, it uses the bridge interface name. +For `macvlan` and `ipvlan`, it is the parent device on the host. It is the same as `--opt parent=...`. + +#### **--internal** + +Restrict external access of this network when using a `bridge` network. Note when using the CNI backend +DNS will be automatically disabled, see **--disable-dns**. + +When using the `macvlan` or `ipvlan` driver with this option no default route will be added to the container. +Because it bypasses the host network stack no additional restrictions can be set by podman and if a +privileged container is run it can set a default route themselves. If this is a concern then the +container connections should be blocked on your actual network gateway. + +Using the `bridge` driver with this option has the following effects: + - Global IP forwarding sysctls will not be changed in the host network namespace. + - IP forwarding is disabled on the bridge interface instead of setting up a firewall. + - No default route will be added to the container. + +In all cases, aardvark-dns will only resolve container names with this option enabled. +Other queries will be answered with `NXDOMAIN`. + +#### **--ip-range**=*range* + +Allocate container IP from a range. The range must be a either a complete subnet in CIDR notation or be in +the `-` syntax which allows for a more flexible range compared to the CIDR subnet. +The *ip-range* option must be used with a *subnet* option. Can be specified multiple times. +The argument order of the **--subnet**, **--gateway** and **--ip-range** options must match. + +#### **--ipam-driver**=*driver* + +Set the ipam driver (IP Address Management Driver) for the network. When unset podman chooses an +ipam driver automatically based on the network driver. + +Valid values are: + + - `dhcp`: IP addresses are assigned from a dhcp server on the network. When using the netavark backend + the `netavark-dhcp-proxy.socket` must be enabled in order to start the dhcp-proxy when a container is + started, for CNI use the `cni-dhcp.socket` unit instead. + - `host-local`: IP addresses are assigned locally. + - `none`: No ip addresses are assigned to the interfaces. + +View the driver in the **podman network inspect** output under the `ipam_options` field. + +#### **--ipv6** + +Enable IPv6 (Dual Stack) networking. If no subnets are given, it allocates an ipv4 and an ipv6 subnet. + +#### **--label**=*label* + +Set metadata for a network (e.g., --label mykey=value). + +#### **--opt**, **-o**=*option* + +Set driver specific options. + +All drivers accept the `mtu`, `metric`, `no_default_route` and options. + +- `mtu`: Sets the Maximum Transmission Unit (MTU) and takes an integer value. +- `metric` Sets the Route Metric for the default route created in every container joined to this network. Accepts a positive integer value. Can only be used with the Netavark network backend. +- `no_default_route`: If set to 1, Podman will not automatically add a default route to subnets. Routes can still be added +manually by creating a custom route using `--route`. + +Additionally the `bridge` driver supports the following options: + +- `vlan`: This option assign VLAN tag and enables vlan\_filtering. Defaults to none. +- `isolate`: This option isolates networks by blocking traffic between those that have this option enabled. +- `com.docker.network.bridge.name`: This option assigns the given name to the created Linux Bridge +- `com.docker.network.driver.mtu`: Sets the Maximum Transmission Unit (MTU) and takes an integer value. +- `vrf`: This option assigns a VRF to the bridge interface. It accepts the name of the VRF and defaults to none. Can only be used with the Netavark network backend. +- `mode`: This option sets the specified bridge mode on the interface. Defaults to `managed`. Supported values: + - `managed`: Podman creates and deletes the bridge and changes sysctls of it. It adds firewall rules to masquerade outgoing traffic, as well as setup port forwarding for incoming traffic using DNAT. + - `unmanaged`: Podman uses an existing bridge. It must exist by the time you want to start a container which uses the network. There will be no NAT or port forwarding, even if such options were passed while creating the container. + +The `macvlan` and `ipvlan` driver support the following options: + +- `parent`: The host device which is used for the macvlan interface. Defaults to the default route interface. +- `mode`: This option sets the specified ip/macvlan mode on the interface. + - Supported values for `macvlan` are `bridge`, `private`, `vepa`, `passthru`. Defaults to `bridge`. + - Supported values for `ipvlan` are `l2`, `l3`, `l3s`. Defaults to `l2`. + +Additionally the `macvlan` driver supports the `bclim` option: + +- `bclim`: Set the threshold for broadcast queueing. Must be a 32 bit integer. Setting this value to `-1` disables broadcast queueing altogether. + +#### **--route**=*route* + +A static route in the format `,,`. This route will be added to every container in this network. Only available with the netavark backend. It can be specified multiple times if more than one static route is desired. + +#### **--subnet**=*subnet* + +The subnet in CIDR notation. Can be specified multiple times to allocate more than one subnet for this network. +The argument order of the **--subnet**, **--gateway** and **--ip-range** options must match. +This is useful to set a static ipv4 and ipv6 subnet. + +## EXAMPLE + +Create a network with no options. +``` +$ podman network create +podman2 +``` + +Create a network named *newnet* that uses *192.5.0.0/16* for its subnet. +``` +$ podman network create --subnet 192.5.0.0/16 newnet +newnet +``` + +Create an IPv6 network named *newnetv6* with a subnet of *2001\:db8::/64*. +``` +$ podman network create --subnet 2001:db8::/64 --ipv6 newnetv6 +newnetv6 +``` + +Create a network named *newnet* that uses *192.168.33.0/24* and defines a gateway as *192.168.33.3*. +``` +$ podman network create --subnet 192.168.33.0/24 --gateway 192.168.33.3 newnet +newnet +``` + +Create a network that uses a *192.168.55.0/24* subnet and has an IP address range of *192.168.55.129 - 192.168.55.254*. +``` +$ podman network create --subnet 192.168.55.0/24 --ip-range 192.168.55.128/25 +podman5 +``` + +Create a network with a static ipv4 and ipv6 subnet and set a gateway. +``` +$ podman network create --subnet 192.168.55.0/24 --gateway 192.168.55.3 --subnet fd52:2a5a:747e:3acd::/64 --gateway fd52:2a5a:747e:3acd::10 +podman4 +``` + +Create a network with a static subnet and a static route. +``` +$ podman network create --subnet 192.168.33.0/24 --route 10.1.0.0/24,192.168.33.10 newnet +``` + +Create a network with a static subnet and a static route without a default +route. +``` +$ podman network create --subnet 192.168.33.0/24 --route 10.1.0.0/24,192.168.33.10 --opt no_default_route=1 newnet +``` + +Create a Macvlan based network using the host interface eth0. Macvlan networks can only be used as root. +``` +$ sudo podman network create -d macvlan -o parent=eth0 --subnet 192.5.0.0/16 newnet +newnet +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-network-ls(1)](podman-network-ls.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +## HISTORY +August 2021, Updated with the new network format by Paul Holzinger + +August 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-network-disconnect.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-network-disconnect.1.md new file mode 100644 index 000000000..328380fc8 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-network-disconnect.1.md @@ -0,0 +1,37 @@ +--- +title: podman-network-disconnect +version: v5.5.0 +--- + +% podman-network-disconnect 1 + +## NAME +podman\-network\-disconnect - Disconnect a container from a network + +## SYNOPSIS +**podman network disconnect** [*options*] network container + +## DESCRIPTION +Disconnects a container from a network. A container can be disconnected from a network by name or by ID. +If all networks are disconnected from the container, it behaves like a container created with `--network=none` +and it does not have network connectivity until a network is connected again. + + +## OPTIONS +#### **--force**, **-f** + +Force the container to disconnect from a network + +## EXAMPLE + +Disconnect container from specified network: +``` +podman network disconnect test web +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-connect(1)](podman-network-connect.1.md)** + +## HISTORY +November 2020, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-network-exists.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-network-exists.1.md new file mode 100644 index 000000000..3446aba07 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-network-exists.1.md @@ -0,0 +1,47 @@ +--- +title: podman-network-exists +version: v5.5.0 +--- + +% podman-network-exists 1 + +## NAME +podman\-network\-exists - Check if the given network exists + +## SYNOPSIS +**podman network exists** *network* + +## DESCRIPTION +**podman network exists** checks if a network exists. The **Name** or **ID** +of the network may be used as input. Podman returns an exit code +of `0` when the network is found. A `1` is returned otherwise. An exit code of +`125` indicates there was another issue. + + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLE + +Check if specified network exists (the network does actually exist): +``` +$ podman network exists net1 +$ echo $? +0 +``` + +Check if nonexistent network exists: +``` +$ podman network exists webbackend +$ echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)** + +## HISTORY +January 2021, Originally compiled by Paul Holzinger `` diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-network-inspect.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-network-inspect.1.md new file mode 100644 index 000000000..d9363a2a6 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-network-inspect.1.md @@ -0,0 +1,83 @@ +--- +title: podman-network-inspect +version: v5.5.0 +--- + +% podman-network-inspect 1 + +## NAME +podman\-network\-inspect - Display the network configuration for one or more networks + +## SYNOPSIS +**podman network inspect** [*options*] *network* [*network* ...] + +## DESCRIPTION +Display the (JSON format) network configuration. + +## OPTIONS +#### **--format**, **-f**=*format* + +Pretty-print networks to JSON or using a Go template. + +| **Placeholder** | **Description** | +|--------------------|-------------------------------------------| +| .Containers ... | Running containers on this network. | +| .Created ... | Timestamp when the network was created | +| .DNSEnabled | Network has dns enabled (boolean) | +| .Driver | Network driver | +| .ID | Network ID | +| .Internal | Network is internal (boolean) | +| .IPAMOptions ... | Network ipam options | +| .IPv6Enabled | Network has ipv6 subnet (boolean) | +| .Labels ... | Network labels | +| .Name | Network name | +| .Network ... | Nested Network type | +| .NetworkDNSServers | Array of DNS servers used in this network | +| .NetworkInterface | Name of the network interface on the host | +| .Options ... | Network options | +| .Routes | List of static routes for this network | +| .Subnets | List of subnets on this network | + +## EXAMPLE + +Inspect the default podman network. + +``` +$ podman network inspect podman +[ + { + "name": "podman", + "id": "2f259bab93aaaaa2542ba43ef33eb990d0999ee1b9924b557b7be53c0b7a1bb9", + "driver": "bridge", + "network_interface": "podman0", + "created": "2021-06-03T12:04:33.088567413+02:00", + "subnets": [ + { + "subnet": "10.88.0.0/16", + "gateway": "10.88.0.1" + } + ], + "ipv6_enabled": false, + "internal": false, + "dns_enabled": false, + "ipam_options": { + "driver": "host-local" + } + } +] +``` + +Show the subnet and gateway for a network. + +``` +$ podman network inspect podman --format "{{range .Subnets}}Subnet: {{.Subnet}} Gateway: {{.Gateway}}{{end}}" +Subnet: 10.88.0.0/16 Gateway: 10.88.0.1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-ls(1)](podman-network-ls.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)** + +## HISTORY +August 2021, Updated with the new network format by Paul Holzinger + +August 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-network-ls.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-network-ls.1.md new file mode 100644 index 000000000..b27232ada --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-network-ls.1.md @@ -0,0 +1,124 @@ +--- +title: podman-network-ls +version: v5.5.0 +--- + +% podman-network-ls 1 + +## NAME +podman\-network\-ls - Display a summary of networks + +## SYNOPSIS +**podman network ls** [*options*] + +## DESCRIPTION +Displays a list of existing podman networks. + +## OPTIONS +#### **--filter**, **-f**=*filter=value* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| **Filter** | **Description** | +| ---------- | ------------------------------------------------------------------------------------------------ | +| driver | Filter by driver type. | +| id | Filter by full or partial network ID. | +| label | Filter by network with (or without, in the case of label!=[...] is used) the specified labels. | +| name | Filter by network name (accepts `regex`). | +| until | Filter by networks created before given timestamp. | +| dangling | Filter by networks with no containers attached. | + + +The `driver` filter accepts values: `bridge`, `macvlan`, `ipvlan`. + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which shows images with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which shows images without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +The `dangling` *filter* accepts values `true` or `false`. + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|--------------------|-------------------------------------------| +| .Created ... | Timestamp when the network was created | +| .DNSEnabled | Network has dns enabled (boolean) | +| .Driver | Network driver | +| .ID | Network ID | +| .Internal | Network is internal (boolean) | +| .IPAMOptions ... | Network ipam options | +| .IPv6Enabled | Network has ipv6 subnet (boolean) | +| .Labels | Network labels | +| .Name | Network name | +| .NetworkDNSServers | Array of DNS servers used in this network | +| .NetworkInterface | Name of the network interface on the host | +| .Options ... | Network options | +| .Routes | List of static routes for this network | +| .Subnets | List of subnets on this network | + +#### **--no-trunc** + +Do not truncate the network ID. + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +The `quiet` option restricts the output to only the network names. + +## EXAMPLE + +Display networks: +``` +$ podman network ls +NETWORK ID NAME DRIVER +88a7120ee19d podman bridge +6dd508dbf8cd podman6 bridge +8e35c2cd3bf6 podman5 macvlan +``` + +Display only network names: +``` +$ podman network ls -q +podman +podman2 +outside +podman9 +``` + +Display name of network which support bridge plugin: +``` +$ podman network ls --filter driver=bridge --format {{.Name}} +podman +podman2 +podman9 +``` +List networks with their subnets: +``` +$ podman network ls --format "{{.Name}}: {{range .Subnets}}{{.Subnet}} {{end}}" +podman: 10.88.0.0/16 +podman3: 10.89.30.0/24 fde4:f86f:4aab\:e68f::/64 +macvlan: +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)** + +## HISTORY +August 2021, Updated with the new network format by Paul Holzinger + +August 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-network-prune.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-network-prune.1.md new file mode 100644 index 000000000..66028a4b9 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-network-prune.1.md @@ -0,0 +1,58 @@ +--- +title: podman-network-prune +version: v5.5.0 +--- + +% podman-network-prune 1 + +## NAME +podman\-network\-prune - Remove all unused networks + +## SYNOPSIS +**podman network prune** [*options*] + +## DESCRIPTION +Remove all unused networks. An unused network is defined by a network which +has no containers connected or configured to connect to it. It does not remove +the so-called default network which goes by the name of *podman*. + +## OPTIONS + +#### **--filter** + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------:|----------------------------------------------------------------------------------------------------| +| label | Only remove networks, with (or without, in the case of label!=[...] is used) the specified labels. | +| until | Only remove networks created before given timestamp. | + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes networks with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes networks without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not prompt for confirmation + +## EXAMPLE + +Prune networks: +``` +podman network prune +``` + +Prune all networks created not created in the last two hours: +``` +podman network prune --filter until=2h +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-rm(1)](podman-network-rm.1.md)** + +## HISTORY +February 2021, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-network-reload.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-network-reload.1.md new file mode 100644 index 000000000..e8119d726 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-network-reload.1.md @@ -0,0 +1,67 @@ +--- +title: podman-network-reload +version: v5.5.0 +--- + +% podman-network-reload 1 + +## NAME +podman\-network\-reload - Reload network configuration for containers + +## SYNOPSIS +**podman network reload** [*options*] [*container...*] + +## DESCRIPTION +Reload one or more container network configurations. + +Rootful Podman relies on iptables rules in order to provide network connectivity. If the iptables rules are deleted, +this happens for example with `firewall-cmd --reload`, the container loses network connectivity. This command restores +the network connectivity. + +## OPTIONS +#### **--all**, **-a** + +Reload network configuration of all containers. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Reload the network configuration after a firewall reload: +``` +# podman run -p 80:80 -d nginx +b1b538e8bc4078fc3ee1c95b666ebc7449b9a97bacd15bcbe464a29e1be59c1c +# curl 127.0.0.1 +works +# sudo firewall-cmd --reload +success +# curl 127.0.0.1 +hangs +# podman network reload b1b538e8bc40 +b1b538e8bc4078fc3ee1c95b666ebc7449b9a97bacd15bcbe464a29e1be59c1c +# curl 127.0.0.1 +works +``` + +Reload the network configuration for all containers: +``` +# podman network reload --all +b1b538e8bc4078fc3ee1c95b666ebc7449b9a97bacd15bcbe464a29e1be59c1c +fe7e8eca56f844ec33af10f0aa3b31b44a172776e3277b9550a623ed5d96e72b +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)** + +## HISTORY +December 2020, Originally compiled by Paul Holzinger diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-network-rm.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-network-rm.1.md new file mode 100644 index 000000000..29e925fba --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-network-rm.1.md @@ -0,0 +1,54 @@ +--- +title: podman-network-rm +version: v5.5.0 +--- + +% podman-network-rm 1 + +## NAME +podman\-network\-rm - Remove one or more networks + +## SYNOPSIS +**podman network rm** [*options*] [*network...*] + +## DESCRIPTION +Delete one or more Podman networks. + +## OPTIONS +#### **--force**, **-f** + +The `force` option removes all containers that use the named network. If the container is +running, the container is stopped and removed. + +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping the running containers that are using the specified network. The --force option must be specified to use the --time option. Use -1 for infinite wait. + +## EXAMPLE + +Delete specified network: +``` +# podman network rm podman9 +Deleted: podman9 +``` + +Delete specified network and all containers associated with the network: +``` +# podman network rm -f fred +Deleted: fred +``` + +## Exit Status + **0** All specified networks removed + + **1** One of the specified networks did not exist, and no other failures + + **2** The network is in use by a container or a Pod + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)** + +## HISTORY +August 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-network-update.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-network-update.1.md new file mode 100644 index 000000000..3dc9de0d1 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-network-update.1.md @@ -0,0 +1,41 @@ +--- +title: podman-network-update +version: v5.5.0 +--- + +% podman-network-update 1 + +## NAME +podman\-network\-update - Update an existing Podman network + +## SYNOPSIS +**podman network update** [*options*] *network* + +## DESCRIPTION +Allow changes to existing container networks. At present, only changes to the DNS servers in use by a network is supported. + +NOTE: Only supported with the netavark network backend. + + +## OPTIONS +#### **--dns-add** + +Accepts array of DNS resolvers and add it to the existing list of resolvers configured for a network. + +#### **--dns-drop** + +Accepts array of DNS resolvers and removes them from the existing list of resolvers configured for a network. + +## EXAMPLE + +Update a network: +``` +$ podman network update network1 --dns-add 8.8.8.8,1.1.1.1 +``` + +Update a network and add/remove dns servers: +``` +$ podman network update network1 --dns-drop 8.8.8.8 --dns-add 3.3.3.3 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-network-ls(1)](podman-network-ls.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-network.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-network.1.md new file mode 100644 index 000000000..d8d916b34 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-network.1.md @@ -0,0 +1,61 @@ +--- +title: podman-network +version: v5.5.0 +--- + +% podman-network 1 + +## NAME +podman\-network - Manage Podman networks + +## SYNOPSIS +**podman network** *subcommand* + +## DESCRIPTION +The network command manages networks for Podman. + +Podman supports two network backends [Netavark](https://github.com/containers/netavark) +and [CNI](https://www.cni.dev/). Netavark is the default network backend and was added in Podman version 4.0. +CNI is deprecated and will be removed in the next major Podman version 5.0, in preference of Netavark. +To configure the network backend use the `network_backend` key under the `[Network]` in +**[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**. +New systems use netavark by default, to check what backend is used run +`podman info --format {{.Host.NetworkBackend}}`. + +All network commands work for both backends but CNI and Netavark use different config files +so networks have to be created again after a backend change. + +## COMMANDS + +| Command | Man Page | Description | +| ---------- | -------------------------------------------------------------- | --------------------------------------------------------------- | +| connect | [podman-network-connect(1)](podman-network-connect.1.md) | Connect a container to a network | +| create | [podman-network-create(1)](podman-network-create.1.md) | Create a Podman network | +| disconnect | [podman-network-disconnect(1)](podman-network-disconnect.1.md) | Disconnect a container from a network | +| exists | [podman-network-exists(1)](podman-network-exists.1.md) | Check if the given network exists | +| inspect | [podman-network-inspect(1)](podman-network-inspect.1.md) | Display the network configuration for one or more networks | +| ls | [podman-network-ls(1)](podman-network-ls.1.md) | Display a summary of networks | +| prune | [podman-network-prune(1)](podman-network-prune.1.md) | Remove all unused networks | +| reload | [podman-network-reload(1)](podman-network-reload.1.md) | Reload network configuration for containers | +| rm | [podman-network-rm(1)](podman-network-rm.1.md) | Remove one or more networks | +| update | [podman-network-update(1)](podman-network-update.1.md) | Update an existing Podman network | + +## SUBNET NOTES +Podman requires specific default IPs and, thus, network subnets. The default values used by Podman can be modified in the **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** file. + +### Podman network +The default bridge network (called `podman`) uses 10.88.0.0/16 as a subnet. When Podman runs as root, the `podman` network is used as default. It is the same as adding the option `--network bridge` or `--network podman`. This subnet can be changed in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** under the [network] section. Set the `default_subnet` to any subnet that is free in the environment. The name of the default network can also be changed from `podman` to another name using the default network key. Note that this is only done when no containers are running. + +### Pasta +Pasta by default performs no Network Address Translation (NAT) and copies the IPs from your main interface into the container namespace. If pasta cannot find an interface with the default route, it will select an interface if there is only one interface with a valid route. If you do not have a default route and several interfaces have defined routes, pasta will be unable to figure out the correct interface and it will fail to start. To specify the interface, use `-i` option to pasta. A default set of pasta options can be set in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** under the `[network]` section with the `pasta_options` key. + +The default rootless networking tool can be selected in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** under the `[network]` section with `default_rootless_network_cmd`, which can be set to `pasta` (default) or `slirp4netns`. + +### Slirp4netns +Slirp4netns uses 10.0.2.0/24 for its default network. This can also be changed in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** but under the `[engine]` section. Use the `network_cmd_options` key and add `["cidr=X.X.X.X/24"]` as a value. Note that slirp4netns needs a network prefix size between 1 and 25. This option accepts an array, so more options can be added in a comma-separated string as described on the **[podman-network-create(1)](podman-network-create.1.md)** man page. To change the CIDR for just one container, specify it on the cli using the `--network` option like this: `--network slirp4netns\:cidr=192.168.1.0/24`. + +### Podman network create +When a new network is created with a `podman network create` command, and no subnet is given with the --subnet option, Podman starts picking a free subnet from 10.89.0.0/24 to 10.255.255.0/24. Use the `default_subnet_pools` option under the `[network]` section in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** to change the range and/or size that is assigned by default. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-pause.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-pause.1.md new file mode 100644 index 000000000..7d41dc8ba --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-pause.1.md @@ -0,0 +1,103 @@ +--- +title: podman-pause +version: v5.5.0 +--- + +% podman-pause 1 + +## NAME +podman\-pause - Pause one or more containers + +## SYNOPSIS +**podman pause** [*options*] [*container*...] + +**podman container pause** [*options*] [*container*...] + +## DESCRIPTION +Pauses all the processes in one or more containers. You may use container IDs or names as input. + +## OPTIONS + +#### **--all**, **-a** + +Pause all running containers. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and pause the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + +#### **--filter**, **-f**=*filter* + +Filter what containers pause. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Pause specified container: +``` +podman pause mywebserver +``` + +Pause container by partial container ID: +``` +podman pause 860a4b23 +``` + +Pause all **running** containers: +``` +podman pause --all +``` + +Pause container using ID specified in given files: +``` +podman pause --cidfile /home/user/cidfile-1 +podman pause --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +Pause the latest container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman pause --latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-unpause(1)](podman-unpause.1.md)** + +## HISTORY +September 2017, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-pod-clone.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-pod-clone.1.md new file mode 100644 index 000000000..101d8d1c2 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-pod-clone.1.md @@ -0,0 +1,796 @@ +--- +title: podman-pod-clone +version: v5.5.0 +--- + +% podman-pod-clone 1 + +## NAME +podman\-pod\-clone - Create a copy of an existing pod + +## SYNOPSIS +**podman pod clone** [*options*] *pod* *name* + +## DESCRIPTION +**podman pod clone** creates a copy of a pod, recreating the identical config for the pod and for all of its containers. Users can modify the pods new name and select pod details within the infra container + +## OPTIONS + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the pod is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + +#### **--cpus** + +Set a number of CPUs for the pod that overrides the original pods CPU limits. If none are specified, the original pod's Nano CPUs are used. + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + +If none are specified, the original pod's CPUset is used. + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/destroy.md) +#### **--destroy** + +Remove the original pod that we are cloning once used to mimic the configuration. + +[//]: # (END included file options/destroy.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the pod. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The pod only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: the pod implements devices by storing the initial configuration passed by the user and recreating the device on each container added to the pod. + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + + +[//]: # (BEGIN included file options/gidmap.pod.md) +#### **--gidmap**=*pod_gid\:host_gid\:amount* + +GID map for the user namespace. Using this flag runs all containers in the pod with user namespace enabled. +It conflicts with the **--userns** and **--subgidname** flags. + +[//]: # (END included file options/gidmap.pod.md) + + +[//]: # (BEGIN included file options/gpus.md) +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. + +[//]: # (END included file options/gpus.md) + +#### **--help**, **-h** + +Print usage statement. + + +[//]: # (BEGIN included file options/hostname.pod.md) +#### **--hostname**=*name* + +Set the pod's hostname inside all containers. + +The given hostname is also added to the `/etc/hosts` file using the container's +primary IP address (also see the **--add-host** option). + +[//]: # (END included file options/hostname.pod.md) + + +[//]: # (BEGIN included file options/infra-command.md) +#### **--infra-command**=*command* + +The command that is run to start the infra container. Default: "/pause". + +[//]: # (END included file options/infra-command.md) + + +[//]: # (BEGIN included file options/infra-conmon-pidfile.md) +#### **--infra-conmon-pidfile**=*file* + +Write the pid of the infra container's **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to manage Podman containers and pods. + +[//]: # (END included file options/infra-conmon-pidfile.md) + + +[//]: # (BEGIN included file options/infra-name.md) +#### **--infra-name**=*name* + +The name that is used for the pod's infra container. + +[//]: # (END included file options/infra-name.md) + + +[//]: # (BEGIN included file options/label.md) +#### **--label**, **-l**=*key=value* + +Add metadata to a pod. + +[//]: # (END included file options/label.md) + + +[//]: # (BEGIN included file options/label-file.md) +#### **--label-file**=*file* + +Read in a line-delimited file of labels. + +[//]: # (END included file options/label-file.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + +#### **--name**, **-n** + +Set a custom name for the cloned pod. The default if not specified is of the syntax: **\-clone** + + +[//]: # (BEGIN included file options/pid.pod.md) +#### **--pid**=*pid* + +Set the PID mode for the pod. The default is to create a private PID namespace for the pod. Requires the PID namespace to be shared via --share. + + host: use the host’s PID namespace for the pod + ns: join the specified PID namespace + private: create a new namespace for the pod (default) + +[//]: # (END included file options/pid.pod.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + +Default restart policy for all the containers in a pod. + + +[//]: # (BEGIN included file options/security-opt.md) +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the pod +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the pod + +- **label=user:**_USER_: Set the label user for the pod processes +- **label=role:**_ROLE_: Set the label role for the pod processes +- **label=type:**_TYPE_: Set the label process type for the pod processes +- **label=level:**_LEVEL_: Set the label level for the pod processes +- **label=filetype:**_TYPE_: Set the label file type for the pod files +- **label=disable**: Turn off label separation for the pod + +Note: Labeling can be disabled for all pods/containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the containers within the pod. + +- **no-new-privileges**: Disable container processes from gaining additional privileges through the `execve(2)` system call (e.g. via setuid or setgid bits, or via file capabilities). Programs that rely on setuid/setgid bits set on their executable to change user id or group id are no longer able to do so, and any file capabilities added to the executable (e.g. via `setcap`) are not added to the permitted capability set. For more details, see: https://docs.kernel.org/userspace-api/no_new_privs.html. + +- **seccomp=unconfined**: Turn off seccomp confinement for the pod. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. + +[//]: # (END included file options/security-opt.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the pod. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/shm-size-systemd.md) +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. + +[//]: # (END included file options/shm-size-systemd.md) + +#### **--start** + +When set to true, this flag starts the newly created pod after the +clone process has completed. All containers within the pod are started. + + +[//]: # (BEGIN included file options/subgidname.md) +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. + +[//]: # (END included file options/subgidname.md) + + +[//]: # (BEGIN included file options/subuidname.md) +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. + +[//]: # (END included file options/subuidname.md) + + +[//]: # (BEGIN included file options/sysctl.md) +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters for all containers in the pod. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: if the ipc namespace is not shared within the pod, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: if the network namespace is not shared within the pod, the above sysctls are not allowed. + +[//]: # (END included file options/sysctl.md) + + +[//]: # (BEGIN included file options/uidmap.pod.md) +#### **--uidmap**=*container_uid\:from_uid\:amount* + +Run all containers in the pod in a new user namespace using the supplied mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +[//]: # (END included file options/uidmap.pod.md) + + +[//]: # (BEGIN included file options/userns.pod.md) +#### **--userns**=*mode* + +Set the user namespace mode for all the containers in a pod. It defaults to the `PODMAN_USERNS` environment variable. An empty value ("") means user namespaces are disabled. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +----------|---------------|--------------------- +"" |$UID |0 (Default User account mapped to root user in container.) +host |$UID |0 (Default User account mapped to root user in container.) +keep-id |$UID |$UID (Map user account to same UID within container.) +auto |$UID | nil (Host User UID is not mapped into container.) +nomap |$UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + + - *auto[:*_OPTIONS,..._*]*: automatically create a namespace. It is possible to specify these options to `auto`: + + - *gidmapping=*_CONTAINER\_GID\:HOST\_GID\:SIZE_ to force a GID mapping to be present in the user namespace. + + - *size=*_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates the size for the user namespace. + + - *uidmapping=*_CONTAINER\_UID\:HOST\_UID\:SIZE_ to force a UID mapping to be present in the user namespace. + + - *host*: run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user (default). + + - *keep-id*: creates a user namespace where the current rootless user's UID\:GID are mapped to the same values in the container. This option is not allowed for containers created by the root user. + + - *nomap*: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +[//]: # (END included file options/userns.pod.md) + + +[//]: # (BEGIN included file options/uts.pod.md) +#### **--uts**=*mode* + +Set the UTS namespace mode for the pod. The following values are supported: + +- **host**: use the host's UTS namespace inside the pod. +- **private**: create a new namespace for the pod (default). +- **ns:[path]**: run the pod in the given existing UTS namespace. + +[//]: # (END included file options/uts.pod.md) + + +[//]: # (BEGIN included file options/volume.md) +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the pod is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +pod. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a pod is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the pod, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the pod. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a pod. Without a label, the security system +might prevent the processes running inside the pod from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the pod context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +pods share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label. Only the current pod can use a private +volume. + +Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any one of the containers. Relabeling walks +the file system under the volume and changes the label on each file; if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the pod. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually changed with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the pod. +For example if a user wanted to volume mount their entire home directory into a +pod, they need to disable SELinux separation. + + $ podman pod clone --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The pod processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the pod +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous pod executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the pod infra container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the pod or infra container +to work. + +Do not modify the source directory mounted into the pod with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the pod are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the pod +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +pod, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +pod. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the pod. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the pod. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless pod fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/volume.md) + + +[//]: # (BEGIN included file options/volumes-from.md) +#### **--volumes-from**=*CONTAINER[\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers and pods. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +pod. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a pod. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the pod context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target pod, then the volume hides +that data on the target. + +[//]: # (END included file options/volumes-from.md) + +## EXAMPLES + +Clone the specified pod to a new pod. +``` +# podman pod clone pod-name +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone the specified pod to a new pod with a new name. +``` +# podman pod clone pod-name --name=cloned-pod +d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone and remove the specified pod to a new pod, modifying its cpus. +``` +# podman pod clone --destroy --cpus=5 d0cf1 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone the specified pod to a new named pod. +``` +# podman pod clone 2d4d4fca7219b4437e0d74fcdc272c4f031426a6eacd207372691207079551de new_name +5a9b7851013d326aa4ac4565726765901b3ecc01fcbc0f237bc7fd95588a24f9 +``` +## SEE ALSO +**[podman-pod-create(1)](podman-pod-create.1.md)** + +## HISTORY +May 2022, Originally written by Charlie Doern + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a core value of open source. The `master` and `slave` mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately. diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-pod-create.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-pod-create.1.md new file mode 100644 index 000000000..57eab2d26 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-pod-create.1.md @@ -0,0 +1,1139 @@ +--- +title: podman-pod-create +version: v5.5.0 +--- + +% podman-pod-create 1 + +## NAME +podman\-pod\-create - Create a new pod + +## SYNOPSIS +**podman pod create** [*options*] [*name*] + +## DESCRIPTION + +Creates an empty pod, or unit of multiple containers, and prepares it to have +containers added to it. The pod can be created with a specific name. If a name +is not given a random name is generated. The pod ID is printed to STDOUT. You +can then use **podman create --pod `` ...** to add containers +to the pod, and **podman pod start ``** to start the pod. + +The operator can identify a pod in three ways: +UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”) +UUID short identifier (“f78375b1c487”) +Name (“jonah”) + +podman generates a UUID for each pod, and if a name is not assigned +to the container with **--name** then a random string name is generated +for it. This name is useful to identify a pod. + +Note: resource limit related flags work by setting the limits explicitly in the pod's cgroup parent +for all containers joining the pod. A container can override the resource limits when joining a pod. +For example, if a pod was created via **podman pod create --cpus=5**, specifying **podman container create --pod=`` --cpus=4** causes the container to use the smaller limit. Also, containers which specify their own cgroup, such as **--cgroupns=host**, do NOT get the assigned pod level cgroup resources. + +## OPTIONS + + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the pod's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + +The /etc/hosts file is shared between all containers in the pod. + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the pod is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + +#### **--cpus**=*amount* + +Set the total number of CPUs delegated to the pod. Default is 0.000 which indicates that there is no limit on computation power. + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the pod. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The pod only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: the pod implements devices by storing the initial configuration passed by the user and recreating the device on each container added to the pod. + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + +#### **--dns**=*ipaddr* + +Set custom DNS servers in the /etc/resolv.conf file that is shared between all containers in the pod. A special option, "none" is allowed which disables creation of /etc/resolv.conf for the pod. + +#### **--dns-option**=*option* + +Set custom DNS options in the /etc/resolv.conf file that is shared between all containers in the pod. + +#### **--dns-search**=*domain* + +Set custom DNS search domains in the /etc/resolv.conf file that is shared between all containers in the pod. + +#### **--exit-policy**=**continue** | *stop* + +Set the exit policy of the pod when the last container exits. Supported policies are: + +| Exit Policy | Description | +| ------------------ | -------------------------------------------------------------------------------------------------------------------------- | +| *continue* | The pod continues running, by keeping its infra container alive, when the last container exits. Used by default. | +| *stop* | The pod (including its infra container) is stopped when the last container exits. Used in `kube play`. | + + +[//]: # (BEGIN included file options/gidmap.pod.md) +#### **--gidmap**=*pod_gid\:host_gid\:amount* + +GID map for the user namespace. Using this flag runs all containers in the pod with user namespace enabled. +It conflicts with the **--userns** and **--subgidname** flags. + +[//]: # (END included file options/gidmap.pod.md) + + +[//]: # (BEGIN included file options/gpus.md) +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. + +[//]: # (END included file options/gpus.md) + +#### **--help**, **-h** + +Print usage statement. + + +[//]: # (BEGIN included file options/hostname.pod.md) +#### **--hostname**=*name* + +Set the pod's hostname inside all containers. + +The given hostname is also added to the `/etc/hosts` file using the container's +primary IP address (also see the **--add-host** option). + +[//]: # (END included file options/hostname.pod.md) + + +[//]: # (BEGIN included file options/hosts-file.md) +#### **--hosts-file**=*path* | *none* | *image* + +Base file to create the `/etc/hosts` file inside the container. This must either +be an absolute path to a file on the host system, or one of the following +special flags: + "" Follow the `base_hosts_file` configuration in _containers.conf_ (the default) + `none` Do not use a base file (i.e. start with an empty file) + `image` Use the container image's `/etc/hosts` file as base file + +[//]: # (END included file options/hosts-file.md) + +#### **--infra** + +Create an infra container and associate it with the pod. An infra container is a lightweight container used to coordinate the shared kernel namespace of a pod. Default: true. + + +[//]: # (BEGIN included file options/infra-command.md) +#### **--infra-command**=*command* + +The command that is run to start the infra container. Default: "/pause". + +[//]: # (END included file options/infra-command.md) + + +[//]: # (BEGIN included file options/infra-conmon-pidfile.md) +#### **--infra-conmon-pidfile**=*file* + +Write the pid of the infra container's **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to manage Podman containers and pods. + +[//]: # (END included file options/infra-conmon-pidfile.md) + +#### **--infra-image**=*image* + +The custom image that is used for the infra container. Unless specified, Podman builds a custom local image which does not require pulling down an image. + + +[//]: # (BEGIN included file options/infra-name.md) +#### **--infra-name**=*name* + +The name that is used for the pod's infra container. + +[//]: # (END included file options/infra-name.md) + + +[//]: # (BEGIN included file options/ip.md) +#### **--ip**=*ipv4* + +Specify a static IPv4 address for the pod, for example **10.88.64.128**. +This option can only be used if the pod is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the pod is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IP address pool (default **10.88.0.0/16**). + +To specify multiple static IP addresses per pod, set multiple networks using the **--network** option with a static IP address specified for each using the `ip` mode for that option. + +[//]: # (END included file options/ip.md) + + +[//]: # (BEGIN included file options/ip6.md) +#### **--ip6**=*ipv6* + +Specify a static IPv6 address for the pod, for example **fd46\:db93\:aa76\:ac37::10**. +This option can only be used if the pod is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the pod is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IPv6 address pool. + +To specify multiple static IPv6 addresses per pod, set multiple networks using the **--network** option with a static IPv6 address specified for each using the `ip6` mode for that option. + +[//]: # (END included file options/ip6.md) + + +[//]: # (BEGIN included file options/label.md) +#### **--label**, **-l**=*key=value* + +Add metadata to a pod. + +[//]: # (END included file options/label.md) + + +[//]: # (BEGIN included file options/label-file.md) +#### **--label-file**=*file* + +Read in a line-delimited file of labels. + +[//]: # (END included file options/label-file.md) + + +[//]: # (BEGIN included file options/mac-address.md) +#### **--mac-address**=*address* + +Pod network interface MAC address (e.g. 92\:d0\:c6:0a:29:33) +This option can only be used if the pod is joined to only a single network - i.e., **--network=_network-name_** is used at most once - +and if the pod is not joining another container's network namespace via **--network=container\:_id_**. + +Remember that the MAC address in an Ethernet network must be unique. +The IPv6 link-local address is based on the device's MAC address +according to RFC4862. + +To specify multiple static MAC addresses per pod, set multiple networks using the **--network** option with a static MAC address specified for each using the `mac` mode for that option. + +[//]: # (END included file options/mac-address.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + +#### **--name**, **-n**=*name* + +Assign a name to the pod. + + +[//]: # (BEGIN included file options/network.md) +#### **--network**=*mode*, **--net** + +Set the network mode for the pod. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + For better integration with DNS handling, **--dns-forward 169.254.1.1** is passed, + and this address is added to resolv.conf(5) as first resolver. It is possible to pass + **--dns-forward** explicitly in case a different IP address should be used. + To make the `host.containers.internal` /etc/hosts entry work and allow connections + to the host, **--map-guest-addr 169.254.1.2** is passed. Again, it can be set + explicitly to choose a different IP address. \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured (via Podman's + **--publish** or by passing the pasta **-t**/**-u** options directly), + to disable automatic port forwarding based on bound ports. Similarly, **-T none** + and **-U none** are given to disable the same functionality from container to + host. \ + All options can also be set in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**; + see the `pasta_options` key under the network section in that file. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.md) + +Invalid if using **--dns**, **--dns-option**, or **--dns-search** with **--network** set to **none** or **container:**_id_. + + +[//]: # (BEGIN included file options/network-alias.md) +#### **--network-alias**=*alias* + +Add a network-scoped alias for the pod, setting the alias for all networks that the container joins. To set a +name only for a specific network, use the alias option as described under the **--network** option. +If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. This option can be specified multiple times. +NOTE: When using CNI a pod only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. + +[//]: # (END included file options/network-alias.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the pod. + +Podman assumes control over the pod's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/pid.pod.md) +#### **--pid**=*pid* + +Set the PID mode for the pod. The default is to create a private PID namespace for the pod. Requires the PID namespace to be shared via --share. + + host: use the host’s PID namespace for the pod + ns: join the specified PID namespace + private: create a new namespace for the pod (default) + +[//]: # (END included file options/pid.pod.md) + +#### **--pod-id-file**=*path* + +Write the pod ID to the file. + + +[//]: # (BEGIN included file options/publish.md) +#### **--publish**, **-p**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Publish a container's port, or range of ports, within this pod to the host. + +Both *hostPort* and *containerPort* can be specified as a range of ports. +When specifying ranges for both, the number of container ports in the +range must match the number of host ports in the range. + +If host IP is set to 0.0.0.0 or not set at all, the port is bound on all IPs on the host. + +By default, Podman publishes TCP ports. To publish a UDP port instead, give +`udp` as protocol. To publish both TCP and UDP ports, set `--publish` twice, +with `tcp`, and `udp` as protocols respectively. Rootful containers can also +publish ports using the `sctp` protocol. + +Host port does not have to be specified (e.g. `podman run -p 127.0.0.1::80`). +If it is not, the container port is randomly assigned a port on the host. + +Use **podman port** to see the actual mapping: `podman port $CONTAINER $CONTAINERPORT`. + +Note that the network drivers `macvlan` and `ipvlan` do not support port forwarding, +therefore this option will have no effect on such networks. + +[//]: # (END included file options/publish.md) + +**Note:** You must not publish ports of containers in the pod individually, +but only by the pod itself. + +**Note:** This cannot be modified once the pod is created. + + +[//]: # (BEGIN included file options/replace.md) +#### **--replace** + +If another pod with the same name already exists, replace and remove it. The default is **false**. + +[//]: # (END included file options/replace.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + +Default restart policy for all the containers in a pod. + + +[//]: # (BEGIN included file options/security-opt.md) +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the pod +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the pod + +- **label=user:**_USER_: Set the label user for the pod processes +- **label=role:**_ROLE_: Set the label role for the pod processes +- **label=type:**_TYPE_: Set the label process type for the pod processes +- **label=level:**_LEVEL_: Set the label level for the pod processes +- **label=filetype:**_TYPE_: Set the label file type for the pod files +- **label=disable**: Turn off label separation for the pod + +Note: Labeling can be disabled for all pods/containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the containers within the pod. + +- **no-new-privileges**: Disable container processes from gaining additional privileges through the `execve(2)` system call (e.g. via setuid or setgid bits, or via file capabilities). Programs that rely on setuid/setgid bits set on their executable to change user id or group id are no longer able to do so, and any file capabilities added to the executable (e.g. via `setcap`) are not added to the permitted capability set. For more details, see: https://docs.kernel.org/userspace-api/no_new_privs.html. + +- **seccomp=unconfined**: Turn off seccomp confinement for the pod. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. + +[//]: # (END included file options/security-opt.md) + +#### **--share**=*namespace* + +A comma-separated list of kernel namespaces to share. If none or "" is specified, no namespaces are shared, and the infra container is not created unless explicitly specified via **--infra=true**. The namespaces to choose from are cgroup, ipc, net, pid, uts. If the option is prefixed with a "+", the namespace is appended to the default list. Otherwise, it replaces the default list. Defaults match Kubernetes default (ipc, net, uts) + +#### **--share-parent** + +This boolean determines whether or not all containers entering the pod use the pod as their cgroup parent. The default value of this option is true. Use the **--share** option to share the cgroup namespace rather than a cgroup parent in a pod. + +Note: This option conflicts with the **--share=cgroup** option since that option sets the pod as the cgroup parent but enters the container into the same cgroupNS as the infra container. + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the pod. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/shm-size-systemd.md) +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. + +[//]: # (END included file options/shm-size-systemd.md) + + +[//]: # (BEGIN included file options/subgidname.md) +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. + +[//]: # (END included file options/subgidname.md) + + +[//]: # (BEGIN included file options/subuidname.md) +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. + +[//]: # (END included file options/subuidname.md) + + +[//]: # (BEGIN included file options/sysctl.md) +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters for all containers in the pod. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: if the ipc namespace is not shared within the pod, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: if the network namespace is not shared within the pod, the above sysctls are not allowed. + +[//]: # (END included file options/sysctl.md) + + +[//]: # (BEGIN included file options/uidmap.pod.md) +#### **--uidmap**=*container_uid\:from_uid\:amount* + +Run all containers in the pod in a new user namespace using the supplied mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +[//]: # (END included file options/uidmap.pod.md) + + +[//]: # (BEGIN included file options/userns.pod.md) +#### **--userns**=*mode* + +Set the user namespace mode for all the containers in a pod. It defaults to the `PODMAN_USERNS` environment variable. An empty value ("") means user namespaces are disabled. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +----------|---------------|--------------------- +"" |$UID |0 (Default User account mapped to root user in container.) +host |$UID |0 (Default User account mapped to root user in container.) +keep-id |$UID |$UID (Map user account to same UID within container.) +auto |$UID | nil (Host User UID is not mapped into container.) +nomap |$UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + + - *auto[:*_OPTIONS,..._*]*: automatically create a namespace. It is possible to specify these options to `auto`: + + - *gidmapping=*_CONTAINER\_GID\:HOST\_GID\:SIZE_ to force a GID mapping to be present in the user namespace. + + - *size=*_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates the size for the user namespace. + + - *uidmapping=*_CONTAINER\_UID\:HOST\_UID\:SIZE_ to force a UID mapping to be present in the user namespace. + + - *host*: run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user (default). + + - *keep-id*: creates a user namespace where the current rootless user's UID\:GID are mapped to the same values in the container. This option is not allowed for containers created by the root user. + + - *nomap*: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +[//]: # (END included file options/userns.pod.md) + + +[//]: # (BEGIN included file options/uts.pod.md) +#### **--uts**=*mode* + +Set the UTS namespace mode for the pod. The following values are supported: + +- **host**: use the host's UTS namespace inside the pod. +- **private**: create a new namespace for the pod (default). +- **ns:[path]**: run the pod in the given existing UTS namespace. + +[//]: # (END included file options/uts.pod.md) + + +[//]: # (BEGIN included file options/volume.md) +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the pod is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +pod. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a pod is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the pod, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the pod. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a pod. Without a label, the security system +might prevent the processes running inside the pod from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the pod context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +pods share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label. Only the current pod can use a private +volume. + +Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any one of the containers. Relabeling walks +the file system under the volume and changes the label on each file; if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the pod. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually changed with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the pod. +For example if a user wanted to volume mount their entire home directory into a +pod, they need to disable SELinux separation. + + $ podman pod create --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The pod processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the pod +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous pod executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the pod infra container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the pod or infra container +to work. + +Do not modify the source directory mounted into the pod with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the pod are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the pod +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +pod, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +pod. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the pod. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the pod. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless pod fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/volume.md) + + +[//]: # (BEGIN included file options/volumes-from.md) +#### **--volumes-from**=*CONTAINER[\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers and pods. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +pod. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a pod. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the pod context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target pod, then the volume hides +that data on the target. + +[//]: # (END included file options/volumes-from.md) + +## EXAMPLES + +Create a named pod. +``` +$ podman pod create --name test +``` + +Create a named pod. +``` +$ podman pod create mypod +``` + +Create a pod without an infra container. +``` +$ podman pod create --infra=false +``` + +Create a named pod with infra container command to run. +``` +$ podman pod create --infra-command /top toppod +``` + +Create a pod with published ports on the host. +``` +$ podman pod create --publish 8443:443 +``` + +Create a pod with the specified network configuration. +``` +$ podman pod create --network slirp4netns:outbound_addr=127.0.0.1,allow_host_loopback=true +``` + +Create a pod with the specified network. +``` +$ podman pod create --network pasta +``` + +Create a pod on two networks. +``` +$ podman pod create --network net1\:ip=10.89.1.5 --network net2\:ip=10.89.10.10 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **containers.conf(1)**, **[cgroups(7)](https://man7.org/linux/man-pages/man7/cgroups.7.html)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +July 2018, Originally compiled by Peter Hunt + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a core value of open source. The `master` and `slave` mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately. diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-pod-exists.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-pod-exists.1.md new file mode 100644 index 000000000..fd5415924 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-pod-exists.1.md @@ -0,0 +1,38 @@ +--- +title: podman-pod-exists +version: v5.5.0 +--- + +% podman-pod-exists 1 + +## NAME +podman-pod-exists - Check if a pod exists in local storage + +## SYNOPSIS +**podman pod exists** *pod* + +## DESCRIPTION +**podman pod exists** checks if a pod exists in local storage. The **ID** or **Name** +of the pod may be used as input. Podman returns an exit code +of `0` when the pod is found. A `1` is returned otherwise. An exit code of `125` indicates there +was an issue accessing the local storage. + +## EXAMPLES + +Check if specified pod exists in local storage (the pod does actually exist): +``` +$ sudo podman pod exists web; echo $? +0 +``` + +Check if specified pod exists in local storage (the pod does not actually exist): +``` +$ sudo podman pod exists backend; echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-pod-inspect.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-pod-inspect.1.md new file mode 100644 index 000000000..09c8daf8f --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-pod-inspect.1.md @@ -0,0 +1,113 @@ +--- +title: podman-pod-inspect +version: v5.5.0 +--- + +% podman-pod-inspect 1 + +## NAME +podman\-pod\-inspect - Display information describing a pod + +## SYNOPSIS +**podman pod inspect** [*options*] *pod* ... + +## DESCRIPTION +Displays configuration and state information about a given pod. It also displays information about containers +that belong to the pod. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|----------------------|---------------------------------------------| +| .BlkioDeviceReadBps | Block I/O Device Read, in bytes/sec | +| .BlkioDeviceWriteBps | Block I/O Device Read, in bytes/sec | +| .BlkioWeight | Block I/O Weight | +| .BlkioWeightDevice | Block I/O Device Weight | +| .CgroupParent | Pod cgroup parent | +| .CgroupPath | Pod cgroup path | +| .Containers | Pod containers | +| .CPUPeriod | CPU period | +| .CPUQuota | CPU quota | +| .CPUSetCPUs | CPU Set CPUs | +| .CPUSetMems | CPU Set Mems | +| .CPUShares | CPU Shares | +| .CreateCgroup | Whether cgroup was created | +| .CreateCommand | Create command | +| .Created ... | Time when the pod was created | +| .CreateInfra | Whether infrastructure created | +| .Devices | Devices | +| .ExitPolicy | Exit policy | +| .Hostname | Pod hostname | +| .ID | Pod ID | +| .InfraConfig ... | Infra config (contains further fields) | +| .InfraContainerID | Pod infrastructure ID | +| .InspectPodData ... | Nested structure, for experts only | +| .Labels ... | Pod labels | +| .LockNumber | Number of the pod's Libpod lock | +| .MemoryLimit | Memory limit, bytes | +| .MemorySwap | Memory swap limit, in bytes | +| .Mounts | Mounts | +| .Name | Pod name | +| .Namespace | Namespace | +| .NumContainers | Number of containers in the pod | +| .RestartPolicy | Restart policy of the pod | +| .SecurityOpts | Security options | +| .SharedNamespaces | Pod shared namespaces | +| .State | Pod state | +| .VolumesFrom | Volumes from | + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Inspect specified pod: +``` +# podman pod inspect foobar +[ + { + "Id": "3513ca70583dd7ef2bac83331350f6b6c47d7b4e526c908e49d89ebf720e4693", + "Name": "foobar", + "Labels": {}, + "CgroupParent": "/libpod_parent", + "CreateCgroup": true, + "Created": "2018-08-08T11:15:18.823115347-05:00" + "State": "created", + "Hostname": "", + "SharedNamespaces": [ + "uts", + "ipc", + "net" + ] + "CreateInfra": false, + "InfraContainerID": "1020dd70583dd7ff2bac83331350f6b6e007de0d026c908e49d89ebf891d4699" + "CgroupPath": "" + "Containers": [ + { + "id": "d53f8bf1e9730281264aac6e6586e327429f62c704abea4b6afb5d8a2b2c9f2c", + "state": "configured" + } + ] + } +] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +August 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-pod-kill.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-pod-kill.1.md new file mode 100644 index 000000000..fd553b893 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-pod-kill.1.md @@ -0,0 +1,73 @@ +--- +title: podman-pod-kill +version: v5.5.0 +--- + +% podman-pod-kill 1 + +## NAME +podman\-pod\-kill - Kill the main process of each container in one or more pods + +## SYNOPSIS +**podman pod kill** [*options*] *pod* ... + +## DESCRIPTION +The main process of each container inside the pods specified is sent SIGKILL, or any signal specified with option --signal. + +## OPTIONS +#### **--all**, **-a** + +Sends signal to all containers associated with a pod. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/signal.md) +#### **--signal**, **-s**=**signal** + +Signal to send to the containers in the pod. For more information on Linux signals, refer to *signal(7)*. +The default is **SIGKILL**. + +[//]: # (END included file options/signal.md) + +## EXAMPLE + +Kill pod with a given name: +``` +podman pod kill mywebserver +``` + +Kill pod with a given ID: +``` +podman pod kill 860a4b23 +``` + +Terminate pod by sending `TERM` signal: +``` +podman pod kill --signal TERM 860a4b23 +``` + +Kill the latest pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman pod kill --latest +``` + +Terminate all pods by sending `KILL` signal: +``` +podman pod kill --all +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-stop(1)](podman-pod-stop.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-pod-logs.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-pod-logs.1.md new file mode 100644 index 000000000..6f0a50b63 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-pod-logs.1.md @@ -0,0 +1,136 @@ +--- +title: podman-pod-logs +version: v5.5.0 +--- + +% podman-pod-logs 1 + +## NAME +podman\-pod\-logs - Display logs for pod with one or more containers + +## SYNOPSIS +**podman pod logs** [*options*] *pod* + +## DESCRIPTION +The podman pod logs command batch-retrieves whatever logs are present with all the containers of a pod. Pod logs can be filtered by container name or ID using flag **-c** or **--container** if needed. + +Note: A long-running `podman pod log` command with a `-f` or `--follow` option needs to be reinvoked if a new container is added to the pod dynamically; otherwise, logs of newly added containers are not visible in the log stream. + +## OPTIONS + + +[//]: # (BEGIN included file options/color.md) +#### **--color** + +Output the containers with different colors in the log. + +[//]: # (END included file options/color.md) + +#### **--container**, **-c** + +By default, `podman pod logs` retrieves logs for all the containers available within the pod, differentiated by the field `container`. However, there are use cases where the user wants to limit the log stream only to a particular container of a pod. For such cases, `-c` can be used like `podman pod logs -c ctrNameorID podname`. + + +[//]: # (BEGIN included file options/follow.md) +#### **--follow**, **-f** + +Follow log output. Default is false. + +Note: When following a pod which is removed by `podman pod rm` +or removed on exit (`podman run --rm ...`), there is a chance that the log +file is removed before `podman pod logs` reads the final content. + +[//]: # (END included file options/follow.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/names.md) +#### **--names**, **-n** + +Output the container names instead of the container IDs in the log. + +[//]: # (END included file options/names.md) + + +[//]: # (BEGIN included file options/since.md) +#### **--since**=*TIMESTAMP* + +Show logs since TIMESTAMP. The --since option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. + +[//]: # (END included file options/since.md) + + +[//]: # (BEGIN included file options/tail.md) +#### **--tail**=*LINES* + +Output the specified number of LINES at the end of the logs. LINES must be an integer. Defaults to -1, +which prints all lines + +[//]: # (END included file options/tail.md) + + +[//]: # (BEGIN included file options/timestamps.md) +#### **--timestamps**, **-t** + +Show timestamps in the log outputs. The default is false + +[//]: # (END included file options/timestamps.md) + + +[//]: # (BEGIN included file options/until.md) +#### **--until**=*TIMESTAMP* + +Show logs until TIMESTAMP. The --until option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. + +[//]: # (END included file options/until.md) + +## EXAMPLE + +To view a pod's logs: +``` +podman pod logs -t podIdorName +``` + +To view logs of a specific container on the pod: +``` +podman pod logs -c ctrIdOrName podIdOrName +``` + +To view all pod logs: +``` +podman pod logs -t --since 0 myserver-pod-1 +``` + +To view a pod's logs since a certain time: +``` +podman pod logs -t --since 2017-08-07T10:10:09.055837383-04:00 myserver-pod-1 +``` + +To view a pod's logs generated in the last 10 minutes: +``` +podman pod logs --since 10m myserver-pod-1 +``` + +To view a pod's logs until 30 minutes ago: +``` +podman pod logs --until 30m myserver-pod-1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-rm(1)](podman-pod-rm.1.md)**, **[podman-logs(1)](podman-logs.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-pod-pause.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-pod-pause.1.md new file mode 100644 index 000000000..7eb500242 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-pod-pause.1.md @@ -0,0 +1,43 @@ +--- +title: podman-pod-pause +version: v5.5.0 +--- + +% podman-pod-pause 1 + +## NAME +podman\-pod\-pause - Pause one or more pods + +## SYNOPSIS +**podman pod pause** [*options*] *pod* ... + +## DESCRIPTION +Pauses all the running processes in the containers of one or more pods. You may use pod IDs or names as input. + +## OPTIONS + +#### **--all**, **-a** + +Pause all pods. + +#### **--latest**, **-l** + +Instead of providing the pod name or ID, pause the last created pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +## EXAMPLE + +Pause a pod with a given name: +``` +podman pod pause mywebserverpod +``` + +Pause a pod with a given ID: +``` +podman pod pause 860a4b23 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-unpause(1)](podman-pod-unpause.1.md)**, **[podman-pause(1)](podman-pause.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-pod-prune.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-pod-prune.1.md new file mode 100644 index 000000000..ce20eb9a2 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-pod-prune.1.md @@ -0,0 +1,38 @@ +--- +title: podman-pod-prune +version: v5.5.0 +--- + +% podman-pod-prune 1 + +## NAME +podman-pod-prune - Remove all stopped pods and their containers + +## SYNOPSIS +**podman pod prune** [*options*] + +## DESCRIPTION +**podman pod prune** removes all stopped pods and their containers from local storage. + +## OPTIONS + +#### **--force**, **-f** +Force removal of all running pods and their containers. The default is false. + +## EXAMPLES + +Remove all stopped pods and their containers from local storage. +``` +$ sudo podman pod prune +22b8813332948064b6566370088c5e0230eeaf15a58b1c5646859fd9fc364fe7 +2afb26869fe5beab979c234afb75c7506063cd4655b1a73557c9d583ff1aebe9 +49161ad2a722cf18722f0e17199a9e840703a17d1158cdeda502b6d54080f674 +5ca429f37fb83a9f54eea89e3a9102b7780a6e6ae5f132db0672da551d862c4a +6bb06573787efb8b0675bc88ebf8361f1a56d3ac7922d1a6436d8f59ffd955f1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +April 2019, Originally compiled by Peter Hunt (pehunt at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-pod-ps.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-pod-ps.1.md new file mode 100644 index 000000000..b1bc64823 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-pod-ps.1.md @@ -0,0 +1,206 @@ +--- +title: podman-pod-ps +version: v5.5.0 +--- + +% podman-pod-ps 1 + +## NAME +podman\-pod\-ps - Print out information about pods + +## SYNOPSIS +**podman pod ps** [*options*] + +## DESCRIPTION +**podman pod ps** lists the pods on the system. +By default it lists: + + * pod ID + * pod name + * the time the pod was created + * number of containers attached to pod + * container ID of the pod infra container + * status of pod as defined by the following table + +| **Status** | **Description** | +| ------------ | ------------------------------------------------| +| Created | No containers running nor stopped | +| Running | at least one container is running | +| Stopped | At least one container stopped and none running | +| Exited | All containers stopped in pod | +| Dead | Error retrieving state | + + +## OPTIONS + +#### **--ctr-ids** + +Display the container IDs + +#### **--ctr-names** + +Display the container names + +#### **--ctr-status** + +Display the container statuses + +#### **--filter**, **-f**=*filter* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|------------|--------------------------------------------------------------------------------------------------| +| ctr-ids | Filter by container ID within the pod. (CID prefix match by default; accepts regex) | +| ctr-names | Filter by container name within the pod. | +| ctr-number | Filter by number of containers in the pod. | +| ctr-status | Filter by container status within the pod. | +| id | Filter by pod ID. (Prefix match by default; accepts regex) | +| label | Filter by container with (or without, in the case of label!=[...] is used) the specified labels. | +| name | Filter by pod name. | +| network | Filter by network name or full ID of network. | +| status | Filter by pod status. | +| until | Filter by pods created before given timestamp. | + +The `ctr-ids`, `ctr-names`, `id`, `name` filters accept `regex` format. + +The `ctr-status` filter accepts values: `created`, `running`, `paused`, `stopped`, `exited`, `unknown`. + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes containers with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes containers without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +The `status` filter accepts values: `stopped`, `running`, `paused`, `exited`, `dead`, `created`, `degraded`. + +#### **--format**=*format* + +Pretty-print containers to JSON or using a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|---------------------|------------------------------------------------------| +| .Cgroup | Cgroup path of pod | +| .ContainerIds | Comma-separated list of container IDs in the pod | +| .ContainerNames | Comma-separated list of container names in the pod | +| .ContainerStatuses | Comma-separated list of container statuses | +| .Created | Creation time of pod | +| .ID | Container ID | +| .InfraID | Pod infra container ID | +| .Label *string* | Specified label of the pod | +| .Labels ... | All the labels assigned to the pod | +| .Name | Name of pod | +| .Networks | Show all networks connected to the infra container | +| .NumberOfContainers | Show the number of containers attached to pod | +| .Restarts | Show the total number of container restarts in a pod | +| .Status | Status of pod | + +#### **--help**, **-h** + +Print usage statement + +#### **--latest**, **-l** + +Show the latest pod created (all states) (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +#### **--namespace**, **--ns** + +Display namespace information of the pod + +#### **--no-trunc** + +Do not truncate the output (default *false*). + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Print the numeric IDs of the pods only + +#### **--sort** + +Sort by created, ID, name, status, or number of containers + +Default: created + +## EXAMPLES + +List all running pods. +``` +$ podman pod ps +POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS +00dfd6fa02c0 jolly_goldstine Running 31 hours ago ba465ab0a3a4 1 +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a 2 +``` + +List all running pods along with container names within the pods. +``` +$ podman pod ps --ctr-names +POD ID NAME STATUS CREATED INFRA ID NAMES +00dfd6fa02c0 jolly_goldstine Running 31 hours ago ba465ab0a3a4 loving_archimedes +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a thirsty_hawking,wizardly_golick +``` + +List all running pods along with status, names and ids. +``` +$ podman pod ps --ctr-status --ctr-names --ctr-ids +POD ID NAME STATUS CREATED INFRA ID IDS NAMES STATUS +00dfd6fa02c0 jolly_goldstine Running 31 hours ago ba465ab0a3a4 ba465ab0a3a4 loving_archimedes running +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a 331693bff40a,8e428daeb89e thirsty_hawking,wizardly_golick configured,configured +``` + +List all running pods and print ID, Container Names, and cgroups. +``` +$ podman pod ps --format "{{.ID}} {{.ContainerNames}} {{.Cgroup}}" +00dfd6fa02c0 loving_archimedes /libpod_parent +f4df8692e116 thirsty_hawking,wizardly_golick /libpod_parent +``` + +List all running pods with two containers sorted by pod ID. +``` +$ podman pod ps --sort id --filter ctr-number=2 +POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a 2 +``` + +List all running pods with their container ids. +``` +$ podman pod ps --ctr-ids +POD ID NAME STATUS CREATED INFRA ID IDS +00dfd6fa02c0 jolly_goldstine Running 31 hours ago ba465ab0a3a4 ba465ab0a3a4 +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a 331693bff40a,8e428daeb89e +``` + +List all running pods with container ids without truncating IDs. +``` +$ podman pod ps --no-trunc --ctr-ids +POD ID NAME STATUS CREATED INFRA ID IDS +00dfd6fa02c0a2daaedfdf8fcecd06f22ad114d46d167d71777224735f701866 jolly_goldstine Running 31 hours ago ba465ab0a3a4e15e3539a1e79c32d1213a02b0989371e274f98e0f1ae9de7050 ba465ab0a3a4e15e3539a1e79c32d1213a02b0989371e274f98e0f1ae9de7050 +f4df8692e116a3e6d1d62572644ed36ca475d933808cc3c93435c45aa139314b nifty_torvalds Created 10 minutes ago 331693bff40a926b6d52b184e116afd15497610c378d5d4c42945dd6e33b75b0 331693bff40a926b6d52b184e116afd15497610c378d5d4c42945dd6e33b75b0,8e428daeb89e69b71e7916a13accfb87d122889442b5c05c2d99cf94a3230e9d +``` + +List all running pods with container names. +``` +$ podman pod ps --ctr-names +POD ID NAME STATUS CREATED INFRA ID NAMES +314f4da82d74 hi Created 17 hours ago a9f2d2165675 jovial_jackson,hopeful_archimedes,vibrant_ptolemy,heuristic_jennings,keen_raman,hopeful_newton,mystifying_bose,silly_lalande,serene_lichterman ... +``` + +## pod ps +Print a list of pods + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-pod-restart.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-pod-restart.1.md new file mode 100644 index 000000000..4a5fcd6c6 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-pod-restart.1.md @@ -0,0 +1,64 @@ +--- +title: podman-pod-restart +version: v5.5.0 +--- + +% podman-pod-restart 1 + +## NAME +podman\-pod\-restart - Restart one or more pods + +## SYNOPSIS +**podman pod restart** [*options*] *pod* ... + +## DESCRIPTION +Restart containers in one or more pods. Running containers are stopped and restarted. +Stopped containers are started. You may use pod IDs or names as input. +The pod ID is printed upon successful restart. +When restarting multiple pods, an error from restarting one pod does not effect restarting other pods. + +## OPTIONS + +#### **--all**, **-a** + +Restarts all pods + +#### **--latest**, **-l** + +Instead of providing the pod name or ID, restart the last created pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +## EXAMPLE + +Restart pod with a given name: +``` +podman pod restart mywebserverpod +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` + +Restart multiple pods with given IDs: +``` +podman pod restart 490eb 3557fb +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +``` + +Restart the last created pod: +``` +podman pod restart --latest +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +``` + +Restart all pods: +``` +podman pod restart --all +19456b4cd557eaf9629825113a552681a6013f8c8cad258e36ab825ef536e818 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +70c358daecf71ef9be8f62404f926080ca0133277ef7ce4f6aa2d5af6bb2d3e9 +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-restart(1)](podman-restart.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-pod-rm.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-pod-rm.1.md new file mode 100644 index 000000000..708e56748 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-pod-rm.1.md @@ -0,0 +1,109 @@ +--- +title: podman-pod-rm +version: v5.5.0 +--- + +% podman-pod-rm 1 + +## NAME +podman\-pod\-rm - Remove one or more stopped pods and containers + +## SYNOPSIS +**podman pod rm** [*options*] *pod* + +## DESCRIPTION +**podman pod rm** removes one or more stopped pods and their containers from the host. The pod name or ID can be used. The \-f option stops all containers and then removes them before removing the pod. If all containers added by the user are in an exited state, the pod is removed. + +## OPTIONS + +#### **--all**, **-a** + +Remove all pods. Can be used in conjunction with \-f as well. + +#### **--force**, **-f** + +Stop running containers and delete all stopped containers before removal of pod. + + +[//]: # (BEGIN included file options/ignore.md) +#### **--ignore**, **-i** + +Ignore errors when specified pods are not in the container store. A user +might have decided to manually remove a pod which leads to a failure +during the ExecStop directive of a systemd service referencing that pod. + +[//]: # (END included file options/ignore.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/pod-id-file.pod.md) +#### **--pod-id-file**=*file* + +Read pod ID from the specified *file* and rm the pod. Can be specified multiple times. + +[//]: # (END included file options/pod-id-file.pod.md) +If specified, the pod-id-file is removed along with the pod. + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping running containers within the pod. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +The --force option must be specified to use the --time option. + +## EXAMPLE + +Remove pod with a given name: +``` +podman pod rm mywebserverpod +``` + +Remove multiple pods with given names and/or IDs: +``` +podman pod rm mywebserverpod myflaskserverpod 860a4b23 +``` + +Forcefully remove pod with a given ID: +``` +podman pod rm -f 860a4b23 +``` + +Forcefully remove all pods: +``` +podman pod rm -f -a +podman pod rm -fa +``` + +Remove pod using ID specified in a given file: +``` +podman pod rm --pod-id-file /path/to/id/file +``` + +## Exit Status + **0** All specified pods removed + + **1** One of the specified pods did not exist, and no other failures + + **2** One of the specified pods is attached to a container + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-pod-start.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-pod-start.1.md new file mode 100644 index 000000000..f22896d9f --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-pod-start.1.md @@ -0,0 +1,74 @@ +--- +title: podman-pod-start +version: v5.5.0 +--- + +% podman-pod-start 1 + +## NAME +podman\-pod\-start - Start one or more pods + +## SYNOPSIS +**podman pod start** [*options*] *pod* ... + +## DESCRIPTION +Start containers in one or more pods. You may use pod IDs or names as input. The pod must have a container attached +to be started. + +## OPTIONS + +#### **--all**, **-a** + +Starts all pods + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/pod-id-file.pod.md) +#### **--pod-id-file**=*file* + +Read pod ID from the specified *file* and start the pod. Can be specified multiple times. + +[//]: # (END included file options/pod-id-file.pod.md) + +## EXAMPLE + +Start pod with a given name: +``` +podman pod start mywebserverpod +``` + +Start pods with given IDs: +``` +podman pod start 860a4b23 5421ab4 +``` + +Start the latest pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman pod start --latest +``` + +Start all pods: +``` +podman pod start --all +``` + +Start pod using ID specified in a given file: +``` +podman pod start --pod-id-file /path/to/id/file +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-stop(1)](podman-pod-stop.1.md)** + +## HISTORY +July 2018, Adapted from podman start man page by Peter Hunt diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-pod-stats.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-pod-stats.1.md new file mode 100644 index 000000000..59906875c --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-pod-stats.1.md @@ -0,0 +1,116 @@ +--- +title: podman-pod-stats +version: v5.5.0 +--- + +% podman-pod-stats 1 + +## NAME +podman\-pod\-stats - Display a live stream of resource usage stats for containers in one or more pods + +## SYNOPSIS +**podman pod stats** [*options*] [*pod*] + +## DESCRIPTION +Display a live stream of containers in one or more pods resource usage statistics. Running rootless is only supported on cgroups v2. + +## OPTIONS + +#### **--all**, **-a** + +Show all containers. Only running containers are shown by default + +#### **--format**=*template* + +Pretty-print container statistics to JSON or using a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| --------------- | ------------------ | +| .BlockIO | Block IO | +| .CID | Container ID | +| .CPU | CPU percentage | +| .Mem | Memory percentage | +| .MemUsage | Memory usage | +| .MemUsageBytes | Memory usage (IEC) | +| .Name | Container Name | +| .NetIO | Network IO | +| .PIDS | Number of PIDs | +| .Pod | Pod ID | + +When using a Go template, precede the format with `table` to print headers. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/no-reset.md) +#### **--no-reset** + +Do not clear the terminal/screen in between reporting intervals + +[//]: # (END included file options/no-reset.md) + + +[//]: # (BEGIN included file options/no-stream.md) +#### **--no-stream** + +Disable streaming pod stats and only pull the first result, default setting is false + +[//]: # (END included file options/no-stream.md) + +## EXAMPLE + +List statistics about all pods without streaming: +``` +# podman pod stats -a --no-stream +ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS +a9f807ffaacd frosty_hodgkin -- 3.092MB / 16.7GB 0.02% -- / -- -- / -- 2 +3b33001239ee sleepy_stallman -- -- / -- -- -- / -- -- / -- -- +``` + +List statistics about specified pod without streaming: +``` +# podman pod stats --no-stream a9f80 +ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS +a9f807ffaacd frosty_hodgkin -- 3.092MB / 16.7GB 0.02% -- / -- -- / -- 2 +``` + +List statistics about specified pod in JSON format without streaming: +``` +# podman pod stats --no-stream --format=json a9f80 +[ + { + "id": "a9f807ffaacd", + "name": "frosty_hodgkin", + "cpu_percent": "--", + "mem_usage": "3.092MB / 16.7GB", + "mem_percent": "0.02%", + "netio": "-- / --", + "blocki": "-- / --", + "pids": "2" + } +] +``` + +List selected statistics formatted in a table about specified pod: +``` +# podman pod stats --no-stream --format "table {{.ID}} {{.Name}} {{.MemUsage}}" 6eae +ID NAME MEM USAGE / LIMIT +6eae9e25a564 clever_bassi 3.031MB / 16.7GB +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +February 2019, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-pod-stop.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-pod-stop.1.md new file mode 100644 index 000000000..82c3bc714 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-pod-stop.1.md @@ -0,0 +1,111 @@ +--- +title: podman-pod-stop +version: v5.5.0 +--- + +% podman-pod-stop 1 + +## NAME +podman\-pod\-stop - Stop one or more pods + +## SYNOPSIS +**podman pod stop** [*options*] *pod* ... + +## DESCRIPTION +Stop containers in one or more pods. You may use pod IDs or names as input. + +## OPTIONS + +#### **--all**, **-a** + +Stops all pods + + +[//]: # (BEGIN included file options/ignore.md) +#### **--ignore**, **-i** + +Ignore errors when specified pods are not in the container store. A user +might have decided to manually remove a pod which leads to a failure +during the ExecStop directive of a systemd service referencing that pod. + +[//]: # (END included file options/ignore.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/pod-id-file.pod.md) +#### **--pod-id-file**=*file* + +Read pod ID from the specified *file* and stop the pod. Can be specified multiple times. + +[//]: # (END included file options/pod-id-file.pod.md) + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping running containers within the pod. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +## EXAMPLE + +Stop pod with a given name. +``` +$ podman pod stop mywebserverpod +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` + +Stop multiple pods with given IDs. +``` +$ podman pod stop 490eb 3557fb +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +``` + +Stop the last created pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman pod stop --latest +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +``` + +Stop all pods. +``` +$ podman pod stop --all +19456b4cd557eaf9629825113a552681a6013f8c8cad258e36ab825ef536e818 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +70c358daecf71ef9be8f62404f926080ca0133277ef7ce4f6aa2d5af6bb2d3e9 +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` + +Stop two pods via --pod-id-file. +``` +$ podman pod stop --pod-id-file file1 --pod-id-file file2 +19456b4cd557eaf9629825113a552681a6013f8c8cad258e36ab825ef536e818 +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` + +Stop all pods with a timeout of 1 second. +``` +$ podman pod stop -a -t 1 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +70c358daecf71ef9be8f62404f926080ca0133277ef7ce4f6aa2d5af6bb2d3e9 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-start(1)](podman-pod-start.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-pod-top.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-pod-top.1.md new file mode 100644 index 000000000..3ea218b4a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-pod-top.1.md @@ -0,0 +1,65 @@ +--- +title: podman-pod-top +version: v5.5.0 +--- + +% podman-pod-top 1 + +## NAME +podman\-pod\-top - Display the running processes of containers in a pod + +## SYNOPSIS +**podman pod top** [*options*] *pod* [*format-descriptors*] + +## DESCRIPTION +Display the running processes of containers in a pod. The *format-descriptors* are ps (1) compatible AIX format +descriptors but extended to print additional information, such as the seccomp mode or the effective capabilities +of a given process. The descriptors can either be passed as separate arguments or as a single comma-separated argument. + +## OPTIONS + +#### **--help**, **-h** + + Print usage statement + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## FORMAT DESCRIPTORS + +For a full list of available descriptors, see podman-top(1) + +## EXAMPLES + +Print top data for the specified pod. +By default, `podman-pod-top` prints data similar to `ps -ef`: +``` +$ podman pod top b031293491cc +USER PID PPID %CPU ELAPSED TTY TIME COMMAND +root 1 0 0.000 2h5m38.737137571s ? 0s top +root 8 0 0.000 2h5m15.737228361s ? 0s top +``` + +The output can be controlled by specifying format descriptors as arguments after the pod. + +Print the pod top data fields pid,seccomp, args and %C on the latest pod created. (This -l option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman pod top -l pid seccomp args %C +PID SECCOMP COMMAND %CPU +1 filter top 0.000 +1 filter /bin/sh 0.000 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **ps(1)**, **seccomp(2)**, **proc(5)**, **capabilities(7)** + +## HISTORY +August 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-pod-unpause.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-pod-unpause.1.md new file mode 100644 index 000000000..830d37af6 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-pod-unpause.1.md @@ -0,0 +1,43 @@ +--- +title: podman-pod-unpause +version: v5.5.0 +--- + +% podman-pod-unpause 1 + +## NAME +podman\-pod\-unpause - Unpause one or more pods + +## SYNOPSIS +**podman pod unpause** [*options*] *pod* ... + +## DESCRIPTION +Unpauses all the paused processes in the containers of one or more pods. You may use pod IDs or names as input. + +## OPTIONS + +#### **--all**, **-a** + +Unpause all pods. + +#### **--latest**, **-l** + +Instead of providing the pod name or ID, unpause the last created pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +## EXAMPLE + +Unpause pod with a given name: +``` +podman pod unpause mywebserverpod +``` + +Unpause pod with a given ID: +``` +podman pod unpause 860a4b23 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-pause(1)](podman-pod-pause.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-pod.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-pod.1.md new file mode 100644 index 000000000..2a09f7b7a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-pod.1.md @@ -0,0 +1,42 @@ +--- +title: podman-pod +version: v5.5.0 +--- + +% podman-pod 1 + +## NAME +podman\-pod - Management tool for groups of containers, called pods + +## SYNOPSIS +**podman pod** *subcommand* + +## DESCRIPTION +podman pod is a set of subcommands that manage pods, or groups of containers. + +## SUBCOMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------- | --------------------------------------------------------------------------------- | +| clone | [podman-pod-clone(1)](podman-pod-clone.1.md) | Create a copy of an existing pod. | +| create | [podman-pod-create(1)](podman-pod-create.1.md) | Create a new pod. | +| exists | [podman-pod-exists(1)](podman-pod-exists.1.md) | Check if a pod exists in local storage. | +| inspect | [podman-pod-inspect(1)](podman-pod-inspect.1.md) | Display information describing a pod. | +| kill | [podman-pod-kill(1)](podman-pod-kill.1.md) | Kill the main process of each container in one or more pods. | +| logs | [podman-pod-logs(1)](podman-pod-logs.1.md) | Display logs for pod with one or more containers. | +| pause | [podman-pod-pause(1)](podman-pod-pause.1.md) | Pause one or more pods. | +| prune | [podman-pod-prune(1)](podman-pod-prune.1.md) | Remove all stopped pods and their containers. | +| ps | [podman-pod-ps(1)](podman-pod-ps.1.md) | Print out information about pods. | +| restart | [podman-pod-restart(1)](podman-pod-restart.1.md) | Restart one or more pods. | +| rm | [podman-pod-rm(1)](podman-pod-rm.1.md) | Remove one or more stopped pods and containers. | +| start | [podman-pod-start(1)](podman-pod-start.1.md) | Start one or more pods. | +| stats | [podman-pod-stats(1)](podman-pod-stats.1.md) | Display a live stream of resource usage stats for containers in one or more pods. | +| stop | [podman-pod-stop(1)](podman-pod-stop.1.md) | Stop one or more pods. | +| top | [podman-pod-top(1)](podman-pod-top.1.md) | Display the running processes of containers in a pod. | +| unpause | [podman-pod-unpause(1)](podman-pod-unpause.1.md) | Unpause one or more pods. | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-port.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-port.1.md new file mode 100644 index 000000000..f14a0b0ec --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-port.1.md @@ -0,0 +1,71 @@ +--- +title: podman-port +version: v5.5.0 +--- + +% podman-port 1 + +## NAME +podman\-port - List port mappings for a container + +## SYNOPSIS +**podman port** [*options*] *container* [*private-port*[/*proto*]] + +**podman container port** [*options*] *container* [*private-port*[/*proto*]] + +## DESCRIPTION +List port mappings for the *container* or look up the public-facing port that is NAT-ed to the *private-port*. + +## OPTIONS + +#### **--all**, **-a** + +List all known port mappings for running containers; when using this option, container names or private ports/protocols filters cannot be used. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +List all port mappings: +``` +# podman port -a +b4d2f05432e482e017b1a4b2eae15fa7b4f6fb7e9f65c1bde46294fdef285906 +80/udp -> 0.0.0.0:44327 +80/tcp -> 0.0.0.0:44327 +# +``` + +List port mappings for a specific container: +``` +# podman port b4d2f054 +80/udp -> 0.0.0.0:44327 +80/tcp -> 0.0.0.0:44327 +# +``` +List the specified port mappings for a specific container: +``` +# podman port b4d2f054 80 + 0.0.0.0:44327 +# +``` + +List the port mappings for a specific container for port 80 and the tcp protocol: +``` +# podman port b4d2f054 80/tcp +0.0.0.0:44327 +# +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +January 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-ps.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-ps.1.md new file mode 100644 index 000000000..e7b493b1d --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-ps.1.md @@ -0,0 +1,228 @@ +--- +title: podman-ps +version: v5.5.0 +--- + +% podman-ps 1 + +## NAME +podman\-ps - Print out information about containers + +## SYNOPSIS +**podman ps** [*options*] + +**podman container ps** [*options*] + +**podman container list** [*options*] + +**podman container ls** [*options*] + +## DESCRIPTION +**podman ps** lists the running containers on the system. Use the **--all** flag to view +all the containers information. By default it lists: + + * container id + * the name of the image the container is using + * the COMMAND the container is executing + * the time the container was created + * the status of the container + * port mappings the container is using + * alternative names for the container + +## OPTIONS + +#### **--all**, **-a** + +Show all the containers, default is only running containers. + +Note: Podman shares containers storage with other tools such as Buildah and CRI-O. In some cases these `external` containers might also exist in the same storage. Use the `--external` option to see these external containers. External containers show the 'storage' status. + +#### **--external** + +Display external containers that are not controlled by Podman but are stored in containers storage. These external containers are generally created via other container technology such as Buildah or CRI-O and may depend on the same container images that Podman is also using. External containers are denoted with either a 'buildah' or 'storage' in the COMMAND and STATUS column of the ps output. + +#### **--filter**, **-f** + +Filter what containers are shown in the output. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| label! | [Key] or [Key=Value] Label NOT assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container (accepts regex) | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] container created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + +#### **--format**=*format* + +Pretty-print containers to JSON or using a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|--------------------|----------------------------------------------| +| .AutoRemove | If true, containers are removed on exit | +| .CIDFile | Container ID File | +| .Command | Quoted command used | +| .Created ... | Creation time for container, Y-M-D H:M\:S | +| .CreatedAt | Creation time for container (same as above) | +| .CreatedHuman | Creation time, relative | +| .ExitCode | Container exit code | +| .Exited | "true" if container has exited | +| .ExitedAt | Time (epoch seconds) that container exited | +| .ExposedPorts ... | Map of exposed ports on this container | +| .ID | Container ID | +| .Image | Image Name/ID | +| .ImageID | Image ID | +| .IsInfra | "true" if infra container | +| .Label *string* | Specified label of the container | +| .Labels ... | All the labels assigned to the container | +| .Mounts | Volumes mounted in the container | +| .Names | Name of container | +| .Networks | Show all networks connected to the container | +| .Pid | Process ID on host system | +| .Pod | Pod the container is associated with (SHA) | +| .PodName | PodName of the container | +| .Ports | Forwarded and exposed ports | +| .Restarts | Display the container restart count | +| .RunningFor | Time elapsed since container was started | +| .Size | Size of container | +| .StartedAt | Time (epoch seconds) the container started | +| .State | Human-friendly description of ctr state | +| .Status | Status of container | + +#### **--help**, **-h** + +Print usage statement + +#### **--last**, **-n** + +Print the n last created containers (all states) + +#### **--latest**, **-l** + +Show the latest container created (all states) (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +#### **--namespace**, **--ns** + +Display namespace information + +#### **--no-trunc** + +Do not truncate the output (default *false*). + +#### **--noheading** + +Omit the table headings from the listing of containers. + +#### **--pod**, **-p** + +Display the pods the containers are associated with + +#### **--quiet**, **-q** + +Print the numeric IDs of the containers only + +#### **--size**, **-s** + +Display the total file size + +#### **--sort**=*created* + +Sort by command, created, id, image, names, runningfor, size, or status", +Note: Choosing size sorts by size of rootFs, not alphabetically like the rest of the options + +#### **--sync** + +Force a sync of container state with the OCI runtime. +In some cases, a container's state in the runtime can become out of sync with Podman's state. +This updates Podman's state based on what the OCI runtime reports. +Forcibly syncing is much slower, but can resolve inconsistent state issues. + +#### **--watch**, **-w** + +Refresh the output with current containers on an interval in seconds. + +## EXAMPLES + +List running containers. +``` +$ podman ps +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +4089df24d4f3 docker.io/library/centos:latest /bin/bash 2 minutes ago Up 2 minutes 0.0.0.0:80->8080/tcp, 0.0.0.0:2000-2006->2000-2006/tcp manyports +92f58933c28c docker.io/library/centos:latest /bin/bash 3 minutes ago Up 3 minutes 192.168.99.100:1000-1006->1000-1006/tcp zen_sanderson +``` + +List all containers. +``` +$ podman ps -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +02f65160e14ca redis:alpine "redis-server" 19 hours ago Exited (-1) 19 hours ago 6379/tcp k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0 +69ed779d8ef9f redis:alpine "redis-server" 25 hours ago Created 6379/tcp k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 +``` + +List all containers including their size. Note: this can take longer since Podman needs to calculate the size from the file system. +``` +$ podman ps -a -s +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES SIZE +02f65160e14ca redis:alpine "redis-server" 20 hours ago Exited (-1) 20 hours ago 6379/tcp k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0 27.49 MB +69ed779d8ef9f redis:alpine "redis-server" 25 hours ago Created 6379/tcp k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 27.49 MB +``` + +List all containers, running or not, using a custom Go format. +``` +$ podman ps -a --format "{{.ID}} {{.Image}} {{.Labels}} {{.Mounts}}" +02f65160e14ca redis:alpine tier=backend proc,tmpfs,devpts,shm,mqueue,sysfs,cgroup,/var/run/,/var/run/ +69ed779d8ef9f redis:alpine batch=no,type=small proc,tmpfs,devpts,shm,mqueue,sysfs,cgroup,/var/run/,/var/run/ +``` + +List all containers and display their namespaces. +``` +$ podman ps --ns -a +CONTAINER ID NAMES PID CGROUP IPC MNT NET PIDNS USER UTS +3557d882a82e3 k8s_container2_podsandbox1_redhat.test.crio_redhat-test-crio_1 29910 4026531835 4026532585 4026532593 4026532508 4026532595 4026531837 4026532594 +09564cdae0bec k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 29851 4026531835 4026532585 4026532590 4026532508 4026532592 4026531837 4026532591 +a31ebbee9cee7 k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0 29717 4026531835 4026532585 4026532587 4026532508 4026532589 4026531837 4026532588 +``` + +List all containers including size sorted by names. +``` +$ podman ps -a --size --sort names +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +69ed779d8ef9f redis:alpine "redis-server" 25 hours ago Created 6379/tcp k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 +02f65160e14ca redis:alpine "redis-server" 19 hours ago Exited (-1) 19 hours ago 6379/tcp k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0 +``` + +List all external containers created by tools other than Podman. +``` +$ podman ps --external -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +69ed779d8ef9f redis:alpine "redis-server" 25 hours ago Created 6379/tcp k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 +38a8a78596f9 docker.io/library/busybox:latest buildah 2 hours ago storage busybox-working-container +fd7b786b5c32 docker.io/library/alpine\:latest buildah 2 hours ago storage alpine-working-container +f78620804e00 scratch buildah 2 hours ago storage working-container +``` + +## ps +Print a list of containers + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **[crio(8)](https://github.com/cri-o/cri-o/blob/main/docs/crio.8.md)** + +## HISTORY +August 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-pull.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-pull.1.md new file mode 100644 index 000000000..8f5f87902 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-pull.1.md @@ -0,0 +1,327 @@ +--- +title: podman-pull +version: v5.5.0 +--- + +% podman-pull 1 + +## NAME +podman\-pull - Pull an image from a registry + +## SYNOPSIS +**podman pull** [*options*] *source* [*source*...] + +**podman image pull** [*options*] *source* [*source*...] + +**podman pull** [*options*] [*transport*]*name*[:*tag*|@*digest*] + +**podman image pull** [*options*] [*transport*]*name*[:*tag*|@*digest*] + +## DESCRIPTION +podman pull copies an image from a registry onto the local machine. The command can pull one or more images. If the image reference in the command line argument does not contain a registry, it is referred to as a `short-name` reference. If the image is a 'short-name' reference, Podman prompts the user for the specific container registry to pull the image from, if an alias for the short-name has not been specified in the `short-name-aliases.conf`. If an image tag is not specified, **podman pull** defaults to the image with the **latest** tag (if it exists) and pulls it. After the image is pulled, podman prints the full image ID. **podman pull** can also pull images using a digest **podman pull** *image*@*digest* and can also be used to pull images from archives and local storage using different transports. +*IMPORTANT: Images are stored in local image storage.* + +## SOURCE +SOURCE is the location from which the container image is pulled from. It supports all transports from **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)**. If no transport is specified, the input is subject to short-name resolution and the `docker` (i.e., container registry) transport is used. For remote clients, including Mac and Windows (excluding WSL2) machines, `docker` is the only supported transport. + +``` +# Pull from a container registry +$ podman pull quay.io/username/myimage + +# Pull from a container registry with short-name resolution +$ podman pull fedora + +# Pull from a container registry via the docker transport +$ podman pull docker://quay.io/username/myimage + +# Pull from a local directory +$ podman pull dir:/tmp/myimage + +# Pull from a tarball in the docker-archive format +$ podman pull docker-archive:/tmp/myimage + +# Pull from a local docker daemon +$ sudo podman pull docker-daemon\:docker.io/library/myimage:33 + +# Pull from a tarball in the OCI-archive format +$ podman pull oci-archive:/tmp/myimage +``` + +## OPTIONS +#### **--all-tags**, **-a** + +All tagged images in the repository are pulled. + +*IMPORTANT: When using the all-tags flag, Podman does not iterate over the search registries in the **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** but always uses docker.io for unqualified image names.* + + +[//]: # (BEGIN included file options/arch.md) +#### **--arch**=*ARCH* +Override the architecture, defaults to hosts, of the image to be pulled. For example, `arm`. +Unless overridden, subsequent lookups of the same image in the local storage matches this architecture, regardless of the host. + +[//]: # (END included file options/arch.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + +#### **--help**, **-h** + +Print the usage statement. + + +[//]: # (BEGIN included file options/os.pull.md) +#### **--os**=*OS* + +Override the OS, defaults to hosts, of the image to be pulled. For example, `windows`. +Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. + +[//]: # (END included file options/os.pull.md) + + +[//]: # (BEGIN included file options/platform.md) +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with --arch and --os) +The `--platform` option can be used to override the current architecture and operating system. +Unless overridden, subsequent lookups of the same image in the local storage matches this platform, regardless of the host. + +[//]: # (END included file options/platform.md) + +#### **--quiet**, **-q** + +Suppress output information when pulling images + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/variant.container.md) +#### **--variant**=*VARIANT* + +Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. + +[//]: # (END included file options/variant.container.md) + +## FILES + +**short-name-aliases.conf** (`/var/cache/containers/short-name-aliases.conf`, `$HOME/.cache/containers/short-name-aliases.conf`) + +When users specify images that do not include the container registry where the +image is stored, this is called a short name. The use of unqualified-search registries entails an ambiguity as it is unclear from which registry a given image, referenced by a short name, may be pulled from. + +Using short names is subject to the risk of hitting squatted registry namespaces. If the unqualified-search registries are set to ["public-registry.com", "my-private-registry.com"] an attacker may take over a namespace of `public-registry.com` such that an image may be pulled from `public-registry.com` instead of the intended source `my-private-registry.com`. + +While it is highly recommended to always use fully-qualified image references, existing deployments using short names may not be easily changed. To circumvent the aforementioned ambiguity, so called short-name aliases can be configured that point to a fully-qualified image reference. Distributions often ship a default shortnames.conf expansion file in /etc/containers/registries.conf.d/ directory. Administrators can use this directory to add their own local short-name expansion files. + +When pulling an image, if the user does not specify the complete registry, container engines attempt to expand the short-name into a full name. If the command is executed with a tty, the user is prompted to select a registry from the +default list unqualified registries defined in registries.conf. The user's selection is then stored in a cache file to be used in all future short-name expansions. Rootful short-names are stored in /var/cache/containers/short-name-aliases.conf. Rootless short-names are stored in the $HOME/.cache/containers/short-name-aliases.conf file. + +For more information on short-names, see `containers-registries.conf(5)` + +**registries.conf** (`/etc/containers/registries.conf`) + +registries.conf is the configuration file which specifies which container registries is consulted when completing image names which do not include a registry or domain portion. + +NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + + +## EXAMPLES +Pull a single image with short name resolution. +``` +$ podman pull alpine:latest +Resolved "alpine" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf) +Trying to pull docker.io/library/alpine:latest... +Getting image source signatures +Copying blob 5843afab3874 done +Copying config d4ff818577 done +Writing manifest to image destination +Storing signatures +d4ff818577bc193b309b355b02ebc9220427090057b54a59e73b79bdfe139b83 +``` + +Pull multiple images with/without short name resolution. +``` +podman pull busybox:musl alpine quay.io/libpod/cirros +Trying to pull docker.io/library/busybox:musl... +Getting image source signatures +Copying blob 0c52b060233b [--------------------------------------] 0.0b / 0.0b +Copying config 9ad2c435a8 done +Writing manifest to image destination +Storing signatures +9ad2c435a887e3f723654e09b48563de44aa3c7950246b2e9305ec85dd3422db +Trying to pull docker.io/library/alpine:latest... +Getting image source signatures +Copying blob 5843afab3874 [--------------------------------------] 0.0b / 0.0b +Copying config d4ff818577 done +Writing manifest to image destination +Storing signatures +d4ff818577bc193b309b355b02ebc9220427090057b54a59e73b79bdfe139b83 +Trying to pull quay.io/libpod/cirros:latest... +Getting image source signatures +Copying blob 8da581cc9286 done +Copying blob 856628d95d17 done +Copying blob f513001ba4ab done +Copying config 3c82e4d066 done +Writing manifest to image destination +Storing signatures +3c82e4d066cf6f9e50efaead6e3ff7fddddf5527826afd68e5a969579fc4db4a +``` + +Pull an image using its digest. +``` +$ podman pull alpine@sha256:d7342993700f8cd7aba8496c2d0e57be0666e80b4c441925fc6f9361fa81d10e +Trying to pull docker.io/library/alpine@sha256:d7342993700f8cd7aba8496c2d0e57be0666e80b4c441925fc6f9361fa81d10e... +Getting image source signatures +Copying blob 188c0c94c7c5 done +Copying config d6e46aa247 done +Writing manifest to image destination +Storing signatures +d6e46aa2470df1d32034c6707c8041158b652f38d2a9ae3d7ad7e7532d22ebe0 +``` + +Pull an image by specifying an authentication file. +``` +$ podman pull --authfile temp-auths/myauths.json docker://docker.io/umohnani/finaltest +Trying to pull docker.io/umohnani/finaltest:latest...Getting image source signatures +Copying blob sha256:6d987f6f42797d81a318c40d442369ba3dc124883a0964d40b0c8f4f7561d913 + 1.90 MB / 1.90 MB [========================================================] 0s +Copying config sha256:ad4686094d8f0186ec8249fc4917b71faa2c1030d7b5a025c29f26e19d95c156 + 1.41 KB / 1.41 KB [========================================================] 0s +Writing manifest to image destination +Storing signatures +03290064078cb797f3e0a530e78c20c13dd22a3dd3adf84a5da2127b48df0438 +``` + +Pull an image by authenticating to a registry. +``` +$ podman pull --creds testuser:testpassword docker.io/umohnani/finaltest +Trying to pull docker.io/umohnani/finaltest:latest...Getting image source signatures +Copying blob sha256:6d987f6f42797d81a318c40d442369ba3dc124883a0964d40b0c8f4f7561d913 + 1.90 MB / 1.90 MB [========================================================] 0s +Copying config sha256:ad4686094d8f0186ec8249fc4917b71faa2c1030d7b5a025c29f26e19d95c156 + 1.41 KB / 1.41 KB [========================================================] 0s +Writing manifest to image destination +Storing signatures +03290064078cb797f3e0a530e78c20c13dd22a3dd3adf84a5da2127b48df0438 +``` + +Pull an image using tls verification. +``` +$ podman pull --tls-verify=false --cert-dir image/certs docker.io/umohnani/finaltest +Trying to pull docker.io/umohnani/finaltest:latest...Getting image source signatures +Copying blob sha256:6d987f6f42797d81a318c40d442369ba3dc124883a0964d40b0c8f4f7561d913 + 1.90 MB / 1.90 MB [========================================================] 0s +Copying config sha256:ad4686094d8f0186ec8249fc4917b71faa2c1030d7b5a025c29f26e19d95c156 + 1.41 KB / 1.41 KB [========================================================] 0s +Writing manifest to image destination +Storing signatures +03290064078cb797f3e0a530e78c20c13dd22a3dd3adf84a5da2127b48df0438 +``` + +Pull an image by overriding the host architecture. +``` +$ podman pull --arch=arm arm32v7/debian:stretch +Trying to pull docker.io/arm32v7/debian\:stretch... +Getting image source signatures +Copying blob b531ae4a3925 done +Copying config 3cba58dad5 done +Writing manifest to image destination +Storing signatures +3cba58dad5d9b35e755b48b634acb3fdd185ab1c996ac11510cc72c17780e13c +``` + +Pull an image with up to 6 retries, delaying 10 seconds between retries in quet mode. +``` +$ podman --remote pull -q --retry 6 --retry-delay 10s ubi9 +4d6addf62a90e392ff6d3f470259eb5667eab5b9a8e03d20b41d0ab910f92170 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-push(1)](podman-push.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-push.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-push.1.md new file mode 100644 index 000000000..e0825d173 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-push.1.md @@ -0,0 +1,276 @@ +--- +title: podman-push +version: v5.5.0 +--- + +% podman-push 1 + +## NAME +podman\-push - Push an image, manifest list or image index from local storage to elsewhere + +## SYNOPSIS +**podman push** [*options*] *image* [*destination*] + +**podman image push** [*options*] *image* [*destination*] + +## DESCRIPTION +Pushes an image, manifest list or image index from local storage to a specified +destination. + +## Image storage +Images are pushed from those stored in local image storage. + +## DESTINATION + + DESTINATION is the location the container image is pushed to. It supports all transports from `containers-transports(5)`. If no transport is specified, the `docker` (i.e., container registry) transport is used. For remote clients, including Mac and Windows (excluding WSL2) machines, `docker` is the only supported transport. + +``` +# Push to a container registry +$ podman push quay.io/podman/stable + +# Push to a container registry via the docker transport +$ podman push docker://quay.io/podman/stable + +# Push to a container registry with another tag +$ podman push myimage quay.io/username/myimage + +# Push to a local directory +$ podman push myimage dir:/tmp/myimage + +# Push to a tarball in the docker-archive format +$ podman push myimage docker-archive:/tmp/myimage + +# Push to a local docker daemon +$ sudo podman push myimage docker-daemon\:docker.io/library/myimage:33 + +# Push to a tarball in the OCI format +$ podman push myimage oci-archive:/tmp/myimage +``` + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/dir-compress.md) +#### **--compress** + +Compress tarball image layers when pushing to a directory using the 'dir' transport. (default is same compression type, compressed or uncompressed, as source) + +[//]: # (END included file options/dir-compress.md) + +Note: This flag can only be set when using the **dir** transport + + +[//]: # (BEGIN included file options/compression-format.md) +#### **--compression-format**=**gzip** | *zstd* | *zstd:chunked* + +Specifies the compression format to use. Supported values are: `gzip`, `zstd` and `zstd:chunked`. The default is `gzip` unless overridden in the containers.conf file. +`zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning in that case. + +[//]: # (END included file options/compression-format.md) + + +[//]: # (BEGIN included file options/compression-level.md) +#### **--compression-level**=*level* + +Specifies the compression level to use. The value is specific to the compression algorithm used, e.g. for zstd the accepted values are in the range 1-20 (inclusive) with a default of 3, while for gzip it is 1-9 (inclusive) and has a default of 5. + +[//]: # (END included file options/compression-level.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/digestfile.md) +#### **--digestfile**=*Digestfile* + +After copying the image, write the digest of the resulting image to the file. + +[//]: # (END included file options/digestfile.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + +#### **--encrypt-layer**=*layer(s)* + +Layer(s) to encrypt: 0-indexed layer indices with support for negative indexing (e.g. 0 is the first layer, -1 is the last layer). If not defined, encrypts all layers if encryption-key flag is specified. + +#### **--encryption-key**=*key* + +The [protocol\:keyfile] specifies the encryption protocol, which can be JWE (RFC7516), PGP (RFC4880), and PKCS7 (RFC2315) and the key material required for image encryption. For instance, jwe:/path/to/key.pem or pgp\:admin@example.com or pkcs7:/path/to/x509-file. + + +[//]: # (BEGIN included file options/force-compression.md) +#### **--force-compression** + +If set, push uses the specified compression algorithm even if the destination contains a differently-compressed variant already. +Defaults to `true` if `--compression-format` is explicitly specified on the command-line, `false` otherwise. + +[//]: # (END included file options/force-compression.md) + +#### **--format**, **-f**=*format* + +Manifest Type (oci, v2s2, or v2s1) to use when pushing an image. + +#### **--quiet**, **-q** + +When writing the output image, suppress progress output + +#### **--remove-signatures** + +Discard any pre-existing signatures in the image. + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + +#### **--sign-by**=*key* + +Add a “simple signing” signature at the destination using the specified key. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-by-sigstore.md) +#### **--sign-by-sigstore**=*param-file* + +Add a sigstore signature based on further options specified in a container's sigstore signing parameter file *param-file*. +See containers-sigstore-signing-params.yaml(5) for details about the file format. + +[//]: # (END included file options/sign-by-sigstore.md) + +#### **--sign-by-sigstore-private-key**=*path* + +Add a sigstore signature at the destination using a private key at the specified path. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-passphrase-file.md) +#### **--sign-passphrase-file**=*path* + +If signing the image (using either **--sign-by** or **--sign-by-sigstore-private-key**), read the passphrase to use from the specified path. + +[//]: # (END included file options/sign-passphrase-file.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLE + +Push the specified image to a local directory: +``` +# podman push imageID dir:/path/to/image +``` + +Push the specified image to a local directory in OCI format: +``` +# podman push imageID oci-archive:/path/to/layout:image:tag +``` + +Push the specified image to a container registry: +``` +# podman push imageID docker://registry.example.com/repository:tag +``` + +Push the specified image to a container registry and save the digest in the specified file: +``` +# podman push --digestfile=/tmp/mydigest imageID docker://registry.example.com/repository:tag +``` + +Push the specified image into the local Docker daemon container store: +``` +# podman push imageID docker-daemon:image:tag +``` + +Push the specified image with a different image name using credentials from an alternate authfile path: +``` +# podman push --authfile temp-auths/myauths.json alpine docker://docker.io/umohnani/alpine +Getting image source signatures +Copying blob sha256:5bef08742407efd622d243692b79ba0055383bbce12900324f75e56f589aedb0 + 4.03 MB / 4.03 MB [========================================================] 1s +Copying config sha256:ad4686094d8f0186ec8249fc4917b71faa2c1030d7b5a025c29f26e19d95c156 + 1.41 KB / 1.41 KB [========================================================] 1s +Writing manifest to image destination +Storing signatures +``` + +Push the specified image to a local directory as an OCI image: +``` +# podman push --format oci registry.access.redhat.com/rhel7 dir\:rhel7-dir +Getting image source signatures +Copying blob sha256:9cadd93b16ff2a0c51ac967ea2abfadfac50cfa3af8b5bf983d89b8f8647f3e4 + 71.41 MB / 71.41 MB [======================================================] 9s +Copying blob sha256:4aa565ad8b7a87248163ce7dba1dd3894821aac97e846b932ff6b8ef9a8a508a + 1.21 KB / 1.21 KB [========================================================] 0s +Copying config sha256\:f1b09a81455c351eaa484b61aacd048ab613c08e4c5d1da80c4c46301b03cf3b + 3.01 KB / 3.01 KB [========================================================] 0s +Writing manifest to image destination +Storing signatures +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pull(1)](podman-pull.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-remote.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-remote.1.md new file mode 100644 index 000000000..ce4bcd166 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-remote.1.md @@ -0,0 +1,206 @@ +--- +title: podman-remote +version: v5.5.0 +--- + +% podman-remote 1 + +## NAME +podman-remote - A remote CLI for Podman: A Simple management tool for pods, containers and images. + +## SYNOPSIS +**podman-remote** [*options*] *command* + +## DESCRIPTION +Podman (Pod Manager) is a fully featured container engine that is a simple daemonless tool. +Podman provides a Docker-CLI comparable command line that eases the transition from other +container engines and allows the management of pods, containers and images. Simply put: `alias docker=podman`. +Most Podman commands can be run as a regular user, without requiring additional +privileges. + +Podman uses Buildah(1) internally to create container images. Both tools share image +(not container) storage, hence each can use or manipulate images (but not containers) +created by the other. + +Podman-remote provides a local client interacting with a Podman backend node through a RESTful API tunneled through a ssh connection. In this context, a Podman node is a Linux system with Podman installed on it and the API service activated. Credentials for this session can be passed in using flags, environment variables, or in `containers.conf`. + +The `containers.conf` file is placed under `$HOME/.config/containers/containers.conf` on Linux and Mac and `%APPDATA%\containers\containers.conf` on Windows. + +**podman [GLOBAL OPTIONS]** + +## GLOBAL OPTIONS + +#### **--connection**=*name*, **-c** + +Remote connection name + +Overrides environment variable `CONTAINER_CONNECTION` if set. + +#### **--help**, **-h** + +Print usage statement + +#### **--identity**=*path* + +Path to ssh identity file. If the identity file has been encrypted, Podman prompts the user for the passphrase. +If no identity file is provided and no user is given, Podman defaults to the user running the podman command. +Podman prompts for the login password on the remote server. + +Identity value resolution precedence: + - command line value + - environment variable `CONTAINER_SSHKEY`, if `CONTAINER_HOST` is found + - `containers.conf` + +#### **--log-level**=*level* + +Log messages above specified level: debug, info, warn, error (default), fatal or panic + +#### **--url**=*value* + +URL to access Podman service (default from `containers.conf`, rootless "unix:///run/user/$UID/podman/podman.sock" or as root "unix:///run/podman/podman.sock). + + - `CONTAINER_HOST` is of the format `://[]@][:][]` + - `CONTAINER_PROXY` is of the format `://[]@][:]` + +Details: + - `schema` is one of: + * `ssh` (default): a local unix(7) socket on the named `host` and `port`, reachable via SSH + * `tcp`: an unencrypted, unauthenticated TCP connection to the named `host` and `port`, can work with proxy if `CONTAINER_PROXY` is set + * `unix`: a local unix(7) socket at the specified `path`, or the default for the user + - `user` defaults to either `root` or the current running user (`ssh` only) + - `password` has no default (`ssh` only) + - `host` must be provided and is either the IP or name of the machine hosting the Podman service (`ssh` and `tcp`) + - `port` defaults to 22 (`ssh` and `tcp`) + - `path` defaults to either `/run/podman/podman.sock`, or `/run/user/$UID/podman/podman.sock` if running rootless (`unix`), or must be explicitly specified (`ssh`) + - `CONTAINER_PROXY`: use proxy (`socks5` or `socks5h`) to access Podman service (`tcp` only) + +URL value resolution precedence: + - command line value + - environment variable `CONTAINER_HOST` + - `engine.service_destinations` table in containers.conf, excluding the /usr/share/containers directory + - `unix:///run/podman/podman.sock` + +Remote connections use local containers.conf for default. + +Some example URL values in valid formats: + - unix:///run/podman/podman.sock + - unix:///run/user/$UID/podman/podman.sock + - ssh://notroot@localhost:22/run/user/$UID/podman/podman.sock + - ssh://root@localhost:22/run/podman/podman.sock + - tcp://localhost:34451 + - tcp://127.0.0.1:34451 + +#### **--version** + +Print the version + +## Environment Variables + +Podman can set up environment variables from env of [engine] table in containers.conf. These variables can be overridden by passing environment variables before the `podman` commands. + +#### **CONTAINERS_CONF** + +Set default locations of containers.conf file + +#### **CONTAINER_CONNECTION** + +Set default `--connection` value to access Podman service. + +#### **CONTAINER_HOST** + +Set default `--url` value to access Podman service. + +#### **CONTAINER_SSHKEY** + +Set default `--identity` path to ssh key file value used to access Podman service. + +## Exit Status + +The exit code from `podman` gives information about why the container +failed to run or why it exited. When `podman` commands exit with a non-zero code, +the exit codes follow the `chroot` standard, see below: + + **125** The error is with podman itself + + $ podman run --foo busybox; echo $? + Error: unknown flag: --foo + 125 + + **126** Executing a _contained command_ and the _command_ cannot be invoked + + $ podman run busybox /etc; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error + 126 + + **127** Executing a _contained command_ and the _command_ cannot be found + $ podman run busybox foo; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error + 127 + + **Exit code** _contained command_ exit code + + $ podman run busybox /bin/sh -c 'exit 3'; echo $? + 3 + + +## COMMANDS + +| Command | Description | +| ------------------------------------------------ | --------------------------------------------------------------------------- | +| [podman-attach(1)](podman-attach.1.md) | Attach to a running container. | +| [podman-build(1)](podman-build.1.md) | Build a container image using a Dockerfile. | +| [podman-commit(1)](podman-commit.1.md) | Create new image based on the changed container. | +| [podman-container(1)](podman-container.1.md) | Manage containers. | +| [podman-cp(1)](podman-cp.1.md) | Copy files/folders between a container and the local filesystem. | +| [podman-create(1)](podman-create.1.md) | Create a new container. | +| [podman-diff(1)](podman-diff.1.md) | Inspect changes on a container or image's filesystem. | +| [podman-events(1)](podman-events.1.md) | Monitor Podman events | +| [podman-export(1)](podman-export.1.md) | Export a container's filesystem contents as a tar archive. | +| [podman-generate(1)](podman-generate.1.md) | Generate structured data based on containers and pods. | +| [podman-healthcheck(1)](podman-healthcheck.1.md) | Manage healthchecks for containers | +| [podman-history(1)](podman-history.1.md) | Show the history of an image. | +| [podman-image(1)](podman-image.1.md) | Manage images. | +| [podman-images(1)](podman-images.1.md) | List images in local storage. | +| [podman-import(1)](podman-import.1.md) | Import a tarball and save it as a filesystem image. | +| [podman-info(1)](podman-info.1.md) | Display Podman related system information. | +| [podman-init(1)](podman-init.1.md) | Initialize a container | +| [podman-inspect(1)](podman-inspect.1.md) | Display a container or image's configuration. | +| [podman-kill(1)](podman-kill.1.md) | Kill the main process in one or more containers. | +| [podman-load(1)](podman-load.1.md) | Load an image from a container image archive into container storage. | +| [podman-logs(1)](podman-logs.1.md) | Display the logs of a container. | +| [podman-pause(1)](podman-pause.1.md) | Pause one or more containers. | +| [podman-pod(1)](podman-pod.1.md) | Management tool for groups of containers, called pods. | +| [podman-port(1)](podman-port.1.md) | List port mappings for a container. | +| [podman-ps(1)](podman-ps.1.md) | Print out information about containers. | +| [podman-pull(1)](podman-pull.1.md) | Pull an image from a registry. | +| [podman-push(1)](podman-push.1.md) | Push an image from local storage to elsewhere. | +| [podman-restart(1)](podman-restart.1.md) | Restart one or more containers. | +| [podman-rm(1)](podman-rm.1.md) | Remove one or more containers. | +| [podman-rmi(1)](podman-rmi.1.md) | Remove one or more locally stored images. | +| [podman-run(1)](podman-run.1.md) | Run a command in a new container. | +| [podman-save(1)](podman-save.1.md) | Save an image to a container archive. | +| [podman-start(1)](podman-start.1.md) | Start one or more containers. | +| [podman-stop(1)](podman-stop.1.md) | Stop one or more running containers. | +| [podman-system(1)](podman-system.1.md) | Manage podman. | +| [podman-tag(1)](podman-tag.1.md) | Add an additional name to a local image. | +| [podman-top(1)](podman-top.1.md) | Display the running processes of a container. | +| [podman-unpause(1)](podman-unpause.1.md) | Unpause one or more containers. | +| [podman-version(1)](podman-version.1.md) | Display the Podman version information. | +| [podman-volume(1)](podman-volume.1.md) | Manage Volumes. | +## FILES + +**containers.conf** (`$HOME/.config/containers/containers.conf`) + +Podman has builtin defaults for command line options. These defaults can be overridden using the containers.conf configuration files. + +Users can modify defaults by creating the `$HOME/.config/containers/containers.conf` file. Podman merges its builtin defaults with the specified fields from this file, if it exists. Fields specified in the users file override the built-in defaults. + +Podman uses builtin defaults if no containers.conf file is found. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system-service(1)](podman-system-service.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-rename.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-rename.1.md new file mode 100644 index 000000000..5b5e1c330 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-rename.1.md @@ -0,0 +1,43 @@ +--- +title: podman-rename +version: v5.5.0 +--- + +% podman-rename 1 + +## NAME +podman\-rename - Rename an existing container + +## SYNOPSIS +**podman rename** *container* *newname* + +**podman container rename** *container* *newname* + +## DESCRIPTION +Rename changes the name of an existing container. +The old name is freed, and is available for use. +This command can be run on containers in any state. +However, running containers may not fully receive the effects until they are restarted - for example, a running container may still use the old name in its logs. +At present, only containers are supported; pods and volumes cannot be renamed. + +## OPTIONS + +## EXAMPLES + +Rename container with a given name. +``` +$ podman rename oldContainer aNewName +``` + +Rename container with a given ID. +``` +$ podman rename 717716c00a6b testcontainer +``` + +Create an alias for container with a given ID. +``` +$ podman container rename 6e7514b47180 databaseCtr +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-restart.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-restart.1.md new file mode 100644 index 000000000..22ff9bfff --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-restart.1.md @@ -0,0 +1,121 @@ +--- +title: podman-restart +version: v5.5.0 +--- + +% podman-restart 1 + +## NAME +podman\-restart - Restart one or more containers + +## SYNOPSIS +**podman restart** [*options*] *container* ... + +**podman container restart** [*options*] *container* ... + +## DESCRIPTION +The restart command allows containers to be restarted using their ID or name. +Running containers are stopped and restarted. Stopped containers are started. + +## OPTIONS + +#### **--all**, **-a** + +Restart all containers regardless of their current state. + +#### **--cidfile** + +Read container ID from the specified file and restart the container. Can be specified multiple times. + +#### **--filter**, **-f**=*filter* + +Filter what containers restart. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--running** + +Restart all containers that are already in the *running* state. + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping the container. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +## EXAMPLES + +Restart the latest container. +``` +$ podman restart -l +ec588fc80b05e19d3006bf2e8aa325f0a2e2ff1f609b7afb39176ca8e3e13467 +``` + +Restart a specific container by partial container ID. +``` +$ podman restart ff6cf1 +ff6cf1e5e77e6dba1efc7f3fcdb20e8b89ad8947bc0518be1fcb2c78681f226f +``` + +Restart two containers by name with a timeout of 4 seconds. +``` +$ podman restart --time 4 test1 test2 +c3bb026838c30e5097f079fa365c9a4769d52e1017588278fa00d5c68ebc1502 +17e13a63081a995136f907024bcfe50ff532917988a152da229db9d894c5a9ec +``` + +Restart all running containers. +``` +$ podman restart --running +``` + +Restart all containers. +``` +$ podman restart --all +``` + +Restart container using ID specified in a given files. +``` +$ podman restart --cidfile /home/user/cidfile-1 +$ podman restart --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +March 2018, Originally compiled by Matt Heon diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-rm.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-rm.1.md new file mode 100644 index 000000000..82f02dc71 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-rm.1.md @@ -0,0 +1,163 @@ +--- +title: podman-rm +version: v5.5.0 +--- + +% podman-rm 1 + +## NAME +podman\-rm - Remove one or more containers + +## SYNOPSIS +**podman rm** [*options*] *container* + +**podman container rm** [*options*] *container* + +## DESCRIPTION +**podman rm** removes one or more containers from the host. The container name or ID can be used. This does not remove images. +Running or unusable containers are not removed without the **-f** option. + +## OPTIONS + +#### **--all**, **-a** + +Remove all containers. Can be used in conjunction with **-f** as well. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and rm the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + +Command does not fail when *file* is missing and user specified --ignore. + +#### **--depend** + +Remove selected container and recursively remove all containers that depend on it. + +#### **--filter**=*filter* + +Filter what containers remove. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + +#### **--force**, **-f** + +Force the removal of running and paused containers. Forcing a container removal also +removes containers from container storage even if the container is not known to Podman. +For example, containers that are created by different container engines like Buildah. +In addition, forcing can be used to remove unusable containers, e.g. containers +whose OCI runtime has become unavailable. + + +[//]: # (BEGIN included file options/ignore.md) +#### **--ignore**, **-i** + +Ignore errors when specified containers are not in the container store. A user +might have decided to manually remove a container which leads to a failure +during the ExecStop directive of a systemd service referencing that container. + +[//]: # (END included file options/ignore.md) +Further ignore when the specified `--cidfile` does not exist as it may have +already been removed along with the container. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping the container. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +The --force option must be specified to use the --time option. + +#### **--volumes**, **-v** + +Remove anonymous volumes associated with the container. This does not include named volumes +created with **podman volume create**, or the **--volume** option of **podman run** and **podman create**. + +## EXAMPLE +Remove container with a given name: +``` +$ podman rm mywebserver +``` + +Remove container with a given name and all of the containers that depend on it: +``` +$ podman rm --depend mywebserver +``` + +Remove multiple containers with given names or IDs: +``` +$ podman rm mywebserver myflaskserver 860a4b23 +``` + +Remove multiple containers with IDs read from files: +``` +$ podman rm --cidfile ./cidfile-1 --cidfile /home/user/cidfile-2 +``` + +Forcibly remove container with a given ID: +``` +$ podman rm -f 860a4b23 +``` + +Remove all containers regardless of the run state: +``` +$ podman rm -f -a +``` + +Forcibly remove the last created container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +$ podman rm -f --latest +``` + +## Exit Status + **0** All specified containers removed + + **1** One of the specified containers did not exist, and no other failures + + **2** One of the specified containers is paused or running + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +August 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-rmi.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-rmi.1.md new file mode 100644 index 000000000..2bd845f9c --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-rmi.1.md @@ -0,0 +1,81 @@ +--- +title: podman-rmi +version: v5.5.0 +--- + +% podman-rmi 1 + +## NAME +podman\-rmi - Remove one or more locally stored images + +## SYNOPSIS +**podman rmi** [*options*] *image* [...] + +**podman image rm** [*options*] *image* [...] + +## DESCRIPTION +Removes one or more locally stored images. +Passing an argument _image_ deletes it, along with any of its dangling parent images. A dangling image is an image without a tag and without being referenced by another image. + +Note: To delete an image from a remote registry, use the [**skopeo delete**](https://github.com/containers/skopeo/blob/main/docs/skopeo-delete.1.md) command. Some registries do not allow users to delete an image via a CLI remotely. + +## OPTIONS + +#### **--all**, **-a** + +Remove all images in the local storage. + +#### **--force**, **-f** + +This option causes Podman to remove all containers that are using the image before removing the image from the system. + +#### **--ignore**, **-i** + +If a specified image does not exist in the local storage, ignore it and do not throw an error. + +#### **--no-prune** + +This option does not remove dangling parents of the specified image. + +Remove an image by its short ID +``` +$ podman rmi c0ed59d05ff7 +``` +Remove an image and its associated containers. +``` +$ podman rmi --force imageID +``` + +Remove multiple images by their shortened IDs. +``` +$ podman rmi c4dfb1609ee2 93fd78260bd1 c0ed59d05ff7 +``` + +Remove all images and containers. +``` +$ podman rmi -a -f +``` + +Remove an absent image with and without the `--ignore` flag. +``` +$ podman rmi --ignore nothing +$ podman rmi nothing +Error: nothing: image not known + +``` + + +## Exit Status + **0** All specified images removed + + **1** One of the specified images did not exist, and no other failures + + **2** One of the specified images has child images or is being used by a container + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[skopeo-delete(1)](https://github.com/containers/skopeo/blob/main/docs/skopeo-delete.1.md)** + +## HISTORY +March 2017, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-rootless.7.md b/versioned_docs/version-5.5.0/source/markdown/podman-rootless.7.md new file mode 100644 index 000000000..710eccd2c --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-rootless.7.md @@ -0,0 +1,54 @@ +--- +title: Shortcomings of Rootless Podman +version: v5.5.0 +--- + +% podman-rootless 7 + +# Shortcomings of Rootless Podman + +The following list categorizes the known issues and irregularities with running Podman as a non-root user. Although currently functional, there is still a number of work items that are under consideration to be added. These proposed changes are in varying degrees of design and development. + +Contributors are more than welcomed to help with this work. If you decide to carve off a piece and work on it, please create an issue in [GitHub](https://github.com/containers/podman/issues), and assign it to yourself. If you find other unexpected behavior with rootless Podman and feel it’s warranted, please feel free to update this document. + +* Podman can not create containers that bind to ports < 1024. + * The kernel does not allow processes without CAP_NET_BIND_SERVICE to bind to low ports. + * You can modify the `net.ipv4.ip_unprivileged_port_start` sysctl to change the lowest port. For example `sysctl net.ipv4.ip_unprivileged_port_start=443` allows rootless Podman containers to bind to ports >= 443. + * A proxy server, kernel firewall rule, or redirection tool such as [redir](https://github.com/troglobit/redir) may be used to redirect traffic from a privileged port to an unprivileged one (where a podman pod is bound) in a server scenario - where a user has access to the root account (or setuid on the binary would be an acceptable risk), but wants to run the containers as an unprivileged user for enhanced security and for a limited number of pre-known ports. +* As of Podman 5.0, pasta is the default networking tool. Since pasta copies the IP address of the main interface, connections to that IP from containers do not work. This means that unless you have more than one interface, inter-container connections cannot be made without explicitly passing a pasta network configuration, either in `containers.conf` or at runtime. + * If you previously had port forwards (ex. via -p 80:80) that other containers could access, you can either revert back to slirp4netns or use the solution (setting pasta options with 10.0.2.x IPs) posted [here](https://blog.podman.io/2024/03/podman-5-0-breaking-changes-in-detail/). +* “How To” documentation is patchy at best. +* If /etc/subuid and /etc/subgid are not set up for a user, then podman commands +can easily fail + * This can be a big issue on machines using Network Based Password information (FreeIPA, Active Directory, LDAP) + * We are working to get support for NSSWITCH on the /etc/subuid and /etc/subgid files. +* No cgroup V1 Support + * cgroup V1 does not safely support cgroup delegation. + * As of Fedora 31 defaults to cgroup V2, which has full support of rootless cgroup management. Note this requires the --cgroup-manager within rootless containers to use systemd, which new containers will get by default. +* Some system unit configuration options do not work in the rootless container + * systemd fails to apply several options and failures are silently ignored (e.g. CPUShares, MemoryLimit). Should work on cgroup V2. + * Use of certain options will cause service startup failures (e.g. PrivateNetwork). The systemd services requiring `PrivateNetwork` can be made to work by passing `--cap-add SYS_ADMIN`, but the security implications should be carefully evaluated. In most cases, it's better to create an override.conf drop-in that sets `PrivateNetwork=no`. This also applies to containers run by root. +* Can not share container images with CRI-O or other rootful users +* Difficult to use additional stores for sharing content +* Does not work on NFS or parallel filesystem homedirs (e.g. [GPFS](https://www.ibm.com/support/knowledgecenter/en/SSFKCN/gpfs_welcome.html)) + * NFS and parallel filesystems enforce file creation on different UIDs on the server side and does not understand User Namespace. + * When a container root process like YUM attempts to create a file owned by a different UID, NFS Server/GPFS denies the creation. +* Does not work with homedirs mounted with noexec/nodev + * User can set up storage to point to other directories they can write to that are not mounted noexec/nodev +* Support for using native overlayfs as an unprivileged user is only available for Podman version >= 3.1 on a Linux kernel version >= 5.12, otherwise the slower _fuse-overlayfs_ may be used. + * A few Linux distributions (e.g. Ubuntu) have supported even older Podman and Linux kernel versions by modifying the normal Linux kernel behaviour. +* Only other supported driver is VFS. +* Cannot use ping out of the box. + * [(Can be fixed by setting sysctl on host)](https://github.com/containers/podman/blob/main/troubleshooting.md#5-rootless-containers-cannot-ping-hosts) +* Requires new shadow-utils (not found in older (RHEL7/Centos7 distros) Should be fixed in RHEL7.7 release) +* A few commands do not work. + * mount/unmount (on fuse-overlay) + * Only works if you enter the mount namespace with podman unshare + * podman stats (Works with cgroup V2 support) + * Checkpoint and Restore (CRIU requires root) + * Pause and Unpause (Works with cgroup V2 support) +* Issues with higher UIDs can cause builds to fail + * If a build is attempting to use a UID that is not mapped into the user namespace mapping for a container, then builds will not be able to put the UID in an image. +* Making device nodes within a container fails, even when running --privileged. + * The kernel does not allow non root user processes (processes without CAP_MKNOD) to create device nodes. If a container needs to create device nodes, it must be run as root. +* When using --net=host with rootless containers, subsequent podman execs to that container will not join the host network namespace because it is owned by root. diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-run.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-run.1.md new file mode 100644 index 000000000..24fb97bff --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-run.1.md @@ -0,0 +1,3314 @@ +--- +title: podman-run +version: v5.5.0 +--- + +% podman-run 1 + +## NAME +podman\-run - Run a command in a new container + +## SYNOPSIS +**podman run** [*options*] *image* [*command* [*arg* ...]] + +**podman container run** [*options*] *image* [*command* [*arg* ...]] + +## DESCRIPTION + +Run a process in a new container. **podman run** starts a process with its own +file system, its own networking, and its own isolated process tree. The _image_ +which starts the process may define defaults related to the process that will be +run in the container, the networking to expose, and more, but **podman run** +gives final control to the operator or administrator who starts the container +from the image. For that reason **podman run** has more options than any other +Podman command. + +If the _image_ is not already loaded then **podman run** will pull the _image_, and +all image dependencies, from the repository in the same way running **podman +pull** _image_, before it starts the container from that image. + +Several files will be automatically created within the container. These include +_/etc/hosts_, _/etc/hostname_, and _/etc/resolv.conf_ to manage networking. +These will be based on the host's version of the files, though they can be +customized with options (for example, **--dns** will override the host's DNS +servers in the created _resolv.conf_). Additionally, a container environment +file is created in each container to indicate to programs they are running in a +container. This file is located at _/run/.containerenv_ (or +_/var/run/.containerenv_ for FreeBSD containers). When using the +--privileged flag the .containerenv contains name/value pairs indicating the +container engine version, whether the engine is running in rootless mode, the +container name and ID, as well as the image name and ID that the container is based on. Note: _/run/.containerenv_ will not be created when a volume is mounted on /run. + +When running from a user defined network namespace, the _/etc/netns/NSNAME/resolv.conf_ +will be used if it exists, otherwise _/etc/resolv.conf_ will be used. + +Default settings are defined in `containers.conf`. Most settings for remote +connections use the servers containers.conf, except when documented in man +pages. + +## IMAGE + + The image is specified using transport\:path format. If no transport is specified, the `docker` (container registry) +transport is used by default. For remote Podman, including Mac and Windows (excluding WSL2) machines, `docker` is the only allowed transport. + + **dir:**_path_ + An existing local directory _path_ storing the manifest, layer tarballs and signatures as individual files. This +is a non-standardized format, primarily useful for debugging or noninvasive container inspection. + + $ podman save --format docker-dir fedora -o /tmp/fedora + $ podman run dir:/tmp/fedora echo hello + + **docker://**_docker-reference_ (Default) + An image reference stored in a remote container image registry. Example: "quay.io/podman/stable:latest". +The reference can include a path to a specific registry; if it does not, the +registries listed in registries.conf are queried to find a matching image. +By default, credentials from `podman login` (stored at +$XDG_RUNTIME_DIR/containers/auth.json by default) are used to authenticate; +otherwise it falls back to using credentials in $HOME/.docker/config.json. + + $ podman run registry.fedoraproject.org/fedora\:latest echo hello + + **docker-archive:**_path_[**:**_docker-reference_] +An image stored in the `docker save` formatted file. _docker-reference_ is only used when creating such a +file, and it must not contain a digest. + + $ podman save --format docker-archive fedora -o /tmp/fedora + $ podman run docker-archive:/tmp/fedora echo hello + + **docker-daemon:**_docker-reference_ + An image in _docker-reference_ format stored in the docker daemon internal storage. The _docker-reference_ can also be an image ID (docker-daemon\:algo\:digest). + + $ sudo docker pull fedora + $ sudo podman run docker-daemon\:docker.io/library/fedora echo hello + + **oci-archive:**_path_**:**_tag_ + An image in a directory compliant with the "Open Container Image Layout Specification" at the specified _path_ +and specified with a _tag_. + + $ podman save --format oci-archive fedora -o /tmp/fedora + $ podman run oci-archive:/tmp/fedora echo hello + +## OPTIONS + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the container's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + + +[//]: # (BEGIN included file options/annotation.container.md) +#### **--annotation**=*key=value* + +Add an annotation to the container. This option can be set multiple times. + +[//]: # (END included file options/annotation.container.md) + + +[//]: # (BEGIN included file options/arch.md) +#### **--arch**=*ARCH* +Override the architecture, defaults to hosts, of the image to be pulled. For example, `arm`. +Unless overridden, subsequent lookups of the same image in the local storage matches this architecture, regardless of the host. + +[//]: # (END included file options/arch.md) + + +[//]: # (BEGIN included file options/attach.md) +#### **--attach**, **-a**=*stdin* | *stdout* | *stderr* + +Attach to STDIN, STDOUT or STDERR. + +In foreground mode (the default when **-d** +is not specified), **podman run** can start the process in the container +and attach the console to the process's standard input, output, and +error. It can even pretend to be a TTY (this is what most command-line +executables expect) and pass along signals. The **-a** option can be set for +each of **stdin**, **stdout**, and **stderr**. + +[//]: # (END included file options/attach.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cap-add.md) +#### **--cap-add**=*capability* + +Add Linux capabilities. + +Granting additional capabilities increases the privileges of the +processes running inside the container and potentially allow it to +break out of confinement. Capabilities like `CAP_SYS_ADMIN`, +`CAP_SYS_PTRACE`, `CAP_MKNOD` and `CAP_SYS_MODULE` are particularly +dangerous when they are not used within a user namespace. Please +refer to **user_namespaces(7)** for a more detailed explanation of the +interaction between user namespaces and capabilities. + +Before adding any capability, review its security implications and +ensure it is really necessary for the container’s functionality. See +**capabilities(7)** for more information. + +[//]: # (END included file options/cap-add.md) + + +[//]: # (BEGIN included file options/cap-drop.md) +#### **--cap-drop**=*capability* + +Drop Linux capabilities. + +[//]: # (END included file options/cap-drop.md) + + +[//]: # (BEGIN included file options/cgroup-conf.md) +#### **--cgroup-conf**=*KEY=VALUE* + +When running on cgroup v2, specify the cgroup file to write to and its value. For example **--cgroup-conf=memory.high=1073741824** sets the memory.high limit to 1GB. + +[//]: # (END included file options/cgroup-conf.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the container is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cgroupns.md) +#### **--cgroupns**=*mode* + +Set the cgroup namespace mode for the container. + +- **host**: use the host's cgroup namespace inside the container. +- **container:**_id_: join the namespace of the specified container. +- **private**: create a new cgroup namespace. +- **ns:**_path_: join the namespace at the specified path. + +If the host uses cgroups v1, the default is set to **host**. On cgroups v2, the default is **private**. + +[//]: # (END included file options/cgroupns.md) + + +[//]: # (BEGIN included file options/cgroups.md) +#### **--cgroups**=*how* + +Determines whether the container creates CGroups. + +Default is **enabled**. + +The **enabled** option creates a new cgroup under the cgroup-parent. +The **disabled** option forces the container to not create CGroups, and thus conflicts with CGroup options (**--cgroupns** and **--cgroup-parent**). +The **no-conmon** option disables a new CGroup only for the **conmon** process. +The **split** option splits the current CGroup in two sub-cgroups: one for conmon and one for the container payload. It is not possible to set **--cgroup-parent** with **split**. + +[//]: # (END included file options/cgroups.md) + + +[//]: # (BEGIN included file options/chrootdirs.md) +#### **--chrootdirs**=*path* + +Path to a directory inside the container that is treated as a `chroot` directory. +Any Podman managed file (e.g., /etc/resolv.conf, /etc/hosts, etc/hostname) that is mounted into the root directory is mounted into that location as well. +Multiple directories are separated with a comma. + +[//]: # (END included file options/chrootdirs.md) + + +[//]: # (BEGIN included file options/cidfile.write.md) +#### **--cidfile**=*file* + +Write the container ID to *file*. The file is removed along with the container, except +when used with podman --remote run on detached containers. + +[//]: # (END included file options/cidfile.write.md) + + +[//]: # (BEGIN included file options/conmon-pidfile.md) +#### **--conmon-pidfile**=*file* + +Write the pid of the **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to restart Podman containers. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/conmon-pidfile.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-rt-period.md) +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-period.md) + + +[//]: # (BEGIN included file options/cpu-rt-runtime.md) +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-runtime.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpus.container.md) +#### **--cpus**=*number* + +Number of CPUs. The default is *0.0* which means no limit. This is shorthand +for **--cpu-period** and **--cpu-quota**, therefore the option cannot be specified with +**--cpu-period** or **--cpu-quota**. + +On some systems, changing the CPU limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpus.container.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + +#### **--detach**, **-d** + +Detached mode: run the container in the background and print the new container ID. The default is *false*. + +At any time run **podman ps** in +the other shell to view a list of the running containers. Reattach to a +detached container with **podman attach** command. + +When attached via tty mode, detach from the container (and leave it +running) using a configurable key sequence. The default sequence is `ctrl-p,ctrl-q`. +Specify the key sequence using the **--detach-keys** option, or configure +it in the **containers.conf** file: see **containers.conf(5)** for more information. + + +[//]: # (BEGIN included file options/detach-keys.md) +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. + +[//]: # (END included file options/detach-keys.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the container. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The container only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: if the user only has access rights via a group, accessing the device +from inside a rootless container fails. Use the `--group-add keep-groups` +flag to pass the user's supplementary group access into the container. + + +[//]: # (BEGIN included file options/device-cgroup-rule.md) +#### **--device-cgroup-rule**=*"type major\:minor mode"* + +Add a rule to the cgroup allowed devices list. The rule is expected to be +in the format specified in the Linux kernel documentation +[admin-guide/cgroup-v1/devices](https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.html): +- *type*: `a` (all), `c` (char), or `b` (block); +- *major* and *minor*: either a number, or `*` for all; +- *mode*: a composition of `r` (read), `w` (write), and `m` (mknod(2)). + +[//]: # (END included file options/device-cgroup-rule.md) + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-read-iops.md) +#### **--device-read-iops**=*path:rate* + +Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-iops.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + + +[//]: # (BEGIN included file options/device-write-iops.md) +#### **--device-write-iops**=*path:rate* + +Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-iops.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + + +[//]: # (BEGIN included file options/dns.md) +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. + +[//]: # (END included file options/dns.md) + +This option cannot be combined with **--network** that is set to **none** or **container:**_id_. + + +[//]: # (BEGIN included file options/dns-option.container.md) +#### **--dns-option**=*option* + +Set custom DNS options. Invalid if using **--dns-option** with **--network** that is set to **none** or **container:**_id_. + +[//]: # (END included file options/dns-option.container.md) + + +[//]: # (BEGIN included file options/dns-search.container.md) +#### **--dns-search**=*domain* + +Set custom DNS search domains. Invalid if using **--dns-search** with **--network** that is set to **none** or **container:**_id_. +Use **--dns-search=.** to remove the search domain. + +[//]: # (END included file options/dns-search.container.md) + + +[//]: # (BEGIN included file options/entrypoint.md) +#### **--entrypoint**=*"command"* | *'["command", "arg1", ...]'* + +Override the default ENTRYPOINT from the image. + +The ENTRYPOINT of an image is similar to a COMMAND +because it specifies what executable to run when the container starts, but it is +(purposely) more difficult to override. The ENTRYPOINT gives a container its +default nature or behavior. When the ENTRYPOINT is set, the +container runs as if it were that binary, complete with default options. More options can be +passed in via the COMMAND. But, if a user wants to run +something else inside the container, the **--entrypoint** option allows a new +ENTRYPOINT to be specified. + +Specify multi option commands in the form of a JSON string. + +[//]: # (END included file options/entrypoint.md) + + +[//]: # (BEGIN included file options/env.md) +#### **--env**, **-e**=*env* + +Set environment variables. + +This option allows arbitrary environment variables that are available for the process to be launched inside of the container. If an environment variable is specified without a value, Podman checks the host environment for a value and set the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the container. + +[//]: # (END included file options/env.md) + +See [**Environment**](#environment) note below for precedence and examples. + + +[//]: # (BEGIN included file options/env-file.md) +#### **--env-file**=*file* + +Read in a line-delimited file of environment variables. + +[//]: # (END included file options/env-file.md) + +See [**Environment**](#environment) note below for precedence and examples. + + +[//]: # (BEGIN included file options/env-host.md) +#### **--env-host** + +Use host environment inside of the container. See **Environment** note below for precedence. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/env-host.md) + + +[//]: # (BEGIN included file options/env-merge.md) +#### **--env-merge**=*env* + +Preprocess default environment variables for the containers. For example +if image contains environment variable `hello=world` user can preprocess +it using `--env-merge hello=${hello}-some` so new value is `hello=world-some`. + +Please note that if the environment variable `hello` is not present in the image, +then it'll be replaced by an empty string and so using `--env-merge hello=${hello}-some` +would result in the new value of `hello=-some`, notice the leading `-` delimiter. + +[//]: # (END included file options/env-merge.md) + + +[//]: # (BEGIN included file options/expose.md) +#### **--expose**=*port[/protocol]* + +Expose a port or a range of ports (e.g. **--expose=3300-3310**). +The protocol can be `tcp`, `udp` or `sctp` and if not given `tcp` is assumed. +This option matches the EXPOSE instruction for image builds and has no effect on +the actual networking rules unless **-P/--publish-all** is used to forward to all +exposed ports from random host ports. To forward specific ports from the host +into the container use the **-p/--publish** option instead. + +[//]: # (END included file options/expose.md) + + +[//]: # (BEGIN included file options/gidmap.container.md) +#### **--gidmap**=*[flags]container_uid\:from_uid[\:amount]* + +Run the container in a new user namespace using the supplied GID mapping. This +option conflicts with the **--userns** and **--subgidname** options. This +option provides a way to map host GIDs to container GIDs in the same way as +__--uidmap__ maps host UIDs to container UIDs. For details see __--uidmap__. + +Note: the **--gidmap** option cannot be called in conjunction with the **--pod** option as a gidmap cannot be set on the container level when in a pod. + +[//]: # (END included file options/gidmap.container.md) + + +[//]: # (BEGIN included file options/gpus.md) +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. + +[//]: # (END included file options/gpus.md) + + +[//]: # (BEGIN included file options/group-add.md) +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/group-add.md) + + +[//]: # (BEGIN included file options/group-entry.md) +#### **--group-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/group` file within the container when `--user` is used. + +The variables $GROUPNAME, $GID, and $USERLIST are automatically replaced with their value at runtime if present. + +[//]: # (END included file options/group-entry.md) + + +[//]: # (BEGIN included file options/health-cmd.md) +#### **--health-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set or alter a healthcheck command for a container. The command is a command to be executed inside the +container that determines the container health. The command is required for other healthcheck options +to be applied. A value of **none** disables existing healthchecks. + +Multiple options can be passed in the form of a JSON array; otherwise, the command is interpreted +as an argument to **/bin/sh -c**. + +Note: The default values are used even if healthcheck is configured in the image. + +[//]: # (END included file options/health-cmd.md) + + +[//]: # (BEGIN included file options/health-interval.md) +#### **--health-interval**=*interval* + +Set an interval for the healthchecks. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-interval.md) + + +[//]: # (BEGIN included file options/health-log-destination.md) +#### **--health-log-destination**=*directory_path* + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) (Default: local) + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. + +[//]: # (END included file options/health-log-destination.md) + + +[//]: # (BEGIN included file options/health-max-log-count.md) +#### **--health-max-log-count**=*number of stored logs* + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) (Default: 5 attempts) + +[//]: # (END included file options/health-max-log-count.md) + + +[//]: # (BEGIN included file options/health-max-log-size.md) +#### **--health-max-log-size**=*size of stored logs* + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) (Default: 500 characters) + +[//]: # (END included file options/health-max-log-size.md) + + +[//]: # (BEGIN included file options/health-on-failure.md) +#### **--health-on-failure**=*action* + +Action to take once the container transitions to an unhealthy state. The default is **none**. + +- **none**: Take no action. +- **kill**: Kill the container. +- **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. +- **stop**: Stop the container. + +[//]: # (END included file options/health-on-failure.md) + + +[//]: # (BEGIN included file options/health-retries.md) +#### **--health-retries**=*retries* + +The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is **3**. + +Note: This parameter can overwrite the healthcheck configuration from the image. + +[//]: # (END included file options/health-retries.md) + + +[//]: # (BEGIN included file options/health-start-period.md) +#### **--health-start-period**=*period* + +The initialization time needed for a container to bootstrap. The value can be expressed in time format like +**2m3s**. The default value is **0s**. + +Note: The health check command is executed as soon as a container is started, if the health check is successful +the container's health state will be updated to `healthy`. However, if the health check fails, the health state will +stay as `starting` until either the health check is successful or until the `--health-start-period` time is over. If the +health check command fails after the `--health-start-period` time is over, the health state will be updated to `unhealthy`. +The health check command is executed periodically based on the value of `--health-interval`. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-start-period.md) + + +[//]: # (BEGIN included file options/health-startup-cmd.md) +#### **--health-startup-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set a startup healthcheck command for a container. This command is executed inside the container and is used to gate the regular +healthcheck. When the startup command succeeds, the regular healthcheck begins and the startup healthcheck ceases. Optionally, +if the command fails for a set number of attempts, the container is restarted. A startup healthcheck can be used to ensure that +containers with an extended startup period are not marked as unhealthy until they are fully started. Startup healthchecks can only be +used when a regular healthcheck (from the container's image or the **--health-cmd** option) is also set. + +[//]: # (END included file options/health-startup-cmd.md) + + +[//]: # (BEGIN included file options/health-startup-interval.md) +#### **--health-startup-interval**=*interval* + +Set an interval for the startup healthcheck. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-startup-interval.md) + + +[//]: # (BEGIN included file options/health-startup-retries.md) +#### **--health-startup-retries**=*retries* + +The number of attempts allowed before the startup healthcheck restarts the container. If set to **0**, the container is never restarted. The default is **0**. + +[//]: # (END included file options/health-startup-retries.md) + + +[//]: # (BEGIN included file options/health-startup-success.md) +#### **--health-startup-success**=*retries* + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value +of **0** means that any success begins the regular healthcheck. The default is **0**. + +[//]: # (END included file options/health-startup-success.md) + + +[//]: # (BEGIN included file options/health-startup-timeout.md) +#### **--health-startup-timeout**=*timeout* + +The maximum time a startup healthcheck command has to complete before it is marked as failed. The value can be expressed in a time +format like **2m3s**. The default value is **30s**. + +[//]: # (END included file options/health-startup-timeout.md) + + +[//]: # (BEGIN included file options/health-timeout.md) +#### **--health-timeout**=*timeout* + +The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the +value can be expressed in a time format such as **1m22s**. The default value is **30s**. + +Note: A timeout marks the healthcheck as failed but does not terminate the running process. +This ensures that a slow but eventually successful healthcheck does not disrupt the container +but is still accounted for in the health status. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-timeout.md) + +#### **--help** + +Print usage statement + + +[//]: # (BEGIN included file options/hostname.container.md) +#### **--hostname**, **-h**=*name* + +Set the container's hostname inside the container. + +This option can only be used with a private UTS namespace `--uts=private` +(default). If `--pod` is given and the pod shares the same UTS namespace +(default), the pod's hostname is used. The given hostname is also added to the +`/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). + +[//]: # (END included file options/hostname.container.md) + + +[//]: # (BEGIN included file options/hosts-file.md) +#### **--hosts-file**=*path* | *none* | *image* + +Base file to create the `/etc/hosts` file inside the container. This must either +be an absolute path to a file on the host system, or one of the following +special flags: + "" Follow the `base_hosts_file` configuration in _containers.conf_ (the default) + `none` Do not use a base file (i.e. start with an empty file) + `image` Use the container image's `/etc/hosts` file as base file + +[//]: # (END included file options/hosts-file.md) + + +[//]: # (BEGIN included file options/hostuser.md) +#### **--hostuser**=*name* + +Add a user account to /etc/passwd from the host to the container. The Username +or UID must exist on the host system. + +[//]: # (END included file options/hostuser.md) + + +[//]: # (BEGIN included file options/http-proxy.md) +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. + +[//]: # (END included file options/http-proxy.md) + + +[//]: # (BEGIN included file options/image-volume.md) +#### **--image-volume**=**bind** | *tmpfs* | *ignore* + +Tells Podman how to handle the builtin image volumes. Default is **bind**. + +- **bind**: An anonymous named volume is created and mounted into the container. +- **tmpfs**: The volume is mounted onto the container as a tmpfs, which allows the users to create +content that disappears when the container is stopped. +- **ignore**: All volumes are just ignored and no action is taken. + +[//]: # (END included file options/image-volume.md) + + +[//]: # (BEGIN included file options/init.md) +#### **--init** + +Run an init inside the container that forwards signals and reaps processes. +The container-init binary is mounted at `/run/podman-init`. +Mounting over `/run` breaks container execution. + +[//]: # (END included file options/init.md) + + +[//]: # (BEGIN included file options/init-path.md) +#### **--init-path**=*path* + +Path to the container-init binary. + +[//]: # (END included file options/init-path.md) + + +[//]: # (BEGIN included file options/interactive.md) +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. + +[//]: # (END included file options/interactive.md) + + +[//]: # (BEGIN included file options/ip.md) +#### **--ip**=*ipv4* + +Specify a static IPv4 address for the container, for example **10.88.64.128**. +This option can only be used if the container is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IP address pool (default **10.88.0.0/16**). + +To specify multiple static IP addresses per container, set multiple networks using the **--network** option with a static IP address specified for each using the `ip` mode for that option. + +[//]: # (END included file options/ip.md) + + +[//]: # (BEGIN included file options/ip6.md) +#### **--ip6**=*ipv6* + +Specify a static IPv6 address for the container, for example **fd46\:db93\:aa76\:ac37::10**. +This option can only be used if the container is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IPv6 address pool. + +To specify multiple static IPv6 addresses per container, set multiple networks using the **--network** option with a static IPv6 address specified for each using the `ip6` mode for that option. + +[//]: # (END included file options/ip6.md) + + +[//]: # (BEGIN included file options/ipc.md) +#### **--ipc**=*ipc* + +Set the IPC namespace mode for a container. The default is to create +a private IPC namespace. + +- "": Use Podman's default, defined in containers.conf. +- **container:**_id_: reuses another container's shared memory, semaphores, and message queues +- **host**: use the host's shared memory, semaphores, and message queues inside the container. Note: the host mode gives the container full access to local shared memory and is therefore considered insecure. +- **none**: private IPC namespace, with /dev/shm not mounted. +- **ns:**_path_: path to an IPC namespace to join. +- **private**: private IPC namespace. +- **shareable**: private IPC namespace with a possibility to share it with other containers. + +[//]: # (END included file options/ipc.md) + + +[//]: # (BEGIN included file options/label.md) +#### **--label**, **-l**=*key=value* + +Add metadata to a container. + +[//]: # (END included file options/label.md) + + +[//]: # (BEGIN included file options/label-file.md) +#### **--label-file**=*file* + +Read in a line-delimited file of labels. + +[//]: # (END included file options/label-file.md) + + +[//]: # (BEGIN included file options/link-local-ip.md) +#### **--link-local-ip**=*ip* + +Not implemented. + +[//]: # (END included file options/link-local-ip.md) + + +[//]: # (BEGIN included file options/log-driver.md) +#### **--log-driver**=*driver* + +Logging driver for the container. Currently available options are **k8s-file**, **journald**, **none**, **passthrough** and **passthrough-tty**, with **json-file** aliased to **k8s-file** for scripting compatibility. (Default **journald**). + +The podman info command below displays the default log-driver for the system. +``` +$ podman info --format '{{ .Host.LogDriver }}' +journald +``` +The **passthrough** driver passes down the standard streams (stdin, stdout, stderr) to the +container. It is not allowed with the remote Podman client, including Mac and Windows (excluding WSL2) machines, and on a tty, since it is +vulnerable to attacks via TIOCSTI. + +The **passthrough-tty** driver is the same as **passthrough** except that it also allows it to be used on a TTY if the user really wants it. + +[//]: # (END included file options/log-driver.md) + + +[//]: # (BEGIN included file options/log-opt.md) +#### **--log-opt**=*name=value* + +Logging driver specific options. + +Set custom logging configuration. The following *name*s are supported: + +**path**: specify a path to the log file + (e.g. **--log-opt path=/var/log/container/mycontainer.json**); + +**max-size**: specify a max size of the log file + (e.g. **--log-opt max-size=10mb**); + +**tag**: specify a custom log tag for the container + (e.g. **--log-opt tag="{{.ImageName}}"**. +It supports the same keys as **podman inspect --format**. +This option is currently supported only by the **journald** log driver. + +[//]: # (END included file options/log-opt.md) + + +[//]: # (BEGIN included file options/mac-address.md) +#### **--mac-address**=*address* + +Container network interface MAC address (e.g. 92\:d0\:c6:0a:29:33) +This option can only be used if the container is joined to only a single network - i.e., **--network=_network-name_** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. + +Remember that the MAC address in an Ethernet network must be unique. +The IPv6 link-local address is based on the device's MAC address +according to RFC4862. + +To specify multiple static MAC addresses per container, set multiple networks using the **--network** option with a static MAC address specified for each using the `mac` mode for that option. + +[//]: # (END included file options/mac-address.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-reservation.md) +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-reservation.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/memory-swappiness.md) +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/memory-swappiness.md) + + +[//]: # (BEGIN included file options/mount.md) +#### **--mount**=*type=TYPE,TYPE-SPECIFIC-OPTION[,...]* + +Attach a filesystem mount to the container. + +Current supported mount TYPEs are **artifact**, **bind**, **devpts**, **glob**, **image**, **ramfs**, **tmpfs** and **volume**. + +Options common to all mount types: + +- *src*, *source*: mount source spec for **bind**, **glob**, and **volume**. + Mandatory for **artifact**, **bind**, **glob**, **image** and **volume**. + +- *dst*, *destination*, *target*: mount destination spec. + +When source globs are specified without the destination directory, +the files and directories are mounted with their complete path +within the container. When the destination is specified, the +files and directories matching the glob on the base file name +on the destination directory are mounted. The option +`type=glob,src=/foo*,destination=/tmp/bar` tells container engines +to mount host files matching /foo* to the /tmp/bar/ +directory in the container. + +Options specific to type=**artifact**: + +- *digest*: If the artifact source contains multiple blobs a digest can be + specified to only mount the one specific blob with the digest. + +- *title*: If the artifact source contains multiple blobs a title can be set + which is compared against `org.opencontainers.image.title` annotation. + +The *src* argument contains the name of the artifact, which must already exist locally. +The *dst* argument contains the target path, if the path in the container is a +directory or does not exist the blob title (`org.opencontainers.image.title` +annotation) will be used as filename and joined to the path. If the annotation +does not exist the digest will be used as filename instead. This results in all blobs +of the artifact mounted into the container at the given path. + +However, if the *dst* path is an existing file in the container, then the blob will be +mounted directly on it. This only works when the artifact contains a single blob +or when either *digest* or *title* are specified. + +Options specific to type=**volume**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *idmap*: If specified, create an idmapped mount to the target user namespace in the container. + The idmap option is only supported by Podman in rootful mode. The Linux kernel does not allow the use of idmapped file systems for unprivileged users. + The idmap option supports a custom mapping that can be different than the user namespace used by the container. + The mapping can be specified after the idmap option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the first value is the + start of the backing file system IDs that are mapped to the second value on the host. The length of this mapping is given in the third value. + Multiple ranges are separated with #. If the specified mapping is prepended with a '@', then the mapping is considered relative to the container + user namespace. The host ID for the mapping is changed to account for the relative position of the container user in the container user namespace. + +Options specific to type=**image**: + +- *rw*, *readwrite*: *true* or *false* (default if unspecified: *false*). + +- *subpath*: Mount only a specific path within the image, instead of the whole image. + +Options specific to **bind** and **glob**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *bind-propagation*: *shared*, *slave*, *private*, *unbindable*, *rshared*, *rslave*, *runbindable*, or **rprivate** (default).[[1]](#Footnote1) See also mount(2). + +- *bind-nonrecursive*: do not set up a recursive bind mount. By default it is recursive. + +- *relabel*: *shared*, *private*. + +- *idmap*: *true* or *false* (default if unspecified: *false*). If true, create an idmapped mount to the target user namespace in the container. The idmap option is only supported by Podman in rootful mode. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *no-dereference*: do not dereference symlinks but copy the link source into the mount destination. + +Options specific to type=**tmpfs** and **ramfs**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *tmpfs-size*: Size of the tmpfs/ramfs mount, in bytes. Unlimited by default in Linux. + +- *tmpfs-mode*: Octal file mode of the tmpfs/ramfs (e.g. 700 or 0700.). + +- *tmpcopyup*: Enable copyup from the image directory at the same location to the tmpfs/ramfs. Used by default. + +- *notmpcopyup*: Disable copying files from the image to the tmpfs/ramfs. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +Options specific to type=**devpts**: + +- *uid*: numeric UID of the file owner (default: 0). + +- *gid*: numeric GID of the file owner (default: 0). + +- *mode*: octal permission mask for the file (default: 600). + +- *max*: maximum number of PTYs (default: 1048576). + +Examples: + +- `type=bind,source=/path/on/host,destination=/path/in/container` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared,U=true` + +- `type=devpts,destination=/dev/pts` + +- `type=glob,src=/usr/lib/libfoo*,destination=/usr/lib,ro=true` + +- `type=image,source=fedora,destination=/fedora-image,rw=true` + +- `type=ramfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,destination=/path/in/container,noswap` + +- `type=artifact,src=quay.io/libpod/testartifact:20250206-single,dst=/data` + +- `type=artifact,src=quay.io/libpod/testartifact:20250206-multi,dst=/data,title=test1` + +[//]: # (END included file options/mount.md) + + +[//]: # (BEGIN included file options/name.container.md) +#### **--name**=*name* + +Assign a name to the container. + +The operator can identify a container in three ways: + +- UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”); +- UUID short identifier (“f78375b1c487”); +- Name (“jonah”). + +Podman generates a UUID for each container, and if no name is assigned to the +container using **--name**, Podman generates a random string name. The name can +be useful as a more human-friendly way to identify containers. This works for +both background and foreground containers. The container's name is also added +to the `/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). + +[//]: # (END included file options/name.container.md) + + +[//]: # (BEGIN included file options/network.md) +#### **--network**=*mode*, **--net** + +Set the network mode for the container. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + For better integration with DNS handling, **--dns-forward 169.254.1.1** is passed, + and this address is added to resolv.conf(5) as first resolver. It is possible to pass + **--dns-forward** explicitly in case a different IP address should be used. + To make the `host.containers.internal` /etc/hosts entry work and allow connections + to the host, **--map-guest-addr 169.254.1.2** is passed. Again, it can be set + explicitly to choose a different IP address. \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured (via Podman's + **--publish** or by passing the pasta **-t**/**-u** options directly), + to disable automatic port forwarding based on bound ports. Similarly, **-T none** + and **-U none** are given to disable the same functionality from container to + host. \ + All options can also be set in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**; + see the `pasta_options` key under the network section in that file. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.md) + +Invalid if using **--dns**, **--dns-option**, or **--dns-search** with **--network** set to **none** or **container:**_id_. + +If used together with **--pod**, the container joins the pod's network namespace. + + +[//]: # (BEGIN included file options/network-alias.md) +#### **--network-alias**=*alias* + +Add a network-scoped alias for the container, setting the alias for all networks that the container joins. To set a +name only for a specific network, use the alias option as described under the **--network** option. +If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. This option can be specified multiple times. +NOTE: When using CNI a container only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. + +[//]: # (END included file options/network-alias.md) + + +[//]: # (BEGIN included file options/no-healthcheck.md) +#### **--no-healthcheck** + +Disable any defined healthchecks for container. + +[//]: # (END included file options/no-healthcheck.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the container. + +Podman assumes control over the container's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/oom-kill-disable.md) +#### **--oom-kill-disable** + +Whether to disable OOM Killer for the container or not. + +This flag is not supported on cgroups V2 systems. + +[//]: # (END included file options/oom-kill-disable.md) + + +[//]: # (BEGIN included file options/oom-score-adj.md) +#### **--oom-score-adj**=*num* + +Tune the host's OOM preferences for containers (accepts values from **-1000** to **1000**). + +When running in rootless mode, the specified value can't be lower than +the oom_score_adj for the current process. In this case, the +oom-score-adj is clamped to the current process value. + +[//]: # (END included file options/oom-score-adj.md) + + +[//]: # (BEGIN included file options/os.pull.md) +#### **--os**=*OS* + +Override the OS, defaults to hosts, of the image to be pulled. For example, `windows`. +Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. + +[//]: # (END included file options/os.pull.md) + +#### **--passwd** + +Allow Podman to add entries to /etc/passwd and /etc/group when used in conjunction with the --user option. +This is used to override the Podman provided user setup in favor of entrypoint configurations such as libnss-extrausers. + + +[//]: # (BEGIN included file options/passwd-entry.md) +#### **--passwd-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/passwd` file within the container when `--passwd` is used. + +The variables $USERNAME, $UID, $GID, $NAME, $HOME are automatically replaced with their value at runtime. + +[//]: # (END included file options/passwd-entry.md) + + +[//]: # (BEGIN included file options/personality.md) +#### **--personality**=*persona* + +Personality sets the execution domain via Linux personality(2). + +[//]: # (END included file options/personality.md) + + +[//]: # (BEGIN included file options/pid.container.md) +#### **--pid**=*mode* + +Set the PID namespace mode for the container. +The default is to create a private PID namespace for the container. + +- **container:**_id_: join another container's PID namespace; +- **host**: use the host's PID namespace for the container. Note the host mode gives the container full access to local PID and is therefore considered insecure; +- **ns:**_path_: join the specified PID namespace; +- **private**: create a new namespace for the container (default). + +[//]: # (END included file options/pid.container.md) + + +[//]: # (BEGIN included file options/pidfile.md) +#### **--pidfile**=*path* + +When the pidfile location is specified, the container process' PID is written to the pidfile. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +If the pidfile option is not specified, the container process' PID is written to /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile. + +After the container is started, the location for the pidfile can be discovered with the following `podman inspect` command: + + $ podman inspect --format '{{ .PidFile }}' $CID + /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile + +[//]: # (END included file options/pidfile.md) + + +[//]: # (BEGIN included file options/pids-limit.md) +#### **--pids-limit**=*limit* + +Tune the container's pids limit. Set to **-1** to have unlimited pids for the container. The default is **2048** on systems that support "pids" cgroup controller. + +[//]: # (END included file options/pids-limit.md) + + +[//]: # (BEGIN included file options/platform.md) +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with --arch and --os) +The `--platform` option can be used to override the current architecture and operating system. +Unless overridden, subsequent lookups of the same image in the local storage matches this platform, regardless of the host. + +[//]: # (END included file options/platform.md) + + +[//]: # (BEGIN included file options/pod.run.md) +#### **--pod**=*name* + +Run container in an existing pod. Podman makes the pod automatically if the pod name is prefixed with **new:**. +To make a pod with more granular options, use the **podman pod create** command before creating a container. +When a container is run with a pod with an infra-container, the infra-container is started first. + +[//]: # (END included file options/pod.run.md) + + +[//]: # (BEGIN included file options/pod-id-file.container.md) +#### **--pod-id-file**=*file* + +Run container in an existing pod and read the pod's ID from the specified *file*. +When a container is run within a pod which has an infra-container, the infra-container starts first. + +[//]: # (END included file options/pod-id-file.container.md) + + +[//]: # (BEGIN included file options/preserve-fd.md) +#### **--preserve-fd**=*FD1[,FD2,...]* + +Pass down to the process the additional file descriptors specified in the comma separated list. It can be specified multiple times. +This option is only supported with the crun OCI runtime. It might be a security risk to use this option with other OCI runtimes. + +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/preserve-fd.md) + + +[//]: # (BEGIN included file options/preserve-fds.md) +#### **--preserve-fds**=*N* + +Pass down to the process N additional file descriptors (in addition to 0, 1, 2). +The total FDs are 3+N. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/preserve-fds.md) + + +[//]: # (BEGIN included file options/privileged.md) +#### **--privileged** + +Give extended privileges to this container. The default is **false**. + +By default, Podman containers are unprivileged (**=false**) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read-only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. +Due to the disabled security features, the privileged field should almost never +be set as containers can easily break out of confinement. + +Containers running in a user namespace (e.g., rootless containers) cannot have +more privileges than the user that launched them. + +[//]: # (END included file options/privileged.md) + + +[//]: # (BEGIN included file options/publish.md) +#### **--publish**, **-p**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Publish a container's port, or range of ports, to the host. + +Both *hostPort* and *containerPort* can be specified as a range of ports. +When specifying ranges for both, the number of container ports in the +range must match the number of host ports in the range. + +If host IP is set to 0.0.0.0 or not set at all, the port is bound on all IPs on the host. + +By default, Podman publishes TCP ports. To publish a UDP port instead, give +`udp` as protocol. To publish both TCP and UDP ports, set `--publish` twice, +with `tcp`, and `udp` as protocols respectively. Rootful containers can also +publish ports using the `sctp` protocol. + +Host port does not have to be specified (e.g. `podman run -p 127.0.0.1::80`). +If it is not, the container port is randomly assigned a port on the host. + +Use **podman port** to see the actual mapping: `podman port $CONTAINER $CONTAINERPORT`. + +Note that the network drivers `macvlan` and `ipvlan` do not support port forwarding, +therefore this option will have no effect on such networks. + +[//]: # (END included file options/publish.md) + +**Note:** If a container runs within a pod, it is not necessary to publish the port for +the containers in the pod. The port must only be published by the pod itself. Pod network +stacks act like the network stack on the host - meaning a variety of containers in the pod +and programs in the container all share a single interface, IP address, and +associated ports. If one container binds to a port, no other container can use that port +within the pod while it is in use. Containers in the pod can also communicate over localhost +by having one container bind to localhost in the pod, and another connect to that port. + + +[//]: # (BEGIN included file options/publish-all.md) +#### **--publish-all**, **-P** + +Publish all exposed ports to random ports on the host interfaces. The default is **false**. + +When set to **true**, publish all exposed ports to the host interfaces. +If the operator uses **-P** (or **-p**) then Podman makes the +exposed port accessible on the host and the ports are available to any +client that can reach the host. + +When using this option, Podman binds any exposed port to a random port on the host +within an ephemeral port range defined by */proc/sys/net/ipv4/ip_local_port_range*. +To find the mapping between the host ports and the exposed ports, use **podman port**. + +[//]: # (END included file options/publish-all.md) + + +[//]: # (BEGIN included file options/pull.md) +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Pull the image only when the image is not in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error if no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. + +[//]: # (END included file options/pull.md) + +#### **--quiet**, **-q** + +Suppress output information when pulling images + + +[//]: # (BEGIN included file options/rdt-class.md) +#### **--rdt-class**=*intel-rdt-class-of-service* + +Rdt-class sets the class of service (CLOS or COS) for the container to run in. Based on the Cache Allocation Technology (CAT) feature that is part of Intel's Resource Director Technology (RDT) feature set, all container processes will run within the pre-configured COS, representing a part of the cache. The COS has to be created and configured using a pseudo file system (usually mounted at `/sys/fs/resctrl`) that the resctrl kernel driver provides. Assigning the container to a COS requires root privileges and thus doesn't work in a rootless environment. Currently, the feature is only supported using `runc` as a runtime. See for more details on creating a COS before a container can be assigned to it. + +[//]: # (END included file options/rdt-class.md) + + +[//]: # (BEGIN included file options/read-only.md) +#### **--read-only** + +Mount the container's root filesystem as read-only. + +By default, container root filesystems are writable, allowing processes +to write files anywhere. By specifying the **--read-only** flag, the containers root filesystem are mounted read-only prohibiting any writes. + +[//]: # (END included file options/read-only.md) + + +[//]: # (BEGIN included file options/read-only-tmpfs.md) +#### **--read-only-tmpfs** + +When running --read-only containers, mount a read-write tmpfs on _/dev_, _/dev/shm_, _/run_, _/tmp_, and _/var/tmp_. The default is **true**. + +| --read-only | --read-only-tmpfs | / | /run, /tmp, /var/tmp| +| ----------- | ----------------- | ---- | ----------------------------------- | +| true | true | r/o | r/w | +| true | false | r/o | r/o | +| false | false | r/w | r/w | +| false | true | r/w | r/w | + +When **--read-only=true** and **--read-only-tmpfs=true** additional tmpfs are mounted on +the /tmp, /run, and /var/tmp directories. + +When **--read-only=true** and **--read-only-tmpfs=false** /dev and /dev/shm are marked +Read/Only and no tmpfs are mounted on /tmp, /run and /var/tmp. The directories +are exposed from the underlying image, meaning they are read-only by default. +This makes the container totally read-only. No writable directories exist within +the container. In this mode writable directories need to be added via external +volumes or mounts. + +By default, when **--read-only=false**, the /dev and /dev/shm are read/write, and the /tmp, /run, and /var/tmp are read/write directories from the container image. + +[//]: # (END included file options/read-only-tmpfs.md) + + +[//]: # (BEGIN included file options/replace.md) +#### **--replace** + +If another container with the same name already exists, replace and remove it. The default is **false**. + +[//]: # (END included file options/replace.md) + + +[//]: # (BEGIN included file options/requires.md) +#### **--requires**=*container* + +Specify one or more requirements. +A requirement is a dependency container that is started before this container. +Containers can be specified by name or ID, with multiple containers being separated by commas. + +[//]: # (END included file options/requires.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + +#### **--rm** + +Automatically remove the container and any anonymous unnamed volume associated with +the container when it exits. The default is **false**. + +#### **--rmi** + +After exit of the container, remove the image unless another +container is using it. Implies --rm on the new container. The default is *false*. + + +[//]: # (BEGIN included file options/rootfs.md) +#### **--rootfs** + +If specified, the first argument refers to an exploded container on the file system. + +This is useful to run a container without requiring any image management, the rootfs +of the container is assumed to be managed externally. + + `Overlay Rootfs Mounts` + + The `\:O` flag tells Podman to mount the directory from the rootfs path as +storage using the `overlay file system`. The container processes +can modify content within the mount point which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +Note: On **SELinux** systems, the rootfs needs the correct label, which is by default +**unconfined_u\:object_r\:container_file_t\:s0**. + + `idmap` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. +The idmap option supports a custom mapping that can be different than the user +namespace used by the container. The mapping can be specified after the idmap +option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the +first value is the start of the backing file system IDs that are mapped to the +second value on the host. The length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/rootfs.md) + + +[//]: # (BEGIN included file options/sdnotify.md) +#### **--sdnotify**=**container** | *conmon* | *healthy* | *ignore* + +Determines how to use the NOTIFY_SOCKET, as passed with systemd and Type=notify. + +Default is **container**, which means allow the OCI runtime to proxy the socket into the +container to receive ready notification. Podman sets the MAINPID to conmon's pid. +The **conmon** option sets MAINPID to conmon's pid, and sends READY when the container +has started. The socket is never passed to the runtime or the container. +The **healthy** option sets MAINPID to conmon's pid, and sends READY when the container +has turned healthy; requires a healthcheck to be set. The socket is never passed to the runtime or the container. +The **ignore** option removes NOTIFY_SOCKET from the environment for itself and child processes, +for the case where some other process above Podman uses NOTIFY_SOCKET and Podman does not use it. + +[//]: # (END included file options/sdnotify.md) + + +[//]: # (BEGIN included file options/seccomp-policy.md) +#### **--seccomp-policy**=*policy* + +Specify the policy to select the seccomp profile. If set to *image*, Podman looks for a "io.containers.seccomp.profile" label in the container-image config and use its value as a seccomp profile. Otherwise, Podman follows the *default* policy by applying the default profile unless specified otherwise via *--security-opt seccomp* as described below. + +Note that this feature is experimental and may change in the future. + +[//]: # (END included file options/seccomp-policy.md) + + +[//]: # (BEGIN included file options/secret.md) +#### **--secret**=*secret[,opt=opt ...]* + +Give the container access to a secret. Can be specified multiple times. + +A secret is a blob of sensitive data which a container needs at runtime but +is not stored in the image or in source control, such as usernames and passwords, +TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 512 kB in size). + +When secrets are specified as type `mount`, the secrets are copied and mounted into the container when a container is created. +When secrets are specified as type `env`, the secret is set as an environment variable within the container. +Secrets are written in the container at the time of container creation, and modifying the secret using `podman secret` commands +after the container is created affects the secret inside the container. + +Secrets and its storage are managed using the `podman secret` command. + +Secret Options + +- `type=mount|env` : How the secret is exposed to the container. + `mount` mounts the secret into the container as a file. + `env` exposes the secret as an environment variable. + Defaults to `mount`. +- `target=target` : Target of secret. + For mounted secrets, this is the path to the secret inside the container. + If a fully qualified path is provided, the secret is mounted at that location. + Otherwise, the secret is mounted to + `/run/secrets/target` for Linux containers or + `/var/run/secrets/target` for FreeBSD containers. + If the target is not set, the secret is mounted to `/run/secrets/secretname` by default. + For env secrets, this is the environment variable key. Defaults to `secretname`. +- `uid=0` : UID of secret. Defaults to 0. Mount secret type only. +- `gid=0` : GID of secret. Defaults to 0. Mount secret type only. +- `mode=0` : Mode of secret. Defaults to 0444. Mount secret type only. + + +Examples + +Mount at `/my/location/mysecret` with UID 1: +``` +--secret mysecret,target=/my/location/mysecret,uid=1 +``` + +Mount at `/run/secrets/customtarget` with mode 0777: +``` +--secret mysecret,target=customtarget,mode=0777 +``` + +Create a secret environment variable called `ENVSEC`: +``` +--secret mysecret,type=env,target=ENVSEC +``` + +[//]: # (END included file options/secret.md) + + +[//]: # (BEGIN included file options/security-opt.md) +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the container +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the container + +- **label=user:**_USER_: Set the label user for the container processes +- **label=role:**_ROLE_: Set the label role for the container processes +- **label=type:**_TYPE_: Set the label process type for the container processes +- **label=level:**_LEVEL_: Set the label level for the container processes +- **label=filetype:**_TYPE_: Set the label file type for the container files +- **label=disable**: Turn off label separation for the container + +Note: Labeling can be disabled for all containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the container. + +- **no-new-privileges**: Disable container processes from gaining additional privileges through the `execve(2)` system call (e.g. via setuid or setgid bits, or via file capabilities). Programs that rely on setuid/setgid bits set on their executable to change user id or group id are no longer able to do so, and any file capabilities added to the executable (e.g. via `setcap`) are not added to the permitted capability set. For more details, see: https://docs.kernel.org/userspace-api/no_new_privs.html. + +- **seccomp=unconfined**: Turn off seccomp confinement for the container. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. + +[//]: # (END included file options/security-opt.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the container. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/shm-size-systemd.md) +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. + +[//]: # (END included file options/shm-size-systemd.md) + + +[//]: # (BEGIN included file options/sig-proxy.md) +#### **--sig-proxy** + +Proxy received signals to the container process. SIGCHLD, SIGURG, SIGSTOP, and SIGKILL are not proxied. + +[//]: # (END included file options/sig-proxy.md) + +The default is **true**. + + +[//]: # (BEGIN included file options/stop-signal.md) +#### **--stop-signal**=*signal* + +Signal to stop a container. Default is **SIGTERM**. + +[//]: # (END included file options/stop-signal.md) + + +[//]: # (BEGIN included file options/stop-timeout.md) +#### **--stop-timeout**=*seconds* + +Timeout to stop a container. Default is **10**. +Remote connections use local containers.conf for defaults. + +[//]: # (END included file options/stop-timeout.md) + + +[//]: # (BEGIN included file options/subgidname.md) +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. + +[//]: # (END included file options/subgidname.md) + + +[//]: # (BEGIN included file options/subuidname.md) +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. + +[//]: # (END included file options/subuidname.md) + + +[//]: # (BEGIN included file options/sysctl.md) +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters at runtime. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: if using the **--ipc=host** option, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: if using the **--network=host** option, the above sysctls are not allowed. + +[//]: # (END included file options/sysctl.md) + + +[//]: # (BEGIN included file options/systemd.md) +#### **--systemd**=*true* | *false* | *always* + +Run container in systemd mode. The default is **true**. + +- **true** enables systemd mode only when the command executed inside the container is *systemd*, */usr/sbin/init*, +*/sbin/init* or */usr/local/sbin/init*. + +- **false** disables systemd mode. + +- **always** enforces the systemd mode to be enabled. + +Running the container in systemd mode causes the following changes: + +* Podman mounts tmpfs file systems on the following directories + * _/run_ + * _/run/lock_ + * _/tmp_ + * _/sys/fs/cgroup/systemd_ (on a cgroup v1 system) + * _/var/lib/journal_ +* Podman sets the default stop signal to **SIGRTMIN+3**. +* Podman sets **container_uuid** environment variable in the container to the +first 32 characters of the container ID. +* Podman does not mount virtual consoles (_/dev/tty\d+_) when running with **--privileged**. +* On cgroup v2, */sys/fs/cgroup* is mounted writable. + +This allows systemd to run in a confined container without any modifications. + +Note that on **SELinux** systems, systemd attempts to write to the cgroup +file system. Containers writing to the cgroup file system are denied by default. +The **container_manage_cgroup** boolean must be enabled for this to be allowed on an SELinux separated system. +``` +setsebool -P container_manage_cgroup true +``` + +[//]: # (END included file options/systemd.md) + + +[//]: # (BEGIN included file options/timeout.md) +#### **--timeout**=*seconds* + +Maximum time a container is allowed to run before conmon sends it the kill +signal. By default containers run until they exit or are stopped by +`podman stop`. + +[//]: # (END included file options/timeout.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/tmpfs.md) +#### **--tmpfs**=*fs* + +Create a tmpfs mount. + +Mount a temporary filesystem (**tmpfs**) mount into a container, for example: + +``` +$ podman run -d --tmpfs /tmp\:rw,size=787448k,mode=1777 my_image +``` + +This command mounts a **tmpfs** at _/tmp_ within the container. The supported mount +options are the same as the Linux default mount flags. If no options are specified, +the system uses the following options: +**rw,noexec,nosuid,nodev**. + +[//]: # (END included file options/tmpfs.md) + + +[//]: # (BEGIN included file options/tty.md) +#### **--tty**, **-t** + +Allocate a pseudo-TTY. The default is **false**. + +When set to **true**, Podman allocates a pseudo-tty and attach to the standard +input of the container. This can be used, for example, to run a throwaway +interactive shell. + +**NOTE**: The --tty flag prevents redirection of standard output. It combines STDOUT and STDERR, it can insert control characters, and it can hang pipes. This option is only used when run interactively in a terminal. When feeding input to Podman, use -i only, not -it. + +[//]: # (END included file options/tty.md) + +``` +echo "asdf" | podman run --rm -i someimage /bin/cat +``` + + +[//]: # (BEGIN included file options/tz.md) +#### **--tz**=*timezone* + +Set timezone in container. This flag takes area-based timezones, GMT time, as well as `local`, which sets the timezone in the container to match the host machine. See `/usr/share/zoneinfo/` for valid timezones. +Remote connections use local containers.conf for defaults + +[//]: # (END included file options/tz.md) + + +[//]: # (BEGIN included file options/uidmap.container.md) +#### **--uidmap**=*[flags]container_uid\:from_uid[\:amount]* + +Run the container in a new user namespace using the supplied UID mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +The possible values of the optional *flags* are discussed further down on this page. +The *amount* value is optional and assumed to be **1** if not given. + +The *from_uid* value is based upon the user running the command, either rootful or rootless users. + +* rootful user: [*flags*]*container_uid*:*host_uid*[:*amount*] +* rootless user: [*flags*]*container_uid*:*intermediate_uid*[:*amount*] + + `Rootful mappings` + + +When **podman run** is called by a privileged user, the option **--uidmap** +works as a direct mapping between host UIDs and container UIDs. + +host UID -> container UID + +The _amount_ specifies the number of consecutive UIDs that is mapped. +If for example _amount_ is **4** the mapping looks like: + +| host UID | container UID | +| ---------- | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | + + `Rootless mappings` + +When **podman run** is called by an unprivileged user (i.e. running rootless), +the value *from_uid* is interpreted as an "intermediate UID". In the rootless +case, host UIDs are not mapped directly to container UIDs. Instead the mapping +happens over two mapping steps: + +host UID -> intermediate UID -> container UID + +The **--uidmap** option only influences the second mapping step. + +The first mapping step is derived by Podman from the contents of the file +_/etc/subuid_ and the UID of the user calling Podman. + +First mapping step: + +| host UID | intermediate UID | +| -------- | ---------------- | +| UID for Podman user | 0 | +| 1st subordinate UID | 1 | +| 2nd subordinate UID | 2 | +| 3rd subordinate UID | 3 | +| nth subordinate UID | n | + +To be able to use intermediate UIDs greater than zero, the user needs to have +subordinate UIDs configured in _/etc/subuid_. See **subuid**(5). + +The second mapping step is configured with **--uidmap**. + +If for example _amount_ is **5** the second mapping step looks like: + +| intermediate UID | container UID | +| ------------------ | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | +| *from_uid* + 4 | *container_uid* + 4 | + +When running as rootless, Podman uses all the ranges configured in the _/etc/subuid_ file. + +The current user ID is mapped to UID=0 in the rootless user namespace. +Every additional range is added sequentially afterward: + +| host | rootless user namespace | length | +| ------ | ----------------------- | ------ | +| $UID | 0 | 1 | +| 1 | $FIRST_RANGE_ID | $FIRST_RANGE_LENGTH | +| 1+$FIRST_RANGE_LENGTH | $SECOND_RANGE_ID | $SECOND_RANGE_LENGTH| + + `Referencing a host ID from the parent namespace` + +As a rootless user, the given host ID in **--uidmap** or **--gidmap** +is mapped from the *intermediate namespace* generated by Podman. Sometimes +it is desirable to refer directly at the *host namespace*. It is possible +to manually do so, by running `podman unshare cat /proc/self/gid_map`, +finding the desired host id at the second column of the output, and getting +the corresponding intermediate id from the first column. + +Podman can perform all that by preceding the host id in the mapping +with the `@` symbol. For instance, by specifying `--gidmap 100000:@2000:1`, +podman will look up the intermediate id corresponding to host id `2000` and +it will map the found intermediate id to the container id `100000`. The +given host id must have been subordinated (otherwise it would not be mapped +into the intermediate space in the first place). + +If the length is greater than one, for instance with `--gidmap 100000:@2000:2`, +Podman will map host ids `2000` and `2001` to `100000` and `100001`, respectively, +regardless of how the intermediate mapping is defined. + + `Extending previous mappings` + +Some mapping modifications may be cumbersome. For instance, a user +starts with a mapping such as `--gidmap="0:0:65000"`, that needs to be +changed such as the parent id `1000` is mapped to container id `100000` +instead, leaving container id `1` unassigned. The corresponding `--gidmap` +becomes `--gidmap="0:0:1" --gidmap="2:2:65534" --gidmap="100000:1:1"`. + +This notation can be simplified using the `+` flag, that takes care of +breaking previous mappings removing any conflicting assignment with +the given mapping. The flag is given before the container id +as follows: `--gidmap="0:0:65000" --gidmap="+100000:1:1"` + + + Flag | Example | Description +-----------|---------------|------------- + `+` | `+100000:1:1` | Extend the previous mapping + +This notation leads to gaps in the assignment, so it may be convenient to +fill those gaps afterwards: `--gidmap="0:0:65000" --gidmap="+100000:1:1" --gidmap="1:65001:1"` + +One specific use case for this flag is in the context of rootless +users. A rootless user may specify mappings with the `+` flag as +in `--gidmap="+100000:1:1"`. Podman will then "fill the gaps" starting +from zero with all the remaining intermediate ids. This is convenient when +a user wants to map a specific intermediate id to a container id, leaving +the rest of subordinate ids to be mapped by Podman at will. + + `Passing only one of --uidmap or --gidmap` + +Usually, subordinated user and group ids are assigned simultaneously, and +for any user the subordinated user ids match the subordinated group ids. +For convenience, if only one of **--uidmap** or **--gidmap** is given, +podman assumes the mapping refers to both UIDs and GIDs and applies the +given mapping to both. If only one value of the two needs to be changed, +the mappings should include the `u` or the `g` flags to specify that +they only apply to UIDs or GIDs and should not be copied over. + + flag | Example | Description +---------|-----------------|----------------- + `u` | `u20000:2000:1` |The mapping only applies to UIDs + `g` | `g10000:1000:1` |The mapping only applies to GIDs + +For instance given the command + + podman run --gidmap "0:0:1000" --gidmap "g2000:2000:1" + +Since no **--uidmap** is given, the **--gidmap** is copied to **--uidmap**, +giving a command equivalent to + + podman run --gidmap "0:0:1000" --gidmap "2000:2000:1" --uidmap "0:0:1000" + +The `--gidmap "g2000:2000:1"` used the `g` flag and therefore it was +not copied to **--uidmap**. + + `Rootless mapping of additional host GIDs` + +A rootless user may desire to map a specific host group that has already been +subordinated within _/etc/subgid_ without specifying the rest of the mapping. + +This can be done with **--gidmap "+g*container_gid*:@*host_gid*"** + +Where: + +- The host GID is given through the `@` symbol +- The mapping of this GID is not copied over to **--usermap** thanks to the `g` flag. +- The rest of the container IDs will be mapped starting from 0 to n, + with all the remaining subordinated GIDs, thanks to the `+` flag. + +For instance, if a user belongs to the group `2000` and that group is +subordinated to that user (with `usermod --add-subgids 2000-2000 $USER`), +the user can map the group into the container with: **--gidmap=+g100000:@2000**. + +If this mapping is combined with the option, **--group-add=keep-groups**, the +process in the container will belong to group `100000`, and files belonging +to group `2000` in the host will appear as being owned by group `100000` +inside the container. + + podman run --group-add=keep-groups --gidmap="+g100000:@2000" ... + + `No subordinate UIDs` + +Even if a user does not have any subordinate UIDs in _/etc/subuid_, +**--uidmap** can be used to map the normal UID of the user to a +container UID by running `podman run --uidmap $container_uid:0:1 --user $container_uid ...`. + + `Pods` + +The **--uidmap** option cannot be called in conjunction with the **--pod** option as a uidmap cannot be set on the container level when in a pod. + +[//]: # (END included file options/uidmap.container.md) + + +[//]: # (BEGIN included file options/ulimit.md) +#### **--ulimit**=*option* + +Ulimit options. Sets the ulimits values inside of the container. + +--ulimit with a soft and hard limit in the format =[:]. For example: + +$ podman run --ulimit nofile=1024:1024 --rm ubi9 ulimit -n +1024 + +Set -1 for the soft or hard limit to set the limit to the maximum limit of the current +process. In rootful mode this is often unlimited. + + +If nofile and nproc are unset, a default value of 1048576 will be used, unless overridden +in containers.conf(5). However, if the default value exceeds the hard limit for the current +rootless user, the current hard limit will be applied instead. + +Use **host** to copy the current configuration from the host. + +Don't use nproc with the ulimit flag as Linux uses nproc to set the +maximum number of processes available to a user, not to a container. + +Use the --pids-limit option to modify the cgroup control to limit the number +of processes within a container. + +[//]: # (END included file options/ulimit.md) + + +[//]: # (BEGIN included file options/umask.md) +#### **--umask**=*umask* + +Set the umask inside the container. Defaults to `0022`. +Remote connections use the local `containers.conf` for defaults. + +[//]: # (END included file options/umask.md) + + +[//]: # (BEGIN included file options/unsetenv.md) +#### **--unsetenv**=*env* + +Unset default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. + +[//]: # (END included file options/unsetenv.md) + + +[//]: # (BEGIN included file options/unsetenv-all.md) +#### **--unsetenv-all** + +Unset all default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. + +[//]: # (END included file options/unsetenv-all.md) + + +[//]: # (BEGIN included file options/user.md) +#### **--user**, **-u**=*user[\:group]* + +Sets the username or UID used and, optionally, the groupname or GID for the specified command. Both *user* and *group* may be symbolic or numeric. + +Without this argument, the command runs as the user specified in the container image. Unless overridden by a `USER` command in the Containerfile or by a value passed to this option, this user generally defaults to root. + +When a user namespace is not in use, the UID and GID used within the container and on the host match. When user namespaces are in use, however, the UID and GID in the container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container by default corresponds to the UID and GID of the user invoking Podman. + +[//]: # (END included file options/user.md) + + +[//]: # (BEGIN included file options/userns.container.md) +#### **--userns**=*mode* + +Set the user namespace mode for the container. + +If `--userns` is not set, the default value is determined as follows. +- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used. +- If the environment variable **PODMAN_USERNS** is set its value is used. +- If `userns` is specified in `containers.conf` this value is used. +- Otherwise, `--userns=host` is assumed. + +`--userns=""` (i.e., an empty string) is an alias for `--userns=host`. + +This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +------------------------|-----------|--------------------- +auto | $UID | nil (Host User UID is not mapped into container.) +host | $UID | 0 (Default User account mapped to root user in container.) +keep-id | $UID | $UID (Map user account to same UID within container.) +keep-id\:uid=200,gid=210 | $UID | 200:210 (Map user account to specified UID, GID value within container.) +nomap | $UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + +**auto**[\:_OPTIONS,..._]: automatically create a unique user namespace. + +* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. + + Example: `containers:2147483647:2147483648`. + +* `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5). + +Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user IDs. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. + +The option `--userns=keep-id` uses all the subuids and subgids of the user. +The option `--userns=nomap` uses all the subuids and subgids of the user except the user's own ID. +Using `--userns=auto` when starting new containers does not work as long as any containers exist that were started with `--userns=nomap` or `--userns=keep-id` without limiting the user namespace size. + + Valid `auto` options: + + - *gidmapping*=_CONTAINER\_GID\:HOST\_GID\:SIZE_: to force a GID mapping to be present in the user namespace. + - *size*=_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates a size for the user namespace. + - *uidmapping*=_CONTAINER\_UID\:HOST\_UID\:SIZE_: to force a UID mapping to be present in the user namespace. + +The host UID and GID in *gidmapping* and *uidmapping* can optionally be prefixed with the `@` symbol. +In this case, podman will look up the intermediate ID corresponding to host ID and it will map the found intermediate ID to the container id. +For details see **--uidmap**. + +**container:**_id_: join the user namespace of the specified container. + +**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user. + +**keep-id**: creates a user namespace where the current user's UID\:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace. + + Valid `keep-id` options: + + - *uid*=UID: override the UID inside the container that is used to map the current user to. + - *gid*=GID: override the GID inside the container that is used to map the current user to. + - *size*=SIZE: override the size of the configured user namespace. It is useful to not saturate all the available IDs. Not supported when running as root. + +**nomap**: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +**ns:**_namespace_: run the container in the given existing user namespace. + +[//]: # (END included file options/userns.container.md) + + +[//]: # (BEGIN included file options/uts.container.md) +#### **--uts**=*mode* + +Set the UTS namespace mode for the container. The following values are supported: + +- **host**: use the host's UTS namespace inside the container. +- **private**: create a new namespace for the container (default). +- **ns:[path]**: run the container in the given existing UTS namespace. +- **container:[container]**: join the UTS namespace of the specified container. + +[//]: # (END included file options/uts.container.md) + + +[//]: # (BEGIN included file options/variant.container.md) +#### **--variant**=*VARIANT* + +Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. + +[//]: # (END included file options/variant.container.md) + + +[//]: # (BEGIN included file options/volume.md) +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the container is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +container. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a container is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the container, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the container. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system +might prevent the processes running inside the container from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the container context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +containers share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label. Only the current container can use a private +volume. + +Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any one of the containers. Relabeling walks +the file system under the volume and changes the label on each file; if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the container. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually changed with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the container. +For example if a user wanted to volume mount their entire home directory into a +container, they need to disable SELinux separation. + + $ podman run --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The container processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous container executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the container +to work. + +Do not modify the source directory mounted into the container with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the container are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the container +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +container, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +container. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the container. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the container. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless container fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/volume.md) + +Use the **--group-add keep-groups** option to pass the user's supplementary group access into the container. + + +[//]: # (BEGIN included file options/volumes-from.md) +#### **--volumes-from**=*CONTAINER[\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +container. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target container, then the volume hides +that data on the target. + +[//]: # (END included file options/volumes-from.md) + + +[//]: # (BEGIN included file options/workdir.md) +#### **--workdir**, **-w**=*dir* + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (**/**). +The image developer can set a different default with the WORKDIR instruction. The operator +can override the working directory by using the **-w** option. + +[//]: # (END included file options/workdir.md) + +## Exit Status + +The exit code from **podman run** gives information about why the container +failed to run or why it exited. When **podman run** exits with a non-zero code, +the exit codes follow the **chroot**(1) standard, see below: + + **125** The error is with Podman itself + + $ podman run --foo busybox; echo $? + Error: unknown flag: --foo + 125 + + **126** The _contained command_ cannot be invoked + + $ podman run busybox /etc; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error + 126 + + **127** The _contained command_ cannot be found + + $ podman run busybox foo; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error + 127 + + **Exit code** _contained command_ exit code + + $ podman run busybox /bin/sh -c 'exit 3'; echo $? + 3 + +## EXAMPLES + +### Running container in read-only mode + +During container image development, containers often need to write to the image +content. Installing packages into _/usr_, for example. In production, +applications seldom need to write to the image. Container applications write +to volumes if they need to write to file systems at all. Applications can be +made more secure by running them in read-only mode using the **--read-only** switch. +This protects the container's image from modification. By default read-only +containers can write to temporary data. Podman mounts a tmpfs on _/run_ and +_/tmp_ within the container. + +``` +$ podman run --read-only -i -t fedora /bin/bash +``` + +If the container does not write to any file +system within the container, including tmpfs, set --read-only-tmpfs=false. +``` +$ podman run --read-only --read-only-tmpfs=false --tmpfs /run -i -t fedora /bin/bash +``` + +### Exposing shared libraries inside of container as read-only using a glob + +``` +$ podman run --mount type=glob,src=/usr/lib64/libnvidia\*,ro=true -i -t fedora /bin/bash +``` + +### Exposing log messages from the container to the host's log + +Bind mount the _/dev/log_ directory to have messages that are logged in the container show up in the host's +syslog/journal. + +``` +$ podman run -v /dev/log:/dev/log -i -t fedora /bin/bash +``` + +From inside the container test this by sending a message to the log. + +``` +(bash)# logger "Hello from my container" +``` + +Then exit and check the journal. + +``` +(bash)# exit + +$ journalctl -b | grep Hello +``` + +This lists the message sent to the logger. + +### Attaching to one or more from STDIN, STDOUT, STDERR + +Without specifying the **-a** option, Podman attaches everything (stdin, stdout, stderr). +Override the default by specifying -a (stdin, stdout, stderr), as in: + +``` +$ podman run -a stdin -a stdout -i -t fedora /bin/bash +``` + +### Sharing IPC between containers + +Using **shm_server.c** available here: https://www.cs.cf.ac.uk/Dave/C/node27.html + +Testing **--ipc=host** mode: + +Host shows a shared memory segment with 7 pids attached, happens to be from httpd: + +``` +$ sudo ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +0x01128e25 0 root 600 1000 7 +``` + +Now run a regular container, and it correctly does NOT see the shared memory segment from the host: + +``` +$ podman run -it shm ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +``` + +Run a container with the new **--ipc=host** option, and it now sees the shared memory segment from the host httpd: + +``` +$ podman run -it --ipc=host shm ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +0x01128e25 0 root 600 1000 7 +``` +Testing **--ipc=container:**_id_ mode: + +Start a container with a program to create a shared memory segment: +``` +$ podman run -it shm bash +$ sudo shm/shm_server & +$ sudo ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +0x0000162e 0 root 666 27 1 +``` +Create a 2nd container correctly shows no shared memory segment from 1st container: +``` +$ podman run shm ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +``` + +Create a 3rd container using the **--ipc=container:**_id_ option, now it shows the shared memory segment from the first: + +``` +$ podman run -it --ipc=container\:ed735b2264ac shm ipcs -m +$ sudo ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +0x0000162e 0 root 666 27 1 +``` + +### Mapping Ports for External Usage + +The exposed port of an application can be mapped to a host port using the **-p** +flag. For example, an httpd port 80 can be mapped to the host port 8080 using the +following: + +``` +$ podman run -p 8080:80 -d -i -t fedora/httpd +``` + +### Mounting External Volumes + +To mount a host directory as a container volume, specify the absolute path to +the directory and the absolute path for the container directory separated by a +colon. If the source is a named volume maintained by Podman, it is recommended to +use its name rather than the path to the volume. Otherwise the volume is +considered an orphan and wiped by the **podman volume prune** command: + +``` +$ podman run -v /var/db:/data1 -i -t fedora bash + +$ podman run -v data:/data2 -i -t fedora bash + +$ podman run -v /var/cache/dnf:/var/cache/dnf\:O -ti fedora dnf -y update +``` + +If the container needs a writable mounted volume by a non root user inside the container, use the **U** option. This option tells Podman to chown the source volume to match the default UID and GID used within the container. +``` +$ podman run -d -e MARIADB_ROOT_PASSWORD=root --user mysql --userns=keep-id -v ~/data:/var/lib/mysql:Z,U mariadb +``` + +Alternatively if the container needs a writable volume by a non root +user inside of the container, the --userns=keep-id option allows users to +specify the UID and GID of the user executing Podman to specific UIDs and GIDs +within the container. Since the processes running in the container run as the user's UID, they can read/write files owned by the user. +``` +$ podman run -d -e MARIADB_ROOT_PASSWORD=root --user mysql --userns=keep-id\:uid=999,gid=999 -v ~/data:/var/lib/mysql\:Z mariadb +``` + +Using **--mount** flags to mount a host directory as a container folder, specify +the absolute path to the directory or the volume name, and the absolute path +within the container directory: + +```` +$ podman run --mount type=bind,src=/var/db,target=/data1 busybox sh + +$ podman run --mount type=bind,src=volume-name,target=/data1 busybox sh +```` + +When using SELinux, be aware that the host has no knowledge of container SELinux +policy. Therefore, in the above example, if SELinux policy is enforced, the +_/var/db_ directory is not writable to the container. A "Permission Denied" +message occurs, and an **avc:** message is added to the host's syslog. + +To work around this, at time of writing this man page, the following command +needs to be run in order for the proper SELinux policy type label to be attached +to the host directory: + +``` +$ chcon -Rt svirt_sandbox_file_t /var/db +``` + +Now, writing to the _/data1_ volume in the container is allowed and the +changes are reflected on the host in _/var/db_. + +### Using alternative security labeling + +Override the default labeling scheme for each container by specifying +the **--security-opt** flag. For example, specify the MCS/MLS level, a +requirement for MLS systems. Specifying the level in the following command +allows the same content to be shared between containers. + +``` +podman run --security-opt label=level\:s0:c100,c200 -i -t fedora bash +``` + +An MLS example might be: + +``` +$ podman run --security-opt label=level\:TopSecret -i -t rhel7 bash +``` + +To disable the security labeling for this container versus running with the +#### **--permissive** flag, use the following command: + +``` +$ podman run --security-opt label=disable -i -t fedora bash +``` + +Tighten the security policy on the processes within a container by specifying an +alternate type for the container. For example, run a container +that is only allowed to listen on Apache ports by executing the following +command: + +``` +$ podman run --security-opt label=type\:svirt_apache_t -i -t centos bash +``` + +Note that an SELinux policy defining a **svirt_apache_t** type must be written. + +To mask additional specific paths in the container, specify the paths +separated by a colon using the **mask** option with the **--security-opt** +flag. + +``` +$ podman run --security-opt mask=/foo/bar:/second/path fedora bash +``` + +To unmask all the paths that are masked by default, set the **unmask** option to +**ALL**. Or to only unmask specific paths, specify the paths as shown above with +the **mask** option. + +``` +$ podman run --security-opt unmask=ALL fedora bash +``` + +To unmask all the paths that start with /proc, set the **unmask** option to +**/proc/***. + +``` +$ podman run --security-opt unmask=/proc/* fedora bash +``` + +``` +$ podman run --security-opt unmask=/foo/bar:/sys/firmware fedora bash +``` + +### Setting device weight via **--blkio-weight-device** flag. + +``` +$ podman run -it --blkio-weight-device "/dev/sda:200" ubuntu +``` + +### Using a podman container with input from a pipe + +``` +$ echo "asdf" | podman run --rm -i --entrypoint /bin/cat someimage +asdf +``` + +### Setting automatic user namespace separated containers + +``` +# podman run --userns=auto\:size=65536 ubi8-micro cat /proc/self/uid_map +0 2147483647 65536 +# podman run --userns=auto\:size=65536 ubi8-micro cat /proc/self/uid_map +0 2147549183 65536 +``` + +### Setting Namespaced Kernel Parameters (Sysctls) + +The **--sysctl** sets namespaced kernel parameters (sysctls) in the +container. For example, to turn on IP forwarding in the containers +network namespace, run this command: + +``` +$ podman run --sysctl net.ipv4.ip_forward=1 someimage +``` + +Note that not all sysctls are namespaced. Podman does not support changing sysctls +inside of a container that also modify the host system. As the kernel +evolves we expect to see more sysctls become namespaced. + +See the definition of the **--sysctl** option above for the current list of +supported sysctls. + +### Set UID/GID mapping in a new user namespace + +Running a container in a new user namespace requires a mapping of +the UIDs and GIDs from the host. + +``` +$ podman run --uidmap 0:30000:7000 --gidmap 0:30000:7000 fedora echo hello +``` + +### Configuring Storage Options from the command line + +Podman allows for the configuration of storage by changing the values +in the _/etc/container/storage.conf_ or by using global options. This +shows how to set up and use fuse-overlayfs for a one-time run of busybox +using global options. + +``` +podman --log-level=debug --storage-driver overlay --storage-opt "overlay.mount_program=/usr/bin/fuse-overlayfs" run busybox /bin/sh +``` + +### Configure timezone in a container + +``` +$ podman run --tz=local alpine date +$ podman run --tz=Asia/Shanghai alpine date +$ podman run --tz=US/Eastern alpine date +``` + +### Adding dependency containers + +The first container, container1, is not started initially, but must be running before container2 starts. +The `podman run` command starts the container automatically before starting container2. + +``` +$ podman create --name container1 -t -i fedora bash +$ podman run --name container2 --requires container1 -t -i fedora bash +``` + +Multiple containers can be required. + +``` +$ podman create --name container1 -t -i fedora bash +$ podman create --name container2 -t -i fedora bash +$ podman run --name container3 --requires container1,container2 -t -i fedora bash +``` + +### Configure keep supplemental groups for access to volume + +``` +$ podman run -v /var/lib/design:/var/lib/design --group-add keep-groups ubi8 +``` + +### Configure execution domain for containers using personality flag + +``` +$ podman run --name container1 --personality=LINUX32 fedora bash +``` + +### Run a container with external rootfs mounted as an overlay + +``` +$ podman run --name container1 --rootfs /path/to/rootfs:O bash +``` + +### Handling Timezones in java applications in a container. + +In order to use a timezone other than UTC when running a +Java application within a container, the `TZ` environment variable must be +set within the container. Java applications ignores the value set with the +`--tz` option. + +``` +# Example run +podman run -ti --rm -e TZ=EST mytzimage +lrwxrwxrwx. 1 root root 29 Nov 3 08:51 /etc/localtime -> ../usr/share/zoneinfo/Etc/UTC +Now with default timezone: +Fri Nov 19 18:10:55 EST 2021 +Java default sees the following timezone: +2021-11-19T18:10:55.651130-05:00 +Forcing UTC: +Fri Nov 19 23:10:55 UTC 2021 +``` + +### Run a container connected to two networks (called net1 and net2) with a static ip + +``` +$ podman run --network net1\:ip=10.89.1.5 --network net2\:ip=10.89.10.10 alpine ip addr +``` + +### Rootless Containers + +Podman runs as a non-root user on most systems. This feature requires that a new enough version of **shadow-utils** +be installed. The **shadow-utils** package must include the **newuidmap**(1) and **newgidmap**(1) executables. + +In order for users to run rootless, there must be an entry for their username in _/etc/subuid_ and _/etc/subgid_ which lists the UIDs for their user namespace. + +Rootless Podman works better if the fuse-overlayfs and slirp4netns packages are installed. +The **fuse-overlayfs** package provides a userspace overlay storage driver, otherwise users need to use +the **vfs** storage driver, which can be disk space expensive and less +performant than other drivers. + +To enable VPN on the container, slirp4netns or pasta needs to be specified; +without either, containers need to be run with the --network=host flag. + +## ENVIRONMENT + +Environment variables within containers can be set using multiple different options, +in the following order of precedence (later entries override earlier entries): + +- Container image: Any environment variables specified in the container image. +- **--http-proxy**: By default, several environment variables are passed in from the host, such as **http_proxy** and **no_proxy**. See **--http-proxy** for details. +- **--env-host**: Host environment of the process executing Podman is added. +- **--env-file**: Any environment variables specified via env-files. If multiple files are specified, then they override each other in order of entry. +- **--env**: Any environment variables specified overrides previous settings. + +Run containers and set the environment ending with a __*__. +The trailing __*__ glob functionality is only active when no value is specified: + +``` +$ export ENV1=a +$ podman run --env 'ENV*' alpine env | grep ENV +ENV1=a +$ podman run --env 'ENV*=b' alpine env | grep ENV +ENV*=b +``` + +## CONMON + +When Podman starts a container it actually executes the conmon program, which +then executes the OCI Runtime. Conmon is the container monitor. It is a small +program whose job is to watch the primary process of the container, and if the +container dies, save the exit code. It also holds open the tty of the +container, so that it can be attached to later. This is what allows Podman to +run in detached mode (backgrounded), so Podman can exit but conmon continues to +run. Each container has their own instance of conmon. Conmon waits for the +container to exit, gathers and saves the exit code, and then launches a Podman +process to complete the container cleanup, by shutting down the network and +storage. For more information about conmon, see the conmon(8) man +page. + +## FILES + +**/etc/subuid** + +**/etc/subgid** + +NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-save(1)](podman-save.1.md)**, **[podman-ps(1)](podman-ps.1.md)**, **[podman-attach(1)](podman-attach.1.md)**, **[podman-pod-create(1)](podman-pod-create.1.md)**, **[podman-port(1)](podman-port.1.md)**, **[podman-start(1)](podman-start.1.md)**, **[podman-kill(1)](podman-kill.1.md)**, **[podman-stop(1)](podman-stop.1.md)**, **[podman-generate-systemd(1)](podman-generate-systemd.1.md)**, **[podman-rm(1)](podman-rm.1.md)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)**, **[setsebool(8)](https://man7.org/linux/man-pages/man8/setsebool.8.html)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, **[pasta(1)](https://passt.top/builds/latest/web/passt.1.html)**, **[fuse-overlayfs(1)](https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md)**, **proc(5)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)**, **personality(2)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +See [podman-rootless(7)](https://github.com/containers/podman/blob/main/rootless.md) +for rootless issues. + +## HISTORY +September 2018, updated by Kunal Kushwaha `` + +October 2017, converted from Docker documentation to Podman by Dan Walsh for Podman `` + +November 2015, updated by Sally O'Malley `` + +June 2014, updated by Sven Dowideit `` + +April 2014, Originally compiled by William Henry `` based on docker.com source material and internal work. + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a core value of open source. The `master` and `slave` mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately. diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-save.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-save.1.md new file mode 100644 index 000000000..058c17c94 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-save.1.md @@ -0,0 +1,107 @@ +--- +title: podman-save +version: v5.5.0 +--- + +% podman-save 1 + +## NAME +podman\-save - Save image(s) to an archive + +## SYNOPSIS +**podman save** [*options*] *name*[:*tag*] + +**podman image save** [*options*] *name*[:*tag*] + +## DESCRIPTION +**podman save** saves an image to a local file or directory. +**podman save** writes to STDOUT by default and can be redirected to a +file using the **output** flag. The **quiet** flag suppresses the output when set. +**podman save** saves parent layers of the image(s) and the image(s) can be loaded using **podman load**. +To export the containers, use the **podman export**. +Note: `:` is a restricted character and cannot be part of the file name. + +**podman [GLOBAL OPTIONS]** + +**podman save [GLOBAL OPTIONS]** + +**podman save [OPTIONS] NAME[\:TAG]** + +## OPTIONS + + +[//]: # (BEGIN included file options/dir-compress.md) +#### **--compress** + +Compress tarball image layers when pushing to a directory using the 'dir' transport. (default is same compression type, compressed or uncompressed, as source) + +[//]: # (END included file options/dir-compress.md) + +Note: This flag can only be set with **--format=docker-dir**. + +#### **--format**=*format* + +An image format to produce, one of: + +| Format | Description | +| ------------------ | ---------------------------------------------------------------------------- | +| **docker-archive** | A tar archive interoperable with **docker load(1)** (the default) | +| **oci-archive** | A tar archive using the OCI Image Format | +| **oci-dir** | A directory using the OCI Image Format | +| **docker-dir** | **dir** transport (see **containers-transports(5)**) with v2s2 manifest type | + +#### **--help**, **-h** + +Print usage statement + +#### **--multi-image-archive**, **-m** + +Allow for creating archives with more than one image. Additional names are interpreted as images instead of tags. Only supported for **--format=docker-archive**. +The default for this option can be modified via the `multi_image_archive="true"|"false"` flag in containers.conf. + +#### **--output**, **-o**=*file* + +Write to a file, default is STDOUT + +#### **--quiet**, **-q** + +Suppress the output + +#### **--uncompressed** + +Accept uncompressed layers when using one of the OCI formats. + +## EXAMPLES + +Save image to a local file without displaying progress. +``` +$ podman save --quiet -o alpine.tar alpine:2.6 +``` + +Save image to stdout and redirect content via shell. +``` +$ podman save alpine > alpine-all.tar +``` + +Save image in oci-archive format to the local file. +``` +$ podman save -o oci-alpine.tar --format oci-archive alpine +``` + +Save image compressed in docker-dir format. +``` +$ podman save --compress --format docker-dir -o alp-dir alpine +Getting image source signatures +Copying blob sha256:2fdfe1cd78c20d05774f0919be19bc1a3e4729bce219968e4188e7e0f1af679d + 1.97 MB / 1.97 MB [========================================================] 0s +Copying config sha256:501d1a8f0487e93128df34ea349795bc324d5e0c0d5112e08386a9dfaff620be + 584 B / 584 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-load(1)](podman-load.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** + +## HISTORY +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-search.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-search.1.md new file mode 100644 index 000000000..e19bc9824 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-search.1.md @@ -0,0 +1,191 @@ +--- +title: podman-search +version: v5.5.0 +--- + +% podman-search 1 + +## NAME +podman\-search - Search a registry for an image + +## SYNOPSIS +**podman search** [*options*] *term* + +## DESCRIPTION +**podman search** searches a registry or a list of registries for a matching image. +The user can specify which registry to search by prefixing the registry in the search term +(e.g., **registry.fedoraproject.org/fedora**). By default, all +unqualified-search registries in `containers-registries.conf(5)` are used. + +The default number of results is 25. The number of results can be limited using the **--limit** flag. +If more than one registry is being searched, the limit is applied to each registry. The output can be filtered +using the **--filter** flag. To get all available images in a registry without a specific +search term, the user can just enter the registry name with a trailing "/" (example **registry.fedoraproject.org/**). + +Note that **podman search** is not a reliable way to determine the presence or existence of an image. +The search behavior of the v1 and v2 Docker distribution API is specific to the implementation of each registry. +Some registries may not support searching at all. +Further note that searching without a search term only works for registries that implement the v2 API. + +**podman [GLOBAL OPTIONS]** + +**podman search [GLOBAL OPTIONS]** + +**podman search [OPTIONS] TERM** + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + +#### **--compatible** + +After the name and the description, also show the stars, official and automated descriptors as Docker does. +Podman does not show these descriptors by default since they are not supported by most public container registries. + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + +#### **--filter**, **-f**=*filter* + +Filter output based on conditions provided (default []) + +Supported filters are: + +* stars (int) - minimum number of stars required for images to show +* is-automated (boolean - true | false) - is the image automated or not +* is-official (boolean - true | false) - is the image official or not + +#### **--format**=*format* + +Change the output format to a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| --------------- | ---------------------------- | +| .Automated | "[OK]" if image is automated | +| .Description | Image description | +| .Index | Registry | +| .Name | Image name | +| .Official | "[OK]" if image is official | +| .Stars | Star count of image | +| .Tag | Repository tag | + +Note: use .Tag only if the --list-tags is set. + +#### **--help**, **-h** + +Print usage statement + +#### **--limit**=*limit* + +Limit the number of results (default 25). +Note: The results from each registry is limited to this value. +Example if limit is 10 and two registries are being searched, the total +number of results is 20, 10 from each (if there are at least 10 matches in each). +The order of the search results is the order in which the API endpoint returns the results. + +#### **--list-tags** + +List the available tags in the repository for the specified image. +**Note:** --list-tags requires the search term to be a fully specified image name. +The result contains the Image name and its tag, one line for every tag associated with the image. + +#### **--no-trunc** + +Do not truncate the output (default *false*). + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Search for images containing the specified name, returning the first three images from each defined registry. +``` +$ podman search --limit 3 fedora +NAME DESCRIPTION +NAME DESCRIPTION +registry.fedoraproject.org/f29/fedora-toolbox +registry.fedoraproject.org/f30/fedora-toolbox +registry.fedoraproject.org/f31/fedora-toolbox +docker.io/library/fedora Official Docker builds of Fedora +docker.io/kasmweb/fedora-37-desktop Fedora 37 desktop for Kasm Workspaces +docker.io/kasmweb/fedora-38-desktop Fedora 38 desktop for Kasm Workspaces +quay.io/fedora/fedora +quay.io/containerdisks/fedora # Fedora Containerdisk Images diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-secret-create.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-secret-create.1.md new file mode 100644 index 000000000..b105583c8 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-secret-create.1.md @@ -0,0 +1,112 @@ +--- +title: podman-secret-create +version: v5.5.0 +--- + +% podman-secret-create 1 + +## NAME +podman\-secret\-create - Create a new secret + +## SYNOPSIS +**podman secret create** [*options*] *name* *file|-* + +## DESCRIPTION + +Creates a secret using standard input or from a file for the secret content. + +Create accepts a path to a file, or `-`, which tells podman to read the secret from stdin + +A secret is a blob of sensitive data which a container needs at runtime but +is not stored in the image or in source control, such as usernames and passwords, +TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 512 kB in size). + +Secrets are not committed to an image with `podman commit`, and do not get committed in the archive created by a `podman export` command. + +Secrets can also be used to store passwords for `podman login` to authenticate against container registries. + +## OPTIONS + +#### **--driver**, **-d**=*driver* + +Specify the secret driver (default **file**). + +#### **--driver-opts**=*key1=val1,key2=val2* + +Specify driver specific options. + +#### **--env**=*false* + +Read secret data from environment variable. + +#### **--help** + +Print usage statement. + +#### **--label**, **-l**=*key=val1,key2=val2* + +Add label to secret. These labels can be viewed in podman secrete inspect or ls. + +#### **--replace**=*false* + +If existing secret with the same name already exists, update the secret. +The `--replace` option does not change secrets within existing containers, only newly created containers. + The default is **false**. + +## SECRET DRIVERS + +#### file + +Secret resides in a read-protected file. + +#### pass + +Secret resides in a GPG-encrypted file. + +#### shell + +Secret is managed by custom scripts. An environment variable **SECRET_ID** +is passed to the scripts (except for **list**), and secrets are communicated +via stdin/stdout (where applicable). Driver options **list**, **lookup**, +**store**, and **delete** serve to install the scripts: + +``` +[secrets] +driver = "shell" + +[secrets.opts] +list = +lookup = +store = +delete = +``` + +## EXAMPLES + +Create the specified secret based on local file. +``` +echo -n mysecret > ./secret.txt +$ podman secret create my_secret ./secret.txt +``` + +Create the specified secret via stdin. +``` +$ printf | podman secret create my_secret - +``` + +Create gpg encrypted secret based on local file using the pass driver. +``` +$ podman secret create --driver=pass my_secret ./secret.txt.gpg +``` + +Create a secret from an environment variable called 'MYSECRET'. +``` +$ podman secret create --env=true my_secret MYSECRET +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)**, **[podman-login(1)](podman-login.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui +February 2024, Added example showing secret creation from an environment variable by Brett Calliss diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-secret-exists.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-secret-exists.1.md new file mode 100644 index 000000000..d63169399 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-secret-exists.1.md @@ -0,0 +1,48 @@ +--- +title: podman-secret-exists +version: v5.5.0 +--- + +% podman-secret-exists 1 + +## NAME +podman\-secret\-exists - Check if the given secret exists + +## SYNOPSIS +**podman secret exists** *secret* + +## DESCRIPTION +**podman secret exists** checks if a secret exists. Podman returns an exit code +of `0` when the secret is found. A `1` is returned otherwise. An exit code of +`125` indicates there was another issue. + + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLE + +Check if a secret called `mysecret` exists (the secret does actually exist). +``` +$ podman secret exists mysecret +$ echo $? +0 +$ +``` + +Check if a secret called `mypassword` exists (the secret does not actually exist). +``` +$ podman secret exists mypassword +$ echo $? +1 +$ +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)** + +## HISTORY +April 2023, Originally compiled by Ygal Blum `` diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-secret-inspect.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-secret-inspect.1.md new file mode 100644 index 000000000..a0c208594 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-secret-inspect.1.md @@ -0,0 +1,73 @@ +--- +title: podman-secret-inspect +version: v5.5.0 +--- + +% podman-secret-inspect 1 + +## NAME +podman\-secret\-inspect - Display detailed information on one or more secrets + +## SYNOPSIS +**podman secret inspect** [*options*] *secret* [...] + +## DESCRIPTION + +Inspects the specified secret. + +By default, this renders all results in a JSON array. If a format is specified, the given template is executed for each result. +Secrets can be queried individually by providing their full name or a unique partial name. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Format secret output using Go template. + +| **Placeholder** | **Description** | +|--------------------------|-------------------------------------------------------------------| +| .CreatedAt ... | When secret was created (relative timestamp, human-readable) | +| .ID | ID of secret | +| .SecretData | Secret Data (Displayed only with --showsecret option) | +| .Spec ... | Details of secret | +| .Spec.Driver ... | Driver info | +| .Spec.Driver.Name | Driver name (string) | +| .Spec.Driver.Options ... | Driver options (map of driver-specific options) | +| .Spec.Labels ... | Labels for this secret | +| .Spec.Name | Name of secret | +| .UpdatedAt ... | When secret was last updated (relative timestamp, human-readable) | + +#### **--help** + +Print usage statement. + +#### **--pretty** + +Print inspect output in human-readable format + +#### **--showsecret** + +Display secret data + +## EXAMPLES + +Inspect the secret mysecret. +``` +$ podman secret inspect mysecret +``` + +Inspect the secret mysecret and display the Name and Labels field. +``` +$ podman secret inspect --format "{{.Spec.Name}} {{.Spec.Labels}}" mysecret +``` + +Inspect the secret mysecret and display the Name and SecretData fields. Note this will display the secret data to the screen. +``` +$ podman secret inspect --showsecret --format "{{.Spec.Name}} {{.SecretData}}" mysecret +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-secret-ls.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-secret-ls.1.md new file mode 100644 index 000000000..c1408425d --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-secret-ls.1.md @@ -0,0 +1,84 @@ +--- +title: podman-secret-ls +version: v5.5.0 +--- + +% podman-secret-ls 1 + +## NAME +podman\-secret\-ls - List all available secrets + +## SYNOPSIS +**podman secret ls** [*options*] + +## DESCRIPTION + +Lists all the secrets that exist. The output can be formatted to a Go template using the **--format** option. + +## OPTIONS + +#### **--filter**, **-f**=*filter=value* + +Filter output based on conditions given. +Multiple filters can be given with multiple uses of the --filter option. + +Valid filters are listed below: + +| **Filter** | **Description** | +| ---------- | ----------------------------------------------------------------- | +| name | [Name] Secret name (accepts regex) | +| id | [ID] Full or partial secret ID | + +#### **--format**=*format* + +Format secret output using Go template. + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------------ | ----------------------------------------------------------------- | +| .CreatedAt ... | When secret was created (relative timestamp, human-readable) | +| .ID | ID of secret | +| .SecretData | Secret Data (Displayed only with --showsecret option) | +| .Spec ... | Details of secret | +| .Spec.Driver ... | Driver info | +| .Spec.Driver.Name | Driver name (string) | +| .Spec.Driver.Options ... | Driver options (map of driver-specific options) | +| .Spec.Labels ... | Labels for this secret | +| .Spec.Name | Name of secret | +| .UpdatedAt ... | When secret was last updated (relative timestamp, human-readable) | + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Print secret IDs only. + +## EXAMPLES + +List all secrets. +``` +$ podman secret ls +``` + +List the name field of all secrets. +``` +$ podman secret ls --format "{{.Name}}" +``` + +List all secrets whose name includes the specified string. +``` +$ podman secret ls --filter name=confidential +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-secret-rm.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-secret-rm.1.md new file mode 100644 index 000000000..df28af609 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-secret-rm.1.md @@ -0,0 +1,48 @@ +--- +title: podman-secret-rm +version: v5.5.0 +--- + +% podman-secret-rm 1 + +## NAME +podman\-secret\-rm - Remove one or more secrets + +## SYNOPSIS +**podman secret rm** [*options*] *secret* [...] + +## DESCRIPTION + +Removes one or more secrets. + +`podman secret rm` is safe to use on secrets that are in use by a container. +The created container has access to the secret data because secrets are +copied and mounted into the container when a container is created. If a secret is deleted and +another secret is created with the same name, the secret inside the container does not change; +the old secret value still remains. + +## OPTIONS + +#### **--all**, **-a** + +Remove all existing secrets. + +#### **--help** + +Print usage statement. + +#### **--ignore**, **-i** +Ignore errors when specified secrets are not present. + +## EXAMPLES + +Remove secrets mysecret1 and mysecret2. +``` +$ podman secret rm mysecret1 mysecret2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-secret.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-secret.1.md new file mode 100644 index 000000000..cd3b98084 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-secret.1.md @@ -0,0 +1,31 @@ +--- +title: podman-secret +version: v5.5.0 +--- + +% podman-secret 1 + +## NAME +podman\-secret - Manage podman secrets + +## SYNOPSIS +**podman secret** *subcommand* + +## DESCRIPTION +podman secret is a set of subcommands that manage secrets. + +## SUBCOMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------------ | ------------------------------------------------------ | +| create | [podman-secret-create(1)](podman-secret-create.1.md) | Create a new secret | +| exists | [podman-secret-exists(1)](podman-secret-exists.1.md) | Check if the given secret exists | +| inspect | [podman-secret-inspect(1)](podman-secret-inspect.1.md) | Display detailed information on one or more secrets | +| ls | [podman-secret-ls(1)](podman-secret-ls.1.md) | List all available secrets | +| rm | [podman-secret-rm(1)](podman-secret-rm.1.md) | Remove one or more secrets | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-start.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-start.1.md new file mode 100644 index 000000000..19129bb21 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-start.1.md @@ -0,0 +1,128 @@ +--- +title: podman-start +version: v5.5.0 +--- + +% podman-start 1 + +## NAME +podman\-start - Start one or more containers + +## SYNOPSIS +**podman start** [*options*] *container* ... + +**podman container start** [*options*] *container* ... + +## DESCRIPTION +Start one or more containers using container IDs or names as input. The *attach* and *interactive* +options cannot be used to override the *--tty* and *--interactive* options from when the container +was created. Starting an already running container with the *--attach* option, Podman simply +attaches to the container. + +## OPTIONS + +#### **--all** + +Start all the containers, default is only running containers. + +#### **--attach**, **-a** + +Attach container's STDOUT and STDERR. The default is false. This option cannot be used when +starting multiple containers. + + +[//]: # (BEGIN included file options/detach-keys.md) +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. + +[//]: # (END included file options/detach-keys.md) + +#### **--filter**, **-f** + +Filter what containers are going to be started from the given arguments. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + + +[//]: # (BEGIN included file options/interactive.md) +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. + +[//]: # (END included file options/interactive.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/sig-proxy.md) +#### **--sig-proxy** + +Proxy received signals to the container process. SIGCHLD, SIGURG, SIGSTOP, and SIGKILL are not proxied. + +[//]: # (END included file options/sig-proxy.md) + +The default is **true** when attaching, **false** otherwise. + +## EXAMPLE + +Start specified container: +``` +podman start mywebserver +``` + +Start multiple containers: +``` +podman start 860a4b231279 5421ab43b45 +``` + +Start specified container in interactive mode with terminal attached: +``` +podman start --interactive --attach 860a4b231279 +``` + +Start last created container in interactive mode (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman start -i -l +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +November 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-stats.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-stats.1.md new file mode 100644 index 000000000..0be793823 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-stats.1.md @@ -0,0 +1,164 @@ +--- +title: podman-stats +version: v5.5.0 +--- + +% podman-stats 1 + +## NAME +podman\-stats - Display a live stream of one or more container's resource usage statistics + +## SYNOPSIS +**podman stats** [*options*] [*container*] + +**podman container stats** [*options*] [*container*] + +## DESCRIPTION +Display a live stream of one or more containers' resource usage statistics + +Note: Podman stats does not work in rootless environments that use CGroups V1. +Podman stats relies on CGroup information for statistics, and CGroup v1 is not +supported for rootless use cases. + +Note: Rootless environments that use CGroups V2 are not able to report statistics +about their networking usage. + +## OPTIONS + +#### **--all**, **-a** + +Show all containers. Only running containers are shown by default + +#### **--format**=*template* + +Pretty-print container statistics to JSON or using a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|---------------------|--------------------------------------------------| +| .AvgCPU | Average CPU, full precision float | +| .AVGCPU | Average CPU, formatted as a percent | +| .BlockInput | Total data read from block device | +| .BlockIO | Total data read/total data written to block device| +| .BlockOutput | Total data written to block device | +| .ContainerID | Container ID, full (untruncated) hash | +| .ContainerStats ... | Nested structure, for experts only | +| .CPU | Percent CPU, full precision float | +| .CPUNano | CPU Usage, total, in nanoseconds | +| .CPUPerc | Percentage of CPU used | +| .CPUSystemNano | CPU Usage, kernel, in nanoseconds | +| .Duration | Same as CPUNano | +| .ID | Container ID, truncated | +| .MemLimit | Memory limit, in bytes | +| .MemPerc | Memory percentage used | +| .MemUsage | Memory usage | +| .MemUsageBytes | Memory usage (IEC) | +| .Name | Container Name | +| .NetIO | Network IO | +| .Network ... | Network I/O, separated by network interface | +| .PerCPU | CPU time consumed by all tasks [1] | +| .PIDs | Number of PIDs | +| .PIDS | Number of PIDs (yes, we know this is a dup) | +| .SystemNano | Current system datetime, nanoseconds since epoch | +| .Up | Duration (CPUNano), in human-readable form | +| .UpTime | Same as Up | + +[1] Cgroups V1 only + +When using a Go template, precede the format with `table` to print headers. + +#### **--interval**, **-i**=*seconds* + +Time in seconds between stats reports, defaults to 5 seconds. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/no-reset.md) +#### **--no-reset** + +Do not clear the terminal/screen in between reporting intervals + +[//]: # (END included file options/no-reset.md) + + +[//]: # (BEGIN included file options/no-stream.md) +#### **--no-stream** + +Disable streaming stats and only pull the first result, default setting is false + +[//]: # (END included file options/no-stream.md) + +#### **--no-trunc** + +Do not truncate output + +## EXAMPLE + +List statistics about all running containers without streaming mode: +``` +# podman stats -a --no-stream +ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS +a9f807ffaacd frosty_hodgkin -- 3.092MB / 16.7GB 0.02% -- / -- -- / -- 2 +3b33001239ee sleepy_stallman -- -- / -- -- -- / -- -- / -- -- +``` + +List the specified container's statistics in streaming mode: +``` +# podman stats a9f80 +ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS +a9f807ffaacd frosty_hodgkin -- 3.092MB / 16.7GB 0.02% -- / -- -- / -- 2 +``` + +List the specified statistics about the specified container in table format: +``` +$ podman stats --no-trunc 3667 --format 'table {{ .ID }} {{ .MemUsage }}' +ID MEM USAGE / LIMIT +3667c6aacb06aac2eaffce914c01736420023d56ef9b0f4cfe58b6d6a78b7503 49.15kB / 67.17GB +``` + +List the specified container statistics in JSON format: +``` +# podman stats --no-stream --format=json a9f80 +[ + { + "id": "a9f807ffaacd", + "name": "frosty_hodgkin", + "cpu_percent": "--", + "mem_usage": "3.092MB / 16.7GB", + "mem_percent": "0.02%", + "netio": "-- / --", + "blocki": "-- / --", + "pids": "2" + } +] +``` + +List the specified container statistics in table format: +``` +# podman stats --no-stream --format "table {{.ID}} {{.Name}} {{.MemUsage}}" 6eae +ID NAME MEM USAGE / LIMIT +6eae9e25a564 clever_bassi 3.031MB / 16.7GB +``` + +Note: When using a slirp4netns network with the rootlesskit port +handler, the traffic sent via the port forwarding is accounted to +the `lo` device. Traffic accounted to `lo` is not accounted in the +stats output. + + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +July 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-stop.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-stop.1.md new file mode 100644 index 000000000..f0d48f01a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-stop.1.md @@ -0,0 +1,142 @@ +--- +title: podman-stop +version: v5.5.0 +--- + +% podman-stop 1 + +## NAME +podman\-stop - Stop one or more running containers + +## SYNOPSIS +**podman stop** [*options*] *container* ... + +**podman container stop** [*options*] *container* ... + +## DESCRIPTION +Stops one or more containers using container IDs or names as input. The **--time** option +specifies the number of seconds to wait before forcibly stopping the container after the stop command +is issued to the container. The default is 10 seconds. By default, containers are stopped with SIGTERM +and then SIGKILL after the timeout. The SIGTERM default can be overridden by the image used to create the +container and also via command line when creating the container. + +## OPTIONS + +#### **--all**, **-a** + +Stop all running containers. This does not include paused containers. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and stop the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + +Command does not fail when *file* is missing and user specified --ignore. + +#### **--filter**, **-f**=*filter* + +Filter what containers are going to be stopped. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + + +[//]: # (BEGIN included file options/ignore.md) +#### **--ignore**, **-i** + +Ignore errors when specified containers are not in the container store. A user +might have decided to manually remove a container which leads to a failure +during the ExecStop directive of a systemd service referencing that container. + +[//]: # (END included file options/ignore.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping the container. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +## EXAMPLES + +Stop the specified container via its name. +``` +$ podman stop mywebserver +``` + +Stop the container via its id. +``` +$ podman stop 860a4b235279 +``` + +Stop multiple containers. +``` +$ podman stop mywebserver 860a4b235279 +``` + +Stop the container identified in the cidfile. +``` +$ podman stop --cidfile /home/user/cidfile-1 +``` + +Stop the containers identified in the cidfiles. +``` +$ podman stop --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +Stop the specified container in 2 seconds. +``` +$ podman stop --time 2 860a4b235279 +``` + +Stop all running containers. +``` +$ podman stop -a +``` + +Stop the last created container (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman stop --latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-rm(1)](podman-rm.1.md)** + +## HISTORY +September 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-system-check.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-system-check.1.md new file mode 100644 index 000000000..84093f7af --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-system-check.1.md @@ -0,0 +1,64 @@ +--- +title: podman-system-check +version: v5.5.0 +--- + +% podman-system-check 1 + +## NAME +podman\-system\-check - Perform consistency checks on image and container storage + +## SYNOPSIS +**podman system check** [*options*] + +## DESCRIPTION +Perform consistency checks on image and container storage, reporting images and +containers which have identified issues. + +## OPTIONS + +#### **--force**, **-f** + +When attempting to remove damaged images, also remove containers which depend +on those images. By default, damaged images which are being used by containers +are left alone. + +Containers which depend on damaged images do so regardless of which engine +created them, but because podman only "knows" how to shut down containers that +it started, the effect on still-running containers which were started by other +engines is difficult to predict. + +#### **--max**, **-m**=*duration* + +When considering layers which are not used by any images or containers, assume +that any layers which are more than *duration* old are the results of canceled +attempts to pull images, and should be treated as though they are damaged. + +#### **--quick**, **-q** + +Skip checks which are known to be time-consuming. This will prevent some types +of errors from being detected. + +#### **--repair**, **-r** + +Remove any images which are determined to have been damaged in some way, unless +they are in use by containers. Use **--force** to remove containers which +depend on damaged images, and those damaged images, as well. + +## EXAMPLE + +A reasonably quick check: +``` +podman system check --quick --repair --force +``` + +A more thorough check: +``` +podman system check --repair --max=1h --force +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)** + +## HISTORY +April 2024 diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-system-connection-add.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-system-connection-add.1.md new file mode 100644 index 000000000..6de11b5ec --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-system-connection-add.1.md @@ -0,0 +1,69 @@ +--- +title: podman-system-connection-add +version: v5.5.0 +--- + +% podman-system-connection-add 1 + +## NAME +podman\-system\-connection\-add - Record destination for the Podman service + +## SYNOPSIS +**podman system connection add** [*options*] *name* *destination* + +## DESCRIPTION +Record ssh destination for remote podman service(s). The ssh destination is given as one of: + - [user@]hostname[:port] + - ssh://[user@]hostname[:port] + - unix://path + - tcp://hostname\\:port + +The user is prompted for the remote ssh login password or key file passphrase as required. The `ssh-agent` is supported if it is running. + +## OPTIONS + +#### **--default**, **-d** + +Make the new destination the default for this user. The default is **false**. + +#### **--identity**=*path* + +Path to ssh identity file. If the identity file has been encrypted, Podman prompts the user for the passphrase. +If no identity file is provided and no user is given, Podman defaults to the user running the podman command. +Podman prompts for the login password on the remote server. + +#### **--port**, **-p**=*port* + +Port for ssh destination. The default value is `22`. + +#### **--socket-path**=*path* + +Path to the Podman service unix domain socket on the ssh destination host + +## EXAMPLE + +Add a named system connection: +``` +$ podman system connection add QA podman.example.com +``` + +Add a system connection using SSH data: +``` +$ podman system connection add --identity ~/.ssh/dev_rsa production ssh://root@server.example.com:2222 +``` + +Add a named system connection to local Unix domain socket: +``` +$ podman system connection add testing unix:///run/podman/podman.sock +``` + +Add a named system connection to local tcp socket: +``` +$ podman system connection add debug tcp://localhost:8080 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + + +## HISTORY +June 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-system-connection-default.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-system-connection-default.1.md new file mode 100644 index 000000000..cbeadf4dd --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-system-connection-default.1.md @@ -0,0 +1,27 @@ +--- +title: podman-system-connection-default +version: v5.5.0 +--- + +% podman-system-connection-default 1 + +## NAME +podman\-system\-connection\-default - Set named destination as default for the Podman service + +## SYNOPSIS +**podman system connection default** *name* + +## DESCRIPTION +Set named ssh destination as default destination for the Podman service. + +## EXAMPLE + +Set the specified connection as default: +``` +$ podman system connection default production +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + +## HISTORY +July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-system-connection-list.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-system-connection-list.1.md new file mode 100644 index 000000000..d32296a09 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-system-connection-list.1.md @@ -0,0 +1,51 @@ +--- +title: podman-system-connection-list +version: v5.5.0 +--- + +% podman-system-connection-list 1 + +## NAME +podman\-system\-connection\-list - List the destination for the Podman service(s) + +## SYNOPSIS +**podman system connection list** [*options*] + +**podman system connection ls** [*options*] + +## DESCRIPTION +List ssh destination(s) for podman service(s). + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change the default output format. This can be of a supported type like 'json' or a Go template. +Valid placeholders for the Go template listed below: + +| **Placeholder** | **Description** | +| --------------- | ----------------------------------------------------------------------------- | +| .Default | Indicates whether connection is the default | +| .Identity | Path to file containing SSH identity | +| .Name | Connection Name/Identifier | +| .ReadWrite | Indicates if this connection can be modified using the system connection commands | +| .URI | URI to podman service. Valid schemes are ssh://[user@]*host*[\:port]*Unix domain socket*[?secure=True], unix://*Unix domain socket*, and tcp://localhost[:*port*] | + +#### **--quiet**, **-q** + +Only show connection names + +## EXAMPLE + +List system connections: +``` +$ podman system connection list +Name URI Identity Default ReadWrite +deva ssh://root@example.com:/run/podman/podman.sock ~/.ssh/id_rsa true true +devb ssh://user@example.com:/run/user/1000/podman/podman.sock ~/.ssh/id_rsa false true +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + +## HISTORY +July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-system-connection-remove.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-system-connection-remove.1.md new file mode 100644 index 000000000..70e1bcf34 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-system-connection-remove.1.md @@ -0,0 +1,33 @@ +--- +title: podman-system-connection-remove +version: v5.5.0 +--- + +% podman-system-connection-remove 1 + +## NAME +podman\-system\-connection\-remove - Delete named destination + +## SYNOPSIS +**podman system connection remove** [*options*] *name* + +## DESCRIPTION +Delete named ssh destination. + +## OPTIONS + +#### **--all**, **-a** + +Remove all connections. + +## EXAMPLE + +Remove the specified system connection: +``` +$ podman system connection remove production +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + +## HISTORY +July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-system-connection-rename.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-system-connection-rename.1.md new file mode 100644 index 000000000..1aaea6bc8 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-system-connection-rename.1.md @@ -0,0 +1,27 @@ +--- +title: podman-system-connection-rename +version: v5.5.0 +--- + +% podman-system-connection-rename 1 + +## NAME +podman\-system\-connection\-rename - Rename the destination for Podman service + +## SYNOPSIS +**podman system connection rename** *old* *new* + +## DESCRIPTION +Rename ssh destination from *old* to *new*. + +## EXAMPLE + +Rename the specified connection: +``` +$ podman system connection rename laptop devel +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + +## HISTORY +July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-system-connection.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-system-connection.1.md new file mode 100644 index 000000000..588c50543 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-system-connection.1.md @@ -0,0 +1,52 @@ +--- +title: podman-system-connection +version: v5.5.0 +--- + +% podman-system-connection 1 + +## NAME +podman\-system\-connection - Manage the destination(s) for Podman service(s) + +## SYNOPSIS +**podman system connection** *subcommand* + +## DESCRIPTION +Manage the destination(s) for Podman service(s). + +The user is prompted for the ssh login password or key file passphrase as required. The `ssh-agent` is supported if it is running. + +Podman manages the system connection by writing and reading the `podman-connections.json` file located under +`$XDG_CONFIG_HOME/containers` or if the env is not set it defaults to `$HOME/.config/containers`. +Or the `PODMAN_CONNECTIONS_CONF` environment variable can be set to a full file path which podman +will use instead. +This file is managed by the podman commands and should never be edited by users directly. To manually +configure the connections use `service_destinations` in containers.conf. + +If the ReadWrite column in the **podman system connection list** output is set to true the connection is +stored in the `podman-connections.json` file otherwise it is stored in containers.conf and can therefore +not be edited with the **podman system connection** commands. + +## COMMANDS + +| Command | Man Page | Description | +| -------- | ----------------------------------------------------------------------------- | ---------------------------------------------------------- | +| add | [podman-system-connection\-add(1)](podman-system-connection-add.1.md) | Record destination for the Podman service | +| default | [podman-system-connection\-default(1)](podman-system-connection-default.1.md) | Set named destination as default for the Podman service | +| list | [podman-system-connection\-list(1)](podman-system-connection-list.1.md) | List the destination for the Podman service(s) | +| remove | [podman-system-connection\-remove(1)](podman-system-connection-remove.1.md) | Delete named destination | +| rename | [podman-system-connection\-rename(1)](podman-system-connection-rename.1.md) | Rename the destination for Podman service | + +## EXAMPLE + +List system connections: +``` +$ podman system connection list +Name URI Identity Default ReadWrite +devl ssh://root@example.com/run/podman/podman.sock ~/.ssh/id_rsa true true +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)** + +## HISTORY +June 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-system-df.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-system-df.1.md new file mode 100644 index 000000000..7a4ff95d4 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-system-df.1.md @@ -0,0 +1,84 @@ +--- +title: podman-system-df +version: v5.5.0 +--- + +% podman-system-df 1 + +## NAME +podman\-system\-df - Show podman disk usage + +## SYNOPSIS +**podman system df** [*options*] + +## DESCRIPTION +Show podman disk usage for images, containers and volumes. + +Note: The RECLAIMABLE size that is reported for images can be incorrect. It might +report that it can reclaim more than a prune would actually free. This will happen +if you are using different images that share some layers. + +## OPTIONS +#### **--format**=*format* + +Pretty-print images using a Go template or JSON. This flag is not allowed in combination with **--verbose** + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------------- | ------------------------------------------------ | +| .Active | Indicates whether volume is in use | +| .RawReclaimable | Raw reclaimable size of each Type | +| .RawSize | Raw size of each type | +| .Reclaimable | Reclaimable size or each type (human-readable) | +| .Size | Size of each type (human-readable) | +| .Total | Total items for each type | +| .Type | Type of data | + + +#### **--verbose**, **-v** +Show detailed information on space usage + +## EXAMPLE + +Show disk usage: +``` +$ podman system df +TYPE TOTAL ACTIVE SIZE RECLAIMABLE +Images 6 2 281MB 168MB (59%) +Containers 3 1 0B 0B (0%) +Local Volumes 1 1 22B 0B (0%) +``` + +Show disk usage in verbose mode: +``` +$ podman system df -v +Images space usage: + +REPOSITORY TAG IMAGE ID CREATED SIZE SHARED SIZE UNIQUE SIZE CONTAINERS +docker.io/library/alpine latest 5cb3aa00f899 2 weeks ago 5.79MB 0B 5.79MB 5 + +Containers space usage: + +CONTAINER ID IMAGE COMMAND LOCAL VOLUMES SIZE CREATED STATUS NAMES +073f7e62812d 5cb3 sleep 100 1 0B 20 hours ago exited zen_joliot +3f19f5bba242 5cb3 sleep 100 0 5.52kB 22 hours ago exited pedantic_archimedes +8cd89bf645cc 5cb3 ls foodir 0 58B 21 hours ago configured agitated_hamilton +a1d948a4b61d 5cb3 ls foodir 0 12B 21 hours ago exited laughing_wing +eafe3e3c5bb3 5cb3 sleep 10000 0 72B 21 hours ago exited priceless_liskov + +Local Volumes space usage: + +VOLUME NAME LINKS SIZE +data 1 0B + +$ podman system df --format "{{.Type}}\t{{.Total}}" +Images 1 +Containers 5 +Local Volumes 1 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)** + +## HISTORY +March 2019, Originally compiled by Qi Wang (qiwan at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-system-migrate.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-system-migrate.1.md new file mode 100644 index 000000000..209038066 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-system-migrate.1.md @@ -0,0 +1,44 @@ +--- +title: podman-system-migrate +version: v5.5.0 +--- + +% podman-system-migrate 1 + +## NAME +podman\-system\-migrate - Migrate existing containers to a new podman version + +## SYNOPSIS +**podman system migrate** [*options*] + +## DESCRIPTION +**podman system migrate** migrates containers to the latest podman version. + +**podman system migrate** takes care of migrating existing containers to the latest version of podman if any change is necessary. + +"Rootless Podman uses a pause process to keep the unprivileged +namespaces alive. This prevents any change to the `/etc/subuid` and +`/etc/subgid` files from being propagated to the rootless containers +while the pause process is running. + +For these changes to be propagated, it is necessary to first stop all +running containers associated with the user and to also stop the pause +process and delete its pid file. Instead of doing it manually, `podman +system migrate` can be used to stop both the running containers and the +pause process. The `/etc/subuid` and `/etc/subgid` files can then be +edited or changed with usermod to recreate the user namespace with the +newly configured mappings. + +## OPTIONS + +#### **--new-runtime**=*runtime* + +Set a new OCI runtime for all containers. +This can be used after a system upgrade which changes the default OCI runtime to move all containers to the new runtime. +There are no guarantees that the containers continue to work under the new runtime, as some runtimes support differing options and configurations. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **usermod(8)** + +## HISTORY +April 2019, Originally compiled by Giuseppe Scrivano (gscrivan at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-system-prune.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-system-prune.1.md new file mode 100644 index 000000000..d96c37ec0 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-system-prune.1.md @@ -0,0 +1,76 @@ +--- +title: podman-system-prune +version: v5.5.0 +--- + +% podman-system-prune 1 + +## NAME +podman\-system\-prune - Remove all unused pods, containers, images, networks, and volume data + +## SYNOPSIS +**podman system prune** [*options*] + +## DESCRIPTION +**podman system prune** removes all unused containers (both dangling and unreferenced), build containers, pods, networks, and optionally, volumes from local storage. + +Use the **--all** option to delete all unused images. Unused images are dangling images as well as any image that does not have any containers based on it. + +By default, volumes are not removed to prevent important data from being deleted if there is currently no container using the volume. Use the **--volumes** flag when running the command to prune volumes as well. + +By default, build containers are not removed to prevent interference with builds in progress. Use the **--build** flag when running the command to remove build containers as well. + +## OPTIONS +#### **--all**, **-a** + +Recursively remove all unused pods, containers, images, networks, and volume data. (Maximum 50 iterations.) + +#### **--build** + +Removes any build containers that were created during the build, but were not removed because the build was unexpectedly terminated. + +Note: **This is not safe operation and should be executed only when no builds are in progress. It can interfere with builds in progress.** + +#### **--external** + +Tries to clean up remainders of previous containers or layers that are not references in the storage json files. These can happen in the case of unclean shutdowns or regular restarts in transient storage mode. + +However, when using transient storage mode, the Podman database does not persist. This means containers leave the writable layers on disk after a reboot. When using a transient store, it is recommended that the **podman system prune --external** command is run during boot. + +This option is incompatible with **--all** and **--filter** and drops the default behaviour of removing unused resources. + +#### **--filter**=*filters* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------:|-----------------------------------------------------------------------------------------------------------------| +| label | Only remove containers and images, with (or without, in the case of label!=[...] is used) the specified labels. | +| until | Only remove containers and images created before given timestamp. | + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes containers and images with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes containers and images without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not prompt for confirmation + +#### **--help**, **-h** + +Print usage statement + +#### **--volumes** + +Prune volumes currently unused by any container + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)** + +## HISTORY +February 2019, Originally compiled by Dan Walsh (dwalsh at redhat dot com) +December 2020, converted filter information from docs.docker.com documentation by Dan Walsh (dwalsh at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-system-renumber.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-system-renumber.1.md new file mode 100644 index 000000000..ad929e078 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-system-renumber.1.md @@ -0,0 +1,31 @@ +--- +title: podman-system-renumber +version: v5.5.0 +--- + +% podman-system-renumber 1 + +## NAME +podman\-system\-renumber - Migrate lock numbers to handle a change in maximum number of locks + +## SYNOPSIS +**podman system renumber** + +## DESCRIPTION +**podman system renumber** renumbers locks used by containers and pods. + +Each Podman container and pod is allocated a lock at creation time, up to a maximum number controlled by the **num_locks** parameter in **containers.conf**. + +When all available locks are exhausted, no further containers and pods can be created until some existing containers and pods are removed. This can be avoided by increasing the number of locks available via modifying **containers.conf** and subsequently running **podman system renumber** to prepare the new locks (and reallocate lock numbers to fit the new struct). + +**podman system renumber** must be called after any changes to **num_locks** - failure to do so results in errors starting Podman as the number of locks available conflicts with the configured number of locks. + +**podman system renumber** can also be used to migrate 1.0 and earlier versions of Podman, which used a different locking scheme, to the new locking model. It is not strictly required to do this, but it is highly recommended to do so as deadlocks can occur otherwise. + +If possible, avoid calling **podman system renumber** while there are other Podman processes running. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +## HISTORY +February 2019, Originally compiled by Matt Heon (mheon at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-system-reset.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-system-reset.1.md new file mode 100644 index 000000000..aa6178869 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-system-reset.1.md @@ -0,0 +1,74 @@ +--- +title: podman-system-reset +version: v5.5.0 +--- + +% podman-system-reset 1 + +## NAME +podman\-system\-reset - Reset storage back to initial state + +## SYNOPSIS +**podman system reset** [*options*] + +## DESCRIPTION +**podman system reset** removes all pods, containers, images, networks and volumes, and machines. +It also removes the configured graphRoot and runRoot directories. Make sure these are not set to +some important directory. + +This command must be run **before** changing any of the following fields in the +`containers.conf` or `storage.conf` files: `driver`, `static_dir`, `tmp_dir` +or `volume_path`. + +`podman system reset` reads the current configuration and attempts to remove all +of the relevant configurations. If the administrator modified the configuration files first, +`podman system reset` might not be able to clean up the previous storage. + +`podman system reset` does not restart podman.service and podman.socket systemd units. You may need to manually restart it after running this command. + +## OPTIONS +#### **--force**, **-f** + +Do not prompt for confirmation + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Reset all storage back to a clean initialized state. +``` +$ podman system reset +WARNING! This will remove: + - all containers + - all pods + - all images + - all networks + - all build cache + - all machines + - all volumes + - the graphRoot directory: /var/lib/containers/storage + - the runRoot directory: /run/containers/storage +Are you sure you want to continue? [y/N] y +``` + +### Switching rootless user from VFS driver to overlay with fuse-overlayfs + +If the user ran rootless containers without having the `fuse-overlayfs` program +installed, podman defaults to the `vfs` storage in their home directory. If they +want to switch to use fuse-overlay, they must install the fuse-overlayfs +package. The user needs to reset the storage to use overlayfs by default. +Execute `podman system reset` as the user first to remove the VFS storage. Now +the user can edit the `/etc/containers/storage.conf` to make any changes if +necessary. If the system's default was already `overlay`, then no changes are +necessary to switch to fuse-overlayfs. Podman looks for the existence of +fuse-overlayfs to use it when set in the `overlay` driver, only falling back to vfs +if the program does not exist. Users can run `podman info` to ensure Podman is +using fuse-overlayfs and the overlay driver. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[fuse-overlayfs(1)](https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)** + +## HISTORY +November 2019, Originally compiled by Dan Walsh (dwalsh at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-system-service.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-system-service.1.md new file mode 100644 index 000000000..373dd5646 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-system-service.1.md @@ -0,0 +1,146 @@ +--- +title: podman-system-service +version: v5.5.0 +--- + +% podman-system-service 1 + +## NAME +podman\-system\-service - Run an API service + +## SYNOPSIS +**podman system service** [*options*] + +## DESCRIPTION +The **podman system service** command creates a listening service that answers API calls for Podman. +The command is available on Linux systems and is usually executed in systemd services. +The command is not available when the Podman command is executed directly on a Windows or macOS +host or in other situations where the Podman command is accessing a remote Podman API service. + +The REST API provided by **podman system service** is split into two parts: a compatibility layer offering support for the Docker v1.40 API, and a Podman-native Libpod layer. +Documentation for the latter is available at *https://docs.podman.io/en/latest/_static/api.html*. +Both APIs are versioned, but the server does not reject requests with an unsupported version set. + +### Run the command in a systemd service + +The command **podman system service** supports systemd socket activation. +When the command is run in a systemd service, the API service can therefore be provided on demand. +If the systemd service is not already running, it will be activated as soon as +a client connects to the listening socket. Systemd then executes the +**podman system service** command. +After some time of inactivity, as defined by the __--time__ option, the command terminates. +Systemd sets the _podman.service_ state as inactive. At this point there is no +**podman system service** process running. No unnecessary compute resources are wasted. +As soon as another client connects, systemd activates the systemd service again. + +The systemd unit files that declares the Podman API service for users are + +* _/usr/lib/systemd/user/podman.service_ +* _/usr/lib/systemd/user/podman.socket_ + +In the file _podman.socket_ the path of the listening Unix socket is defined by + +``` +ListenStream=%t/podman/podman.sock +``` + +The path contains the systemd specifier `%t` which systemd expands to the value of the environment variable +`XDG_RUNTIME_DIR` (see systemd specifiers in the **systemd.unit(5)** man page). + +In addition to the systemd user services, there is also a systemd system service _podman.service_. +It runs rootful Podman and is accessed from the Unix socket _/run/podman/podman.sock_. See the systemd unit files + +* _/usr/lib/systemd/system/podman.service_ +* _/usr/lib/systemd/system/podman.socket_ + +The **podman system service** command does not support more than one listening socket for the API service. + +Note: The default systemd unit files (system and user) change the log-level option to *info* from *error*. This change provides additional information on each API call. + +### Run the command directly + +To support running an API service without using a systemd service, the command also takes an +optional endpoint argument for the API in URI form. For example, *unix:///tmp/foobar.sock* or *tcp://localhost:8080*. +If no endpoint is provided, defaults is used. The default endpoint for a rootful +service is *unix:///run/podman/podman.sock* and rootless is *unix://$XDG_RUNTIME_DIR/podman/podman.sock* (for +example *unix:///run/user/1000/podman/podman.sock*) + +### Access the Unix socket from inside a container + +To access the API service inside a container: +- mount the socket as a volume +- run the container with `--security-opt label=disable` + +### Security + +Please note that the API grants full access to all Podman functionality, and thus allows arbitrary code execution as the user running the API, with no ability to limit or audit this access. +The API's security model is built upon access via a Unix socket with access restricted via standard file permissions, ensuring that only the user running the service will be able to access it. +We *strongly* recommend against making the API socket available via the network (IE, bindings the service to a *tcp* URL). +Even access via Localhost carries risks - anyone with access to the system will be able to access the API. +If remote access is required, we instead recommend forwarding the API socket via SSH, and limiting access on the remote machine to the greatest extent possible. +If a *tcp* URL must be used, using the *--cors* option is recommended to improve security. + +## OPTIONS + +#### **--cors** + +CORS headers to inject to the HTTP response. The default value is empty string which disables CORS headers. + +#### **--help**, **-h** + +Print usage statement. + +#### **--time**, **-t** + +The time until the session expires in _seconds_. The default is 5 +seconds. A value of `0` means no timeout, therefore the session does not expire. + +The default timeout can be changed via the `service_timeout=VALUE` field in containers.conf. +See **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** for more information. + +## EXAMPLES + +Start the user systemd socket for a rootless service. +``` +systemctl --user start podman.socket +``` + +Configure DOCKER_HOST environment variable to point to the Podman socket so that +it can be used via Docker API tools like docker-compose. +``` +$ export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock +$ docker-compose up +``` + +Configure the systemd socket to be automatically started after reboots, and run as the specified user. +``` +systemctl --user enable podman.socket +loginctl enable-linger +``` + +Start the systemd socket for the rootful service. +``` +sudo systemctl start podman.socket +``` + +Configure the socket to be automatically started after reboots. +``` +sudo systemctl enable podman.socket +``` + +It is possible to run the API without using systemd socket activation. +In this case the API will not be available on demand because the command will +stay terminated after the inactivity timeout has passed. +Run an API with an inactivity timeout of 5 seconds without using socket activation. +``` +podman system service --time 5 +``` + +The default socket was used as no URI argument was provided. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +## HISTORY +January 2020, Originally compiled by Brent Baude `` +November 2020, Updated by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-system.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-system.1.md new file mode 100644 index 000000000..12ce7cafe --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-system.1.md @@ -0,0 +1,33 @@ +--- +title: podman-system +version: v5.5.0 +--- + +% podman-system 1 + +## NAME +podman\-system - Manage podman + +## SYNOPSIS +**podman system** *subcommand* + +## DESCRIPTION +The system command allows management of the podman systems + +## COMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------------------ | ------------------------------------------------------------------------ | +| check | [podman-system-check(1)](podman-system-check.1.md) | Perform consistency checks on image and container storage. +| connection | [podman-system-connection(1)](podman-system-connection.1.md) | Manage the destination(s) for Podman service(s) | +| df | [podman-system-df(1)](podman-system-df.1.md) | Show podman disk usage. | +| events | [podman-events(1)](podman-events.1.md) | Monitor Podman events | +| info | [podman-info(1)](podman-info.1.md) | Display Podman related system information. | +| migrate | [podman-system-migrate(1)](podman-system-migrate.1.md) | Migrate existing containers to a new podman version. | +| prune | [podman-system-prune(1)](podman-system-prune.1.md) | Remove all unused pods, containers, images, networks, and volume data. | +| renumber | [podman-system-renumber(1)](podman-system-renumber.1.md) | Migrate lock numbers to handle a change in maximum number of locks. | +| reset | [podman-system-reset(1)](podman-system-reset.1.md) | Reset storage back to initial state. | +| service | [podman-system-service(1)](podman-system-service.1.md) | Run an API service | + +## SEE ALSO +**[podman(1)](podman.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-systemd.unit.5.md b/versioned_docs/version-5.5.0/source/markdown/podman-systemd.unit.5.md new file mode 100644 index 000000000..9bac79f49 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-systemd.unit.5.md @@ -0,0 +1,2193 @@ +--- +title: Restart service when sleep finishes +version: v5.5.0 +--- + +% podman-systemd.unit 5 + +## NAME + +podman\-systemd.unit - systemd units using Podman Quadlet + +## SYNOPSIS + +*name*.container, *name*.volume, *name*.network, *name*.kube *name*.image, *name*.build *name*.pod + +### Podman rootful unit search path + +Quadlet files for the root user can be placed in the following directories ordered in precedence. Meaning duplicate named quadlets found under /run take precedence over ones in /etc, as well as those in /usr: + +Temporary quadlets, usually used for testing: + +* /run/containers/systemd/ + +System administrator's defined quadlets: + +* /etc/containers/systemd/ + +Distribution defined quadlets: + +* /usr/share/containers/systemd/ + +### Podman rootless unit search path + +Quadlet files for non-root users can be placed in the following directories: + + * $XDG_RUNTIME_DIR/containers/systemd/ + * $XDG_CONFIG_HOME/containers/systemd/ or ~/.config/containers/systemd/ + * /etc/containers/systemd/users/$(UID) + * /etc/containers/systemd/users/ + +### Using symbolic links + +Quadlet supports using symbolic links for the base of the search paths and inside them. + +## DESCRIPTION + +Podman supports building and starting containers (and creating volumes) via systemd by using a +[systemd generator](https://www.freedesktop.org/software/systemd/man/systemd.generator.html). +These files are read during boot (and when `systemctl daemon-reload` is run) and generate +corresponding regular systemd service unit files. Both system and user systemd units are supported. +All options and tables available in standard systemd unit files are supported. For example, options defined in +the [Service] table and [Install] tables pass directly to systemd and are handled by it. +See systemd.unit(5) man page for more information. + +The Podman generator reads the search paths above and reads files with the extensions `.container` +`.volume`, `.network`, `.build`, `.pod` and `.kube`, and for each file generates a similarly named `.service` file. Be aware that +existing vendor services (i.e., in `/usr/`) are replaced if they have the same name. The generated unit files can +be started and managed with `systemctl` like any other systemd service. `systemctl {--user} list-unit-files` +lists existing unit files on the system. + +The Podman files use the same format as [regular systemd unit files](https://www.freedesktop.org/software/systemd/man/systemd.syntax.html). +Each file type has a custom section (for example, `[Container]`) that is handled by Podman, and all +other sections are passed on untouched, allowing the use of any normal systemd configuration options +like dependencies or cgroup limits. + +The source files also support drop-ins in the same [way systemd does](https://www.freedesktop.org/software/systemd/man/latest/systemd.unit.html). +For a given source file (`foo.container`), the corresponding `.d` directory (`foo.container.d`) will +be scanned for files with a `.conf` extension, which are then merged into the base file in alphabetical +order. Top-level type drop-ins (`container.d`) will also be included. If the unit contains dashes ("-") +in the name (`foo-bar-baz.container`), then the drop-in directories generated by truncating the name after +the dash are searched as well (`foo-.container.d` and `foo-bar-.container.d`). Drop-in files with the same name +further down the hierarchy override those further up (`foo-bar-baz.container.d/10-override.conf` overrides +`foo-bar-.container.d/10-override.conf`, which overrides `foo-.service.d/10-override.conf`, which overrides +`container.d/10-override.conf`). The format of these drop-in files is the same as the base file. This is useful +to alter or add configuration settings for a unit, without having to modify unit files. + +For rootless containers, when administrators place Quadlet files in the +/etc/containers/systemd/users directory, all users' sessions execute the +Quadlet when the login session begins. If the administrator places a Quadlet +file in the /etc/containers/systemd/users/${UID}/ directory, then only the +user with the matching UID executes the Quadlet when the login +session gets started. For unit files placed in subdirectories within +/etc/containers/systemd/user/${UID}/ and the other user unit search paths, +Quadlet will recursively search and run the unit files present in these subdirectories. + +Note: When a Quadlet is starting, Podman often pulls or builds one more container images which may take a considerable amount of time. +Systemd defaults service start time to 90 seconds, or fails the service. Pre-pulling the image or extending +the systemd timeout time for the service using the *TimeoutStartSec* Service option can fix the problem. +A word of caution: *TimeoutStartSec* is not available for `Type=oneshot` units. Refer to `systemd.service(5)` +for more information on how to handle long startup times for units which do not need to stay active +once their main process has finished. + +Adding the following snippet to a Quadlet file extends the systemd timeout to 15 minutes. + +``` +[Service] +TimeoutStartSec=900 +``` + +Quadlet requires the use of cgroup v2, use `podman info --format {{.Host.CgroupsVersion}}` to check on the system. + +### Service Type + +By default, the `Type` field of the `Service` section of the Quadlet file does not need to be set. +Quadlet will set it to `notify` for `.container` and `.kube` files, +`forking` for `.pod` files, and `oneshot` for `.volume`, `.network`, `.build`, and `.image` files. + +However, `Type` may be explicitly set to `oneshot` for `.container` and `.kube` files when no containers are expected +to run once `podman` exits. + +When setting `Type=oneshot`, it is recommended to also set `RemainAfterExit=yes` to prevent the service state +from becoming `inactive (dead)`. However, when activating a service via a timer unit, having `RemainAfterExit=yes` +leaves the job in a "started" state which prevents subsequent activations by the timer. For more information, see the +`systemd.service(5)` man page. + +Examples for such cases: +- `.container` file with an image that exits after their entrypoint has finished + +- `.kube` file pointing to a Kubernetes Yaml file that does not define any containers. E.g. PVCs only + +### Enabling unit files + +The services created by Podman are considered transient by systemd, which means they don't have the same +persistence rules as regular units. In particular, it is not possible to `systemctl enable` them +in order for them to become automatically enabled on the next boot. + +To compensate for this, the generator manually applies the `[Install]` section of the container definition +unit files during generation, in the same way `systemctl enable` does when run later. + +For example, to start a container on boot, add something like this to the file: + +``` +[Install] +WantedBy=default.target +``` + +Currently, only the `Alias`, `WantedBy`, `RequiredBy`, and `UpheldBy` keys are supported. + +The Install section can be part of the main file, or it can be in a +separate drop-in file as described above. The latter allows you to +install an non-enabled unit and then later enabling it by installing +the drop-in. + + +**NOTE:** To express dependencies between containers, use the generated names of the services. In other +words `WantedBy=other.service`, not `WantedBy=other.container`. The same is +true for other kinds of dependencies, too, like `After=other.service`. + +### Template files + +Systemd supports a concept of [template files](https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html#Service%20Templates). +They are units with names of the form "basename@instancename.service" +when they are running, but that can be instantiated multiple times +from a single "basename@.service" file. The individual instances can +also be different by using drop-in files with the full instance name. + +Quadlets support these in two ways. First of all, a quadlet unit with +a template form will generate a systemd service with a template form, +and the template systemd service can be used as a regular template. +For example, "foo@.container" will generate "foo@.service" and you can +then "systemctl start foo@bar.service". + +Secondly, if you make a symlink like "foo@instance.container", that +will generate an instantiated template file. When generating this file +quadlet will read drop-in files both from the instanced directory +(foo@instance.container.d) and the template directory +(foo@.container.d). This allows customization of individual instances. + +Instanced template files (like `foo@bar.container`) can be enabled +just like non-templated ones. However, templated ones +(`foo@.container`) are different, because they need to be +instantiated. If the `[Install]` section contains a `DefaultInstance=` +key, then that instance will be enabled, but if not, nothing will +happen and the options will only be used as the default for units +that are instantiated using symlinks. + +An example template file `sleep@.container` might look like this: + +``` +[Unit] +Description=A templated sleepy container + +[Container] +Image=quay.io/fedora/fedora +Exec=sleep %i + +[Service] +# Restart service when sleep finishes +Restart=always + +[Install] +WantedBy=multi-user.target +DefaultInstance=100 +``` + +If this is installed, then on boot there will be a `sleep@100.service` +running that sleeps for 100 seconds. You can then do something like +`systemctl start sleep@50.service` to start another instance that +sleeps 50 seconds, or alternatively another service can start it via a +dependency like `Wants=sleep@50.service`. + +In addition, if you do `ln -s sleep@.container sleep@10.container` you +will also have a 10 second sleep running at boot. And, if you want +that particular instance to be running with another image, you can +create a drop-in file like `sleep@10.container.d/10-image.conf`: +``` +[Container] +Image=quay.io/centos/centos +``` + +### Relative paths + +In order to support Systemd specifiers, Quadlet does not resolve relative paths that start with `%`. +To resolve such a path, prepend it with `./`. + +For example, instead of `EnvironmentFile=%n/env` use `EnvironmentFile=./%n/env` + +### Debugging unit files + +After placing the unit file in one of the unit search paths (mentioned +above), you can start it with `systemctl start {--user}`. If it fails +with "Failed to start example.service: Unit example.service not +found.", then it is possible that you used incorrect syntax or you +used an option from a newer version of Podman Quadlet and the +generator failed to create a service file. + +View the generated files and/or error messages with: +``` +/usr/lib/systemd/system-generators/podman-system-generator {--user} --dryrun +``` + +Alternatively, show only the errors with: +``` +systemd-analyze {--user} --generators=true verify example.service +``` + +That command also performs additional checks on the generated service unit. +For details, see systemd-analyze(1) man page. + +#### Debugging a limited set of unit files + +If you would like to debug a limited set of unit files, you can copy them to a separate directory and set the +`QUADLET_UNIT_DIRS` environment variable to this directory when running the command below: + +``` +QUADLET_UNIT_DIRS= /usr/lib/systemd/system-generators/podman-system-generator {--user} --dryrun +``` + +This will instruct Quadlet to look for units in this directory instead of the common ones and by +that limit the output to only the units you are debugging. + +### Implicit network dependencies + +Quadlet will add dependencies on `network-online.target` (as root) or `podman-user-wait-network-online.service` +(as user) by adding `After=` and `Wants=` properties to the unit. This is to ensure that the network is reachable +if an image needs to be pulled and by the time the container is started. + +The special case `podman-user-wait-network-online.service` unit is needed as user because user units are unable to wait +for system (root) units so `network-online.target` doesn't do anything there and is instead ignored. As this caused +a significant amount of issues we decided to work around this with our own special purpose unit that simply checks if +the `network-online.target` unit is active with `systemctl is-active network-online.target`. + +This behavior can be disabled by adding `DefaultDependencies=false` in the `Quadlet` section. +Note, the _systemd_ `[Unit]` section has an option with the same name but a different meaning. + +### Dependency between Quadlet units + +Quadlet will automatically translate dependencies, specified in the keys +`Wants`, `Requires`, `Requisite`, `BindsTo`, `PartOf`, `Upholds`, `Conflicts`, `Before` and `After` +of the `[Unit]` section, between different Quadlet units. + +For example the `fedora.container` unit below specifies a dependency on the `basic.container` unit. +``` +[Unit] +After=basic.container +Requires=basic.container + +[Container] +Image=registry.fedoraproject.org/fedora:41 +``` + +## Container units [Container] + +Container units are named with a `.container` extension and contain a `[Container]` section describing +the container that is run as a service. The resulting service file contains a line like +`ExecStart=podman run … image-name`, and most of the keys in this section control the command-line +options passed to Podman. However, some options also affect the details of how systemd is set up to run and +interact with the container. + +By default, the Podman container has the same name as the unit, but with a `systemd-` prefix, i.e. +a `$name.container` file creates a `$name.service` unit and a `systemd-$name` Podman container. The +`ContainerName` option allows for overriding this default name with a user-provided one. + +There is only one required key, `Image`, which defines the container image the service runs. + +Valid options for `[Container]` are listed below: + +| **[Container] options** | **podman run equivalent** | +|--------------------------------------|------------------------------------------------------| +| AddCapability=CAP | --cap-add CAP | +| AddDevice=/dev/foo | --device /dev/foo | +| AddHost=example\.com:192.168.10.11 | --add-host example.com:192.168.10.11 | +| Annotation="XYZ" | --annotation "XYZ" | +| AutoUpdate=registry | --label "io.containers.autoupdate=registry" | +| CgroupsMode=no-conmon | --cgroups=no-conmon | +| ContainerName=name | --name name | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| DNS=192.168.55.1 | --dns=192.168.55.1 | +| DNSOption=ndots:1 | --dns-option=ndots:1 | +| DNSSearch=example.com | --dns-search example.com | +| DropCapability=CAP | --cap-drop=CAP | +| Entrypoint=/foo.sh | --entrypoint=/foo.sh | +| Environment=foo=bar | --env foo=bar | +| EnvironmentFile=/tmp/env | --env-file /tmp/env | +| EnvironmentHost=true | --env-host | +| Exec=/usr/bin/command | Command after image specification - /usr/bin/command | +| ExposeHostPort=50-59 | --expose 50-59 | +| GIDMap=0:10000:10 | --gidmap=0:10000:10 | +| GlobalArgs=--log-level=debug | --log-level=debug | +| Group=1234 | --user UID:1234 | +| GroupAdd=keep-groups | --group-add=keep-groups | +| HealthCmd=/usr/bin/command | --health-cmd=/usr/bin/command | +| HealthInterval=2m | --health-interval=2m | +| HealthLogDestination=/foo/log | --health-log-destination=/foo/log | +| HealthMaxLogCount=5 | --health-max-log-count=5 | +| HealthMaxLogSize=500 | --health-max-log-size=500 | +| HealthOnFailure=kill | --health-on-failure=kill | +| HealthRetries=5 | --health-retries=5 | +| HealthStartPeriod=1m | --health-start-period=period=1m | +| HealthStartupCmd=command | --health-startup-cmd=command | +| HealthStartupInterval=1m | --health-startup-interval=1m | +| HealthStartupRetries=8 | --health-startup-retries=8 | +| HealthStartupSuccess=2 | --health-startup-success=2 | +| HealthStartupTimeout=1m33s | --health-startup-timeout=1m33s | +| HealthTimeout=20s | --health-timeout=20s | +| HostName=example.com | --hostname example.com | +| Image=ubi8 | Image specification - ubi8 | +| IP=192.5.0.1 | --ip 192.5.0.1 | +| IP6=2001:db8::1 | --ip6 2001:db8::1 | +| Label="XYZ" | --label "XYZ" | +| LogDriver=journald | --log-driver journald | +| LogOpt=path=/var/log/mykube\.json | --log-opt path=/var/log/mykube\.json | +| Mask=/proc/sys/foo\:/proc/sys/bar | --security-opt mask=/proc/sys/foo:/proc/sys/bar | +| Memory=20g | --memory 20g | +| Mount=type=... | --mount type=... | +| Network=host | --network host | +| NetworkAlias=name | --network-alias name | +| NoNewPrivileges=true | --security-opt no-new-privileges | +| Notify=true | --sdnotify container | +| PidsLimit=10000 | --pids-limit 10000 | +| Pod=pod-name | --pod=pod-name | +| PodmanArgs=--publish 8080:80 | --publish 8080:80 | +| PublishPort=8080:80 | --publish 8080:80 | +| Pull=never | --pull never | +| ReadOnly=true | --read-only | +| ReadOnlyTmpfs=true | --read-only-tmpfs | +| ReloadCmd=/usr/bin/command | Add ExecReload and run exec with the value | +| ReloadSignal=SIGHUP | Add ExecReload and run kill with the signal | +| Retry=5 | --retry=5 | +| RetryDelay=5s | --retry-delay=5s | +| Rootfs=/var/lib/rootfs | --rootfs /var/lib/rootfs | +| RunInit=true | --init | +| SeccompProfile=/tmp/s.json | --security-opt seccomp=/tmp/s.json | +| Secret=secret | --secret=secret[,opt=opt ...] | +| SecurityLabelDisable=true | --security-opt label=disable | +| SecurityLabelFileType=usr_t | --security-opt label=filetype:usr_t | +| SecurityLabelLevel=s0:c1,c2 | --security-opt label=level\:s0\:c1,c2 | +| SecurityLabelNested=true | --security-opt label=nested | +| SecurityLabelType=spc_t | --security-opt label=type\:spc_t | +| ShmSize=100m | --shm-size=100m | +| StartWithPod=true | If Pod= is defined, container is started by pod | +| StopSignal=SIGINT | --stop-signal=SIGINT | +| StopTimeout=20 | --stop-timeout=20 | +| SubGIDMap=gtest | --subgidname=gtest | +| SubUIDMap=utest | --subuidname=utest | +| Sysctl=name=value | --sysctl=name=value | +| Timezone=local | --tz local | +| Tmpfs=/work | --tmpfs /work | +| UIDMap=0:10000:10 | --uidmap=0:10000:10 | +| Ulimit=nofile=1000:10000 | --ulimit nofile=1000:10000 | +| Unmask=ALL | --security-opt unmask=ALL | +| User=bin | --user bin | +| UserNS=keep-id\:uid=200,gid=210 | --userns keep-id:uid=200,gid=210 | +| Volume=/source:/dest | --volume /source:/dest | +| WorkingDir=$HOME | --workdir $HOME | + +Description of `[Container]` section are: + +### `AddCapability=` + +Add these capabilities, in addition to the default Podman capability set, to the container. + +This is a space separated list of capabilities. This key can be listed multiple times. + +For example: +``` +AddCapability=CAP_DAC_OVERRIDE CAP_IPC_OWNER +``` + +### `AddDevice=` + +Adds a device node from the host into the container. The format of this is +`HOST-DEVICE[\:CONTAINER-DEVICE][:PERMISSIONS]`, where `HOST-DEVICE` is the path of +the device node on the host, `CONTAINER-DEVICE` is the path of the device node in +the container, and `PERMISSIONS` is a list of permissions combining 'r' for read, +'w' for write, and 'm' for mknod(2). The `-` prefix tells Quadlet to add the device +only if it exists on the host. + +This key can be listed multiple times. + +### `AddHost=` + +Add host-to-IP mapping to /etc/hosts. +The format is `hostname\:ip`. + +Equivalent to the Podman `--add-host` option. +This key can be listed multiple times. + +### `Annotation=` + +Set one or more OCI annotations on the container. The format is a list of `key=value` items, +similar to `Environment`. + +This key can be listed multiple times. + +### `AutoUpdate=` + +Indicates whether the container will be auto-updated ([podman-auto-update(1)](podman-auto-update.1.md)). The following values are supported: + +* `registry`: Requires a fully-qualified image reference (e.g., quay.io/podman/stable:latest) to be used to create the container. This enforcement is necessary to know which image to actually check and pull. If an image ID was used, Podman does not know which image to check/pull anymore. + +* `local`: Tells Podman to compare the image a container is using to the image with its raw name in local storage. If an image is updated locally, Podman simply restarts the systemd unit executing the container. + +### `CgroupsMode=` + +The cgroups mode of the Podman container. Equivalent to the Podman `--cgroups` option. + +By default, the cgroups mode of the container created by Quadlet is `split`, +which differs from the default (`enabled`) used by the Podman CLI. + +If the container joins a pod (i.e. `Pod=` is specified), you may want to change this to +`no-conmon` or `enabled` so that pod level cgroup resource limits can take effect. + +### `ContainerName=` + +The (optional) name of the Podman container. If this is not specified, the default value +of `systemd-%N` is used, which is the same as the service name but with a `systemd-` +prefix to avoid conflicts with user-managed containers. + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `DNS=` + +Set network-scoped DNS resolver/nameserver for containers in this network. + +This key can be listed multiple times. + +### `DNSOption=` + +Set custom DNS options. + +This key can be listed multiple times. + +### `DNSSearch=` + +Set custom DNS search domains. Use **DNSSearch=.** to remove the search domain. + +This key can be listed multiple times. + +### `DropCapability=` + +Drop these capabilities from the default podman capability set, or `all` to drop all capabilities. + +This is a space separated list of capabilities. This key can be listed multiple times. + +For example: +``` +DropCapability=CAP_DAC_OVERRIDE CAP_IPC_OWNER +``` + +### `Entrypoint=` + +Override the default ENTRYPOINT from the image. +Equivalent to the Podman `--entrypoint` option. +Specify multi option commands in the form of a JSON string. + +### `Environment=` + +Set an environment variable in the container. This uses the same format as +[services in systemd](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Environment=) +and can be listed multiple times. + +### `EnvironmentFile=` + +Use a line-delimited file to set environment variables in the container. +The path may be absolute or relative to the location of the unit file. +This key may be used multiple times, and the order persists when passed to `podman run`. + +### `EnvironmentHost=` + +Use the host environment inside of the container. + +### `Exec=` + +Additional arguments for the container; this has exactly the same effect as passing +more arguments after a `podman run ` invocation. + +The format is the same as for [systemd command lines](https://www.freedesktop.org/software/systemd/man/systemd.service.html#Command%20lines), +However, unlike the usage scenario for similarly-named systemd `ExecStart=` verb +which operates on the ambient root filesystem, it is very common for container +images to have their own `ENTRYPOINT` or `CMD` metadata which this interacts with. + +The default expectation for many images is that the image will include an `ENTRYPOINT` +with a default binary, and this field will add arguments to that entrypoint. + +Another way to describe this is that it works the same way as the [args field in a Kubernetes pod](https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell). + +### `ExposeHostPort=` + +Exposes a port, or a range of ports (e.g. `50-59`), from the host to the container. Equivalent +to the Podman `--expose` option. + +This key can be listed multiple times. + +### `GIDMap=` + +Run the container in a new user namespace using the supplied GID mapping. +Equivalent to the Podman `--gidmap` option. + +This key can be listed multiple times. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `run` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Group=` + +The (numeric) GID to run as inside the container. This does not need to match the GID on the host, +which can be modified with `UserNS`, but if that is not specified, this GID is also used on the host. + +### `GroupAdd=` + +Assign additional groups to the primary user running within the container process. Also supports the `keep-groups` special flag. +Equivalent to the Podman `--group-add` option. + +### `HealthCmd=` + +Set or alter a healthcheck command for a container. A value of none disables existing healthchecks. +Equivalent to the Podman `--health-cmd` option. + +### `HealthInterval=` + +Set an interval for the healthchecks. An interval of disable results in no automatic timer setup. +Equivalent to the Podman `--health-interval` option. + +### `HealthLogDestination=` + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) +(Default: local) +Equivalent to the Podman `--health-log-destination` option. + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. + +### `HealthMaxLogCount=` + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) +(Default: 5 attempts) +Equivalent to the Podman `--Health-max-log-count` option. + +### `HealthMaxLogSize=` + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) +(Default: 500 characters) +Equivalent to the Podman `--Health-max-log-size` option. + +### `HealthOnFailure=` + +Action to take once the container transitions to an unhealthy state. +The "kill" action in combination integrates best with systemd. Once +the container turns unhealthy, it gets killed, and systemd restarts the +service. +Equivalent to the Podman `--health-on-failure` option. + +### `HealthRetries=` + +The number of retries allowed before a healthcheck is considered to be unhealthy. +Equivalent to the Podman `--health-retries` option. + +### `HealthStartPeriod=` + +The initialization time needed for a container to bootstrap. +Equivalent to the Podman `--health-start-period` option. + +### `HealthStartupCmd=` + +Set a startup healthcheck command for a container. +Equivalent to the Podman `--health-startup-cmd` option. + +### `HealthStartupInterval=` + +Set an interval for the startup healthcheck. An interval of disable results in no automatic timer setup. +Equivalent to the Podman `--health-startup-interval` option. + +### `HealthStartupRetries=` + +The number of attempts allowed before the startup healthcheck restarts the container. +Equivalent to the Podman `--health-startup-retries` option. + +### `HealthStartupSuccess=` + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. +Equivalent to the Podman `--health-startup-success` option. + +### `HealthStartupTimeout=` + +The maximum time a startup healthcheck command has to complete before it is marked as failed. +Equivalent to the Podman `--health-startup-timeout` option. + +### `HealthTimeout=` + +The maximum time allowed to complete the healthcheck before an interval is considered failed. +Equivalent to the Podman `--health-timeout` option. + +### `HostName=` + +Sets the host name that is available inside the container. +Equivalent to the Podman `--hostname` option. + +### `Image=` + +The image to run in the container. +It is recommended to use a fully qualified image name rather than a short name, both for +performance and robustness reasons. + +The format of the name is the same as when passed to `podman pull`. So, it supports using +`\:tag` or digests to guarantee the specific image version. + +Special Cases: + +* If the `name` of the image ends with `.image`, Quadlet will use the image pulled by the corresponding `.image` file, and the generated systemd service contains a dependency on the `$name-image.service` (or the service name set in the .image file). Note that the corresponding `.image` file must exist. +* If the `name` of the image ends with `.build`, Quadlet will use the image built by the corresponding `.build` file, and the generated systemd service contains a dependency on the `$name-build.service`. Note: the corresponding `.build` file must exist. + +### `IP=` + +Specify a static IPv4 address for the container, for example **10.88.64.128**. +Equivalent to the Podman `--ip` option. + +### `IP6=` + +Specify a static IPv6 address for the container, for example **fd46\:db93\:aa76\:ac37::10**. +Equivalent to the Podman `--ip6` option. + +### `Label=` + +Set one or more OCI labels on the container. The format is a list of `key=value` items, +similar to `Environment`. + +This key can be listed multiple times. + +### `LogDriver=` + +Set the log-driver used by Podman when running the container. +Equivalent to the Podman `--log-driver` option. + +### `LogOpt=` + +Set the log-opt (logging options) used by Podman when running the container. +Equivalent to the Podman `--log-opt` option. +This key can be listed multiple times. + +### `Mask=` + +Specify the paths to mask separated by a colon. `Mask=/path/1:/path/2`. A masked path cannot be accessed inside the container. + +### `Memory=` + +Specify the amount of memory for the container. + +### `Mount=` + +Attach a filesystem mount to the container. +This is equivalent to the Podman `--mount` option, and +generally has the form `type=TYPE,TYPE-SPECIFIC-OPTION[,...]`. + +Special cases: + +* For `type=volume`, if `source` ends with `.volume`, the Podman named volume generated by the corresponding `.volume` file is used. +* For `type=image`, if `source` ends with `.image`, the image generated by the corresponding `.image` file is used. + +In both cases, the generated systemd service will contain a dependency on the service generated for the corresponding unit. Note: the corresponding `.volume` or `.image` file must exist. + +This key can be listed multiple times. + +### `Network=` + +Specify a custom network for the container. This has the same format as the `--network` option +to `podman run`. For example, use `host` to use the host network in the container, or `none` to +not set up networking in the container. + +Special cases: + +* If the `name` of the network ends with `.network`, a Podman network called +`systemd-$name` is used, and the generated systemd service contains +a dependency on the `$name-network.service`. Such a network can be automatically +created by using a `$name.network` Quadlet file. Note: the corresponding `.network` file must exist. + +* If the `name` ends with `.container`, +the container will reuse the network stack of another container created by `$name.container`. +The generated systemd service contains a dependency on `$name.service`. Note: the corresponding `.container` file must exist. + +This key can be listed multiple times. + +### `NetworkAlias=` + +Add a network-scoped alias for the container. This has the same format as the `--network-alias` +option to `podman run`. Aliases can be used to group containers together in DNS resolution: for +example, setting `NetworkAlias=web` on multiple containers will make a DNS query for `web` resolve +to all the containers with that alias. + +This key can be listed multiple times. + +### `NoNewPrivileges=` (defaults to `false`) + +If enabled, this disables the container processes from gaining additional privileges via things like +setuid and file capabilities. + +### `Notify=` (defaults to `false`) + +By default, Podman is run in such a way that the systemd startup notify command is handled by +the container runtime. In other words, the service is deemed started when the container runtime +starts the child in the container. However, if the container application supports +[sd_notify](https://www.freedesktop.org/software/systemd/man/sd_notify.html), then setting +`Notify` to true passes the notification details to the container allowing it to notify +of startup on its own. + +In addition, setting `Notify` to `healthy` will postpone startup notifications until such time as +the container is marked healthy, as determined by Podman healthchecks. Note that this requires +setting up a container healthcheck, see the `HealthCmd` option for more. + +### `PidsLimit=` + +Tune the container's pids limit. +This is equivalent to the Podman `--pids-limit` option. + +### `Pod=` + +Specify a Quadlet `.pod` unit to link the container to. +The value must take the form of `.pod` and the `.pod` unit must exist. + +Quadlet will add all the necessary parameters to link between the container and the pod and between their corresponding services. + + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman run` command +in the generated file (right before the image name in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `PublishPort=` + +Exposes a port, or a range of ports (e.g. `50-59`), from the container to the host. Equivalent +to the Podman `--publish` option. The format is similar to the Podman options, which is of +the form `ip\:hostPort:containerPort`, `ip::containerPort`, `hostPort:containerPort` or +`containerPort`, where the number of host and container ports must be the same (in the case +of a range). + +If the IP is set to 0.0.0.0 or not set at all, the port is bound on all IPv4 addresses on +the host; use [::] for IPv6. + +Note that not listing a host port means that Podman automatically selects one, and it +may be different for each invocation of service. This makes that a less useful option. The +allocated port can be found with the `podman port` command. + +This key can be listed multiple times. + +### `Pull=` + +Set the image pull policy. +This is equivalent to the Podman `--pull` option + +### `ReadOnly=` (defaults to `false`) + +If enabled, makes the image read-only. + +### `ReadOnlyTmpfs=` (defaults to `true`) + +If ReadOnly is set to `true`, mount a read-write tmpfs on /dev, /dev/shm, /run, /tmp, and /var/tmp. + +### `ReloadCmd=` + +Add `ExecReload` line to the `Service` that runs ` podman exec` with this command in this container. + +In order to execute the reload run `systemctl reload ` + +Mutually exclusive with `ReloadSignal` + +### `ReloadSignal=` + +Add `ExecReload` line to the `Service` that runs `podman kill` with this signal which sends the signal to the main container process. + +In order to execute the reload run `systemctl reload ` + +Mutually exclusive with `ReloadCmd` + +### `Retry=` + +Number of times to retry the image pull when a HTTP error occurs. Equivalent to the Podman `--retry` option. + +### `RetryDelay=` + +Delay between retries. Equivalent to the Podman `--retry-delay` option. + +### `Rootfs=` + +The rootfs to use for the container. Rootfs points to a directory on the system that contains the content to be run within the container. This option conflicts with the `Image` option. + +The format of the rootfs is the same as when passed to `podman run --rootfs`, so it supports overlay mounts as well. + +Note: On SELinux systems, the rootfs needs the correct label, which is by default unconfined_u\:object_r\:container_file_t\:s0. + +### `RunInit=` (defaults to `false`) + +If enabled, the container has a minimal init process inside the +container that forwards signals and reaps processes. + +### `SeccompProfile=` + +Set the seccomp profile to use in the container. If unset, the default podman profile is used. +Set to either the pathname of a JSON file, or `unconfined` to disable the seccomp filters. + +### `Secret=` + +Use a Podman secret in the container either as a file or an environment variable. +This is equivalent to the Podman `--secret` option and generally has the form `secret[,opt=opt ...]` + +### `SecurityLabelDisable=` + +Turn off label separation for the container. + +### `SecurityLabelFileType=` + +Set the label file type for the container files. + +### `SecurityLabelLevel=` + +Set the label process level for the container processes. + +### `SecurityLabelNested=` + +Allow SecurityLabels to function within the container. This allows separation of containers created within the container. + +### `SecurityLabelType=` + +Set the label process type for the container processes. + +### `ShmSize=` + +Size of /dev/shm. + +This is equivalent to the Podman `--shm-size` option and generally has the form `number[unit]` + +### `StartWithPod=` + +Start the container after the associated pod is created. Default to **true**. + +If `true`, container will be started/stopped/restarted alongside the pod. + +If `false`, the container will not be started when the pod starts. The container will be stopped with the pod. Restarting the pod will also restart the container as long as the container was also running before. + +Note, the container can still be started manually or through a target by configuring the `[Install]` section. The pod will be started as needed in any case. + +### `StopSignal=` + +Signal to stop a container. Default is **SIGTERM**. + +This is equivalent to the Podman `--stop-signal` option + +### `StopTimeout=` + +Seconds to wait before forcibly stopping the container. + +Note, this value should be lower than the actual systemd unit timeout to make sure the podman rm command is not killed by systemd. + +This is equivalent to the Podman `--stop-timeout` option + +### `SubGIDMap=` + +Run the container in a new user namespace using the map with name in the /etc/subgid file. +Equivalent to the Podman `--subgidname` option. + +### `SubUIDMap=` + +Run the container in a new user namespace using the map with name in the /etc/subuid file. +Equivalent to the Podman `--subuidname` option. + +### `Sysctl=` + +Configures namespaced kernel parameters for the container. The format is `Sysctl=name=value`. + +This is a space separated list of kernel parameters. This key can be listed multiple times. + +For example: +``` +Sysctl=net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.all.use_tempaddr=1 +``` + +### `Timezone=` (if unset uses system-configured default) + +The timezone to run the container in. + +### `Tmpfs=` + +Mount a tmpfs in the container. This is equivalent to the Podman `--tmpfs` option, and +generally has the form `CONTAINER-DIR[\:OPTIONS]`. + +This key can be listed multiple times. + +### `UIDMap=` + +Run the container in a new user namespace using the supplied UID mapping. +Equivalent to the Podman `--uidmap` option. + +This key can be listed multiple times. + +### `Ulimit=` + +Ulimit options. Sets the ulimits values inside of the container. + +This key can be listed multiple times. + +### `Unmask=` + +Specify the paths to unmask separated by a colon. unmask=ALL or /path/1:/path/2, or shell expanded paths (/proc/*): + +If set to `ALL`, Podman will unmask all the paths that are masked or made read-only by default. + +The default masked paths are /proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux. + +The default paths that are read-only are /proc/asound, /proc/bus, /proc/fs, /proc/irq, /proc/sys, /proc/sysrq-trigger, /sys/fs/cgroup. + +### `User=` + +The (numeric) UID to run as inside the container. This does not need to match the UID on the host, +which can be modified with `UserNS`, but if that is not specified, this UID is also used on the host. + +### `UserNS=` + +Set the user namespace mode for the container. This is equivalent to the Podman `--userns` option and +generally has the form `MODE[:OPTIONS,...]`. + +### `Volume=` + +Mount a volume in the container. This is equivalent to the Podman `--volume` option, and +generally has the form `[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[:OPTIONS]]`. + +If `SOURCE-VOLUME` starts with `.`, Quadlet resolves the path relative to the location of the unit file. + +Special case: + +* If `SOURCE-VOLUME` ends with `.volume`, a Podman named volume called `systemd-$name` is used as the source, and the generated systemd service contains a dependency on the `$name-volume.service`. Note that the corresponding `.volume` file must exist. + +This key can be listed multiple times. + +### `WorkingDir=` + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (/). The image developer can set a different default with the WORKDIR instruction. This option overrides the working directory by using the -w option. + +## Pod units [Pod] + +Pod units are named with a `.pod` extension and contain a `[Pod]` section describing +the pod that is created and run as a service. The resulting service file contains a line like +`ExecStartPre=podman pod create …`, and most of the keys in this section control the command-line +options passed to Podman. + +By default, the Podman pod has the same name as the unit, but with a `systemd-` prefix, i.e. +a `$name.pod` file creates a `$name-pod.service` unit and a `systemd-$name` Podman pod. The +`PodName` option allows for overriding this default name with a user-provided one. + +Valid options for `[Pod]` are listed below: + +| **[Pod] options** | **podman pod create equivalent** | +|-------------------------------------|----------------------------------------| +| AddHost=example\.com:192.168.10.11 | --add-host example.com:192.168.10.11 | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| DNS=192.168.55.1 | --dns=192.168.55.1 | +| DNSOption=ndots:1 | --dns-option=ndots:1 | +| DNSSearch=example.com | --dns-search example.com | +| GIDMap=0:10000:10 | --gidmap=0:10000:10 | +| GlobalArgs=--log-level=debug | --log-level=debug | +| HostName=name | --hostname=name | +| IP=192.5.0.1 | --ip 192.5.0.1 | +| IP6=2001\:db8::1 | --ip6 2001:db8::1 | +| Network=host | --network host | +| NetworkAlias=name | --network-alias name | +| PodmanArgs=\-\-cpus=2 | --cpus=2 | +| PodName=name | --name=name | +| PublishPort=8080:80 | --publish 8080:80 | +| ServiceName=name | Name the systemd unit `name.service` | +| ShmSize=100m | --shm-size=100m | +| SubGIDMap=gtest | --subgidname=gtest | +| SubUIDMap=utest | --subuidname=utest | +| UIDMap=0:10000:10 | --uidmap=0:10000:10 | +| UserNS=keep-id\:uid=200,gid=210 | --userns keep-id:uid=200,gid=210 | +| Volume=/source:/dest | --volume /source:/dest | + +Supported keys in the `[Pod]` section are: + +### `AddHost=` + +Add host-to-IP mapping to /etc/hosts. +The format is `hostname\:ip`. + +Equivalent to the Podman `--add-host` option. +This key can be listed multiple times. + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `DNS=` + +Set network-scoped DNS resolver/nameserver for containers in this pod. + +This key can be listed multiple times. + +### `DNSOption=` + +Set custom DNS options. + +This key can be listed multiple times. + +### `DNSSearch=` + +Set custom DNS search domains. Use **DNSSearch=.** to remove the search domain. + +This key can be listed multiple times. + +### `GIDMap=` + +Create the pod in a new user namespace using the supplied GID mapping. +Equivalent to the Podman `--gidmap` option. + +This key can be listed multiple times. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `pod` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `HostName=` + +Set the pod’s hostname inside all containers. + +The given hostname is also added to the /etc/hosts file using the container’s primary IP address (also see the `--add-host` option). + +Equivalent to the Podman `--hostname` option. +This key can be listed multiple times. + +### `IP=` + +Specify a static IPv4 address for the pod, for example **10.88.64.128**. +Equivalent to the Podman `--ip` option. + +### `IP6=` + +Specify a static IPv6 address for the pod, for example **fd46\:db93\:aa76\:ac37::10**. +Equivalent to the Podman `--ip6` option. + +### `Network=` + +Specify a custom network for the pod. +This has the same format as the `--network` option to `podman pod create`. +For example, use `host` to use the host network in the pod, or `none` to not set up networking in the pod. + +Special case: + +* If the `name` of the network ends with `.network`, Quadlet will look for the corresponding `.network` Quadlet unit. If found, Quadlet will use the name of the Network set in the Unit, otherwise, `systemd-$name` is used. + +The generated systemd service contains a dependency on the service unit generated for that `.network` unit. Note: the corresponding `.network` file must exist. + +This key can be listed multiple times. + +### `NetworkAlias=` + +Add a network-scoped alias for the pod. This has the same format as the `--network-alias` option to +`podman pod create`. Aliases can be used to group containers together in DNS resolution: for +example, setting `NetworkAlias=web` on multiple containers will make a DNS query for `web` resolve +to all the containers with that alias. + +This key can be listed multiple times. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman pod create` command +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `PodName=` + +The (optional) name of the Podman pod. If this is not specified, the default value +of `systemd-%N` is used, which is the same as the service name but with a `systemd-` +prefix to avoid conflicts with user-managed containers. + +Please note that pods and containers cannot have the same name. +So, if PodName is set, it must not conflict with any container. + +### `PublishPort=` + +Exposes a port, or a range of ports (e.g. `50-59`), from the pod to the host. Equivalent +to the Podman `--publish` option. The format is similar to the Podman options, which is of +the form `ip\:hostPort:containerPort`, `ip::containerPort`, `hostPort:containerPort` or +`containerPort`, where the number of host and container ports must be the same (in the case +of a range). + +If the IP is set to 0.0.0.0 or not set at all, the port is bound on all IPv4 addresses on +the host; use [::] for IPv6. + +Note that not listing a host port means that Podman automatically selects one, and it +may be different for each invocation of service. This makes that a less useful option. The +allocated port can be found with the `podman port` command. + +When using `host` networking via `Network=host`, the `PublishPort=` option cannot be used. + +This key can be listed multiple times. + + +### `ServiceName=` + +By default, Quadlet will name the systemd service unit by appending `-pod` to the name of the Quadlet. +Setting this key overrides this behavior by instructing Quadlet to use the provided name. + +Note, the name should not include the `.service` file extension + +### `ShmSize=` + +Size of /dev/shm. + +This is equivalent to the Podman `--shm-size` option and generally has the form `number[unit]` + +### `SubGIDMap=` + +Create the pod in a new user namespace using the map with name in the /etc/subgid file. +Equivalent to the Podman `--subgidname` option. + +### `SubUIDMap=` + +Create the pod in a new user namespace using the map with name in the /etc/subuid file. +Equivalent to the Podman `--subuidname` option. + +### `UIDMap=` + +Create the pod in a new user namespace using the supplied UID mapping. +Equivalent to the Podman `--uidmap` option. + +This key can be listed multiple times. + +### `UserNS=` + +Set the user namespace mode for the pod. This is equivalent to the Podman `--userns` option and +generally has the form `MODE[:OPTIONS,...]`. + +### `Volume=` + +Mount a volume in the pod. This is equivalent to the Podman `--volume` option, and +generally has the form `[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]`. + +If `SOURCE-VOLUME` starts with `.`, Quadlet resolves the path relative to the location of the unit file. + +Special case: + +* If `SOURCE-VOLUME` ends with `.volume`, Quadlet will look for the corresponding `.volume` Quadlet unit. If found, Quadlet will use the name of the Volume set in the Unit, otherwise, `systemd-$name` is used. Note: the corresponding `.volume` file must exist. + +The generated systemd service contains a dependency on the service unit generated for that `.volume` unit, +or on `$name-volume.service` if the `.volume` unit is not found. + +This key can be listed multiple times. + +## Kube units [Kube] + +Kube units are named with a `.kube` extension and contain a `[Kube]` section describing +how `podman kube play` runs as a service. The resulting service file contains a line like +`ExecStart=podman kube play … file.yml`, and most of the keys in this section control the command-line +options passed to Podman. However, some options also affect the details of how systemd is set up to run and +interact with the container. + +There is only one required key, `Yaml`, which defines the path to the Kubernetes YAML file. + +Valid options for `[Kube]` are listed below: + +| **[Kube] options** | **podman kube play equivalent** | +| ------------------------------------| -----------------------------------------------------------------| +| AutoUpdate=registry | --annotation "io.containers.autoupdate=registry" | +| ConfigMap=/tmp/config.map | --config-map /tmp/config.map | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| ExitCodePropagation=how | How to propagate container error status | +| GlobalArgs=--log-level=debug | --log-level=debug | +| KubeDownForce=true | --force (for `podman kube down`) | +| LogDriver=journald | --log-driver journald | +| Network=host | --network host | +| PodmanArgs=\-\-annotation=key=value | --annotation=key=value | +| PublishPort=8080:80 | --publish 8080:80 | +| SetWorkingDirectory=yaml | Set `WorkingDirectory` of unit file to location of the YAML file | +| UserNS=keep-id\:uid=200,gid=210 | --userns keep-id\:uid=200,gid=210 | +| Yaml=/tmp/kube.yaml | podman kube play /tmp/kube.yaml | + +Supported keys in the `[Kube]` section are: + +### `AutoUpdate=` + +Indicates whether containers will be auto-updated ([podman-auto-update(1)](podman-auto-update.1.md)). AutoUpdate can be specified multiple times. The following values are supported: + +* `registry`: Requires a fully-qualified image reference (e.g., quay.io/podman/stable:latest) to be used to create the container. This enforcement is necessary to know which images to actually check and pull. If an image ID was used, Podman does not know which image to check/pull anymore. + +* `local`: Tells Podman to compare the image a container is using to the image with its raw name in local storage. If an image is updated locally, Podman simply restarts the systemd unit executing the Kubernetes Quadlet. + +* `name/(local|registry)`: Tells Podman to perform the `local` or `registry` autoupdate on the specified container name. + +### `ConfigMap=` + +Pass the Kubernetes ConfigMap YAML path to `podman kube play` via the `--configmap` argument. +Unlike the `configmap` argument, the value may contain only one path but +it may be absolute or relative to the location of the unit file. + +This key may be used multiple times + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `ExitCodePropagation=` + +Control how the main PID of the systemd service should exit. The following values are supported: +- `all`: exit non-zero if all containers have failed (i.e., exited non-zero) +- `any`: exit non-zero if any container has failed +- `none`: exit zero and ignore failed containers + +The current default value is `none`. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `kube` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `KubeDownForce=` + +Remove all resources, including volumes, when calling `podman kube down`. +Equivalent to the Podman `--force` option. + +### `LogDriver=` + +Set the log-driver Podman uses when running the container. +Equivalent to the Podman `--log-driver` option. + +### `Network=` + +Specify a custom network for the container. This has the same format as the `--network` option +to `podman kube play`. For example, use `host` to use the host network in the container, or `none` to +not set up networking in the container. + +Special case: + +* If the `name` of the network ends with `.network`, a Podman network called `systemd-$name` is used, and the generated systemd service contains a dependency on the `$name-network.service`. Such a network can be automatically created by using a `$name.network` Quadlet file. Note: the corresponding `.network` file must exist. + +This key can be listed multiple times. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman kube play` command +in the generated file (right before the path to the yaml file in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `PublishPort=` + +Exposes a port, or a range of ports (e.g. `50-59`), from the container to the host. Equivalent +to the `podman kube play`'s `--publish` option. The format is similar to the Podman options, which is of +the form `ip\:hostPort:containerPort`, `ip::containerPort`, `hostPort:containerPort` or +`containerPort`, where the number of host and container ports must be the same (in the case +of a range). + +If the IP is set to 0.0.0.0 or not set at all, the port is bound on all IPv4 addresses on +the host; use [::] for IPv6. + +The list of published ports specified in the unit file is merged with the list of ports specified +in the Kubernetes YAML file. If the same container port and protocol is specified in both, the +entry from the unit file takes precedence + +This key can be listed multiple times. + +### `SetWorkingDirectory=` + +Set the `WorkingDirectory` field of the `Service` group of the Systemd service unit file. +Used to allow `podman kube play` to correctly resolve relative paths. +Supported values are `yaml` and `unit` to set the working directory to that of the YAML or Quadlet Unit file respectively. + +Alternatively, users can explicitly set the `WorkingDirectory` field of the `Service` group in the `.kube` file. +Please note that if the `WorkingDirectory` field of the `Service` group is set, +Quadlet will not set it even if `SetWorkingDirectory` is set + +### `UserNS=` + +Set the user namespace mode for the container. This is equivalent to the Podman `--userns` option and +generally has the form `MODE[\:OPTIONS,...]`. + +### `Yaml=` + +The path, absolute or relative to the location of the unit file, to the Kubernetes YAML file to use. + +## Network units [Network] + +Network files are named with a `.network` extension and contain a section `[Network]` describing the +named Podman network. The generated service is a one-time command that ensures that the network +exists on the host, creating it if needed. + +By default, the Podman network has the same name as the unit, but with a `systemd-` prefix, i.e. for +a network file named `$NAME.network`, the generated Podman network is called `systemd-$NAME`, and +the generated service file is `$NAME-network.service`. The `NetworkName` option allows for +overriding this default name with a user-provided one. + +Please note that stopping the corresponding service will not remove the podman network. +In addition, updating an existing network is not supported. +In order to update the network parameters you will first need to manually remove the podman network and then restart the service. + +Using network units allows containers to depend on networks being automatically pre-created. This is +particularly interesting when using special options to control network creation, as Podman otherwise creates networks with the default options. + +Valid options for `[Network]` are listed below: + +| **[Network] options** | **podman network create equivalent** | +|-------------------------------------|-----------------------------------------------------------------| +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| DisableDNS=true | --disable-dns | +| DNS=192.168.55.1 | --dns=192.168.55.1 | +| Driver=bridge | --driver bridge | +| Gateway=192.168.55.3 | --gateway 192.168.55.3 | +| GlobalArgs=--log-level=debug | --log-level=debug | +| Internal=true | --internal | +| IPAMDriver=dhcp | --ipam-driver dhcp | +| IPRange=192.168.55.128/25 | --ip-range 192.168.55.128/25 | +| IPv6=true | --ipv6 | +| Label="XYZ" | --label "XYZ" | +| NetworkDeleteOnStop=true | Add ExecStopPost to delete the network when the unit is stopped | +| NetworkName=foo | podman network create foo | +| Options=isolate=true | --opt isolate=true | +| PodmanArgs=--dns=192.168.55.1 | --dns=192.168.55.1 | +| Subnet=192.5.0.0/16 | --subnet 192.5.0.0/16 | + +Supported keys in `[Network]` section are: + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `DisableDNS=` (defaults to `false`) + +If enabled, disables the DNS plugin for this network. + +This is equivalent to the Podman `--disable-dns` option + +### `DNS=` + +Set network-scoped DNS resolver/nameserver for containers in this network. + +This key can be listed multiple times. + +### `Driver=` (defaults to `bridge`) + +Driver to manage the network. Currently `bridge`, `macvlan` and `ipvlan` are supported. + +This is equivalent to the Podman `--driver` option + +### `Gateway=` + +Define a gateway for the subnet. If you want to provide a gateway address, you must also provide a subnet option. + +This is equivalent to the Podman `--gateway` option + +This key can be listed multiple times. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `network` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Internal=` (defaults to `false`) + +Restrict external access of this network. + +This is equivalent to the Podman `--internal` option + +### `IPAMDriver=` + +Set the ipam driver (IP Address Management Driver) for the network. Currently `host-local`, `dhcp` and `none` are supported. + +This is equivalent to the Podman `--ipam-driver` option + +### `IPRange=` + +Allocate container IP from a range. The range must be a either a complete subnet in CIDR notation or be +in the `-` syntax which allows for a more flexible range compared to the CIDR subnet. +The ip-range option must be used with a subnet option. + +This is equivalent to the Podman `--ip-range` option + +This key can be listed multiple times. + +### `IPv6=` + +Enable IPv6 (Dual Stack) networking. + +This is equivalent to the Podman `--ipv6` option + +### `Label=` + +Set one or more OCI labels on the network. The format is a list of +`key=value` items, similar to `Environment`. + +This key can be listed multiple times. + +### `NetworkDeleteOnStop=` (defaults to `false`) + +When set to `true` the network is deleted when the service is stopped + +### `NetworkName=` + +The (optional) name of the Podman network. If this is not specified, the default value of +`systemd-%N` is used, which is the same as the unit name but with a `systemd-` prefix to avoid +conflicts with user-managed networks. + +### `Options=` + +Set driver specific options. + +This is equivalent to the Podman `--opt` option + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman network create` command +in the generated file (right before the name of the network in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Subnet=` + +The subnet in CIDR notation. + +This is equivalent to the Podman `--subnet` option + +This key can be listed multiple times. + +## Volume units [Volume] + +Volume files are named with a `.volume` extension and contain a section `[Volume]` describing the +named Podman volume. The generated service is a one-time command that ensures that the volume +exists on the host, creating it if needed. + +By default, the Podman volume has the same name as the unit, but with a `systemd-` prefix, i.e. for +a volume file named `$NAME.volume`, the generated Podman volume is called `systemd-$NAME`, and the +generated service file is `$NAME-volume.service`. The `VolumeName` option allows for overriding this +default name with a user-provided one. + +Using volume units allows containers to depend on volumes being automatically pre-created. This is +particularly interesting when using special options to control volume creation, +as Podman otherwise creates volumes with the default options. + +Valid options for `[Volume]` are listed below: + +| **[Volume] options** | **podman volume create equivalent** | +|-------------------------------------|-------------------------------------------| +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| Copy=true | --opt copy | +| Device=tmpfs | --opt device=tmpfs | +| Driver=image | --driver=image | +| GlobalArgs=--log-level=debug | --log-level=debug | +| Group=192 | --opt group=192 | +| Image=quay.io/centos/centos\:latest | --opt image=quay.io/centos/centos:latest | +| Label="foo=bar" | --label "foo=bar" | +| Options=XYZ | --opt "o=XYZ" | +| PodmanArgs=--driver=image | --driver=image | +| Type=type | Filesystem type of Device | +| User=123 | --opt uid=123 | +| VolumeName=foo | podman volume create foo | + +Supported keys in `[Volume]` section are: + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `Copy=` (default to `true`) + +If enabled, the content of the image located at the mountpoint of the volume is copied into the +volume on the first run. + +### `Device=` + +The path of a device which is mounted for the volume. + +### `Driver=` + +Specify the volume driver name. When set to `image`, the `Image` key must also be set. + +This is equivalent to the Podman `--driver` option. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `volume` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Group=` + +The host (numeric) GID, or group name to use as the group for the volume + +### `Image=` + +Specifies the image the volume is based on when `Driver` is set to the `image`. +It is recommended to use a fully qualified image name rather than a short name, both for +performance and robustness reasons. + +The format of the name is the same as when passed to `podman pull`. So, it supports using +`\:tag` or digests to guarantee the specific image version. + +Special case: + +* If the `name` of the image ends with `.image`, Quadlet will use the image +pulled by the corresponding `.image` file, and the generated systemd service contains a dependency on the `$name-image.service` (or the service name set in the .image file). Note: the corresponding `.image` file must exist. + +### `Label=` + +Set one or more OCI labels on the volume. The format is a list of +`key=value` items, similar to `Environment`. + +This key can be listed multiple times. + +### `Options=` + +The mount options to use for a filesystem as used by the **mount(8)** command `-o` option. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman volume create` command +in the generated file (right before the name of the volume in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Type=` + +The filesystem type of `Device` as used by the **mount(8)** commands `-t` option. + +### `User=` + +The host (numeric) UID, or user name to use as the owner for the volume + +### `VolumeName=` + +The (optional) name of the Podman volume. If this is not specified, the default value of +`systemd-%N` is used, which is the same as the unit name but with a `systemd-` prefix to avoid +conflicts with user-managed volumes. + +## Build units [Build] + +Build files are named with a `.build` extension and contain a section `[Build]` describing the image +build command. The generated service is a one-time command that ensures that the image is built on +the host from a supplied Containerfile and context directory. Subsequent (re-)starts of the +generated built service will usually finish quickly, as image layer caching will skip unchanged +build steps. + +A minimal `.build` unit needs at least the `ImageTag=` key, and either of `File=` or +`SetWorkingDirectory=` keys. + +Using build units allows containers and volumes to depend on images being built locally. This can be +interesting for creating container images not available on container registries, or for local +testing and development. + +Valid options for `[Build]` are listed below: + +| **[Build] options** | **podman build equivalent** | +|-------------------------------------|---------------------------------------------| +| Annotation=annotation=value | --annotation=annotation=value | +| Arch=aarch64 | --arch=aarch64 | +| AuthFile=/etc/registry/auth\.json | --authfile=/etc/registry/auth\.json | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| DNS=192.168.55.1 | --dns=192.168.55.1 | +| DNSOption=ndots:1 | --dns-option=ndots:1 | +| DNSSearch=example.com | --dns-search example.com | +| Environment=foo=bar | --env foo=bar | +| File=/path/to/Containerfile | --file=/path/to/Containerfile | +| ForceRM=false | --force-rm=false | +| GlobalArgs=--log-level=debug | --log-level=debug | +| GroupAdd=keep-groups | --group-add=keep-groups | +| ImageTag=localhost/imagename | --tag=localhost/imagename | +| Label=label | --label=label | +| Network=host | --network=host | +| PodmanArgs=--pull never | --pull never | +| Pull=never | --pull never | +| Retry=5 | --retry=5 | +| RetryDelay=10s | --retry-delay=10s | +| Secret=secret | --secret=id=mysecret,src=path | +| SetWorkingDirectory=unit | Set `WorkingDirectory` of systemd unit file | +| Target=my-app | --target=my-app | +| TLSVerify=false | --tls-verify=false | +| Variant=arm/v7 | --variant=arm/v7 | +| Volume=/source:/dest | --volume /source:/dest | + +### `Annotation=` + +Add an image *annotation* (e.g. annotation=*value*) to the image metadata. Can be used multiple +times. + +This is equivalent to the `--annotation` option of `podman build`. + +### `Arch=` + +Override the architecture, defaults to hosts', of the image to be built. + +This is equivalent to the `--arch` option of `podman build`. + +### `AuthFile=` + +Path of the authentication file. + +This is equivalent to the `--authfile` option of `podman build`. + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `DNS=` + +Set network-scoped DNS resolver/nameserver for the build container. + +This key can be listed multiple times. + +This is equivalent to the `--dns` option of `podman build`. + +### `DNSOption=` + +Set custom DNS options. + +This key can be listed multiple times. + +This is equivalent to the `--dns-option` option of `podman build`. + +### `DNSSearch=` + +Set custom DNS search domains. Use **DNSSearch=.** to remove the search domain. + +This key can be listed multiple times. + +This is equivalent to the `--dns-search` option of `podman build`. + +### `Environment=` + +Add a value (e.g. env=*value*) to the built image. This uses the same format as [services in +systemd](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Environment=) and can be +listed multiple times. + +### `File=` + +Specifies a Containerfile which contains instructions for building the image. A URL starting with +`http(s)://` allows you to specify a remote Containerfile to be downloaded. Note that for a given +relative path to a Containerfile, or when using a `http(s)://` URL, you also must set +`SetWorkingDirectory=` in order for `podman build` to find a valid context directory for the +resources specified in the Containerfile. + +Note that setting a `File=` field is mandatory for a `.build` file, unless `SetWorkingDirectory` (or +a `WorkingDirectory` in the `Service` group) has also been set. + +This is equivalent to the `--file` option of `podman build`. + +### `ForceRM=` + +Always remove intermediate containers after a build, even if the build fails (default true). + +This is equivalent to the `--force-rm` option of `podman build`. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `build` in the generated +file. It can be used to access Podman features otherwise unsupported by the generator. Since the +generator is unaware of what unexpected interactions can be caused by these arguments, it is not +recommended to use this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `GroupAdd=` + +Assign additional groups to the primary user running within the container process. Also supports the +`keep-groups` special flag. + +This is equivalent to the `--group-add` option of `podman build`. + +### `ImageTag=` + +Specifies the name which is assigned to the resulting image if the build process completes +successfully. + +This is equivalent to the `--tag` option of `podman build`. + +This key can be listed multiple times. The first instance will be used as the name of the created artifact when the `.build` file is referenced by another Quadlet unit. + +### `Label=` + +Add an image *label* (e.g. label=*value*) to the image metadata. Can be used multiple times. + +This is equivalent to the `--label` option of `podman build`. + +### `Network=` + +Sets the configuration for network namespaces when handling RUN instructions. This has the same +format as the `--network` option to `podman build`. For example, use `host` to use the host network, +or `none` to not set up networking. + +Special case: + +* If the `name` of the network ends with `.network`, Quadlet will look for the corresponding `.network` Quadlet unit. If found, Quadlet will use the name of the Network set in the Unit, otherwise, `systemd-$name` is used. The generated systemd service contains a dependency on the service unit generated for that `.network` unit, or on `$name-network.service` if the `.network` unit is not found. Note: the corresponding `.network` file must exist. + +This key can be listed multiple times. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman build` command +in the generated file (right before the image name in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Pull=` + +Set the image pull policy. + +This is equivalent to the `--pull` option of `podman build`. + +### `Retry=` + +Number of times to retry the image pull when a HTTP error occurs. Equivalent to the Podman `--retry` option. + +### `RetryDelay=` + +Delay between retries. Equivalent to the Podman `--retry-delay` option. + +### `Secret=` + +Pass secret information used in Containerfile build stages in a safe way. + +This is equivalent to the `--secret` option of `podman build` and generally has the form +`secret[,opt=opt ...]`. + +### `SetWorkingDirectory=` + +Provide context (a working directory) to `podman build`. Supported values are a path, a URL, or the +special keys `file` or `unit` to set the context directory to the parent directory of the file from +the `File=` key or to that of the Quadlet `.build` unit file, respectively. This allows Quadlet to +resolve relative paths. + +When using one of the special keys (`file` or `unit`), the `WorkingDirectory` field of the `Service` +group of the Systemd service unit will also be set to accordingly. Alternatively, users can +explicitly set the `WorkingDirectory` field of the `Service` group in the `.build` file. Please note +that if the `WorkingDirectory` field of the `Service` group is set by the user, Quadlet will not +overwrite it even if `SetWorkingDirectory` is set to `file` or `unit`. + +By providing a URL to `SetWorkingDirectory=` you can instruct `podman build` to clone a Git +repository or download an archive file extracted to a temporary location by `podman build` as build +context. Note that in this case, the `WorkingDirectory` of the Systemd service unit is left +untouched by Quadlet. + +Note that providing context directory is mandatory for a `.build` file, unless a `File=` key has +also been provided. + +### `Target=` + +Set the target build stage to build. Commands in the Containerfile after the target stage are +skipped. + +This is equivalent to the `--target` option of `podman build`. + +### `TLSVerify=` + +Require HTTPS and verification of certificates when contacting registries. + +This is equivalent to the `--tls-verify` option of `podman build`. + +### `Variant=` + +Override the default architecture variant of the container image to be built. + +This is equivalent to the `--variant` option of `podman build`. + +### `Volume=` + +Mount a volume to containers when executing RUN instructions during the build. This is equivalent to +the `--volume` option of `podman build`, and generally has the form +`[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]`. + +If `SOURCE-VOLUME` starts with `.`, Quadlet resolves the path relative to the location of the unit file. + +Special case: + +* If `SOURCE-VOLUME` ends with `.volume`, Quadlet will look for the corresponding `.volume` Quadlet unit. If found, Quadlet will use the name of the Volume set in the Unit, otherwise, `systemd-$name` is used. The generated systemd service contains a dependency on the service unit generated for that `.volume` unit, or on `$name-volume.service` if the `.volume` unit is not found. Note: the corresponding `.volume` file must exist. + +This key can be listed multiple times. + +## Image units [Image] + +Image files are named with a `.image` extension and contain a section `[Image]` describing the +container image pull command. The generated service is a one-time command that ensures that the image +exists on the host, pulling it if needed. + +Using image units allows containers and volumes to depend on images being automatically pulled. This is +particularly interesting when using special options to control image pulls. + +Valid options for `[Image]` are listed below: + +| **[Image] options** | **podman image pull equivalent** | +|----------------------------------------|--------------------------------------------------| +| AllTags=true | --all-tags | +| Arch=aarch64 | --arch=aarch64 | +| AuthFile=/etc/registry/auth\.json | --authfile=/etc/registry/auth\.json | +| CertDir=/etc/registry/certs | --cert-dir=/etc/registry/certs | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| Creds=myname\:mypassword | --creds=myname\:mypassword | +| DecryptionKey=/etc/registry\.key | --decryption-key=/etc/registry\.key | +| GlobalArgs=--log-level=debug | --log-level=debug | +| Image=quay\.io/centos/centos\:latest | podman image pull quay.io/centos/centos\:latest | +| ImageTag=quay\.io/centos/centos\:latest | Use this name when resolving `.image` references | +| OS=windows | --os=windows | +| PodmanArgs=--os=linux | --os=linux | +| Retry=5 | --retry=5 | +| RetryDelay=10s | --retry-delay=10s | +| TLSVerify=false | --tls-verify=false | +| Variant=arm/v7 | --variant=arm/v7 | + +### `AllTags=` + +All tagged images in the repository are pulled. + +This is equivalent to the Podman `--all-tags` option. + +### `Arch=` + +Override the architecture, defaults to hosts, of the image to be pulled. + +This is equivalent to the Podman `--arch` option. + +### `AuthFile=` + +Path of the authentication file. + +This is equivalent to the Podman `--authfile` option. + +### `CertDir=` + +Use certificates at path (*.crt, *.cert, *.key) to connect to the registry. + +This is equivalent to the Podman `--cert-dir` option. + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `Creds=` + +The `[username[:password]]` to use to authenticate with the registry, if required. + +This is equivalent to the Podman `--creds` option. + +### `DecryptionKey=` + +The `[key[:passphrase]]` to be used for decryption of images. + +This is equivalent to the Podman `--decryption-key` option. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `image` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Image=` + +The image to pull. +It is recommended to use a fully qualified image name rather than a short name, both for +performance and robustness reasons. + +The format of the name is the same as when passed to `podman pull`. So, it supports using +`:tag` or digests to guarantee the specific image version. + +### `ImageTag=` + +Actual FQIN of the referenced `Image`. +Only meaningful when source is a file or directory archive. + +For example, an image saved into a `docker-archive` with the following Podman command: + +`podman image save --format docker-archive --output /tmp/archive-file.tar quay.io/podman/stable:latest` + +requires setting +- `Image=docker-archive:/tmp/archive-file.tar` +- `ImageTag=quay.io/podman/stable\:latest` + +### `OS=` + +Override the OS, defaults to hosts, of the image to be pulled. + +This is equivalent to the Podman `--os` option. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman image pull` command +in the generated file (right before the image name in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Retry=` + +Number of times to retry the image pull when a HTTP error occurs. Equivalent to the Podman `--retry` option. + +### `RetryDelay=` + +Delay between retries. Equivalent to the Podman `--retry-delay` option. + +### `TLSVerify=` + +Require HTTPS and verification of certificates when contacting registries. + +This is equivalent to the Podman `--tls-verify` option. + +### `Variant=` + +Override the default architecture variant of the container image. + +This is equivalent to the Podman `--variant` option. + +## Quadlet section [Quadlet] +Some quadlet specific configuration is shared between different unit types. Those settings +can be configured in the `[Quadlet]` section. + +Valid options for `[Quadlet]` are listed below: + +| **[Quadlet] options** | **Description** | +|----------------------------|---------------------------------------------------| +| DefaultDependencies=false | Disable implicit network dependencies to the unit | + +### `DefaultDependencies=` + +Add Quadlet's default network dependencies to the unit (default is `true`). + +When set to false, Quadlet will **not** add a dependency (After=, Wants=) to +`network-online.target`/`podman-user-wait-network-online.service` to the generated unit. + +Note, this option is set in the `[Quadlet]` section. The _systemd_ `[Unit]` section +has an option with the same name but a different meaning. + +## EXAMPLES + +Example `test.container`: + +``` +[Unit] +Description=A minimal container + +[Container] +# Use the centos image +Image=quay.io/centos/centos:latest + +# Use volume and network defined below +Volume=test.volume:/data +Network=test.network + +# In the container we just run sleep +Exec=sleep 60 + +[Service] +# Restart service when sleep finishes +Restart=always +# Extend Timeout to allow time to pull the image +TimeoutStartSec=900 +# ExecStartPre flag and other systemd commands can go here, see systemd.unit(5) man page. +ExecStartPre=/usr/share/mincontainer/setup.sh + +[Install] +# Start by default on boot +WantedBy=multi-user.target default.target +``` + +Example `test.kube`: +``` +[Unit] +Description=A kubernetes yaml based service +Before=local-fs.target + +[Kube] +Yaml=/opt/k8s/deployment.yml + +[Install] +# Start by default on boot +WantedBy=multi-user.target default.target +``` + +Example for locally built image to be used in a container: + +`test.build` +``` +[Build] +# Tag the image to be built +ImageTag=localhost/imagename + +# Set the working directory to the path of the unit file, +# expecting to find a Containerfile/Dockerfile +# + other files needed to build the image +SetWorkingDirectory=unit +``` + +`test.container` +``` +[Container] +Image=test.build +``` + +Example `test.volume`: + +``` +[Volume] +User=root +Group=root +Label=org.test.Key=value +``` + +Example `test.network`: +``` +[Network] +Subnet=172.16.0.0/24 +Gateway=172.16.0.1 +IPRange=172.16.0.0/28 +Label=org.test.Key=value +``` + +Example for Container in a Pod: + +`test.pod` +``` +[Pod] +PodName=test +``` + +`centos.container` +``` +[Container] +Image=quay.io/centos/centos\:latest +Exec=sh -c "sleep inf" +Pod=test.pod +``` + +Example `s3fs.volume`: + +For further details, please see the [s3fs-fuse](https://github.com/s3fs-fuse/s3fs-fuse) project. +Remember to read the [FAQ](https://github.com/s3fs-fuse/s3fs-fuse/wiki/FAQ) + +> NOTE: Enabling the cache massively speeds up access and write times on static files/objects. + +> However, `use_cache` is [UNBOUNDED](https://github.com/s3fs-fuse/s3fs-fuse/wiki/FAQ#q-how-does-the-local-file-cache-work)! + +> Be careful, it will fill up with any files accessed on the s3 bucket through the file system. + +Please remember to set `S3_BUCKET`, `PATH`, `AWS_REGION`. `CACHE_DIRECTORY` should be set up by [systemd](https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#RuntimeDirectory=) + +``` +[Service] +CacheDirectory=s3fs +ExecStartPre=/usr/local/bin/aws s3api put-object --bucket ${S3_BUCKET} --key ${PATH}/ + +[Volume] +Device=${S3_BUCKET}:/${PATH} +Type=fuse.s3fs +VolumeName=s3fs-volume +Options=iam_role,endpoint=${AWS_REGION},use_xattr,listobjectsv2,del_cache,use_cache=${CACHE_DIRECTORY} +# `iam_role` assumes inside EC2, if not, Use `profile=` instead +``` + +## SEE ALSO +**[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)**, +**[systemd.service(5)](https://www.freedesktop.org/software/systemd/man/systemd.service.html)**, +**[systemd-analyze(1)](https://www.freedesktop.org/software/systemd/man/latest/systemd-analyze.html)**, +**[podman-run(1)](podman-run.1.md)**, +**[podman-network-create(1)](podman-network-create.1.md)**, +**[podman-auto-update(1)](podman-auto-update.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-tag.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-tag.1.md new file mode 100644 index 000000000..fdcbbd4c7 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-tag.1.md @@ -0,0 +1,51 @@ +--- +title: podman-tag +version: v5.5.0 +--- + +% podman-tag 1 + +## NAME +podman\-tag - Add an additional name to a local image + +## SYNOPSIS +**podman tag** *image*[:*tag*] [*target-name*[:*tag*]...] [*options*] + +**podman image tag** *image*[:*tag*] [*target-name*[:*tag*]...] [*options*] + +## DESCRIPTION +Assigns a new image name to an existing image. A full name refers to the entire +image name, including the optional *tag* after the `:`. If there is no *tag* +provided, then Podman defaults to `latest` for both the *image* and the +*target-name*. + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Tag specified image with an image name defaulting to :latest. +``` +$ podman tag 0e3bbc2 fedora:latest +``` + +Tag specified image with fully specified image name. +``` +$ podman tag httpd myregistryhost:5000/fedora/httpd\:v2 +``` + +Tag specified image with multiple tags. +``` +$ podman tag mymariadb mycontainerregistry.io/namespace/mariadb:10 mycontainerregistry.io/namespace/mariadb:10.11 mycontainerregistry.io/namespace/mariadb:10.11.12 +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +December 2019, Update description to refer to 'name' instead of 'alias' by Sascha Grunert +July 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-top.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-top.1.md new file mode 100644 index 000000000..69c6830cd --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-top.1.md @@ -0,0 +1,125 @@ +--- +title: podman-top +version: v5.5.0 +--- + +% podman-top 1 + +## NAME +podman\-top - Display the running processes of a container + +## SYNOPSIS +**podman top** [*options*] *container* [*format-descriptors*] + +**podman container top** [*options*] *container* [*format-descriptors*] + +## DESCRIPTION +Display the running processes of the container. The *format-descriptors* are ps (1) compatible AIX format +descriptors but extended to print additional information, such as the seccomp mode or the effective capabilities +of a given process. The descriptors can either be passed as separated arguments or as a single comma-separated +argument. Note that options and or flags of ps(1) can also be specified; in this case, Podman falls back to +executing ps(1) from the host with the specified arguments and flags in the container namespace. If the container +has the `CAP_SYS_PTRACE` capability then we will execute ps(1) in the container so it must be installed there. +To extract host-related information, use the "h*" descriptors. For instance, `podman top $name hpid huser` +to display the PID and user of the processes in the host context. + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## FORMAT DESCRIPTORS + +The following descriptors are supported in addition to the AIX format descriptors mentioned in ps (1): + +**args, capbnd, capeff, capinh, capprm, comm, etime, group, hgroup, hpid, huser, label, nice, pcpu, pgid, pid, ppid, rgroup, ruser, seccomp, state, time, tty, user, vsz** + +**capbnd** + + Set of bounding capabilities. See capabilities (7) for more information. + +**capeff** + + Set of effective capabilities. See capabilities (7) for more information. + +**capinh** + + Set of inheritable capabilities. See capabilities (7) for more information. + +**capprm** + + Set of permitted capabilities. See capabilities (7) for more information. + +**hgroup** + + The corresponding effective group of a container process on the host. + +**hpid** + + The corresponding host PID of a container process. + +**huser** + + The corresponding effective user of a container process on the host. + +**label** + + Current security attributes of the process. + +**seccomp** + + Seccomp mode of the process (i.e., disabled, strict or filter). See seccomp (2) for more information. + +**state** + + Process state codes (e.g, **R** for *running*, **S** for *sleeping*). See proc(5) for more information. + +**stime** + + Process start time (e.g, "2019-12-09 10:50:36 +0100 CET). + +## EXAMPLES + +By default, `podman-top` prints data similar to `ps -ef`. +``` +$ podman top f5a62a71b07 +USER PID PPID %CPU ELAPSED TTY TIME COMMAND +root 1 0 0.000 20.386825206s pts/0 0s sh +root 7 1 0.000 16.386882887s pts/0 0s sleep +root 8 1 0.000 11.386886562s pts/0 0s vi +``` + +The output can be controlled by specifying format descriptors as arguments after the container. +``` +$ podman top -l pid seccomp args %C +PID SECCOMP COMMAND %CPU +1 filter sh 0.000 +8 filter vi /etc/ 0.000 +``` + +Podman falls back to executing ps(1) from the host in the container namespace if an unknown descriptor is specified. +``` +$ podman top -l -- aux +USER PID PPID %CPU ELAPSED TTY TIME COMMAND +root 1 0 0.000 1h2m12.497061672s ? 0s sleep 100000 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **ps(1)**, **seccomp(2)**, **proc(5)**, **capabilities(7)** + +## HISTORY +July 2018, Introduce format descriptors by Valentin Rothberg + +December 2017, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-troubleshooting.7.md b/versioned_docs/version-5.5.0/source/markdown/podman-troubleshooting.7.md new file mode 100644 index 000000000..b728042f9 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-troubleshooting.7.md @@ -0,0 +1,1552 @@ +--- +title: Troubleshooting +version: v5.5.0 +--- + +% podman-troubleshooting 7 + + +# Troubleshooting + +## A list of common issues and solutions for Podman + +--- +### 1) Variety of issues - Validate Version + +A large number of issues reported against Podman are often found to already be fixed +in more current versions of the project. Before reporting an issue, please verify the +version you are running with `podman version` and compare it to the latest release +documented on the top of Podman's [README.md](README.md). + +If they differ, please update your version of PODMAN to the latest possible +and retry your command before reporting the issue. + +--- +### 2) Can't use volume mount, get permission denied + +```console +$ podman run -v ~/mycontent:/content fedora touch /content/file +touch: cannot touch '/content/file': Permission denied +``` + +#### Solution + +This is sometimes caused by SELinux, and sometimes by user namespaces. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, you can add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two containers +share the volume content. As a result, Podman labels the content with a shared +content label. Shared volume labels allow all containers to read/write content. +The **Z** option tells Podman to label the content with a private unshared label. +Only the current container can use a private volume. + +```console +$ podman run -v ~/mycontent:/content\:Z fedora touch /content/file +``` + +Make sure the content is private for the container. Do not relabel system directories and content. +Relabeling system content might cause other confined services on your machine to fail. For these +types of containers we recommend having SELinux separation disabled. The option `--security-opt label=disable` +will disable SELinux separation for the container. + +```console +$ podman run --security-opt label=disable -v ~:/home/user fedora touch /home/user/file +``` + +In cases where the container image runs as a specific, non-root user, though, the +solution is to fix the user namespace. This would include container images such as +the Jupyter Notebook image (which runs as "jovyan") and the Postgres image (which runs +as "postgres"). In either case, use the `--userns` switch to map user namespaces, +most of the time by using the **keep-id** option. + +```console +$ podman run -v "$PWD":/home/jovyan/work --userns=keep-id jupyter/scipy-notebook +``` + +--- +### 3) No such image or Bare keys cannot contain ':' + +When doing a `podman pull` or `podman build` command and a "common" image cannot be pulled, +it is likely that the `/etc/containers/registries.conf` file is either not installed or possibly +misconfigured. + +#### Symptom + +```console +$ sudo podman build -f Dockerfile +STEP 1: FROM alpine +error building: error creating build container: no such image "alpine" in registry: image not known +``` + +or + +```console +$ sudo podman pull fedora +error pulling image "fedora": unable to pull fedora: error getting default registries to try: Near line 9 (last key parsed ''): Bare keys cannot contain ':'. +``` + +#### Solution + + * Verify that the `/etc/containers/registries.conf` file exists. If not, verify that the containers-common package is installed. + * Verify that the entries in the `unqualified-search-registries` list of the `/etc/containers/registries.conf` file are valid and reachable. + * i.e. `unqualified-search-registries = ["registry.fedoraproject.org", "quay.io", "registry.access.redhat.com"]` + +--- +### 4) http: server gave HTTP response to HTTPS client + +When doing a Podman command such as `build`, `commit`, `pull`, or `push` to a registry, +TLS verification is turned on by default. If encryption is not used with +those commands, this error can occur. + +#### Symptom + +```console +$ sudo podman push alpine docker://localhost:5000/myalpine\:latest +Getting image source signatures +Get https://localhost:5000/v2/: http: server gave HTTP response to HTTPS client +``` + +#### Solution + +By default TLS verification is turned on when communicating to registries from +Podman. If the registry does not require encryption the Podman commands +such as `build`, `commit`, `pull` and `push` will fail unless TLS verification is turned +off using the `--tls-verify` option. **NOTE:** It is not at all recommended to +communicate with a registry and not use TLS verification. + + * Turn off TLS verification by passing false to the tls-verify option. + * I.e. `podman push --tls-verify=false alpine docker://localhost:5000/myalpine\:latest` + + +For a global workaround, users[1] can create the file `/etc/containers/registries.conf.d/registry-NAME.conf` +(replacing NAME with the name of this registry) with the following content (replacing FULLY.QUALIFIED.NAME.OF.REGISTRY with the address of this registry): + +``` +[[registry]] +location = "FULLY.QUALIFIED.NAME.OF.REGISTRY" +insecure = true +``` + +[1] If you are using a Mac / Windows, you should execute `podman machine ssh` to login into podman machine before adding the insecure entry to the registry—conf file. + +**This is an insecure method and should be used cautiously.** + +--- +### 5) rootless containers cannot ping hosts + +When using the ping command from a non-root container, the command may +fail because of a lack of privileges. + +#### Symptom + +```console +$ podman run --rm fedora ping -W10 -c1 redhat.com +PING redhat.com (209.132.183.105): 56 data bytes + +--- redhat.com ping statistics --- +1 packets transmitted, 0 packets received, 100% packet loss +``` + +#### Solution + +It is most likely necessary to enable unprivileged pings on the host. +Be sure the UID of the user is part of the range in the +`/proc/sys/net/ipv4/ping_group_range` file. + +To change its value you can use something like: + +```console +# sysctl -w "net.ipv4.ping_group_range=0 2000000" +``` + +To make the change persistent, you'll need to add a file in +`/etc/sysctl.d` that contains `net.ipv4.ping_group_range=0 $MAX_UID`. + +--- +### 6) Build hangs when the Dockerfile contains the useradd command + +When the Dockerfile contains a command like `RUN useradd -u 99999000 -g users newuser` the build can hang. + +#### Symptom + +If you are using a useradd command within a Dockerfile with a large UID/GID, it will create a large sparse file `/var/log/lastlog`. This can cause the build to hang forever. Go language does not support sparse files correctly, which can lead to some huge files being created in your container image. + +#### Solution + +If the entry in the Dockerfile looked like: RUN useradd -u 99999000 -g users newuser then add the `--no-log-init` parameter to change it to: `RUN useradd --no-log-init -u 99999000 -g users newuser`. This option tells useradd to stop creating the lastlog file. + +### 7) Permission denied when running Podman commands + +When rootless Podman attempts to execute a container on a non exec home directory a permission error will be raised. + +#### Symptom + +If you are running Podman or Buildah on a home directory that is mounted noexec, +then they will fail with a message like: + +```console +$ podman run centos:7 +standard_init_linux.go:203: exec user process caused "permission denied" +``` + +#### Solution + +Since the administrator of the system set up your home directory to be noexec, you will not be allowed to execute containers from storage in your home directory. It is possible to work around this by manually specifying a container storage path that is not on a noexec mount. Simply copy the file /etc/containers/storage.conf to ~/.config/containers/ (creating the directory if necessary). Specify a graphroot directory which is not on a noexec mount point and to which you have read/write privileges. You will need to modify other fields to writable directories as well. + +For example + +```console +$ cat ~/.config/containers/storage.conf +[storage] + driver = "overlay" + runroot = "/run/user/1000" + graphroot = "/execdir/myuser/storage" + [storage.options] + mount_program = "/bin/fuse-overlayfs" +``` + +### 8) Permission denied when running systemd within a Podman container + +When running systemd as PID 1 inside of a container on an SELinux +separated machine, it needs to write to the cgroup file system. + +#### Symptom + +Systemd gets permission denied when attempting to write to the cgroup file +system, and AVC messages start to show up in the audit.log file or journal on +the system. + +#### Solution + +Newer versions of Podman (2.0 or greater) support running init based containers +with a different SELinux labels, which allow the container process access to the +cgroup file system. This feature requires container-selinux-2.132 or newer +versions. + +Prior to Podman 2.0, the SELinux boolean `container_manage_cgroup` allows +container processes to write to the cgroup file system. Turn on this boolean, +on SELinux separated systems, to allow systemd to run properly in the container. +Only do this on systems running older versions of Podman. + +```console +# setsebool -P container_manage_cgroup true +``` + +### 9) Newuidmap missing when running rootless Podman commands + +Rootless Podman requires the newuidmap and newgidmap programs to be installed. + +#### Symptom + +If you are running Podman or Buildah as a rootless user, you get an error complaining about +a missing newuidmap executable. + +```console +$ podman run -ti fedora sh +command required for rootless mode with multiple IDs: exec: "newuidmap": executable file not found in $PATH +``` + +#### Solution + +Install a version of shadow-utils that includes these executables. Note that for RHEL and CentOS 7, at least the 7.7 release must be installed for support to be available. + +### 10) rootless setup user: invalid argument + +Rootless Podman requires the user running it to have a range of UIDs listed in /etc/subuid and /etc/subgid. + +#### Symptom + +A user, either via --user or through the default configured for the image, is not mapped inside the namespace. + +```console +$ podman run --rm -ti --user 1000000 alpine echo hi +Error: container create failed: container_linux.go:344: starting container process caused "setup user: invalid argument" +``` + +#### Solution + +Update the /etc/subuid and /etc/subgid with fields for users that look like: + +```console +$ cat /etc/subuid +johndoe:100000:65536 +test:165536:65536 +``` + +The format of this file is `USERNAME\:UID\:RANGE` + +* username as listed in `/etc/passwd` or `getpwent`. +* The initial uid allocated for the user. +* The size of the range of UIDs allocated for the user. + +This means johndoe is allocated UIDs 100000-165535 as well as his standard UID in the +`/etc/passwd` file. + +You should ensure that each user has a unique range of UIDs, because overlapping UIDs, +would potentially allow one user to attack another user. In addition, make sure +that the range of UIDs you allocate can cover all UIDs that the container +requires. For example, if the container has a user with UID 10000, ensure you +have at least 10000 subuids, and if the container needs to be run as a user with +UID 1000000, ensure you have at least 1000000 subuids. + +You could also use the `usermod` program to assign UIDs to a user. + +If you update either the `/etc/subuid` or `/etc/subgid` file, you need to +stop all running containers and kill the pause process. This is done +automatically by the `system migrate` command, which can also be used +to stop all the containers and kill the pause process. + +```console +# usermod --add-subuids 200000-201000 --add-subgids 200000-201000 johndoe +# grep johndoe /etc/subuid /etc/subgid +/etc/subuid:johndoe:200000:1001 +/etc/subgid:johndoe:200000:1001 +``` + +### 11) Changing the location of the Graphroot leads to permission denied + +When I change the graphroot storage location in storage.conf, the next time I +run Podman, I get an error like: + +```console +# podman run -p 5000:5000 -it centos bash + +bash: error while loading shared libraries: /lib64/libc.so.6: cannot apply additional memory protection after relocation: Permission denied +``` + +For example, the admin sets up a spare disk to be mounted at `/src/containers`, +and points storage.conf at this directory. + + +#### Symptom + +SELinux blocks containers from using arbitrary locations for overlay storage. +These directories need to be labeled with the same labels as if the content was +under `/var/lib/containers/storage`. + +#### Solution + +Tell SELinux about the new containers storage by setting up an equivalence record. +This tells SELinux to label content under the new path, as if it was stored +under `/var/lib/containers/storage`. + +```console +# semanage fcontext -a -e /var/lib/containers /srv/containers +# restorecon -R -v /srv/containers +``` + +The semanage command above tells SELinux to set up the default labeling of +`/srv/containers` to match `/var/lib/containers`. The `restorecon` command +tells SELinux to apply the labels to the actual content. + +Now all new content created in these directories will automatically be created +with the correct label. + +### 12) Anonymous image pull fails with 'invalid username/password' + +Pulling an anonymous image that doesn't require authentication can result in an +`invalid username/password` error. + +#### Symptom + +If you pull an anonymous image, one that should not require credentials, you can receive +an `invalid username/password` error if you have credentials established in the +authentication file for the target container registry that are no longer valid. + +```console +$ podman run -it --rm docker://docker.io/library/alpine:latest ls +Trying to pull docker://docker.io/library/alpine:latest...ERRO[0000] Error pulling image ref //alpine:latest: Error determining manifest MIME type for docker://alpine:latest: unable to retrieve auth token: invalid username/password +Failed +Error: unable to pull docker://docker.io/library/alpine:latest: unable to pull image: Error determining manifest MIME type for docker://alpine:latest: unable to retrieve auth token: invalid username/password +``` + +This can happen if the authentication file is modified 'by hand' or if the credentials +are established locally and then the password is updated later in the container registry. + +#### Solution + +Depending upon which container tool was used to establish the credentials, use `podman logout` +or `docker logout` to remove the credentials from the authentication file. + +### 13) Running Podman inside a container causes container crashes and inconsistent states + +Running Podman in a container and forwarding some, but not all, of the required host directories can cause inconsistent container behavior. + +#### Symptom + +After creating a container with Podman's storage directories mounted in from the host and running Podman inside a container, all containers show their state as "configured" or "created", even if they were running or stopped. + +#### Solution + +When running Podman inside a container, it is recommended to mount at a minimum `/var/lib/containers/storage/` as a volume. +Typically, you will not mount in the host version of the directory, but if you wish to share containers with the host, you can do so. +If you do mount in the host's `/var/lib/containers/storage`, however, you must also mount in the host's `/run/libpod` and `/run/containers/storage` directories. +Not doing this will cause Podman in the container to detect that temporary files have been cleared, leading it to assume a system restart has taken place. +This can cause Podman to reset container states and lose track of running containers. + +For running containers on the host from inside a container, we also recommend the [Podman remote client](docs/tutorials/remote_client.md), which only requires a single socket to be mounted into the container. + +### 14) Rootless 'podman build' fails EPERM on NFS: + +NFS enforces file creation on different UIDs on the server side and does not understand user namespace, which rootless Podman requires. +When a container root process like YUM attempts to create a file owned by a different UID, NFS Server denies the creation. +NFS is also a problem for the file locks when the storage is on it. Other distributed file systems (for example: Lustre, Spectrum Scale, the General Parallel File System (GPFS)) are also not supported when running in rootless mode as these file systems do not understand user namespace. + +#### Symptom +```console +$ podman build . +ERRO[0014] Error while applying layer: ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied +error creating build container: Error committing the finished image: error adding layer with blob "sha256\:a02a4930cb5d36f3290eb84f4bfa30668ef2e9fe3a1fb73ec015fc58b9958b17": ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied +``` + +#### Solution +Choose one of the following: + * Set up containers/storage in a different directory, not on an NFS share. + * Create a directory on a local file system. + * Edit `~/.config/containers/containers.conf` and point the `volume_path` option to that local directory. (Copy `/usr/share/containers/containers.conf` if `~/.config/containers/containers.conf` does not exist) + * Otherwise just run Podman as root, via `sudo podman` + +### 15) Rootless 'podman build' fails when using OverlayFS: + +The Overlay file system (OverlayFS) requires the ability to call the `mknod` command when creating whiteout files +when extracting an image. However, a rootless user does not have the privileges to use `mknod` in this capacity. + +#### Symptom +```console +$ podman build --storage-driver overlay . +STEP 1: FROM docker.io/ubuntu\:xenial +Getting image source signatures +Copying blob edf72af6d627 done +Copying blob 3e4f86211d23 done +Copying blob 8d3eac894db4 done +Copying blob f7277927d38a done +Copying config 5e13f8dd4c done +Writing manifest to image destination +Storing signatures +Error: creating build container: Error committing the finished image: error adding layer with blob "sha256:8d3eac894db4dc4154377ad28643dfe6625ff0e54bcfa63e0d04921f1a8ef7f8": Error processing tar file(exit status 1): operation not permitted +$ podman build . +ERRO[0014] Error while applying layer: ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied +error creating build container: Error committing the finished image: error adding layer with blob "sha256\:a02a4930cb5d36f3290eb84f4bfa30668ef2e9fe3a1fb73ec015fc58b9958b17": ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied +``` + +#### Solution +Choose one of the following: + * Complete the build operation as a privileged user. + * Install and configure fuse-overlayfs. + * Install the fuse-overlayfs package for your Linux Distribution. + * Add `mount_program = "/usr/bin/fuse-overlayfs"` under `[storage.options]` in your `~/.config/containers/storage.conf` file. + +### 16) RHEL 7 and CentOS 7 based `init` images don't work with cgroup v2 + +The systemd version shipped in RHEL 7 and CentOS 7 doesn't have support for cgroup v2. Support for cgroup v2 requires version 230 of systemd or newer, which +was never shipped or supported on RHEL 7 or CentOS 7. + +#### Symptom +```console +# podman run --name test -d registry.access.redhat.com/rhel7-init\:latest && sleep 10 && podman exec test systemctl status +c8567461948439bce72fad3076a91ececfb7b14d469bfa5fbc32c6403185beff +Failed to get D-Bus connection: Operation not permitted +Error: non zero exit code: 1: OCI runtime error +``` + +#### Solution +You'll need to either: + +* configure the host to use cgroup v1. On Fedora you can do: + +```console +# dnf install -y grubby +# grubby --update-kernel=ALL --args=”systemd.unified_cgroup_hierarchy=0" +# reboot +``` + +* update the image to use an updated version of systemd. + +### 17) rootless containers exit once the user session exits + +You need to set lingering mode through loginctl to prevent user processes to be killed once +the user session completed. + +#### Symptom + +Once the user logs out all the containers exit. + +#### Solution + +```console +# loginctl enable-linger $UID +``` + +### 18) `podman run` fails with "bpf create: permission denied error" + +The Kernel Lockdown patches deny eBPF programs when Secure Boot is enabled in the BIOS. [Matthew Garrett's post](https://mjg59.dreamwidth.org/50577.html) describes the relationship between Lockdown and Secure Boot and [Jan-Philip Gehrcke's](https://gehrcke.de/2019/09/running-an-ebpf-program-may-require-lifting-the-kernel-lockdown/) connects this with eBPF. [RH bug 1768125](https://bugzilla.redhat.com/show_bug.cgi?id=1768125) contains some additional details. + +#### Symptom + +Attempts to run podman result in + +```Error: bpf create : Operation not permitted: OCI runtime permission denied error``` + +#### Solution + +One workaround is to disable Secure Boot in your BIOS. + +### 19) error creating libpod runtime: there might not be enough IDs available in the namespace + +Unable to pull images + +#### Symptom + +```console +$ podman unshare cat /proc/self/uid_map + 0 1000 1 +``` + +#### Solution + +```console +$ podman system migrate +``` + +Original command now returns + +```console +$ podman unshare cat /proc/self/uid_map + 0 1000 1 + 1 100000 65536 +``` + +Reference [subuid](https://man7.org/linux/man-pages/man5/subuid.5.html) and [subgid](https://man7.org/linux/man-pages/man5/subgid.5.html) man pages for more detail. + +### 20) Passed-in devices or files can't be accessed in rootless container + +As a non-root user you have group access rights to a device or files that you +want to pass into a rootless container with `--device=...` or `--volume=...` + +#### Symptom + +Any access inside the container is rejected with "Permission denied". + +#### Solution + +The runtime uses `setgroups(2)` hence the process loses all additional groups +the non-root user has. Use the `--group-add keep-groups` flag to pass the +user's supplementary group access into the container. Currently only available +with the `crun` OCI runtime. + +### 21) A rootless container running in detached mode is closed at logout + + +When running a container with a command like `podman run --detach httpd` as +a rootless user, the container is closed upon logout and is not kept running. + +#### Symptom + +When logging out of a rootless user session, all containers that were started +in detached mode are stopped and are not kept running. As the root user, these +same containers would survive the logout and continue running. + +#### Solution + +When systemd notes that a session that started a Podman container has exited, +it will also stop any containers that have been associated with it. To avoid +this, use the following command before logging out: `loginctl enable-linger`. +To later revert the linger functionality, use `loginctl disable-linger`. + +LOGINCTL(1), SYSTEMD(1) + +### 22) Containers default detach keys conflict with shell history navigation + +Podman defaults to `ctrl-p,ctrl-q` to detach from a running containers. The +bash and zsh shells default to `ctrl-p` for the displaying of the previous +command. This causes issues when running a shell inside of a container. + +#### Symptom + +With the default detach key combo ctrl-p,ctrl-q, shell history navigation +(tested in bash and zsh) using ctrl-p to access the previous command will not +display this previous command, or anything else. Conmon is waiting for an +additional character to see if the user wants to detach from the container. +Adding additional characters to the command will cause it to be displayed along +with the additional character. If the user types ctrl-p a second time the shell +display the 2nd to last command. + +#### Solution + +The solution to this is to change the default detach_keys. For example in order +to change the defaults to `ctrl-q,ctrl-q` use the `--detach-keys` option. + +```console +$ podman run -ti --detach-keys ctrl-q,ctrl-q fedora sh +``` + +To make this change the default for all containers, users can modify the +containers.conf file. This can be done simply in your home directory, but adding the +following lines to users containers.conf + +```console +$ cat >> ~/.config/containers/containers.conf << _eof +[engine] +detach_keys="ctrl-q,ctrl-q" +_eof +``` + +In order to effect root running containers and all users, modify the system +wide defaults in `/etc/containers/containers.conf`. + + +### 23) Container with exposed ports won't run in a pod + +A container with ports that have been published with the `--publish` or `-p` option +can not be run within a pod. + +#### Symptom + +```console +$ podman pod create --name srcview -p 127.0.0.1:3434:3434 -p 127.0.0.1:7080:7080 -p 127.0.0.1:3370:3370 4b2f4611fa2cbd60b3899b936368c2b3f4f0f68bc8e6593416e0ab8ecb0a3f1d + +$ podman run --pod srcview --name src-expose -p 3434:3434 -v "${PWD}:/var/opt/localrepo":Z,ro sourcegraph/src-expose:latest serve /var/opt/localrepo +Error: cannot set port bindings on an existing container network namespace +``` + +#### Solution + +This is a known limitation. If a container will be run within a pod, it is not necessary +to publish the port for the containers in the pod. The port must only be published by the +pod itself. Pod network stacks act like the network stack on the host - you have a +variety of containers in the pod, and programs in the container, all sharing a single +interface and IP address, and associated ports. If one container binds to a port, no other +container can use that port within the pod while it is in use. Containers in the pod can +also communicate over localhost by having one container bind to localhost in the pod, and +another connect to that port. + +In the example from the symptom section, dropping the `-p 3434:3434` would allow the +`podman run` command to complete, and the container as part of the pod would still have +access to that port. For example: + +```console +$ podman run --pod srcview --name src-expose -v "${PWD}:/var/opt/localrepo":Z,ro sourcegraph/src-expose:latest serve /var/opt/localrepo +``` + +### 24) Podman container images fail with `fuse: device not found` when run + +Some container images require that the fuse kernel module is loaded in the kernel +before they will run with the fuse filesystem in play. + +#### Symptom + +When trying to run the container images found at quay.io/podman, quay.io/containers +registry.access.redhat.com/ubi8 or other locations, an error will sometimes be returned: + + +``` +ERRO error unmounting /var/lib/containers/storage/overlay/30c058cdadc888177361dd14a7ed7edab441c58525b341df321f07bc11440e68/merged: invalid argument +error mounting container "1ae176ca72b3da7c70af31db7434bcf6f94b07dbc0328bc7e4e8fc9579d0dc2e": error mounting build container "1ae176ca72b3da7c70af31db7434bcf6f94b07dbc0328bc7e4e8fc9579d0dc2e": error creating overlay mount to /var/lib/containers/storage/overlay/30c058cdadc888177361dd14a7ed7edab441c58525b341df321f07bc11440e68/merged: using mount program /usr/bin/fuse-overlayfs: fuse: device not found, try 'modprobe fuse' first +fuse-overlayfs: cannot mount: No such device +: exit status 1 +ERRO exit status 1 +``` + +#### Solution + +If you encounter a `fuse: device not found` error when running the container image, it is likely that +the fuse kernel module has not been loaded on your host system. Use the command `modprobe fuse` to load the +module and then run the container image afterwards. To enable this automatically at boot time, you can add a configuration +file to `/etc/modules.load.d`. See `man modules-load.d` for more details. + +### 25) podman run --rootfs link/to//read/only/dir does not work + +An error such as "OCI runtime error" on a read-only filesystem or the error "{image} is not an absolute path or is a symlink" are often times indicators for this issue. For more details, review this [issue]( +https://github.com/containers/podman/issues/5895). + +#### Symptom + +Rootless Podman requires certain files to exist in a file system in order to run. +Podman will create /etc/resolv.conf, /etc/hosts and other file descriptors on the rootfs in order +to mount volumes on them. + +#### Solution + +Run the container once in read/write mode, Podman will generate all of the FDs on the rootfs, and +from that point forward you can run with a read-only rootfs. + +```console +$ podman run --rm --rootfs /path/to/rootfs true +``` + +The command above will create all the missing directories needed to run the container. + +After that, it can be used in read-only mode, by multiple containers at the same time: + +```console +$ podman run --read-only --rootfs /path/to/rootfs .... +``` + +Another option is to use an Overlay Rootfs Mount: + +```console +$ podman run --rootfs /path/to/rootfs\:O .... +``` + +Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +### 26) Running containers with resource limits fails with a permissions error + +On some systemd-based systems, non-root users do not have resource limit delegation +permissions. This causes setting resource limits to fail. + +#### Symptom + +Running a container with a resource limit options will fail with an error similar to the following: + +`--cpus`, `--cpu-period`, `--cpu-quota`, `--cpu-shares`: + + Error: OCI runtime error: crun: the requested cgroup controller `cpu` is not available + +`--cpuset-cpus`, `--cpuset-mems`: + + Error: OCI runtime error: crun: the requested cgroup controller `cpuset` is not available + +This means that resource limit delegation is not enabled for the current user. + +#### Solution + +You can verify whether resource limit delegation is enabled by running the following command: + +```console +$ cat "/sys/fs/cgroup/user.slice/user-$(id -u).slice/user@$(id -u).service/cgroup.controllers" +``` + +Example output might be: + + memory pids + +In the above example, `cpu` and `cpuset` are not listed, which means the current user does +not have permission to set CPU or CPUSET limits. + +If you want to enable CPU or CPUSET limit delegation for all users, you can create the +file `/etc/systemd/system/user@.service.d/delegate.conf` with the contents: + +```ini +[Service] +Delegate=memory pids cpu cpuset +``` + +After logging out and logging back in, you should have permission to set +CPU and CPUSET limits. + +### 27) `exec container process '/bin/sh': Exec format error` (or another binary than `bin/sh`) + +This can happen when running a container from an image for another architecture than the one you are running on. + +For example, if a remote repository only has, and thus send you, a `linux/arm64` _OS/ARCH_ but you run on `linux/amd64` (as happened in https://github.com/openMF/community-app/issues/3323 due to https://github.com/timbru31/docker-ruby-node/issues/564). + +### 28) `Error: failed to create sshClient: Connection to bastion host (ssh://user@host:22/run/user/.../podman/podman.sock) failed.: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain` + +In some situations where the client is not on the same machine as where the podman daemon is running the client key could be using a cipher not supported by the host. This indicates an issue with one's SSH config. Until remedied using podman over ssh +with a pre-shared key will be impossible. + +#### Symptom + +The accepted ciphers per `/etc/crypto-policies/back-ends/openssh.config` are not one that was used to create the public/private key pair that was transferred over to the host for ssh authentication. + +You can confirm this is the case by attempting to connect to the host via `podman-remote info` from the client and simultaneously on the host running `journalctl -f` and watching for the error `userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]`. + +#### Solution + +Create a new key using a supported algorithm e.g. ecdsa: + +```console +$ ssh-keygen -t ecdsa -f ~/.ssh/podman +``` + +Then copy the new id over: + +```console +$ ssh-copy-id -i ~/.ssh/podman.pub user@host +``` + +And then re-add the connection (removing the old one if necessary): + +```console +$ podman-remote system connection add myuser --identity ~/.ssh/podman ssh://user@host/run/user/1000/podman/podman.sock +``` + +And now this should work: + +```console +$ podman-remote info +``` + +### 29) Rootless CNI networking fails in RHEL with Podman v2.2.1 to v3.0.1. + +A failure is encountered when trying to use networking on a rootless +container in Podman v2.2.1 through v3.0.1 on RHEL. This error does not +occur on other Linux distributions. + +#### Symptom + +A rootless container is created using a CNI network, but the `podman run` command +returns an error that an image must be built. + +#### Solution + +In order to use a CNI network in a rootless container on RHEL, +an Infra container image for CNI-in-slirp4netns must be created. The +instructions for building the Infra container image can be found for +v2.2.1 [here](https://github.com/containers/podman/tree/v2.2.1-rhel/contrib/rootless-cni-infra), +and for v3.0.1 [here](https://github.com/containers/podman/tree/v3.0.1-rhel/contrib/rootless-cni-infra). + +### 30) Container related firewall rules are lost after reloading firewalld +Container network can't be reached after `firewall-cmd --reload` and `systemctl restart firewalld` Running `podman network reload` will fix it but it has to be done manually. + +#### Symptom +The firewall rules created by podman are lost when the firewall is reloaded. + +#### Solution +[@ranjithrajaram](https://github.com/containers/podman/issues/5431#issuecomment-847758377) has created a systemd-hook to fix this issue + +1) For "firewall-cmd --reload", create a systemd unit file with the following +```ini +[Unit] +Description=firewalld reload hook - run a hook script on firewalld reload +Wants=dbus.service +After=dbus.service + +[Service] +Type=simple +ExecStart=/bin/bash -c '/bin/busctl monitor --system --match "interface=org.fedoraproject.FirewallD1,member=Reloaded" --match "interface=org.fedoraproject.FirewallD1,member=PropertiesChanged" | while read -r line ; do podman network reload --all ; done' + +[Install] +WantedBy=default.target +``` + +2) For "systemctl restart firewalld", create a systemd unit file with the following +```ini +[Unit] +Description=podman network reload +Wants=firewalld.service +After=firewalld.service +PartOf=firewalld.service + +[Service] +Type=simple +RemainAfterExit=yes +ExecStart=/usr/bin/podman network reload --all + +[Install] +WantedBy=default.target +``` + +However, If you use busctl monitor then you can't get machine-readable output on RHEL 8. +Since it doesn't have `busctl -j` as mentioned here by [@yrro](https://github.com/containers/podman/issues/5431#issuecomment-896943018). + +For RHEL 8, you can use the following one-liner bash script. +```ini +[Unit] +Description=Redo podman NAT rules after firewalld starts or reloads +Wants=dbus.service +After=dbus.service +Requires=firewalld.service + +[Service] +Type=simple +ExecStart=/bin/bash -c "dbus-monitor --profile --system 'type=signal,sender=org.freedesktop.DBus,path=/org/freedesktop/DBus,interface=org.freedesktop.DBus,member=NameAcquired,arg0=org.fedoraproject.FirewallD1' 'type=signal,path=/org/fedoraproject/FirewallD1,interface=org.fedoraproject.FirewallD1,member=Reloaded' | sed -u '/^#/d' | while read -r type timestamp serial sender destination path interface member _junk; do if [[ $type = '#'* ]]; then continue; elif [[ $interface = org.freedesktop.DBus && $member = NameAcquired ]]; then echo 'firewalld started'; podman network reload --all; elif [[ $interface = org.fedoraproject.FirewallD1 && $member = Reloaded ]]; then echo 'firewalld reloaded'; podman network reload --all; fi; done" +Restart=Always + +[Install] +WantedBy=default.target +``` +`busctl-monitor` is almost usable in RHEL 8, except that it always outputs two bogus events when it starts up, +one of which is (in its only machine-readable format) indistinguishable from the `NameOwnerChanged` that you get when firewalld starts up. +This means you would get an extra `podman network reload --all` when this unit starts. + +Apart from this, you can use the following systemd service with the python3 code. + +```ini +[Unit] +Description=Redo podman NAT rules after firewalld starts or reloads +Wants=dbus.service +Requires=firewalld.service +After=dbus.service + +[Service] +Type=simple +ExecStart=/usr/bin/python /path/to/python/code/podman-redo-nat.py +Restart=always + +[Install] +WantedBy=default.target +``` +The code reloads podman network twice when you use `systemctl restart firewalld`. +```python3 +import dbus +from gi.repository import GLib +from dbus.mainloop.glib import DBusGMainLoop +import subprocess +import sys + +# I'm a bit confused on the return values in the code +# Not sure if they are needed. + +def reload_podman_network(): + try: + subprocess.run(["podman","network","reload","--all"],timeout=90) + # I'm not sure about this part + sys.stdout.write("podman network reload done\n") + sys.stdout.flush() + except subprocess.TimeoutExpired as t: + sys.stderr.write(f"Podman reload failed due to Timeout {t}") + except subprocess.CalledProcessError as e: + sys.stderr.write(f"Podman reload failed due to {e}") + except Exception as e: + sys.stderr.write(f"Podman reload failed with an Unhandled Exception {e}") + + return False + +def signal_handler(*args, **kwargs): + if kwargs.get('member') == "Reloaded": + reload_podman_network() + elif kwargs.get('member') == "NameOwnerChanged": + reload_podman_network() + else: + return None + return None + +def signal_listener(): + try: + DBusGMainLoop(set_as_default=True)# Define the loop. + loop = GLib.MainLoop() + system_bus = dbus.SystemBus() + # Listens to systemctl restart firewalld with a filter added, will cause podman network to be reloaded twice + system_bus.add_signal_receiver(signal_handler,dbus_interface='org.freedesktop.DBus',arg0='org.fedoraproject.FirewallD1',member_keyword='member') + # Listens to firewall-cmd --reload + system_bus.add_signal_receiver(signal_handler,dbus_interface='org.fedoraproject.FirewallD1',signal_name='Reloaded',member_keyword='member') + loop.run() + except KeyboardInterrupt: + loop.quit() + sys.exit(0) + except Exception as e: + loop.quit() + sys.stderr.write(f"Error occurred {e}") + sys.exit(1) + +if __name__ == "__main__": + signal_listener() +``` + +### 31) Podman run fails with `ERRO[0000] XDG_RUNTIME_DIR directory "/run/user/0" is not owned by the current user` or `Error: creating tmpdir: mkdir /run/user/1000: permission denied`. + +A failure is encountered when performing `podman run` with a warning `XDG_RUNTIME_DIR is pointing to a path which is not writable. Most likely podman will fail.` + +#### Symptom + +A rootless container is being invoked with cgroup configuration as `cgroupv2` for user with missing or invalid **systemd session**. + +Example cases +```console +# su user1 -c 'podman images' +ERRO[0000] XDG_RUNTIME_DIR directory "/run/user/0" is not owned by the current user +``` +```console +# su - user1 -c 'podman images' +Error: creating tmpdir: mkdir /run/user/1000: permission denied +``` + +#### Solution + +Podman expects a valid login session for the `rootless+cgroupv2` use-case. Podman execution is expected to fail if the login session is not present. In most cases, podman will figure out a solution on its own but if `XDG_RUNTIME_DIR` is pointing to a path that is not writable execution will most likely fail. Typical scenarios of such cases are seen when users are trying to use Podman with `su - -c ''`, or `sudo -l` and badly configured systemd session. + +Alternatives: + +* Execute Podman via __systemd-run__ that will first start a systemd login session: + + ```console + $ sudo systemd-run --machine=username@ --quiet --user --collect --pipe --wait podman run --rm docker.io/library/alpine echo hello + ``` +* Start an interactive shell in a systemd login session with the command `machinectl shell @` + and then run Podman + + ```console + $ sudo -i + # machinectl shell username@ + Connected to the local host. Press ^] three times within 1s to exit session. + $ podman run --rm docker.io/library/alpine echo hello + ``` +* Start a new systemd login session by logging in with `ssh` i.e. `ssh @localhost` and then run Podman. + +* Before invoking Podman command create a valid login session for your rootless user using `loginctl enable-linger ` + +### 32) 127.0.0.1:7777 port already bound + +After deleting a VM on macOS, the initialization of subsequent VMs fails. + +#### Symptom + +After deleting a client VM on macOS via `podman machine stop` && `podman machine rm`, attempting to `podman machine init` a new client VM leads to an error with the 127.0.0.1:7777 port already bound. + +#### Solution + +You will need to remove the hanging gv-proxy process bound to the port in question. For example, if the port mentioned in the error message is 127.0.0.1:7777, you can use the command `kill -9 $(lsof -i:7777)` in order to identify and remove the hanging process which prevents you from starting a new VM on that default port. + +### 33) The sshd process fails to run inside of the container. + +#### Symptom + +The sshd process running inside the container fails with the error +"Error writing /proc/self/loginuid". + +### Solution + +If the `/proc/self/loginuid` file is already initialized then the +`CAP_AUDIT_CONTROL` capability is required to override it. + +This happens when running Podman from a user session since the +`/proc/self/loginuid` file is already initialized. The solution is to +run Podman from a system service, either using the Podman service, and +then using podman -remote to start the container or simply by running +something like `systemd-run podman run ...`. In this case the +container will only need `CAP_AUDIT_WRITE`. + +### 34) Container creates a file that is not owned by the user's regular UID + +After running a container with rootless Podman, the non-root user sees a numerical UID and GID instead of a username and groupname. + +#### Symptom + +When listing file permissions with `ls -l` on the host in a directory that was passed as `--volume /some/dir` to `podman run`, +the UID and GID are displayed rather than the corresponding username and groupname. The UID and GID numbers displayed are +from the user's subordinate UID and GID ranges on the host system. + +An example + +```console +$ mkdir dir1 +$ chmod 777 dir1 +$ podman run --rm -v ./dir1:/dir1\:Z \ + --user 2003:2003 \ + docker.io/library/ubuntu bash -c "touch /dir1/a; chmod 600 /dir1/a" +$ ls -l dir1/a +-rw-------. 1 102002 102002 0 Jan 19 19:35 dir1/a +$ less dir1/a +less: dir1/a: Permission denied +``` + +#### Solution + +If you want to read, chown, or remove such a file, enter a user +namespace. Instead of running commands such as `less dir1/a` or `rm dir1/a`, you +need to prepend the command-line with `podman unshare`, i.e., +`podman unshare less dir1/a` or `podman unshare rm dir1/a`. To change the ownership +of the file `dir1/a` to your regular user's UID and GID, run `podman unshare chown 0:0 dir1/a`. +A file having the ownership `0:0` in the user namespace is owned by the regular +user on the host. To use Bash features, such as variable expansion and +globbing, you need to wrap the command with `bash -c`, e.g. +`podman unshare bash -c 'ls $HOME/dir1/a*'`. + +Would it have been possible to run Podman in another way so that your regular +user would have become the owner of the file? Yes, you can use the option +`--userns keep-id:uid=$uid,gid=$gid` to change how UIDs and GIDs are mapped +between the container and the host. Let's try it out. + +In the example above `ls -l` shows the UID 102002 and GID 102002. Set shell variables + +```console +$ uid_from_ls=102002 +$ gid_from_ls=102002 +``` + +Set shell variables to the lowest subordinate UID and GID + +```console +$ lowest_subuid=$(podman info --format "{{ (index .Host.IDMappings.UIDMap 1).HostID }}") +$ lowest_subgid=$(podman info --format "{{ (index .Host.IDMappings.GIDMap 1).HostID }}") +``` + +Compute the UID and GID inside the container that map to the owner of the created file on the host. + +```console +$ uid=$(( $uid_from_ls - $lowest_subuid + 1)) +$ gid=$(( $gid_from_ls - $lowest_subgid + 1)) +``` +(In the computation it was assumed that there is only one subuid range and one subgid range) + +```console +$ echo $uid +2003 +$ echo $gid +2003 +``` + +The computation shows that the UID is `2003` and the GID is `2003` inside the container. +This comes as no surprise as this is what was specified before with `--user=2003:2003`, +but the same computation could be used whenever a username is specified +or the `--user` option is not used. + +Run the container again but now with UIDs and GIDs mapped + +```console +$ mkdir dir1 +$ chmod 777 dir1 +$ podman run --rm + -v ./dir1:/dir1:Z \ + --user $uid:$gid \ + --userns keep-id:uid=$uid,gid=$gid \ + docker.io/library/ubuntu bash -c "touch /dir1/a; chmod 600 /dir1/a" +$ id -u +tester +$ id -g +tester +$ ls -l dir1/a +-rw-------. 1 tester tester 0 Jan 19 20:31 dir1/a +$ +``` + +In this example the `--user` option specified a rootless user in the container. +As the rootless user could also have been specified in the container image, e.g. + +```console +$ podman image inspect --format "user: {{.User}}" IMAGE +user: hpc +``` +the same problem could also occur even without specifying `--user`. + +Another variant of the same problem could occur when using +`--user=root:root` (the default), but where the root user creates non-root owned files +in some way (e.g by creating them themselves, or switching the effective UID to +a rootless user and then creates files). + +See also the troubleshooting tip: + +[_Podman run fails with "Error: unrecognized namespace mode keep-id\:uid=1000,gid=1000 passed"_](#39-podman-run-fails-with-error-unrecognized-namespace-mode-keep-iduid1000gid1000-passed) + +### 35) Passed-in devices or files can't be accessed in rootless container (UID/GID mapping problem) + +As a non-root user you have access rights to devices, files and directories that you +want to pass into a rootless container with `--device=...`, `--volume=...` or `--mount=..`. + +Podman by default maps a non-root user inside a container to one of the user's +subordinate UIDs and subordinate GIDs on the host. When the container user tries to access a +file, a "Permission denied" error could occur because the container user does not have the +permissions of the regular user of the host. + +#### Symptom + +* Any access inside the container is rejected with "Permission denied" +for files, directories or devices passed in to the container +with `--device=..`,`--volume=..` or `--mount=..`, e.g. + +```console +$ mkdir dir1 +$ chmod 700 dir1 +$ podman run --rm -v ./dir1:/dir1:Z \ + --user 2003:2003 \ + docker.io/library/ubuntu ls /dir1 +ls: cannot open directory '/dir1': Permission denied +``` + +#### Solution + +We follow essentially the same solution as in the previous +troubleshooting tip: + +[_Container creates a file that is not owned by the user's regular UID_](#34-container-creates-a-file-that-is-not-owned-by-the-users-regular-uid) + +but for this problem the container UID and GID can't be as +easily computed by mere addition and subtraction. + +In other words, it might be more challenging to find out the UID and +the GID inside the container that we want to map to the regular +user on the host. + +If the `--user` option is used together with a numerical UID and GID +to specify a rootless user, we already know the answer. + +If the `--user` option is used together with a username and groupname, +we could look up the UID and GID in the file `/etc/passwd` of the container. + +If the container user is not set via `--user` but instead from the +container image, we could inspect the container image + +```console +$ podman image inspect --format "user: {{.User}}" IMAGE +user: hpc +``` + +and then look it up in `/etc/passwd` of the container. + +If the problem occurs in a container that is started to run as root but later +switches to an effictive UID of a rootless user, it might be less +straightforward to find out the UID and the GID. Reading the +`Containerfile`, `Dockerfile` or the `/etc/passwd` could give a clue. + +To run the container with the rootless container UID and GID mapped to the +user's regular UID and GID on the host follow these steps: + +Set the `uid` and `gid` shell variables in a Bash shell to the UID and GID +of the user that will be running inside the container, e.g. + +```console +$ uid=2003 +$ gid=2003 +``` + +and run + +```console +$ mkdir dir1 +$ echo hello > dir1/file.txt +$ chmod 700 dir1/file.txt +$ podman run --rm \ + -v ./dir1:/dir1:Z \ + --user $uid:$gid \ + --userns keep-id:uid=$uid,gid=$gid \ + docker.io/library/alpine cat /dir1/file.txt +hello +``` + +See also the troubleshooting tip: + +[_Podman run fails with "Error: unrecognized namespace mode keep-id:uid=1000,gid=1000 passed"_](#39-podman-run-fails-with-error-unrecognized-namespace-mode-keep-iduid1000gid1000-passed) + +### 36) Images in the additional stores can be deleted even if there are containers using them + +When an image in an additional store is used, it is not locked thus it +can be deleted even if there are containers using it. + +#### Symptom + +WARN[0000] Can't stat lower layer "/var/lib/containers/storage/overlay/l/7HS76F2P5N73FDUKUQAOJA3WI5" because it does not exist. Going through storage to recreate the missing symlinks. + +#### Solution + +It is the user responsibility to make sure images in an additional +store are not deleted while being used by containers in another +store. + +### 37) Syncing bugfixes for podman-remote or setups using Podman API + +After upgrading Podman to a newer version an issue with the earlier version of Podman still presents itself while using podman-remote. + +#### Symptom + +While running podman remote commands with the most updated Podman, issues that were fixed in a prior version of Podman can arise either on the Podman client side or the Podman server side. + +#### Solution + +When upgrading Podman to a particular version for the required fixes, users often make the mistake of only upgrading the Podman client. However, suppose a setup uses `podman-remote` or uses a client that communicates with the Podman server on a remote machine via the REST API. In that case, it is required to upgrade both the Podman client and the Podman server running on the remote machine. Both the Podman client and server must be upgraded to the same version. + +Example: If a particular bug was fixed in `v4.1.0` then the Podman client must have version `v4.1.0` as well the Podman server must have version `v4.1.0`. + +### 38) Unexpected carriage returns are outputted on the terminal + +When using the __--tty__ (__-t__) flag, unexpected carriage returns are outputted on the terminal. + +#### Symptom + +The container program prints a newline (`\n`) but the terminal outputs a carriage return and a newline (`\r\n`). + +``` +$ podman run --rm -t fedora echo abc | od -c +0000000 a b c \r \n +0000005 +``` + +When run directly on the host, the result is as expected. + +``` +$ echo abc | od -c +0000000 a b c \n +0000004 +``` + +Extra carriage returns can also shift the prompt to the right. + +``` +$ podman run --rm -t fedora sh -c "echo 1; echo 2; echo 3" | cat -A +1^M$ + 2^M$ + 3^M$ + $ +``` + +#### Solution + +Run Podman without the __--tty__ (__-t__) flag. + +``` +$ podman run --rm fedora echo abc | od -c +0000000 a b c \n +0000004 +``` + +The __--tty__ (__-t__) flag should only be used when the program requires user interaction in the termainal, for instance expecting +the user to type an answer to a question. + +Where does the extra carriage return `\r` come from? + +The extra `\r` is not outputted by Podman but by the terminal. In fact, a reconfiguration of the terminal can make the extra `\r` go away. + +``` +$ podman run --rm -t fedora /bin/sh -c "stty -onlcr && echo abc" | od -c +0000000 a b c \n +0000004 +``` + +### 39) Podman run fails with "Error: unrecognized namespace mode keep-id:uid=1000,gid=1000 passed" + +Podman 4.3.0 introduced the options _uid_ and _gid_ that can be given to `--userns keep-id` which are not recognized by older versions of Podman. + +#### Symptom + +When using a Podman version older than 4.3.0, the options _uid_ and _gid_ are not recognized, and an "unrecognized namespace mode" error is raised. + +``` +$ uid=1000 +$ gid=1000 +$ podman run --rm + --user $uid:$gid \ + --userns keep-id:uid=$uid,gid=$gid \ + docker.io/library/ubuntu /bin/cat /proc/self/uid_map +Error: unrecognized namespace mode keep-id:uid=1000,gid=1000 passed +$ +``` + +#### Solution + +Use __--uidmap__ and __--gidmap__ options to describe the same UID and GID mapping. + +Run + +``` +$ uid=1000 +$ gid=1000 +$ subuidSize=$(( $(podman info --format "{{ range \ + .Host.IDMappings.UIDMap }}+{{.Size }}{{end }}" ) - 1 )) +$ subgidSize=$(( $(podman info --format "{{ range \ + .Host.IDMappings.GIDMap }}+{{.Size }}{{end }}" ) - 1 )) +$ podman run --rm \ + --user $uid:$gid \ + --uidmap 0:1:$uid \ + --uidmap $uid:0:1 \ + --uidmap $(($uid+1)):$(($uid+1)):$(($subuidSize-$uid)) \ + --gidmap 0:1:$gid \ + --gidmap $gid:0:1 \ + --gidmap $(($gid+1)):$(($gid+1)):$(($subgidSize-$gid)) \ + docker.io/library/ubuntu /bin/cat /proc/self/uid_map + 0 1 1000 + 1000 0 1 + 1001 1001 64536 +``` + +which uses the same UID and GID mapping as when specifying +`--userns keep-id:uid=$uid,gid=$gid` with Podman 4.3.0 (or greater) + +``` +$ uid=1000 +$ gid=1000 +$ podman run --rm \ + --user $uid:$gid \ + --userns keep-id:uid=$uid,gid=$gid \ + docker.io/library/ubuntu /bin/cat /proc/self/uid_map + 0 1 1000 + 1000 0 1 + 1001 1001 64536 +``` + +Replace `/bin/cat /proc/self/uid_map` with +`/bin/cat /proc/self/gid_map` to show the GID mapping. + +### 40) Podman fails to find expected image with "error locating pulled image", "image not known" + +When trying to do a Podman command that pulls an image from local storage or a remote repository, +an error is raised saying "image not known" or "error locating pulled image". Even though the image +had been verified before the Podman command was invoked. + +#### Symptom + +After verifying that an image is in place either locally or on a remote repository, a Podman command +referencing that image will fail in a manner like: +``` +# ls Containerfile +FROM registry.access.redhat.com/ubi8-minimal:latest +MAINTAINER Podman Community +USER root + +# podman build . +STEP 1/2: FROM registry.access.redhat.com/ubi8-minimal +Trying to pull registry.access.redhat.com/ubi8-minimal:latest... +Getting image source signatures +Checking if image destination supports signatures +Copying blob a6577091999b done +Copying config abb1ba1bce done +Writing manifest to image destination +Storing signatures +Error: error creating build container: error locating pulled image "registry.access.redhat.com/ubi8-minimal:latest" name in containers storage: registry.access.redhat.com/ubi8-minimal\:latest: image not known +``` + +#### Solution +The general cause for this is a timing issue. To make Podman commands as +efficient as possible, read and write locks are only established for critical +sections within the code. When pulling an image from a repository, a copy of +that image is first written to local storage using a write lock. This lock is +released before the image is then acquired/read. If another process does a +harmful command such as `podman system prune --all` or `podman system reset` +or `podman rmi --all`, between the time the image is written and before the +first process can acquire it, this type of `image not known` error can arise. + +The maintainers of Podman have considered heavier-duty locks to close this +timing window. However, the slowdown that all Podman commands would encounter +was not considered worth the cost of completely closing this small timing window. + +### 41) A podman build step with `--mount=type=secret` fails with "operation not permitted" + +Executing a step in a `Dockerfile`/`Containerfile` which mounts secrets using `--mount=type=secret` fails with "operation not permitted" when running on a host filesystem mounted with `nosuid` and when using the `runc` runtime. + +#### Symptom + +A `RUN` line in the `Dockerfile`/`Containerfile` contains a [secret mount](https://github.com/containers/common/blob/main/docs/Containerfile.5.md) such as `--mount=type=secret,id=MY_USER,target=/etc/dnf/vars/MY_USER`. +When running `podman build` the process fails with an error message like: + +``` +STEP 3/13: RUN --mount=type=secret,id=MY_USER,target=/etc/dnf/vars/MY_USER --mount=type=secret,id=MY_USER,target=/etc/dnf/vars/MY_USER ...: time="2023-06-13T18:04:59+02:00" level=error msg="runc create failed: unable to start container process: error during container init: error mounting \"/var/tmp/buildah2251989386/mnt/buildah-bind-target-11\" to rootfs at \"/etc/dnf/vars/MY_USER\": mount /var/tmp/buildah2251989386/mnt/buildah-bind-target-11:/etc/dnf/vars/MY_USER (via /proc/self/fd/7), flags: 0x1021: operation not permitted" +: exit status 1 +ERRO[0002] did not get container create message from subprocess: EOF +``` + +#### Solution + +* Install `crun`, e.g. with `dnf install crun`. +* Use the `crun` runtime by passing `--runtime /usr/bin/crun` to `podman build`. + +See also [Buildah issue 4228](https://github.com/containers/buildah/issues/4228) for a full discussion of the problem. + +### 42) podman-in-podman builds that are file I/0 intensive are very slow + +When using the `overlay` storage driver to do a nested `podman build` inside a running container, file I/O operations such as `COPY` of a large amount of data is very slow or can hang completely. + +#### Symptom + +Using the default `overlay` storage driver, a `COPY`, `ADD`, or an I/O intensive `RUN` line in a `Containerfile` that is run inside another container is very slow or hangs completely when running a `podman build` inside the running parent container. + +#### Solution + +This could be caused by the child container using `fuse-overlayfs` for writing to `/var/lib/containers/storage`. Writes can be slow with `fuse-overlayfs`. The solution is to use the native `overlay` filesystem by using a local directory on the host system as a volume to `/var/lib/containers/storage` like so: `podman run --privileged --rm -it -v ./nested_storage:/var/lib/containers/storage parent:latest`. Ensure that the base image of `parent:latest` in this example has no contents in `/var/lib/containers/storage` in the image itself for this to work. Once using the native volume, the nested container should not fall back to `fuse-overlayfs` to write files and the nested build will complete much faster. + +If you don't have access to the parent run process, such as in a CI environment, then the second option is to change the storage driver to `vfs` in the parent image by changing changing this line in your `storage.conf` file: `driver = "vfs"`. You may have to run `podman system reset` for this to take effect. You know it's changed when `podman info |grep graphDriverName` outputs `graphDriverName: vfs`. This method is slower performance than using the volume method above but is significantly faster than `fuse-overlayfs` + +### 43) `podman run --userns=auto` fails with "Error: creating container storage: not enough unused IDs in user namespace" + +Using `--userns=auto` when creating new containers does not work as long as any containers exist that were created with `--userns=keep-id` or `--userns=nomap` + +#### Symptom + +1. Run with `--userns=auto` + ``` + $ podman run --rm -d --userns=auto alpine sleep 3600 + ``` + The command succeeds. +2. Run with `--userns=auto` + ``` + $ podman run --rm -d --userns=auto alpine sleep 3600 + ``` + The command succeeds. +3. Run with `--userns=keep-id` + ``` + $ podman run --rm -d --userns=keep-id alpine sleep 3600 + ``` + The command succeeds. +4. Run with `--userns=auto` + ``` + $ podman run --rm -d --userns=auto alpine sleep 3600 + ``` + The command fails with the error message + ``` + Error: creating container storage: not enough unused IDs in user namespace + ``` + +#### Solution + +Any existing containers that were created using `--userns=keep-id` or `--userns=nomap` must first be deleted before any new container can be created with `--userns=auto` + +### 44) `sudo podman run --userns=auto` fails with `Cannot find mappings for user "containers"` + +When rootful podman is invoked with `--userns=auto`, podman needs to +pick subranges of subuids and subgids for the user namespace of the container. +Rootful podman ensures that the subuid and subgid ranges for such containers +do not overlap, but how can rootful podman prevent other tools +from accidentally using these IDs? + +It's not possible to block other tools that are running as root from using these IDs, +but such tools would normally not use subuids and subgids that have already +been assigned to a user in _/etc/subuid_ and _/etc/subgid_. + +The username _containers_ on the host has a special function for rootful Podman. +Rootful podman uses the subuids and subgids of the user _containers_ when +running `--userns=auto` containers. The user _containers_ has no need for these +subuids and subgids because no processes should be started as the user _containers_. +In other words, the user _containers_ is a special user that only exists on the system +to reserve _subuids_ and _subgids_ for rootful podman. + +_containers_ is the default username but it can be changed by setting the +option `root-auto-userns-user` in the file _/etc/containers/storage.conf_ + +#### Symptom + +Run rootful podman with `--userns=auto` +``` +sudo podman run --rm --userns=auto alpine echo hello +``` +The command fails with the error message: +``` +ERRO[0000] Cannot find mappings for user "containers": no subuid ranges found for user "containers" in /etc/subuid +Error: creating container storage: not enough unused IDs in user namespace +``` + +The files _/etc/subuid_ and _/etc/subgid_ do not have any lines that start with `containers:` + +#### Solution + +Add subuid and subgid ranges for the user _containers_ in _/etc/subuid_ and _/etc/subgid_ +or provide such ranges with _/etc/nsswitch.conf_. +For details, see [subid(5)](https://man7.org/linux/man-pages/man5/subuid.5.html). + +The following steps create the user _containers_ and assigns big subuid and subgid ranges to it: + +1. Create the user _containers_ + ``` + sudo useradd --comment "Helper user to reserve subuids and subgids for Podman" \ + --no-create-home \ + --shell /usr/sbin/nologin \ + containers + ``` +2. Check the subuid and subgid ranges of the user _containers_ + ``` + $ grep ^containers: /etc/subuid + containers:720896:65536 + $ grep ^containers: /etc/subgid + containers:720896:65536 + ``` + By default __useradd__ assigns 65536 subuids and 65536 subgids to a new user. + Typically you would like the reserved pool to be bigger than that. The bigger + the size, the more containers could be started with `sudo podman run --userns=auto ...` +3. Edit the line for the user _containers_ in the files _/etc/subuid_ and _/etc/subgid_ + to make the ranges bigger. Ensure that the subuid range of the user _containers_ do + not overlap with any other subuid ranges in the files _/etc/subuid_. Ensure that the + subgid range of the user _containers_ do not overlap with any other subgid ranges in + the files _/etc/subgid_. + +Test the echo command again + +``` +sudo podman run --rm --userns=auto alpine echo hello +``` + +The command succeeds and prints `hello` diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-unmount.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-unmount.1.md new file mode 100644 index 000000000..27a348dd6 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-unmount.1.md @@ -0,0 +1,75 @@ +--- +title: podman-unmount +version: v5.5.0 +--- + +% podman-unmount 1 + +## NAME +podman\-unmount - Unmount a working container's root filesystem + +## SYNOPSIS +**podman unmount** [*options*] *container* [...] + +**podman umount** [*options*] *container* [...] + +**podman container unmount** [*options*] *container* [...] + +**podman container umount** [*options*] *container* [...] + +## DESCRIPTION +Unmounts the specified containers' root file system, if no other processes +are using it. + +Container storage increments a mount counter each time a container is mounted. +When a container is unmounted, the mount counter is decremented, and the +container's root filesystem is physically unmounted only when the mount +counter reaches zero indicating no other processes are using the mount. +An unmount can be forced with the --force flag. + +Note: Podman can be used to unmount Podman containers as well as external containers. +External containers are containers created in container/storage by other tools like +Buildah and CRI-O. + +## OPTIONS +#### **--all**, **-a** + +All of the currently mounted containers are unmounted. + +#### **--force**, **-f** + +Force the unmounting of specified containers' root file system, even if other +processes have mounted it. + +Note: Other processes can fail if the mount point they are using is removed without their knowledge. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Unmount container with a given ID: +``` +podman container unmount containerID +``` + +Unmount multiple containers with given IDs: +``` +podman unmount containerID1 containerID2 containerID3 +``` + +Unmount all containers: +``` +podman unmount --all +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-mount(1)](podman-mount.1.md)**, **[podman-image-mount(1)](podman-image-mount.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-unpause.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-unpause.1.md new file mode 100644 index 000000000..4021f995a --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-unpause.1.md @@ -0,0 +1,103 @@ +--- +title: podman-unpause +version: v5.5.0 +--- + +% podman-unpause 1 + +## NAME +podman\-unpause - Unpause one or more containers + +## SYNOPSIS +**podman unpause** [*options*]|[*container* ...] + +**podman container unpause** [*options*]|[*container* ...] + +## DESCRIPTION +Unpauses the processes in one or more containers. Container IDs or names can be used as input. + +## OPTIONS + +#### **--all**, **-a** + +Unpause all paused containers. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and unpause the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + +#### **--filter**, **-f**=*filter* + +Filter what containers unpause. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Unpause specified container: +``` +podman unpause mywebserver +``` + +Unpause container by a partial container ID: +``` +podman unpause 860a4b23 +``` + +Unpause all **paused** containers: +``` +podman unpause --all +``` + +Unpause container using ID specified in given files: +``` +podman unpause --cidfile /home/user/cidfile-1 +podman unpause --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +Unpause the latest container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman unpause --latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pause(1)](podman-pause.1.md)** + +## HISTORY +September 2017, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-unshare.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-unshare.1.md new file mode 100644 index 000000000..fc2b67b2b --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-unshare.1.md @@ -0,0 +1,114 @@ +--- +title: podman-unshare +version: v5.5.0 +--- + +% podman-unshare 1 + +## NAME +podman\-unshare - Run a command inside of a modified user namespace + +## SYNOPSIS +**podman unshare** [*options*] [*command*] + +## DESCRIPTION +Launches a process (by default, *$SHELL*) in a new user namespace. The user +namespace is configured so that the invoking user's UID and primary GID appear +to be UID 0 and GID 0, respectively. Any ranges which match that user and +group in `/etc/subuid` and `/etc/subgid` are also mapped in as themselves with the +help of the *newuidmap(1)* and *newgidmap(1)* helpers. + +**podman unshare** is useful for troubleshooting unprivileged operations and for +manually clearing storage and other data related to images and containers. + +It is also useful to use the **podman mount** command. If an unprivileged user wants to mount and work with a container, then they need to execute +**podman unshare**. Executing **podman mount** fails for unprivileged users unless the user is running inside a **podman unshare** session. + +The unshare session defines two environment variables: + +- **CONTAINERS_GRAPHROOT**: the path to the persistent container's data. +- **CONTAINERS_RUNROOT**: the path to the volatile container's data. + +*IMPORTANT: This command is not available with the remote Podman client.* + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--rootless-netns** + +Join the rootless network namespace used for netavark networking. It can be used to +connect to a rootless container via IP address (bridge networking). This is otherwise +not possible from the host network namespace. + +## Exit Codes + +The exit code from `podman unshare` gives information about why the container +failed to run or why it exited. When `podman unshare` commands exit with a non-zero code, +the exit codes follow the `chroot` standard, see below: + + **125** The error is with podman **_itself_** + + $ podman unshare --foo; echo $? + Error: unknown flag: --foo + 125 + + **126** Executing a _contained command_ and the _command_ cannot be invoked + + $ podman unshare /etc; echo $? + Error: fork/exec /etc: permission denied + 126 + + **127** Executing a _contained command_ and the _command_ cannot be found + + $ podman unshare foo; echo $? + Error: fork/exec /usr/bin/bogus: no such file or directory + 127 + + **Exit code** _contained command_ exit code + + $ podman unshare /bin/sh -c 'exit 3'; echo $? + 3 + +## EXAMPLE + +Execute specified command in rootless user namespace: +``` +$ podman unshare id +uid=0(root) gid=0(root) groups=0(root),65534(nobody) +``` + +Show user namespace mappings for rootless containers: +``` +$ podman unshare cat /proc/self/uid_map /proc/self/gid_map + 0 1000 1 + 1 10000 65536 + 0 1000 1 + 1 10000 65536 +``` + + +Show rootless netns information in user namespace for rootless containers: +``` +$ podman unshare --rootless-netns ip addr +1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 + link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 + inet 127.0.0.1/8 scope host lo + valid_lft forever preferred_lft forever + inet6 ::1/128 scope host + valid_lft forever preferred_lft forever +2: tap0: mtu 65520 qdisc fq_codel state UNKNOWN group default qlen 1000 + link/ether aa:8c:0b:73:98:f6 brd ff:ff:ff:ff:ff:ff + inet 10.0.2.100/24 brd 10.0.2.255 scope global tap0 + valid_lft forever preferred_lft forever + inet6 fd00::a88c:bff:fe73:98f6/64 scope global dynamic mngtmpaddr + valid_lft 86389sec preferred_lft 14389sec + inet6 fe80::a88c:bff:fe73:98f6/64 scope link + valid_lft forever preferred_lft forever +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-mount(1)](podman-mount.1.md)**, **namespaces(7)**, **newuidmap(1)**, **newgidmap(1)**, **user\_namespaces(7)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-untag.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-untag.1.md new file mode 100644 index 000000000..50b8e5976 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-untag.1.md @@ -0,0 +1,46 @@ +--- +title: podman-untag +version: v5.5.0 +--- + +% podman-untag 1 + +## NAME +podman\-untag - Remove one or more names from a locally-stored image + +## SYNOPSIS +**podman untag** *image* [*name*[:*tag*]...] + +**podman image untag** *image* [*name*[:*tag*]...] + +## DESCRIPTION +Remove one or more names from an image in the local storage. The image can be referred to by ID or reference. If no name is specified, all names are removed from the image. If a specified name is a short name and does not include a registry, `localhost/` is prefixed (e.g., `fedora` -> `localhost/fedora`). If a specified name does not include a tag, `:latest` is appended (e.g., `localhost/fedora` -> `localhost/fedora\\:latest`). + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Remove all tags from the specified image. +``` +$ podman untag 0e3bbc2 +``` + +Remove tag from specified image. +``` +$ podman untag imageName:latest otherImageName:latest +``` + +Remove multiple tags from the specified image. +``` +$ podman untag httpd myhttpd myregistryhost:5000/fedora/httpd\\:v2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +December 2019, Originally compiled by Sascha Grunert diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-update.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-update.1.md new file mode 100644 index 000000000..cfb07b292 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-update.1.md @@ -0,0 +1,562 @@ +--- +title: podman-update +version: v5.5.0 +--- + +% podman-update 1 + +## NAME +podman\-update - Update the configuration of a given container + +## SYNOPSIS +**podman update** [*options*] *container* + +**podman container update** [*options*] *container* + +## DESCRIPTION + +Updates the configuration of an existing container, allowing changes to resource limits and healthchecks. + +## OPTIONS + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-rt-period.md) +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-period.md) + + +[//]: # (BEGIN included file options/cpu-rt-runtime.md) +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-runtime.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpus.container.md) +#### **--cpus**=*number* + +Number of CPUs. The default is *0.0* which means no limit. This is shorthand +for **--cpu-period** and **--cpu-quota**, therefore the option cannot be specified with +**--cpu-period** or **--cpu-quota**. + +On some systems, changing the CPU limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpus.container.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-read-iops.md) +#### **--device-read-iops**=*path:rate* + +Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-iops.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + + +[//]: # (BEGIN included file options/device-write-iops.md) +#### **--device-write-iops**=*path:rate* + +Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-iops.md) + + +[//]: # (BEGIN included file options/env.update.md) +#### **--env**, **-e**=*env* + +Add a value (e.g. env=*value*) to the container. Can be used multiple times. +If the value already exists in the container, it is overridden. +To remove an environment variable from the container, use the `--unsetenv` +option. + +Note that the env updates only affect the main container process after +the next start. + +[//]: # (END included file options/env.update.md) + + +[//]: # (BEGIN included file options/health-cmd.md) +#### **--health-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set or alter a healthcheck command for a container. The command is a command to be executed inside the +container that determines the container health. The command is required for other healthcheck options +to be applied. A value of **none** disables existing healthchecks. + +Multiple options can be passed in the form of a JSON array; otherwise, the command is interpreted +as an argument to **/bin/sh -c**. + +Note: The default values are used even if healthcheck is configured in the image. + +[//]: # (END included file options/health-cmd.md) + + +[//]: # (BEGIN included file options/health-interval.md) +#### **--health-interval**=*interval* + +Set an interval for the healthchecks. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-interval.md) + +Changing this setting resets the timer. + + +[//]: # (BEGIN included file options/health-log-destination.md) +#### **--health-log-destination**=*directory_path* + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) (Default: local) + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. + +[//]: # (END included file options/health-log-destination.md) + +Warning: Changing this setting may cause the loss of previous logs. + + +[//]: # (BEGIN included file options/health-max-log-count.md) +#### **--health-max-log-count**=*number of stored logs* + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) (Default: 5 attempts) + +[//]: # (END included file options/health-max-log-count.md) + + +[//]: # (BEGIN included file options/health-max-log-size.md) +#### **--health-max-log-size**=*size of stored logs* + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) (Default: 500 characters) + +[//]: # (END included file options/health-max-log-size.md) + + +[//]: # (BEGIN included file options/health-on-failure.md) +#### **--health-on-failure**=*action* + +Action to take once the container transitions to an unhealthy state. The default is **none**. + +- **none**: Take no action. +- **kill**: Kill the container. +- **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. +- **stop**: Stop the container. + +[//]: # (END included file options/health-on-failure.md) + + +[//]: # (BEGIN included file options/health-retries.md) +#### **--health-retries**=*retries* + +The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is **3**. + +Note: This parameter can overwrite the healthcheck configuration from the image. + +[//]: # (END included file options/health-retries.md) + + +[//]: # (BEGIN included file options/health-start-period.md) +#### **--health-start-period**=*period* + +The initialization time needed for a container to bootstrap. The value can be expressed in time format like +**2m3s**. The default value is **0s**. + +Note: The health check command is executed as soon as a container is started, if the health check is successful +the container's health state will be updated to `healthy`. However, if the health check fails, the health state will +stay as `starting` until either the health check is successful or until the `--health-start-period` time is over. If the +health check command fails after the `--health-start-period` time is over, the health state will be updated to `unhealthy`. +The health check command is executed periodically based on the value of `--health-interval`. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-start-period.md) + + +[//]: # (BEGIN included file options/health-startup-cmd.md) +#### **--health-startup-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set a startup healthcheck command for a container. This command is executed inside the container and is used to gate the regular +healthcheck. When the startup command succeeds, the regular healthcheck begins and the startup healthcheck ceases. Optionally, +if the command fails for a set number of attempts, the container is restarted. A startup healthcheck can be used to ensure that +containers with an extended startup period are not marked as unhealthy until they are fully started. Startup healthchecks can only be +used when a regular healthcheck (from the container's image or the **--health-cmd** option) is also set. + +[//]: # (END included file options/health-startup-cmd.md) + + +[//]: # (BEGIN included file options/health-startup-interval.md) +#### **--health-startup-interval**=*interval* + +Set an interval for the startup healthcheck. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-startup-interval.md) + +Changing this setting resets the timer, depending on the state of the container. + + +[//]: # (BEGIN included file options/health-startup-retries.md) +#### **--health-startup-retries**=*retries* + +The number of attempts allowed before the startup healthcheck restarts the container. If set to **0**, the container is never restarted. The default is **0**. + +[//]: # (END included file options/health-startup-retries.md) + + +[//]: # (BEGIN included file options/health-startup-success.md) +#### **--health-startup-success**=*retries* + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value +of **0** means that any success begins the regular healthcheck. The default is **0**. + +[//]: # (END included file options/health-startup-success.md) + + +[//]: # (BEGIN included file options/health-startup-timeout.md) +#### **--health-startup-timeout**=*timeout* + +The maximum time a startup healthcheck command has to complete before it is marked as failed. The value can be expressed in a time +format like **2m3s**. The default value is **30s**. + +[//]: # (END included file options/health-startup-timeout.md) + + +[//]: # (BEGIN included file options/health-timeout.md) +#### **--health-timeout**=*timeout* + +The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the +value can be expressed in a time format such as **1m22s**. The default value is **30s**. + +Note: A timeout marks the healthcheck as failed but does not terminate the running process. +This ensures that a slow but eventually successful healthcheck does not disrupt the container +but is still accounted for in the health status. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-timeout.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-reservation.md) +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-reservation.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/memory-swappiness.md) +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/memory-swappiness.md) + + +[//]: # (BEGIN included file options/no-healthcheck.md) +#### **--no-healthcheck** + +Disable any defined healthchecks for container. + +[//]: # (END included file options/no-healthcheck.md) + + +[//]: # (BEGIN included file options/pids-limit.md) +#### **--pids-limit**=*limit* + +Tune the container's pids limit. Set to **-1** to have unlimited pids for the container. The default is **2048** on systems that support "pids" cgroup controller. + +[//]: # (END included file options/pids-limit.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + + +[//]: # (BEGIN included file options/unsetenv.update.md) +#### **--unsetenv**=*env* + +Unset environment variables from the container. + +Note that the env updates only affect the main container process after +the next start. + +[//]: # (END included file options/unsetenv.update.md) + + +## EXAMPLEs + +Update a container with a new cpu quota and period. +``` +podman update --cpus=5 myCtr +``` + +Update a container with all available options for cgroups v2. +``` +podman update --cpus 5 --cpuset-cpus 0 --cpu-shares 123 --cpuset-mems 0 --memory 1G --memory-swap 2G --memory-reservation 2G --blkio-weight-device /dev/zero:123 --blkio-weight 123 --device-read-bps /dev/zero:10mb --device-write-bps /dev/zero:10mb --device-read-iops /dev/zero:1000 --device-write-iops /dev/zero:1000 --pids-limit 123 ctrID +``` + +Update a container with all available options for cgroups v1. +``` +podman update --cpus 5 --cpuset-cpus 0 --cpu-shares 123 --cpuset-mems 0 --memory 1G --memory-swap 2G --memory-reservation 2G --memory-swappiness 50 --pids-limit 123 ctrID +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-create(1)](podman-create.1.md)**, **[podman-run(1)](podman-run.1.md)** + +## HISTORY +August 2022, Originally written by Charlie Doern diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-version.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-version.1.md new file mode 100644 index 000000000..05c018760 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-version.1.md @@ -0,0 +1,60 @@ +--- +title: podman-version +version: v5.5.0 +--- + +% podman-version 1 + +## NAME +podman\-version - Display the Podman version information + +## SYNOPSIS +**podman version** [*options*] + +## DESCRIPTION +Shows the following information: Remote API Version, Version, Go Version, Git Commit, Build Time, +OS, and Architecture. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change output format to "json" or a Go template. + +| **Placeholder** | **Description** | +| ------------------- | ------------------------ | +| .Client ... | Version of local podman | +| .Server ... | Version of remote podman | + +Each of the above fields branch deeper into further subfields +such as .Version, .APIVersion, .GoVersion, and more. + +## Example + +A sample output of the `version` command: +``` +$ podman version +Version: 2.0.0 +API Version: 1 +Go Version: go1.14.2 +Git Commit: 4520664f63c3a7f9a80227715359e20069d95542 +Built: Tue May 19 10:48:59 2020 +OS/Arch: linux/amd64 +``` + +Filtering out only the version: +``` +$ podman version --format '{{.Client.Version}}' +2.0.0 +``` + +#### **--help**, **-h** + +Print usage statement + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +November 2018, Added --format flag by Tomas Tomecek +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-volume-create.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-volume-create.1.md new file mode 100644 index 000000000..0bd60c82d --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-volume-create.1.md @@ -0,0 +1,213 @@ +--- +title: podman-volume-create +version: v5.5.0 +--- + +% podman-volume-create 1 + +## NAME +podman\-volume\-create - Create a new volume + +## SYNOPSIS +**podman volume create** [*options*] [*name*] + +## DESCRIPTION + +Creates an empty volume and prepares it to be used by containers. The volume +can be created with a specific name, if a name is not given a random name is +generated. You can add metadata to the volume by using the **--label** flag and +driver options can be set using the **--opt** flag. + +## OPTIONS + +#### **--driver**, **-d**=*driver* + +Specify the volume driver name (default **local**). +There are two drivers supported by Podman itself: **local** and **image**. + +The **local** driver uses a directory on disk as the backend by default, but can also use the **mount(8)** command to mount a filesystem as the volume if **--opt** is specified. + +The **image** driver uses an image as the backing store of for the volume. +An overlay filesystem is created, which allows changes to the volume to be committed as a new layer on top of the image. + +Using a value other than **local** or **image**, Podman attempts to create the volume using a volume plugin with the given name. +Such plugins must be defined in the **volume_plugins** section of the **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** configuration file. + +#### **--help** + +Print usage statement + +#### **--ignore** + +Don't fail if the named volume already exists, instead just print the name. Note that the new options are not applied to the existing volume. + +#### **--label**, **-l**=*label* + +Set metadata for a volume (e.g., --label mykey=value). + +#### **--opt**, **-o**=*option* + +Set driver specific options. +For the default driver, **local**, this allows a volume to be configured to mount a filesystem on the host. + +For the `local` driver the following options are supported: `type`, `device`, `o`, and `[no]copy`. + + - The `type` option sets the type of the filesystem to be mounted, and is equivalent to the `-t` flag to **mount(8)**. + - The `device` option sets the device to be mounted, and is equivalent to the `device` argument to **mount(8)**. + - The `copy` option enables copying files from the container image path where the mount is created to the newly created volume on the first run. `copy` is the default. + +The `o` option sets options for the mount, and is equivalent to the filesystem +options (also `-o`) passed to **mount(8)** with the following exceptions: + + - The `o` option supports `uid` and `gid` options to set the UID and GID of the created volume that are not normally supported by **mount(8)**. + - The `o` option supports the `size` option to set the maximum size of the created volume, the `inodes` option to set the maximum number of inodes for the volume, and `noquota` to completely disable quota support even for tracking of disk usage. + The `size` option is supported on the "tmpfs" and "xfs[note]" file systems. + The `inodes` option is supported on the "xfs[note]" file systems. + Note: xfs filesystems must be mounted with the `prjquota` flag described in the **xfs_quota(8)** man page. Podman will throw an error if they're not. + - The `o` option supports using volume options other than the UID/GID options with the **local** driver and requires root privileges. + - The `o` options supports the `timeout` option which allows users to set a driver specific timeout in seconds before volume creation fails. For example, **--opt=o=timeout=10** sets a driver timeout of 10 seconds. + +***Note*** Do not confuse the `--opt,-o` create option with the `-o` mount option. For example, with `podman volume create`, use `-o=o=uid=1000` *not* `-o=uid=1000`. + +For the **image** driver, the only supported option is `image`, which specifies the image the volume is based on. +This option is mandatory when using the **image** driver. + +When not using the **local** and **image** drivers, the given options are passed directly to the volume plugin. In this case, supported options are dictated by the plugin in question, not Podman. + +## EXAMPLES + +Create empty volume. +``` +$ podman volume create +``` + +Create empty named volume. +``` +$ podman volume create myvol +``` + +Create empty named volume with specified label. +``` +$ podman volume create --label foo=bar myvol +``` + +Create tmpfs named volume with specified size and mount options. +``` +# podman volume create --opt device=tmpfs --opt type=tmpfs --opt o=size=2M,nodev,noexec myvol +``` + +Create tmpfs named volume testvol with specified options. +``` +# podman volume create --opt device=tmpfs --opt type=tmpfs --opt o=uid=1000,gid=1000 testvol +``` + +Create image named volume using the specified local image in containers/storage. +``` +# podman volume create --driver image --opt image=fedora\:latest fedoraVol +``` + +## QUOTAS + +`podman volume create` uses `XFS project quota controls` for controlling the size and the number of inodes of builtin volumes. The directory used to store the volumes must be an `XFS` file system and be mounted with the `pquota` option. + +Example /etc/fstab entry: +``` +/dev/podman/podman-var /var xfs defaults,x-systemd.device-timeout=0,pquota 1 2 +``` + +Podman generates project IDs for each builtin volume, but these project IDs need to be unique for the XFS file system. These project IDs by default are generated randomly, with a potential for overlap with other quotas on the same file +system. + +The xfs_quota tool can be used to assign a project ID to the storage driver directory, e.g.: + +``` +echo 100000:/var/lib/containers/storage/overlay >> /etc/projects +echo 200000:/var/lib/containers/storage/volumes >> /etc/projects +echo storage:100000 >> /etc/projid +echo volumes:200000 >> /etc/projid +xfs_quota -x -c 'project -s storage volumes' / +``` + +In the example above we are configuring the overlay storage driver for newly +created containers as well as volumes to use project IDs with a **start offset**. +All containers are assigned larger project IDs (e.g. >= 100000). +All volume assigned project IDs larger project IDs starting with 200000. +This prevents xfs_quota management conflicts with containers/storage. + +## MOUNT EXAMPLES + +`podman volume create` allows the `type`, `device`, and `o` options to be passed to `mount(8)` when using the `local` driver. + +## [s3fs-fuse](https://github.com/s3fs-fuse/s3fs-fuse) + +[s3fs-fuse](https://github.com/s3fs-fuse/s3fs-fuse) or just `s3fs`, is a [fuse](https://github.com/libfuse/libfuse) filesystem that allows s3 prefixes to be mounted as filesystem mounts. + +**Installing:** +```shell +$ doas dnf install s3fs-fuse +``` + +**Simple usage:** +```shell +$ s3fs --help +$ s3fs -o use_xattr,endpoint=aq-central-1 bucket:/prefix /mnt +``` + +**Equivalent through `mount(8)`** +```shell +$ mount -t fuse.s3fs -o use_xattr,endpoint=aq-central-1 bucket:/prefix /mnt +``` + +**Equivalent through `podman volume create`** +```shell +$ podman volume create s3fs-fuse-volume -o type=fuse.s3fs -o device=bucket:/prefix -o o=use_xattr,endpoint=aq-central-1 +``` + +**The volume can then be mounted in a container with** +```shell +$ podman run -v s3fs-fuse-volume:/s3:z --rm -it fedora:latest +``` + +Please see the available [options](https://github.com/s3fs-fuse/s3fs-fuse/wiki/Fuse-Over-Amazon#options) on their wiki. + +### Using with other container users + +The above example works because the volume is mounted as the host user and inside the container `root` is mapped to the user in the host. + +If the mount is accessed by a different user inside the container, a "Permission denied" error will be raised. + +```shell +$ podman run --user bin:bin -v s3fs-fuse-volume:/s3:z,U --rm -it fedora:latest +$ ls /s3 +# ls: /s3: Permission denied +``` + +In FUSE-land, mounts are protected for the user who mounted them; specify the `allow_other` mount option if other users need access. +> Note: This will remove the normal fuse [security measures](https://github.com/libfuse/libfuse/wiki/FAQ#why-dont-other-users-have-access-to-the-mounted-filesystem) on the mount point, after which, the normal filesystem permissions will have to protect it + +```shell +$ podman volume create s3fs-fuse-other-volume -o type=fuse.s3fs -o device=bucket:/prefix -o o=allow_other,use_xattr,endpoint=aq-central-1 +$ podman run --user bin:bin -v s3fs-fuse-volume:/s3:z,U --rm -it fedora\:latest +$ ls /s3 +``` + +### The Prefix must exist + +`s3fs` will fail to mount if the prefix does not exist in the bucket. + +Create a s3-directory by putting an empty object at the desired `prefix/` key +```shell +$ aws s3api put-object --bucket bucket --key prefix/ +``` + +If performance is the priority, please check out the more performant [goofys](https://github.com/kahing/goofys). + +> FUSE filesystems exist for [Google Cloud Storage](https://github.com/GoogleCloudPlatform/gcsfuse) and [Azure Blob Storage](https://github.com/Azure/azure-storage-fuse) + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[podman-volume(1)](podman-volume.1.md)**, **mount(8)**, **xfs_quota(8)**, **xfs_quota(8)**, **projects(5)**, **projid(5)** + +## HISTORY +January 2020, updated with information on volume plugins by Matthew Heon +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-volume-exists.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-volume-exists.1.md new file mode 100644 index 000000000..58215cc0d --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-volume-exists.1.md @@ -0,0 +1,48 @@ +--- +title: podman-volume-exists +version: v5.5.0 +--- + +% podman-volume-exists 1 + +## NAME +podman\-volume\-exists - Check if the given volume exists + +## SYNOPSIS +**podman volume exists** *volume* + +## DESCRIPTION +**podman volume exists** checks if a volume exists. Podman returns an exit code +of `0` when the volume is found. A `1` is returned otherwise. An exit code of +`125` indicates there was another issue. + + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLE + +Check if a volume called `myvol` exists (the volume does actually exist). +``` +$ podman volume exists myvol +$ echo $? +0 +$ +``` + +Check if a volume called `mysql` exists (the volume does not actually exist). +``` +$ podman volume exists mysql +$ echo $? +1 +$ +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** + +## HISTORY +January 2021, Originally compiled by Paul Holzinger `` diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-volume-export.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-volume-export.1.md new file mode 100644 index 000000000..6a4a5f594 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-volume-export.1.md @@ -0,0 +1,43 @@ +--- +title: podman-volume-export +version: v5.5.0 +--- + +% podman-volume-export 1 + +## NAME +podman\-volume\-export - Export volume to external tar + +## SYNOPSIS +**podman volume export** [*options*] *volume* + +## DESCRIPTION + +**podman volume export** exports the contents of a podman volume and saves it as a tarball +on the local machine. **podman volume export** writes to STDOUT by default and can be +redirected to a file using the `--output` flag. + +Note: Following command is not supported by podman-remote. + +**podman volume export [OPTIONS] VOLUME** + +## OPTIONS + +#### **--help** + +Print usage statement + +#### **--output**, **-o**=*file* + +Write to a file, default is STDOUT + +## EXAMPLES + +Export named volume content into the specified file. +``` +$ podman volume export myvol --output myvol.tar + +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-volume-import(1)](podman-volume-import.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-volume-import.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-volume-import.1.md new file mode 100644 index 000000000..7ee9ac3e1 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-volume-import.1.md @@ -0,0 +1,46 @@ +--- +title: podman-volume-import +version: v5.5.0 +--- + +% podman-volume-import 1 + +## NAME +podman\-volume\-import - Import tarball contents into an existing podman volume + +## SYNOPSIS +**podman volume import** *volume* [*source*] + +## DESCRIPTION + +**podman volume import** imports the contents of a tarball into the podman volume's mount point. +The contents of the volume is merged with the content of the tarball with the latter taking precedence. +**podman volume import** can consume piped input when using `-` as source path. + +The given volume must already exist and is not created by podman volume import. + +Note: Following command is not supported by podman-remote. + +#### **--help** + +Print usage statement + +## EXAMPLES + +Import named volume content from the specified file. +``` +$ podman volume import myvol test.tar +``` + +Import named volume content from stdin. +``` +$ gunzip -c hello.tar.gz | podman volume import myvol - +``` + +Export the content from named volume and pipe it into the named volume via stdin. +``` +$ podman volume export oldmyvol | podman volume import myvol - +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-volume-export(1)](podman-volume-export.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-volume-inspect.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-volume-inspect.1.md new file mode 100644 index 000000000..6ea71c0b8 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-volume-inspect.1.md @@ -0,0 +1,109 @@ +--- +title: podman-volume-inspect +version: v5.5.0 +--- + +% podman-volume-inspect 1 + +## NAME +podman\-volume\-inspect - Get detailed information on one or more volumes + +## SYNOPSIS +**podman volume inspect** [*options*] *volume* [...] + +## DESCRIPTION + +Display detailed information on one or more volumes. The output can be formatted using +the **--format** flag and a Go template. To get detailed information about all the +existing volumes, use the **--all** flag. +Volumes can be queried individually by providing their full name or a unique partial name. + + +## OPTIONS + +#### **--all**, **-a** + +Inspect all volumes. + +#### **--format**, **-f**=*format* + +Format volume output using Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------- | --------------------------------------------------------------------------- | +| .Anonymous | Indicates whether volume is anonymous | +| .CreatedAt ... | Volume creation time | +| .Driver | Volume driver | +| .GID | GID the volume was created with | +| .Labels ... | Label information associated with the volume | +| .LockNumber | Number of the volume's Libpod lock | +| .MountCount | Number of times the volume is mounted | +| .Mountpoint | Source of volume mount point | +| .Name | Volume name | +| .NeedsChown | Indicates volume will be chowned on next use | +| .NeedsCopyUp | Indicates data at the destination will be copied into the volume on next use| +| .Options ... | Volume options | +| .Scope | Volume scope | +| .Status ... | Status of the volume | +| .StorageID | StorageID of the volume | +| .Timeout | Timeout of the volume | +| .UID | UID the volume was created with | + +#### **--help** + +Print usage statement + + +## EXAMPLES + +Inspect named volume. +``` +$ podman volume inspect myvol +[ + { + "Name": "myvol", + "Driver": "local", + "Mountpoint": "/home/myusername/.local/share/containers/storage/volumes/myvol/_data", + "CreatedAt": "2023-03-13T16:26:48.423069028-04:00", + "Labels": {}, + "Scope": "local", + "Options": {}, + "MountCount": 0, + "NeedsCopyUp": true, + "NeedsChown": true + } +] +``` + +Inspect all volumes. +``` +$ podman volume inspect --all +[ + { + "Name": "myvol", + "Driver": "local", + "Mountpoint": "/home/myusername/.local/share/containers/storage/volumes/myvol/_data", + "CreatedAt": "2023-03-13T16:26:48.423069028-04:00", + "Labels": {}, + "Scope": "local", + "Options": {}, + "MountCount": 0, + "NeedsCopyUp": true, + "NeedsChown": true + } +] +``` + +Inspect named volume and display its Driver and Scope field. +``` +$ podman volume inspect --format "{{.Driver}} {{.Scope}}" myvol +local local +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-volume-ls.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-volume-ls.1.md new file mode 100644 index 000000000..f5854e267 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-volume-ls.1.md @@ -0,0 +1,117 @@ +--- +title: podman-volume-ls +version: v5.5.0 +--- + +% podman-volume-ls 1 + +## NAME +podman\-volume\-ls - List all the available volumes + +## SYNOPSIS +**podman volume ls** [*options*] + +## DESCRIPTION + +Lists all the volumes that exist. The output can be filtered using the **--filter** +flag and can be formatted to either JSON or a Go template using the **--format** +flag. Use the **--quiet** flag to print only the volume names. + +## OPTIONS + +#### **--filter**, **-f**=*filter* + +Filter what volumes are shown in the output. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive, with the only exception being `label` +which is exclusive. Filters with different keys always work exclusive. + +Volumes can be filtered by the following attributes: + +| **Filter** | **Description** | +| ---------- | ------------------------------------------------------------------------------------- | +| dangling | [Dangling] Matches all volumes not referenced by any containers | +| driver | [Driver] Matches volumes based on their driver | +| label | [Key] or [Key=Value] Label assigned to a volume | +| name | [Name] Volume name (accepts regex) | +| opt | Matches a storage driver options | +| scope | Filters volume by scope | +| after/since | Filter by volumes created after the given VOLUME (name or tag) | +| until | Only remove volumes created before given timestamp | + +#### **--format**=*format* + +Format volume output using Go template. + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------------- | -------------------------------------------- | +| .Anonymous | Indicates whether volume is anonymous | +| .CreatedAt ... | Volume creation time | +| .Driver | Volume driver | +| .GID | GID of volume | +| .InspectVolumeData ... | Don't use | +| .Labels ... | Label information associated with the volume | +| .LockNumber | Number of the volume's Libpod lock | +| .MountCount | Number of times the volume is mounted | +| .Mountpoint | Source of volume mount point | +| .Name | Volume name | +| .NeedsChown | Indicates whether volume needs to be chowned | +| .NeedsCopyUp | Indicates if volume needs to be copied up to | +| .Options ... | Volume options | +| .Scope | Volume scope | +| .Status ... | Status of the volume | +| .StorageID | StorageID of the volume | +| .Timeout | Timeout of the volume | +| .UID | UID of volume | +| .VolumeConfigResponse ... | Don't use | + +#### **--help** + +Print usage statement. + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Print volume output in quiet mode. Only print the volume names. + +## EXAMPLES + +List all volumes. +``` +$ podman volume ls +``` + +List all volumes and display content as json format. +``` +$ podman volume ls --format json +``` + +List all volumes and display their Driver and Scope fields +``` +$ podman volume ls --format "{{.Driver}} {{.Scope}}" +``` + +List volumes with the name foo and label blue. +``` +$ podman volume ls --filter name=foo,label=blue +``` + +List volumes with the label key=value. +``` +$ podman volume ls --filter label=key=value +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-volume-mount.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-volume-mount.1.md new file mode 100644 index 000000000..4e7dd5bad --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-volume-mount.1.md @@ -0,0 +1,41 @@ +--- +title: podman-volume-mount +version: v5.5.0 +--- + +% podman-volume-mount 1 + +## NAME +podman\-volume\-mount - Mount a volume filesystem + +## SYNOPSIS +**podman volume mount** [*volume* ...] + +## DESCRIPTION +Mounts the specified volumes' file system in a location which can be +accessed from the host, and returns its location. + +Rootless mode only supports mounting file volumes unless Podman is run within the user namespace +via the `podman unshare` command. All other volume types fail to mount. + +## RETURN VALUE +The location of the mounted file system. On error an empty string and errno is +returned. + +## EXAMPLE + +Mount specified volume. As Root: +``` +# podman volume mount foo +/home/dwalsh/.local/share/containers/storage/volumes/foo/_data +``` + +In rootless mode, volume mounting only works after executing the podman unshare command to enter the user namespace. +``` +$ podman unshare +# podman volume mount foo +/home/dwalsh/.local/share/containers/storage/volumes/foo/_data +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-volume-unmount(1)](podman-volume-unmount.1.md)**, **[podman-unshare(1)](podman-unshare.1.md)**, **mount(8)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-volume-prune.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-volume-prune.1.md new file mode 100644 index 000000000..3c2bb697d --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-volume-prune.1.md @@ -0,0 +1,77 @@ +--- +title: podman-volume-prune +version: v5.5.0 +--- + +% podman-volume-prune 1 + +## NAME +podman\-volume\-prune - Remove all unused volumes + +## SYNOPSIS +**podman volume prune** [*options*] + +## DESCRIPTION + +Removes unused volumes. By default all unused volumes are removed, the **--filter** flag can +be used to filter specific volumes. Users are prompted to confirm the removal of all the +unused volumes. To bypass the confirmation, use the **--force** flag. + + +## OPTIONS + +#### **--filter** + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:-----------:|------------------------------------------------------------------------------------------------------------| +| dangling | [Bool] Only remove volumes not referenced by any containers | +| driver | [String] Only remove volumes with the given driver | +| label | [String] Only remove volumes, with (or without, in the case of label!=[...] is used) the specified labels. | +| name | [String] Only remove volume with the given name | +| opt | [String] Only remove volumes created with the given options | +| scope | [String] Only remove volumes with the given scope | +| until | [DateTime] Only remove volumes created before given timestamp. | +| after/since | [Volume] Filter by volumes created after the given VOLUME (name or tag) | + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes volumes with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes volumes without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not prompt for confirmation. + +#### **--help** + +Print usage statement + + +## EXAMPLES + + +Prune all unused volumes. +``` +$ podman volume prune +``` + +Prune all volumes. Note: this command will also remove all containers that are using a volume. +``` +$ podman volume prune --force +``` + +Prune all volumes that contain the specified label. +``` +$ podman volume prune --filter label=mylabel=mylabelvalue +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-volume-reload.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-volume-reload.1.md new file mode 100644 index 000000000..1d1a2f3c7 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-volume-reload.1.md @@ -0,0 +1,35 @@ +--- +title: podman-volume-reload +version: v5.5.0 +--- + +% podman-volume-reload 1 + +## NAME +podman\-volume\-reload - Reload all volumes from volumes plugins + +## SYNOPSIS +**podman volume reload** + +## DESCRIPTION + +**podman volume reload** checks all configured volume plugins and updates the libpod database with all available volumes. +Existing volumes are also removed from the database when they are no longer present in the plugin. + +This command it is best effort and cannot guarantee a perfect state because plugins can be modified from the outside at any time. + +Note: This command is not supported with podman-remote. + +## EXAMPLES + +Reload the volume plugins. +``` +$ podman volume reload +Added: +vol6 +Removed: +t3 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-volume-rm.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-volume-rm.1.md new file mode 100644 index 000000000..e03ce86ea --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-volume-rm.1.md @@ -0,0 +1,70 @@ +--- +title: podman-volume-rm +version: v5.5.0 +--- + +% podman-volume-rm 1 + +## NAME +podman\-volume\-rm - Remove one or more volumes + +## SYNOPSIS +**podman volume rm** [*options*] *volume* [...] + +## DESCRIPTION + +Removes one or more volumes. Only volumes that are not being used are removed. +If a volume is being used by a container, an error is returned unless the **--force** +flag is being used. To remove all volumes, use the **--all** flag. +Volumes can be removed individually by providing their full name or a unique partial name. + +## OPTIONS + +#### **--all**, **-a** + +Remove all volumes. + +#### **--force**, **-f** + +Remove a volume by force. +If it is being used by containers, the containers are removed first. + +#### **--help** + +Print usage statement + +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping running containers that are using the specified volume. The --force option must be specified to use the --time option. Use -1 for infinite wait. + +## EXAMPLES + +Remove multiple specified volumes. +``` +$ podman volume rm myvol1 myvol2 +``` + +Remove all volumes. +``` +$ podman volume rm --all +``` + +Remove the specified volume even if it is in use. Note, this removes all containers using the volume. +``` +$ podman volume rm --force myvol +``` + +## Exit Status + **0** All specified volumes removed + + **1** One of the specified volumes did not exist, and no other failures + + **2** One of the specified volumes is being used by a container + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-volume-unmount.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-volume-unmount.1.md new file mode 100644 index 000000000..25c75821e --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-volume-unmount.1.md @@ -0,0 +1,37 @@ +--- +title: podman-volume-unmount +version: v5.5.0 +--- + +% podman-volume-unmount 1 + +## NAME +podman\-volume\-unmount - Unmount a volume + +## SYNOPSIS +**podman volume unmount** *volume* [...] + +**podman volume umount** *volume* [...] + +## DESCRIPTION +Unmounts the specified volume, if there are no other containers +using it. + +Volume storage increments a mount counter each time a volume is mounted. +When a volume is unmounted, the mount counter is decremented, and the +volume's filesystem is physically unmounted only when the mount +counter reaches zero indicating no other processes are using the mount. + +## EXAMPLE + +Unmount volume with a given ID: +``` +podman volume unmount volumeID +``` + +Unmount multiple volumes with given IDs: +``` +podman volume unmount volumeID1 volumeID2 volumeID3 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-volume-mount(1)](podman-volume-mount.1.md)** diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-volume.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-volume.1.md new file mode 100644 index 000000000..731778c78 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-volume.1.md @@ -0,0 +1,37 @@ +--- +title: podman-volume +version: v5.5.0 +--- + +% podman-volume 1 + +## NAME +podman\-volume - Simple management tool for volumes + +## SYNOPSIS +**podman volume** *subcommand* + +## DESCRIPTION +podman volume is a set of subcommands that manage volumes. + +## SUBCOMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------------ | ------------------------------------------------------------------------------ | +| create | [podman-volume-create(1)](podman-volume-create.1.md) | Create a new volume. | +| exists | [podman-volume-exists(1)](podman-volume-exists.1.md) | Check if the given volume exists. | +| export | [podman-volume-export(1)](podman-volume-export.1.md) | Export volume to external tar. | +| import | [podman-volume-import(1)](podman-volume-import.1.md) | Import tarball contents into an existing podman volume. | +| inspect | [podman-volume-inspect(1)](podman-volume-inspect.1.md) | Get detailed information on one or more volumes. | +| ls | [podman-volume-ls(1)](podman-volume-ls.1.md) | List all the available volumes. | +| mount | [podman-volume-mount(1)](podman-volume-mount.1.md) | Mount a volume filesystem. | +| prune | [podman-volume-prune(1)](podman-volume-prune.1.md) | Remove all unused volumes. | +| reload | [podman-volume-reload(1)](podman-volume-reload.1.md) | Reload all volumes from volumes plugins. | +| rm | [podman-volume-rm(1)](podman-volume-rm.1.md) | Remove one or more volumes. | +| unmount | [podman-volume-unmount(1)](podman-volume-unmount.1.md) | Unmount a volume. | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.0/source/markdown/podman-wait.1.md b/versioned_docs/version-5.5.0/source/markdown/podman-wait.1.md new file mode 100644 index 000000000..cdcceaf0b --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman-wait.1.md @@ -0,0 +1,103 @@ +--- +title: podman-wait +version: v5.5.0 +--- + +% podman-wait 1 + +## NAME +podman\-wait - Wait on one or more containers to stop and print their exit codes + +## SYNOPSIS +**podman wait** [*options*] *container* [...] + +**podman container wait** [*options*] *container* [...] + +## DESCRIPTION +Waits on one or more containers to stop. The container can be referred to by its +name or ID. In the case of multiple containers, Podman waits on each consecutively. +After all conditions are satisfied, the containers' return codes are printed +separated by newline in the same order as they were given to the command. An +exit code of -1 is emitted for all conditions other than "stopped" and +"exited". + +When waiting for containers with a restart policy of `always` or `on-failure`, +such as those created by `podman kube play`, the containers may be repeatedly +exiting and restarting, possibly with different exit codes. `podman wait` will +only display and detect the first exit after the wait command was started. + +When running a container with podman run --rm wait does not wait for the +container to be fully removed. To wait for the removal of a container use +`--condition=removing`. + +## OPTIONS + +#### **--condition**=*state* +Container state or condition to wait for. Can be specified multiple times where at least one condition must match for the command to return. Supported values are "configured", "created", "exited", "healthy", "initialized", "paused", "removing", "running", "stopped", "stopping", "unhealthy". The default condition is "stopped". + +#### **--help**, **-h** + + Print usage statement + + +#### **--ignore** +Ignore errors when a specified container is missing and mark its return code as -1. + +#### **--interval**, **-i**=*duration* + Time interval to wait before polling for completion. A duration string is a sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". Time unit defaults to "ms". + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLES + +Wait for the specified container to exit. +``` +$ podman wait mywebserver +0 +``` + +Wait for the latest container to exit. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman wait --latest +0 +``` + +Wait for the container to exit, checking every two seconds. +``` +$ podman wait --interval 2s mywebserver +0 +``` + +Wait for the container by ID. This container exits with error status 1: +``` +$ podman wait 860a4b23 +1 +``` + +Wait for both specified containers to exit. +``` +$ podman wait mywebserver myftpserver +0 +125 +``` + +Wait for the named container to exit, but do not fail if the container does not exist. +``` +$ podman wait --ignore does-not-exist +-1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +September 2017, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.0/source/markdown/podman.1.md b/versioned_docs/version-5.5.0/source/markdown/podman.1.md new file mode 100644 index 000000000..94a493a11 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podman.1.md @@ -0,0 +1,491 @@ +--- +title: podman +version: v5.5.0 +--- + +% podman 1 + +## NAME +podman - Simple management tool for pods, containers and images + +## SYNOPSIS +**podman** [*options*] *command* + +## DESCRIPTION +Podman (Pod Manager) is a fully featured container engine that is a simple daemonless tool. +Podman provides a Docker-CLI comparable command line that eases the transition from other +container engines and allows the management of pods, containers and images. Simply put: `alias docker=podman`. +Most Podman commands can be run as a regular user, without requiring additional +privileges. + +Podman uses Buildah(1) internally to create container images. Both tools share image +(not container) storage, hence each can use or manipulate images (but not containers) +created by the other. + +Default settings for flags are defined in `containers.conf`. Most settings for +Remote connections use the server's containers.conf, except when documented in +man pages. + +**podman [GLOBAL OPTIONS]** + +## GLOBAL OPTIONS + +#### **--cdi-spec-dir**=*path* + +The CDI spec directory path (may be set multiple times). Default path is `/etc/cdi`. + +#### **--cgroup-manager**=*manager* + +The CGroup manager to use for container cgroups. Supported values are __cgroupfs__ or __systemd__. Default is _systemd_ unless overridden in the containers.conf file. + +Note: Setting this flag can cause certain commands to break when called on containers previously created by the other CGroup manager type. +Note: CGroup manager is not supported in rootless mode when using CGroups Version V1. + +#### **--config** +Location of config file. Mainly for docker compatibility, only the authentication parts of the config are supported. + +#### **--conmon** +Path of the conmon binary (Default path is configured in `containers.conf`) + +#### **--connection**, **-c** +Connection to use for remote podman, including Mac and Windows (excluding WSL2) machines, (Default connection is configured in `containers.conf`) +Setting this option switches the **--remote** option to true. +Remote connections use local containers.conf for default. + +#### **--events-backend**=*type* + +Backend to use for storing events. Allowed values are **file**, **journald**, and +**none**. When *file* is specified, the events are stored under +`/events/events.log` (see **--tmpdir** below). + +#### **--help**, **-h** + +Print usage statement + +#### **--hooks-dir**=*path* + +Each `*.json` file in the path configures a hook for Podman containers. For more details on the syntax of the JSON files and the semantics of hook injection, see `oci-hooks(5)`. Podman and libpod currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. + +This option may be set multiple times; paths from later options have higher precedence (`oci-hooks(5)` discusses directory precedence). + +For the annotation conditions, libpod uses any annotations set in the generated OCI configuration. + +For the bind-mount conditions, only mounts explicitly requested by the caller via `--volume` are considered. Bind mounts that libpod inserts by default (e.g. `/dev/shm`) are not considered. + +If `--hooks-dir` is unset for root callers, Podman and libpod currently default to `/usr/share/containers/oci/hooks.d` and `/etc/containers/oci/hooks.d` in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting `--hooks-dir`. + +Podman and libpod currently support an additional `precreate` state which is called before the runtime's `create` operation. Unlike the other stages, which receive the container state on their standard input, `precreate` hooks receive the proposed runtime configuration on their standard input. They may alter that configuration as they see fit, and write the altered form to their standard output. + +**WARNING**: the `precreate` hook allows powerful changes to occur, such as adding additional mounts to the runtime configuration. That power also makes it easy to break things. Before reporting libpod errors, try running a container with `precreate` hooks disabled to see if the problem is due to one of the hooks. + +#### **--identity**=*path* + +Path to ssh identity file. If the identity file has been encrypted, podman prompts the user for the passphrase. +If no identity file is provided and no user is given, podman defaults to the user running the podman command. +Podman prompts for the login password on the remote server. + +Identity value resolution precedence: + - command line value + - environment variable `CONTAINER_SSHKEY`, if `CONTAINER_HOST` is found + - `containers.conf` +Remote connections use local containers.conf for default. + +#### **--imagestore**=*path* + +Path of the imagestore where images are stored. By default, the storage library stores all the images in the graphroot but if an imagestore is provided, then the storage library will store newly pulled images in the provided imagestore and keep using the graphroot for everything else. If the user is using the overlay driver, then the images which were already part of the graphroot will still be accessible. + +This will override *imagestore* option in `containers-storage.conf(5)`, refer to `containers-storage.conf(5)` for more details. + +#### **--log-level**=*level* + +Log messages at and above specified level: __debug__, __info__, __warn__, __error__, __fatal__ or __panic__ (default: _warn_) + +#### **--module**=*path* + +Load the specified `containers.conf(5)` module. Can be an absolute or relative path. Please refer to `containers.conf(5)` for details. + +This flag is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. +Further note that the flag is a root-level flag and must be specified before any Podman sub-command. + +#### **--network-cmd-path**=*path* +Path to the `slirp4netns(1)` command binary to use for setting up a slirp4netns network. +If "" is used, then the binary will first be searched using the `helper_binaries_dir` option in `containers.conf`, and second using the `$PATH` environment variable. +**Note:** This option is deprecated and will be removed with Podman 6.0. Use the `helper_binaries_dir` option in `containers.conf` instead. + +#### **--network-config-dir**=*directory* + +Path to the directory where network configuration files are located. +For the netavark backend "/etc/containers/networks" is used as root +and "$graphroot/networks" as rootless. +For the CNI backend the default is "/etc/cni/net.d" as root +and "$HOME/.config/cni/net.d" as rootless. +CNI is deprecated and will be removed in the next major Podman version 5.0 in preference of Netavark. + +#### **--out**=*path* +Redirect the output of podman to the specified path without affecting the container output or its logs. This parameter can be used to capture the output from any of podman's commands directly into a file and enable suppression of podman's output by specifying /dev/null as the path. To explicitly disable the container logging, the **--log-driver** option should be used. + +#### **--remote**, **-r** +When true, access to the Podman service is remote. Defaults to false. +Settings can be modified in the containers.conf file. If the CONTAINER_HOST +environment variable is set, the **--remote** option defaults to true. + +#### **--root**=*value* + +Storage root dir in which data, including images, is stored (default: "/var/lib/containers/storage" for UID 0, "$HOME/.local/share/containers/storage" for other users). +Default root dir configured in `containers-storage.conf(5)`. + +Overriding this option causes the *storage-opt* settings in `containers-storage.conf(5)` to be ignored. The user must specify additional options via the `--storage-opt` flag. + +#### **--runroot**=*value* + +Storage state directory where all state information is stored (default: "/run/containers/storage" for UID 0, "/run/user/$UID/run" for other users). +Default state dir configured in `containers-storage.conf(5)`. + +#### **--runtime**=*value* + +Name of the OCI runtime as specified in containers.conf or absolute path to the OCI compatible binary used to run containers. + +#### **--runtime-flag**=*flag* + +Adds global flags for the container runtime. To list the supported flags, please +consult the manpages of the selected container runtime (`runc` is the default +runtime, the manpage to consult is `runc(8)`. When the machine is configured +for cgroup V2, the default runtime is `crun`, the manpage to consult is `crun(8)`.). + +Note: Do not pass the leading `--` to the flag. To pass the runc flag `--log-format json` +to podman build, the option given can be `--runtime-flag log-format=json`. + + +#### **--ssh**=*value* + +This option allows the user to change the ssh mode, meaning that rather than using the default **golang** mode, one can instead use **--ssh=native** +to use the installed ssh binary and config file declared in containers.conf. + +#### **--storage-driver**=*value* + +Storage driver. The default storage driver for UID 0 is configured in `containers-storage.conf(5)` in rootless mode), and is *vfs* for non-root users when *fuse-overlayfs* is not available. The `STORAGE_DRIVER` environment variable overrides the default. The --storage-driver specified driver overrides all. + +Overriding this option causes the *storage-opt* settings in `containers-storage.conf(5)` to be ignored. The user must +specify additional options via the `--storage-opt` flag. + +#### **--storage-opt**=*value* + +Specify a storage driver option. Default storage driver options are configured in `containers-storage.conf(5)`. The `STORAGE_OPTS` environment variable overrides the default. The --storage-opt specified options override all. Specify --storage-opt="" so no storage options is used. + +#### **--syslog** + +Output logging information to syslog as well as the console (default *false*). + +On remote clients, including Mac and Windows (excluding WSL2) machines, logging is directed to the file $HOME/.config/containers/podman.log. + +#### **--tmpdir**=*path* + +Path to the tmp directory, for libpod runtime content. Defaults to `$XDG_RUNTIME_DIR/libpod/tmp` as rootless and `/run/libpod/tmp` as rootful. + +NOTE --tmpdir is not used for the temporary storage of downloaded images. Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + +#### **--transient-store** + +Enables a global transient storage mode where all container metadata is stored on non-persistent media (i.e. in the location specified by `--runroot`). +This mode allows starting containers faster, as well as guaranteeing a fresh state on boot in case of unclean shutdowns or other problems. However +it is not compatible with a traditional model where containers persist across reboots. + +Default value for this is configured in `containers-storage.conf(5)`. + +#### **--url**=*value* +URL to access Podman service (default from `containers.conf`, rootless `unix:///run/user/$UID/podman/podman.sock` or as root `unix:///run/podman/podman.sock`). +Setting this option switches the **--remote** option to true. + + - `CONTAINER_HOST` is of the format `://[]@][:][]` + +Details: + - `schema` is one of: + * `ssh` (default): a local unix(7) socket on the named `host` and `port`, reachable via SSH + * `tcp`: an unencrypted, unauthenticated TCP connection to the named `host` and `port` + * `unix`: a local unix(7) socket at the specified `path`, or the default for the user + - `user` defaults to either `root` or the current running user (`ssh` only) + - `password` has no default (`ssh` only) + - `host` must be provided and is either the IP or name of the machine hosting the Podman service (`ssh` and `tcp`) + - `port` defaults to 22 (`ssh` and `tcp`) + - `path` defaults to either `/run/podman/podman.sock`, or `/run/user/$UID/podman/podman.sock` if running rootless (`unix`), or must be explicitly specified (`ssh`) + +URL value resolution precedence: + - command line value + - environment variable `CONTAINER_HOST` + - `engine.service_destinations` table in containers.conf, excluding the /usr/share/containers directory + - `unix:///run/podman/podman.sock` + +Remote connections use local containers.conf for default. + +Some example URL values in valid formats: + - `unix:///run/podman/podman.sock` + - `unix:///run/user/$UID/podman/podman.sock` + - `ssh://notroot@localhost:22/run/user/$UID/podman/podman.sock` + - `ssh://root@localhost:22/run/podman/podman.sock` + - `tcp://localhost:34451` + - `tcp://127.0.0.1:34451` + +#### **--version**, **-v** + +Print the version + +#### **--volumepath**=*value* + +Volume directory where builtin volume information is stored (default: "/var/lib/containers/storage/volumes" for UID 0, "$HOME/.local/share/containers/storage/volumes" for other users). Default volume path can be overridden in `containers.conf`. + +## Environment Variables + +Podman can set up environment variables from env of [engine] table in containers.conf. These variables can be overridden by passing environment variables before the `podman` commands. + +#### **CONTAINERS_CONF** + +Set default locations of containers.conf file + +#### **CONTAINERS_REGISTRIES_CONF** + +Set default location of the registries.conf file. + +#### **CONTAINERS_STORAGE_CONF** + +Set default location of the storage.conf file. + +#### **CONTAINER_CONNECTION** + +Override default `--connection` value to access Podman service. Automatically enables the --remote option. + +#### **CONTAINER_HOST** + +Set default `--url` value to access Podman service. Automatically enables --remote option. + +#### **CONTAINER_SSHKEY** + +Set default `--identity` path to ssh key file value used to access Podman service. + +#### **PODMAN_CONNECTIONS_CONF** + +The path to the file where the system connections and farms created with `podman system connection add` +and `podman farm add` are stored, by default it uses `~/.config/containers/podman-connections.json`. + +#### **STORAGE_DRIVER** + +Set default `--storage-driver` value. + +#### **STORAGE_OPTS** + +Set default `--storage-opt` value. + +#### **TMPDIR** + +Set the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + +#### **XDG_CONFIG_HOME** + +In Rootless mode configuration files are read from `XDG_CONFIG_HOME` when +specified, otherwise in the home directory of the user under +`$HOME/.config/containers`. + +#### **XDG_DATA_HOME** + +In Rootless mode images are pulled under `XDG_DATA_HOME` when specified, +otherwise in the home directory of the user under +`$HOME/.local/share/containers/storage`. + +#### **XDG_RUNTIME_DIR** + +In Rootless mode temporary configuration data is stored in `${XDG_RUNTIME_DIR}/containers`. + +## Remote Access + +The Podman command can be used with remote services using the `--remote` flag. Connections can +be made using local unix domain sockets, ssh or directly to tcp sockets. When specifying the +podman --remote flag, only the global options `--url`, `--identity`, `--log-level`, `--connection` are used. + +Connection information can also be managed using the containers.conf file. + +## Exit Codes + +The exit code from `podman` gives information about why the container +failed to run or why it exited. When `podman` commands exit with a non-zero code, +the exit codes follow the `chroot` standard, see below: + + **125** The error is with podman **_itself_** + + $ podman run --foo busybox; echo $? + Error: unknown flag: --foo + 125 + + **126** Executing a _container command_ and the _command_ cannot be invoked + + $ podman run busybox /etc; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error + 126 + + **127** Executing a _container command_ and the _command_ cannot be found + + $ podman run busybox foo; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error + 127 + + **Exit code** otherwise, `podman` returns the exit code of the _container command_ + + $ podman run busybox /bin/sh -c 'exit 3'; echo $? + 3 + + +## COMMANDS + +| Command | Description | +|--------------------------------------------------|------------------------------------------------------------------------------| +| [podman-artifact(1)](podman-artifact.1.md) | Manage OCI artifacts. | +| [podman-attach(1)](podman-attach.1.md) | Attach to a running container. | +| [podman-auto-update(1)](podman-auto-update.1.md) | Auto update containers according to their auto-update policy | +| [podman-build(1)](podman-build.1.md) | Build a container image using a Containerfile. | +| [podman-farm(1)](podman-farm.1.md) | Farm out builds to machines running podman for different architectures | +| [podman-commit(1)](podman-commit.1.md) | Create new image based on the changed container. | +| [podman-completion(1)](podman-completion.1.md) | Generate shell completion scripts | +| [podman-compose(1)](podman-compose.1.md) | Run Compose workloads via an external compose provider. | +| [podman-container(1)](podman-container.1.md) | Manage containers. | +| [podman-cp(1)](podman-cp.1.md) | Copy files/folders between a container and the local filesystem. | +| [podman-create(1)](podman-create.1.md) | Create a new container. | +| [podman-diff(1)](podman-diff.1.md) | Inspect changes on a container or image's filesystem. | +| [podman-events(1)](podman-events.1.md) | Monitor Podman events | +| [podman-exec(1)](podman-exec.1.md) | Execute a command in a running container. | +| [podman-export(1)](podman-export.1.md) | Export a container's filesystem contents as a tar archive. | +| [podman-generate(1)](podman-generate.1.md) | Generate structured data based on containers, pods or volumes. | +| [podman-healthcheck(1)](podman-healthcheck.1.md) | Manage healthchecks for containers | +| [podman-history(1)](podman-history.1.md) | Show the history of an image. | +| [podman-image(1)](podman-image.1.md) | Manage images. | +| [podman-images(1)](podman-images.1.md) | List images in local storage. | +| [podman-import(1)](podman-import.1.md) | Import a tarball and save it as a filesystem image. | +| [podman-info(1)](podman-info.1.md) | Display Podman related system information. | +| [podman-init(1)](podman-init.1.md) | Initialize one or more containers | +| [podman-inspect(1)](podman-inspect.1.md) | Display a container, image, volume, network, or pod's configuration. | +| [podman-kill(1)](podman-kill.1.md) | Kill the main process in one or more containers. | +| [podman-load(1)](podman-load.1.md) | Load image(s) from a tar archive into container storage. | +| [podman-login(1)](podman-login.1.md) | Log in to a container registry. | +| [podman-logout(1)](podman-logout.1.md) | Log out of a container registry. | +| [podman-logs(1)](podman-logs.1.md) | Display the logs of one or more containers. | +| [podman-machine(1)](podman-machine.1.md) | Manage Podman's virtual machine | +| [podman-manifest(1)](podman-manifest.1.md) | Create and manipulate manifest lists and image indexes. | +| [podman-mount(1)](podman-mount.1.md) | Mount a working container's root filesystem. | +| [podman-network(1)](podman-network.1.md) | Manage Podman networks. | +| [podman-pause(1)](podman-pause.1.md) | Pause one or more containers. | +| [podman-kube(1)](podman-kube.1.md) | Play containers, pods or volumes based on a structured input file. | +| [podman-pod(1)](podman-pod.1.md) | Management tool for groups of containers, called pods. | +| [podman-port(1)](podman-port.1.md) | List port mappings for a container. | +| [podman-ps(1)](podman-ps.1.md) | Print out information about containers. | +| [podman-pull(1)](podman-pull.1.md) | Pull an image from a registry. | +| [podman-push(1)](podman-push.1.md) | Push an image, manifest list or image index from local storage to elsewhere. | +| [podman-rename(1)](podman-rename.1.md) | Rename an existing container. | +| [podman-restart(1)](podman-restart.1.md) | Restart one or more containers. | +| [podman-rm(1)](podman-rm.1.md) | Remove one or more containers. | +| [podman-rmi(1)](podman-rmi.1.md) | Remove one or more locally stored images. | +| [podman-run(1)](podman-run.1.md) | Run a command in a new container. | +| [podman-save(1)](podman-save.1.md) | Save image(s) to an archive. | +| [podman-search(1)](podman-search.1.md) | Search a registry for an image. | +| [podman-secret(1)](podman-secret.1.md) | Manage podman secrets. | +| [podman-start(1)](podman-start.1.md) | Start one or more containers. | +| [podman-stats(1)](podman-stats.1.md) | Display a live stream of one or more container's resource usage statistics. | +| [podman-stop(1)](podman-stop.1.md) | Stop one or more running containers. | +| [podman-system(1)](podman-system.1.md) | Manage podman. | +| [podman-tag(1)](podman-tag.1.md) | Add an additional name to a local image. | +| [podman-top(1)](podman-top.1.md) | Display the running processes of a container. | +| [podman-unmount(1)](podman-unmount.1.md) | Unmount a working container's root filesystem. | +| [podman-unpause(1)](podman-unpause.1.md) | Unpause one or more containers. | +| [podman-unshare(1)](podman-unshare.1.md) | Run a command inside of a modified user namespace. | +| [podman-untag(1)](podman-untag.1.md) | Remove one or more names from a locally-stored image. | +| [podman-update(1)](podman-update.1.md) | Update the configuration of a given container. | +| [podman-version(1)](podman-version.1.md) | Display the Podman version information. | +| [podman-volume(1)](podman-volume.1.md) | Simple management tool for volumes. | +| [podman-wait(1)](podman-wait.1.md) | Wait on one or more containers to stop and print their exit codes. | + +## CONFIGURATION FILES + +**containers.conf** (`/usr/share/containers/containers.conf`, `/etc/containers/containers.conf`, `$HOME/.config/containers/containers.conf`) + +Podman has builtin defaults for command line options. These defaults can be overridden using the containers.conf configuration files. + +Distributions ship the `/usr/share/containers/containers.conf` file with their default settings. Administrators can override fields in this file by creating the `/etc/containers/containers.conf` file. Users can further modify defaults by creating the `$HOME/.config/containers/containers.conf` file. Podman merges its builtin defaults with the specified fields from these files, if they exist. Fields specified in the users file override the administrator's file, which overrides the distribution's file, which override the built-in defaults. + +Podman uses builtin defaults if no containers.conf file is found. + +If the **CONTAINERS_CONF** environment variable is set, then its value is used for the containers.conf file rather than the default. + +**mounts.conf** (`/usr/share/containers/mounts.conf`) + +The mounts.conf file specifies volume mount directories that are automatically mounted inside containers when executing the `podman run` or `podman start` commands. Administrators can override the defaults file by creating `/etc/containers/mounts.conf`. + +When Podman runs in rootless mode, the file `$HOME/.config/containers/mounts.conf` overrides the default if it exists. For details, see containers-mounts.conf(5). + +**policy.json** (`/etc/containers/policy.json`, `$HOME/.config/containers/policy.json`) + +Signature verification policy files are used to specify policy, e.g. trusted keys, applicable when deciding whether to accept an image, or individual signatures of that image, as valid. For details, see containers-policy.json(5). + +**registries.conf** (`/etc/containers/registries.conf`, `$HOME/.config/containers/registries.conf`) + +registries.conf is the configuration file which specifies which container registries is consulted when completing image names which do not include a registry or domain portion. + +Non root users of Podman can create the `$HOME/.config/containers/registries.conf` file to be used instead of the system defaults. + +If the **CONTAINERS_REGISTRIES_CONF** environment variable is set, then its value is used for the registries.conf file rather than the default. + +**storage.conf** (`/etc/containers/storage.conf`, `$HOME/.config/containers/storage.conf`) + +storage.conf is the storage configuration file for all tools using containers/storage + +The storage configuration file specifies all of the available container storage options for tools using shared container storage. + +When Podman runs in rootless mode, the file `$HOME/.config/containers/storage.conf` is used instead of the system defaults. + +If the **CONTAINERS_STORAGE_CONF** environment variable is set, then its value is used for the storage.conf file rather than the default. + +## Rootless mode +Podman can also be used as non-root user. When podman runs in rootless mode, a user namespace is automatically created for the user, defined in `/etc/subuid` and `/etc/subgid`. + +Containers created by a non-root user are not visible to other users and are not seen or managed by Podman running as root. + +It is required to have multiple UIDS/GIDS set for a user. Be sure the user is present in the files `/etc/subuid` and `/etc/subgid`. + +Execute the following commands to add the ranges to the files + + $ sudo usermod --add-subuids 10000-75535 USERNAME + $ sudo usermod --add-subgids 10000-75535 USERNAME + +Or just add the content manually. + + $ echo USERNAME:10000:65536 >> /etc/subuid + $ echo USERNAME:10000:65536 >> /etc/subgid + +See the `subuid(5)` and `subgid(5)` man pages for more information. + + + +Note: whitespace in any row of `/etc/subuid` or `/etc/subgid`, including trailing blanks, may result in no entry failures. + +Images are pulled under `XDG_DATA_HOME` when specified, otherwise in the home directory of the user under `.local/share/containers/storage`. + +Currently slirp4netns or pasta is required to be installed to create a network +device, otherwise rootless containers need to run in the network namespace of +the host. + +In certain environments like HPC (High Performance Computing), users cannot take advantage of the additional UIDs and GIDs from the `/etc/subuid` and `/etc/subgid` systems. However, in this environment, rootless Podman can operate with a single UID. To make this work, set the `ignore_chown_errors` option in the `containers-storage.conf(5)` file. This option tells Podman when pulling an image to ignore chown errors when attempting to change a file in a container image to match the non-root UID in the image. This means all files get saved as the user's UID. Note this can cause issues when running the container. + +### **NOTE:** Unsupported file systems in rootless mode + +The Overlay file system (OverlayFS) is not supported with kernels prior to 5.12.9 in rootless mode. The fuse-overlayfs package is a tool that provides the functionality of OverlayFS in user namespace that allows mounting file systems in rootless environments. It is recommended to install the fuse-overlayfs package. In rootless mode, Podman automatically uses the fuse-overlayfs program as the mount_program if installed, as long as the `$HOME/.config/containers/storage.conf` file was not previously created. If storage.conf exists in the homedir, add `mount_program = "/usr/bin/fuse-overlayfs"` under `[storage.options.overlay]` to enable this feature. + +The Network File System (NFS) and other distributed file systems (for example: Lustre, Spectrum Scale, the General Parallel File System (GPFS)) are not supported when running in rootless mode as these file systems do not understand user namespace. However, rootless Podman can make use of an NFS Homedir by modifying the `$HOME/.config/containers/storage.conf` to have the `graphroot` option point to a directory stored on local (Non NFS) storage. + +## SEE ALSO +**[containers-mounts.conf(5)](https://github.com/containers/common/blob/main/docs/containers-mounts.conf.5.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **[oci-hooks(5)](https://github.com/containers/common/blob/main/pkg/hooks/docs/oci-hooks.5.md)**, **[containers-policy.json(5)](https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/main/man/runc.8.md)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, **[pasta(1)](https://passt.top/builds/latest/web/passt.1.html)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +See [podman-rootless(7)](https://github.com/containers/podman/blob/main/rootless.md) +for rootless issues. + +## HISTORY +Dec 2016, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.0/source/markdown/podmansh.1.md b/versioned_docs/version-5.5.0/source/markdown/podmansh.1.md new file mode 100644 index 000000000..8a9e31fc7 --- /dev/null +++ b/versioned_docs/version-5.5.0/source/markdown/podmansh.1.md @@ -0,0 +1,138 @@ +--- +title: podmansh +version: v5.5.0 +--- + +% podmansh 1 + +## NAME +podmansh - Execute login shell within the Podman `podmansh` container + +## SYNOPSIS +**podmansh** + +## DESCRIPTION + +Execute a user shell within a container when the user logs into the system. The container that the users get added to can be defined via a Podman Quadlet file. This user only has access to volumes and capabilities configured into the Quadlet file. + +Administrators can create a Quadlet in /etc/containers/systemd/users, which systemd will start for all users when they log in. The administrator can create a specific Quadlet with the container name `podmansh`, then enable users to use the login shell /usr/bin/podmansh. These user login shells are automatically executed inside the `podmansh` container via Podman. + +Optionally, the administrator can place Quadlet files in the /etc/containers/systemd/users/${UID} directory for a user. Only this UID will execute these Quadlet services when that user logs in. + +The user is confined to the container environment via all of the security mechanisms, including SELinux. The only information that will be available from the system comes from volumes leaked into the container. + +Systemd will automatically create the container when the user session is started. Systemd will take down the container when all connections to the user session are removed. This means users can log in to the system multiple times, with each session connected to the same container. + +Administrators can use volumes to expose specific host data from the host system to the user, without the user being exposed to other parts of the system. + +Timeout for podmansh can be set using the `podmansh_timeout` option in containers.conf. + +## Setup +Create user login session using useradd while running as root. + +``` +# useradd -s /usr/bin/podmansh lockedu +# grep lockedu /etc/passwd +lockedu:x:4008:4008::/home/lockedu:/usr/bin/podmansh +``` + +Create a Podman Quadlet file that looks something like one of the following. + +Fully locked down container, no access to host OS. + +``` +# USERID=$(id -u lockedu) +# mkdir -p /etc/containers/systemd/users/${USERID} +# cat > /etc/containers/systemd/users/${USERID}/podmansh.container << _EOF +[Unit] +Description=The podmansh container +After=local-fs.target + +[Container] +Image=registry.fedoraproject.org/fedora +ContainerName=podmansh +RemapUsers=keep-id +RunInit=yes +DropCapability=all +NoNewPrivileges=true + +Exec=sleep infinity + +[Install] +RequiredBy=default.target +_EOF +``` + +Alternatively, while running as root, create a Quadlet where the user is allowed to become root within the user namespace. They can also permanently read/write content from their home directory which is volume mounted from the actual host's users account, rather than being inside of the container. + +``` +# useradd -s /usr/bin/podmansh confinedu +# grep confinedu /etc/passwd +confinedu:x:4009:4009::/home/confinedu:/usr/bin/podmansh +# USERID=$(id -u confinedu) +# mkdir -p /etc/containers/systemd/users/${USERID} +# cat > /etc/containers/systemd/users/${USERID}/podmansh.container << _EOF +[Unit] +Description=The podmansh container +After=local-fs.target + +[Container] +Image=registry.fedoraproject.org/fedora +ContainerName=podmansh +RemapUsers=keep-id +RunInit=yes + +Volume=%h/data:%h:Z +Exec=sleep infinity + +[Service] +ExecStartPre=/usr/bin/mkdir -p %h/data + +[Install] +RequiredBy=default.target +_EOF +``` + +Another example, while running as root, create a Quadlet where the users inside this container are allowed to execute containers with SELinux separation and able to read and write content in the $HOME/data directory. + +``` +# useradd -s /usr/bin/podmansh fullu +# grep fullu /etc/passwd +fullu:x:4010:4010::/home/fullu:/usr/bin/podmansh +# USERID=$(id -u fullu) +# mkdir -p /etc/containers/systemd/users/${USERID} +# cat > /etc/containers/systemd/users/${USERID}/podmansh.container << _EOF +[Unit] +Description=The podmansh container +After=local-fs.target + +[Container] +Image=registry.fedoraproject.org/fedora +ContainerName=podmansh +RemapUsers=keep-id +RunInit=yes +PodmanArgs=--security-opt=unmask=/sys/fs/selinux \ + --security-opt=label=nested \ + --security-opt=label=user:container_user_u \ + --security-opt=label=type:container_user_t \ + --security-opt=label=role:container_user_r \ + --security-opt=label=level:s0-s0:c0.c1023 + +Volume=%h/data:%h:Z +WorkingDir=%h +Volume=/sys/fs/selinux:/sys/fs/selinux +Exec=sleep infinity + +[Service] +ExecStartPre=/usr/bin/mkdir -p %h/data + +[Install] +RequiredBy=default.target +_EOF +``` + +## SEE ALSO +**[containers.conf(5)](containers.conf.5.md)**, **[podman(1)](podman.1.md)**, **[podman-exec(1)](podman-exec.1.md)**, **[podman-systemd.unit(5)](podman-systemd.unit.5.md)** + +## HISTORY +May 2023, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.0/tutorials/README.md b/versioned_docs/version-5.5.0/tutorials/README.md new file mode 100644 index 000000000..6c024ed3a --- /dev/null +++ b/versioned_docs/version-5.5.0/tutorials/README.md @@ -0,0 +1,46 @@ +--- +title: Podman Tutorials +version: v5.5.0 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +# Podman Tutorials + +## Links to a number of useful tutorials for the Podman utility. + +**[Introduction Tutorial](podman_tutorial.md)** + +Learn how to set up Podman and perform some basic commands with the utility. + +**[Basic Setup and Use of Podman in a Rootless environment](rootless_tutorial.md)** + +The steps required to set up rootless Podman are enumerated. + +**[Setup Mac/Windows](mac_win_client.md)** + +Special setup for running the Podman remote client on a Mac or Windows PC and connecting to Podman running on a Linux VM are documented. + +**[Remote Client](remote_client.md)** + +A brief how-to on using the Podman remote-client. + +**[How to use libpod for custom/derivative projects](podman-derivative-api.md)** + +How the libpod API can be used within your own project. + +**[Image Signing](image_signing.md)** + +Learn how to set up and use image signing with Podman. + +**[Basic Networking](basic_networking.md)** + +A basic guide to common network setups with Podman + +**[Socket activation](socket_activation.md)** + +Learn how to run containers that support socket activation. + +**[Performance](performance.md)** + +Performance guide regarding Podman configuration and usage. diff --git a/versioned_docs/version-5.5.0/tutorials/basic_networking.md b/versioned_docs/version-5.5.0/tutorials/basic_networking.md new file mode 100644 index 000000000..908c2cab2 --- /dev/null +++ b/versioned_docs/version-5.5.0/tutorials/basic_networking.md @@ -0,0 +1,336 @@ +--- +title: Basic Networking Guide for Podman +version: v5.5.0 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + + +# Basic Networking Guide for Podman + + +It seems once people understand the basics of containers, networking is one of the first +aspects they begin experimenting with. And regarding networking, it takes very +little experimentation before ending up on the deep end of the pool. The following +guide shows the most common network setups for Podman rootful and rootless containers. +Each setup is supported with an example. + + +## Differences between rootful and rootless container networking + +One of the guiding factors on networking for containers with Podman is going to +be whether or not the container is run by a root user or not. This is because +unprivileged users cannot create networking interfaces on the host. Therefore, +for rootless containers, the default network mode is slirp4netns. Because of the +limited privileges, slirp4netns lacks some of the features of networking +compared to rootful Podman's networking; for example, slirp4netns cannot give +containers a routable IP address. The default networking mode for rootful +containers on the other side is netavark, which allows a container to have a +routable IP address. + +## Firewalls + +The role of a firewall will not impact the setup and configuration of networking, +but it will impact traffic on those networks. The most obvious is inbound network +traffic to the container host, which is being passed onto containers usually with +port mapping. Depending on the firewall implementation, we have observed firewall +ports being opened automatically due to running a container with a port mapping (for +example). If container traffic does not seem to work properly, check the firewall +and allow traffic on ports the container is using. A common problem is that +reloading the firewall deletes the netavark iptables rules resulting in a loss of +network connectivity for rootful containers. Podman v3 provides the podman +network reload command to restore this without having to restart the container. + +## Basic Network Setups + +Most containers and pods being run with Podman adhere to a couple of simple scenarios. +By default, rootful Podman will create a bridged network. This is the most straightforward +and preferred network setup for Podman. Bridge networking creates an interface for +the container on an internal bridge network, which is then connected to the internet +via Network Address Translation(NAT). We also see users wanting to use `macvlan` +for networking as well. The `macvlan` plugin forwards an entire network interface +from the host into the container, allowing it access to the network the host is connected +to. And finally, the default network configuration for rootless containers is slirp4netns. +The slirp4netns network mode has limited capabilities but can be run on users without +root privileges. It creates a tunnel from the host into the container to forward +traffic. + +### Bridge + +A bridge network is defined as an internal network is created where both the +container and host are attached. Then this network is capable of allowing the containers +to communicate outside the host. + + +*[Image: bridge_network]* + +Consider the above illustration. It depicts a laptop user running two containers: +a web and db instance. These two containers are on the virtual network with the +host. Additionally, by default, these containers can initiate communications outside +the laptop (to the Internet for example). The containers on the virtual network +typically have non-routable, also known as private IP addresses. + +When dealing with communication that is being initiated outside the host, the outside +client typically must address the laptop’s external network interface and given port +number. Assuming the host allows incoming traffic, the host will know to forward +the incoming traffic on that port to the specific container. To accomplish this, +firewall rules are added to forward traffic when a container requests a specific +port be forwarded. + +Bridge networking is the default for Podman containers created as root. Podman provides +a default bridge network, but you can create others using the `podman network create` +command. Containers can be joined to a network when they are created with the +`--network` flag, or after they are created via the `podman network connect` and +`podman network disconnect` commands. + +As mentioned earlier, slirp4netns is the default network configuration for rootless +users. But as of Podman version 4.0, rootless users can also use netavark. +The user experience of rootless netavark is very akin to a rootful netavark, except that +there is no default network configuration provided. You simply need to create a +network, and the one will be created as a bridge network. If you would like to switch from +CNI networking to netavark, you must issue the `podman system reset --force` command. +This will delete all of your images, containers, and custom networks. + +``` +$ podman network create +``` + +When rootless containers are run, network operations +will be executed inside an extra network namespace. To join this namespace, use +`podman unshare --rootless-netns`. + +#### Default Network + +The default network `podman` with netavark is memory-only. It does not support dns resolution because of backwards compatibility with Docker. To change settings, export the in-memory network and change the file. + +For the default rootful network use +``` +podman network inspect podman | jq .[] > /etc/containers/networks/podman.json +``` + +And for the rootless network use + +``` +podman network inspect podman | jq .[] > ~/.local/share/containers/storage/networks/podman.json +``` + + +#### Example + +By default, rootful containers use the netavark for its default network if +you have not migrated from Podman v3. +In this case, no network name must be passed to Podman. However, you can create +additional bridged networks with the podman create command. + +The following example shows how to set up a web server and expose it to the network +outside the host as both rootful and rootless. It will also show how an outside +client can connect to the container. + +``` +(rootful) $ sudo podman run -dt --name webserver -p 8080:80 quay.io/libpod/banner +00f3440c7576aae2d5b193c40513c29c7964e96bf797cf0cc352c2b68ccbe66a +``` + +Now run the container. +``` +$ podman run -dt --name webserver --network podman1 -p 8081:80 quay.io/libpod/banner +269fd0d6b2c8ed60f2ca41d7beceec2471d72fb9a33aa8ca45b81dc9a0abbb12 +``` +Note in the above run command, the container’s port 80 (where the Nginx server is +running) was mapped to the host’s port 8080. Port 8080 was chosen to demonstrate +how the host and container ports can be mapped for external access. The port could +very well have been 80 as well (except for rootless users). + +To connect from an outside client to the webserver, simply point an HTTP client to +the host’s IP address at port 8080 for rootful and port 8081 for rootless. +``` +(outside_host): $ curl 192.168.99.109:8080 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ + +(outside_host): $ curl 192.168.99.109:8081 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ +``` + +### Macvlan + +With macvlan, the container is given access to a physical network interface on the +host. This interface can configure multiple subinterfaces. And each subinterface +is capable of having its own MAC and IP address. In the case of Podman containers, +the container will present itself as if it is on the same network as the host. + +*[Image: macvlan_network]* + +In the illustration, outside clients will be able to access the web container by +its IP address directly. Usually the network information, including IP address, +is leased from a DHCP server like most other network clients on the network. If +the laptop is running a firewall, such as firewalld, then accommodations will need +to be made for proper access. + +Note that Podman has to be run as root in order to use macvlan. + +#### Example + +The following example demonstrates how to set up a web container on a macvlan and +how to access that container from outside the host. First, create the macvlan network. + You need to know the network interface on the host that connects to the routable +network. In the example case, it is eth0. + +``` +$ sudo podman network create -d macvlan -o parent=eth0 webnetwork +webnetwork +``` + +The next step is to ensure that the DHCP service is running. This handles +the DHCP leases from the network. If DHCP is not needed, the `--subnet` option +can be used to assign a static subnet in the `network create` command above. + +CNI and netavark both use their own DHCP service; therefore, you need to know +what backend you are using. To see what you are using, run this command: +``` +$ sudo podman info --format {{.Host.NetworkBackend}} +``` +If this command does not work, you are using an older version prior to Podman +v4.0 which means you are using CNI. +If the netavark backend is used, at least Podman v4.5 with netavark v1.6 is +required to use DHCP. + +For netavark use: +``` +$ sudo systemctl enable --now netavark-dhcp-proxy.socket +``` +Or if the system doesn't use systemd, start the daemon manually: +``` +$ /usr/libexec/podman/netavark dhcp-proxy --activity-timeout 0 +``` + +With CNI use: +``` +$ sudo systemctl enable --now cni-dhcp.socket +``` +Or if the system doesn't use systemd, start the daemon manually: +``` +$ sudo /usr/libexec/cni/dhcp daemon +``` +Note that depending on the distribution, the binary location may differ. + +Now run the container and be certain to attach it to the network we created earlier. +``` +$ sudo podman run -dt --name webserver --network webnetwork quay.io/libpod/banner +03d82083c434d7e937fc0b87c25401f46ab5050007df403bf988e25e52c5cc40 +[baude@localhost ~]$ sudo podman exec webserver ip address show eth0 +2: eth0@if3: mtu 1500 qdisc noqueue state +UP +link/ether 0a:3c:e2:eb:87:0f brd ff:ff:ff:ff:ff:ff +inet 192.168.99.186/24 brd 192.168.99.255 scope global eth0 +valid_lft forever preferred_lft forever +inet6 fe80::83c:e2ff:feeb:870f/64 scope link +valid_lft forever preferred_lft forever +``` +Because the container has a routable IP address (on this network) and is not being +managed by firewalld, no change to the firewall is needed. +``` +(outside_host): $ curl http://192.168.99.186 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ +``` + + + +### Slirp4netns + +Slirp4netns is the default network setup for rootless containers and pods. It was +invented because unprivileged users are not allowed to make network interfaces on +the host. Slirp4netns creates a TAP device in the container’s network namespace +and connects to the usermode TCP/IP stack. Consider the following illustration. + +*[Image: slirp_network]* + +The unprivileged user on this laptop has created two containers: a DB container and +a web container. Both of these containers have the ability to access content on +networks outside the laptop. And outside clients can access the containers if the +container is bound to a host port and the laptop firewall allows it. Remember, unprivileged +users must use ports 1024 through 65535 as lower ports require root privileges. (CAP_NET_BIND_SERVICE) +Note: this can be adjusted using the `sysctl net.ipv4.ip_unprivileged_port_start` + +One of the drawbacks of slirp4netns is that the containers are completely isolated +from each other. Unlike the bridge approach, there is no virtual network. For containers +to communicate with each other, they can use the port mappings with the host system, +or they can be put into a Pod where they share the same network namespace. See [Communicating +between containers and pods](#Communicating-between-containers-and-pods) for more information. + +#### Example + +The following example will show how two rootless containers can communicate with +each other where one is a web server. Then it will show how a client on the host’s +network can communicate with the rootless web server. + +First, run the rootless web server and map port 80 from the container to a non-privileged +port like 8080. +``` +$ podman run -dt --name webserver -p 8080:80 quay.io/libpod/banner +17ea33ccd7f55ff45766b3ec596b990a5f2ba66eb9159cb89748a85dc3cebfe0 +``` +Because rootless containers cannot communicate with each other directly with TCP/IP +via IP addresses, the host and the port mapping are used. To do so, the IP address +of the host (interface) must be known. +``` +$ ip address show eth0 +3: eth0: mtu 1500 qdisc fq_codel state UP group +default qlen 1000 +link/ether 3c:e1:a1:c1:7a:3f brd ff:ff:ff:ff:ff:ff +altname eth0 +inet 192.168.99.109/24 brd 192.168.99.255 scope global dynamic noprefixroute eth0 +valid_lft 78808sec preferred_lft 78808sec +inet6 fe80::5632:6f10:9e76:c33/64 scope link noprefixroute +valid_lft forever preferred_lft forever +``` +From another rootless container, use the host’s IP address and port to communicate +between the two rootless containers successfully. +``` +$ podman run -it quay.io/libpod/banner curl http://192.168.99.109:8080 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ +``` + +From a client outside the host, the IP address and port can also be used: +``` +(outside_host): $ curl http://192.168.99.109:8080 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ +``` + +## Communicating between containers and pods + +Most users of containers have a decent understanding of how containers communicate +with each other and the rest of the world. Usually each container has its own IP +address and networking information. They communicate amongst each other using regular +TCP/IP means like IP addresses or, in many cases, using DNS names often based on +the container name. But pods are a collection of one or more containers, and with +that, some uniqueness is inherited. + +By definition, all containers in a Podman pod share the same network namespace. This +fact means that they will have the same IP address, MAC addresses, and port mappings. +You can conveniently communicate between containers in a pod by using localhost. + +*[Image: slirp_network]* + +The above illustration describes a Pod on a bridged network. As depicted, the Pod +has two containers “inside” it: a DB and a Web container. Because they share the +same network namespace, the DB and Web container can communicate with each other +using localhost (127.0.0.1). Furthermore, they are also both addressable by the +IP address (and DNS name if applicable) assigned to the Pod itself. + +For more information on container to container networking, see [Configuring container +networking with Podman](https://www.redhat.com/sysadmin/container-networking-podman). diff --git a/versioned_docs/version-5.5.0/tutorials/image_signing.md b/versioned_docs/version-5.5.0/tutorials/image_signing.md new file mode 100644 index 000000000..8716c8ed4 --- /dev/null +++ b/versioned_docs/version-5.5.0/tutorials/image_signing.md @@ -0,0 +1,199 @@ +--- +title: How to sign and distribute container images using Podman +version: v5.5.0 +--- + +# How to sign and distribute container images using Podman + +Signing container images originates from the motivation of trusting only +dedicated image providers to mitigate man-in-the-middle (MITM) attacks or +attacks on container registries. One way to sign images is to utilize a GNU +Privacy Guard ([GPG][0]) key. This technique is generally compatible with any +OCI compliant container registry like [Quay.io][1]. It is worth mentioning that +the OpenShift integrated container registry supports this signing mechanism out +of the box, which makes separate signature storage unnecessary. + +[0]: https://gnupg.org +[1]: https://quay.io + +From a technical perspective, we can utilize Podman to sign the image before +pushing it into a remote registry. After that, all systems running Podman have +to be configured to retrieve the signatures from a remote server, which can +be any simple web server. This means that every unsigned image will be rejected +during an image pull operation. But how does this work? + +First of all, we have to create a GPG key pair or select an already locally +available one. To generate a new GPG key, just run `gpg --full-gen-key` and +follow the interactive dialog. Now we should be able to verify that the key +exists locally: + +```bash +> gpg --list-keys sgrunert@suse.com +pub rsa2048 2018-11-26 [SC] [expires: 2020-11-25] + XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX +uid [ultimate] Sascha Grunert +sub rsa2048 2018-11-26 [E] [expires: 2020-11-25] +``` + +Now let’s assume that we run a container registry. For example we could simply +start one on our local machine: + +```bash +sudo podman run -d -p 5000:5000 docker.io/registry +``` + +The registry does not know anything about image signing, it just provides the remote +storage for the container images. This means if we want to sign an image, we +have to take care of how to distribute the signatures. + +Let’s choose a standard `alpine` image for our signing experiment: + +```bash +sudo podman pull docker://docker.io/alpine:latest +``` + +```bash +sudo podman images alpine +REPOSITORY TAG IMAGE ID CREATED SIZE +docker.io/library/alpine latest e7d92cdc71fe 6 weeks ago 5.86 MB +``` + +Now we can re-tag the image to point it to our local registry: + +```bash +sudo podman tag alpine localhost:5000/alpine +``` + +```bash +sudo podman images alpine +REPOSITORY TAG IMAGE ID CREATED SIZE +localhost:5000/alpine latest e7d92cdc71fe 6 weeks ago 5.86 MB +docker.io/library/alpine latest e7d92cdc71fe 6 weeks ago 5.86 MB +``` + +Podman would now be able to push the image and sign it in one command. But to +let this work, we have to modify our system-wide registries configuration at +`/etc/containers/registries.d/default.yaml`: + +```yaml +default-docker: + sigstore: http://localhost:8000 # Added by us + sigstore-staging: file:///var/lib/containers/sigstore +``` + +We can see that we have two signature stores configured: + +- `sigstore`: referencing a web server for signature reading +- `sigstore-staging`: referencing a file path for signature writing + +Now, let’s push and sign the image: + +```bash +sudo -E GNUPGHOME=$HOME/.gnupg \ + podman push \ + --tls-verify=false \ + --sign-by sgrunert@suse.com \ + localhost:5000/alpine +… +Storing signatures +``` + +If we now take a look at the systems signature storage, then we see that there +is a new signature available, which was caused by the image push: + +```bash +sudo ls /var/lib/containers/sigstore +'alpine@sha256=e9b65ef660a3ff91d28cc50eba84f21798a6c5c39b4dd165047db49e84ae1fb9' +``` + +The default signature store in our edited version of +`/etc/containers/registries.d/default.yaml` references a web server listening at +`http://localhost:8000`. For our experiment, we simply start a new server inside +the local staging signature store: + +```bash +sudo bash -c 'cd /var/lib/containers/sigstore && python3 -m http.server' +Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ... +``` + +Let’s remove the local images for our verification test: + +``` +sudo podman rmi docker.io/alpine localhost:5000/alpine +``` + +We have to write a policy to enforce that the signature has to be valid. This +can be done by adding a new rule in `/etc/containers/policy.json`. From the +below example, copy the `"docker"` entry into the `"transports"` section of your +`policy.json`. + +```json +{ + "default": [{ "type": "insecureAcceptAnything" }], + "transports": { + "docker": { + "localhost:5000": [ + { + "type": "signedBy", + "keyType": "GPGKeys", + "keyPath": "/tmp/key.gpg" + } + ] + } + } +} +``` + +The `keyPath` does not exist yet, so we have to put the GPG key there: + +```bash +gpg --output /tmp/key.gpg --armor --export sgrunert@suse.com +``` + +If we now pull the image: + +```bash +sudo podman pull --tls-verify=false localhost:5000/alpine +… +Storing signatures +e7d92cdc71feacf90708cb59182d0df1b911f8ae022d29e8e95d75ca6a99776a +``` + +Then we can see in the logs of the web server that the signature has been +accessed: + +``` +127.0.0.1 - - [04/Mar/2020 11:18:21] "GET /alpine@sha256=e9b65ef660a3ff91d28cc50eba84f21798a6c5c39b4dd165047db49e84ae1fb9/signature-1 HTTP/1.1" 200 - +``` + +As a counterpart example, if we specify the wrong key at `/tmp/key.gpg`: + +```bash +gpg --output /tmp/key.gpg --armor --export mail@saschagrunert.de +File '/tmp/key.gpg' exists. Overwrite? (y/N) y +``` + +Then a pull is not possible any more: + +```bash +sudo podman pull --tls-verify=false localhost:5000/alpine +Trying to pull localhost:5000/alpine... +Error: pulling image "localhost:5000/alpine": unable to pull localhost:5000/alpine: unable to pull image: Source image rejected: Invalid GPG signature: … +``` + +So in general there are four main things to be taken into consideration when +signing container images with Podman and GPG: + +1. We need a valid private GPG key on the signing machine and corresponding + public keys on every system which would pull the image +2. A web server has to run somewhere which has access to the signature storage +3. The web server has to be configured in any + `/etc/containers/registries.d/*.yaml` file +4. Every image pulling system has to be configured to contain the enforcing + policy configuration via `policy.conf` + +That’s it for image signing and GPG. The cool thing is that this setup works out +of the box with [CRI-O][2] as well and can be used to sign container images in +Kubernetes environments. + +[2]: https://cri-o.io diff --git a/versioned_docs/version-5.5.0/tutorials/mac_client.md b/versioned_docs/version-5.5.0/tutorials/mac_client.md new file mode 100644 index 000000000..216ee2858 --- /dev/null +++ b/versioned_docs/version-5.5.0/tutorials/mac_client.md @@ -0,0 +1,7 @@ +--- +title: "[Podman Mac Client tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md)" +version: v5.5.0 +--- + +# [Podman Mac Client tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) +This tutorial has moved! You can find out how to set up Podman on macOS (as well as Windows) [here](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) diff --git a/versioned_docs/version-5.5.0/tutorials/mac_win_client.md b/versioned_docs/version-5.5.0/tutorials/mac_win_client.md new file mode 100644 index 000000000..dc249494d --- /dev/null +++ b/versioned_docs/version-5.5.0/tutorials/mac_win_client.md @@ -0,0 +1,120 @@ +--- +title: Podman Remote clients for macOS and Windows +version: v5.5.0 +--- + +# Podman Remote clients for macOS and Windows + +*** +**_NOTE:_** For running Podman on Windows, refer to the [Podman for Windows](podman-for-windows.md) guide, which uses the recommended approach of a Podman-managed Linux backend. For Mac, see the [Podman installation instructions](https://podman.io/getting-started/installation). This guide covers the advanced usage of Podman with a custom Linux VM or a remote external Linux system. +*** + +## Introduction + +The core Podman runtime environment can only run on Linux operating systems. But other operating systems can use the “remote client” to manage their containers to a Linux backend. This remote client is nearly identical to the standard Podman program. Certain functions that do not make sense for remote clients have been removed. For example, the “--latest” switch for container commands has been removed. + +### Brief architecture + +The remote client uses a client-server model. You need Podman installed on a Linux machine or VM that also has the SSH daemon running. On the local operating system, when you execute a Podman command, Podman connects to the server via SSH. It then connects to the Podman service by using systemd socket activation. The Podman commands are executed on the server. From the client's point of view, it seems like Podman runs locally. + +## Obtaining and installing Podman + +### Windows + +Installing the Windows Podman client begins by downloading the Podman Windows installer. The Windows installer is built with each Podman release and is downloadable from its [release description page](https://github.com/containers/podman/releases/latest). The Windows installer file is named `podman-#.#.#-setup.exe`, where the `#` symbols represent the version number of Podman. + +Once you have downloaded the installer to your Windows host, simply double click the installer and Podman will be installed. The path is also set to put `podman` in the default user path. + +Podman must be run at a command prompt using the Windows Command Prompt (`cmd.exe`) or PowerShell (`pwsh.exe`) applications. + +### macOS + +The Mac Client is available through [Homebrew](https://brew.sh/). You can download homebrew via the instructions on their site. Install podman using: +``` +$ brew install podman +``` + +## Creating the first connection + +### Enable the Podman service on the server machine. + +Before performing any Podman client commands, you must enable the podman.sock SystemD service on the Linux server. In these examples, we are running Podman as a normal, unprivileged user, also known as a rootless user. By default, the rootless socket listens at `/run/user/${UID}/podman/podman.sock`. You can enable and start this socket permanently, using the following commands: +``` +$ systemctl --user enable --now podman.socket +``` +You will need to enable linger for this user in order for the socket to work when the user is not logged in. + +``` +sudo loginctl enable-linger $USER +``` + +You can verify that the socket is listening with a simple Podman command. + +``` +$ podman --remote info +host: + arch: amd64 + buildahVersion: 1.16.0-dev + cgroupVersion: v2 + conmon: + package: conmon-2.0.19-1.fc32.x86_64 +``` + +#### Enable sshd + +In order for the client to communicate with the server you need to enable and start the SSH daemon on your Linux machine, if it is not currently enabled. +``` +sudo systemctl enable --now sshd +``` + +#### Setting up SSH +Remote podman uses SSH to communicate between the client and server. The remote client works considerably smoother using SSH keys. To set up your ssh connection, you need to generate an ssh key pair from your client machine. +``` +$ ssh-keygen +``` +Your public key by default should be in your home directory under .ssh\id_rsa.pub. You then need to copy the contents of id_rsa.pub and append it into ~/.ssh/authorized_keys on the Linux server. On a Mac, you can automate this using ssh-copy-id. + +If you do not wish to use SSH keys, you will be prompted with each Podman command for your login password. + +## Using the client + +The first step in using the Podman remote client is to configure a connection.. + +You can add a connection by using the `podman system connection add` command. + +``` +C:\Users\baude> podman system connection add baude --identity c:\Users\baude\.ssh\id_rsa ssh://192.168.122.1/run/user/1000/podman/podman.sock +``` + +This will add a remote connection to Podman and if it is the first connection added, it will mark the connection as the default. You can observe your connections with `podman system connection list` + +``` +C:\Users\baude> podman system connection list +Name Identity URI +baude* id_rsa ssh://baude@192.168.122.1/run/user/1000/podman/podman.sock +``` + +Now we can test the connection with `podman info`. + +``` +C:\Users\baude> podman info +host: + arch: amd64 + buildahVersion: 1.16.0-dev + cgroupVersion: v2 + conmon: + package: conmon-2.0.19-1.fc32.x86_64 +``` + +Podman has also introduced a “--connection” flag where you can use other connections you have defined. If no connection is provided, the default connection will be used. + +``` +C:\Users\baude> podman system connection --help +``` + +## Wrap up + +You can use the podman remote clients to manage your containers running on a Linux server. The communication between client and server relies heavily on SSH connections and the use of SSH keys are encouraged. Once you have Podman installed on your remote client, you should set up a connection using `podman system connection add` which will then be used by subsequent Podman commands. + +## History +Originally published on [Red Hat Enable Sysadmin](https://www.redhat.com/sysadmin/podman-clients-macos-windows) diff --git a/versioned_docs/version-5.5.0/tutorials/performance.md b/versioned_docs/version-5.5.0/tutorials/performance.md new file mode 100644 index 000000000..fbf98c816 --- /dev/null +++ b/versioned_docs/version-5.5.0/tutorials/performance.md @@ -0,0 +1,249 @@ +--- +title: Podman performance guide +version: v5.5.0 +--- + +# Podman performance guide + +The performance of Podman may be influenced by a number of factors, such as, + +* the specified Podman command-line options and configuration +* the OCI runtime +* the host file system +* the container image + +Changing any of these may or may not have any noticeable effect on the performance of Podman on your system. + +## Using a separate user account for benchmarking + +Some performance tips, such as using a different storage driver would require the user to run `podman system reset`, +which erases all containers and container images for the user. +Instead of benchmarking different alternatives in your own home directory, you could create a new user +that afterwards can be removed. + +### Example: Specify the storage driver _vfs_ and run `/bin/true` in an Alpine container + +Interactively + +``` +sudo useradd testuser +sudo machinectl shell testuser@ +podman pull docker.io/library/alpine +/usr/bin/time -v podman --storage-driver=vfs run --rm docker.io/library/alpine /bin/true +exit +``` + +Noninteractively + +``` +sudo useradd testuser +systemd-run --machine=testuser@ --quiet --user --collect --pipe --wait \ + podman --storage-driver=vfs pull docker.io/library/alpine +systemd-run --machine=testuser@ --quiet --user --collect --pipe --wait \ + /usr/bin/time -v podman --storage-driver=vfs run --rm docker.io/library/alpine /bin/true +``` + +The command `/usr/bin/time -v` measures and displays benchmarking information. + +## Performance considerations + +### Use a fast OCI runtime + +Podman uses an OCI runtime when running containers. +The fastest OCI runtime is probably [__crun__](https://github.com/containers/crun). + +Check that you are using crun + +``` +$ podman info --format={{.Host.OCIRuntime.Name}} +crun +``` + +To benchmark an OCI runtime, create a test user account and +specify the OCI runtime path with [__--runtime__](https://docs.podman.io/en/latest/markdown/podman.1.html#runtime-value). + +### Choosing a storage driver + +The following storage drivers are listed from fastest to slowest: + +1. native overlayfs +2. fuse-overlayfs +3. vfs + +There is one notable exception to this speed ranking. +Creating a container takes significantly longer with _native overlayfs_ than _fuse-overlayfs_ +when these conditions are all met: + +* rootless Podman is used +* a modified UID/GID mapping is used +* _native overlayfs_ is used +* no container has yet been created with the specified container image and UID/GID mapping + +Runtime speed is not affected. Only __podman create__ and the container creation phases of +__podman run__ and __podman build__ are affected. +For more details, see [GitHub comment](https://github.com/containers/podman/issues/16541#issuecomment-1352790422). +Command-line options that modify the UID/GID mapping are for example __--userns__, __--uidmap__ and __--gidmap__. +The command-line option `--userns auto` is particularly affected by this performance penalty, +because different UID/GID mappings could potentially be used on each invocation. For other uses of +__--userns__, __--uidmap__ and __--gidmap__ the performance penalty is a one-time cost +that only occurs the first time the command is run. + +Using native overlayfs as an unprivileged user is available for Podman version >= 3.1 on a Linux kernel version >= 5.13. +If SELinux is not used, then Linux kernel version 5.11 or later is sufficient. +Native overlayfs support is included in RHEL >= 8.5, see [release notes](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/8.5_release_notes/index). + +To show the current storage driver + +``` +$ podman info -f {{.Store.GraphDriverName}} +overlay +$ podman info -f '{{index .Store.GraphStatus "Native Overlay Diff"}}' +true +``` + +Storage driver | Result of `podman info -f {{.Store.GraphDriverName}}` | Result of `podman info -f '{{index .Store.GraphStatus "Native Overlay Diff"}}` +---- | ------ | ----- +native overlayfs | overlay | true +fuse-overlayfs | overlay | false +VFS | vfs | false + +Before changing the storage driver, running `podman system reset` is required. +The command erases all containers and container images for the user. +See the example above "_Using a separate user account for benchmarking_" for how to benchmark a storage driver in a separate test account. + +#### Specifying the storage driver with command-line options + +Storage driver | Podman command +---- | ------ +native overlayfs | `podman --storage-driver=overlay run ...` +fuse-overlayfs | `podman --storage-driver=overlay --storage-opt overlay.mount_program=/usr/bin/fuse-overlayfs run ...` +VFS | `podman --storage-driver=vfs run ...` + +#### Configuring the default storage driver + +The default storage driver can be configured in +_/etc/containers/storage.conf_ and overridden by a user in +_~/.config/containers/storage.conf_ + +To configure native overlayfs: +``` +[storage] +driver = "overlay" +``` + +To configure fuse-overlayfs: +``` +[storage] +driver = "overlay" +[storage.options.overlay] +mount_program = "/usr/bin/fuse-overlayfs" +``` + +To configure VFS: +``` +[storage] +driver = "vfs" +``` + +See storage.conf(5) for all available configuration settings. + +### Network performance for rootless Podman + +When using rootless Podman, network traffic is normally passed through the network driver +[pasta](https://passt.top/passt/about/#pasta). This comes with a performance penalty. + +You can avoid using _pasta_ in the following ways: + +* Use socket activation for listening network sockets. Communication over the activated socket does not pass through + pasta, so it has the same performance characteristics as the normal network on the host. + Socket-activated services can be started and stopped in different ways: + + Let systemd start the service when the first client connects. Let the service terminate by itself after some time of inactivity. + Using a service on demand, can free up compute resources. + + Start the service explicitly (`systemctl --user enable foobar.service`). If the service is already + running when the first client connects, there will be no delay due to container startup. + The [socket activation tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/socket_activation.md) + provides more information about socket activation support in Podman. + +* Set up the network manually as root. Create a bridge and virtual ethernet pair (VETH). Note: compared to other methods, + this setup doesn't provide any network isolation. In containers granted CAP_NET_ADMIN or CAP_NET_RAW, processes can + open packet or raw sockets directly facing the host, which allows them to send arbitrary frames, including + crafted Ethernet and IP packets, as well as receiving packets that were not originally intended for the container, + by means of ARP spoofing. + For more information, see + + An [example](https://lists.podman.io/archives/list/podman@lists.podman.io/thread/W6MCYO6RY5YFRTSUDAOEZA7SC2EFXRZE/) posted on the Podman mailing list + + The section _DIY networking_ in [Podman-Rootless-Networking.pdf](https://containers.github.io/podman.io_old/old/community/meeting/notes/2021-10-05/Podman-Rootless-Networking.pdf) + +* Use `--network=host`. No network namespace is created. The container will use the host’s network. + Note: By using `--network=host`, the container is given full access to local system services such as D-bus and is therefore considered insecure. + +Side note: Pasta is faster than the network driver [slirp4netns](https://github.com/containers/podman/blob/main/docs/tutorials/basic_networking.md#slirp4netns). +Pasta is the default network driver since Podman 5.0.0. + +Since Podman 5.1.0 the default network driver can be shown with + +``` +$ podman info -f '{{.Host.RootlessNetworkCmd}}' +pasta +``` + +### Lazy pulling of container images + +Podman supports lazy pulling for the following container image formats: + +* __zstd:chunked__ + +* __eStargz__ + +__zstd:chunked__ has better performance than __eStargz__. + +See the article [_Pull container images faster with partial pulls_](https://www.redhat.com/sysadmin/faster-container-image-pulls) by Giuseppe Scrivano and Dan Walsh. + +### Choosing a host file system + +Lazy pulling of container images can run more efficiently when the file system has reflink support. The file systems XFS and BTRFS have reflink support. + +### Option --log-driver + +The `podman run` option [__--log-driver__](https://docs.podman.io/en/latest/markdown/podman-run.1.html#log-driver-driver) specifies the logging driver for the container. + +If logging is not needed, consider using `--log-driver=none` to disable logging. + +### Reuse the package repository cache when building container images + +The first step of a container build is often to download metadata from +the package repositories and post-process that data. + +To speed up container builds, you could prepare a directory on the host +that contains the package metadata and then make the directory available +to the container build by using an _overlay mount_. + +#### Example : Speed up _podman build_ by reusing the DNF metadata cache + +In this example the containers are based on Fedora 36. + +First create an empty directory on the host, for example *$HOME/dnf_cache_f36*. + +``` +$ mkdir $HOME/dnf_cache_f36 +``` + +Fill the directory with the most recent __dnf__ metadata cache. + +``` +$ podman run --rm -v $HOME/dnf_cache_f36:/var/cache/dnf:Z registry.fedoraproject.org/fedora:36 dnf makecache +``` + +Create a new directory, for example, _$HOME/ctr_ and a file _$HOME/ctr/Containerfile_ with these contents + +``` +FROM registry.fedoraproject.org/fedora:36 +RUN dnf -y update && dnf -y install cowsay && dnf clean all +``` + +To build the Containerfile using the prepared metadata cache, provide the directory _$HOME/dnf_cache_f36_ as an _overlay mount_ (volume option `:O`) + +``` +$ podman build -v $HOME/dnf_cache_f36:/var/cache/dnf:O -t cowsay $HOME/ctr +``` + +The article [_Speeding up container image builds with Buildah_](https://www.redhat.com/sysadmin/speeding-container-buildah) by Dan Walsh provides more details. diff --git a/versioned_docs/version-5.5.0/tutorials/podman-derivative-api.md b/versioned_docs/version-5.5.0/tutorials/podman-derivative-api.md new file mode 100644 index 000000000..0de3c85ed --- /dev/null +++ b/versioned_docs/version-5.5.0/tutorials/podman-derivative-api.md @@ -0,0 +1,60 @@ +--- +title: How to use libpod for custom/derivative projects +version: v5.5.0 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +# How to use libpod for custom/derivative projects + +libpod today is a Golang library and a CLI. The choice of interface you make has advantages and disadvantages. + +Using the REST API +--- + +Advantages: + + - Stable, versioned API + - Language-agnostic + - [Well-documented](http://docs.podman.io/en/latest/_static/api.html) API + +Disadvantages: + + - Error handling is less verbose than Golang API + - May be slower + +Running as a subprocess +--- + +Advantages: + + - Many commands output JSON + - Works with languages other than Golang + - Easy to get started + +Disadvantages: + + - Error handling is harder + - May be slower + - Can't hook into or control low-level things like how images are pulled + +Vendoring into a Go project +--- + +Advantages: + + - Significant power and control + +Disadvantages: + + - You are now on the hook for container runtime security updates (partially, `runc`/`crun` are separate) + - Binary size + - Potential skew between multiple libpod versions operating on the same storage can cause problems + +Making the choice +--- + +A good question to ask first is: Do you want users to be able to use `podman` to manipulate the containers created by your project? +If so, that makes it more likely that you want to run `podman` as a subprocess or using the HTTP API. If you want a separate image store and a fundamentally +different experience; if what you're doing with containers is quite different from those created by the `podman` CLI, +that may drive you towards vendoring. diff --git a/versioned_docs/version-5.5.0/tutorials/podman-for-windows.md b/versioned_docs/version-5.5.0/tutorials/podman-for-windows.md new file mode 100644 index 000000000..681fdbe98 --- /dev/null +++ b/versioned_docs/version-5.5.0/tutorials/podman-for-windows.md @@ -0,0 +1,426 @@ +--- +title: Documentation +version: v5.5.0 +--- + +![](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +Podman for Windows +================== + +While "containers are Linux," Podman also runs on Mac and Windows, where it +provides a native CLI and embeds a guest Linux system to launch your +containers. This guest is referred to as a Podman machine and is managed with +the `podman machine` command. On Windows, each Podman machine is backed by a +virtualized Windows Subsystem for Linux (WSLv2) distribution. The podman command +can be run directly from your Windows PowerShell (or CMD) prompt, where it +remotely communicates with the podman service running in the WSL environment. +Alternatively, you can access Podman directly from the WSL instance if you +prefer a Linux prompt and Linux tooling. In addition to command-line access, +Podman also listens for Docker API clients, supporting direct usage of +Docker-based tools and programmatic access from your language of choice. + +Prerequisites +------------- + +Since Podman uses WSL, you need a recent release of Windows 10 or Windows 11. +On x64, WSL requires build 18362 or later, and 19041 or later is required for +arm64 systems. Internally, WSL uses virtualization, so your system must +support and have hardware virtualization enabled. If you are running Windows +on a VM, you must have a VM that supports nested virtualization. + +It is also recommended to install the modern "Windows Terminal," which +provides a superior user experience to the standard PowerShell and CMD +prompts, as well as a WSL prompt, should you want it. + +You can install it by searching the Windows Store or by running the following +`winget` command: + +`winget install Microsoft.WindowsTerminal` + + +Installing Podman +----------------- + +Installing the Windows Podman client begins by downloading the Podman Windows +installer. The Windows installer is built with each Podman release and can be +downloaded from the official + [GitHub release page](https://github.com/containers/podman/releases). +Be sure to download a 4.1 or later release for the capabilities discussed +in this guide. + +*[Image: Installing Podman 4.1.0]* + +Once downloaded, simply run the EXE file, and relaunch a new terminal. After +this point, podman.exe will be present on your PATH, and you will be able to run +the `podman machine init` command to create your first machine. + +`PS C:\Users\User> podman machine init` + +Automatic WSL Installation +-------------------------- + +If WSL has not been installed on your system, the first machine init command +will prompt a dialog to begin an automated install. If accepted, this process +will install the necessary Windows components, restart the system, and after +login, relaunch the machine creation process in a terminal window. Be sure to +wait a minute or two for the relaunch to occur, as Windows has a delay before +executing startup items. Alternatively, you can decline automatic installation +and install WSL manually. However, this will require additional download and +setup time. + +Machine Init Process +-------------------- + +After WSL is installed, the init command will install a minimal installation +of Fedora, customizing it to run podman. + +``` +PS C:\Users\User> podman machine init +Extracting compressed file +Importing operating system into WSL (this may take 5+ minutes on a new WSL install)... +Installing packages (this will take a while)... +Complete! +Configuring system... +Generating public/private ed25519 key pair. +Your identification has been saved in podman-machine-default +Your public key has been saved in podman-machine-default.pub +The key fingerprint is: +SHA256:RGTGg2Q/LX7ijN+mzu8+BzcS3cEWP6Hir6pYllJtceA root@WINPC +Machine init complete +To start your machine run: + + podman machine start +``` + + +Starting Machine +---------------- + +After the machine init process completes, it can then be started and stopped +as desired: + +``` +PS C:\Users\User> podman machine start + +Starting machine "podman-machine-default" + +This machine is currently configured in rootless mode. If your containers +require root permissions (e.g. ports < 1024), or if you run into compatibility +issues with non-podman clients, you can switch using the following command: + + podman machine set --rootful + +API forwarding listening on: npipe:////./pipe/docker_engine + +Docker API clients default to this address. You do not need to set DOCKER_HOST. +Machine "podman-machine-default" started successfully +``` + +First Podman Command +-------------------- + +From this point on, podman commands operate similarly to how they would on +Linux. + +For a quick working example with a small image, you can run the Linux date +command on PowerShell. + +``` +PS C:\Users\User> podman run ubi8-micro date +Thu May 5 21:56:42 UTC 2022 +``` + +Port Forwarding +--------------- + +Port forwarding also works as expected; ports will be bound against localhost +(127.0.0.1). Note: When running as rootless (the default), you must use a port +greater than 1023. See the Rootful and Rootless section for more details. + +To launch httpd, you can run: + +``` +PS C:\Users\User> podman run --rm -d -p 8080:80 --name httpd docker.io/library/httpd +f708641300564a6caf90c145e64cd852e76f77f6a41699478bb83a162dceada9 +``` + +A curl command against localhost on the PowerShell prompt will return a +successful HTTP response: + +``` +PS C:\Users\User> curl http://localhost:8080/ -UseBasicParsing + +StatusCode : 200 +StatusDescription : OK +Content :

It works!

+``` + +As with Linux, to stop, run: + +`podman stop httpd` + + +Using API Forwarding +-------------------- + +API forwarding allows Docker API tools and clients to use podman as if it was +Docker. Provided there is no other service listening on the Docker API pipe; +no special settings will be required. + +``` +PS C:\Users\User> .\docker.exe run -it fedora echo "Hello Podman!" +Hello Podman! +``` + +Otherwise, after starting the machine, you will be notified of an environment +variable you can set for tools to point to podman. Alternatively, you can shut +down both the conflicting service and podman, then finally run `podman machine +start` to restart, which should grab the Docker API address. + + +``` +Another process was listening on the default Docker API pipe address. +You can still connect Docker API clients by setting DOCKER HOST using the +following PowerShell command in your terminal session: + + $Env:DOCKER_HOST = 'npipe:////./pipe/podman-machine-default' + +Or in a classic CMD prompt: + + set DOCKER_HOST=npipe:////./pipe/podman-machine-default + +Alternatively, terminate the other process and restart podman machine. +Machine "podman-machine-default" started successfully + +PS C:\Users\User> $Env:DOCKER_HOST = 'npipe:////./pipe/podman-machine-default' +PS C:\Users\User>.\docker.exe version --format '{{(index .Server.Components 0).Name}}' +Podman Engine +``` + +Rootful & Rootless +------------------ + +On the embedded WSL Linux distro, podman can either be run under the root user +(rootful) or a non-privileged user (rootless). For behavioral consistency with +Podman on Linux, rootless is the default. Note: Rootful and Rootless +containers are distinct and isolated from one another. Podman commands against +one (e.g., podman ps) will not represent results/state for the other. + +While most containers run fine in a rootless setting, you may find a case +where the container only functions with root privileges. If this is the case, +you can switch the machine to rootful by stopping it and using the set +command: + +``` +podman machine stop +podman machine set --rootful +``` + +To restore rootless execution, set rootful to false: + +``` +podman machine stop +podman machine set --rootful=false +``` + +Another case in which you may wish to use rootful execution is binding a port +less than 1024. However, future versions of podman will likely drop this to a +lower number to improve compatibility with defaults on system port services (such +as MySQL) + +Volume Mounting +--------------- + +New in Podman v4.1 is the ability to perform volume mounts from Windows paths into a +Linux container. This supports several notation schemes, including: + +Windows Style Paths: + +`podman run --rm -v c:\Users\User\myfolder:/myfolder ubi8-micro ls /myfolder` + +Unixy Windows Paths: + +`podman run --rm -v /c/Users/User/myfolder:/myfolder ubi8-micro ls /myfolder` + +Linux paths local to the WSL filesystem: + +`podman run --rm -v /var/myfolder:/myfolder ubi-micro ls /myfolder` + +All of the above conventions work, whether running on a Windows prompt or the +WSL Linux shell. Although when using Windows paths on Linux, appropriately quote +or escape the Windows path portion of the argument. + + +Listing Podman Machine(s) +------------------------- + +To list the available podman machine instances and their current resource +usage, use the `podman machine ls` command: + +``` +PS C:\Users\User> podman machine ls + + +NAME VM TYPE CREATED LAST UP CPUS MEMORY DISK SIZE +podman-machine-default wsl 2 hours ago Currently running 4 331.1MB 768MB +``` + +Since WSL shares the same virtual machine and Linux kernel across multiple +distributions, the CPU and Memory values represent the total resources shared +across running systems. The opposite applies to the Disk value. It is +independent and represents the amount of storage for each individual +distribution. + + +Accessing the Podman Linux Environment +-------------------------------------- + +While using the podman.exe client on the Windows environment provides a +seamless native experience supporting the usage of local desktop tools and +APIs, there are a few scenarios in which you may wish to access the Linux +environment: + ++ Updating to the latest stable packages on the embedded Fedora instance ++ Using Linux development tools directly ++ Using a workflow that relies on EXT4 filesystem performance or behavior + semantics + +There are three mechanisms to access the embedded WSL distribution: +1. SSH using `podman machine ssh` +2. WSL command on the Windows PowerShell prompt +3. Windows Terminal Integration + +### Using SSH + +SSH access provides a similar experience as Podman on Mac. It immediately +drops you into the appropriate user based on your machine's rootful/rootless +configuration (root in the former, 'user' in the latter). The --username +option can be used to override with a specific user. + +An example task using SSH is updating your Linux environment to pull down the +latest OS bugfixes: + +`podman machine ssh sudo dnf upgrade -y` + +### Using the WSL Command + +The `wsl` command provides direct access to the Linux system but enters the +shell as root first. This is due to design limitations of WSL, where running +systemd (Linux's system services) requires the usage of a privileged process +namespace. + +Unless you have no other distributions of WSL installed, it's recommended to +use the `-d` option with the name of your podman machine (podman-machine-default +is the default) + +``` +PS C:\Users\User> wsl -d podman-machine-default +``` + +You will be automatically entered into a nested process namespace where +systemd is running. If you need to access the parent namespace, hit `ctrl-d` +or type exit. This also means to log out, you need to exit twice. + +``` +[root@WINPC /]# podman --version +podman version 4.1.0 +``` + + +To access commands as the non-privileged user (rootless podman), you must +first type `su user`. Alternatively, you can prefix the `wsl` command to use the +special `enterns`: + +``` +wsl -d podman-machine-default enterns su user +[user@WINPC /]$ id +uid=1000(user) gid=1000(user) groups=1000(user),10(wheel) +``` + +Likewise, running commands as root without entering a prompt should also be +prefixed with `enterns`. + +`wsl -d podman-machine-default enterns systemctl status` + +Accessing the WSL instance as a specific user using `wsl -u` or using inline +commands without `enterns` is not recommended since commands will execute +against the incorrect namespace. + +### Using Windows Terminal Integration + +Entering WSL as root is a 2-click operation. Simply click the drop-down tag, +and pick 'podman-machine-default,' where you will be entered directly as root. + +*[Image: Using WSL in Windows Terminal]* + +As before, to switch to a non-privileged user for rootless podman commands, +type `su user`. + +``` +[root@WINPC /]# su user +[user@WINPC /]$ podman info --format '{{.Store.RunRoot}}' +/run/user/1000/containers +``` + +Stopping a Podman Machine +------------------------- + +To stop a running podman machine, use the `podman machine stop` command: + +``` +PS C:\Users\User> podman machine stop +Machine "podman-machine-default" stopped successfully +``` + +Removing a Podman Machine +------------------------- + +To remove a machine, use the `podman machine rm` command: + +``` +PS C:\Users\User> podman machine rm + +The following files will be deleted: + +C:\Users\User\.ssh\podman-machine-default +C:\Users\User\.ssh\podman-machine-default.pub +C:\Users\User\.local\share\containers\podman\machine\wsl\podman-machine-default_fedora-35-x86_64.tar +C:\Users\User\.config\containers\podman\machine\wsl\podman-machine-default.json +C:\Users\User\.local\share\containers\podman\machine\wsl\wsldist\podman-machine-default + + +Are you sure you want to continue? [y/N] y +``` + + + +Troubleshooting +--------------- + +Recovering from a failed auto-installation of WSL + +If auto-install fails and retrying is unsuccessful, you can attempt to reset +your WSL system state and perform a manual WSL installation using the `wsl +--install` command. To do so, perform the following steps: + +1. Launch PowerShell as administrator + ``` + Start-Process powershell -Verb RunAs + ``` +2. Disable WSL Features + ``` + dism.exe /online /disable-feature /featurename:Microsoft-Windows-Subsystem-Linux /norestart + dism.exe /online /disable-feature /featurename:VirtualMachinePlatform /norestart + ``` +3. Reboot +4. Run manual WSL install + ``` + wsl --install + ``` +5. Continue with podman machine init + +Install Certificate Authority +============================= + +Instructions for installing a CA certificate can be found [here](podman-install-certificate-authority.md). diff --git a/versioned_docs/version-5.5.0/tutorials/podman-install-certificate-authority.md b/versioned_docs/version-5.5.0/tutorials/podman-install-certificate-authority.md new file mode 100644 index 000000000..0b992a538 --- /dev/null +++ b/versioned_docs/version-5.5.0/tutorials/podman-install-certificate-authority.md @@ -0,0 +1,114 @@ +--- +title: Documentation +version: v5.5.0 +--- + +*[Image: PODMAN logo]* + +Install Certificate Authority +============================= + +Organizations may create their own local certificate authority (CA) or acquire one from a third party. This may mean more than one certificate, such as one or more intermediate certificates and a root certificate, for example. In any case, it is necessary to add the certificate authority (CA) certificate(s) so that it can be employed for various use cases. + +### Method one + +Certificates may be either individual or concatenated (bundles). The following steps are one method to add such certificates to Podman. It is assumed that Podman is running and the certificate(s) to be installed are available on an accessible server via curl. If such access is not possible, an alternative method follows. + +First, assuming a running Podman machine, ssh into the machine: +``` +podman machine ssh +``` + +If Podman is running in the default rootless mode, an additional command is required to get to a root shell: + +``` +[core@localhost ~]$ sudo su - +``` + +After issuing the above command, the prompt should change to indicate the "root" instead of the "core" user. + +Next, while in the machine, change to the directory where the certificate(s) should be installed: +``` +[root@localhost ~]# cd /etc/pki/ca-trust/source/anchors +``` + +Then use curl to download the certificate. Notes: +* The -k is only necessary if connecting securely to a server for which the certificate is not yet trusted +* The MY-SERVER.COM/SOME-CERTIFICATE.pem should be replaced as appropriate +``` +[root@localhost anchors]# curl -k -o some-certificate.pem https://MY-SERVER.COM/SOME-CERTIFICATE.pem +``` + +Repeat as necessary for multiple certificates. + +Once all of the certificates have been downloaded, run the command to add the certificates to the list of trusted CAs: +``` +[root@localhost anchors]# update-ca-trust +``` + +Exit the machine: +``` +[root@localhost anchors]# exit +``` + +If the "sudo su -" command was used to switch to a root shell as described above, an additional exit command is needed to exit the machine: + +``` +[core@localhost ~]$ exit +``` + +If the certificates are still not accepted, it might be necessary to restart the Podman machine. To do this, issue the following commands on the host (and not inside the Podman machine): + +``` +podman machine stop +podman machine start +``` + +### Alternative Method + +If the above method is for some reason not practical or desirable, the certificate may be created using vi. + +As above, assuming a running Podman machine, ssh into the machine: + +``` +podman machine ssh +``` + +If the prompt starts with "core" instead of "root", switch to a root shell: + +``` +[core@localhost ~]$ sudo su - +``` + +Next, change to the directory where the certificate(s) should be installed: +``` +[root@localhost ~]# cd /etc/pki/ca-trust/source/anchors +``` + +Then use vi to create the certificate. +``` +[root@localhost ~]# vi SOME-CERTIFICATE.pem +``` +After vi opens, copy the certificate to the clipboard, then in insert mode, paste the clipboard contents to vi. Lastly, save the file and close vi. + +Repeat as necessary for multiple certificates. + +Once all of the certificates have been created, run the command to add the certificates to the list of trusted CAs: +``` +[root@localhost anchors]# update-ca-trust +``` + +Exit the machine: +``` +[root@localhost anchors]# exit +``` + +If the "sudo su -" command described above was used, an additional exit command is needed: + +``` +[core@localhost ~]$ exit +``` + +### Final Notes + +The certificate installation will persist during machine restarts. There is no need to stop and start the machine to begin using the certificate. diff --git a/versioned_docs/version-5.5.0/tutorials/podman_tutorial.md b/versioned_docs/version-5.5.0/tutorials/podman_tutorial.md new file mode 100644 index 000000000..1f0e51948 --- /dev/null +++ b/versioned_docs/version-5.5.0/tutorials/podman_tutorial.md @@ -0,0 +1,149 @@ +--- +title: Basic Setup and Use of Podman +version: v5.5.0 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +# Basic Setup and Use of Podman +Podman is a utility provided as part of the libpod library. It can be used to create and maintain +containers. The following tutorial will teach you how to set up Podman and perform some basic +commands with Podman. + +If you are running on a Mac or Windows PC, you should instead follow the [Mac and Windows tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) +to set up the remote Podman client. + +**NOTE**: the code samples are intended to be run as a non-root user, and use `sudo` where +root escalation is required. + +## Installing Podman + +For installing or building Podman, see the [installation instructions](https://podman.io/getting-started/installation). + +## Familiarizing yourself with Podman + +### Running a sample container +This sample container will run a very basic httpd server (named basic_httpd) that serves only its index +page. +```console +podman run --name basic_httpd -dt -p 8080:80/tcp docker.io/nginx +``` +Because the container is being run in detached mode, represented by the *-d* in the `podman run` command, Podman +will print the container ID after it has run. Note that we use port forwarding to be able to +access the HTTP server. For successful running at least slirp4netns v0.3.0 is needed. + +### Listing running containers +The Podman *ps* command is used to list creating and running containers. +```console +podman ps +``` + +Note: If you add *-a* to the *ps* command, Podman will show all containers. +### Inspecting a running container +You can "inspect" a running container for metadata and details about itself. We can even use +the inspect subcommand to see what IP address was assigned to the container. As the container is running in rootless mode, an IP address is not assigned and the value will be listed as "none" in the output from inspect. +```console +podman inspect basic_httpd | grep IPAddress\": + "SecondaryIPAddresses": null, + "IPAddress": "", +``` + +### Testing the httpd server +As we do not have the IP address of the container, we can test the network communication between the host +operating system and the container using curl. The following command should display the index page of our +containerized httpd server. +```console +curl http://localhost:8080 +``` + +### Viewing the container's logs +You can view the container's logs with Podman as well: +```console +podman logs +10.88.0.1 - - [07/Feb/2018:15:22:11 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:30 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:30 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:31 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:31 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +``` + +### Viewing the container's pids +And you can observe the httpd pid in the container with *top*. +```console +podman top + UID PID PPID C STIME TTY TIME CMD + 0 31873 31863 0 09:21 ? 00:00:00 nginx: master process nginx -g daemon off; + 101 31889 31873 0 09:21 ? 00:00:00 nginx: worker process +``` + +### Checkpointing the container +Checkpointing a container stops the container while writing the state of all processes in the container to disk. +With this a container can later be restored and continue running at exactly the same point in time as the +checkpoint. This capability requires CRIU 3.11 or later installed on the system. +This feature is not supported as rootless; as such, if you wish to try it, you'll need to re-create your container as root, using the same command but with sudo. + +To checkpoint the container use: +```console +sudo podman container checkpoint +``` + +### Restoring the container +Restoring a container is only possible for a previously checkpointed container. The restored container will +continue to run at exactly the same point in time it was checkpointed. +To restore the container use: +```console +sudo podman container restore +``` + +After being restored, the container will answer requests again as it did before checkpointing. +```console +curl http://:8080 +``` + +### Migrate the container +To live migrate a container from one host to another the container is checkpointed on the source +system of the migration, transferred to the destination system and then restored on the destination +system. When transferring the checkpoint, it is possible to specify an output-file. + +On the source system: +```console +sudo podman container checkpoint -e /tmp/checkpoint.tar.gz +scp /tmp/checkpoint.tar.gz :/tmp +``` + +On the destination system: +```console +sudo podman container restore -i /tmp/checkpoint.tar.gz +``` + +After being restored, the container will answer requests again as it did before checkpointing. This +time the container will continue to run on the destination system. +```console +curl http://:8080 +``` + +### Stopping the container +To stop the httpd container: +```console +podman stop +``` +You can also check the status of one or more containers using the *ps* subcommand. In this case, we should +use the *-a* argument to list all containers. +```console +podman ps -a +``` + +### Removing the container +To remove the httpd container: +```console +podman rm +``` +You can verify the deletion of the container by running *podman ps -a*. + +## Integration Tests +For more information on how to set up and run the integration tests in your environment, checkout the Integration Tests [README.md](https://github.com/containers/podman/blob/main/test/README.md) + +## More information + +For more information on Podman and its subcommands, checkout the asciiart demos on the [README.md](https://github.com/containers/podman/blob/main/README.md#commands) +page. diff --git a/versioned_docs/version-5.5.0/tutorials/podman_tutorial_cn.md b/versioned_docs/version-5.5.0/tutorials/podman_tutorial_cn.md new file mode 100644 index 000000000..fdcbb7d2b --- /dev/null +++ b/versioned_docs/version-5.5.0/tutorials/podman_tutorial_cn.md @@ -0,0 +1,175 @@ +--- +title: Documentation +version: v5.5.0 +--- + +> - 译文出自：[掘金翻译计划](https://juejin.cn/translate) + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +Podman是由libpod库提供一个实用的程序，可以被用于创建和管理容器。 + +下面的教程会教你如何启动 Podman 并使用 Podman 执行一些基本的命令。 + +如果你正在使用 Mac 或者 Windows +，你应该先查看[Mac 和 Windows 使用说明](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md)来设置 Podman +远程客户端。 + +**注意**：示例中所有命令皆以非 root 的用户运行，必要的时候通过 `sudo` 命令来获取 root 权限。 + +## 安装Podman + +安装或者编译 Podman ，请参照[安装说明](https://podman.io/getting-started/installation)。 + +## 熟悉podman + +### 运行一个示例容器 + +这个示例容器会运行一个简单的只有主页的 httpd 服务器。 + +```console +podman run --name basic_httpd -dt -p 8080:80/tcp docker.io/nginx +``` + +因为命令中的 *-d* 参数表明容器以 "detached" 模式运行，所以 Podman 会在容器运行后打印容器的 ID。 + +注意为了访问这个 HTTP 服务器，我们将使用端口转发。成功运行需要 slirp4netns 的 v0.3.0+ 版本。 + +Podman 的 *ps* 命令用于列出正在创建和运行的容器。 + +```console +podman ps +``` + +**注意**：如果为 *ps* 命令添加 *-a* 参数，Podman 将展示所有的容器。 + +### 查看正在运行的容器 + +你可以 "inspect" (查看)一个正在运行的容器的元数据以及其他详细信息。我们甚至可以使用 inspect 的子命令查看分配给容器的 IP 地址。由于容器以非 root 模式运行，没有分配 IP 地址，inspect 的输出会是 " +none" 。 + +```console +podman inspect -l | grep IPAddress\": + "SecondaryIPAddresses": null, + "IPAddress": "", +``` + +**注意**：*-l* 参数是**最近的容器**的指代，你也可以使用容器的ID 代替 *-l* + +### 测试httpd服务器 + +由于我们没有容器的 IP 地址，我们可以使用 curl 测试主机和容器之间的网络通信。下面的命令应该显示我们的容器化 httpd 服务器 的主页。 + +```console +curl http://localhost:8080 +``` + +### 查看容器的日志 + +你也可以使用 podman 查看容器的日志 + +```console +podman logs --latest +10.88.0.1 - - [07/Feb/2018:15:22:11 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:30 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:30 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:31 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:31 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +``` + +### 查看容器中的进程pid + +你可以使用 *top* 命令查看容器中 httpd 的 pid + +```console +podman top + UID PID PPID C STIME TTY TIME CMD + 0 31873 31863 0 09:21 ? 00:00:00 nginx: master process nginx -g daemon off; + 101 31889 31873 0 09:21 ? 00:00:00 nginx: worker process +``` + +### 设置容器的检查点 + +设置检查点会在停止容器的同时把容器中所有进程的状态写入磁盘。 + +有了它，容器后续可以被恢复，并在与检查点完全相同的时间点继续运行。 这个功能需要在系统上安装 CRIU 的 3.11+ 版本。 + +这个功能不支持非 root 模式，因此，如果你想尝试使用它，你需要使用 sudo 方式重新创建容器。 + +设置容器检查点请使用： + +```console +sudo podman container checkpoint +``` + +### 恢复容器 + +恢复容器只能在以前设置过检查点的容器上使用。恢复的容器会在与设置检查点时完全相同的时间点继续运行。 + +恢复容器请使用： + +```console +sudo podman container restore +``` + +恢复之后。容器会像设置检查点之前一样回复请求 + +```console +curl http://:8080 +``` + +### 迁移容器 + +为了将容器从一个主机上热迁移到另一个主机，容器可以在在源系统上创建检查点，传输到目的系统，然后再在目的系统上恢复。 +为了便于传输容器的检查点，可以将其存储在一个指定的输出文件中。 + +在源系统上： + +```console +sudo podman container checkpoint -e /tmp/checkpoint.tar.gz +scp /tmp/checkpoint.tar.gz :/tmp +``` + +在目标系统上： + +```console +sudo podman container restore -i /tmp/checkpoint.tar.gz +``` + +恢复之后，容器会像设置检查点之前一样回复请求。这时，容器会在目标系统上继续运行。 + +```console +curl http://:8080 +``` + +### 停止容器 + +停止 httpd 容器 + +```console +podman stop --latest +``` + +你还可以使用 *ps* 命令检查一个或多个容器的状态，在这个例子中，我们使用 *-a* 参数列出所有的容器。 + +```console +podman ps -a +``` + +### 移除容器 + +移除 httpd 容器 + +```console +podman rm --latest +``` + +你可以使用 *podman ps -a* 验证容器的删除。 + +## 集成测试 + +在环境中如何设置并运行集成测试请查看集成测试的[自述页面](https://github.com/containers/podman/blob/main/test/README.md) + +## 更多信息 + +有关podman 和它的子命令的更多信息请查看 podman 的[自述页面](https://github.com/containers/podman/blob/main/README.md#commands) diff --git a/versioned_docs/version-5.5.0/tutorials/qemu-remote-tutorial.md b/versioned_docs/version-5.5.0/tutorials/qemu-remote-tutorial.md new file mode 100644 index 000000000..a32551497 --- /dev/null +++ b/versioned_docs/version-5.5.0/tutorials/qemu-remote-tutorial.md @@ -0,0 +1,137 @@ +--- +title: Podman-remote client for Windows with QEMU VM +version: v5.5.0 +--- + +# Podman-remote client for Windows with QEMU VM + +*** +**_NOTE:_** For running Podman on Windows, refer to the [Podman for Windows](podman-for-windows.md) guide, which uses the recommended approach of a Podman-managed Linux backend. For Mac, see the [Podman installation instructions](https://podman.io/getting-started/installation). This guide covers the advanced usage of Podman with a custom Linux VM. +*** + +## Introduction + +This is an experimental setup using QEMU VM for running Podman for the already supported [Podman-remote](https://docs.podman.io/en/latest/markdown/podman-remote.1.html) client on Windows. +The officially supported and recommended way of running Podman on Windows is using [Podman machine](https://docs.podman.io/en/latest/markdown/podman-machine.1.html). + +## Prerequisites + +* Windows 10 Build 18362 or later (Build 19044/Version 21H2 or later recommended) +* SSH client feature installed on the machine +* Hyper-V acceleration should be operational on the machine +* Directory `C:\qemu-remote\` will be used for storing needed assets +* Port `57561` is free to use for ssh over a loopback interface + +## Obtaining and installing + +### QEMU + +Download QEMU (7.2.0 minimal) from https://qemu.weilnetz.de/w64/ + +Then download the Fedora CoreOS (FCOS) image for QEMU from https://getfedora.org/coreos/download?tab=metal_virtualized&stream=testing&arch=x86_64 + +One will need `.xz` format extraction tool like xz itself or 7-zip. Use it to extract the `.qcow2` image to C:\qemu-remote\fedora-coreos-37.20221127.2.0-qemu.x86_64.qcow2 + +With xz the command line (when run from the same directory) will be +``` +xz -d fedora-coreos-37.20221127.2.0-qemu.x86_64.qcow2.xz +``` + +### Podman + +Download and install the latest release of Podman for Windows. Podman releases can be obtained from the official Podman GitHub release page: https://github.com/containers/podman/releases + +#### Older Podman releases + +When using older Podman releases (4.3.x and earlier), where `gvproxy.exe` is missing from the installation directory, +it could be obtained from the official releases https://github.com/containers/gvisor-tap-vsock/releases +One would need version `0.5.0` or a more recent release. Download `gvproxy-windows.exe` and copy it to +the Podman installation directory (or any other location, which is added to the PATH environment variable) +renaming the binary to `gvproxy.exe`. + +### SSH + +Generate ssh keys with an empty passphrase + +ssh-keygen -t ed25519 -f C:\qemu-remote\remote + +### Ignition for FCOS + +Create ignition file C:\qemu-remote\remote.ign with the content of +``` +{"ignition":{"config":{"replace":{"verification":{}}},"proxy":{},"security":{"tls":{}},"timeouts":{},"version":"3.2.0"},"passwd":{"users":[{"name":"core","sshAuthorizedKeys":["YOURSSHKEYHERE"],"uid":501},{"name":"root","sshAuthorizedKeys":["YOURSSHKEYHERE"]}]},"storage":{"directories":[{"group":{"name":"core"},"path":"/home/core/.config","user":{"name":"core"},"mode":493},{"group":{"name":"core"},"path":"/home/core/.config/containers","user":{"name":"core"},"mode":493},{"group":{"name":"core"},"path":"/home/core/.config/systemd","user":{"name":"core"},"mode":493},{"group":{"name":"core"},"path":"/home/core/.config/systemd/user","user":{"name":"core"},"mode":493},{"group":{"name":"core"},"path":"/home/core/.config/systemd/user/default.target.wants","user":{"name":"core"},"mode":493},{"group":{"name":"root"},"path":"/etc/containers/registries.conf.d","user":{"name":"root"},"mode":493},{"group":{"name":"root"},"path":"/etc/systemd/system.conf.d","user":{"name":"root"},"mode":493},{"group":{"name":"root"},"path":"/etc/environment.d","user":{"name":"root"},"mode":493}],"files":[{"group":{"name":"core"},"path":"/home/core/.config/systemd/user/linger-example.service","user":{"name":"core"},"contents":{"source":"data:,%5BUnit%5D%0ADescription=A%20systemd%20user%20unit%20demo%0AAfter=network-online.target%0AWants=network-online.target%20podman.socket%0A%5BService%5D%0AExecStart=%2Fusr%2Fbin%2Fsleep%20infinity%0A","verification":{}},"mode":484},{"group":{"name":"core"},"path":"/home/core/.config/containers/containers.conf","user":{"name":"core"},"contents":{"source":"data:,%5Bcontainers%5D%0Anetns=%22bridge%22%0A","verification":{}},"mode":484},{"group":{"name":"root"},"overwrite":true,"path":"/etc/subuid","user":{"name":"root"},"contents":{"source":"data:,core:100000:1000000","verification":{}},"mode":484},{"group":{"name":"root"},"overwrite":true,"path":"/etc/subgid","user":{"name":"root"},"contents":{"source":"data:,core:100000:1000000","verification":{}},"mode":484},{"group":{"name":"root"},"path":"/etc/systemd/system/user@.service.d/delegate.conf","user":{"name":"root"},"contents":{"source":"data:,%5BService%5D%0ADelegate=memory%20pids%20cpu%20io%0A","verification":{}},"mode":420},{"group":{"name":"core"},"path":"/var/lib/systemd/linger/core","user":{"name":"core"},"contents":{"verification":{}},"mode":420},{"group":{"name":"root"},"path":"/etc/containers/containers.conf","user":{"name":"root"},"contents":{"source":"data:,%5Bengine%5D%0Amachine_enabled=true%0A","verification":{}},"mode":420},{"group":{"name":"root"},"path":"/etc/containers/podman-machine","user":{"name":"root"},"contents":{"source":"data:,qemu%0A","verification":{}},"mode":420},{"group":{"name":"root"},"path":"/etc/containers/registries.conf.d/999-podman-machine.conf","user":{"name":"root"},"contents":{"source":"data:,unqualified-search-registries=%5B%22docker.io%22%5D%0A","verification":{}},"mode":420},{"group":{},"path":"/etc/tmpfiles.d/podman-docker.conf","user":{},"contents":{"source":"data:,L+%20%20%2Frun%2Fdocker.sock%20%20%20-%20%20%20%20-%20%20%20%20-%20%20%20%20%20-%20%20%20%2Frun%2Fpodman%2Fpodman.sock%0A","verification":{}},"mode":420},{"group":{"name":"root"},"path":"/etc/profile.d/docker-host.sh","user":{"name":"root"},"contents":{"source":"data:,export%20DOCKER_HOST=%22unix:%2F%2F$%28podman%20info%20-f%20%22%7B%7B.Host.RemoteSocket.Path%7D%7D%22%29%22%0A","verification":{}},"mode":420}],"links":[{"group":{"name":"core"},"path":"/home/core/.config/systemd/user/default.target.wants/linger-example.service","user":{"name":"core"},"hard":false,"target":"/home/core/.config/systemd/user/linger-example.service"},{"group":{"name":"root"},"overwrite":true,"path":"/usr/local/bin/docker","user":{"name":"root"},"hard":false,"target":"/usr/bin/podman"},{"group":{"name":"root"},"overwrite":false,"path":"/etc/localtime","user":{"name":"root"},"hard":false,"target":"\\usr\\share\\zoneinfo"}]},"systemd":{"units":[{"enabled":true,"name":"podman.socket"},{"contents":"[Unit]\nRequires=dev-virtio\\\\x2dports-vport1p1.device\nAfter=remove-moby.service sshd.socket sshd.service\nOnFailure=emergency.target\nOnFailureJobMode=isolate\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/bin/sh -c '/usr/bin/echo Ready \u003e/dev/vport1p1'\n[Install]\nRequiredBy=default.target\n","enabled":true,"name":"ready.service"},{"enabled":false,"mask":true,"name":"docker.service"},{"enabled":false,"mask":true,"name":"docker.socket"},{"contents":"[Unit]\nDescription=Remove moby-engine\n# Run once for the machine\nAfter=systemd-machine-id-commit.service\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/rpm-ostree override remove moby-engine\nExecStart=/usr/bin/rpm-ostree ex apply-live --allow-replacement\nExecStartPost=/bin/touch /var/lib/%N.stamp\n\n[Install]\nWantedBy=default.target\n","enabled":true,"name":"remove-moby.service"},{"contents":"[Unit]\nDescription=Environment setter from QEMU FW_CFG\n[Service]\nType=oneshot\nRemainAfterExit=yes\nEnvironment=FWCFGRAW=/sys/firmware/qemu_fw_cfg/by_name/opt/com.coreos/environment/raw\nEnvironment=SYSTEMD_CONF=/etc/systemd/system.conf.d/default-env.conf\nEnvironment=ENVD_CONF=/etc/environment.d/default-env.conf\nEnvironment=PROFILE_CONF=/etc/profile.d/default-env.sh\nExecStart=/usr/bin/bash -c '/usr/bin/test -f ${FWCFGRAW} \u0026\u0026\\\n\techo \"[Manager]\\n#Got from QEMU FW_CFG\\nDefaultEnvironment=$(/usr/bin/base64 -d ${FWCFGRAW} | sed -e \"s+|+ +g\")\\n\" \u003e ${SYSTEMD_CONF} ||\\\n\techo \"[Manager]\\n#Got nothing from QEMU FW_CFG\\n#DefaultEnvironment=\\n\" \u003e ${SYSTEMD_CONF}'\nExecStart=/usr/bin/bash -c '/usr/bin/test -f ${FWCFGRAW} \u0026\u0026 (\\\n\techo \"#Got from QEMU FW_CFG\"\u003e ${ENVD_CONF};\\\n\tIFS=\"|\";\\\n\tfor iprxy in $(/usr/bin/base64 -d ${FWCFGRAW}); do\\\n\t\techo \"$iprxy\" \u003e\u003e ${ENVD_CONF}; done ) || \\\n\techo \"#Got nothing from QEMU FW_CFG\"\u003e ${ENVD_CONF}'\nExecStart=/usr/bin/bash -c '/usr/bin/test -f ${FWCFGRAW} \u0026\u0026 (\\\n\techo \"#Got from QEMU FW_CFG\"\u003e ${PROFILE_CONF};\\\n\tIFS=\"|\";\\\n\tfor iprxy in $(/usr/bin/base64 -d ${FWCFGRAW}); do\\\n\t\techo \"export $iprxy\" \u003e\u003e ${PROFILE_CONF}; done ) || \\\n\techo \"#Got nothing from QEMU FW_CFG\"\u003e ${PROFILE_CONF}'\nExecStartPost=/usr/bin/systemctl daemon-reload\n[Install]\nWantedBy=sysinit.target\n","enabled":true,"name":"envset-fwcfg.service"}]}} +``` + +Replace "YOURSSHKEYHERE" with the actual pub keys you generated. + +## Launching + +### gvproxy + +One needs to run gvproxy first to make it ready for the QEMU VM launched afterward. Run it with the command below: +``` +gvproxy.exe -listen-qemu unix://C:/qemu-remote/vlan_remote.sock -pid-file C:\qemu-remote\proxy.pid -ssh-port 57561 -forward-sock C:\qemu-remote\podman.sock -forward-dest /run/user/501/podman/podman.sock -forward-user core -forward-identity C:\qemu-remote\remote +``` + +### QEMU + +Launch QEMU with the following command (the following configures it to use 4 CPUs and 8 GB RAM, but it could be adjusted for less): + +``` +qemu-system-x86_64w.exe -m 8192 -smp 4 -fw_cfg name=opt/com.coreos/config,file=C:\qemu-remote\remote.ign -netdev stream,id=vlan,server=off,addr.type=unix,addr.path=C:\qemu-remote\vlan_remote.sock -device virtio-net-pci,netdev=vlan,mac=5a:94:ef:e4:0c:ee -device virtio-serial -chardev socket,path=C:\qemu-remote\ready.sock,server=on,wait=off,id=apodman-machine-default_ready -device virtserialport,chardev=apodman-machine-default_ready,name=org.fedoraproject.port.0 -pidfile C:\qemu-remote\vm.pid -machine q35,accel=whpx:tcg -cpu max,vmx=off,monitor=off -drive if=virtio,file=C:\qemu-remote\fedora-coreos-37.20221127.2.0-qemu.x86_64.qcow2 +``` + +### First time launch extras + +Observe QEMU loading and wait for the message of SSH keys being provisioned to the machine. Next, before making the first ssh connection, one would need to add it to known hosts. +We are using `127.0.0.1` instead of `localhost` to force IPv4. + +``` +ssh-keyscan -p 57561 127.0.0.1 >> %USERPROFILE%\.ssh\known_hosts +``` + +### Add new connection to Podman + +Create a connection named "qemuremote" + +``` +podman system connection add --identity C:\qemu-remote\remote -p 57561 qemuremote ssh://core@127.0.0.1 +``` + +#### Optional + +Make it default for simplicity of operation/testing + +``` +podman system connection default qemuremote +``` + +## Using Podman + +Choose the active connection to be "qemuremote" (not needed if one made it default). + +Run some basic network enabled workload: + +``` +podman run -d --rm -p 8080:80 nginx +``` + +Test it with + +``` +curl http -v http://localhost:8080 +``` + +## Shutting down the machine + +The built-in machinery of Podman machine will not work for a custom machine. One needs to gracefully shut it down by connecting via SSH: + +``` +ssh -i C:\qemu-remote\remote -p 57561 core@127.0.0.1 +``` + +And then executing + +``` +sudo poweroff +``` diff --git a/versioned_docs/version-5.5.0/tutorials/remote_client.md b/versioned_docs/version-5.5.0/tutorials/remote_client.md new file mode 100644 index 000000000..ebd5e9dca --- /dev/null +++ b/versioned_docs/version-5.5.0/tutorials/remote_client.md @@ -0,0 +1,124 @@ +--- +title: Podman remote-client tutorial +version: v5.5.0 +--- + +# Podman remote-client tutorial + +## Introduction +The purpose of the Podman remote-client is to allow users to interact with a Podman "backend" while on a separate client. The command line interface of the remote client is exactly the same as the regular Podman commands with the exception of some flags being removed as they do not apply to the remote-client. + +The remote client takes advantage of a client-server model. You need Podman installed on a Linux machine or VM that also has the SSH daemon running. On the local operating system, when you execute a Podman command, Podman connects to the server via SSH. It then connects to the Podman service by using systemd socket activation, and hitting our [Rest API](https://docs.podman.io/en/latest/_static/api.html). The Podman commands are executed on the server. From the client's point of view, it seems like Podman runs locally. + +This tutorial is for running Podman remotely on Linux. If you are using a Mac or a Windows PC, please follow the [Mac and Windows tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) + +## Obtaining and installing Podman + +### Client machine +You will need either Podman or the podman-remote client. The difference between the two is that the compiled podman-remote client can only act as a remote client connecting to a backend, while Podman can run local, standard Podman commands, as well as act as a remote client (using `podman --remote`) + +If you already have Podman installed, you do not need to install podman-remote. + +You can find out how to [install Podman here](https://podman.io/getting-started/installation) + +If you would like to install only the podman-remote client, it is downloadable from its [release description page](https://github.com/containers/podman/releases/latest). You can also build it from source using the `make podman-remote` + + +### Server Machine +You will need to [install Podman](https://podman.io/getting-started/installation) on your server machine. + + +## Creating the first connection + +### Enable the Podman service on the server machine. + +Before performing any Podman client commands, you must enable the podman.sock SystemD service on the Linux server. In these examples, we are running Podman as a normal, unprivileged user, also known as a rootless user. By default, the rootless socket listens at `/run/user/${UID}/podman/podman.sock`. You can enable this socket permanently using the following command: +``` +systemctl --user enable --now podman.socket +``` +You will need to enable linger for this user in order for the socket to work when the user is not logged in: + +``` +sudo loginctl enable-linger $USER +``` +This is only required if you are not running Podman as root. + +You can verify that the socket is listening with a simple Podman command. + +``` +podman --remote info +host: + arch: amd64 + buildahVersion: 1.16.0-dev + cgroupVersion: v2 + conmon: + package: conmon-2.0.19-1.fc32.x86_64 +``` + +#### Enable sshd + +In order for the Podman client to communicate with the server you need to enable and start the SSH daemon on your Linux machine, if it is not currently enabled. +``` +sudo systemctl enable --now sshd +``` + +#### Setting up SSH +Remote Podman uses SSH to communicate between the client and server. The remote client works considerably smoother using SSH keys. To set up your ssh connection, you need to generate an ssh key pair from your client machine. *NOTE:* in some instances, using a `rsa` key will cause connection issues, be sure to create an `ed25519` key. +``` +ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 +``` +Your public key by default should be in your home directory under `~/.ssh/id_ed25519.pub`. You then need to copy the contents of `id_ed25519.pub` and append it into `~/.ssh/authorized_keys` on the Linux server. You can automate this using `ssh-copy-id`: +``` +ssh-copy-id -i ~/.ssh/id_ed25519.pub 192.168.122.1 +``` + +If you do not wish to use SSH keys, you will be prompted with each Podman command for your login password. + +## Using the client + +Note: `podman-remote` is equivalent to `podman --remote` here, depending on what you have chosen to install. + +The first step in using the Podman remote client is to configure a connection. + +You can add a connection by using the `podman-remote system connection add` command. + +``` +podman-remote system connection add myuser --identity ~/.ssh/id_ed25519 ssh://myuser@192.168.122.1/run/user/1000/podman/podman.sock +``` + +This will add a remote connection to Podman and if it is the first connection added, it will mark the connection as the default. You can observe your connections with `podman-remote system connection list`: + +``` +podman-remote system connection list +Name Identity URI +myuser* id_ed25519 ssh://myuser@192.168.122.1/run/user/1000/podman/podman.sock +``` + +Now we can test the connection with `podman info`: + +``` +podman-remote info +host: + arch: amd64 + buildahVersion: 1.16.0-dev + cgroupVersion: v2 + conmon: + package: conmon-2.0.19-1.fc32.x86_64 +``` + +Podman-remote has also introduced a “--connection” flag where you can use other connections you have defined. If no connection is provided, the default connection will be used. + +``` +podman-remote system connection --help +``` + +## Wrap up + +You can use the Podman remote clients to manage your containers running on a Linux server. The communication between client and server relies heavily on SSH connections and the use of SSH keys are encouraged. Once you have Podman installed on your remote client, you should set up a connection using `podman-remote system connection add` which will then be used by subsequent Podman commands. + +# Troubleshooting + +See the [Troubleshooting](https://github.com/containers/podman/blob/main/troubleshooting.md) document if you run into issues. + +## History +Adapted from the [Mac and Windows tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) diff --git a/versioned_docs/version-5.5.0/tutorials/rootless_tutorial.md b/versioned_docs/version-5.5.0/tutorials/rootless_tutorial.md new file mode 100644 index 000000000..8809db23b --- /dev/null +++ b/versioned_docs/version-5.5.0/tutorials/rootless_tutorial.md @@ -0,0 +1,221 @@ +--- +title: Basic Setup and Use of Podman in a Rootless environment. +version: v5.5.0 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +# Basic Setup and Use of Podman in a Rootless environment. + +Prior to allowing users without root privileges to run Podman, the administrator must install or build Podman and complete the following configurations. + +## Administrator Actions + +### Installing Podman + +For installing Podman, see the [installation instructions](https://podman.io/getting-started/installation). + +### Building Podman + +For building Podman, see the [build instructions](https://podman.io/getting-started/installation#building-from-scratch). + +### Networking configuration + +A user-mode networking tool for unprivileged network namespaces must be installed on the machine in order for Podman to run in a rootless environment. + +Podman supports two rootless networking tools: [pasta](https://passt.top/passt/about/#pasta) (provided by [passt](https://passt.top/passt/about/)) and [slirp4netns](https://github.com/rootless-containers/slirp4netns). + +pasta is the default since Podman 5.0, while slirp4netns was the default for previous versions. Passt is a more modern replacement for SLIRP that amongst other things fully supports IPv6 and is more secure architecturally (runs in a separate process, uses modern Linux mechanisms for isolation etc). + +Passt is [available on most Linux distributions](https://passt.top/passt/about/#availability) via their package distribution software such as `yum`, `dnf`, `apt`, `zypper`, etc. under the name `passt`. If the package is not available, you can build and install `passt` from [its upstream](https://passt.top/passt/about/#try-it). + +Alternatively, slirp4netns can be installed in the same fashion either from your distribution's repositories or by following [the instructions](https://github.com/rootless-containers/slirp4netns?tab=readme-ov-file#install) provided on its GitHub. + +The major user-facing difference between the two is outlined in [Shortcomings of Rootless Podman](https://github.com/containers/podman/blob/main/rootless.md?plain=1#L11) and expanded upon in **[podman-network(1)](https://github.com/containers/podman/blob/main/docs/source/markdown/podman-network.1.md#pasta)**. + +> [!note] +> pasta's default situation of not being being able to communicate between the container and the host has been fixed in Podman 5.3: see [Podman 5.3 changes for improved networking experience with pasta](https://blog.podman.io/2024/10/podman-5-3-changes-for-improved-networking-experience-with-pasta/). + +The default rootless networking tool can be selected in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** under the `[network]` section with `default_rootless_network_cmd`, which can be set to `pasta` (default) or `slirp4netns`. + +### `/etc/subuid` and `/etc/subgid` configuration + +Rootless Podman requires the user running it to have a range of UIDs listed in the files `/etc/subuid` and `/etc/subgid`. The `shadow-utils` or `newuid` package provides these files on different distributions and they must be installed on the system. Root privileges are required to add or update entries within these files. The following is a summary from the [How does rootless Podman work?](https://opensource.com/article/19/2/how-does-rootless-podman-work) article by Dan Walsh on [opensource.com](https://opensource.com) + +For each user that will be allowed to create containers, update `/etc/subuid` and `/etc/subgid` for the user with fields that look like the following. Note that the values for each user must be unique. If there is overlap, there is a potential for a user to use another user's namespace and they could corrupt it. + +``` +# cat /etc/subuid +johndoe:100000:65536 +test:165536:65536 +``` + +The format of this file is `USERNAME:UID:RANGE` + +* username as listed in `/etc/passwd` or in the output of [`getpwent`](https://man7.org/linux/man-pages/man3/getpwent.3.html). +* The initial UID allocated for the user. +* The size of the range of UIDs allocated for the user. + +This means the user `johndoe` is allocated UIDs 100000-165535 as well as their standard UID in the `/etc/passwd` file. NOTE: this is not currently supported with network installs; these files must be available locally to the host machine. It is not possible to configure this with LDAP or Active Directory. + +Rather than updating the files directly, the `usermod` program can be used to assign UIDs and GIDs to a user. + +``` +# usermod --add-subuids 100000-165535 --add-subgids 100000-165535 johndoe +grep johndoe /etc/subuid /etc/subgid +/etc/subuid:johndoe:100000:65536 +/etc/subgid:johndoe:100000:65536 +``` + +If you update either `/etc/subuid` or `/etc/subgid`, you need to stop all the running containers owned by the user and kill the pause process that is running on the system for that user. This can be done automatically by running [`podman system migrate`](https://github.com/containers/podman/blob/main/docs/source/markdown/podman-system-migrate.1.md) as that user. + +#### Giving access to additional groups + +Users can fully map additional groups to a container namespace if +those groups subordinated to the user: + +``` +# usermod --add-subgids 2000-2000 johndoe +grep johndoe /etc/subgid +``` + +This means the user `johndoe` can "impersonate" the group `2000` inside the +container. Note that it is usually not a good idea to subordinate active +user ids to other users, because it would allow user impersonation. + +`johndoe` can use `--group-add keep-groups` to preserve the additional +groups, and `--gidmap="+g102000:@2000"` to map the group `2000` in the host +to the group `102000` in the container: + +``` +$ podman run \ + --rm \ + --group-add keep-groups \ + --gidmap="+g102000:@2000" \ + --volume "$PWD:/data:ro" \ + --workdir /data \ + alpine ls -lisa +``` + +### Enable unprivileged `ping` + +(It is very unlikely that you will need to do this on a modern distro). + +Users running in a non-privileged container may not be able to use the `ping` utility from that container. + +If this is required, the administrator must verify that the UID of the user is part of the range in the `/proc/sys/net/ipv4/ping_group_range` file. + +To change its value the administrator can use a call similar to: `sysctl -w "net.ipv4.ping_group_range=0 2000000"`. + +To make the change persist, the administrator will need to add a file with the `.conf` file extension in `/etc/sysctl.d` that contains `net.ipv4.ping_group_range=0 $MAX_GID`, where `$MAX_GID` is the highest assignable GID of the user running the container. + + +## User Actions + +The majority of the work necessary to run Podman in a rootless environment is on the shoulders of the machine’s administrator. + +Once the Administrator has completed the setup on the machine and then the configurations for the user in `/etc/subuid` and `/etc/subgid`, the user can just start using any Podman command that they wish. + +### User Configuration Files + +The Podman configuration files for root reside in `/usr/share/containers` with overrides in `/etc/containers`. In the rootless environment they reside in `${XDG_CONFIG_HOME}/containers` and are owned by each individual user. + +Note: in environments without `XDG` environment variables, Podman internally sets the following defaults: + +- `$XDG_CONFIG_HOME` = `$HOME/.config` +- `$XDG_DATA_HOME` = `$HOME/.local/share` +- `$XDG_RUNTIME_DIR` = + - `/run/user/$UID` on `systemd` environments + - `$TMPDIR/podman-run-$UID` otherwise + +The three main configuration files are [containers.conf](https://github.com/containers/common/blob/main/docs/containers.conf.5.md), [storage.conf](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md) and [registries.conf](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md). The user can modify these files as they wish. + +#### containers.conf +Podman reads + +1. `/usr/share/containers/containers.conf` +2. `/etc/containers/containers.conf` +3. `${XDG_CONFIG_HOME}/containers/containers.conf` + +if they exist, in that order. Each file can override the previous for particular fields. + +#### storage.conf +For `storage.conf` the order is + +1. `/etc/containers/storage.conf` +2. `${XDG_CONFIG_HOME}/containers/storage.conf` + +In rootless Podman, certain fields in `/etc/containers/storage.conf` are ignored. These fields are: +``` +graphroot="" + container storage graph dir (default: "/var/lib/containers/storage") + Default directory to store all writable content created by container storage programs. + +runroot="" + container storage run dir (default: "/run/containers/storage") + Default directory to store all temporary writable content created by container storage programs. +``` +In rootless Podman these fields default to +``` +graphroot="${XDG_DATA_HOME}/containers/storage" +runroot="${XDG_RUNTIME_DIR}/containers" +``` +[\$XDG_RUNTIME_DIR](https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html#variables) defaults on most systems to `/run/user/$UID`. + +#### registries +Registry configuration is read in this order + +1. `/etc/containers/registries.conf` +2. `/etc/containers/registries.d/*` +3. `${XDG_CONFIG_HOME}/containers/registries.conf` + +The files in the home directory should be used to configure rootless Podman for personal needs. These files are not created by default. Users can copy the files from `/usr/share/containers` or `/etc/containers` and modify them. + +#### Authorization files +The default authorization file used by the `podman login` and `podman logout` commands is `${XDG_RUNTIME_DIR}/containers/auth.json`. + +### Using volumes + +Rootless Podman is not, and will never be, root; it's not a `setuid` binary, and gains no privileges when it runs. Instead, Podman makes use of a user namespace to shift the UIDs and GIDs of a block of users it is given access to on the host (via the `newuidmap` and `newgidmap` executables) and your own user within the containers that Podman creates. + +If your container runs with the root user, then `root` in the container is actually your user on the host. UID/GID 1 is the first UID/GID specified in your user's mapping in `/etc/subuid` and `/etc/subgid`, etc. If you mount a directory from the host into a container as a rootless user, and create a file in that directory as root in the container, you'll see it's actually owned by your user on the host. + +So, for example, + +``` +host$ whoami +john + +# a folder which is empty +host$ ls /home/john/folder +host$ podman run -it -v /home/john/folder:/container/volume mycontainer /bin/bash + +# Now I'm in the container +root@container# whoami +root +root@container# touch /container/volume/test +root@container# ls -l /container/volume +total 0 +-rw-r--r-- 1 root root 0 May 20 21:47 test +root@container# exit + +# I check again +host$ ls -l /home/john/folder +total 0 +-rw-r--r-- 1 john john 0 May 20 21:47 test +``` + +We do recognize that this doesn't really match how many people intend to use rootless Podman - they want their UID inside and outside the container to match. Thus, we provide the `--userns=keep-id` flag, which ensures that your user is mapped to its own UID and GID inside the container. + +It is also helpful to distinguish between running Podman as a rootless user, and a container which is built to run rootless. If the container you're trying to run has a `USER` which is not root, then when mounting volumes you **must** use `--userns=keep-id`. This is because the container user would not be able to become `root` and access the mounted volumes. + +Another consideration in regards to volumes: + +- When providing the path of a directory you'd like to bind-mount, the path needs to be provided as an absolute path + or a relative path that starts with `.` (a dot), otherwise the string will be interpreted as the name of a named volume. + +## More information + +If you are still experiencing problems running Podman in a rootless environment, please refer to the [Shortcomings of Rootless Podman](https://github.com/containers/podman/blob/main/rootless.md) page which lists known issues and solutions to known issues in this environment. + +For more information on Podman and its subcommands, follow the links on the main [README.md](https://github.com/containers/podman/blob/main/README.md#podman-information-for-developers) page or the [podman.io](https://podman.io) web site. diff --git a/versioned_docs/version-5.5.0/tutorials/socket_activation.md b/versioned_docs/version-5.5.0/tutorials/socket_activation.md new file mode 100644 index 000000000..05fc9c8a9 --- /dev/null +++ b/versioned_docs/version-5.5.0/tutorials/socket_activation.md @@ -0,0 +1,289 @@ +--- +title: Podman socket activation +version: v5.5.0 +--- + +# Podman socket activation + +Socket activation conceptually works by having systemd create a socket (e.g. TCP, UDP or Unix +socket). As soon as a client connects to the socket, systemd will start the systemd service that is +configured for the socket. The newly started program inherits the file descriptor of the socket +and can then accept the incoming connection (in other words run the system call `accept()`). +This description corresponds to the default systemd socket configuration +[`Accept=no`](https://www.freedesktop.org/software/systemd/man/systemd.socket.html#Accept=) +that lets the service accept the socket. + +Podman supports two forms of socket activation: + +* Socket activation of the API service +* Socket activation of containers + +## Socket activation of the API service + +The architecture looks like this + +``` mermaid +stateDiagram-v2 + [*] --> systemd: first client connects + systemd --> podman: socket inherited via fork/exec +``` + +The file _/usr/lib/systemd/user/podman.socket_ on a Fedora system defines the Podman API socket for +rootless users: + +``` +$ cat /usr/lib/systemd/user/podman.socket +[Unit] +Description=Podman API Socket +Documentation=man:podman-system-service(1) + +[Socket] +ListenStream=%t/podman/podman.sock +SocketMode=0660 + +[Install] +WantedBy=sockets.target +``` + +The socket is configured to be a Unix socket and can be started like this + +``` +$ systemctl --user start podman.socket +$ ls $XDG_RUNTIME_DIR/podman/podman.sock +/run/user/1000/podman/podman.sock +$ +``` +The socket can later be used by for instance __docker-compose__ that needs a Docker-compatible API + +``` +$ export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock +$ docker-compose up +``` + +When __docker-compose__ or any other client connects to the UNIX socket `$XDG_RUNTIME_DIR/podman/podman.sock`, +the service _podman.service_ is started. See its definition in the file _/usr/lib/systemd/user/podman.service_. + +## Socket activation of containers + +Since version 3.4.0 Podman supports socket activation of containers, i.e., passing +a socket-activated socket to the container. Thanks to the fork/exec model of Podman, the socket will be first +inherited by conmon and then by the OCI runtime and finally by the container +as can be seen in the following diagram: + + +``` mermaid +stateDiagram-v2 + [*] --> systemd: first client connects + systemd --> podman: socket inherited via fork/exec + state "OCI runtime" as s2 + podman --> conmon: socket inherited via double fork/exec + conmon --> s2: socket inherited via fork/exec + s2 --> container: socket inherited via exec +``` + +This type of socket activation can be used in systemd services that are generated from container unit files (see [podman-systemd.unit(5)](https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html)) (Note, quadlet requires the use of cgroup v2) or from the command [`podman generate systemd`](https://docs.podman.io/en/latest/markdown/podman-generate-systemd.1.html). +The container must also support socket activation. Not all software daemons support socket activation +but it's getting more popular. For instance Apache HTTP server, MariaDB, DBUS, PipeWire, Gunicorn, CUPS +all have socket activation support. + +### Example: socket-activated echo server container in a systemd service + +This example shows how to run the socket-activated echo server +[socket-activate-echo](https://github.com/eriksjolund/socket-activate-echo/pkgs/container/socket-activate-echo) +in a systemd user service. Podman version 4.4.0 or higher is required. + +Enable lingering for your regular user + +``` +$ loginctl enable-linger $USER +``` + +The command has these effects on your enabled systemd user units: + +* the units are automatically started after a reboot +* the units are not automatically stopped after you log out + +Create directories + +``` +$ mkdir -p ~/.config/systemd/user +$ mkdir -p ~/.config/containers/systemd +``` + +Create the file _~/.config/containers/systemd/echo.container_ with the file contents: + +``` +[Unit] +Description=Example echo service +Requires=echo.socket +After=echo.socket + +[Container] +Image=ghcr.io/eriksjolund/socket-activate-echo +Network=none + +[Install] +WantedBy=default.target +``` + +The file follows the syntax described in [__podman-systemd.unit__(5)](https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html). + +The `[Install]` section is optional. If you remove the two last lines, the _echo.service_ will not +be automatically started after a reboot. Instead, the _echo.service_ is started when the first +client connects to the socket. + +The line `Network=none` is optional. It improves security by removing network connectivity for the container. +The container can still be serving the internet because `Network=none` has no effect on activated sockets. + +A socket-activated service also requires a systemd socket unit. +Create the file _~/.config/systemd/user/echo.socket_ that defines the +sockets that the container should use + +``` +[Unit] +Description=Example echo socket + +[Socket] +ListenStream=127.0.0.1:3000 +ListenDatagram=127.0.0.1:3000 +ListenStream=[::1]:3000 +ListenDatagram=[::1]:3000 +ListenStream=%h/echo_stream_sock + +# VMADDR_CID_ANY (-1U) = 2^32 -1 = 4294967295 +# See "man vsock" +ListenStream=vsock:4294967295:3000 + +[Install] +WantedBy=sockets.target +``` + +`%h` is a systemd specifier that expands to the user's home directory. + +After editing the unit files, systemd needs to reload its configuration. + +``` +$ systemctl --user daemon-reload +``` + +While reloading its configuration systemd generates the unit _echo.service_ +from the file _~/.config/containers/systemd/echo.container_ +by executing the unit generator `/usr/lib/systemd/system-generators/podman-system-generator`. + +Optional: View the generated _echo.service_ to see the `podman run` command that +will be run. + +``` +$ systemctl --user cat echo.service +``` + +Configure systemd to automatically start _echo.socket_ after reboots. + +``` +$ systemctl --user enable echo.socket +``` + +Pull the container image beforehand + +``` +$ podman pull ghcr.io/eriksjolund/socket-activate-echo +``` + +Start the socket unit + +``` +$ systemctl --user start echo.socket +``` + +Test the echo server with the program __socat__ + +``` +$ echo hello | socat -t 30 - tcp4:127.0.0.1:3000 +hello +$ echo hello | socat -t 30 - tcp6:[::1]:3000 +hello +$ echo hello | socat -t 30 - udp4:127.0.0.1:3000 +hello +$ echo hello | socat -t 30 - udp6:[::1]:3000 +hello +$ echo hello | socat -t 30 - unix:$HOME/echo_stream_sock +hello +$ echo hello | socat -t 30 - VSOCK-CONNECT:1:3000 +hello +``` + +The option `-t 30` configures socat to use a timeout of 30 seconds when socat reads from the socket awaiting to get an EOF (End-Of-File). +As the container image has already been pulled, such a long timeout is not really needed. + +The echo server works as expected. It replies _"hello"_ after receiving the text _"hello"_. + +### Example: socket activate an Apache HTTP server with systemd-socket-activate + +Instead of setting up a systemd service to test out socket activation, an alternative is to use the command-line +tool [__systemd-socket-activate__](https://www.freedesktop.org/software/systemd/man/systemd-socket-activate.html#). + +Let's build a container image for the Apache HTTP server that is configured to support socket activation on port 8080. + +Create a new directory _ctr_ and a file _ctr/Containerfile_ with this contents + +``` +FROM docker.io/library/fedora +RUN dnf -y update && dnf install -y httpd && dnf clean all +RUN sed -i "s/Listen 80/Listen 127.0.0.1:8080/g" /etc/httpd/conf/httpd.conf +CMD ["/usr/sbin/httpd", "-DFOREGROUND"] +``` + +Build the container image + +``` +$ podman build -t socket-activate-httpd ctr +``` + +In one shell, start __systemd-socket-activate__. + +``` +$ systemd-socket-activate -l 8080 podman run --rm --network=none localhost/socket-activate-httpd +``` + +The TCP port number 8080 is given as an option to __systemd-socket-activate__. The __--publish__ (__-p__) +option for `podman run` is not used. + +In another shell, fetch a web page from _localhost:8080_ + +``` +$ curl -s localhost:8080 | head -6 + + + + + +Test Page for the HTTP Server on Fedora +$ +``` + +### Disabling the network with _--network=none_ + +If the container only needs to communicate over the socket-activated socket, it's possible to disable +the network by passing __--network=none__ to `podman run`. This improves security because the +container then runs with less privileges. + +### Native network performance over the socket-activated socket + +When using rootless Podman, network traffic is normally passed through slirp4netns. This comes with +a performance penalty. Fortunately, communication over the socket-activated socket does not pass through +slirp4netns so it has the same performance characteristics as the normal network on the host. + +### Starting a socket-activated service + +There is a delay when the first connection is made because the container needs to +start up. To minimize this delay, consider passing __--pull=never__ to `podman run` and instead +pull the container image beforehand. Instead of waiting for the start of the service to be triggered by the +first client connecting to it, the service can also be explicitly started (`systemctl --user start echo.service`). + +### Stopping a socket-activated service + +Some services run a command (configured by the systemd directive __ExecStart__) that exits after some time of inactivity. +Depending on the restart configuration for the service +(systemd directive [__Restart__](https://www.freedesktop.org/software/systemd/man/systemd.service.html#Restart=)), +it may then be stopped. An example of this is _podman.service_ that stops after some time of inactivity. +The service will be started again when the next client connects to the socket. diff --git a/versioned_docs/version-5.5.1/MANPAGE_SYNTAX.md b/versioned_docs/version-5.5.1/MANPAGE_SYNTAX.md new file mode 100644 index 000000000..3a61c68ae --- /dev/null +++ b/versioned_docs/version-5.5.1/MANPAGE_SYNTAX.md @@ -0,0 +1,147 @@ +--- +title: podman-command +version: v5.5.1 +--- + +% podman-command(1) + +## NAME +podman\-command - short description + +## SYNOPSIS +(Shows the command structure. If the command can be written in two different ways, both of them have to be shown.\ +Many manpages include the OPTIONS **--all**, **-a** and/or **--latest**, **-l**. In this case, there is no `container name` or `ID` needed after the initial command. Because most of the other OPTIONS still need the `container name` or ` ID`, it is defined that the *container* argument in the command should **not** be put in brackets. It should also be noted in the *IMPORTANT* section in the description of the OPTION with the following sentence: *IMPORTANT: This OPTION does not need a container name or ID as input argument.*.) + +**podman command** [*optional*] *mandatory value* + +**podman subcommand command** [*optional*] *mandatory value* + +(If there is the possibility to chose between two or more mandatory command values. There should also always be a space before and after a vertical bar to ensure better readability.) + +**podman command** [*optional*] *value1* | *value2* + +**podman subcommand command** [*optional*] *value1* | *value2* + +(If an optional value follows a mandatory one.) + +**podman command** [*optional*] *value1* | *value2* [*optional*] + +**podman subcommand command** [*optional*] *value1* | *value2* [*optional*] + +(If the command accepts an infinite number of values.) + +**podman command** [*optional*] *value* [*value* ...] + +**podman subcommand command** [*optional*] *value* [*value* ...] + +## DESCRIPTION +**podman command** is always the beginning of the DESCRIPTION section. Putting the command as the first part of the DESCRIPTION ensures uniformity. All commands mentioned in the text retain their appearance and form.\ +Example for the first sentence: **podman command** is an example command. + +Commands or files that are quoted from other podman manpages or podman repositories have to be linked to those. Non-podman commands are not to be linked.\ +Example sentence: Use **[podman-run](podman-run.1.md)** or **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** for the problem. + +It should also be specified if the command can only be run as root. In addition, it should be described when a command, OPTION, or other content cannot be executed with the remote client or in combination with other commands, OPTIONS, or content. In this case, the following sentence is put at the end of a command, OPTION, or content:\ +*IMPORTANT: This command/OPTION/content is not available with the command/OPTION/content/on the remote Podman client.*\ +For a command, this should be done in the DESCRIPTION section. For the OPTIONS, it should be done in the DESCRIPTION of the specified OPTION. + +Do not use pronouns in the man pages, especially the word `you`. + +There should be **no** new line after H2-headers (`##`). + +## OPTIONS +All flags are referred to as OPTIONS. The term flags should not be used. All OPTIONS are listed in this section. OPTIONS that appear in descriptions of other OPTIONS and sections retain their appearance, for example: **--exit**. + +OPTIONS that are quoted from other podman manpages or podman repositories have to be linked to those.\ +Example sentence: Use **[podman-generate-systemd --new](./source/markdown/podman-generate-systemd.1.md#--new)** for the problem. + + Each OPTION should be explained to the fullest extent below the OPTION itself. Each OPTION is behind an H4-header (`####`). If the OPTION has a default argument, it has to be explained in the description of the OPTION. If the OPTION is also not available with a command/OPTION/content/ on the remote Podman client, the sentence about the default argument should the second to last sentence. The sentence about the default argument should be in a new line as well as the *IMPORTANT* sentence. + + All OPTIONS are to be sorted in alphabetical order. + + Tables should be used when there is a different definition for multiple arguments, and these have to be explained. This is shown with the OPTION **--test**.\ + Lists should be used when arguments are used that do not need a definition for each argument and a single description explains them. An example is shown with **[podman-commit --change](./source/markdown/podman-commit.1.md#--change--cinstruction)** + + +#### **--version**, **-v** + +OPTIONS can be put after the command in two different ways. Either the long version with **--option** or as the short version **-o**. If there are two ways to write an OPTION they are separated by a comma. If there are two versions of one command the long version is always shown in front. If OPTION is boolean, *true/false* are not enumerated. The default boolean argument is shown in the same way normal default arguments are displayed.\ +Example: The default is **false**.\ +*IMPORTANT: This OPTION is not available with the remote Podman client.* + +#### **--exit** + +An example of a boolean OPTION that is only available in long form. + +#### **--answer**, **-a**=**active** | *disable* + +The **--answer** OPTION above is an example of an OPTION that accepts two possible arguments as inputs. If a default argument is selected when the OPTION is not used in the command, it is shown in **bold**. If the OPTION is used, it must include an argument afterward. It must always be ensured that the standard argument is in the first position after the OPTION. In this example, there are two different ways to execute the command. Both possible OPTIONS have to be shown with the arguments following them.\ +The default value is shown as **active**. + +#### **--status**=**good** | *better* | *best* + +This is an example of three arguments following an OPTION. If the number of arguments is greater than three, the arguments are **not** listed after the equal sign. The arguments must be shown in a table like in **--test**=**_test_**. This form should also be used if the understanding of the content is in danger of becoming incomprehensible. An example for this is **[podman-container-prune --filters](./source/markdown/podman-container-prune.1.md#--filterfilters)**.\ +The default value is shown as **good**. + +#### **--test**=**test** + +OPTIONS that are followed by an equal sign include an argument after the equal sign in **bold** or *italic*. If there is a default argument that is used if the OPTION is not specified in the command, the argument after the equal sign is displayed in **bold**. All arguments must be listed and explained in the text below the OPTION. + +| Argument | Description | +| ------------------ | --------------------------------------------------------------------------- | +| **example one** | This argument is the default argument if the OPTION is not specified. | +| *example two* | If one refers to a command, one should use **bold** marks. | +| *example three* | Example: In combination with **podman command** highly effective. | +| *example four* | Example: Can be combined with **--exit**. | +| *example five* | The fifth description | + +The table shows an example for a listing of arguments. The contents in the table should be aligned left. If the content in the table conflicts with this, it can be aligned to support the understanding of the content. If there is a default argument, it **must** be listed as the first entry in the table.\ +The default value is shown as **example one**. + +If the number of arguments is smaller than four they have to be listed behind the OPTION as seen in the OPTION **--status**. + +#### **--problem**=*problem* + +OPTIONS that are followed by an equal sign that is then followed by an unspecified argument, have no default argument. If this OPTION is written with an equal sign and the argument is left empty, there will be no error, but the OPTION will be ignored. The meaning of the argument is described preferably in `one` word after the equal sign in *italic* format. + +## SUBCHAPTER +For chapters that are made specifically as an individual SUBCHAPTER in a man page, the previous conditions regarding formatting apply. + +There are no restrictions for the use of paragraphs and tables. Within these paragraphs and tables the previous conditions regarding formatting apply. + +Strings of characters or numbers can be highlighted with `backticks`. Paths of any kind **must** be highlighted. + +IMPORTANT: Only characters that are **not** part of categories mentioned before can be highlighted. This includes headers. For example it is not advised to highlight an OPTION or a **command**. + +SUBHEADINGS are displayed as follows: +### SUBHEADING +Text for SUBHEADINGS. + +## EXAMPLES +All EXAMPLES are listed in this section. This section should be at the end of each man page. Each EXAMPLE is always in one box. The box starts and ends with the last written line, **not** with a blank line. The `$` in front of the commands indicates that it can be run as a normal user, while the commands starting with `#` can only be run as root. If there is the need for a comment in a box the comment should have `###` in front of it. + +Description of the EXAMPLE +``` +### Example comment +$ podman command +$ podman command -o +$ cat $HOME/Dockerfile | podman command --option +``` + +Description of the EXAMPLE two +``` +# podman command --status=better +``` +## SEE ALSO +All commands, including commands with OPTIONS, and config-files mentioned in the manpage have to be listed here. Podman commands, including commands with OPTIONS, and config-files have to be linked. If a command is mentioned several times with different OPTIONS it just have to be linked once. All other commands, including commands with OPTIONS, and config-files just have to be mentioned. If a command is mentioned several times with different OPTIONS it just has to be linked once. + +Example: +**[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-create(1)](podman-create.1.md)** + +## HISTORY +Normally, the dates of changes, the content of the changes and the person who provided them is listed here. Most manpages don't keep this record. + +Example:\ +December 2021, Originally compiled by Alexander Richter + +`Every manpage should end with an empty line.` diff --git a/versioned_docs/version-5.5.1/index.md b/versioned_docs/version-5.5.1/index.md new file mode 100644 index 000000000..d96b71947 --- /dev/null +++ b/versioned_docs/version-5.5.1/index.md @@ -0,0 +1,42 @@ +--- +title: Podman Documentation +version: v5.5.1 +--- + +# Podman Documentation (v5.5.1) + +Welcome to the Podman documentation for version v5.5.1. + +## Getting Started + +- [Installation Instructions](https://podman.io/get-started) +- [Basic Tutorial](tutorials/podman_tutorial.md) +- [Rootless Containers](tutorials/rootless_tutorial.md) + +## Commands + +- [podman](source/markdown/podman.1.md) +- [podman-build](source/markdown/podman-build.1.md) +- [podman-run](source/markdown/podman-run.1.md) +- [podman-ps](source/markdown/podman-ps.1.md) + +## Tutorials + +- [Basic Networking](tutorials/basic_networking.md) +- [Rootless Tutorial](tutorials/rootless_tutorial.md) +- [Podman Tutorial](tutorials/podman_tutorial.md) +- [Performance](tutorials/performance.md) + +## System & Management + +- [System Commands](source/markdown/podman-system.1.md) +- [Machine Commands](source/markdown/podman-machine.1.md) +- [Pod Management](source/markdown/podman-pod.1.md) +- [Volume Management](source/markdown/podman-volume.1.md) + +## Advanced Features + +- [Systemd Integration](source/markdown/podman-systemd.unit.5.md) +- [Kubernetes Support](source/markdown/podman-kube.1.md) +- [Secret Management](source/markdown/podman-secret.1.md) +- [Code Generation](source/markdown/podman-generate.1.md) diff --git a/versioned_docs/version-5.5.1/kubernetes_support.md b/versioned_docs/version-5.5.1/kubernetes_support.md new file mode 100644 index 000000000..fe0b9b08c --- /dev/null +++ b/versioned_docs/version-5.5.1/kubernetes_support.md @@ -0,0 +1,208 @@ +--- +title: Podman Kube Play Support +version: v5.5.1 +--- + +# Podman Kube Play Support + +This document outlines the kube yaml fields that are currently supported by the **podman kube play** command. + +Note: **N/A** means that the option cannot be supported in a single-node Podman environment. + +## Pod Fields + +| Field | Support | +|-----------------------------------------------------|---------| +| containers | ✅ | +| initContainers | ✅ | +| imagePullSecrets | no | +| enableServiceLinks | no | +| os\.name | no | +| volumes | ✅ | +| nodeSelector | N/A | +| nodeName | N/A | +| affinity\.nodeAffinity | N/A | +| affinity\.podAffinity | N/A | +| affinity\.podAntiAffinity | N/A | +| tolerations\.key | N/A | +| tolerations\.operator | N/A | +| tolerations\.effect | N/A | +| tolerations\.tolerationSeconds | N/A | +| schedulerName | N/A | +| runtimeClassName | no | +| priorityClassName | no | +| priority | no | +| topologySpreadConstraints\.maxSkew | N/A | +| topologySpreadConstraints\.topologyKey | N/A | +| topologySpreadConstraints\.whenUnsatisfiable | N/A | +| topologySpreadConstraints\.labelSelector | N/A | +| topologySpreadConstraints\.minDomains | N/A | +| restartPolicy | ✅ | +| terminationGracePeriodSeconds | ✅ | +| activeDeadlineSeconds | no | +| readinessGates\.conditionType | no | +| hostname | ✅ | +| setHostnameAsFQDN | no | +| subdomain | no | +| hostAliases\.hostnames | ✅ | +| hostAliases\.ip | ✅ | +| dnsConfig\.nameservers | ✅ | +| dnsConfig\.options\.name | ✅ | +| dnsConfig\.options\.value | ✅ | +| dnsConfig\.searches | ✅ | +| dnsPolicy | no | +| hostNetwork | ✅ | +| hostPID | ✅ | +| hostIPC | ✅ | +| shareProcessNamespace | ✅ | +| serviceAccountName | no | +| automountServiceAccountToken | no | +| securityContext\.runAsUser | ✅ | +| securityContext\.runAsNonRoot | no | +| securityContext\.runAsGroup | ✅ | +| securityContext\.supplementalGroups | ✅ | +| securityContext\.fsGroup | no | +| securityContext\.fsGroupChangePolicy | no | +| securityContext\.seccompProfile\.type | no | +| securityContext\.seccompProfile\.localhostProfile | no | +| securityContext\.seLinuxOptions\.level | ✅ | +| securityContext\.seLinuxOptions\.role | ✅ | +| securityContext\.seLinuxOptions\.type | ✅ | +| securityContext\.seLinuxOptions\.user | ✅ | +| securityContext\.sysctls\.name | ✅ | +| securityContext\.sysctls\.value | ✅ | +| securityContext\.windowsOptions\.gmsaCredentialSpec | no | +| securityContext\.windowsOptions\.hostProcess | no | +| securityContext\.windowsOptions\.runAsUserName | no | + +## Container Fields + +| Field | Support | +|-----------------------------------------------------|---------| +| name | ✅ | +| image | ✅ | +| imagePullPolicy | ✅ | +| command | ✅ | +| args | ✅ | +| workingDir | ✅ | +| ports\.containerPort | ✅ | +| ports\.hostIP | ✅ | +| ports\.hostPort | ✅ | +| ports\.name | ✅ | +| ports\.protocol | ✅ | +| env\.name | ✅ | +| env\.value | ✅ | +| env\.valueFrom\.configMapKeyRef\.key | ✅ | +| env\.valueFrom\.configMapKeyRef\.name | ✅ | +| env\.valueFrom\.configMapKeyRef\.optional | ✅ | +| env\.valueFrom\.fieldRef | ✅ | +| env\.valueFrom\.resourceFieldRef | ✅ | +| env\.valueFrom\.secretKeyRef\.key | ✅ | +| env\.valueFrom\.secretKeyRef\.name | ✅ | +| env\.valueFrom\.secretKeyRef\.optional | ✅ | +| envFrom\.configMapRef\.name | ✅ | +| envFrom\.configMapRef\.optional | ✅ | +| envFrom\.prefix | no | +| envFrom\.secretRef\.name | ✅ | +| envFrom\.secretRef\.optional | ✅ | +| volumeMounts\.mountPath | ✅ | +| volumeMounts\.name | ✅ | +| volumeMounts\.mountPropagation | no | +| volumeMounts\.readOnly | ✅ | +| volumeMounts\.subPath | ✅ | +| volumeMounts\.subPathExpr | no | +| volumeDevices\.devicePath | no | +| volumeDevices\.name | no | +| resources\.limits | ✅ | +| resources\.requests | ✅ | +| lifecycle\.postStart | no | +| lifecycle\.preStop | no | +| terminationMessagePath | no | +| terminationMessagePolicy | no | +| livenessProbe | ✅ | +| readinessProbe | no | +| startupProbe | no | +| securityContext\.runAsUser | ✅ | +| securityContext\.runAsNonRoot | no | +| securityContext\.runAsGroup | ✅ | +| securityContext\.readOnlyRootFilesystem | ✅ | +| securityContext\.procMount | ✅ | +| securityContext\.privileged | ✅ | +| securityContext\.allowPrivilegeEscalation | ✅ | +| securityContext\.capabilities\.add | ✅ | +| securityContext\.capabilities\.drop | ✅ | +| securityContext\.seccompProfile\.type | no | +| securityContext\.seccompProfile\.localhostProfile | no | +| securityContext\.seLinuxOptions\.level | ✅ | +| securityContext\.seLinuxOptions\.role | ✅ | +| securityContext\.seLinuxOptions\.type | ✅ | +| securityContext\.seLinuxOptions\.user | ✅ | +| securityContext\.windowsOptions\.gmsaCredentialSpec | no | +| securityContext\.windowsOptions\.hostProcess | no | +| securityContext\.windowsOptions\.runAsUserName | no | +| stdin | no | +| stdinOnce | no | +| tty | no | + +## PersistentVolumeClaim Fields + +| Field | Support | +|---------------------|---------| +| volumeName | no | +| storageClassName | ✅ | +| volumeMode | no | +| accessModes | ✅ | +| selector | no | +| resources\.limits | no | +| resources\.requests | ✅ | + +## ConfigMap Fields + +| Field | Support | +|------------|---------| +| binaryData | ✅ | +| data | ✅ | +| immutable | no | + +## Deployment Fields + +| Field | Support | +|-----------------------------------------|-------------------------------------------------------| +| replicas | ✅ (the actual replica count is ignored and set to 1) | +| selector | ✅ | +| template | ✅ | +| minReadySeconds | no | +| strategy\.type | no | +| strategy\.rollingUpdate\.maxSurge | no | +| strategy\.rollingUpdate\.maxUnavailable | no | +| revisionHistoryLimit | no | +| progressDeadlineSeconds | no | +| paused | no | + +## DaemonSet Fields + +| Field | Support | +|-----------------------------------------|---------| +| selector | ✅ | +| template | ✅ | +| minReadySeconds | no | +| strategy\.type | no | +| strategy\.rollingUpdate\.maxSurge | no | +| strategy\.rollingUpdate\.maxUnavailable | no | +| revisionHistoryLimit | no | + +## Job Fields + +| Field | Support | +|-------------------------|----------------------------------| +| activeDeadlineSeconds | no | +| selector | no (automatically set by k8s) | +| template | ✅ | +| backoffLimit | no | +| completionMode | no | +| completions | no (set to 1 with kube generate) | +| manualSelector | no | +| parallelism | no (set to 1 with kube generate) | +| podFailurePolicy | no | +| suspend | no | +| ttlSecondsAfterFinished | no | diff --git a/versioned_docs/version-5.5.1/source/markdown/options/README.md b/versioned_docs/version-5.5.1/source/markdown/options/README.md new file mode 100644 index 000000000..65f816269 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/README.md @@ -0,0 +1,68 @@ +--- +title: Documentation +version: v5.5.1 +--- + +Common Man Page Options +======================= + +This subdirectory contains option (flag) names and descriptions +common to multiple podman man pages. Each file is one option. The +filename does not necessarily need to be identical to the option +name: for instance, `hostname.container.md` and `hostname.pod.md` +exist because the **--hostname** option is sufficiently different +between `podman-{create,run}` and `podman-pod-{create,run}` to +warrant living separately. + +How +=== + +The files here are included in `podman-*.md.in` files using the `@@option` +mechanism: + +``` +@@option foo ! includes options/foo.md +``` + +The tool that does this is `hack/markdown-preprocess`. It is a python +script because it needs to run on `readthedocs.io`. From a given `.md.in` +file, this script creates a `.md` file that can then be read by +`go-md2man`, `sphinx`, anything that groks markdown. This runs as +part of `make docs`. + +Special Substitutions +===================== + +Some options are almost identical except for 'pod' vs 'container' +differences. For those, use `<>`. +Order is immaterial: the important thing is the presence of the +string "`pod`" in one half but not the other. The correct string +is chosen based on the filename: if the file contains `-pod`, +such as `podman-pod-create`, the string with `pod` (case-insensitive) +in it is chosen. + +The string `<>` is replaced with the podman subcommand +as determined from the filename, e.g., `create` for `podman-create.1.md.in`. +This allows the shared use of examples in the option file: +``` + Example: podman <> --foo --bar +``` +As a special case, `podman-pod-X` becomes just `X` (the "pod" is removed). +This makes the `pod-id-file` man page more useful. To get the full +subcommand including 'pod', use `<>`. + +Restrictions +============ + +There is a restriction for having a single text line with three +back-ticks in the front and the end of the line. For instance: + +\`\`\`Some man page text\`\`\` + +This is currently not allowed and causes a corruption of the +compiled man page. Instead, put the three back-ticks on separate +lines like: + +\`\`\` +Some man page text +\`\`\` diff --git a/versioned_docs/version-5.5.1/source/markdown/options/add-host.md b/versioned_docs/version-5.5.1/source/markdown/options/add-host.md new file mode 100644 index 000000000..1cf08bdd6 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/add-host.md @@ -0,0 +1,44 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, create, farm build, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the <>'s `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/annotation.container.md b/versioned_docs/version-5.5.1/source/markdown/options/annotation.container.md new file mode 100644 index 000000000..6333df844 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/annotation.container.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, kube play, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--annotation**=*key=value* + +Add an annotation to the container<<| or pod>>. This option can be set multiple times. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/annotation.image.md b/versioned_docs/version-5.5.1/source/markdown/options/annotation.image.md new file mode 100644 index 000000000..578cadbc3 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/annotation.image.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--annotation**=*annotation=value* + +Add an image *annotation* (e.g. annotation=*value*) to the image metadata. Can +be used multiple times. + +Note: this information is not present in Docker image formats, so it is +discarded when writing images in Docker formats. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/annotation.manifest.md b/versioned_docs/version-5.5.1/source/markdown/options/annotation.manifest.md new file mode 100644 index 000000000..60dcbfb35 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/annotation.manifest.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman artifact add, manifest add, manifest annotate +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--annotation**=*annotation=value* + +Set an annotation on the entry for the specified image or artifact. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/arch.md b/versioned_docs/version-5.5.1/source/markdown/options/arch.md new file mode 100644 index 000000000..84acc2fbe --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/arch.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--arch**=*ARCH* +Override the architecture, defaults to hosts, of the image to be pulled. For example, `arm`. +Unless overridden, subsequent lookups of the same image in the local storage matches this architecture, regardless of the host. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/attach.md b/versioned_docs/version-5.5.1/source/markdown/options/attach.md new file mode 100644 index 000000000..148946fa1 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/attach.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--attach**, **-a**=*stdin* | *stdout* | *stderr* + +Attach to STDIN, STDOUT or STDERR. + +In foreground mode (the default when **-d** +is not specified), **podman run** can start the process in the container +and attach the console to the process's standard input, output, and +error. It can even pretend to be a TTY (this is what most command-line +executables expect) and pass along signals. The **-a** option can be set for +each of **stdin**, **stdout**, and **stderr**. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/authfile.md b/versioned_docs/version-5.5.1/source/markdown/options/authfile.md new file mode 100644 index 000000000..940aa111a --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/authfile.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, auto update, build, container runlabel, create, farm build, image sign, kube play, login, logout, manifest add, manifest inspect, manifest push, pull, push, run, search +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/blkio-weight-device.md b/versioned_docs/version-5.5.1/source/markdown/options/blkio-weight-device.md new file mode 100644 index 000000000..0b7ead92c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/blkio-weight-device.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman container clone, create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/blkio-weight.md b/versioned_docs/version-5.5.1/source/markdown/options/blkio-weight.md new file mode 100644 index 000000000..750634607 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/blkio-weight.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman container clone, create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/build-arg-file.md b/versioned_docs/version-5.5.1/source/markdown/options/build-arg-file.md new file mode 100644 index 000000000..5cf322dd8 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/build-arg-file.md @@ -0,0 +1,27 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--build-arg-file**=*path* + +Specifies a file containing lines of build arguments of the form `arg=value`. +The suggested file name is `argfile.conf`. + +Comment lines beginning with `#` are ignored, along with blank lines. +All others must be of the `arg=value` format passed to `--build-arg`. + +If several arguments are provided via the `--build-arg-file` +and `--build-arg` options, the build arguments are merged across all +of the provided files and command line arguments. + +Any file provided in a `--build-arg-file` option is read before +the arguments supplied via the `--build-arg` option. + +When a given argument name is specified several times, the last instance +is the one that is passed to the resulting builds. This means `--build-arg` +values always override those in a `--build-arg-file`. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/build-arg.md b/versioned_docs/version-5.5.1/source/markdown/options/build-arg.md new file mode 100644 index 000000000..7d0bee7c6 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/build-arg.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--build-arg**=*arg=value* + +Specifies a build argument and its value, which is interpolated in +instructions read from the Containerfiles in the same way that environment variables are, but which are not added to environment variable list in the resulting image's configuration. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/build-context.md b/versioned_docs/version-5.5.1/source/markdown/options/build-context.md new file mode 100644 index 000000000..dacc78141 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/build-context.md @@ -0,0 +1,35 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--build-context**=*name=value* + +Specify an additional build context using its short name and its location. +Additional build contexts can be referenced in the same manner as we access +different stages in COPY instruction. + +Valid values are: + +* Local directory – e.g. --build-context project2=../path/to/project2/src (This option is not available with the remote Podman client. On Podman machine setup (i.e macOS and Windows) path must exists on the machine VM) +* HTTP URL to a tarball – e.g. --build-context src=https://example.org/releases/src.tar +* Container image – specified with a container-image:// prefix, e.g. --build-context alpine=container-image://alpine:3.15, (also accepts docker://, docker-image://) + +On the Containerfile side, reference the build context on all +commands that accept the “from” parameter. Here’s how that might look: + +```dockerfile +FROM [name] +COPY --from=[name] ... +RUN --mount=from=[name] … +``` + +The value of [name] is matched with the following priority order: + +* Named build context defined with --build-context [name]=.. +* Stage defined with AS [name] inside Containerfile +* Image [name], either local or in a remote registry diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cache-from.md b/versioned_docs/version-5.5.1/source/markdown/options/cache-from.md new file mode 100644 index 000000000..1920df47e --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cache-from.md @@ -0,0 +1,26 @@ +--- +title: populate a cache and also consult it +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cache-from**=*image* + +Repository to utilize as a potential cache source. When specified, Buildah tries to look for +cache images in the specified repository and attempts to pull cache images instead of actually +executing the build steps locally. Buildah only attempts to pull previously cached images if they +are considered as valid cache hits. + +Use the `--cache-to` option to populate a remote repository with cache content. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-from` option is ignored unless `--layers` is specified. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cache-to.md b/versioned_docs/version-5.5.1/source/markdown/options/cache-to.md new file mode 100644 index 000000000..04d3074a1 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cache-to.md @@ -0,0 +1,24 @@ +--- +title: populate a cache and also consult it +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cache-to**=*image* + +Set this flag to specify a remote repository that is used to store cache images. Buildah attempts to +push newly built cache image to the remote repository. + +Note: Use the `--cache-from` option in order to use cache content in a remote repository. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-to` option is ignored unless `--layers` is specified. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cache-ttl.md b/versioned_docs/version-5.5.1/source/markdown/options/cache-ttl.md new file mode 100644 index 000000000..792d526ce --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cache-ttl.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cache-ttl** + +Limit the use of cached images to only consider images with created timestamps less than *duration* ago. +For example if `--cache-ttl=1h` is specified, Buildah considers intermediate cache images which are created +under the duration of one hour, and intermediate cache images outside this duration is ignored. + +Note: Setting `--cache-ttl=0` manually is equivalent to using `--no-cache` in the +implementation since this means that the user does not want to use cache at all. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cap-add.image.md b/versioned_docs/version-5.5.1/source/markdown/options/cap-add.image.md new file mode 100644 index 000000000..2ab393014 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cap-add.image.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cap-add**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability added to its capability set. +Certain capabilities are granted by default; this option can be used to add +more. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cap-add.md b/versioned_docs/version-5.5.1/source/markdown/options/cap-add.md new file mode 100644 index 000000000..be5bbd338 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cap-add.md @@ -0,0 +1,24 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cap-add**=*capability* + +Add Linux capabilities. + +Granting additional capabilities increases the privileges of the +processes running inside the container and potentially allow it to +break out of confinement. Capabilities like `CAP_SYS_ADMIN`, +`CAP_SYS_PTRACE`, `CAP_MKNOD` and `CAP_SYS_MODULE` are particularly +dangerous when they are not used within a user namespace. Please +refer to **user_namespaces(7)** for a more detailed explanation of the +interaction between user namespaces and capabilities. + +Before adding any capability, review its security implications and +ensure it is really necessary for the container’s functionality. See +**capabilities(7)** for more information. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cap-drop.image.md b/versioned_docs/version-5.5.1/source/markdown/options/cap-drop.image.md new file mode 100644 index 000000000..d263bb146 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cap-drop.image.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cap-drop**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability removed from its capability set. +The CAP\_CHOWN, CAP\_DAC\_OVERRIDE, CAP\_FOWNER, +CAP\_FSETID, CAP\_KILL, CAP\_NET\_BIND\_SERVICE, CAP\_SETFCAP, +CAP\_SETGID, CAP\_SETPCAP, and CAP\_SETUID capabilities are +granted by default; this option can be used to remove them. + +If a capability is specified to both the **--cap-add** and **--cap-drop** +options, it is dropped, regardless of the order in which the options were +given. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cap-drop.md b/versioned_docs/version-5.5.1/source/markdown/options/cap-drop.md new file mode 100644 index 000000000..a1086c4e8 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cap-drop.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cap-drop**=*capability* + +Drop Linux capabilities. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cert-dir.md b/versioned_docs/version-5.5.1/source/markdown/options/cert-dir.md new file mode 100644 index 000000000..d05250d04 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cert-dir.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, build, container runlabel, farm build, image sign, kube play, login, manifest add, manifest push, pull, push, search +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cgroup-conf.md b/versioned_docs/version-5.5.1/source/markdown/options/cgroup-conf.md new file mode 100644 index 000000000..f4aacd767 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cgroup-conf.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroup-conf**=*KEY=VALUE* + +When running on cgroup v2, specify the cgroup file to write to and its value. For example **--cgroup-conf=memory.high=1073741824** sets the memory.high limit to 1GB. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cgroup-parent.md b/versioned_docs/version-5.5.1/source/markdown/options/cgroup-parent.md new file mode 100644 index 000000000..06f1c2848 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cgroup-parent.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, create, farm build, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the <> is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cgroupns.image.md b/versioned_docs/version-5.5.1/source/markdown/options/cgroupns.image.md new file mode 100644 index 000000000..cab712724 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cgroupns.image.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroupns**=*how* + +Sets the configuration for cgroup namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "private" to indicate +that a new cgroup namespace is created, or it can be "host" to indicate +that the cgroup namespace in which `buildah` itself is being run is reused. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cgroupns.md b/versioned_docs/version-5.5.1/source/markdown/options/cgroupns.md new file mode 100644 index 000000000..250e388c0 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cgroupns.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroupns**=*mode* + +Set the cgroup namespace mode for the container. + +- **host**: use the host's cgroup namespace inside the container. +- **container:**_id_: join the namespace of the specified container. +- **private**: create a new cgroup namespace. +- **ns:**_path_: join the namespace at the specified path. + +If the host uses cgroups v1, the default is set to **host**. On cgroups v2, the default is **private**. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cgroups.md b/versioned_docs/version-5.5.1/source/markdown/options/cgroups.md new file mode 100644 index 000000000..4b2bc077c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cgroups.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroups**=*how* + +Determines whether the container creates CGroups. + +Default is **enabled**. + +The **enabled** option creates a new cgroup under the cgroup-parent. +The **disabled** option forces the container to not create CGroups, and thus conflicts with CGroup options (**--cgroupns** and **--cgroup-parent**). +The **no-conmon** option disables a new CGroup only for the **conmon** process. +The **split** option splits the current CGroup in two sub-cgroups: one for conmon and one for the container payload. It is not possible to set **--cgroup-parent** with **split**. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/chrootdirs.md b/versioned_docs/version-5.5.1/source/markdown/options/chrootdirs.md new file mode 100644 index 000000000..33bff0fcd --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/chrootdirs.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--chrootdirs**=*path* + +Path to a directory inside the container that is treated as a `chroot` directory. +Any Podman managed file (e.g., /etc/resolv.conf, /etc/hosts, etc/hostname) that is mounted into the root directory is mounted into that location as well. +Multiple directories are separated with a comma. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cidfile.read.md b/versioned_docs/version-5.5.1/source/markdown/options/cidfile.read.md new file mode 100644 index 000000000..b7c655b1c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cidfile.read.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman kill, pause, rm, stop, unpause +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cidfile**=*file* + +Read container ID from the specified *file* and <> the container. +Can be specified multiple times. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cidfile.write.md b/versioned_docs/version-5.5.1/source/markdown/options/cidfile.write.md new file mode 100644 index 000000000..1ff09b1e3 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cidfile.write.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cidfile**=*file* + +Write the container ID to *file*. The file is removed along with the container, except +when used with podman --remote run on detached containers. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/color.md b/versioned_docs/version-5.5.1/source/markdown/options/color.md new file mode 100644 index 000000000..f100022a2 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/color.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--color** + +Output the containers with different colors in the log. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/compat-auth-file.md b/versioned_docs/version-5.5.1/source/markdown/options/compat-auth-file.md new file mode 100644 index 000000000..1fca2d2e9 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/compat-auth-file.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman login, logout +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compat-auth-file**=*path* + +Instead of updating the default credentials file, update the one at *path*, and use a Docker-compatible format. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/compat-volumes.md b/versioned_docs/version-5.5.1/source/markdown/options/compat-volumes.md new file mode 100644 index 000000000..11e80cb2c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/compat-volumes.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compat-volumes** + +Handle directories marked using the VOLUME instruction (both in this build, and +those inherited from base images) such that their contents can only be modified +by ADD and COPY instructions. Any changes made in those locations by RUN +instructions will be reverted. Before the introduction of this option, this +behavior was the default, but it is now disabled by default. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/compression-format.md b/versioned_docs/version-5.5.1/source/markdown/options/compression-format.md new file mode 100644 index 000000000..65d728b31 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/compression-format.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compression-format**=**gzip** | *zstd* | *zstd:chunked* + +Specifies the compression format to use. Supported values are: `gzip`, `zstd` and `zstd:chunked`. The default is `gzip` unless overridden in the containers.conf file. +`zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning in that case. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/compression-level.md b/versioned_docs/version-5.5.1/source/markdown/options/compression-level.md new file mode 100644 index 000000000..d33eb4814 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/compression-level.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compression-level**=*level* + +Specifies the compression level to use. The value is specific to the compression algorithm used, e.g. for zstd the accepted values are in the range 1-20 (inclusive) with a default of 3, while for gzip it is 1-9 (inclusive) and has a default of 5. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/conmon-pidfile.md b/versioned_docs/version-5.5.1/source/markdown/options/conmon-pidfile.md new file mode 100644 index 000000000..01a40c4dc --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/conmon-pidfile.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--conmon-pidfile**=*file* + +Write the pid of the **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to restart Podman containers. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cpp-flag.md b/versioned_docs/version-5.5.1/source/markdown/options/cpp-flag.md new file mode 100644 index 000000000..3627483bd --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cpp-flag.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpp-flag**=*flags* + +Set additional flags to pass to the C Preprocessor cpp(1). Containerfiles ending with a ".in" suffix is preprocessed via cpp(1). This option can be used to pass additional flags to cpp.Note: You can also set default CPPFLAGS by setting the BUILDAH_CPPFLAGS environment variable (e.g., export BUILDAH_CPPFLAGS="-DDEBUG"). diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cpu-period.md b/versioned_docs/version-5.5.1/source/markdown/options/cpu-period.md new file mode 100644 index 000000000..90066c26d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cpu-period.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cpu-quota.md b/versioned_docs/version-5.5.1/source/markdown/options/cpu-quota.md new file mode 100644 index 000000000..f2e06476b --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cpu-quota.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cpu-rt-period.md b/versioned_docs/version-5.5.1/source/markdown/options/cpu-rt-period.md new file mode 100644 index 000000000..15a78c1c1 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cpu-rt-period.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman container clone, create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cpu-rt-runtime.md b/versioned_docs/version-5.5.1/source/markdown/options/cpu-rt-runtime.md new file mode 100644 index 000000000..b083ee053 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cpu-rt-runtime.md @@ -0,0 +1,19 @@ +--- +title: of +version: v5.5.1 +--- + +####> This option file is used in: +####> podman container clone, create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cpu-shares.md b/versioned_docs/version-5.5.1/source/markdown/options/cpu-shares.md new file mode 100644 index 000000000..a5845567e --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cpu-shares.md @@ -0,0 +1,50 @@ +--- +title: of +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cpus.container.md b/versioned_docs/version-5.5.1/source/markdown/options/cpus.container.md new file mode 100644 index 000000000..80ce5f475 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cpus.container.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpus**=*number* + +Number of CPUs. The default is *0.0* which means no limit. This is shorthand +for **--cpu-period** and **--cpu-quota**, therefore the option cannot be specified with +**--cpu-period** or **--cpu-quota**. + +On some systems, changing the CPU limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cpuset-cpus.md b/versioned_docs/version-5.5.1/source/markdown/options/cpuset-cpus.md new file mode 100644 index 000000000..eeb16b54e --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cpuset-cpus.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/cpuset-mems.md b/versioned_docs/version-5.5.1/source/markdown/options/cpuset-mems.md new file mode 100644 index 000000000..d3a8d8a04 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/cpuset-mems.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/creds.md b/versioned_docs/version-5.5.1/source/markdown/options/creds.md new file mode 100644 index 000000000..a00a0725b --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/creds.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, build, container runlabel, farm build, kube play, manifest add, manifest push, pull, push, search +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--creds**=*[username[\\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/decryption-key.md b/versioned_docs/version-5.5.1/source/markdown/options/decryption-key.md new file mode 100644 index 000000000..9f1cc2033 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/decryption-key.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman artifact pull, build, create, farm build, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--decryption-key**=*key[\\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/destroy.md b/versioned_docs/version-5.5.1/source/markdown/options/destroy.md new file mode 100644 index 000000000..d21fdabd9 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/destroy.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman container clone, pod clone +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--destroy** + +Remove the original <> that we are cloning once used to mimic the configuration. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/detach-keys.md b/versioned_docs/version-5.5.1/source/markdown/options/detach-keys.md new file mode 100644 index 000000000..60cd80362 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/detach-keys.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman attach, exec, run, start +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/device-cgroup-rule.md b/versioned_docs/version-5.5.1/source/markdown/options/device-cgroup-rule.md new file mode 100644 index 000000000..141b1ab21 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/device-cgroup-rule.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-cgroup-rule**=*"type major\\:minor mode"* + +Add a rule to the cgroup allowed devices list. The rule is expected to be +in the format specified in the Linux kernel documentation +[admin-guide/cgroup-v1/devices](https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.html): +- *type*: `a` (all), `c` (char), or `b` (block); +- *major* and *minor*: either a number, or `*` for all; +- *mode*: a composition of `r` (read), `w` (write), and `m` (mknod(2)). diff --git a/versioned_docs/version-5.5.1/source/markdown/options/device-read-bps.md b/versioned_docs/version-5.5.1/source/markdown/options/device-read-bps.md new file mode 100644 index 000000000..b7f121d9f --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/device-read-bps.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman container clone, create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/device-read-iops.md b/versioned_docs/version-5.5.1/source/markdown/options/device-read-iops.md new file mode 100644 index 000000000..5d71fe238 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/device-read-iops.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-read-iops**=*path:rate* + +Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/device-write-bps.md b/versioned_docs/version-5.5.1/source/markdown/options/device-write-bps.md new file mode 100644 index 000000000..95d5e8f8a --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/device-write-bps.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman container clone, create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/device-write-iops.md b/versioned_docs/version-5.5.1/source/markdown/options/device-write-iops.md new file mode 100644 index 000000000..47ec1f29d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/device-write-iops.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-write-iops**=*path:rate* + +Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/device.md b/versioned_docs/version-5.5.1/source/markdown/options/device.md new file mode 100644 index 000000000..34e04cfde --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/device.md @@ -0,0 +1,31 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, create, farm build, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device**=*host-device[:container-device][\\\:permissions]* + +Add a host device to the <>. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The <> only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true diff --git a/versioned_docs/version-5.5.1/source/markdown/options/digestfile.md b/versioned_docs/version-5.5.1/source/markdown/options/digestfile.md new file mode 100644 index 000000000..42dfc30e2 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/digestfile.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman artifact push, manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--digestfile**=*Digestfile* + +After copying the image, write the digest of the resulting image to the file. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/dir-compress.md b/versioned_docs/version-5.5.1/source/markdown/options/dir-compress.md new file mode 100644 index 000000000..5c5e3bb70 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/dir-compress.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman push, save +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compress** + +Compress tarball image layers when pushing to a directory using the 'dir' transport. (default is same compression type, compressed or uncompressed, as source) diff --git a/versioned_docs/version-5.5.1/source/markdown/options/disable-compression.md b/versioned_docs/version-5.5.1/source/markdown/options/disable-compression.md new file mode 100644 index 000000000..cea49e129 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/disable-compression.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--disable-compression**, **-D** + +Don't compress filesystem layers when building the image unless it is required +by the location where the image is being written. This is the default setting, +because image layers are compressed automatically when they are pushed to +registries, and images being written to local storage only need to be +decompressed again to be stored. Compression can be forced in all cases by +specifying **--disable-compression=false**. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/disable-content-trust.md b/versioned_docs/version-5.5.1/source/markdown/options/disable-content-trust.md new file mode 100644 index 000000000..b0126d76d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/disable-content-trust.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, create, pull, push, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/dns-option.container.md b/versioned_docs/version-5.5.1/source/markdown/options/dns-option.container.md new file mode 100644 index 000000000..ae99bcacf --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/dns-option.container.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns-option**=*option* + +Set custom DNS options. Invalid if using **--dns-option** with **--network** that is set to **none** or **container:**_id_. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/dns-option.image.md b/versioned_docs/version-5.5.1/source/markdown/options/dns-option.image.md new file mode 100644 index 000000000..c1b03b85d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/dns-option.image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns-option**=*option* + +Set custom DNS options to be used during the build. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/dns-search.container.md b/versioned_docs/version-5.5.1/source/markdown/options/dns-search.container.md new file mode 100644 index 000000000..f15096f94 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/dns-search.container.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns-search**=*domain* + +Set custom DNS search domains. Invalid if using **--dns-search** with **--network** that is set to **none** or **container:**_id_. +Use **--dns-search=.** to remove the search domain. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/dns-search.image.md b/versioned_docs/version-5.5.1/source/markdown/options/dns-search.image.md new file mode 100644 index 000000000..e5a1f9923 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/dns-search.image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns-search**=*domain* + +Set custom DNS search domains to be used during the build. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/dns.md b/versioned_docs/version-5.5.1/source/markdown/options/dns.md new file mode 100644 index 000000000..d90c56484 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/dns.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, create, farm build, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/entrypoint.md b/versioned_docs/version-5.5.1/source/markdown/options/entrypoint.md new file mode 100644 index 000000000..71282cbf5 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/entrypoint.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--entrypoint**=*"command"* | *'["command", "arg1", ...]'* + +Override the default ENTRYPOINT from the image. + +The ENTRYPOINT of an image is similar to a COMMAND +because it specifies what executable to run when the container starts, but it is +(purposely) more difficult to override. The ENTRYPOINT gives a container its +default nature or behavior. When the ENTRYPOINT is set, the +container runs as if it were that binary, complete with default options. More options can be +passed in via the COMMAND. But, if a user wants to run +something else inside the container, the **--entrypoint** option allows a new +ENTRYPOINT to be specified. + +Specify multi option commands in the form of a JSON string. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/env-file.md b/versioned_docs/version-5.5.1/source/markdown/options/env-file.md new file mode 100644 index 000000000..ca4c87846 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/env-file.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env-file**=*file* + +Read in a line-delimited file of environment variables. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/env-host.md b/versioned_docs/version-5.5.1/source/markdown/options/env-host.md new file mode 100644 index 000000000..461416eb9 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/env-host.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env-host** + +Use host environment inside of the container. See **Environment** note below for precedence. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.1/source/markdown/options/env-merge.md b/versioned_docs/version-5.5.1/source/markdown/options/env-merge.md new file mode 100644 index 000000000..90b872ba4 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/env-merge.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env-merge**=*env* + +Preprocess default environment variables for the containers. For example +if image contains environment variable `hello=world` user can preprocess +it using `--env-merge hello=${hello}-some` so new value is `hello=world-some`. + +Please note that if the environment variable `hello` is not present in the image, +then it'll be replaced by an empty string and so using `--env-merge hello=${hello}-some` +would result in the new value of `hello=-some`, notice the leading `-` delimiter. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/env.image.md b/versioned_docs/version-5.5.1/source/markdown/options/env.image.md new file mode 100644 index 000000000..e66c865b1 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/env.image.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env**=*env[=value]* + +Add a value (e.g. env=*value*) to the built image. Can be used multiple times. +If neither `=` nor a *value* are specified, but *env* is set in the current +environment, the value from the current environment is added to the image. +To remove an environment variable from the built image, use the `--unsetenv` +option. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/env.md b/versioned_docs/version-5.5.1/source/markdown/options/env.md new file mode 100644 index 000000000..434493d17 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/env.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env**, **-e**=*env* + +Set environment variables. + +This option allows arbitrary environment variables that are available for the process to be launched inside of the container. If an environment variable is specified without a value, Podman checks the host environment for a value and set the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the container. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/env.update.md b/versioned_docs/version-5.5.1/source/markdown/options/env.update.md new file mode 100644 index 000000000..e58b8c050 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/env.update.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env**, **-e**=*env* + +Add a value (e.g. env=*value*) to the container. Can be used multiple times. +If the value already exists in the container, it is overridden. +To remove an environment variable from the container, use the `--unsetenv` +option. + +Note that the env updates only affect the main container process after +the next start. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/expose.md b/versioned_docs/version-5.5.1/source/markdown/options/expose.md new file mode 100644 index 000000000..c090d716d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/expose.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--expose**=*port[/protocol]* + +Expose a port or a range of ports (e.g. **--expose=3300-3310**). +The protocol can be `tcp`, `udp` or `sctp` and if not given `tcp` is assumed. +This option matches the EXPOSE instruction for image builds and has no effect on +the actual networking rules unless **-P/--publish-all** is used to forward to all +exposed ports from random host ports. To forward specific ports from the host +into the container use the **-p/--publish** option instead. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/farm.md b/versioned_docs/version-5.5.1/source/markdown/options/farm.md new file mode 100644 index 000000000..a27495972 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/farm.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--farm** + +This option specifies the name of the farm to be used in the build process. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/features.md b/versioned_docs/version-5.5.1/source/markdown/options/features.md new file mode 100644 index 000000000..27ac1d90e --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/features.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman manifest add, manifest annotate +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--features**=*feature* + +Specify the features list which the list or index records as requirements for +the image. This option is rarely used. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/file.md b/versioned_docs/version-5.5.1/source/markdown/options/file.md new file mode 100644 index 000000000..1d4a12bc1 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/file.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--file**, **-f**=*Containerfile* + +Specifies a Containerfile which contains instructions for building the image, +either a local file or an **http** or **https** URL. If more than one +Containerfile is specified, *FROM* instructions are only be accepted from the +last specified file. + +If a build context is not specified, and at least one Containerfile is a +local file, the directory in which it resides is used as the build +context. + +Specifying the option `-f -` causes the Containerfile contents to be read from stdin. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/follow.md b/versioned_docs/version-5.5.1/source/markdown/options/follow.md new file mode 100644 index 000000000..232268778 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/follow.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--follow**, **-f** + +Follow log output. Default is false. + +Note: When following a <> which is removed by `podman <> rm` +or removed on exit (`podman run --rm ...`), there is a chance that the log +file is removed before `podman<< pod|>> logs` reads the final content. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/force-compression.md b/versioned_docs/version-5.5.1/source/markdown/options/force-compression.md new file mode 100644 index 000000000..01cc99fb4 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/force-compression.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--force-compression** + +If set, push uses the specified compression algorithm even if the destination contains a differently-compressed variant already. +Defaults to `true` if `--compression-format` is explicitly specified on the command-line, `false` otherwise. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/force-rm.md b/versioned_docs/version-5.5.1/source/markdown/options/force-rm.md new file mode 100644 index 000000000..17f9b913f --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/force-rm.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--force-rm** + +Always remove intermediate containers after a build, even if the build fails (default true). diff --git a/versioned_docs/version-5.5.1/source/markdown/options/format.md b/versioned_docs/version-5.5.1/source/markdown/options/format.md new file mode 100644 index 000000000..836fb7c24 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/format.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--format** + +Control the format for the built image's manifest and configuration data. +Recognized formats include *oci* (OCI image-spec v1.0, the default) and +*docker* (version 2, using schema format 2 for the manifest). + +Note: You can also override the default format by setting the BUILDAH\_FORMAT +environment variable. `export BUILDAH_FORMAT=docker` diff --git a/versioned_docs/version-5.5.1/source/markdown/options/from.md b/versioned_docs/version-5.5.1/source/markdown/options/from.md new file mode 100644 index 000000000..ba88d19ec --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/from.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--from** + +Overrides the first `FROM` instruction within the Containerfile. If there are multiple +FROM instructions in a Containerfile, only the first is changed. + +With the remote podman client, not all container transports work as +expected. For example, oci-archive:/x.tar references /x.tar on the remote +machine instead of on the client. When using podman remote clients it is +best to restrict use to *containers-storage*, and *docker:// transports*. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/gidmap.container.md b/versioned_docs/version-5.5.1/source/markdown/options/gidmap.container.md new file mode 100644 index 000000000..c59f4698f --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/gidmap.container.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--gidmap**=*[flags]container_uid\:from_uid[\\:amount]* + +Run the container in a new user namespace using the supplied GID mapping. This +option conflicts with the **--userns** and **--subgidname** options. This +option provides a way to map host GIDs to container GIDs in the same way as +__--uidmap__ maps host UIDs to container UIDs. For details see __--uidmap__. + +Note: the **--gidmap** option cannot be called in conjunction with the **--pod** option as a gidmap cannot be set on the container level when in a pod. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/gidmap.pod.md b/versioned_docs/version-5.5.1/source/markdown/options/gidmap.pod.md new file mode 100644 index 000000000..b43f2905d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/gidmap.pod.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--gidmap**=*pod_gid\:host_gid\\:amount* + +GID map for the user namespace. Using this flag runs all containers in the pod with user namespace enabled. +It conflicts with the **--userns** and **--subgidname** flags. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/gpus.md b/versioned_docs/version-5.5.1/source/markdown/options/gpus.md new file mode 100644 index 000000000..e649f7d38 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/gpus.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/group-add.md b/versioned_docs/version-5.5.1/source/markdown/options/group-add.md new file mode 100644 index 000000000..ebb0d13a4 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/group-add.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, create, farm build, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.1/source/markdown/options/group-entry.md b/versioned_docs/version-5.5.1/source/markdown/options/group-entry.md new file mode 100644 index 000000000..9a2f78dfe --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/group-entry.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--group-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/group` file within the container when `--user` is used. + +The variables $GROUPNAME, $GID, and $USERLIST are automatically replaced with their value at runtime if present. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/health-cmd.md b/versioned_docs/version-5.5.1/source/markdown/options/health-cmd.md new file mode 100644 index 000000000..d82dc2f97 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/health-cmd.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set or alter a healthcheck command for a container. The command is a command to be executed inside the +container that determines the container health. The command is required for other healthcheck options +to be applied. A value of **none** disables existing healthchecks. + +Multiple options can be passed in the form of a JSON array; otherwise, the command is interpreted +as an argument to **/bin/sh -c**. + +Note: The default values are used even if healthcheck is configured in the image. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/health-interval.md b/versioned_docs/version-5.5.1/source/markdown/options/health-interval.md new file mode 100644 index 000000000..d9be191e6 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/health-interval.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-interval**=*interval* + +Set an interval for the healthchecks. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +Note: This parameter will overwrite related healthcheck configuration from the image. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/health-log-destination.md b/versioned_docs/version-5.5.1/source/markdown/options/health-log-destination.md new file mode 100644 index 000000000..fb8ee31c3 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/health-log-destination.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-log-destination**=*directory_path* + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) (Default: local) + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/health-max-log-count.md b/versioned_docs/version-5.5.1/source/markdown/options/health-max-log-count.md new file mode 100644 index 000000000..f246b0e00 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/health-max-log-count.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-max-log-count**=*number of stored logs* + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) (Default: 5 attempts) diff --git a/versioned_docs/version-5.5.1/source/markdown/options/health-max-log-size.md b/versioned_docs/version-5.5.1/source/markdown/options/health-max-log-size.md new file mode 100644 index 000000000..3acf55ee8 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/health-max-log-size.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-max-log-size**=*size of stored logs* + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) (Default: 500 characters) diff --git a/versioned_docs/version-5.5.1/source/markdown/options/health-on-failure.md b/versioned_docs/version-5.5.1/source/markdown/options/health-on-failure.md new file mode 100644 index 000000000..98ecfb43e --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/health-on-failure.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-on-failure**=*action* + +Action to take once the container transitions to an unhealthy state. The default is **none**. + +- **none**: Take no action. +- **kill**: Kill the container. +- **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. +- **stop**: Stop the container. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/health-retries.md b/versioned_docs/version-5.5.1/source/markdown/options/health-retries.md new file mode 100644 index 000000000..f9cee103f --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/health-retries.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-retries**=*retries* + +The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is **3**. + +Note: This parameter can overwrite the healthcheck configuration from the image. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/health-start-period.md b/versioned_docs/version-5.5.1/source/markdown/options/health-start-period.md new file mode 100644 index 000000000..07ccecdae --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/health-start-period.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-start-period**=*period* + +The initialization time needed for a container to bootstrap. The value can be expressed in time format like +**2m3s**. The default value is **0s**. + +Note: The health check command is executed as soon as a container is started, if the health check is successful +the container's health state will be updated to `healthy`. However, if the health check fails, the health state will +stay as `starting` until either the health check is successful or until the `--health-start-period` time is over. If the +health check command fails after the `--health-start-period` time is over, the health state will be updated to `unhealthy`. +The health check command is executed periodically based on the value of `--health-interval`. + +Note: This parameter will overwrite related healthcheck configuration from the image. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/health-startup-cmd.md b/versioned_docs/version-5.5.1/source/markdown/options/health-startup-cmd.md new file mode 100644 index 000000000..c6b768514 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/health-startup-cmd.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set a startup healthcheck command for a container. This command is executed inside the container and is used to gate the regular +healthcheck. When the startup command succeeds, the regular healthcheck begins and the startup healthcheck ceases. Optionally, +if the command fails for a set number of attempts, the container is restarted. A startup healthcheck can be used to ensure that +containers with an extended startup period are not marked as unhealthy until they are fully started. Startup healthchecks can only be +used when a regular healthcheck (from the container's image or the **--health-cmd** option) is also set. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/health-startup-interval.md b/versioned_docs/version-5.5.1/source/markdown/options/health-startup-interval.md new file mode 100644 index 000000000..e26632955 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/health-startup-interval.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-interval**=*interval* + +Set an interval for the startup healthcheck. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/health-startup-retries.md b/versioned_docs/version-5.5.1/source/markdown/options/health-startup-retries.md new file mode 100644 index 000000000..6fc0398df --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/health-startup-retries.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-retries**=*retries* + +The number of attempts allowed before the startup healthcheck restarts the container. If set to **0**, the container is never restarted. The default is **0**. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/health-startup-success.md b/versioned_docs/version-5.5.1/source/markdown/options/health-startup-success.md new file mode 100644 index 000000000..069e4bc97 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/health-startup-success.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-success**=*retries* + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value +of **0** means that any success begins the regular healthcheck. The default is **0**. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/health-startup-timeout.md b/versioned_docs/version-5.5.1/source/markdown/options/health-startup-timeout.md new file mode 100644 index 000000000..9afc85fe1 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/health-startup-timeout.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-timeout**=*timeout* + +The maximum time a startup healthcheck command has to complete before it is marked as failed. The value can be expressed in a time +format like **2m3s**. The default value is **30s**. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/health-timeout.md b/versioned_docs/version-5.5.1/source/markdown/options/health-timeout.md new file mode 100644 index 000000000..13f87b89c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/health-timeout.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-timeout**=*timeout* + +The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the +value can be expressed in a time format such as **1m22s**. The default value is **30s**. + +Note: A timeout marks the healthcheck as failed but does not terminate the running process. +This ensures that a slow but eventually successful healthcheck does not disrupt the container +but is still accounted for in the health status. + +Note: This parameter will overwrite related healthcheck configuration from the image. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/help.md b/versioned_docs/version-5.5.1/source/markdown/options/help.md new file mode 100644 index 000000000..4debbdf3d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/help.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--help**, **-h** + +Print usage statement diff --git a/versioned_docs/version-5.5.1/source/markdown/options/hooks-dir.md b/versioned_docs/version-5.5.1/source/markdown/options/hooks-dir.md new file mode 100644 index 000000000..0cfb70a4f --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/hooks-dir.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hooks-dir**=*path* + +Each *.json file in the path configures a hook for buildah build containers. For more details on the syntax of the JSON files and the semantics of hook injection. Buildah currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. + +This option may be set multiple times; paths from later options have higher precedence. + +For the annotation conditions, buildah uses any annotations set in the generated OCI configuration. + +For the bind-mount conditions, only mounts explicitly requested by the caller via --volume are considered. Bind mounts that buildah inserts by default (e.g. /dev/shm) are not considered. + +If --hooks-dir is unset for root callers, Buildah currently defaults to /usr/share/containers/oci/hooks.d and /etc/containers/oci/hooks.d in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting --hooks-dir. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/hostname.container.md b/versioned_docs/version-5.5.1/source/markdown/options/hostname.container.md new file mode 100644 index 000000000..35db4fd6b --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/hostname.container.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hostname**, **-h**=*name* + +Set the container's hostname inside the container. + +This option can only be used with a private UTS namespace `--uts=private` +(default). If `--pod` is given and the pod shares the same UTS namespace +(default), the pod's hostname is used. The given hostname is also added to the +`/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). diff --git a/versioned_docs/version-5.5.1/source/markdown/options/hostname.pod.md b/versioned_docs/version-5.5.1/source/markdown/options/hostname.pod.md new file mode 100644 index 000000000..66ba2f7b3 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/hostname.pod.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hostname**=*name* + +Set the pod's hostname inside all containers. + +The given hostname is also added to the `/etc/hosts` file using the container's +primary IP address (also see the **--add-host** option). diff --git a/versioned_docs/version-5.5.1/source/markdown/options/hosts-file.md b/versioned_docs/version-5.5.1/source/markdown/options/hosts-file.md new file mode 100644 index 000000000..9fd982ab1 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/hosts-file.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hosts-file**=*path* | *none* | *image* + +Base file to create the `/etc/hosts` file inside the container. This must either +be an absolute path to a file on the host system, or one of the following +special flags: + "" Follow the `base_hosts_file` configuration in _containers.conf_ (the default) + `none` Do not use a base file (i.e. start with an empty file) + `image` Use the container image's `/etc/hosts` file as base file diff --git a/versioned_docs/version-5.5.1/source/markdown/options/hostuser.md b/versioned_docs/version-5.5.1/source/markdown/options/hostuser.md new file mode 100644 index 000000000..ba2161468 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/hostuser.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hostuser**=*name* + +Add a user account to /etc/passwd from the host to the container. The Username +or UID must exist on the host system. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/http-proxy.md b/versioned_docs/version-5.5.1/source/markdown/options/http-proxy.md new file mode 100644 index 000000000..fa7926049 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/http-proxy.md @@ -0,0 +1,25 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, create, farm build, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/identity-label.md b/versioned_docs/version-5.5.1/source/markdown/options/identity-label.md new file mode 100644 index 000000000..a52f91ecc --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/identity-label.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--identity-label** + +Adds default identity label `io.buildah.version` if set. (default true). diff --git a/versioned_docs/version-5.5.1/source/markdown/options/ignore.md b/versioned_docs/version-5.5.1/source/markdown/options/ignore.md new file mode 100644 index 000000000..8cbb48b94 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/ignore.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman pod rm, pod stop, rm, stop +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ignore**, **-i** + +Ignore errors when specified <> are not in the container store. A user +might have decided to manually remove a <> which leads to a failure +during the ExecStop directive of a systemd service referencing that <>. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/ignorefile.md b/versioned_docs/version-5.5.1/source/markdown/options/ignorefile.md new file mode 100644 index 000000000..d882784d9 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/ignorefile.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ignorefile** + +Path to an alternative .containerignore file. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/iidfile.md b/versioned_docs/version-5.5.1/source/markdown/options/iidfile.md new file mode 100644 index 000000000..4c92b71ef --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/iidfile.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--iidfile**=*ImageIDfile* + +Write the built image's ID to the file. When `--platform` is specified more than once, attempting to use this option triggers an error. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/image-volume.md b/versioned_docs/version-5.5.1/source/markdown/options/image-volume.md new file mode 100644 index 000000000..b3dc0a327 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/image-volume.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--image-volume**=**bind** | *tmpfs* | *ignore* + +Tells Podman how to handle the builtin image volumes. Default is **bind**. + +- **bind**: An anonymous named volume is created and mounted into the container. +- **tmpfs**: The volume is mounted onto the container as a tmpfs, which allows the users to create +content that disappears when the container is stopped. +- **ignore**: All volumes are just ignored and no action is taken. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/infra-command.md b/versioned_docs/version-5.5.1/source/markdown/options/infra-command.md new file mode 100644 index 000000000..7fdee78bb --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/infra-command.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--infra-command**=*command* + +The command that is run to start the infra container. Default: "/pause". diff --git a/versioned_docs/version-5.5.1/source/markdown/options/infra-conmon-pidfile.md b/versioned_docs/version-5.5.1/source/markdown/options/infra-conmon-pidfile.md new file mode 100644 index 000000000..fcccfb4ad --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/infra-conmon-pidfile.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--infra-conmon-pidfile**=*file* + +Write the pid of the infra container's **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to manage Podman containers and pods. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/infra-name.md b/versioned_docs/version-5.5.1/source/markdown/options/infra-name.md new file mode 100644 index 000000000..10a978266 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/infra-name.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--infra-name**=*name* + +The name that is used for the pod's infra container. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/inherit-labels.md b/versioned_docs/version-5.5.1/source/markdown/options/inherit-labels.md new file mode 100644 index 000000000..250e99bcc --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/inherit-labels.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--inherit-labels** + +Inherit the labels from the base image or base stages. (default true). diff --git a/versioned_docs/version-5.5.1/source/markdown/options/init-path.md b/versioned_docs/version-5.5.1/source/markdown/options/init-path.md new file mode 100644 index 000000000..722b50076 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/init-path.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--init-path**=*path* + +Path to the container-init binary. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/init.md b/versioned_docs/version-5.5.1/source/markdown/options/init.md new file mode 100644 index 000000000..c34f0d729 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/init.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--init** + +Run an init inside the container that forwards signals and reaps processes. +The container-init binary is mounted at `/run/podman-init`. +Mounting over `/run` breaks container execution. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/interactive.md b/versioned_docs/version-5.5.1/source/markdown/options/interactive.md new file mode 100644 index 000000000..60a5cd0c2 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/interactive.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, exec, run, start +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/ip.md b/versioned_docs/version-5.5.1/source/markdown/options/ip.md new file mode 100644 index 000000000..3dc0742f8 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/ip.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ip**=*ipv4* + +Specify a static IPv4 address for the <>, for example **10.88.64.128**. +This option can only be used if the <> is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the <> is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IP address pool (default **10.88.0.0/16**). + +To specify multiple static IP addresses per <>, set multiple networks using the **--network** option with a static IP address specified for each using the `ip` mode for that option. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/ip6.md b/versioned_docs/version-5.5.1/source/markdown/options/ip6.md new file mode 100644 index 000000000..20165192a --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/ip6.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ip6**=*ipv6* + +Specify a static IPv6 address for the <>, for example **fd46:db93:aa76\:ac37::10**. +This option can only be used if the <> is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the <> is not joining another container's network namespace via **--network=container\\:_id_**. +The address must be within the network's IPv6 address pool. + +To specify multiple static IPv6 addresses per <>, set multiple networks using the **--network** option with a static IPv6 address specified for each using the `ip6` mode for that option. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/ipc.image.md b/versioned_docs/version-5.5.1/source/markdown/options/ipc.image.md new file mode 100644 index 000000000..26e82e292 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/ipc.image.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ipc**=*how* + +Sets the configuration for IPC namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate +that a new IPC namespace is created, or it can be "host" to indicate +that the IPC namespace in which `podman` itself is being run is reused, +or it can be the path to an IPC namespace which is already in use by +another process. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/ipc.md b/versioned_docs/version-5.5.1/source/markdown/options/ipc.md new file mode 100644 index 000000000..0da4d87fc --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/ipc.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ipc**=*ipc* + +Set the IPC namespace mode for a container. The default is to create +a private IPC namespace. + +- "": Use Podman's default, defined in containers.conf. +- **container:**_id_: reuses another container's shared memory, semaphores, and message queues +- **host**: use the host's shared memory, semaphores, and message queues inside the container. Note: the host mode gives the container full access to local shared memory and is therefore considered insecure. +- **none**: private IPC namespace, with /dev/shm not mounted. +- **ns:**_path_: path to an IPC namespace to join. +- **private**: private IPC namespace. +- **shareable**: private IPC namespace with a possibility to share it with other containers. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/isolation.md b/versioned_docs/version-5.5.1/source/markdown/options/isolation.md new file mode 100644 index 000000000..9d86c62c9 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/isolation.md @@ -0,0 +1,22 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--isolation**=*type* + +Controls what type of isolation is used for running processes as part of `RUN` +instructions. Recognized types include *oci* (OCI-compatible runtime, the +default), *rootless* (OCI-compatible runtime invoked using a modified +configuration and its --rootless option enabled, with *--no-new-keyring +--no-pivot* added to its *create* invocation, with network and UTS namespaces +disabled, and IPC, PID, and user namespaces enabled; the default for +unprivileged users), and *chroot* (an internal wrapper that leans more toward +chroot(1) than container technology). + +Note: You can also override the default isolation type by setting the +BUILDAH\_ISOLATION environment variable. `export BUILDAH_ISOLATION=oci` diff --git a/versioned_docs/version-5.5.1/source/markdown/options/jobs.md b/versioned_docs/version-5.5.1/source/markdown/options/jobs.md new file mode 100644 index 000000000..677902f71 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/jobs.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--jobs**=*number* + +Run up to N concurrent stages in parallel. If the number of jobs is greater +than 1, stdin is read from /dev/null. If 0 is specified, then there is +no limit in the number of jobs that run in parallel. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/label-file.md b/versioned_docs/version-5.5.1/source/markdown/options/label-file.md new file mode 100644 index 000000000..68d29ecd7 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/label-file.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--label-file**=*file* + +Read in a line-delimited file of labels. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/label.image.md b/versioned_docs/version-5.5.1/source/markdown/options/label.image.md new file mode 100644 index 000000000..5e9a88eb7 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/label.image.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--label**=*label* + +Add an image *label* (e.g. label=*value*) to the image metadata. Can be used +multiple times. + +Users can set a special LABEL **io.containers.capabilities=CAP1,CAP2,CAP3** in +a Containerfile that specifies the list of Linux capabilities required for the +container to run properly. This label specified in a container image tells +Podman to run the container with just these capabilities. Podman launches the +container with just the specified capabilities, as long as this list of +capabilities is a subset of the default list. + +If the specified capabilities are not in the default set, Podman prints an error +message and runs the container with the default capabilities. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/label.md b/versioned_docs/version-5.5.1/source/markdown/options/label.md new file mode 100644 index 000000000..6d96391b9 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/label.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--label**, **-l**=*key=value* + +Add metadata to a <>. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/latest.md b/versioned_docs/version-5.5.1/source/markdown/options/latest.md new file mode 100644 index 000000000..4a2080d57 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/latest.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman attach, container diff, container inspect, diff, exec, init, inspect, kill, logs, mount, network reload, pause, pod inspect, pod kill, pod logs, pod rm, pod start, pod stats, pod stop, pod top, port, restart, rm, start, stats, stop, top, unmount, unpause, wait +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--latest**, **-l** + +Instead of providing the <> name or ID, use the last created <>. +Note: the last started <> can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.1/source/markdown/options/layer-label.md b/versioned_docs/version-5.5.1/source/markdown/options/layer-label.md new file mode 100644 index 000000000..0725c801d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/layer-label.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--layer-label**=*label[=value]* + +Add an intermediate image *label* (e.g. label=*value*) to the intermediate +image metadata. It can be used multiple times. + +If *label* is named, but neither `=` nor a `value` is provided, then +the *label* is set to an empty value. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/layers.md b/versioned_docs/version-5.5.1/source/markdown/options/layers.md new file mode 100644 index 000000000..1276eb644 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/layers.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--layers** + +Cache intermediate images during the build process (Default is `true`). + +Note: You can also override the default value of layers by setting the +BUILDAH\_LAYERS environment variable. `export BUILDAH_LAYERS=true` diff --git a/versioned_docs/version-5.5.1/source/markdown/options/link-local-ip.md b/versioned_docs/version-5.5.1/source/markdown/options/link-local-ip.md new file mode 100644 index 000000000..dcfdf689e --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/link-local-ip.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--link-local-ip**=*ip* + +Not implemented. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/log-driver.md b/versioned_docs/version-5.5.1/source/markdown/options/log-driver.md new file mode 100644 index 000000000..635ae5b20 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/log-driver.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--log-driver**=*driver* + +Logging driver for the container. Currently available options are **k8s-file**, **journald**, **none**, **passthrough** and **passthrough-tty**, with **json-file** aliased to **k8s-file** for scripting compatibility. (Default **journald**). + +The podman info command below displays the default log-driver for the system. +``` +$ podman info --format '{{ .Host.LogDriver }}' +journald +``` +The **passthrough** driver passes down the standard streams (stdin, stdout, stderr) to the +container. It is not allowed with the remote Podman client, including Mac and Windows (excluding WSL2) machines, and on a tty, since it is +vulnerable to attacks via TIOCSTI. + +The **passthrough-tty** driver is the same as **passthrough** except that it also allows it to be used on a TTY if the user really wants it. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/log-opt.md b/versioned_docs/version-5.5.1/source/markdown/options/log-opt.md new file mode 100644 index 000000000..9c76b3f15 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/log-opt.md @@ -0,0 +1,25 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, kube play, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--log-opt**=*name=value* + +Logging driver specific options. + +Set custom logging configuration. The following *name*s are supported: + +**path**: specify a path to the log file + (e.g. **--log-opt path=/var/log/container/mycontainer.json**); + +**max-size**: specify a max size of the log file + (e.g. **--log-opt max-size=10mb**); + +**tag**: specify a custom log tag for the container + (e.g. **--log-opt tag="{{.ImageName}}"**. +It supports the same keys as **podman inspect --format**. +This option is currently supported only by the **journald** log driver. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/logfile.md b/versioned_docs/version-5.5.1/source/markdown/options/logfile.md new file mode 100644 index 000000000..29db2223b --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/logfile.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--logfile**=*filename* + +Log output which is sent to standard output and standard error to the +specified file instead of to standard output and standard error. +This option is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/mac-address.md b/versioned_docs/version-5.5.1/source/markdown/options/mac-address.md new file mode 100644 index 000000000..8ba6953ec --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/mac-address.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--mac-address**=*address* + +<> network interface MAC address (e.g. 92:d0\:c6:0a:29:33) +This option can only be used if the <> is joined to only a single network - i.e., **--network=_network-name_** is used at most once - +and if the <> is not joining another container's network namespace via **--network=container\:_id_**. + +Remember that the MAC address in an Ethernet network must be unique. +The IPv6 link-local address is based on the device's MAC address +according to RFC4862. + +To specify multiple static MAC addresses per <>, set multiple networks using the **--network** option with a static MAC address specified for each using the `mac` mode for that option. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/manifest.md b/versioned_docs/version-5.5.1/source/markdown/options/manifest.md new file mode 100644 index 000000000..77bb69a5b --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/manifest.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--manifest**=*manifest* + +Name of the manifest list to which the image is added. Creates the manifest list if it does not exist. This option is useful for building multi architecture images. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/memory-reservation.md b/versioned_docs/version-5.5.1/source/markdown/options/memory-reservation.md new file mode 100644 index 000000000..52e51ea0b --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/memory-reservation.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman container clone, create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/memory-swap.md b/versioned_docs/version-5.5.1/source/markdown/options/memory-swap.md new file mode 100644 index 000000000..14d5b3b6c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/memory-swap.md @@ -0,0 +1,22 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/memory-swappiness.md b/versioned_docs/version-5.5.1/source/markdown/options/memory-swappiness.md new file mode 100644 index 000000000..528d843a8 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/memory-swappiness.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman container clone, create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/memory.md b/versioned_docs/version-5.5.1/source/markdown/options/memory.md new file mode 100644 index 000000000..dacaa86a3 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/memory.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/mount.md b/versioned_docs/version-5.5.1/source/markdown/options/mount.md new file mode 100644 index 000000000..48ff9838f --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/mount.md @@ -0,0 +1,133 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--mount**=*type=TYPE,TYPE-SPECIFIC-OPTION[,...]* + +Attach a filesystem mount to the container. + +Current supported mount TYPEs are **artifact**, **bind**, **devpts**, **glob**, **image**, **ramfs**, **tmpfs** and **volume**. + +Options common to all mount types: + +- *src*, *source*: mount source spec for **bind**, **glob**, and **volume**. + Mandatory for **artifact**, **bind**, **glob**, **image** and **volume**. + +- *dst*, *destination*, *target*: mount destination spec. + +When source globs are specified without the destination directory, +the files and directories are mounted with their complete path +within the container. When the destination is specified, the +files and directories matching the glob on the base file name +on the destination directory are mounted. The option +`type=glob,src=/foo*,destination=/tmp/bar` tells container engines +to mount host files matching /foo* to the /tmp/bar/ +directory in the container. + +Options specific to type=**artifact**: + +- *digest*: If the artifact source contains multiple blobs a digest can be + specified to only mount the one specific blob with the digest. + +- *title*: If the artifact source contains multiple blobs a title can be set + which is compared against `org.opencontainers.image.title` annotation. + +The *src* argument contains the name of the artifact, which must already exist locally. +The *dst* argument contains the target path, if the path in the container is a +directory or does not exist the blob title (`org.opencontainers.image.title` +annotation) will be used as filename and joined to the path. If the annotation +does not exist the digest will be used as filename instead. This results in all blobs +of the artifact mounted into the container at the given path. + +However, if the *dst* path is an existing file in the container, then the blob will be +mounted directly on it. This only works when the artifact contains a single blob +or when either *digest* or *title* are specified. + +Options specific to type=**volume**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *idmap*: If specified, create an idmapped mount to the target user namespace in the container. + The idmap option is only supported by Podman in rootful mode. The Linux kernel does not allow the use of idmapped file systems for unprivileged users. + The idmap option supports a custom mapping that can be different than the user namespace used by the container. + The mapping can be specified after the idmap option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the first value is the + start of the backing file system IDs that are mapped to the second value on the host. The length of this mapping is given in the third value. + Multiple ranges are separated with #. If the specified mapping is prepended with a '@', then the mapping is considered relative to the container + user namespace. The host ID for the mapping is changed to account for the relative position of the container user in the container user namespace. + +Options specific to type=**image**: + +- *rw*, *readwrite*: *true* or *false* (default if unspecified: *false*). + +- *subpath*: Mount only a specific path within the image, instead of the whole image. + +Options specific to **bind** and **glob**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *bind-propagation*: *shared*, *slave*, *private*, *unbindable*, *rshared*, *rslave*, *runbindable*, or **rprivate** (default).[[1]](#Footnote1) See also mount(2). + +- *bind-nonrecursive*: do not set up a recursive bind mount. By default it is recursive. + +- *relabel*: *shared*, *private*. + +- *idmap*: *true* or *false* (default if unspecified: *false*). If true, create an idmapped mount to the target user namespace in the container. The idmap option is only supported by Podman in rootful mode. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *no-dereference*: do not dereference symlinks but copy the link source into the mount destination. + +Options specific to type=**tmpfs** and **ramfs**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *tmpfs-size*: Size of the tmpfs/ramfs mount, in bytes. Unlimited by default in Linux. + +- *tmpfs-mode*: Octal file mode of the tmpfs/ramfs (e.g. 700 or 0700.). + +- *tmpcopyup*: Enable copyup from the image directory at the same location to the tmpfs/ramfs. Used by default. + +- *notmpcopyup*: Disable copying files from the image to the tmpfs/ramfs. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +Options specific to type=**devpts**: + +- *uid*: numeric UID of the file owner (default: 0). + +- *gid*: numeric GID of the file owner (default: 0). + +- *mode*: octal permission mask for the file (default: 600). + +- *max*: maximum number of PTYs (default: 1048576). + +Examples: + +- `type=bind,source=/path/on/host,destination=/path/in/container` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared,U=true` + +- `type=devpts,destination=/dev/pts` + +- `type=glob,src=/usr/lib/libfoo*,destination=/usr/lib,ro=true` + +- `type=image,source=fedora,destination=/fedora-image,rw=true` + +- `type=ramfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,destination=/path/in/container,noswap` + +- `type=artifact,src=quay.io/libpod/testartifact:20250206-single,dst=/data` + +- `type=artifact,src=quay.io/libpod/testartifact:20250206-multi,dst=/data,title=test1` diff --git a/versioned_docs/version-5.5.1/source/markdown/options/name.container.md b/versioned_docs/version-5.5.1/source/markdown/options/name.container.md new file mode 100644 index 000000000..c9236fd89 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/name.container.md @@ -0,0 +1,25 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--name**=*name* + +Assign a name to the container. + +The operator can identify a container in three ways: + +- UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”); +- UUID short identifier (“f78375b1c487”); +- Name (“jonah”). + +Podman generates a UUID for each container, and if no name is assigned to the +container using **--name**, Podman generates a random string name. The name can +be useful as a more human-friendly way to identify containers. This works for +both background and foreground containers. The container's name is also added +to the `/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). diff --git a/versioned_docs/version-5.5.1/source/markdown/options/names.md b/versioned_docs/version-5.5.1/source/markdown/options/names.md new file mode 100644 index 000000000..f9341f0aa --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/names.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--names**, **-n** + +Output the container names instead of the container IDs in the log. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/network-alias.md b/versioned_docs/version-5.5.1/source/markdown/options/network-alias.md new file mode 100644 index 000000000..b1bcfb62c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/network-alias.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--network-alias**=*alias* + +Add a network-scoped alias for the <>, setting the alias for all networks that the container joins. To set a +name only for a specific network, use the alias option as described under the **--network** option. +If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. This option can be specified multiple times. +NOTE: When using CNI a <> only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/network.image.md b/versioned_docs/version-5.5.1/source/markdown/options/network.image.md new file mode 100644 index 000000000..a61aff1e5 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/network.image.md @@ -0,0 +1,68 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--network**=*mode*, **--net** + +Sets the configuration for network namespaces when handling `RUN` instructions. + +Valid _mode_ values are: + +- **none**: no networking. +- **host**: use the Podman host network stack. Note: the host mode gives the +container full access to local system services such as D-bus and is therefore +considered insecure. +- **ns:**_path_: path to a network namespace to join. +- **private**: create a new namespace for the container (default) +- **\**: Join the network with the given name or ID, e.g. use `--network mynet` to join the network with the name mynet. Only supported for rootful users. +- **slirp4netns[\\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=MTU**: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=CIDR**: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=INTERFACE**: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=IPv4**: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=INTERFACE**: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=IPv6**: Specify the outbound ipv6 address slirp binds to. +- **pasta[\\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance diff --git a/versioned_docs/version-5.5.1/source/markdown/options/network.md b/versioned_docs/version-5.5.1/source/markdown/options/network.md new file mode 100644 index 000000000..6ecae8845 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/network.md @@ -0,0 +1,99 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, kube play, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--network**=*mode*, **--net** + +Set the network mode for the <>. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + For better integration with DNS handling, **--dns-forward 169.254.1.1** is passed, + and this address is added to resolv.conf(5) as first resolver. It is possible to pass + **--dns-forward** explicitly in case a different IP address should be used. + To make the `host.containers.internal` /etc/hosts entry work and allow connections + to the host, **--map-guest-addr 169.254.1.2** is passed. Again, it can be set + explicitly to choose a different IP address. \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured (via Podman's + **--publish** or by passing the pasta **-t**/**-u** options directly), + to disable automatic port forwarding based on bound ports. Similarly, **-T none** + and **-U none** are given to disable the same functionality from container to + host. \ + All options can also be set in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**; + see the `pasta_options` key under the network section in that file. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance diff --git a/versioned_docs/version-5.5.1/source/markdown/options/no-cache.md b/versioned_docs/version-5.5.1/source/markdown/options/no-cache.md new file mode 100644 index 000000000..4c4e2f591 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/no-cache.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-cache** + +Do not use existing cached images for the container build. Build from the start with a new set of cached layers. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/no-healthcheck.md b/versioned_docs/version-5.5.1/source/markdown/options/no-healthcheck.md new file mode 100644 index 000000000..43eceed8a --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/no-healthcheck.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-healthcheck** + +Disable any defined healthchecks for container. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/no-hostname.md b/versioned_docs/version-5.5.1/source/markdown/options/no-hostname.md new file mode 100644 index 000000000..f12301106 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/no-hostname.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, create, farm build, kube play, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/no-hosts.md b/versioned_docs/version-5.5.1/source/markdown/options/no-hosts.md new file mode 100644 index 000000000..0772a8b00 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/no-hosts.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, create, farm build, kube play, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the <>. + +Podman assumes control over the <>'s `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/no-reset.md b/versioned_docs/version-5.5.1/source/markdown/options/no-reset.md new file mode 100644 index 000000000..bacabb6ff --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/no-reset.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman pod stats, stats +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-reset** + +Do not clear the terminal/screen in between reporting intervals diff --git a/versioned_docs/version-5.5.1/source/markdown/options/no-stream.md b/versioned_docs/version-5.5.1/source/markdown/options/no-stream.md new file mode 100644 index 000000000..e14c69229 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/no-stream.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman pod stats, stats +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-stream** + +Disable streaming <<|pod >>stats and only pull the first result, default setting is false diff --git a/versioned_docs/version-5.5.1/source/markdown/options/no-trunc.md b/versioned_docs/version-5.5.1/source/markdown/options/no-trunc.md new file mode 100644 index 000000000..edba361b5 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/no-trunc.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman artifact ls, images +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-trunc** + +Do not truncate the output (default *false*). diff --git a/versioned_docs/version-5.5.1/source/markdown/options/noheading.md b/versioned_docs/version-5.5.1/source/markdown/options/noheading.md new file mode 100644 index 000000000..f25fdf594 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/noheading.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman artifact ls, image trust, images, machine list, network ls, pod ps, secret ls, volume ls +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--noheading**, **-n** + +Omit the table headings from the listing. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/omit-history.md b/versioned_docs/version-5.5.1/source/markdown/options/omit-history.md new file mode 100644 index 000000000..361ff54ef --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/omit-history.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--omit-history** + +Omit build history information in the built image. (default false). + +This option is useful for the cases where end users explicitly +want to set `--omit-history` to omit the optional `History` from +built images or when working with images built using build tools that +do not include `History` information in their images. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/oom-kill-disable.md b/versioned_docs/version-5.5.1/source/markdown/options/oom-kill-disable.md new file mode 100644 index 000000000..c0edb7c83 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/oom-kill-disable.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--oom-kill-disable** + +Whether to disable OOM Killer for the container or not. + +This flag is not supported on cgroups V2 systems. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/oom-score-adj.md b/versioned_docs/version-5.5.1/source/markdown/options/oom-score-adj.md new file mode 100644 index 000000000..e729df0c7 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/oom-score-adj.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--oom-score-adj**=*num* + +Tune the host's OOM preferences for containers (accepts values from **-1000** to **1000**). + +When running in rootless mode, the specified value can't be lower than +the oom_score_adj for the current process. In this case, the +oom-score-adj is clamped to the current process value. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/os-feature.md b/versioned_docs/version-5.5.1/source/markdown/options/os-feature.md new file mode 100644 index 000000000..cf79d6645 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/os-feature.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os-feature**=*feature* + +Set the name of a required operating system *feature* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS feature list is kept, if the base image specified any. This option is typically only meaningful when the image's OS is Windows. + +If *feature* has a trailing `-`, then the *feature* is removed from the set of required features which is listed in the image. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/os-version.image.md b/versioned_docs/version-5.5.1/source/markdown/options/os-version.image.md new file mode 100644 index 000000000..e800f49e4 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/os-version.image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os-version**=*version* + +Set the exact required operating system *version* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS version is kept, if the base image specified one. This option is typically only meaningful when the image's OS is Windows, and is typically set in Windows base images, so using this option is usually unnecessary. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/os-version.md b/versioned_docs/version-5.5.1/source/markdown/options/os-version.md new file mode 100644 index 000000000..a74f73d01 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/os-version.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman manifest add, manifest annotate +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os-version**=*version* + +Specify the OS version which the list or index records as a requirement for the +image. This option is rarely used. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/os.md b/versioned_docs/version-5.5.1/source/markdown/options/os.md new file mode 100644 index 000000000..3f3bd36fa --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/os.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os**=*string* + +Set the OS of the image to be built, and that of the base image to be pulled, if the build uses one, instead of using the current operating system of the build host. Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/os.pull.md b/versioned_docs/version-5.5.1/source/markdown/options/os.pull.md new file mode 100644 index 000000000..abdb61914 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/os.pull.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os**=*OS* + +Override the OS, defaults to hosts, of the image to be pulled. For example, `windows`. +Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/passwd-entry.md b/versioned_docs/version-5.5.1/source/markdown/options/passwd-entry.md new file mode 100644 index 000000000..1744e8e54 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/passwd-entry.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--passwd-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/passwd` file within the container when `--passwd` is used. + +The variables $USERNAME, $UID, $GID, $NAME, $HOME are automatically replaced with their value at runtime. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/personality.md b/versioned_docs/version-5.5.1/source/markdown/options/personality.md new file mode 100644 index 000000000..c77daf030 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/personality.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--personality**=*persona* + +Personality sets the execution domain via Linux personality(2). diff --git a/versioned_docs/version-5.5.1/source/markdown/options/pid.container.md b/versioned_docs/version-5.5.1/source/markdown/options/pid.container.md new file mode 100644 index 000000000..14ef52600 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/pid.container.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pid**=*mode* + +Set the PID namespace mode for the container. +The default is to create a private PID namespace for the container. + +- **container:**_id_: join another container's PID namespace; +- **host**: use the host's PID namespace for the container. Note the host mode gives the container full access to local PID and is therefore considered insecure; +- **ns:**_path_: join the specified PID namespace; +- **private**: create a new namespace for the container (default). diff --git a/versioned_docs/version-5.5.1/source/markdown/options/pid.image.md b/versioned_docs/version-5.5.1/source/markdown/options/pid.image.md new file mode 100644 index 000000000..2ac81c1e6 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/pid.image.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pid**=*pid* + +Sets the configuration for PID namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new PID namespace is created, or it can be "host" to indicate that the PID namespace in which `podman` itself is being run is reused, or it can be the path to a PID namespace which is already in use by another +process. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/pid.pod.md b/versioned_docs/version-5.5.1/source/markdown/options/pid.pod.md new file mode 100644 index 000000000..1618f593e --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/pid.pod.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pid**=*pid* + +Set the PID mode for the pod. The default is to create a private PID namespace for the pod. Requires the PID namespace to be shared via --share. + + host: use the host’s PID namespace for the pod + ns: join the specified PID namespace + private: create a new namespace for the pod (default) diff --git a/versioned_docs/version-5.5.1/source/markdown/options/pidfile.md b/versioned_docs/version-5.5.1/source/markdown/options/pidfile.md new file mode 100644 index 000000000..5c8cdcd04 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/pidfile.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pidfile**=*path* + +When the pidfile location is specified, the container process' PID is written to the pidfile. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +If the pidfile option is not specified, the container process' PID is written to /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile. + +After the container is started, the location for the pidfile can be discovered with the following `podman inspect` command: + + $ podman inspect --format '{{ .PidFile }}' $CID + /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile diff --git a/versioned_docs/version-5.5.1/source/markdown/options/pids-limit.md b/versioned_docs/version-5.5.1/source/markdown/options/pids-limit.md new file mode 100644 index 000000000..5860d3aaf --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/pids-limit.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pids-limit**=*limit* + +Tune the container's pids limit. Set to **-1** to have unlimited pids for the container. The default is **2048** on systems that support "pids" cgroup controller. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/platform.md b/versioned_docs/version-5.5.1/source/markdown/options/platform.md new file mode 100644 index 000000000..2c01afeab --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/platform.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with --arch and --os) +The `--platform` option can be used to override the current architecture and operating system. +Unless overridden, subsequent lookups of the same image in the local storage matches this platform, regardless of the host. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/pod-id-file.container.md b/versioned_docs/version-5.5.1/source/markdown/options/pod-id-file.container.md new file mode 100644 index 000000000..c6bc81224 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/pod-id-file.container.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pod-id-file**=*file* + +Run container in an existing pod and read the pod's ID from the specified *file*. +When a container is run within a pod which has an infra-container, the infra-container starts first. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/pod-id-file.pod.md b/versioned_docs/version-5.5.1/source/markdown/options/pod-id-file.pod.md new file mode 100644 index 000000000..b04e35580 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/pod-id-file.pod.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman pod rm, pod start, pod stop +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pod-id-file**=*file* + +Read pod ID from the specified *file* and <> the pod. Can be specified multiple times. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/pod.run.md b/versioned_docs/version-5.5.1/source/markdown/options/pod.run.md new file mode 100644 index 000000000..e0f850106 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/pod.run.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pod**=*name* + +Run container in an existing pod. Podman makes the pod automatically if the pod name is prefixed with **new:**. +To make a pod with more granular options, use the **podman pod create** command before creating a container. +When a container is run with a pod with an infra-container, the infra-container is started first. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/preserve-fd.md b/versioned_docs/version-5.5.1/source/markdown/options/preserve-fd.md new file mode 100644 index 000000000..bcf1d6456 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/preserve-fd.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--preserve-fd**=*FD1[,FD2,...]* + +Pass down to the process the additional file descriptors specified in the comma separated list. It can be specified multiple times. +This option is only supported with the crun OCI runtime. It might be a security risk to use this option with other OCI runtimes. + +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.1/source/markdown/options/preserve-fds.md b/versioned_docs/version-5.5.1/source/markdown/options/preserve-fds.md new file mode 100644 index 000000000..6280a6226 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/preserve-fds.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--preserve-fds**=*N* + +Pass down to the process N additional file descriptors (in addition to 0, 1, 2). +The total FDs are 3+N. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.1/source/markdown/options/privileged.md b/versioned_docs/version-5.5.1/source/markdown/options/privileged.md new file mode 100644 index 000000000..5ec119eb9 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/privileged.md @@ -0,0 +1,28 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--privileged** + +Give extended privileges to this container. The default is **false**. + +By default, Podman containers are unprivileged (**=false**) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read-only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. +Due to the disabled security features, the privileged field should almost never +be set as containers can easily break out of confinement. + +Containers running in a user namespace (e.g., rootless containers) cannot have +more privileges than the user that launched them. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/publish-all.md b/versioned_docs/version-5.5.1/source/markdown/options/publish-all.md new file mode 100644 index 000000000..1468194ad --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/publish-all.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--publish-all**, **-P** + +Publish all exposed ports to random ports on the host interfaces. The default is **false**. + +When set to **true**, publish all exposed ports to the host interfaces. +If the operator uses **-P** (or **-p**) then Podman makes the +exposed port accessible on the host and the ports are available to any +client that can reach the host. + +When using this option, Podman binds any exposed port to a random port on the host +within an ephemeral port range defined by */proc/sys/net/ipv4/ip_local_port_range*. +To find the mapping between the host ports and the exposed ports, use **podman port**. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/publish.md b/versioned_docs/version-5.5.1/source/markdown/options/publish.md new file mode 100644 index 000000000..026e8ba90 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/publish.md @@ -0,0 +1,31 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--publish**, **-p**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Publish a container's port, or range of ports,<<| within this pod>> to the host. + +Both *hostPort* and *containerPort* can be specified as a range of ports. +When specifying ranges for both, the number of container ports in the +range must match the number of host ports in the range. + +If host IP is set to 0.0.0.0 or not set at all, the port is bound on all IPs on the host. + +By default, Podman publishes TCP ports. To publish a UDP port instead, give +`udp` as protocol. To publish both TCP and UDP ports, set `--publish` twice, +with `tcp`, and `udp` as protocols respectively. Rootful containers can also +publish ports using the `sctp` protocol. + +Host port does not have to be specified (e.g. `podman run -p 127.0.0.1::80`). +If it is not, the container port is randomly assigned a port on the host. + +Use **podman port** to see the actual mapping: `podman port $CONTAINER $CONTAINERPORT`. + +Note that the network drivers `macvlan` and `ipvlan` do not support port forwarding, +therefore this option will have no effect on such networks. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/pull.image.md b/versioned_docs/version-5.5.1/source/markdown/options/pull.image.md new file mode 100644 index 000000000..16c43d038 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/pull.image.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Only pull the image when it does not exist in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error when no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/pull.md b/versioned_docs/version-5.5.1/source/markdown/options/pull.md new file mode 100644 index 000000000..eb98a4e36 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/pull.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Pull the image only when the image is not in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error if no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/quiet.md b/versioned_docs/version-5.5.1/source/markdown/options/quiet.md new file mode 100644 index 000000000..363008579 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/quiet.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--quiet**, **-q** + +Suppress output messages which indicate which instruction is being processed, and of progress when pulling images from a registry, and when writing the output image. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/rdt-class.md b/versioned_docs/version-5.5.1/source/markdown/options/rdt-class.md new file mode 100644 index 000000000..26449ad7d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/rdt-class.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--rdt-class**=*intel-rdt-class-of-service* + +Rdt-class sets the class of service (CLOS or COS) for the container to run in. Based on the Cache Allocation Technology (CAT) feature that is part of Intel's Resource Director Technology (RDT) feature set, all container processes will run within the pre-configured COS, representing a part of the cache. The COS has to be created and configured using a pseudo file system (usually mounted at `/sys/fs/resctrl`) that the resctrl kernel driver provides. Assigning the container to a COS requires root privileges and thus doesn't work in a rootless environment. Currently, the feature is only supported using `runc` as a runtime. See for more details on creating a COS before a container can be assigned to it. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/read-only-tmpfs.md b/versioned_docs/version-5.5.1/source/markdown/options/read-only-tmpfs.md new file mode 100644 index 000000000..dae38bc86 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/read-only-tmpfs.md @@ -0,0 +1,31 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--read-only-tmpfs** + +When running --read-only containers, mount a read-write tmpfs on _/dev_, _/dev/shm_, _/run_, _/tmp_, and _/var/tmp_. The default is **true**. + +| --read-only | --read-only-tmpfs | / | /run, /tmp, /var/tmp| +| ----------- | ----------------- | ---- | ----------------------------------- | +| true | true | r/o | r/w | +| true | false | r/o | r/o | +| false | false | r/w | r/w | +| false | true | r/w | r/w | + +When **--read-only=true** and **--read-only-tmpfs=true** additional tmpfs are mounted on +the /tmp, /run, and /var/tmp directories. + +When **--read-only=true** and **--read-only-tmpfs=false** /dev and /dev/shm are marked +Read/Only and no tmpfs are mounted on /tmp, /run and /var/tmp. The directories +are exposed from the underlying image, meaning they are read-only by default. +This makes the container totally read-only. No writable directories exist within +the container. In this mode writable directories need to be added via external +volumes or mounts. + +By default, when **--read-only=false**, the /dev and /dev/shm are read/write, and the /tmp, /run, and /var/tmp are read/write directories from the container image. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/read-only.md b/versioned_docs/version-5.5.1/source/markdown/options/read-only.md new file mode 100644 index 000000000..69edc49e1 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/read-only.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--read-only** + +Mount the container's root filesystem as read-only. + +By default, container root filesystems are writable, allowing processes +to write files anywhere. By specifying the **--read-only** flag, the containers root filesystem are mounted read-only prohibiting any writes. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/replace.md b/versioned_docs/version-5.5.1/source/markdown/options/replace.md new file mode 100644 index 000000000..2d7143e57 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/replace.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--replace** + +If another <> with the same name already exists, replace and remove it. The default is **false**. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/requires.md b/versioned_docs/version-5.5.1/source/markdown/options/requires.md new file mode 100644 index 000000000..9837b4779 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/requires.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--requires**=*container* + +Specify one or more requirements. +A requirement is a dependency container that is started before this container. +Containers can be specified by name or ID, with multiple containers being separated by commas. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/restart.md b/versioned_docs/version-5.5.1/source/markdown/options/restart.md new file mode 100644 index 000000000..b8eace16c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/restart.md @@ -0,0 +1,27 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). diff --git a/versioned_docs/version-5.5.1/source/markdown/options/retry-delay.md b/versioned_docs/version-5.5.1/source/markdown/options/retry-delay.md new file mode 100644 index 000000000..53756c037 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/retry-delay.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, build, create, farm build, pull, push, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/retry.md b/versioned_docs/version-5.5.1/source/markdown/options/retry.md new file mode 100644 index 000000000..f1d7474b1 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/retry.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, build, create, farm build, pull, push, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/rm.md b/versioned_docs/version-5.5.1/source/markdown/options/rm.md new file mode 100644 index 000000000..a748d84d2 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/rm.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--rm** + +Remove intermediate containers after a successful build (default true). diff --git a/versioned_docs/version-5.5.1/source/markdown/options/rootfs.md b/versioned_docs/version-5.5.1/source/markdown/options/rootfs.md new file mode 100644 index 000000000..c4ddf2072 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/rootfs.md @@ -0,0 +1,39 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--rootfs** + +If specified, the first argument refers to an exploded container on the file system. + +This is useful to run a container without requiring any image management, the rootfs +of the container is assumed to be managed externally. + + `Overlay Rootfs Mounts` + + The `\:O` flag tells Podman to mount the directory from the rootfs path as +storage using the `overlay file system`. The container processes +can modify content within the mount point which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +Note: On **SELinux** systems, the rootfs needs the correct label, which is by default +**unconfined_u:object_r:container_file_t\\:s0**. + + `idmap` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. +The idmap option supports a custom mapping that can be different than the user +namespace used by the container. The mapping can be specified after the idmap +option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the +first value is the start of the backing file system IDs that are mapped to the +second value on the host. The length of this mapping is given in the third value. +Multiple ranges are separated with #. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/runtime-flag.md b/versioned_docs/version-5.5.1/source/markdown/options/runtime-flag.md new file mode 100644 index 000000000..624676f05 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/runtime-flag.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--runtime-flag**=*flag* + +Adds global flags for the container runtime. To list the supported flags, please consult the manpages of the selected container runtime. + +Note: Do not pass the leading -- to the flag. To pass the runc flag --log-format json to buildah build, the option given is --runtime-flag log-format=json. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/runtime.md b/versioned_docs/version-5.5.1/source/markdown/options/runtime.md new file mode 100644 index 000000000..2f7da9b17 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/runtime.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--runtime**=*path* + +The *path* to an alternate OCI-compatible runtime, which is used to run +commands specified by the **RUN** instruction. + +Note: You can also override the default runtime by setting the BUILDAH\_RUNTIME environment variable. `export BUILDAH_RUNTIME=/usr/local/bin/runc` diff --git a/versioned_docs/version-5.5.1/source/markdown/options/sbom-image-output.md b/versioned_docs/version-5.5.1/source/markdown/options/sbom-image-output.md new file mode 100644 index 000000000..6257a4076 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/sbom-image-output.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-image-output**=*path* + +When generating SBOMs, store the generated SBOM in the specified path in the +output image. There is no default. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/sbom-image-purl-output.md b/versioned_docs/version-5.5.1/source/markdown/options/sbom-image-purl-output.md new file mode 100644 index 000000000..b37fc7acf --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/sbom-image-purl-output.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-image-purl-output**=*path* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the specified path in the output +image. There is no default. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/sbom-merge-strategy.md b/versioned_docs/version-5.5.1/source/markdown/options/sbom-merge-strategy.md new file mode 100644 index 000000000..4f0cf46de --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/sbom-merge-strategy.md @@ -0,0 +1,29 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-merge-strategy**=*method* + +If more than one **--sbom-scanner-command** value is being used, use the +specified method to merge the output from later commands with output from +earlier commands. Recognized values include: + + - cat + Concatenate the files. + - merge-cyclonedx-by-component-name-and-version + Merge the "component" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "version" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + - merge-spdx-by-package-name-and-versioninfo + Merge the "package" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "versionInfo" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/sbom-output.md b/versioned_docs/version-5.5.1/source/markdown/options/sbom-output.md new file mode 100644 index 000000000..898827116 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/sbom-output.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-output**=*file* + +When generating SBOMs, store the generated SBOM in the named file on the local +filesystem. There is no default. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/sbom-purl-output.md b/versioned_docs/version-5.5.1/source/markdown/options/sbom-purl-output.md new file mode 100644 index 000000000..fbb550279 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/sbom-purl-output.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-purl-output**=*file* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the named file in the local +filesystem. There is no default. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/sbom-scanner-command.md b/versioned_docs/version-5.5.1/source/markdown/options/sbom-scanner-command.md new file mode 100644 index 000000000..5ad42c2a7 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/sbom-scanner-command.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-scanner-command**=*image* + +Generate SBOMs by running the specified command from the scanner image. If +multiple commands are specified, they are run in the order in which they are +specified. These text substitutions are performed: + - {ROOTFS} + The root of the built image's filesystem, bind mounted. + - {CONTEXT} + The build context and additional build contexts, bind mounted. + - {OUTPUT} + The name of a temporary output file, to be read and merged with others or copied elsewhere. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/sbom-scanner-image.md b/versioned_docs/version-5.5.1/source/markdown/options/sbom-scanner-image.md new file mode 100644 index 000000000..8130914e6 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/sbom-scanner-image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-scanner-image**=*image* + +Generate SBOMs using the specified scanner image. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/sbom.md b/versioned_docs/version-5.5.1/source/markdown/options/sbom.md new file mode 100644 index 000000000..ca4e53a99 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/sbom.md @@ -0,0 +1,38 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom**=*preset* + +Generate SBOMs (Software Bills Of Materials) for the output image by scanning +the working container and build contexts using the named combination of scanner +image, scanner commands, and merge strategy. Must be specified with one or +more of **--sbom-image-output**, **--sbom-image-purl-output**, **--sbom-output**, +and **--sbom-purl-output**. Recognized presets, and the set of options which +they equate to: + + - "syft", "syft-cyclonedx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output cyclonedx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output cyclonedx-json={OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "syft-spdx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output spdx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output spdx-json={OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + - "trivy", "trivy-cyclonedx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "trivy-spdx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo diff --git a/versioned_docs/version-5.5.1/source/markdown/options/sdnotify.md b/versioned_docs/version-5.5.1/source/markdown/options/sdnotify.md new file mode 100644 index 000000000..9e0041a97 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/sdnotify.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sdnotify**=**container** | *conmon* | *healthy* | *ignore* + +Determines how to use the NOTIFY_SOCKET, as passed with systemd and Type=notify. + +Default is **container**, which means allow the OCI runtime to proxy the socket into the +container to receive ready notification. Podman sets the MAINPID to conmon's pid. +The **conmon** option sets MAINPID to conmon's pid, and sends READY when the container +has started. The socket is never passed to the runtime or the container. +The **healthy** option sets MAINPID to conmon's pid, and sends READY when the container +has turned healthy; requires a healthcheck to be set. The socket is never passed to the runtime or the container. +The **ignore** option removes NOTIFY_SOCKET from the environment for itself and child processes, +for the case where some other process above Podman uses NOTIFY_SOCKET and Podman does not use it. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/seccomp-policy.md b/versioned_docs/version-5.5.1/source/markdown/options/seccomp-policy.md new file mode 100644 index 000000000..381f85eab --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/seccomp-policy.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--seccomp-policy**=*policy* + +Specify the policy to select the seccomp profile. If set to *image*, Podman looks for a "io.containers.seccomp.profile" label in the container-image config and use its value as a seccomp profile. Otherwise, Podman follows the *default* policy by applying the default profile unless specified otherwise via *--security-opt seccomp* as described below. + +Note that this feature is experimental and may change in the future. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/secret.image.md b/versioned_docs/version-5.5.1/source/markdown/options/secret.image.md new file mode 100644 index 000000000..e69707397 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/secret.image.md @@ -0,0 +1,28 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--secret**=**id=id[,src=*envOrFile*][,env=*ENV*][,type=*file* | *env*]** + +Pass secret information to be used in the Containerfile for building images +in a safe way that will not end up stored in the final image, or be seen in other stages. +The value of the secret will be read from an environment variable or file named +by the "id" option, or named by the "src" option if it is specified, or from an +environment variable specified by the "env" option. See [EXAMPLES](#examples). +The secret will be mounted in the container at `/run/secrets/id` by default. + +To later use the secret, use the --mount flag in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret` + +The location of the secret in the container can be overridden using the +"target", "dst", or "destination" option of the `RUN --mount` flag. + +`RUN --mount=type=secret,id=mysecret,target=/run/secrets/myothersecret cat /run/secrets/myothersecret` + +Note: changing the contents of secret files will not trigger a rebuild of layers that use said secrets. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/secret.md b/versioned_docs/version-5.5.1/source/markdown/options/secret.md new file mode 100644 index 000000000..6fba929e9 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/secret.md @@ -0,0 +1,59 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--secret**=*secret[,opt=opt ...]* + +Give the container access to a secret. Can be specified multiple times. + +A secret is a blob of sensitive data which a container needs at runtime but +is not stored in the image or in source control, such as usernames and passwords, +TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 512 kB in size). + +When secrets are specified as type `mount`, the secrets are copied and mounted into the container when a container is created. +When secrets are specified as type `env`, the secret is set as an environment variable within the container. +Secrets are written in the container at the time of container creation, and modifying the secret using `podman secret` commands +after the container is created affects the secret inside the container. + +Secrets and its storage are managed using the `podman secret` command. + +Secret Options + +- `type=mount|env` : How the secret is exposed to the container. + `mount` mounts the secret into the container as a file. + `env` exposes the secret as an environment variable. + Defaults to `mount`. +- `target=target` : Target of secret. + For mounted secrets, this is the path to the secret inside the container. + If a fully qualified path is provided, the secret is mounted at that location. + Otherwise, the secret is mounted to + `/run/secrets/target` for Linux containers or + `/var/run/secrets/target` for FreeBSD containers. + If the target is not set, the secret is mounted to `/run/secrets/secretname` by default. + For env secrets, this is the environment variable key. Defaults to `secretname`. +- `uid=0` : UID of secret. Defaults to 0. Mount secret type only. +- `gid=0` : GID of secret. Defaults to 0. Mount secret type only. +- `mode=0` : Mode of secret. Defaults to 0444. Mount secret type only. + + +Examples + +Mount at `/my/location/mysecret` with UID 1: +``` +--secret mysecret,target=/my/location/mysecret,uid=1 +``` + +Mount at `/run/secrets/customtarget` with mode 0777: +``` +--secret mysecret,target=customtarget,mode=0777 +``` + +Create a secret environment variable called `ENVSEC`: +``` +--secret mysecret,type=env,target=ENVSEC +``` diff --git a/versioned_docs/version-5.5.1/source/markdown/options/security-opt.image.md b/versioned_docs/version-5.5.1/source/markdown/options/security-opt.image.md new file mode 100644 index 000000000..02e808fb5 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/security-opt.image.md @@ -0,0 +1,27 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--security-opt**=*option* + +Security Options + +- `apparmor=unconfined` : Turn off apparmor confinement for the container +- `apparmor=alternate-profile` : Set the apparmor confinement profile for the +container + +- `label=user:USER` : Set the label user for the container processes +- `label=role:ROLE` : Set the label role for the container processes +- `label=type:TYPE` : Set the label process type for the container processes +- `label=level:LEVEL` : Set the label level for the container processes +- `label=filetype:TYPE` : Set the label file type for the container files +- `label=disable` : Turn off label separation for the container +- `no-new-privileges` : Disable container processes from gaining additional privileges + +- `seccomp=unconfined` : Turn off seccomp confinement for the container +- `seccomp=profile.json` : JSON file to be used as the seccomp filter for the container. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/security-opt.md b/versioned_docs/version-5.5.1/source/markdown/options/security-opt.md new file mode 100644 index 000000000..3103f3250 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/security-opt.md @@ -0,0 +1,41 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the <> +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the <> + +- **label=user:**_USER_: Set the label user for the <> processes +- **label=role:**_ROLE_: Set the label role for the <> processes +- **label=type:**_TYPE_: Set the label process type for the <> processes +- **label=level:**_LEVEL_: Set the label level for the <> processes +- **label=filetype:**_TYPE_: Set the label file type for the <> files +- **label=disable**: Turn off label separation for the <> + +Note: Labeling can be disabled for all <<|pods/>>containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the container<>. + +- **no-new-privileges**: Disable container processes from gaining additional privileges through the `execve(2)` system call (e.g. via setuid or setgid bits, or via file capabilities). Programs that rely on setuid/setgid bits set on their executable to change user id or group id are no longer able to do so, and any file capabilities added to the executable (e.g. via `setcap`) are not added to the permitted capability set. For more details, see: https://docs.kernel.org/userspace-api/no_new_privs.html. + +- **seccomp=unconfined**: Turn off seccomp confinement for the <>. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/shm-size-systemd.md b/versioned_docs/version-5.5.1/source/markdown/options/shm-size-systemd.md new file mode 100644 index 000000000..e5ac09808 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/shm-size-systemd.md @@ -0,0 +1,15 @@ +--- +title: of +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/shm-size.md b/versioned_docs/version-5.5.1/source/markdown/options/shm-size.md new file mode 100644 index 000000000..2f11ca810 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/shm-size.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, create, farm build, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the <>. +This option conflicts with **--ipc=host**. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/sig-proxy.md b/versioned_docs/version-5.5.1/source/markdown/options/sig-proxy.md new file mode 100644 index 000000000..267db2eba --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/sig-proxy.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman attach, run, start +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sig-proxy** + +Proxy received signals to the container process. SIGCHLD, SIGURG, SIGSTOP, and SIGKILL are not proxied. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/sign-by-sigstore.md b/versioned_docs/version-5.5.1/source/markdown/options/sign-by-sigstore.md new file mode 100644 index 000000000..51384bcf6 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/sign-by-sigstore.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman artifact push, manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sign-by-sigstore**=*param-file* + +Add a sigstore signature based on further options specified in a container's sigstore signing parameter file *param-file*. +See containers-sigstore-signing-params.yaml(5) for details about the file format. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/sign-passphrase-file.md b/versioned_docs/version-5.5.1/source/markdown/options/sign-passphrase-file.md new file mode 100644 index 000000000..b1f0dbb73 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/sign-passphrase-file.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman artifact push, manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sign-passphrase-file**=*path* + +If signing the image (using either **--sign-by** or **--sign-by-sigstore-private-key**), read the passphrase to use from the specified path. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/signal.md b/versioned_docs/version-5.5.1/source/markdown/options/signal.md new file mode 100644 index 000000000..363b75d8d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/signal.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman kill, pod kill +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--signal**, **-s**=**signal** + +Signal to send to the container<<|s in the pod>>. For more information on Linux signals, refer to *signal(7)*. +The default is **SIGKILL**. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/since.md b/versioned_docs/version-5.5.1/source/markdown/options/since.md new file mode 100644 index 000000000..fc50c4f02 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/since.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--since**=*TIMESTAMP* + +Show logs since TIMESTAMP. The --since option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/skip-unused-stages.md b/versioned_docs/version-5.5.1/source/markdown/options/skip-unused-stages.md new file mode 100644 index 000000000..70806873d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/skip-unused-stages.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--skip-unused-stages** + +Skip stages in multi-stage builds which don't affect the target stage. (Default: **true**). diff --git a/versioned_docs/version-5.5.1/source/markdown/options/squash-all.md b/versioned_docs/version-5.5.1/source/markdown/options/squash-all.md new file mode 100644 index 000000000..0333f1653 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/squash-all.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--squash-all** + +Squash all of the new image's layers (including those inherited from a base image) into a single new layer. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/squash.md b/versioned_docs/version-5.5.1/source/markdown/options/squash.md new file mode 100644 index 000000000..5337b47ed --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/squash.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--squash** + +Squash all of the image's new layers into a single new layer; any preexisting layers are not squashed. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/ssh.md b/versioned_docs/version-5.5.1/source/markdown/options/ssh.md new file mode 100644 index 000000000..f5181dc15 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/ssh.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ssh**=*default* | *id[=socket>* + +SSH agent socket or keys to expose to the build. +The socket path can be left empty to use the value of `default=$SSH_AUTH_SOCK` + +To later use the ssh agent, use the --mount option in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=ssh,id=id mycmd` diff --git a/versioned_docs/version-5.5.1/source/markdown/options/stop-signal.md b/versioned_docs/version-5.5.1/source/markdown/options/stop-signal.md new file mode 100644 index 000000000..58cbd4f3a --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/stop-signal.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--stop-signal**=*signal* + +Signal to stop a container. Default is **SIGTERM**. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/stop-timeout.md b/versioned_docs/version-5.5.1/source/markdown/options/stop-timeout.md new file mode 100644 index 000000000..ac6ecb575 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/stop-timeout.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--stop-timeout**=*seconds* + +Timeout to stop a container. Default is **10**. +Remote connections use local containers.conf for defaults. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/subgidname.md b/versioned_docs/version-5.5.1/source/markdown/options/subgidname.md new file mode 100644 index 000000000..3d5f22800 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/subgidname.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/subuidname.md b/versioned_docs/version-5.5.1/source/markdown/options/subuidname.md new file mode 100644 index 000000000..ff804d1de --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/subuidname.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/sysctl.md b/versioned_docs/version-5.5.1/source/markdown/options/sysctl.md new file mode 100644 index 000000000..f02d1405a --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/sysctl.md @@ -0,0 +1,30 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters <>. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: <>, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: <>, the above sysctls are not allowed. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/systemd.md b/versioned_docs/version-5.5.1/source/markdown/options/systemd.md new file mode 100644 index 000000000..f9636ed85 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/systemd.md @@ -0,0 +1,42 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--systemd**=*true* | *false* | *always* + +Run container in systemd mode. The default is **true**. + +- **true** enables systemd mode only when the command executed inside the container is *systemd*, */usr/sbin/init*, +*/sbin/init* or */usr/local/sbin/init*. + +- **false** disables systemd mode. + +- **always** enforces the systemd mode to be enabled. + +Running the container in systemd mode causes the following changes: + +* Podman mounts tmpfs file systems on the following directories + * _/run_ + * _/run/lock_ + * _/tmp_ + * _/sys/fs/cgroup/systemd_ (on a cgroup v1 system) + * _/var/lib/journal_ +* Podman sets the default stop signal to **SIGRTMIN+3**. +* Podman sets **container_uuid** environment variable in the container to the +first 32 characters of the container ID. +* Podman does not mount virtual consoles (_/dev/tty\d+_) when running with **--privileged**. +* On cgroup v2, */sys/fs/cgroup* is mounted writable. + +This allows systemd to run in a confined container without any modifications. + +Note that on **SELinux** systems, systemd attempts to write to the cgroup +file system. Containers writing to the cgroup file system are denied by default. +The **container_manage_cgroup** boolean must be enabled for this to be allowed on an SELinux separated system. +``` +setsebool -P container_manage_cgroup true +``` diff --git a/versioned_docs/version-5.5.1/source/markdown/options/tag.md b/versioned_docs/version-5.5.1/source/markdown/options/tag.md new file mode 100644 index 000000000..527fbcb35 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/tag.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tag**, **-t**=*imageName* + +Specifies the name which is assigned to the resulting image if the build process completes successfully. +If _imageName_ does not include a registry name, the registry name *localhost* is prepended to the image name. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/tail.md b/versioned_docs/version-5.5.1/source/markdown/options/tail.md new file mode 100644 index 000000000..9931f4855 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/tail.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tail**=*LINES* + +Output the specified number of LINES at the end of the logs. LINES must be an integer. Defaults to -1, +which prints all lines diff --git a/versioned_docs/version-5.5.1/source/markdown/options/target.md b/versioned_docs/version-5.5.1/source/markdown/options/target.md new file mode 100644 index 000000000..9f32f5ccf --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/target.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--target**=*stageName* + +Set the target build stage to build. When building a Containerfile with multiple build stages, --target can be used to specify an intermediate build stage by name as the final stage for the resulting image. Commands after the target stage is skipped. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/time.md b/versioned_docs/version-5.5.1/source/markdown/options/time.md new file mode 100644 index 000000000..dc3615fe8 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/time.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman pod rm, pod stop, restart, rm, stop +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping <>. +Use -1 for infinite wait. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/timeout.md b/versioned_docs/version-5.5.1/source/markdown/options/timeout.md new file mode 100644 index 000000000..55c2894f8 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/timeout.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--timeout**=*seconds* + +Maximum time a container is allowed to run before conmon sends it the kill +signal. By default containers run until they exit or are stopped by +`podman stop`. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/timestamp.md b/versioned_docs/version-5.5.1/source/markdown/options/timestamp.md new file mode 100644 index 000000000..3af9655e9 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/timestamp.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--timestamp**=*seconds* + +Set the create timestamp to seconds since epoch to allow for deterministic builds (defaults to current time). By default, the created timestamp is changed and written into the image manifest with every commit, causing the image's sha256 hash to be different even if the sources are exactly the same otherwise. +When --timestamp is set, the created timestamp is always set to the time specified and therefore not changed, allowing the image's sha256 hash to remain the same. All files committed to the layers of the image is created with the timestamp. + +If the only instruction in a Containerfile is `FROM`, this flag has no effect. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/timestamps.md b/versioned_docs/version-5.5.1/source/markdown/options/timestamps.md new file mode 100644 index 000000000..5b4bc385e --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/timestamps.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--timestamps**, **-t** + +Show timestamps in the log outputs. The default is false diff --git a/versioned_docs/version-5.5.1/source/markdown/options/tls-verify.md b/versioned_docs/version-5.5.1/source/markdown/options/tls-verify.md new file mode 100644 index 000000000..629aef085 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/tls-verify.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, auto update, build, container runlabel, create, farm build, kube play, login, manifest add, manifest create, manifest inspect, manifest push, pull, push, run, search +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/options/tmpfs.md b/versioned_docs/version-5.5.1/source/markdown/options/tmpfs.md new file mode 100644 index 000000000..8f59f286c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/tmpfs.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tmpfs**=*fs* + +Create a tmpfs mount. + +Mount a temporary filesystem (**tmpfs**) mount into a container, for example: + +``` +$ podman <> -d --tmpfs /tmp\:rw,size=787448k,mode=1777 my_image +``` + +This command mounts a **tmpfs** at _/tmp_ within the container. The supported mount +options are the same as the Linux default mount flags. If no options are specified, +the system uses the following options: +**rw,noexec,nosuid,nodev**. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/tty.md b/versioned_docs/version-5.5.1/source/markdown/options/tty.md new file mode 100644 index 000000000..6952d7341 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/tty.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tty**, **-t** + +Allocate a pseudo-TTY. The default is **false**. + +When set to **true**, Podman allocates a pseudo-tty and attach to the standard +input of the container. This can be used, for example, to run a throwaway +interactive shell. + +**NOTE**: The --tty flag prevents redirection of standard output. It combines STDOUT and STDERR, it can insert control characters, and it can hang pipes. This option is only used when run interactively in a terminal. When feeding input to Podman, use -i only, not -it. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/tz.md b/versioned_docs/version-5.5.1/source/markdown/options/tz.md new file mode 100644 index 000000000..06c99863c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/tz.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tz**=*timezone* + +Set timezone in container. This flag takes area-based timezones, GMT time, as well as `local`, which sets the timezone in the container to match the host machine. See `/usr/share/zoneinfo/` for valid timezones. +Remote connections use local containers.conf for defaults diff --git a/versioned_docs/version-5.5.1/source/markdown/options/uidmap.container.md b/versioned_docs/version-5.5.1/source/markdown/options/uidmap.container.md new file mode 100644 index 000000000..9c7c3eaff --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/uidmap.container.md @@ -0,0 +1,201 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uidmap**=*[flags]container_uid\:from_uid[\\:amount]* + +Run the container in a new user namespace using the supplied UID mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +The possible values of the optional *flags* are discussed further down on this page. +The *amount* value is optional and assumed to be **1** if not given. + +The *from_uid* value is based upon the user running the command, either rootful or rootless users. + +* rootful user: [*flags*]*container_uid*:*host_uid*[:*amount*] +* rootless user: [*flags*]*container_uid*:*intermediate_uid*[:*amount*] + + `Rootful mappings` + + +When **podman <>** is called by a privileged user, the option **--uidmap** +works as a direct mapping between host UIDs and container UIDs. + +host UID -> container UID + +The _amount_ specifies the number of consecutive UIDs that is mapped. +If for example _amount_ is **4** the mapping looks like: + +| host UID | container UID | +| ---------- | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | + + `Rootless mappings` + +When **podman <>** is called by an unprivileged user (i.e. running rootless), +the value *from_uid* is interpreted as an "intermediate UID". In the rootless +case, host UIDs are not mapped directly to container UIDs. Instead the mapping +happens over two mapping steps: + +host UID -> intermediate UID -> container UID + +The **--uidmap** option only influences the second mapping step. + +The first mapping step is derived by Podman from the contents of the file +_/etc/subuid_ and the UID of the user calling Podman. + +First mapping step: + +| host UID | intermediate UID | +| -------- | ---------------- | +| UID for Podman user | 0 | +| 1st subordinate UID | 1 | +| 2nd subordinate UID | 2 | +| 3rd subordinate UID | 3 | +| nth subordinate UID | n | + +To be able to use intermediate UIDs greater than zero, the user needs to have +subordinate UIDs configured in _/etc/subuid_. See **subuid**(5). + +The second mapping step is configured with **--uidmap**. + +If for example _amount_ is **5** the second mapping step looks like: + +| intermediate UID | container UID | +| ------------------ | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | +| *from_uid* + 4 | *container_uid* + 4 | + +When running as rootless, Podman uses all the ranges configured in the _/etc/subuid_ file. + +The current user ID is mapped to UID=0 in the rootless user namespace. +Every additional range is added sequentially afterward: + +| host | rootless user namespace | length | +| ------ | ----------------------- | ------ | +| $UID | 0 | 1 | +| 1 | $FIRST_RANGE_ID | $FIRST_RANGE_LENGTH | +| 1+$FIRST_RANGE_LENGTH | $SECOND_RANGE_ID | $SECOND_RANGE_LENGTH| + + `Referencing a host ID from the parent namespace` + +As a rootless user, the given host ID in **--uidmap** or **--gidmap** +is mapped from the *intermediate namespace* generated by Podman. Sometimes +it is desirable to refer directly at the *host namespace*. It is possible +to manually do so, by running `podman unshare cat /proc/self/gid_map`, +finding the desired host id at the second column of the output, and getting +the corresponding intermediate id from the first column. + +Podman can perform all that by preceding the host id in the mapping +with the `@` symbol. For instance, by specifying `--gidmap 100000:@2000:1`, +podman will look up the intermediate id corresponding to host id `2000` and +it will map the found intermediate id to the container id `100000`. The +given host id must have been subordinated (otherwise it would not be mapped +into the intermediate space in the first place). + +If the length is greater than one, for instance with `--gidmap 100000:@2000:2`, +Podman will map host ids `2000` and `2001` to `100000` and `100001`, respectively, +regardless of how the intermediate mapping is defined. + + `Extending previous mappings` + +Some mapping modifications may be cumbersome. For instance, a user +starts with a mapping such as `--gidmap="0:0:65000"`, that needs to be +changed such as the parent id `1000` is mapped to container id `100000` +instead, leaving container id `1` unassigned. The corresponding `--gidmap` +becomes `--gidmap="0:0:1" --gidmap="2:2:65534" --gidmap="100000:1:1"`. + +This notation can be simplified using the `+` flag, that takes care of +breaking previous mappings removing any conflicting assignment with +the given mapping. The flag is given before the container id +as follows: `--gidmap="0:0:65000" --gidmap="+100000:1:1"` + + + Flag | Example | Description +-----------|---------------|------------- + `+` | `+100000:1:1` | Extend the previous mapping + +This notation leads to gaps in the assignment, so it may be convenient to +fill those gaps afterwards: `--gidmap="0:0:65000" --gidmap="+100000:1:1" --gidmap="1:65001:1"` + +One specific use case for this flag is in the context of rootless +users. A rootless user may specify mappings with the `+` flag as +in `--gidmap="+100000:1:1"`. Podman will then "fill the gaps" starting +from zero with all the remaining intermediate ids. This is convenient when +a user wants to map a specific intermediate id to a container id, leaving +the rest of subordinate ids to be mapped by Podman at will. + + `Passing only one of --uidmap or --gidmap` + +Usually, subordinated user and group ids are assigned simultaneously, and +for any user the subordinated user ids match the subordinated group ids. +For convenience, if only one of **--uidmap** or **--gidmap** is given, +podman assumes the mapping refers to both UIDs and GIDs and applies the +given mapping to both. If only one value of the two needs to be changed, +the mappings should include the `u` or the `g` flags to specify that +they only apply to UIDs or GIDs and should not be copied over. + + flag | Example | Description +---------|-----------------|----------------- + `u` | `u20000:2000:1` |The mapping only applies to UIDs + `g` | `g10000:1000:1` |The mapping only applies to GIDs + +For instance given the command + + podman <> --gidmap "0:0:1000" --gidmap "g2000:2000:1" + +Since no **--uidmap** is given, the **--gidmap** is copied to **--uidmap**, +giving a command equivalent to + + podman <> --gidmap "0:0:1000" --gidmap "2000:2000:1" --uidmap "0:0:1000" + +The `--gidmap "g2000:2000:1"` used the `g` flag and therefore it was +not copied to **--uidmap**. + + `Rootless mapping of additional host GIDs` + +A rootless user may desire to map a specific host group that has already been +subordinated within _/etc/subgid_ without specifying the rest of the mapping. + +This can be done with **--gidmap "+g*container_gid*:@*host_gid*"** + +Where: + +- The host GID is given through the `@` symbol +- The mapping of this GID is not copied over to **--usermap** thanks to the `g` flag. +- The rest of the container IDs will be mapped starting from 0 to n, + with all the remaining subordinated GIDs, thanks to the `+` flag. + +For instance, if a user belongs to the group `2000` and that group is +subordinated to that user (with `usermod --add-subgids 2000-2000 $USER`), +the user can map the group into the container with: **--gidmap=+g100000:@2000**. + +If this mapping is combined with the option, **--group-add=keep-groups**, the +process in the container will belong to group `100000`, and files belonging +to group `2000` in the host will appear as being owned by group `100000` +inside the container. + + podman run --group-add=keep-groups --gidmap="+g100000:@2000" ... + + `No subordinate UIDs` + +Even if a user does not have any subordinate UIDs in _/etc/subuid_, +**--uidmap** can be used to map the normal UID of the user to a +container UID by running `podman <> --uidmap $container_uid:0:1 --user $container_uid ...`. + + `Pods` + +The **--uidmap** option cannot be called in conjunction with the **--pod** option as a uidmap cannot be set on the container level when in a pod. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/uidmap.pod.md b/versioned_docs/version-5.5.1/source/markdown/options/uidmap.pod.md new file mode 100644 index 000000000..1cb7d974f --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/uidmap.pod.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uidmap**=*container_uid\:from_uid\\:amount* + +Run all containers in the pod in a new user namespace using the supplied mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/ulimit.image.md b/versioned_docs/version-5.5.1/source/markdown/options/ulimit.image.md new file mode 100644 index 000000000..c033f7e27 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/ulimit.image.md @@ -0,0 +1,27 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ulimit**=*type=soft-limit[\\:hard-limit]* + +Specifies resource limits to apply to processes launched when processing `RUN` instructions. This option can be specified multiple times. Recognized resource types include: + "core": maximum core dump size (ulimit -c) + "cpu": maximum CPU time (ulimit -t) + "data": maximum size of a process's data segment (ulimit -d) + "fsize": maximum size of new files (ulimit -f) + "locks": maximum number of file locks (ulimit -x) + "memlock": maximum amount of locked memory (ulimit -l) + "msgqueue": maximum amount of data in message queues (ulimit -q) + "nice": niceness adjustment (nice -n, ulimit -e) + "nofile": maximum number of open files (ulimit -n) + "nproc": maximum number of processes (ulimit -u) + "rss": maximum size of a process's (ulimit -m) + "rtprio": maximum real-time scheduling priority (ulimit -r) + "rttime": maximum amount of real-time execution between blocking syscalls + "sigpending": maximum number of pending signals (ulimit -i) + "stack": maximum stack size (ulimit -s) diff --git a/versioned_docs/version-5.5.1/source/markdown/options/ulimit.md b/versioned_docs/version-5.5.1/source/markdown/options/ulimit.md new file mode 100644 index 000000000..c4626b203 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/ulimit.md @@ -0,0 +1,33 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ulimit**=*option* + +Ulimit options. Sets the ulimits values inside of the container. + +--ulimit with a soft and hard limit in the format =[:]. For example: + +$ podman run --ulimit nofile=1024:1024 --rm ubi9 ulimit -n +1024 + +Set -1 for the soft or hard limit to set the limit to the maximum limit of the current +process. In rootful mode this is often unlimited. + + +If nofile and nproc are unset, a default value of 1048576 will be used, unless overridden +in containers.conf(5). However, if the default value exceeds the hard limit for the current +rootless user, the current hard limit will be applied instead. + +Use **host** to copy the current configuration from the host. + +Don't use nproc with the ulimit flag as Linux uses nproc to set the +maximum number of processes available to a user, not to a container. + +Use the --pids-limit option to modify the cgroup control to limit the number +of processes within a container. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/umask.md b/versioned_docs/version-5.5.1/source/markdown/options/umask.md new file mode 100644 index 000000000..94ad72179 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/umask.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--umask**=*umask* + +Set the umask inside the container. Defaults to `0022`. +Remote connections use the local `containers.conf` for defaults. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/unsetenv-all.md b/versioned_docs/version-5.5.1/source/markdown/options/unsetenv-all.md new file mode 100644 index 000000000..39f7e040d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/unsetenv-all.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetenv-all** + +Unset all default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/unsetenv.image.md b/versioned_docs/version-5.5.1/source/markdown/options/unsetenv.image.md new file mode 100644 index 000000000..faefc9317 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/unsetenv.image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetenv**=*env* + +Unset environment variables from the final image. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/unsetenv.md b/versioned_docs/version-5.5.1/source/markdown/options/unsetenv.md new file mode 100644 index 000000000..daa272b3f --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/unsetenv.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetenv**=*env* + +Unset default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/unsetenv.update.md b/versioned_docs/version-5.5.1/source/markdown/options/unsetenv.update.md new file mode 100644 index 000000000..d56c1234e --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/unsetenv.update.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetenv**=*env* + +Unset environment variables from the container. + +Note that the env updates only affect the main container process after +the next start. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/unsetlabel.md b/versioned_docs/version-5.5.1/source/markdown/options/unsetlabel.md new file mode 100644 index 000000000..8a1b9072b --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/unsetlabel.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetlabel**=*label* + +Unset the image label, causing the label not to be inherited from the base image. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/until.md b/versioned_docs/version-5.5.1/source/markdown/options/until.md new file mode 100644 index 000000000..0923ed22f --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/until.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--until**=*TIMESTAMP* + +Show logs until TIMESTAMP. The --until option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/user-mode-networking.md b/versioned_docs/version-5.5.1/source/markdown/options/user-mode-networking.md new file mode 100644 index 000000000..1df2f5f5c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/user-mode-networking.md @@ -0,0 +1,26 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman machine init, machine set +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--user-mode-networking** + +Indicates that this machine relays traffic from the guest through a user-space +process running on the host. In some VPN configurations the VPN may drop +traffic from alternate network interfaces, including VM network devices. By +enabling user-mode networking (a setting of `true`), VPNs observe all +podman machine traffic as coming from the host, bypassing the problem. + +When the qemu backend is used (Linux, Mac), user-mode networking is +mandatory and the only allowed value is `true`. In contrast, The Windows/WSL +backend defaults to `false`, and follows the standard WSL network setup. +Changing this setting to `true` on Windows/WSL informs Podman to replace +the WSL networking setup on start of this machine instance with a user-mode +networking distribution. Since WSL shares the same kernel across +distributions, all other running distributions reuses this network. +Likewise, when the last machine instance with a `true` setting stops, the +original networking setup is restored. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/user.md b/versioned_docs/version-5.5.1/source/markdown/options/user.md new file mode 100644 index 000000000..5def8fa3d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/user.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--user**, **-u**=*user[\:group]* + +Sets the username or UID used and, optionally, the groupname or GID for the specified command. Both *user* and *group* may be symbolic or numeric. + +Without this argument, the command runs as the user specified in the container image. Unless overridden by a `USER` command in the Containerfile or by a value passed to this option, this user generally defaults to root. + +When a user namespace is not in use, the UID and GID used within the container and on the host match. When user namespaces are in use, however, the UID and GID in the container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container by default corresponds to the UID and GID of the user invoking Podman. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/userns-gid-map-group.md b/versioned_docs/version-5.5.1/source/markdown/options/userns-gid-map-group.md new file mode 100644 index 000000000..e145faf37 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/userns-gid-map-group.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns-gid-map-group**=*group* + +Specifies that a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subgid` file which correspond to the specified group. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-uid-map-user is specified, but --userns-gid-map-group is not specified, `podman` assumes that the specified user name is also a +suitable group name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/userns-gid-map.md b/versioned_docs/version-5.5.1/source/markdown/options/userns-gid-map.md new file mode 100644 index 000000000..89022586b --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/userns-gid-map.md @@ -0,0 +1,24 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns-gid-map**=*mapping* + +Directly specifies a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container GID, a corresponding starting host-level GID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-gids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-gid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-gid-map are specified, but --userns-uid-map is specified, the GID map is set to use the same numeric values as the UID map. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/userns-uid-map-user.md b/versioned_docs/version-5.5.1/source/markdown/options/userns-uid-map-user.md new file mode 100644 index 000000000..462738b25 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/userns-uid-map-user.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns-uid-map-user**=*user* + +Specifies that a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subuid` file which correspond to the specified user. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-gid-map-group is specified, but --userns-uid-map-user is not specified, `podman` assumes that the specified group name is also a +suitable user name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/userns-uid-map.md b/versioned_docs/version-5.5.1/source/markdown/options/userns-uid-map.md new file mode 100644 index 000000000..134b197b0 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/userns-uid-map.md @@ -0,0 +1,24 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns-uid-map**=*mapping* + +Directly specifies a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions default to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container UID, a corresponding starting host-level UID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-uids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-uid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-uid-map are specified, but --userns-gid-map is specified, the UID map is set to use the same numeric values as the GID map. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/userns.container.md b/versioned_docs/version-5.5.1/source/markdown/options/userns.container.md new file mode 100644 index 000000000..e98f71daa --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/userns.container.md @@ -0,0 +1,74 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, kube play, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns**=*mode* + +Set the user namespace mode for the container. + +If `--userns` is not set, the default value is determined as follows. +- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used. +- If the environment variable **PODMAN_USERNS** is set its value is used. +- If `userns` is specified in `containers.conf` this value is used. +- Otherwise, `--userns=host` is assumed. + +`--userns=""` (i.e., an empty string) is an alias for `--userns=host`. + +This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +------------------------|-----------|--------------------- +auto | $UID | nil (Host User UID is not mapped into container.) +host | $UID | 0 (Default User account mapped to root user in container.) +keep-id | $UID | $UID (Map user account to same UID within container.) +keep-id\:uid=200,gid=210 | $UID | 200:210 (Map user account to specified UID, GID value within container.) +nomap | $UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + +**auto**[\:_OPTIONS,..._]: automatically create a unique user namespace. + +* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. + + Example: `containers:2147483647:2147483648`. + +* `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5). + +Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user IDs. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. + +The option `--userns=keep-id` uses all the subuids and subgids of the user. +The option `--userns=nomap` uses all the subuids and subgids of the user except the user's own ID. +Using `--userns=auto` when starting new containers does not work as long as any containers exist that were started with `--userns=nomap` or `--userns=keep-id` without limiting the user namespace size. + + Valid `auto` options: + + - *gidmapping*=_CONTAINER\_GID\:HOST\_GID\:SIZE_: to force a GID mapping to be present in the user namespace. + - *size*=_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates a size for the user namespace. + - *uidmapping*=_CONTAINER\_UID\:HOST\_UID\:SIZE_: to force a UID mapping to be present in the user namespace. + +The host UID and GID in *gidmapping* and *uidmapping* can optionally be prefixed with the `@` symbol. +In this case, podman will look up the intermediate ID corresponding to host ID and it will map the found intermediate ID to the container id. +For details see **--uidmap**. + +**container:**_id_: join the user namespace of the specified container. + +**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user. + +**keep-id**: creates a user namespace where the current user's UID\:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace. + + Valid `keep-id` options: + + - *uid*=UID: override the UID inside the container that is used to map the current user to. + - *gid*=GID: override the GID inside the container that is used to map the current user to. + - *size*=SIZE: override the size of the configured user namespace. It is useful to not saturate all the available IDs. Not supported when running as root. + +**nomap**: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +**ns:**_namespace_: run the <> in the given existing user namespace. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/userns.image.md b/versioned_docs/version-5.5.1/source/markdown/options/userns.image.md new file mode 100644 index 000000000..22d155ceb --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/userns.image.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns**=*how* + +Sets the configuration for user namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new user namespace is created, it can be "host" to indicate that the user namespace in which `podman` itself is being run is reused, or it can be the path to a user namespace which is already in use by another process. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/userns.pod.md b/versioned_docs/version-5.5.1/source/markdown/options/userns.pod.md new file mode 100644 index 000000000..6865fe405 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/userns.pod.md @@ -0,0 +1,38 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns**=*mode* + +Set the user namespace mode for all the containers in a pod. It defaults to the `PODMAN_USERNS` environment variable. An empty value ("") means user namespaces are disabled. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +----------|---------------|--------------------- +"" |$UID |0 (Default User account mapped to root user in container.) +host |$UID |0 (Default User account mapped to root user in container.) +keep-id |$UID |$UID (Map user account to same UID within container.) +auto |$UID | nil (Host User UID is not mapped into container.) +nomap |$UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + + - *auto[:*_OPTIONS,..._*]*: automatically create a namespace. It is possible to specify these options to `auto`: + + - *gidmapping=*_CONTAINER\_GID\:HOST\_GID\:SIZE_ to force a GID mapping to be present in the user namespace. + + - *size=*_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates the size for the user namespace. + + - *uidmapping=*_CONTAINER\_UID\:HOST\_UID\:SIZE_ to force a UID mapping to be present in the user namespace. + + - *host*: run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user (default). + + - *keep-id*: creates a user namespace where the current rootless user's UID\:GID are mapped to the same values in the container. This option is not allowed for containers created by the root user. + + - *nomap*: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/uts.container.md b/versioned_docs/version-5.5.1/source/markdown/options/uts.container.md new file mode 100644 index 000000000..e71a08f46 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/uts.container.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uts**=*mode* + +Set the UTS namespace mode for the container. The following values are supported: + +- **host**: use the host's UTS namespace inside the container. +- **private**: create a new namespace for the container (default). +- **ns:[path]**: run the container in the given existing UTS namespace. +- **container:[container]**: join the UTS namespace of the specified container. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/uts.md b/versioned_docs/version-5.5.1/source/markdown/options/uts.md new file mode 100644 index 000000000..ea24ed7aa --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/uts.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uts**=*how* + +Sets the configuration for UTS namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new UTS namespace to be created, or it can be "host" to indicate that the UTS namespace in which `podman` itself is being run is reused, or it can be the path to a UTS namespace which is already in use by another process. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/uts.pod.md b/versioned_docs/version-5.5.1/source/markdown/options/uts.pod.md new file mode 100644 index 000000000..2cd8b5a4a --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/uts.pod.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uts**=*mode* + +Set the UTS namespace mode for the pod. The following values are supported: + +- **host**: use the host's UTS namespace inside the pod. +- **private**: create a new namespace for the pod (default). +- **ns:[path]**: run the pod in the given existing UTS namespace. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/variant.container.md b/versioned_docs/version-5.5.1/source/markdown/options/variant.container.md new file mode 100644 index 000000000..1528478f1 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/variant.container.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--variant**=*VARIANT* + +Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/variant.manifest.md b/versioned_docs/version-5.5.1/source/markdown/options/variant.manifest.md new file mode 100644 index 000000000..11a25e17d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/variant.manifest.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman manifest add, manifest annotate +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--variant** + +Specify the variant which the list or index records for the image. This option +is typically used to distinguish between multiple entries which share the same +architecture value, but which expect different versions of its instruction set. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/volume.image.md b/versioned_docs/version-5.5.1/source/markdown/options/volume.image.md new file mode 100644 index 000000000..60ec93560 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/volume.image.md @@ -0,0 +1,125 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--volume**, **-v**=*[HOST-DIR\:CONTAINER-DIR[\\\:OPTIONS]]* + +Mount a host directory into containers when executing RUN instructions during +the build. + +The `OPTIONS` are a comma-separated list and can be one or more of: + + * [rw|ro] + * [z|Z|O] + * [U] + * [`[r]shared`|`[r]slave`|`[r]private`][[1]](#Footnote1) + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR` +must be an absolute path as well. Podman bind-mounts the `HOST-DIR` to the +specified path when processing RUN instructions. + +You can specify multiple **-v** options to mount one or more mounts. + +You can add the `:ro` or `:rw` suffix to a volume to mount it read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted. When running using user namespaces, the UID and GID inside +the namespace may correspond to another UID and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the namespace, to change recursively the owner and group of +the source volume. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add one of these two suffixes +`:z` or `:Z` to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The `z` option tells Podman that two containers +share the volume content. As a result, Podman labels the content with a shared +content label. Shared volume labels allow all containers to read/write content. +The `Z` option tells Podman to label the content with a private unshared label. +Only the current container can use a private volume. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the host machine to fail. For these types +of containers, disabling SELinux separation is recommended. The option +`--security-opt label=disable` disables SELinux separation for the container. +For example, if a user wanted to volume mount their entire home directory into the build containers, they need to disable SELinux separation. + + $ podman build --security-opt label=disable -v $HOME:/home/user . + +`Overlay Volume Mounts` + +The `:O` flag tells Podman to mount the directory from the host as a +temporary storage using the Overlay file system. The `RUN` command containers +are allowed to modify contents within the mountpoint and are stored in the +container storage in a separate directory. In Overlay FS terms the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the `RUN` command +finishes executing, similar to a tmpfs mount point. + +Any subsequent execution of `RUN` commands sees the original source directory +content, any changes from previous RUN commands no longer exists. + +One use case of the `overlay` mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: + +- Overlay mounts are not currently supported in rootless mode. +- The `O` flag is not allowed to be specified with the `Z` or `z` flags. + Content mounted into the container is labeled with the private label. + On SELinux systems, labels in the source directory needs to be readable + by the container label. If not, SELinux container separation must be disabled + for the container to work. +- Modification of the directory volume mounted into the container with an + overlay mount can cause unexpected failures. Do not modify the directory until + the container finishes running. + +By default bind mounted volumes are `private`. That means any mounts done +inside containers are not be visible on the host and vice versa. This behavior +can be changed by specifying a volume mount propagation property. + +When the mount propagation policy is set to `shared`, any mounts completed +inside the container on that volume is visible to both the host and +container. When the mount propagation policy is set to `slave`, one way mount +propagation is enabled and any mounts completed on the host for that volume is +visible only inside of the container. To control the mount propagation +property of volume use the `:[r]shared`, `:[r]slave` or `:[r]private` +propagation flag. For mount propagation to work on the source mount point (mount +point where source dir is mounted on) has to have the right propagation properties. +For shared volumes, the source mount point has to be shared. And for slave volumes, +the source mount has to be either shared or slave. [[1]](#Footnote1) + +Use `df ` to determine the source mount and then use +`findmnt -o TARGET,PROPAGATION ` to determine propagation +properties of source mount, if `findmnt` utility is not available, the source +mount point can be determined by looking at the mount entry in +`/proc/self/mountinfo`. Look at `optional fields` and see if any propagation +properties are specified. +`shared:X` means the mount is `shared`, `master:X` means the mount is `slave` +and if nothing is there that means the mount is `private`. [[1]](#Footnote1) + +To change propagation properties of a mount point use the `mount` command. For +example, to bind mount the source directory `/foo` do +`mount --bind /foo /foo` and `mount --make-private --make-shared /foo`. This +converts /foo into a `shared` mount point. The propagation properties of +the source mount can be changed directly. For instance if `/` is the source +mount for `/foo`, then use `mount --make-shared /` to convert `/` into a +`shared` mount. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/volume.md b/versioned_docs/version-5.5.1/source/markdown/options/volume.md new file mode 100644 index 000000000..4af96b528 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/volume.md @@ -0,0 +1,216 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the <> is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +<>. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a <> is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the <>, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the <>. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a <>. Without a label, the security system +might prevent the processes running inside the <> from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the <> context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +<> share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label. Only the current <> can use a private +volume. + +Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any one of the containers. Relabeling walks +the file system under the volume and changes the label on each file; if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the <>. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually changed with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the <>. +For example if a user wanted to volume mount their entire home directory into a +<>, they need to disable SELinux separation. + + $ podman <> --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The <> processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the <> +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous <> executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the <<|pod infra>> container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the <<|pod or infra>> container +to work. + +Do not modify the source directory mounted into the <> with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the <> are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the <> +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +<>, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +<>. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the <>. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the <>. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless <> fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/volumes-from.md b/versioned_docs/version-5.5.1/source/markdown/options/volumes-from.md new file mode 100644 index 000000000..28ebb2d9a --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/volumes-from.md @@ -0,0 +1,41 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--volumes-from**=*CONTAINER[\\\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers<<| and pods>>. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +<>. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a <>. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the <> context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target <>, then the volume hides +that data on the target. diff --git a/versioned_docs/version-5.5.1/source/markdown/options/workdir.md b/versioned_docs/version-5.5.1/source/markdown/options/workdir.md new file mode 100644 index 000000000..0444b5a3d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/options/workdir.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.1 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--workdir**, **-w**=*dir* + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (**/**). +The image developer can set a different default with the WORKDIR instruction. The operator +can override the working directory by using the **-w** option. diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-artifact-add.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-artifact-add.1.md new file mode 100644 index 000000000..4810f467d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-artifact-add.1.md @@ -0,0 +1,88 @@ +--- +title: podman-artifact-add +version: v5.5.1 +--- + +% podman-artifact-add 1 + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-add - Add an OCI artifact to the local store + +## SYNOPSIS +**podman artifact add** *name* *file* [*file*]... + +## DESCRIPTION + +Add an OCI artifact to the local store from the local filesystem. You must +provide at least one file to create the artifact, but several can also be +added. + + +## OPTIONS + + +[//]: # (BEGIN included file options/annotation.manifest.md) +#### **--annotation**=*annotation=value* + +Set an annotation on the entry for the specified image or artifact. + +[//]: # (END included file options/annotation.manifest.md) + +Note: Set annotations for each file being added. + +#### **--append**, **-a** + +Append files to an existing artifact. This option cannot be used with the **--type** option. + +#### **--file-type** + +Set the media type of the artifact file instead of allowing detection to determine the type + +#### **--help** + +Print usage statement. + +#### **--type** + +Set a type for the artifact being added. + +## EXAMPLES + +Add a single file to an artifact + +``` +$ podman artifact add quay.io/myartifact/myml:latest /tmp/foobar.ml +0fe1488ecdef8cc4093e11a55bc048d9fc3e13a4ba846efd24b5a715006c95b3 +``` + +Add multiple files to an artifact +``` +$ podman artifact add quay.io/myartifact/myml:latest /tmp/foobar1.ml /tmp/foobar2.ml +1487acae11b5a30948c50762882036b41ac91a7b9514be8012d98015c95ddb78 +``` + +Set an annotation for an artifact +``` +$ podman artifact add --annotation date=2025-01-30 quay.io/myartifact/myml:latest /tmp/foobar1.ml +``` + +Append a file to an existing artifact +``` +$ podman artifact add --append quay.io/myartifact/tarballs:latest /tmp/foobar.tar.gz +``` + +Override the media type of the artifact being added +``` +$ podman artifact add --file-type text/yaml quay.io/myartifact/descriptors\:latest /tmp/info.yaml +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-artifact-extract.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-artifact-extract.1.md new file mode 100644 index 000000000..bee4d4e3c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-artifact-extract.1.md @@ -0,0 +1,88 @@ +--- +title: podman-artifact-extract +version: v5.5.1 +--- + +% podman-artifact-extract 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-extract - Extract an OCI artifact to a local path + +## SYNOPSIS +**podman artifact extract** *artifact* *target* + +## DESCRIPTION + +Extract the blobs of an OCI artifact to a local file or directory. + +If the target path is a file or does not exist, the artifact must either consist +of one blob (layer) or if it has multiple blobs (layers) then the **--digest** or +**--title** option must be used to select only a single blob. If the file already +exists it will be overwritten. + +If the target is a directory (it must exist), all blobs will be copied to the +target directory. As the target file name the value from the `org.opencontainers.image.title` +annotation is used. If the annotation is missing, the target file name will be the +digest of the blob (with `:` replaced by `-` in the name). +If the target file already exists in the directory, it will be overwritten. + +## OPTIONS + +#### **--digest**=**digest** + +When extracting blobs from the artifact only use the one with the specified digest. +If the target is a directory then the digest is always used as file name instead even +when the title annotation exists on the blob. +Conflicts with **--title**. + +#### **--help** + +Print usage statement. + +#### **--title**=**title** + +When extracting blobs from the artifact only use the one with the specified title. +It looks for the `org.opencontainers.image.title` annotation and compares that +against the given title. +Conflicts with **--digest**. + +## EXAMPLES + +Extract an artifact with a single blob + +``` +$ podman artifact extract quay.io/artifact/foobar1:test /tmp/myfile +``` + +Extract an artifact with multiple blobs + +``` +$ podman artifact extract quay.io/artifact/foobar2:test /tmp/mydir +$ ls /tmp/mydir +CONTRIBUTING.md README.md +``` + +Extract only a single blob from an artifact with multiple blobs + +``` +$ podman artifact extract --title README.md quay.io/artifact/foobar2:test /tmp/mydir +$ ls /tmp/mydir +README.md +``` +Or using the digest instead of the title +``` +$ podman artifact extract --digest sha256:c0594e012b17fd9e6548355ceb571a79613f7bb988d7d883f112513601ac6e9a quay.io/artifact/foobar2\:test /tmp/mydir +$ ls /tmp/mydir +README.md +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Feb 2025, Originally compiled by Paul Holzinger diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-artifact-inspect.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-artifact-inspect.1.md new file mode 100644 index 000000000..f13596863 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-artifact-inspect.1.md @@ -0,0 +1,43 @@ +--- +title: podman-artifact-inspect +version: v5.5.1 +--- + +% podman-artifact-inspect 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-inspect - Inspect an OCI artifact + +## SYNOPSIS +**podman artifact inspect** [*name*] ... + +## DESCRIPTION + +Inspect an artifact in the local store. The artifact can be referred to with either: + +1. Fully qualified artifact name +2. Full or partial digest of the artifact's manifest + +## OPTIONS + +#### **--help** + +Print usage statement. + +## EXAMPLES + +Inspect an OCI image in the local store. +``` +$ podman artifact inspect quay.io/myartifact/myml\:latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Sept 2024, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-artifact-ls.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-artifact-ls.1.md new file mode 100644 index 000000000..11abfb44f --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-artifact-ls.1.md @@ -0,0 +1,90 @@ +--- +title: podman-artifact-ls +version: v5.5.1 +--- + +% podman-artifact-ls 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-ls - List OCI artifacts in local store + +## SYNOPSIS +**podman artifact ls** [*options*] + +## DESCRIPTION + +List all local artifacts in your local store. + +## OPTIONS + +#### **--format** + +Print results with a Go template. + +| **Placeholder** | **Description** | +|-----------------|------------------------------------------------| +| .Digest | The computed digest of the artifact's manifest | +| .Repository | Repository name of the artifact | +| .Size | Size artifact in human readable units | +| .Tag | Tag of the artifact name | + + +[//]: # (BEGIN included file options/no-trunc.md) +#### **--no-trunc** + +Do not truncate the output (default *false*). + +[//]: # (END included file options/no-trunc.md) + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +## EXAMPLES + +List artifacts in the local store +``` +$ podman artifact ls +REPOSITORY TAG DIGEST SIZE +quay.io/artifact/foobar1 latest ab609fad386d 2.097GB +quay.io/artifact/foobar2 special cd734b558ceb 12.58MB +``` + +List artifacts in the local store without truncating the digest +``` +$ podman artifact ls --no-trunc +REPOSITORY TAG DIGEST SIZE +quay.io/artifact/foobar1 latest ab609fad386df1433f461b0643d9cf575560baf633809dcc9c190da6cc3a3c29 2.097GB +quay.io/artifact/foobar2 special cd734b558ceb8ccc0281ca76530e1dea1eb479407d3163f75fb601bffb6f73d0 12.58MB +``` + +List artifacts in the local store without the title header +``` +$ podman artifact ls --noheading +quay.io/artifact/foobar1 latest ab609fad386d 2.097GB +quay.io/artifact/foobar2 special cd734b558ceb 12.58MB +``` + +List artifact digests and size using a --format +``` +$ podman artifact ls --format "{{.Digest}} {{.Size}}" +ab609fad386d 2.097GB +cd734b558ceb 12.58MB +``` + + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-artifact-pull.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-artifact-pull.1.md new file mode 100644 index 000000000..7442e06da --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-artifact-pull.1.md @@ -0,0 +1,140 @@ +--- +title: podman-artifact-pull +version: v5.5.1 +--- + +% podman-artifact-pull 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-pull - Pulls an artifact from a registry and stores it locally + +## SYNOPSIS +**podman artifact pull** [*options*] *source* + + +## DESCRIPTION +podman artifact pull copies an artifact from a registry onto the local machine. + + +## SOURCE +SOURCE is the location from which the artifact image is obtained. + +``` +# Pull from a registry +$ podman artifact pull quay.io/foobar/artifact\:special +``` + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +#### **--help**, **-h** + +Print the usage statement. + +#### **--quiet**, **-q** + +Suppress output information when pulling images + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## FILES + +## EXAMPLES +Pull an artifact from a registry + +``` +podman artifact pull quay.io/baude/artifact\:josey +Getting image source signatures +Copying blob e741c35a27bb done | +Copying config 44136fa355 done | +Writing manifest to image destination + +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-artifact-push.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-artifact-push.1.md new file mode 100644 index 000000000..c4c51fca3 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-artifact-push.1.md @@ -0,0 +1,149 @@ +--- +title: podman-artifact-push +version: v5.5.1 +--- + +% podman-artifact-push 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-push - Push an OCI artifact from local storage to an image registry + +## SYNOPSIS +**podman artifact push** [*options*] *image* + +## DESCRIPTION +Pushes an artifact from the local artifact store to an image registry. + +``` +# Push artifact to a container registry +$ podman artifact push quay.io/artifact/foobar1\:latest +``` + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\\\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/digestfile.md) +#### **--digestfile**=*Digestfile* + +After copying the image, write the digest of the resulting image to the file. + +[//]: # (END included file options/digestfile.md) + +#### **--quiet**, **-q** + +When writing the output image, suppress progress output + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + +#### **--sign-by**=*key* + +Add a “simple signing” signature at the destination using the specified key. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-by-sigstore.md) +#### **--sign-by-sigstore**=*param-file* + +Add a sigstore signature based on further options specified in a container's sigstore signing parameter file *param-file*. +See containers-sigstore-signing-params.yaml(5) for details about the file format. + +[//]: # (END included file options/sign-by-sigstore.md) + + +#### **--sign-by-sigstore-private-key**=*path* + +Add a sigstore signature at the destination using a private key at the specified path. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-passphrase-file.md) +#### **--sign-passphrase-file**=*path* + +If signing the image (using either **--sign-by** or **--sign-by-sigstore-private-key**), read the passphrase to use from the specified path. + +[//]: # (END included file options/sign-passphrase-file.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLE + +Push the specified iage to a container registry: +``` +$ podman artifact push quay.io/baude/artifact\:single +Getting image source signatures +Copying blob 3ddc0a3cdb61 done | +Copying config 44136fa355 done | +Writing manifest to image destination +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)**, **[podman-pull(1)](podman-pull.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** + + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-artifact-rm.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-artifact-rm.1.md new file mode 100644 index 000000000..83c7d8094 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-artifact-rm.1.md @@ -0,0 +1,63 @@ +--- +title: podman-artifact-rm +version: v5.5.1 +--- + +% podman-artifact-rm 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-rm - Remove an OCI from local storage + +## SYNOPSIS +**podman artifact rm** [*options*] *name* + +## DESCRIPTION + +Remove an artifact from the local artifact store. The input may be the fully +qualified artifact name or a full or partial artifact digest. + +## OPTIONS + +#### **--all**, **-a** + +Remove all artifacts in the local store. The use of this option conflicts with +providing a name or digest of the artifact. + +#### **--help** + +Print usage statement. + + +## EXAMPLES + +Remove an artifact by name + +``` +$ podman artifact rm quay.io/artifact/foobar2\:test +Deleted: e7b417f49fc24fc7ead6485da0ebd5bc4419d8a3f394c169fee5a6f38faa4056 +``` + +Remove an artifact by partial digest + +``` +$ podman artifact rm e7b417f49fc +Deleted: e7b417f49fc24fc7ead6485da0ebd5bc4419d8a3f394c169fee5a6f38faa4056 +``` + +Remove all artifacts in local storage +``` +$ podman artifact rm -a +Deleted: cee15f7c5ce3e86ae6ce60d84bebdc37ad34acfa9a2611cf47501469ac83a1ab +Deleted: 72875f8f6f78d5b8ba98b2dd2c0a6f395fde8f05ff63a1df580d7a88f5afa97b +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-artifact.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-artifact.1.md new file mode 100644 index 000000000..50925e41b --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-artifact.1.md @@ -0,0 +1,42 @@ +--- +title: podman-artifact +version: v5.5.1 +--- + +% podman-artifact 1 + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact - Manage OCI artifacts + +## SYNOPSIS +**podman artifact** *subcommand* + +## DESCRIPTION +`podman artifact` is a set of subcommands that manage OCI artifacts. + +OCI artifacts are a common way to distribute files that are associated with OCI images and +containers. Podman is capable of managing (pulling, inspecting, pushing) these artifacts +from its local "artifact store". + +## SUBCOMMANDS + +| Command | Man Page | Description | +|---------|------------------------------------------------------------|--------------------------------------------------------------| +| add | [podman-artifact-add(1)](podman-artifact-add.1.md) | Add an OCI artifact to the local store | +| extract | [podman-artifact-extract(1)](podman-artifact-extract.1.md) | Extract an OCI artifact to a local path | +| inspect | [podman-artifact-inspect(1)](podman-artifact-inspect.1.md) | Inspect an OCI artifact | +| ls | [podman-artifact-ls(1)](podman-artifact-ls.1.md) | List OCI artifacts in local store | +| pull | [podman-artifact-pull(1)](podman-artifact-pull.1.md) | Pulls an artifact from a registry and stores it locally | +| push | [podman-artifact-push(1)](podman-artifact-push.1.md) | Push an OCI artifact from local storage to an image registry | +| rm | [podman-artifact-rm(1)](podman-artifact-rm.1.md) | Remove an OCI from local storage | + + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +Sept 2024, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-attach.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-attach.1.md new file mode 100644 index 000000000..54a008ad3 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-attach.1.md @@ -0,0 +1,78 @@ +--- +title: podman-attach +version: v5.5.1 +--- + +% podman-attach 1 + +## NAME +podman\-attach - Attach to a running container + +## SYNOPSIS +**podman attach** [*options*] *container* + +**podman container attach** [*options*] *container* + +## DESCRIPTION +**podman attach** attaches to a running *container* using the *container's name* or *ID*, to either view its ongoing output or to control it interactively.\ +The *container* can be detached from (and leave it running) using a configurable key sequence. The default sequence is `ctrl-p,ctrl-q`. Configure the keys sequence using the **--detach-keys** OPTION, or specifying it in the `containers.conf` file: see **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** for more information. + +## OPTIONS + +[//]: # (BEGIN included file options/detach-keys.md) +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. + +[//]: # (END included file options/detach-keys.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--no-stdin** + +Do not attach STDIN. The default is **false**. + + +[//]: # (BEGIN included file options/sig-proxy.md) +#### **--sig-proxy** + +Proxy received signals to the container process. SIGCHLD, SIGURG, SIGSTOP, and SIGKILL are not proxied. + +[//]: # (END included file options/sig-proxy.md) + +The default is **true**. + +## EXAMPLES +Attach to a container called "foobar". +``` +$ podman attach foobar +``` + +Attach to the latest created container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman attach --latest +``` + +Attach to a container that start with the ID "1234". +``` +$ podman attach 1234 +``` + +Attach to a container without attaching STDIN. +``` +$ podman attach --no-stdin foobar +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-exec(1)](podman-exec.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-auto-update.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-auto-update.1.md new file mode 100644 index 000000000..f27c98517 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-auto-update.1.md @@ -0,0 +1,146 @@ +--- +title: podman-auto-update +version: v5.5.1 +--- + +% podman-auto-update 1 + +## NAME +podman\-auto-update - Auto update containers according to their auto-update policy + +## SYNOPSIS +**podman auto-update** [*options*] + +## DESCRIPTION +**podman auto-update** pulls down new container images and restarts containers configured for auto updates. +To make use of auto updates, the container or Kubernetes workloads must run inside a systemd unit. +After a successful update of an image, the containers using the image get updated by restarting the systemd units they run in. +Please refer to `podman-systemd.unit(5)` on how to run Podman under systemd. + +To configure a container for auto updates, it must be created with the `io.containers.autoupdate` label or the `AutoUpdate` field in `podman-systemd.unit(5)` with one of the following two values: + +* `registry`: If the label is present and set to `registry`, Podman reaches out to the corresponding registry to check if the image has been updated. +The label `image` is an alternative to `registry` maintained for backwards compatibility. +An image is considered updated if the digest in the local storage is different than the one of the remote image. +If an image must be updated, Podman pulls it down and restarts the systemd unit executing the container. +The registry policy requires a fully-qualified image reference (e.g., quay.io/podman/stable\\:latest) to be used to create the container. +This enforcement is necessary to know which image to actually check and pull. +If an image ID was used, Podman would not know which image to check/pull anymore. + +* `local`: If the autoupdate label is set to `local`, Podman compares the image digest of the container to the one in the local container storage. +If they differ, the local image is considered to be newer and the systemd unit gets restarted. + +### Auto Updates and Kubernetes YAML + +Podman supports auto updates for Kubernetes workloads. The auto-update policy can be configured directly via `podman-systemd.unit(5)` or inside the Kubernetes YAML with the Podman-specific annotations mentioned below: + +* `io.containers.autoupdate`: "registry|local" to apply the auto-update policy to all containers +* `io.containers.autoupdate/$container`: "registry|local" to apply the auto-update policy to `$container` only +* `io.containers.sdnotify`: "conmon|container" to apply the sdnotify policy to all containers +* `io.containers.sdnotify/$container`: "conmon|container" to apply the sdnotify policy to `$container` only + +By default, the autoupdate policy is set to "disabled", the sdnotify policy is set to "conmon". + +### Systemd Unit and Timer + +Podman ships with a `podman-auto-update.service` systemd unit. This unit is triggered daily at midnight by the `podman-auto-update.timer` systemd timer. +The timer can be altered for custom time-based updates if desired. +The unit can further be invoked by other systemd units (e.g., via the dependency tree) or manually via **systemctl start podman-auto-update.service**. + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + +Alternatively, the `io.containers.autoupdate.authfile` container label can be configured. In that case, Podman will use the specified label's value instead. + +#### **--dry-run** + +Check for the availability of new images but do not perform any pull operation or restart any service or container. +The `UPDATED` field indicates the availability of a new image with "pending". + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| --------------- | -------------------------------------- | +| .Container | ID and name of the container | +| .ContainerID | ID of the container | +| .ContainerName | Name of the container | +| .Image | Name of the image | +| .Policy | Auto-update policy of the container | +| .Unit | Name of the systemd unit | +| .Updated | Update status: true,false,failed | + +#### **--rollback** + +If restarting a systemd unit after updating the image has failed, rollback to using the previous image and restart the unit another time. Default is true. + +Note that detecting if a systemd unit has failed is best done by the container sending the READY message via SDNOTIFY. +This way, restarting the unit waits until having received the message or a timeout kicked in. +Without that, restarting the systemd unit may succeed even if the container has failed shortly after. + +For a container to send the READY message via SDNOTIFY it must be created with the `--sdnotify=container` option (see podman-run(1)). +The application running inside the container can then execute `systemd-notify --ready` when ready or use the sdnotify bindings of the specific programming language (e.g., sd_notify(3)). + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Create a Quadlet file configured for auto updates: +``` +$ cat ~/.config/containers/systemd/sleep.container +[Container] +Image=registry.fedoraproject.org/fedora:latest +Exec=sleep infinity +AutoUpdate=registry +``` + +Generate a systemd service from the Quadlet file by reloading the systemd user daemon: +``` +$ systemctl --user daemon-reload +``` + +Start the systemd service and make sure the container is running +``` +$ systemctl --user start sleep.service +$ podman ps +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +f8e4759798d4 registry.fedoraproject.org/fedora:latest sleep infinity 2 seconds ago Up 2 seconds systemd-sleep +``` + +Check if a new image is available via `--dry-run`: +``` +$ podman auto-update --dry-run --format "{{.Image}} {{.Updated}}" +registry.fedoraproject.org/fedora:latest pending +``` + +Update the service: +``` +$ podman auto-update +UNIT CONTAINER IMAGE POLICY UPDATED +sleep.service f8e4759798d4 (systemd-sleep) registry.fedoraproject.org/fedora\\:latest registry true +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-generate-systemd(1)](podman-generate-systemd.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-systemd.unit(5)](podman-systemd.unit.5.md)**, **sd_notify(3)**, **[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-build.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-build.1.md new file mode 100644 index 000000000..7aaebecf8 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-build.1.md @@ -0,0 +1,1951 @@ +--- +title: podman-build +version: v5.5.1 +--- + +% podman-build 1 + +## NAME +podman\-build - Build a container image using a Containerfile + +## SYNOPSIS +**podman build** [*options*] [*context*] + +**podman image build** [*options*] [*context*] + +## DESCRIPTION +**podman build** Builds an image using instructions from one or more +Containerfiles or Dockerfiles and a specified build context directory. A +Containerfile uses the same syntax as a Dockerfile internally. For this +document, a file referred to as a Containerfile can be a file named +either 'Containerfile' or 'Dockerfile' exclusively. Any file that has additional +extension attached will not be recognized by `podman build .` unless a `-f` flag is +used to specify the file. + +The build context directory can be specified as the http(s) URL of an archive, +git repository or Containerfile. + +When invoked with `-f` and a path to a Containerfile, with no explicit CONTEXT +directory, Podman uses the Containerfile's parent directory as its build context. + +Containerfiles ending with a ".in" suffix are preprocessed via CPP(1). This +can be useful to decompose Containerfiles into several reusable parts that can +be used via CPP's **#include** directive. Containerfiles ending in .in are +restricted to no comment lines unless they are CPP commands. +Note, a Containerfile.in file can still be used by other tools when manually +preprocessing them via `cpp -E`. + +When the URL is an archive, the contents of the URL is downloaded to a temporary +location and extracted before execution. + +When the URL is a Containerfile, the Containerfile is downloaded to a temporary +location. + +When a Git repository is set as the URL, the repository is cloned locally and +then set as the context. A URL is treated as a Git repository if it +has a `git://` prefix or a `.git` suffix. + +NOTE: `podman build` uses code sourced from the `Buildah` project to build +container images. This `Buildah` code creates `Buildah` containers for the +`RUN` options in container storage. In certain situations, when the +`podman build` crashes or users kill the `podman build` process, these external +containers can be left in container storage. Use the `podman ps --all --external` +command to see these containers. + +`podman buildx build` command is an alias of `podman build`. Not all `buildx build` features are available in Podman. The `buildx build` option is provided for scripting compatibility. + +## OPTIONS + + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the container's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + +#### **--all-platforms** + +Instead of building for a set of platforms specified using the **--platform** option, inspect the build's base images, and build for all of the platforms for which they are all available. Stages that use *scratch* as a starting point can not be inspected, so at least one non-*scratch* stage must be present for detection to work usefully. + + +[//]: # (BEGIN included file options/annotation.image.md) +#### **--annotation**=*annotation=value* + +Add an image *annotation* (e.g. annotation=*value*) to the image metadata. Can +be used multiple times. + +Note: this information is not present in Docker image formats, so it is +discarded when writing images in Docker formats. + +[//]: # (END included file options/annotation.image.md) + +#### **--arch**=*arch* + +Set the architecture of the image to be built, and that of the base image to be +pulled, if the build uses one, to the provided value instead of using the +architecture of the build host. Unless overridden, subsequent lookups of the +same image in the local storage matches this architecture, regardless of the +host. (Examples: arm, arm64, 386, amd64, ppc64le, s390x) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/build-arg.md) +#### **--build-arg**=*arg=value* + +Specifies a build argument and its value, which is interpolated in +instructions read from the Containerfiles in the same way that environment variables are, but which are not added to environment variable list in the resulting image's configuration. + +[//]: # (END included file options/build-arg.md) + + +[//]: # (BEGIN included file options/build-arg-file.md) +#### **--build-arg-file**=*path* + +Specifies a file containing lines of build arguments of the form `arg=value`. +The suggested file name is `argfile.conf`. + +Comment lines beginning with `#` are ignored, along with blank lines. +All others must be of the `arg=value` format passed to `--build-arg`. + +If several arguments are provided via the `--build-arg-file` +and `--build-arg` options, the build arguments are merged across all +of the provided files and command line arguments. + +Any file provided in a `--build-arg-file` option is read before +the arguments supplied via the `--build-arg` option. + +When a given argument name is specified several times, the last instance +is the one that is passed to the resulting builds. This means `--build-arg` +values always override those in a `--build-arg-file`. + +[//]: # (END included file options/build-arg-file.md) + + +[//]: # (BEGIN included file options/build-context.md) +#### **--build-context**=*name=value* + +Specify an additional build context using its short name and its location. +Additional build contexts can be referenced in the same manner as we access +different stages in COPY instruction. + +Valid values are: + +* Local directory – e.g. --build-context project2=../path/to/project2/src (This option is not available with the remote Podman client. On Podman machine setup (i.e macOS and Windows) path must exists on the machine VM) +* HTTP URL to a tarball – e.g. --build-context src=https://example.org/releases/src.tar +* Container image – specified with a container-image:// prefix, e.g. --build-context alpine=container-image://alpine:3.15, (also accepts docker://, docker-image://) + +On the Containerfile side, reference the build context on all +commands that accept the “from” parameter. Here’s how that might look: + +```dockerfile +FROM [name] +COPY --from=[name] ... +RUN --mount=from=[name] … +``` + +The value of [name] is matched with the following priority order: + +* Named build context defined with --build-context [name]=.. +* Stage defined with AS [name] inside Containerfile +* Image [name], either local or in a remote registry + +[//]: # (END included file options/build-context.md) + + +[//]: # (BEGIN included file options/cache-from.md) +#### **--cache-from**=*image* + +Repository to utilize as a potential cache source. When specified, Buildah tries to look for +cache images in the specified repository and attempts to pull cache images instead of actually +executing the build steps locally. Buildah only attempts to pull previously cached images if they +are considered as valid cache hits. + +Use the `--cache-to` option to populate a remote repository with cache content. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-from` option is ignored unless `--layers` is specified. + +[//]: # (END included file options/cache-from.md) + + +[//]: # (BEGIN included file options/cache-to.md) +#### **--cache-to**=*image* + +Set this flag to specify a remote repository that is used to store cache images. Buildah attempts to +push newly built cache image to the remote repository. + +Note: Use the `--cache-from` option in order to use cache content in a remote repository. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-to` option is ignored unless `--layers` is specified. + +[//]: # (END included file options/cache-to.md) + + +[//]: # (BEGIN included file options/cache-ttl.md) +#### **--cache-ttl** + +Limit the use of cached images to only consider images with created timestamps less than *duration* ago. +For example if `--cache-ttl=1h` is specified, Buildah considers intermediate cache images which are created +under the duration of one hour, and intermediate cache images outside this duration is ignored. + +Note: Setting `--cache-ttl=0` manually is equivalent to using `--no-cache` in the +implementation since this means that the user does not want to use cache at all. + +[//]: # (END included file options/cache-ttl.md) + + +[//]: # (BEGIN included file options/cap-add.image.md) +#### **--cap-add**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability added to its capability set. +Certain capabilities are granted by default; this option can be used to add +more. + +[//]: # (END included file options/cap-add.image.md) + + +[//]: # (BEGIN included file options/cap-drop.image.md) +#### **--cap-drop**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability removed from its capability set. +The CAP\_CHOWN, CAP\_DAC\_OVERRIDE, CAP\_FOWNER, +CAP\_FSETID, CAP\_KILL, CAP\_NET\_BIND\_SERVICE, CAP\_SETFCAP, +CAP\_SETGID, CAP\_SETPCAP, and CAP\_SETUID capabilities are +granted by default; this option can be used to remove them. + +If a capability is specified to both the **--cap-add** and **--cap-drop** +options, it is dropped, regardless of the order in which the options were +given. + +[//]: # (END included file options/cap-drop.image.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the container is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cgroupns.image.md) +#### **--cgroupns**=*how* + +Sets the configuration for cgroup namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "private" to indicate +that a new cgroup namespace is created, or it can be "host" to indicate +that the cgroup namespace in which `buildah` itself is being run is reused. + +[//]: # (END included file options/cgroupns.image.md) + + +[//]: # (BEGIN included file options/compat-volumes.md) +#### **--compat-volumes** + +Handle directories marked using the VOLUME instruction (both in this build, and +those inherited from base images) such that their contents can only be modified +by ADD and COPY instructions. Any changes made in those locations by RUN +instructions will be reverted. Before the introduction of this option, this +behavior was the default, but it is now disabled by default. + +[//]: # (END included file options/compat-volumes.md) + +#### **--compress** + +This option is added to be aligned with other containers CLIs. +Podman doesn't communicate with a daemon or a remote server. +Thus, compressing the data before sending it is irrelevant to Podman. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/cpp-flag.md) +#### **--cpp-flag**=*flags* + +Set additional flags to pass to the C Preprocessor cpp(1). Containerfiles ending with a ".in" suffix is preprocessed via cpp(1). This option can be used to pass additional flags to cpp.Note: You can also set default CPPFLAGS by setting the BUILDAH_CPPFLAGS environment variable (e.g., export BUILDAH_CPPFLAGS="-DDEBUG"). + +[//]: # (END included file options/cpp-flag.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + +#### **--cw**=*options* + +Produce an image suitable for use as a confidential workload running in a +trusted execution environment (TEE) using krun (i.e., *crun* built with the +libkrun feature enabled and invoked as *krun*). Instead of the conventional +contents, the root filesystem of the image will contain an encrypted disk image +and configuration information for krun. + +The value for *options* is a comma-separated list of key=value pairs, supplying +configuration information which is needed for producing the additional data +which will be included in the container image. + +Recognized _keys_ are: + +*attestation_url*: The location of a key broker / attestation server. +If a value is specified, the new image's workload ID, along with the passphrase +used to encrypt the disk image, will be registered with the server, and the +server's location will be stored in the container image. +At run-time, krun is expected to contact the server to retrieve the passphrase +using the workload ID, which is also stored in the container image. +If no value is specified, a *passphrase* value *must* be specified. + +*cpus*: The number of virtual CPUs which the image expects to be run with at +run-time. If not specified, a default value will be supplied. + +*firmware_library*: The location of the libkrunfw-sev shared library. If not +specified, `buildah` checks for its presence in a number of hard-coded +locations. + +*memory*: The amount of memory which the image expects to be run with at +run-time, as a number of megabytes. If not specified, a default value will be +supplied. + +*passphrase*: The passphrase to use to encrypt the disk image which will be +included in the container image. +If no value is specified, but an *attestation_url* value is specified, a +randomly-generated passphrase will be used. +The authors recommend setting an *attestation_url* but not a *passphrase*. + +*slop*: Extra space to allocate for the disk image compared to the size of the +container image's contents, expressed either as a percentage (..%) or a size +value (bytes, or larger units if suffixes like KB or MB are present), or a sum +of two or more such specifications. If not specified, `buildah` guesses that +25% more space than the contents will be enough, but this option is provided in +case its guess is wrong. + +*type*: The type of trusted execution environment (TEE) which the image should +be marked for use with. Accepted values are "SEV" (AMD Secure Encrypted +Virtualization - Encrypted State) and "SNP" (AMD Secure Encrypted +Virtualization - Secure Nested Paging). If not specified, defaults to "SNP". + +*workload_id*: A workload identifier which will be recorded in the container +image, to be used at run-time for retrieving the passphrase which was used to +encrypt the disk image. If not specified, a semi-random value will be derived +from the base image's image ID. + +This option is not supported on the remote client, including Mac and Windows +(excluding WSL2) machines. + + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the container. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The container only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: if the user only has access rights via a group, accessing the device +from inside a rootless container fails. The **[crun(1)](https://github.com/containers/crun/tree/main/crun.1.md)** runtime offers a +workaround for this by adding the option +**--annotation run.oci.keep_original_groups=1**. + + +[//]: # (BEGIN included file options/disable-compression.md) +#### **--disable-compression**, **-D** + +Don't compress filesystem layers when building the image unless it is required +by the location where the image is being written. This is the default setting, +because image layers are compressed automatically when they are pushed to +registries, and images being written to local storage only need to be +decompressed again to be stored. Compression can be forced in all cases by +specifying **--disable-compression=false**. + +[//]: # (END included file options/disable-compression.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + + +[//]: # (BEGIN included file options/dns.md) +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. + +[//]: # (END included file options/dns.md) + +This option cannot be combined with **--network** that is set to **none**. + +Note: this option takes effect only during *RUN* instructions in the build. +It does not affect _/etc/resolv.conf_ in the final image. + + +[//]: # (BEGIN included file options/dns-option.image.md) +#### **--dns-option**=*option* + +Set custom DNS options to be used during the build. + +[//]: # (END included file options/dns-option.image.md) + + +[//]: # (BEGIN included file options/dns-search.image.md) +#### **--dns-search**=*domain* + +Set custom DNS search domains to be used during the build. + +[//]: # (END included file options/dns-search.image.md) + + +[//]: # (BEGIN included file options/env.image.md) +#### **--env**=*env[=value]* + +Add a value (e.g. env=*value*) to the built image. Can be used multiple times. +If neither `=` nor a *value* are specified, but *env* is set in the current +environment, the value from the current environment is added to the image. +To remove an environment variable from the built image, use the `--unsetenv` +option. + +[//]: # (END included file options/env.image.md) + + +[//]: # (BEGIN included file options/file.md) +#### **--file**, **-f**=*Containerfile* + +Specifies a Containerfile which contains instructions for building the image, +either a local file or an **http** or **https** URL. If more than one +Containerfile is specified, *FROM* instructions are only be accepted from the +last specified file. + +If a build context is not specified, and at least one Containerfile is a +local file, the directory in which it resides is used as the build +context. + +Specifying the option `-f -` causes the Containerfile contents to be read from stdin. + +[//]: # (END included file options/file.md) + + +[//]: # (BEGIN included file options/force-rm.md) +#### **--force-rm** + +Always remove intermediate containers after a build, even if the build fails (default true). + +[//]: # (END included file options/force-rm.md) + + +[//]: # (BEGIN included file options/format.md) +#### **--format** + +Control the format for the built image's manifest and configuration data. +Recognized formats include *oci* (OCI image-spec v1.0, the default) and +*docker* (version 2, using schema format 2 for the manifest). + +Note: You can also override the default format by setting the BUILDAH\_FORMAT +environment variable. `export BUILDAH_FORMAT=docker` + +[//]: # (END included file options/format.md) + + +[//]: # (BEGIN included file options/from.md) +#### **--from** + +Overrides the first `FROM` instruction within the Containerfile. If there are multiple +FROM instructions in a Containerfile, only the first is changed. + +With the remote podman client, not all container transports work as +expected. For example, oci-archive:/x.tar references /x.tar on the remote +machine instead of on the client. When using podman remote clients it is +best to restrict use to *containers-storage*, and *docker:// transports*. + +[//]: # (END included file options/from.md) + + +[//]: # (BEGIN included file options/group-add.md) +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/group-add.md) + + +[//]: # (BEGIN included file options/help.md) +#### **--help**, **-h** + +Print usage statement + +[//]: # (END included file options/help.md) + + +[//]: # (BEGIN included file options/hooks-dir.md) +#### **--hooks-dir**=*path* + +Each *.json file in the path configures a hook for buildah build containers. For more details on the syntax of the JSON files and the semantics of hook injection. Buildah currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. + +This option may be set multiple times; paths from later options have higher precedence. + +For the annotation conditions, buildah uses any annotations set in the generated OCI configuration. + +For the bind-mount conditions, only mounts explicitly requested by the caller via --volume are considered. Bind mounts that buildah inserts by default (e.g. /dev/shm) are not considered. + +If --hooks-dir is unset for root callers, Buildah currently defaults to /usr/share/containers/oci/hooks.d and /etc/containers/oci/hooks.d in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting --hooks-dir. + +[//]: # (END included file options/hooks-dir.md) + + +[//]: # (BEGIN included file options/http-proxy.md) +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. + +[//]: # (END included file options/http-proxy.md) + + +[//]: # (BEGIN included file options/identity-label.md) +#### **--identity-label** + +Adds default identity label `io.buildah.version` if set. (default true). + +[//]: # (END included file options/identity-label.md) + + +[//]: # (BEGIN included file options/ignorefile.md) +#### **--ignorefile** + +Path to an alternative .containerignore file. + +[//]: # (END included file options/ignorefile.md) + + +[//]: # (BEGIN included file options/iidfile.md) +#### **--iidfile**=*ImageIDfile* + +Write the built image's ID to the file. When `--platform` is specified more than once, attempting to use this option triggers an error. + +[//]: # (END included file options/iidfile.md) + + +[//]: # (BEGIN included file options/inherit-labels.md) +#### **--inherit-labels** + +Inherit the labels from the base image or base stages. (default true). + +[//]: # (END included file options/inherit-labels.md) + + +[//]: # (BEGIN included file options/ipc.image.md) +#### **--ipc**=*how* + +Sets the configuration for IPC namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate +that a new IPC namespace is created, or it can be "host" to indicate +that the IPC namespace in which `podman` itself is being run is reused, +or it can be the path to an IPC namespace which is already in use by +another process. + +[//]: # (END included file options/ipc.image.md) + + +[//]: # (BEGIN included file options/isolation.md) +#### **--isolation**=*type* + +Controls what type of isolation is used for running processes as part of `RUN` +instructions. Recognized types include *oci* (OCI-compatible runtime, the +default), *rootless* (OCI-compatible runtime invoked using a modified +configuration and its --rootless option enabled, with *--no-new-keyring +--no-pivot* added to its *create* invocation, with network and UTS namespaces +disabled, and IPC, PID, and user namespaces enabled; the default for +unprivileged users), and *chroot* (an internal wrapper that leans more toward +chroot(1) than container technology). + +Note: You can also override the default isolation type by setting the +BUILDAH\_ISOLATION environment variable. `export BUILDAH_ISOLATION=oci` + +[//]: # (END included file options/isolation.md) + + +[//]: # (BEGIN included file options/jobs.md) +#### **--jobs**=*number* + +Run up to N concurrent stages in parallel. If the number of jobs is greater +than 1, stdin is read from /dev/null. If 0 is specified, then there is +no limit in the number of jobs that run in parallel. + +[//]: # (END included file options/jobs.md) + + +[//]: # (BEGIN included file options/label.image.md) +#### **--label**=*label* + +Add an image *label* (e.g. label=*value*) to the image metadata. Can be used +multiple times. + +Users can set a special LABEL **io.containers.capabilities=CAP1,CAP2,CAP3** in +a Containerfile that specifies the list of Linux capabilities required for the +container to run properly. This label specified in a container image tells +Podman to run the container with just these capabilities. Podman launches the +container with just the specified capabilities, as long as this list of +capabilities is a subset of the default list. + +If the specified capabilities are not in the default set, Podman prints an error +message and runs the container with the default capabilities. + +[//]: # (END included file options/label.image.md) + + +[//]: # (BEGIN included file options/layer-label.md) +#### **--layer-label**=*label[=value]* + +Add an intermediate image *label* (e.g. label=*value*) to the intermediate +image metadata. It can be used multiple times. + +If *label* is named, but neither `=` nor a `value` is provided, then +the *label* is set to an empty value. + +[//]: # (END included file options/layer-label.md) + + +[//]: # (BEGIN included file options/layers.md) +#### **--layers** + +Cache intermediate images during the build process (Default is `true`). + +Note: You can also override the default value of layers by setting the +BUILDAH\_LAYERS environment variable. `export BUILDAH_LAYERS=true` + +[//]: # (END included file options/layers.md) + + +[//]: # (BEGIN included file options/logfile.md) +#### **--logfile**=*filename* + +Log output which is sent to standard output and standard error to the +specified file instead of to standard output and standard error. +This option is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. + +[//]: # (END included file options/logfile.md) + +#### **--logsplit**=*bool-value* + +If `--logfile` and `--platform` are specified, the `--logsplit` option allows +end-users to split the log file for each platform into different files in the +following format: `${logfile}_${platform-os}_${platform-arch}`. +This option is not supported on the remote client, including Mac and Windows +(excluding WSL2) machines. + + +[//]: # (BEGIN included file options/manifest.md) +#### **--manifest**=*manifest* + +Name of the manifest list to which the image is added. Creates the manifest list if it does not exist. This option is useful for building multi architecture images. + +[//]: # (END included file options/manifest.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/network.image.md) +#### **--network**=*mode*, **--net** + +Sets the configuration for network namespaces when handling `RUN` instructions. + +Valid _mode_ values are: + +- **none**: no networking. +- **host**: use the Podman host network stack. Note: the host mode gives the +container full access to local system services such as D-bus and is therefore +considered insecure. +- **ns:**_path_: path to a network namespace to join. +- **private**: create a new namespace for the container (default) +- **\**: Join the network with the given name or ID, e.g. use `--network mynet` to join the network with the name mynet. Only supported for rootful users. +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=MTU**: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=CIDR**: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=INTERFACE**: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=IPv4**: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=INTERFACE**: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=IPv6**: Specify the outbound ipv6 address slirp binds to. +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.image.md) + + +[//]: # (BEGIN included file options/no-cache.md) +#### **--no-cache** + +Do not use existing cached images for the container build. Build from the start with a new set of cached layers. + +[//]: # (END included file options/no-cache.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the container. + +Podman assumes control over the container's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/omit-history.md) +#### **--omit-history** + +Omit build history information in the built image. (default false). + +This option is useful for the cases where end users explicitly +want to set `--omit-history` to omit the optional `History` from +built images or when working with images built using build tools that +do not include `History` information in their images. + +[//]: # (END included file options/omit-history.md) + + +[//]: # (BEGIN included file options/os.md) +#### **--os**=*string* + +Set the OS of the image to be built, and that of the base image to be pulled, if the build uses one, instead of using the current operating system of the build host. Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. + +[//]: # (END included file options/os.md) + + +[//]: # (BEGIN included file options/os-feature.md) +#### **--os-feature**=*feature* + +Set the name of a required operating system *feature* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS feature list is kept, if the base image specified any. This option is typically only meaningful when the image's OS is Windows. + +If *feature* has a trailing `-`, then the *feature* is removed from the set of required features which is listed in the image. + +[//]: # (END included file options/os-feature.md) + + +[//]: # (BEGIN included file options/os-version.image.md) +#### **--os-version**=*version* + +Set the exact required operating system *version* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS version is kept, if the base image specified one. This option is typically only meaningful when the image's OS is Windows, and is typically set in Windows base images, so using this option is usually unnecessary. + +[//]: # (END included file options/os-version.image.md) + +#### **--output**, **-o**=*output-opts* + +Output destination (format: type=local,dest=path) + +The --output (or -o) option extends the default behavior of building a container image by allowing users to export the contents of the image as files on the local filesystem, which can be useful for generating local binaries, code generation, etc. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +The value for --output is a comma-separated sequence of key=value pairs, defining the output type and options. + +Supported _keys_ are: +- **dest**: Destination path for exported output. Valid value is absolute or relative path, `-` means the standard output. +- **type**: Defines the type of output to be used. Valid values is documented below. + +Valid _type_ values are: +- **local**: write the resulting build files to a directory on the client-side. +- **tar**: write the resulting files as a single tarball (.tar). + +If no type is specified, the value defaults to **local**. +Alternatively, instead of a comma-separated sequence, the value of **--output** can be just a destination (in the **dest** format) (e.g. `--output some-path`, `--output -`) where `--output some-path` is treated as if **type=local** and `--output -` is treated as if **type=tar**. + + +[//]: # (BEGIN included file options/pid.image.md) +#### **--pid**=*pid* + +Sets the configuration for PID namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new PID namespace is created, or it can be "host" to indicate that the PID namespace in which `podman` itself is being run is reused, or it can be the path to a PID namespace which is already in use by another +process. + +[//]: # (END included file options/pid.image.md) + +#### **--platform**=*os/arch[/variant][,...]* + +Set the *os/arch* of the built image (and its base image, when using one) +to the provided value instead of using the current operating system and +architecture of the host (for example `linux/arm`). Unless overridden, +subsequent lookups of the same image in the local storage matches this +platform, regardless of the host. + +If `--platform` is set, then the values of the `--arch`, `--os`, and +`--variant` options is overridden. + +The `--platform` option can be specified more than once, or given a +comma-separated list of values as its argument. When more than one platform is +specified, the `--manifest` option is used instead of the `--tag` +option. + +Os/arch pairs are those used by the Go Programming Language. In several cases +the *arch* value for a platform differs from one produced by other tools such as +the `arch` command. Valid OS and architecture name combinations are listed as +values for $GOOS and $GOARCH at https://golang.org/doc/install/source#environment, +and can also be found by running `go tool dist list`. + +While `podman build` is happy to use base images and build images for any +platform that exists, `RUN` instructions are unable to succeed without +the help of emulation provided by packages like `qemu-user-static`. + + +[//]: # (BEGIN included file options/pull.image.md) +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Only pull the image when it does not exist in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error when no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. + +[//]: # (END included file options/pull.image.md) + + +[//]: # (BEGIN included file options/quiet.md) +#### **--quiet**, **-q** + +Suppress output messages which indicate which instruction is being processed, and of progress when pulling images from a registry, and when writing the output image. + +[//]: # (END included file options/quiet.md) + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + + +[//]: # (BEGIN included file options/rm.md) +#### **--rm** + +Remove intermediate containers after a successful build (default true). + +[//]: # (END included file options/rm.md) + + +[//]: # (BEGIN included file options/runtime.md) +#### **--runtime**=*path* + +The *path* to an alternate OCI-compatible runtime, which is used to run +commands specified by the **RUN** instruction. + +Note: You can also override the default runtime by setting the BUILDAH\_RUNTIME environment variable. `export BUILDAH_RUNTIME=/usr/local/bin/runc` + +[//]: # (END included file options/runtime.md) + + +[//]: # (BEGIN included file options/runtime-flag.md) +#### **--runtime-flag**=*flag* + +Adds global flags for the container runtime. To list the supported flags, please consult the manpages of the selected container runtime. + +Note: Do not pass the leading -- to the flag. To pass the runc flag --log-format json to buildah build, the option given is --runtime-flag log-format=json. + +[//]: # (END included file options/runtime-flag.md) + +#### **--sbom**=*preset* + +Generate SBOMs (Software Bills Of Materials) for the output image by scanning +the working container and build contexts using the named combination of scanner +image, scanner commands, and merge strategy. Must be specified with one or +more of **--sbom-image-output**, **--sbom-image-purl-output**, **--sbom-output**, +and **--sbom-purl-output**. Recognized presets, and the set of options which +they equate to: + + - "syft", "syft-cyclonedx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output cyclonedx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output cyclonedx-json={OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "syft-spdx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output spdx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output spdx-json={OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + - "trivy", "trivy-cyclonedx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "trivy-spdx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + +#### **--sbom-image-output**=*path* + +When generating SBOMs, store the generated SBOM in the specified path in the +output image. There is no default. + +#### **--sbom-image-purl-output**=*path* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the specified path in the output +image. There is no default. + +#### **--sbom-merge-strategy**=*method* + +If more than one **--sbom-scanner-command** value is being used, use the +specified method to merge the output from later commands with output from +earlier commands. Recognized values include: + + - cat + Concatenate the files. + - merge-cyclonedx-by-component-name-and-version + Merge the "component" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "version" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + - merge-spdx-by-package-name-and-versioninfo + Merge the "package" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "versionInfo" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + +#### **--sbom-output**=*file* + +When generating SBOMs, store the generated SBOM in the named file on the local +filesystem. There is no default. + +#### **--sbom-purl-output**=*file* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the named file in the local +filesystem. There is no default. + +#### **--sbom-scanner-command**=*image* + +Generate SBOMs by running the specified command from the scanner image. If +multiple commands are specified, they are run in the order in which they are +specified. These text substitutions are performed: + - {ROOTFS} + The root of the built image's filesystem, bind mounted. + - {CONTEXT} + The build context and additional build contexts, bind mounted. + - {OUTPUT} + The name of a temporary output file, to be read and merged with others or copied elsewhere. + +#### **--sbom-scanner-image**=*image* + +Generate SBOMs using the specified scanner image. + + +[//]: # (BEGIN included file options/secret.image.md) +#### **--secret**=**id=id[,src=*envOrFile*][,env=*ENV*][,type=*file* | *env*]** + +Pass secret information to be used in the Containerfile for building images +in a safe way that will not end up stored in the final image, or be seen in other stages. +The value of the secret will be read from an environment variable or file named +by the "id" option, or named by the "src" option if it is specified, or from an +environment variable specified by the "env" option. See [EXAMPLES](#examples). +The secret will be mounted in the container at `/run/secrets/id` by default. + +To later use the secret, use the --mount flag in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret` + +The location of the secret in the container can be overridden using the +"target", "dst", or "destination" option of the `RUN --mount` flag. + +`RUN --mount=type=secret,id=mysecret,target=/run/secrets/myothersecret cat /run/secrets/myothersecret` + +Note: changing the contents of secret files will not trigger a rebuild of layers that use said secrets. + +[//]: # (END included file options/secret.image.md) + + +[//]: # (BEGIN included file options/security-opt.image.md) +#### **--security-opt**=*option* + +Security Options + +- `apparmor=unconfined` : Turn off apparmor confinement for the container +- `apparmor=alternate-profile` : Set the apparmor confinement profile for the +container + +- `label=user:USER` : Set the label user for the container processes +- `label=role:ROLE` : Set the label role for the container processes +- `label=type:TYPE` : Set the label process type for the container processes +- `label=level:LEVEL` : Set the label level for the container processes +- `label=filetype\:TYPE` : Set the label file type for the container files +- `label=disable` : Turn off label separation for the container +- `no-new-privileges` : Disable container processes from gaining additional privileges + +- `seccomp=unconfined` : Turn off seccomp confinement for the container +- `seccomp=profile.json` : JSON file to be used as the seccomp filter for the container. + +[//]: # (END included file options/security-opt.image.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the container. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + +#### **--sign-by**=*fingerprint* + +Sign the image using a GPG key with the specified FINGERPRINT. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines,) + + +[//]: # (BEGIN included file options/skip-unused-stages.md) +#### **--skip-unused-stages** + +Skip stages in multi-stage builds which don't affect the target stage. (Default: **true**). + +[//]: # (END included file options/skip-unused-stages.md) + + +[//]: # (BEGIN included file options/squash.md) +#### **--squash** + +Squash all of the image's new layers into a single new layer; any preexisting layers are not squashed. + +[//]: # (END included file options/squash.md) + + +[//]: # (BEGIN included file options/squash-all.md) +#### **--squash-all** + +Squash all of the new image's layers (including those inherited from a base image) into a single new layer. + +[//]: # (END included file options/squash-all.md) + + +[//]: # (BEGIN included file options/ssh.md) +#### **--ssh**=*default* | *id[=socket>* + +SSH agent socket or keys to expose to the build. +The socket path can be left empty to use the value of `default=$SSH_AUTH_SOCK` + +To later use the ssh agent, use the --mount option in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=ssh,id=id mycmd` + +[//]: # (END included file options/ssh.md) + +#### **--stdin** + +Pass stdin into the RUN containers. Sometime commands being RUN within a Containerfile +want to request information from the user. For example apt asking for a confirmation for install. +Use --stdin to be able to interact from the terminal during the build. + + +[//]: # (BEGIN included file options/tag.md) +#### **--tag**, **-t**=*imageName* + +Specifies the name which is assigned to the resulting image if the build process completes successfully. +If _imageName_ does not include a registry name, the registry name *localhost* is prepended to the image name. + +[//]: # (END included file options/tag.md) + + +[//]: # (BEGIN included file options/target.md) +#### **--target**=*stageName* + +Set the target build stage to build. When building a Containerfile with multiple build stages, --target can be used to specify an intermediate build stage by name as the final stage for the resulting image. Commands after the target stage is skipped. + +[//]: # (END included file options/target.md) + + +[//]: # (BEGIN included file options/timestamp.md) +#### **--timestamp**=*seconds* + +Set the create timestamp to seconds since epoch to allow for deterministic builds (defaults to current time). By default, the created timestamp is changed and written into the image manifest with every commit, causing the image's sha256 hash to be different even if the sources are exactly the same otherwise. +When --timestamp is set, the created timestamp is always set to the time specified and therefore not changed, allowing the image's sha256 hash to remain the same. All files committed to the layers of the image is created with the timestamp. + +If the only instruction in a Containerfile is `FROM`, this flag has no effect. + +[//]: # (END included file options/timestamp.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/ulimit.image.md) +#### **--ulimit**=*type=soft-limit[\:hard-limit]* + +Specifies resource limits to apply to processes launched when processing `RUN` instructions. This option can be specified multiple times. Recognized resource types include: + "core": maximum core dump size (ulimit -c) + "cpu": maximum CPU time (ulimit -t) + "data": maximum size of a process's data segment (ulimit -d) + "fsize": maximum size of new files (ulimit -f) + "locks": maximum number of file locks (ulimit -x) + "memlock": maximum amount of locked memory (ulimit -l) + "msgqueue": maximum amount of data in message queues (ulimit -q) + "nice": niceness adjustment (nice -n, ulimit -e) + "nofile": maximum number of open files (ulimit -n) + "nproc": maximum number of processes (ulimit -u) + "rss": maximum size of a process's (ulimit -m) + "rtprio": maximum real-time scheduling priority (ulimit -r) + "rttime": maximum amount of real-time execution between blocking syscalls + "sigpending": maximum number of pending signals (ulimit -i) + "stack": maximum stack size (ulimit -s) + +[//]: # (END included file options/ulimit.image.md) + + +[//]: # (BEGIN included file options/unsetenv.image.md) +#### **--unsetenv**=*env* + +Unset environment variables from the final image. + +[//]: # (END included file options/unsetenv.image.md) + + +[//]: # (BEGIN included file options/unsetlabel.md) +#### **--unsetlabel**=*label* + +Unset the image label, causing the label not to be inherited from the base image. + +[//]: # (END included file options/unsetlabel.md) + + +[//]: # (BEGIN included file options/userns.image.md) +#### **--userns**=*how* + +Sets the configuration for user namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new user namespace is created, it can be "host" to indicate that the user namespace in which `podman` itself is being run is reused, or it can be the path to a user namespace which is already in use by another process. + +[//]: # (END included file options/userns.image.md) + + +[//]: # (BEGIN included file options/userns-gid-map.md) +#### **--userns-gid-map**=*mapping* + +Directly specifies a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container GID, a corresponding starting host-level GID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-gids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-gid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-gid-map are specified, but --userns-uid-map is specified, the GID map is set to use the same numeric values as the UID map. + +[//]: # (END included file options/userns-gid-map.md) + + +[//]: # (BEGIN included file options/userns-gid-map-group.md) +#### **--userns-gid-map-group**=*group* + +Specifies that a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subgid` file which correspond to the specified group. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-uid-map-user is specified, but --userns-gid-map-group is not specified, `podman` assumes that the specified user name is also a +suitable group name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. + +[//]: # (END included file options/userns-gid-map-group.md) + + +[//]: # (BEGIN included file options/userns-uid-map.md) +#### **--userns-uid-map**=*mapping* + +Directly specifies a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions default to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container UID, a corresponding starting host-level UID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-uids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-uid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-uid-map are specified, but --userns-gid-map is specified, the UID map is set to use the same numeric values as the GID map. + +[//]: # (END included file options/userns-uid-map.md) + + +[//]: # (BEGIN included file options/userns-uid-map-user.md) +#### **--userns-uid-map-user**=*user* + +Specifies that a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subuid` file which correspond to the specified user. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-gid-map-group is specified, but --userns-uid-map-user is not specified, `podman` assumes that the specified group name is also a +suitable user name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. + +[//]: # (END included file options/userns-uid-map-user.md) + + +[//]: # (BEGIN included file options/uts.md) +#### **--uts**=*how* + +Sets the configuration for UTS namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new UTS namespace to be created, or it can be "host" to indicate that the UTS namespace in which `podman` itself is being run is reused, or it can be the path to a UTS namespace which is already in use by another process. + +[//]: # (END included file options/uts.md) + +#### **--variant**=*variant* + +Set the architecture variant of the image to be built, and that of the base +image to be pulled, if the build uses one, to the provided value instead of +using the architecture variant of the build host. + + +[//]: # (BEGIN included file options/volume.image.md) +#### **--volume**, **-v**=*[HOST-DIR\:CONTAINER-DIR[\:OPTIONS]]* + +Mount a host directory into containers when executing RUN instructions during +the build. + +The `OPTIONS` are a comma-separated list and can be one or more of: + + * [rw|ro] + * [z|Z|O] + * [U] + * [`[r]shared`|`[r]slave`|`[r]private`][[1]](#Footnote1) + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR` +must be an absolute path as well. Podman bind-mounts the `HOST-DIR` to the +specified path when processing RUN instructions. + +You can specify multiple **-v** options to mount one or more mounts. + +You can add the `:ro` or `:rw` suffix to a volume to mount it read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted. When running using user namespaces, the UID and GID inside +the namespace may correspond to another UID and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the namespace, to change recursively the owner and group of +the source volume. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add one of these two suffixes +`:z` or `:Z` to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The `z` option tells Podman that two containers +share the volume content. As a result, Podman labels the content with a shared +content label. Shared volume labels allow all containers to read/write content. +The `Z` option tells Podman to label the content with a private unshared label. +Only the current container can use a private volume. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the host machine to fail. For these types +of containers, disabling SELinux separation is recommended. The option +`--security-opt label=disable` disables SELinux separation for the container. +For example, if a user wanted to volume mount their entire home directory into the build containers, they need to disable SELinux separation. + + $ podman build --security-opt label=disable -v $HOME:/home/user . + +`Overlay Volume Mounts` + +The `:O` flag tells Podman to mount the directory from the host as a +temporary storage using the Overlay file system. The `RUN` command containers +are allowed to modify contents within the mountpoint and are stored in the +container storage in a separate directory. In Overlay FS terms the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the `RUN` command +finishes executing, similar to a tmpfs mount point. + +Any subsequent execution of `RUN` commands sees the original source directory +content, any changes from previous RUN commands no longer exists. + +One use case of the `overlay` mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: + +- Overlay mounts are not currently supported in rootless mode. +- The `O` flag is not allowed to be specified with the `Z` or `z` flags. + Content mounted into the container is labeled with the private label. + On SELinux systems, labels in the source directory needs to be readable + by the container label. If not, SELinux container separation must be disabled + for the container to work. +- Modification of the directory volume mounted into the container with an + overlay mount can cause unexpected failures. Do not modify the directory until + the container finishes running. + +By default bind mounted volumes are `private`. That means any mounts done +inside containers are not be visible on the host and vice versa. This behavior +can be changed by specifying a volume mount propagation property. + +When the mount propagation policy is set to `shared`, any mounts completed +inside the container on that volume is visible to both the host and +container. When the mount propagation policy is set to `slave`, one way mount +propagation is enabled and any mounts completed on the host for that volume is +visible only inside of the container. To control the mount propagation +property of volume use the `:[r]shared`, `:[r]slave` or `:[r]private` +propagation flag. For mount propagation to work on the source mount point (mount +point where source dir is mounted on) has to have the right propagation properties. +For shared volumes, the source mount point has to be shared. And for slave volumes, +the source mount has to be either shared or slave. [[1]](#Footnote1) + +Use `df ` to determine the source mount and then use +`findmnt -o TARGET,PROPAGATION ` to determine propagation +properties of source mount, if `findmnt` utility is not available, the source +mount point can be determined by looking at the mount entry in +`/proc/self/mountinfo`. Look at `optional fields` and see if any propagation +properties are specified. +`shared:X` means the mount is `shared`, `master:X` means the mount is `slave` +and if nothing is there that means the mount is `private`. [[1]](#Footnote1) + +To change propagation properties of a mount point use the `mount` command. For +example, to bind mount the source directory `/foo` do +`mount --bind /foo /foo` and `mount --make-private --make-shared /foo`. This +converts /foo into a `shared` mount point. The propagation properties of +the source mount can be changed directly. For instance if `/` is the source +mount for `/foo`, then use `mount --make-shared /` to convert `/` into a +`shared` mount. + +[//]: # (END included file options/volume.image.md) + +## EXAMPLES + +### Build an image using local Containerfiles + +Build image using Containerfile with content from current directory: +``` +$ podman build . +``` + +Build image using specified Containerfile with content from current directory: +``` +$ podman build -f Containerfile.simple . +``` + +Build image using Containerfile from stdin with content from current directory: +``` +$ cat $HOME/Containerfile | podman build -f - . +``` + +Build image using multiple Containerfiles with content from current directory: +``` +$ podman build -f Containerfile.simple -f Containerfile.notsosimple . +``` + +Build image with specified Containerfile with content from $HOME directory. Note `cpp` is applied to Containerfile.in before processing as Containerfile: +``` +$ podman build -f Containerfile.in $HOME +``` + +Build image with the specified tag with Containerfile and content from current directory: +``` +$ podman build -t imageName . +``` + +Build image ignoring registry verification for any images pulled via the Containerfile: +``` +$ podman build --tls-verify=false -t imageName . +``` + +Build image with the specified logging format: +``` +$ podman build --runtime-flag log-format=json . +``` + +Build image using debug mode for logging: +``` +$ podman build --runtime-flag debug . +``` + +Build image using specified registry attributes when pulling images from the selected Containerfile: +``` +$ podman build --authfile /tmp/auths/myauths.json --cert-dir $HOME/auth --tls-verify=true --creds=username:password -t imageName -f Containerfile.simple . +``` + +Build image using specified resource controls when running containers during the build: +``` +$ podman build --memory 40m --cpu-period 10000 --cpu-quota 50000 --ulimit nofile=1024:1028 -t imageName . +``` + +Build image using specified SELinux labels and cgroup config running containers during the build: +``` +$ podman build --security-opt label=level:s0:c100,c200 --cgroup-parent /path/to/cgroup/parent -t imageName . +``` + +Build image with read-only and SELinux relabeled volume mounted from the host into running containers during the build: +``` +$ podman build --volume /home/test:/myvol:ro,Z -t imageName . +``` + +Build image with overlay volume mounted from the host into running containers during the build: +``` +$ podman build -v /var/lib/yum:/var/lib/yum\:O -t imageName . +``` + +Build image using layers and then removing intermediate containers even if the build fails. +``` +$ podman build --layers --force-rm -t imageName . +``` + +Build image ignoring cache and not removing intermediate containers even if the build succeeds: +``` +$ podman build --no-cache --rm=false -t imageName . +``` + +Build image using the specified network when running containers during the build: +``` +$ podman build --network mynet . +``` + +Build an image using a secret stored in an environment variable or file named `mysecret` to be used with the instruction `RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret`: +``` +$ podman build --secret=id=mysecret . +``` + +Build an image using a secret stored in an environment variable named `MYSECRET` to be used with the instruction `RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret`: +``` +$ podman build --secret=id=mysecret,env=MYSECRET . +$ podman build --secret=id=mysecret,src=MYSECRET,type=env . +``` + +Build an image using a secret stored in a file named `.mysecret` to be used with the instruction `RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret`: +``` +$ podman build --secret=id=mysecret,src=.mysecret . +$ podman build --secret=id=mysecret,src=.mysecret,type=file . +``` + +### Building a multi-architecture image using the --manifest option (requires emulation software) + +Build image using the specified architectures and link to a single manifest on successful completion: +``` +$ podman build --arch arm --manifest myimage /tmp/mysrc +$ podman build --arch amd64 --manifest myimage /tmp/mysrc +$ podman build --arch s390x --manifest myimage /tmp/mysrc +``` + +Similarly build using a single command +``` +$ podman build --platform linux/s390x,linux/ppc64le,linux/amd64 --manifest myimage /tmp/mysrc +``` + +Build image using multiple specified architectures and link to single manifest on successful completion: +``` +$ podman build --platform linux/arm64 --platform linux/amd64 --manifest myimage /tmp/mysrc +``` + +### Building an image using a URL, Git repo, or archive + + The build context directory can be specified as a URL to a Containerfile, a +Git repository, or URL to an archive. If the URL is a Containerfile, it is +downloaded to a temporary location and used as the context. When a Git +repository is set as the URL, the repository is cloned locally to a temporary +location and then used as the context. Lastly, if the URL is an archive, it is +downloaded to a temporary location and extracted before being used as the +context. + +#### Building an image using a URL to a Containerfile + +Build image from Containerfile downloaded into temporary location used as the build context: +``` +$ podman build https://10.10.10.1/podman/Containerfile +``` + +#### Building an image using a Git repository + + Podman clones the specified GitHub repository to a temporary location and +uses it as the context. The Containerfile at the root of the repository is used +and it only works if the GitHub repository is a dedicated repository. + +Build image from specified git repository downloaded into temporary location used as the build context: +``` +$ podman build -t hello https://github.com/containers/PodmanHello.git +$ podman run hello +``` + + Note: GitHub does not support using `git://` for performing `clone` operation due to recent changes in their security guidance (https://github.blog/2021-09-01-improving-git-protocol-security-github/). Use an `https://` URL if the source repository is hosted on GitHub. + +#### Building an image using a URL to an archive + + Podman fetches the archive file, decompresses it, and uses its contents as the +build context. The Containerfile at the root of the archive and the rest of the +archive are used as the context of the build. Passing the +`-f PATH/Containerfile` option as well tells the system to look for that file +inside the contents of the archive. + +``` +$ podman build -f dev/Containerfile https://10.10.10.1/podman/context.tar.gz +``` + + Note: supported compression formats are 'xz', 'bzip2', 'gzip' and 'identity' +(no compression). + +## Files + +### .containerignore/.dockerignore + +If the file *.containerignore* or *.dockerignore* exists in the context directory, +`podman build` reads its contents. Use the `--ignorefile` option to override the +.containerignore path location. +Podman uses the content to exclude files and directories from the context +directory, when executing COPY and ADD directives in the +Containerfile/Dockerfile + +The .containerignore and .dockerignore files use the same syntax; if both +are in the context directory, podman build only uses .containerignore. + +Users can specify a series of Unix shell globs in a .containerignore file to +identify files/directories to exclude. + +Podman supports a special wildcard string `**` which matches any number of +directories (including zero). For example, **/*.go excludes all files that +end with .go that are found in all directories. + +Example .containerignore file: + +``` +# exclude this content for image +*/*.c +**/output* +src +``` + +`*/*.c` +Excludes files and directories whose names ends with .c in any top level +subdirectory. For example, the source file include/rootless.c. + +`**/output*` +Excludes files and directories starting with `output` from any directory. + +`src` +Excludes files named src and the directory src as well as any content in it. + +Lines starting with ! (exclamation mark) can be used to make exceptions to +exclusions. The following is an example .containerignore file that uses this +mechanism: +``` +*.doc +!Help.doc +``` + +Exclude all doc files except Help.doc from the image. + +This functionality is compatible with the handling of .containerignore files +described here: **[containerignore(5)](https://github.com/containers/common/blob/main/docs/containerignore.5.md)** + +### registries.conf (`/etc/containers/registries.conf`) + +registries.conf is the configuration file which specifies which container +registries is consulted when completing image names which do not include +a registry or domain portion. +See **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + + +## Troubleshooting + +### lastlog sparse file + +Using a useradd command within a Containerfile with a large UID/GID creates +a large sparse file `/var/log/lastlog`. This can cause the +build to hang forever. Go language does not support sparse files correctly, +which can lead to some huge files being created in the container image. + +When using the `useradd` command within the build script, pass the +`--no-log-init or -l` option to the `useradd` command. This option tells +useradd to stop creating the lastlog file. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/main/man/runc.8.md)**, **[useradd(8)](https://www.unix.com/man-page/redhat/8/useradd)**, **[podman-ps(1)](podman-ps.1.md)**, **[podman-rm(1)](podman-rm.1.md)**, **[Containerfile(5)](https://github.com/containers/common/blob/main/docs/Containerfile.5.md)**, **[containerignore(5)](https://github.com/containers/common/blob/main/docs/containerignore.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +See [podman-rootless(7)](https://github.com/containers/podman/blob/main/rootless.md) +for rootless issues. + +## HISTORY +Aug 2020, Additional options and .containerignore added by Dan Walsh `` + +May 2018, Minor revisions added by Joe Doss `` + +December 2017, Originally compiled by Tom Sweeney `` + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a +core value of open source. The `master` and `slave` mount propagation +terminology used here is problematic and divisive, and needs to be changed. +However, these terms are currently used within the Linux kernel and must be +used as-is at this time. When the kernel maintainers rectify this usage, +Podman will follow suit immediately. diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-commit.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-commit.1.md new file mode 100644 index 000000000..8fdc6dada --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-commit.1.md @@ -0,0 +1,139 @@ +--- +title: podman-commit +version: v5.5.1 +--- + +% podman-commit 1 + +## NAME +podman\-commit - Create new image based on the changed container + +## SYNOPSIS +**podman commit** [*options*] *container* [*image*] + +**podman container commit** [*options*] *container* [*image*] + +## DESCRIPTION +**podman commit** creates an image based on a changed *container*. The author of the image can be set using the **--author** OPTION. Various image instructions can be configured with the **--change** OPTION and a commit message can be set using the **--message** OPTION. The *container* and its processes aren't paused while the image is committed. If this is not desired, the **--pause** OPTION can be set to *true*. When the commit is complete, Podman prints out the ID of the new image. + +If `image` does not begin with a registry name component, `localhost` is added to the name. +If `image` is not provided, the values for the `REPOSITORY` and `TAG` values of the created image is set to ``. + +## OPTIONS +#### **--author**, **-a**=*author* + +Set the author for the committed image. + +#### **--change**, **-c**=*instruction* + +Apply the following possible instructions to the created image: + +- *CMD* +- *ENTRYPOINT* +- *ENV* +- *EXPOSE* +- *LABEL* +- *ONBUILD* +- *STOPSIGNAL* +- *USER* +- *VOLUME* +- *WORKDIR* + +Can be set multiple times. + +#### **--config**=*ConfigBlobFile* + +Merge the container configuration from the specified file into the configuration for the image +as it is being committed. The file contents should be a JSON-encoded version of +a Schema2Config structure, which is defined at +https://github.com/containers/image/blob/v5.29.0/manifest/docker_schema2.go#L67. + +#### **--format**, **-f**=**oci** | *docker* + +Set the format of the image manifest and metadata. The currently supported formats are **oci** and *docker*.\ +The default is **oci**. + +#### **--iidfile**=*ImageIDfile* + +Write the image ID to the file. + +#### **--include-volumes** + +Include in the committed image any volumes added to the container by the **--volume** or **--mount** OPTIONS to the **[podman create](podman-create.1.md)** and **[podman run](podman-run.1.md)** commands.\ +The default is **false**. + +#### **--message**, **-m**=*message* + +Set commit message for committed image.\ +*IMPORTANT: The message field is not supported in `oci` format.* + +#### **--pause**, **-p** + +Pause the container when creating an image.\ +The default is **false**. + +#### **--quiet**, **-q** + +Suppresses output.\ +The default is **false**. + +#### **--squash**, **-s** + +Squash newly built layers into a single new layer.\ +The default is **false**. + +## EXAMPLES +Create image from container with entrypoint and label: +``` +$ podman commit --change CMD=/bin/bash --change ENTRYPOINT=/bin/sh --change "LABEL blue=image" reverent_golick image-committed +Getting image source signatures +Copying blob sha256:b41deda5a2feb1f03a5c1bb38c598cbc12c9ccd675f438edc6acd815f7585b86 + 25.80 MB / 25.80 MB [======================================================] 0s +Copying config sha256\:c16a6d30f3782288ec4e7521c754acc29d37155629cb39149756f486dae2d4cd + 448 B / 448 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Create image from container with commit message: +``` +$ podman commit -q --message "committing container to image" +reverent_golick image-committed +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Create image from container with author: +``` +$ podman commit -q --author "firstName lastName" reverent_golick image-committed +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Pause running container while creating image: +``` +$ podman commit -q --pause=true containerID image-committed +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Create image from container with default image tag: +``` +$ podman commit containerID +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Create image from container with default required capabilities: +``` +$ podman commit -q --change LABEL=io.containers.capabilities=setuid,setgid epic_nobel privimage +400d31a3f36dca751435e80a0e16da4859beb51ff84670ce6bdc5edb30b94066 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-create(1)](podman-create.1.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +December 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-completion.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-completion.1.md new file mode 100644 index 000000000..49d82e57e --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-completion.1.md @@ -0,0 +1,83 @@ +--- +title: podman-completion +version: v5.5.1 +--- + +% podman-completion 1 + +## NAME +podman\-completion - Generate shell completion scripts + +## SYNOPSIS +**podman completion** [*options*] *bash* | *zsh* | *fish* | *powershell* + +## DESCRIPTION +**podman completion** generates shell completion scripts for a variety of shells. Supported shells are *bash*, *zsh*, *fish* and *powershell*. + +These script are used by the shell to provide suggestions and complete commands when the command is typed and `[TAB]` is pressed. + +Usually these scripts are automatically installed via the package manager. + +## OPTIONS +#### **--file**, **-f**=*file* + +Write the generated output to a file. + +#### **--no-desc** + +Do not provide description in the completions.\ +The default is **false**. + +## Installation + +### BASH +`bash-completion` has to be installed on the system. + +To load the completion script into the current session run: +``` +source <(podman completion bash) +``` + +To make it available for all bash sessions run: +``` +podman completion -f /etc/bash_completion.d/podman bash +``` + + +### ZSH +Shell completion needs to be already enabled in the environment. The following can be executed: +``` +echo "autoload -U compinit; compinit" >> ~/.zshrc +``` + +To make it available for all zsh sessions run: +``` +podman completion -f "${fpath[1]}/_podman" zsh +``` + +Once the shell is reloaded the auto-completion works. + + +### FISH +To load the completion script into the current session run: +``` +podman completion fish | source +``` + +To make it available for all fish sessions run: +``` +podman completion -f ~/.config/fish/completions/podman.fish fish +``` + +### POWERSHELL +To load the completion script into the current session run: +``` +podman.exe completion powershell | Out-String | Invoke-Expression +``` + +To make it available in all powershell sessions that a user has, write the +completion output to a file and source that to the user's powershell profile. +More information about profiles is available with **Get-Help about_Profiles**. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **zsh(1)**, **fish(1)**, **powershell(1)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-compose.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-compose.1.md new file mode 100644 index 000000000..9580f6739 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-compose.1.md @@ -0,0 +1,28 @@ +--- +title: podman-compose +version: v5.5.1 +--- + +% podman-compose 1 + +## NAME +podman\-compose - Run Compose workloads via an external compose provider + +## SYNOPSIS +**podman compose** [*options*] [*command* [*arg* ...]] + +## DESCRIPTION +**podman compose** is a thin wrapper around an external compose provider such as docker-compose or podman-compose. This means that `podman compose` is executing another tool that implements the compose functionality but sets up the environment in a way to let the compose provider communicate transparently with the local Podman socket. The specified options as well the command and argument are passed directly to the compose provider. + +The default compose providers are `docker-compose` and `podman-compose`. If installed, `docker-compose` takes precedence since it is the original implementation of the Compose specification and is widely used on the supported platforms (i.e., Linux, Mac OS, Windows). + +If you want to change the default behavior or have a custom installation path for your provider of choice, please change the `compose_providers` field in `containers.conf(5)` to `compose_providers = ["/path/to/provider"]`. You may also set the `PODMAN_COMPOSE_PROVIDER` environment variable. + +By default, `podman compose` will emit a warning saying that it executes an external command. This warning can be disabled by setting `compose_warning_logs` to false in `containers.conf(5)` or setting the `PODMAN_COMPOSE_WARNING_LOGS` environment variable to false. See the man page for `containers.conf(5)` for more information. + +## OPTIONS + +To see supported options of the installed compose provider, please run `podman compose --help`. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-container-checkpoint.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-container-checkpoint.1.md new file mode 100644 index 000000000..6c769959b --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-container-checkpoint.1.md @@ -0,0 +1,231 @@ +--- +title: podman-container-checkpoint +version: v5.5.1 +--- + +% podman-container-checkpoint 1 + +## NAME +podman\-container\-checkpoint - Checkpoint one or more running containers + +## SYNOPSIS +**podman container checkpoint** [*options*] *container* [*container* ...] + +## DESCRIPTION +**podman container checkpoint** checkpoints all the processes in one or more *containers*. A *container* can be restored from a checkpoint with **[podman-container-restore](podman-container-restore.1.md)**. The *container IDs* or *names* are used as input. + +*IMPORTANT: If the container is using __systemd__ as __entrypoint__ checkpointing the container might not be possible.* + +## OPTIONS +#### **--all**, **-a** + +Checkpoint all running *containers*.\ +The default is **false**.\ +*IMPORTANT: This OPTION does not need a container name or ID as input argument.* + +#### **--compress**, **-c**=**zstd** | *none* | *gzip* + +Specify the compression algorithm used for the checkpoint archive created +with the **--export, -e** OPTION. Possible algorithms are **zstd**, *none* +and *gzip*.\ +One possible reason to use *none* is to enable faster creation of checkpoint +archives. Not compressing the checkpoint archive can result in faster checkpoint +archive creation.\ +The default is **zstd**. + +#### **--create-image**=*image* + +Create a checkpoint image from a running container. This is a standard OCI image +created in the local image store. It consists of a single layer that contains +all of the checkpoint files. The content of this image layer is in the same format as a +checkpoint created with **--export**. A checkpoint image can be pushed to a +standard container registry and pulled on a different system to enable container +migration. In addition, the image can be exported with **podman image save** and +inspected with **podman inspect**. Inspecting a checkpoint image displays +additional information, stored as annotations, about the host environment used +to do the checkpoint: + +- **io.podman.annotations.checkpoint.name**: Human-readable name of the original + container. + +- **io.podman.annotations.checkpoint.rawImageName**: Unprocessed name of the + image used to create the original container (as specified by the user). + +- **io.podman.annotations.checkpoint.rootfsImageID**: ID of the image used to + create the original container. + +- **io.podman.annotations.checkpoint.rootfsImageName**: Image name used to + create the original container. + +- **io.podman.annotations.checkpoint.podman.version**: Version of Podman used to + create the checkpoint. + +- **io.podman.annotations.checkpoint.criu.version**: Version of CRIU used to + create the checkpoint. + +- **io.podman.annotations.checkpoint.runtime.name**: Container runtime (e.g., + runc, crun) used to create the checkpoint. + +- **io.podman.annotations.checkpoint.runtime.version**: Version of the container + runtime used to create the checkpoint. + +- **io.podman.annotations.checkpoint.conmon.version**: Version of conmon used + with the original container. + +- **io.podman.annotations.checkpoint.host.arch**: CPU architecture of the host + on which the checkpoint was created. + +- **io.podman.annotations.checkpoint.host.kernel**: Version of Linux kernel + of the host where the checkpoint was created. + +- **io.podman.annotations.checkpoint.cgroups.version**: cgroup version used by + the host where the checkpoint was created. + +- **io.podman.annotations.checkpoint.distribution.version**: Version of host + distribution on which the checkpoint was created. + +- **io.podman.annotations.checkpoint.distribution.name**: Name of host + distribution on which the checkpoint was created. + +#### **--export**, **-e**=*archive* + +Export the checkpoint to a tar.gz file. The exported checkpoint can be used +to import the *container* on another system and thus enabling container live +migration. This checkpoint archive also includes all changes to the *container's* +root file-system, if not explicitly disabled using **--ignore-rootfs**. + +#### **--file-locks** + +Checkpoint a *container* with file locks. If an application running in the container +is using file locks, this OPTION is required during checkpoint and restore. Otherwise +checkpointing *containers* with file locks is expected to fail. If file locks are not +used, this option is ignored.\ +The default is **false**. + +#### **--ignore-rootfs** + +If a checkpoint is exported to a tar.gz file it is possible with the help of **--ignore-rootfs** to explicitly disable including changes to the root file-system into the checkpoint archive file.\ +The default is **false**.\ +*IMPORTANT: This OPTION only works in combination with __--export, -e__.* + +#### **--ignore-volumes** + +This OPTION must be used in combination with the **--export, -e** OPTION. +When this OPTION is specified, the content of volumes associated with +the *container* is not included into the checkpoint tar.gz file.\ +The default is **false**. + +#### **--keep**, **-k** + +Keep all temporary log and statistics files created by CRIU during checkpointing. These files are not deleted if checkpointing fails for further debugging. If checkpointing succeeds these files are theoretically not needed, but if these files are needed Podman can keep the files for further analysis.\ +The default is **false**. + +#### **--latest**, **-l** + +Instead of providing the *container ID* or *name*, use the last created *container*. The default is **false**. +*IMPORTANT: This OPTION is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines. This OPTION does not need a container name or ID as input argument.* + +#### **--leave-running**, **-R** + +Leave the *container* running after checkpointing instead of stopping it.\ +The default is **false**. + +#### **--pre-checkpoint**, **-P** + +Dump the *container's* memory information only, leaving the *container* running. Later +operations supersedes prior dumps. It only works on `runc 1.0-rc3` or `higher`.\ +The default is **false**. + +The functionality to only checkpoint the memory of the container and in a second +checkpoint only write out the memory pages which have changed since the first +checkpoint relies on the Linux kernel's soft-dirty bit, which is not available +on all systems as it depends on the system architecture and the configuration +of the Linux kernel. Podman verifies if the current system supports this +functionality and return an error if the current system does not support it. + +#### **--print-stats** + +Print out statistics about checkpointing the container(s). The output is +rendered in a JSON array and contains information about how much time different +checkpoint operations required. Many of the checkpoint statistics are created +by CRIU and just passed through to Podman. The following information is provided +in the JSON array: + +- **podman_checkpoint_duration**: Overall time (in microseconds) needed to create + all checkpoints. + +- **runtime_checkpoint_duration**: Time (in microseconds) the container runtime + needed to create the checkpoint. + +- **freezing_time**: Time (in microseconds) CRIU needed to pause (freeze) all + processes in the container (measured by CRIU). + +- **frozen_time**: Time (in microseconds) all processes in the container were + paused (measured by CRIU). + +- **memdump_time**: Time (in microseconds) needed to extract all required memory + pages from all container processes (measured by CRIU). + +- **memwrite_time**: Time (in microseconds) needed to write all required memory + pages to the corresponding checkpoint image files (measured by CRIU). + +- **pages_scanned**: Number of memory pages scanned to determine if they need + to be checkpointed (measured by CRIU). + +- **pages_written**: Number of memory pages actually written to the checkpoint + image files (measured by CRIU). + +The default is **false**. + +#### **--tcp-established** + +Checkpoint a *container* with established TCP connections. If the checkpoint +image contains established TCP connections, this OPTION is required during +restore. Defaults to not checkpointing *containers* with established TCP +connections.\ +The default is **false**. + +#### **--with-previous** + +Check out the *container* with previous criu image files in pre-dump. It only works on `runc 1.0-rc3` or `higher`.\ +The default is **false**.\ +*IMPORTANT: This OPTION is not available with __--pre-checkpoint__*. + +This option requires that the option __--pre-checkpoint__ has been used before on the +same container. Without an existing pre-checkpoint, this option fails. + +Also see __--pre-checkpoint__ for additional information about __--pre-checkpoint__ +availability on different systems. + +## EXAMPLES +Make a checkpoint for the container "mywebserver". +``` +# podman container checkpoint mywebserver +``` + +Create a checkpoint image for the container "mywebserver". +``` +# podman container checkpoint --create-image mywebserver-checkpoint-1 mywebserver +``` + +Dumps the container's memory information of the latest container into an archive. +``` +# podman container checkpoint -P -e pre-checkpoint.tar.gz -l +``` + +Keep the container's memory information from an older dump and add the new container's memory information. +``` +# podman container checkpoint --with-previous -e checkpoint.tar.gz -l +``` + +Dump the container's memory information of the latest container into an archive with the specified compress method. +``` +# podman container checkpoint -l --compress=none --export=dump.tar +# podman container checkpoint -l --compress=gzip --export=dump.tar.gz +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container-restore(1)](podman-container-restore.1.md)**, **criu(8)** + +## HISTORY +September 2018, Originally compiled by Adrian Reber diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-container-cleanup.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-container-cleanup.1.md new file mode 100644 index 000000000..800f45eac --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-container-cleanup.1.md @@ -0,0 +1,61 @@ +--- +title: podman-container-cleanup +version: v5.5.1 +--- + +% podman-container-cleanup 1 + +## NAME +podman\-container\-cleanup - Clean up the container's network and mountpoints + +## SYNOPSIS +**podman container cleanup** [*options*] *container* [*container* ...] + +## DESCRIPTION +**podman container cleanup** cleans up exited *containers* by removing all mountpoints and network configurations from the host. The *container name* or *ID* can be used. The cleanup command does not remove the *containers*. Running *containers* are not cleaned up.\ +Sometimes container mount points and network stacks can remain if the podman command was killed or the *container* ran in daemon mode. This command is automatically executed when *containers* are run in daemon mode by the `conmon process` when the *container* exits. + +## OPTIONS +#### **--all**, **-a** + +Clean up all *containers*.\ +The default is **false**.\ +*IMPORTANT: This OPTION does not need a container name or ID as input argument.* + +#### **--exec**=*session* + +Clean up an exec session for a single *container*. +It can only be specified if a single *container* is being cleaned up (conflicts with **--all** as such). If **--rm** is not specified, temporary files for the exec session are cleaned up; if it is, the exec session is removed from the *container*.\ +*IMPORTANT: Conflicts with **--rmi** as the container is not being cleaned up so the image cannot be removed.* + +#### **--latest**, **-l** + +Instead of providing the *container ID* or *name*, use the last created *container*. The default is **false**. +*IMPORTANT: This OPTION is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines. This OPTION does not need a container name or ID as input argument.* + +#### **--rm** + +After cleanup, remove the *container* entirely.\ +The default is **false**. + +#### **--rmi** + +After cleanup, remove the image entirely.\ +The default is **false**. + +## EXAMPLES +Clean up the container "mywebserver". +``` +$ podman container cleanup mywebserver +``` + +Clean up the containers with the names "mywebserver", "myflaskserver", "860a4b23". +``` +$ podman container cleanup mywebserver myflaskserver 860a4b23 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)** + +## HISTORY +Jun 2018, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-container-clone.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-container-clone.1.md new file mode 100644 index 000000000..ca9cc99b2 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-container-clone.1.md @@ -0,0 +1,362 @@ +--- +title: podman-container-clone +version: v5.5.1 +--- + +% podman-container-clone 1 + +## NAME +podman\-container\-clone - Create a copy of an existing container + +## SYNOPSIS +**podman container clone** [*options*] *container* *name* *image* + +## DESCRIPTION +**podman container clone** creates a copy of a container, recreating the original with an identical configuration. This command takes three arguments: the first being the container ID or name to clone, the second argument in this command can change the name of the clone from the default of $ORIGINAL_NAME-clone, and the third is a new image to use in the cloned container. + +## OPTIONS + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + +If none is specified, the original container's cpu period is used + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + +If none is specified, the original container's CPU quota are used. + + +[//]: # (BEGIN included file options/cpu-rt-period.md) +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-period.md) + +If none is specified, the original container's CPU runtime period is used. + + +[//]: # (BEGIN included file options/cpu-rt-runtime.md) +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-runtime.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + +If none are specified, the original container's CPU shares are used. + +#### **--cpus** + +Set a number of CPUs for the container that overrides the original containers CPU limits. If none are specified, the original container's Nano CPUs are used. + +This is shorthand +for **--cpu-period** and **--cpu-quota**, so only **--cpus** or either both the **--cpu-period** and **--cpu-quota** options can be set. + +This option is not supported on cgroups V1 rootless systems. + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + +If none are specified, the original container's CPUset is used. + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + +If none are specified, the original container's CPU memory nodes are used. + + +[//]: # (BEGIN included file options/destroy.md) +#### **--destroy** + +Remove the original container that we are cloning once used to mimic the configuration. + +[//]: # (END included file options/destroy.md) + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + +#### **--force**, **-f** + +Force removal of the original container that we are cloning. Can only be used in conjunction with **--destroy**. + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + +If no memory limits are specified, the original container's memory limits are used. + + +[//]: # (BEGIN included file options/memory-reservation.md) +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-reservation.md) + +If unspecified, memory reservation is the same as memory limit from the +container being cloned. + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + +If unspecified, the container being cloned is used to derive +the swap value. + + +[//]: # (BEGIN included file options/memory-swappiness.md) +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/memory-swappiness.md) + +#### **--name** + +Set a custom name for the cloned container. The default if not specified is of the syntax: **\-clone** + +#### **--pod**=*name* + +Clone the container in an existing pod. It is helpful to move a container to an +existing pod. The container joins the pod shared namespaces, losing its configuration +that conflicts with the shared namespaces. + +#### **--run** + +When set to true, this flag runs the newly created container after the +clone process has completed, this specifies a detached running mode. + +## EXAMPLES + +Clone specified container into a new container: +``` +# podman container clone d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone specified container into a newly named container: +``` +# podman container clone --name=clone d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Replace specified container with selected resource constraints into a new container, removing original container: +``` +# podman container clone --destroy --cpus=5 d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone specified container giving a new name and then replacing the image of the original container with the specified image name: +``` +# podman container clone 2d4d4fca7219b4437e0d74fcdc272c4f031426a6eacd207372691207079551de new_name fedora +Resolved "fedora" as an alias (/etc/containers/registries.conf.d/shortnames.conf) +Trying to pull registry.fedoraproject.org/fedora\:latest... +Getting image source signatures +Copying blob c6183d119aa8 done +Copying config e417cd49a8 done +Writing manifest to image destination +Storing signatures +5a9b7851013d326aa4ac4565726765901b3ecc01fcbc0f237bc7fd95588a24f9 +``` + +## SEE ALSO +**[podman-create(1)](podman-create.1.md)**, **[cgroups(7)](https://man7.org/linux/man-pages/man7/cgroups.7.html)** + +## HISTORY +January 2022, Originally written by Charlie Doern diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-container-diff.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-container-diff.1.md new file mode 100644 index 000000000..1588b8163 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-container-diff.1.md @@ -0,0 +1,65 @@ +--- +title: podman-container-diff +version: v5.5.1 +--- + +% podman-container-diff 1 + +## NAME +podman\-container\-diff - Inspect changes on a container's filesystem + +## SYNOPSIS +**podman container diff** [*options*] *container* [*container*] + +## DESCRIPTION +Displays changes on a container's filesystem. The container is compared to its parent layer or the second argument when given. + +The output is prefixed with the following symbols: + +| Symbol | Description | +|--------|-------------| +| A | A file or directory was added. | +| D | A file or directory was deleted. | +| C | A file or directory was changed. | + +## OPTIONS + +#### **--format** + +Alter the output into a different format. The only valid format for **podman container diff** is `json`. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +``` +# podman container diff container1 +C /usr +C /usr/local +C /usr/local/bin +A /usr/local/bin/docker-entrypoint.sh +``` + +``` +$ podman container diff --format json container1 container2 +{ + "added": [ + "/test" + ] +} +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)** + +## HISTORY +July 2021, Originally compiled by Paul Holzinger diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-container-exists.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-container-exists.1.md new file mode 100644 index 000000000..f3f33a764 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-container-exists.1.md @@ -0,0 +1,56 @@ +--- +title: podman-container-exists +version: v5.5.1 +--- + +% podman-container-exists 1 + +## NAME +podman\-container\-exists - Check if a container exists in local storage + +## SYNOPSIS +**podman container exists** [*options*] *container* + +## DESCRIPTION +**podman container exists** checks if a container exists in local storage. The *container ID* or *name* is used as input. Podman returns an exit code +of `0` when the container is found. A `1` is returned otherwise. An exit code of `125` indicates there was an issue accessing the local storage. + +## OPTIONS +#### **--external** + +Check for external *containers* as well as Podman *containers*. These external *containers* are generally created via other container technology such as `Buildah` or `CRI-O`.\ +The default is **false**. + +**-h**, **--help** + +Prints usage statement.\ +The default is **false**. + +## EXAMPLES + +Check if a container called "webclient" exists in local storage. Here, the container does exist. +``` +$ podman container exists webclient +$ echo $? +0 +``` + +Check if a container called "webbackend" exists in local storage. Here, the container does not exist. +``` +$ podman container exists webbackend +$ echo $? +1 +``` + +Check if a container called "ubi8-working-container" created via Buildah exists in local storage. Here, the container does not exist. +``` +$ podman container exists --external ubi8-working-container +$ echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +November 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-container-inspect.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-container-inspect.1.md new file mode 100644 index 000000000..fbb588ef9 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-container-inspect.1.md @@ -0,0 +1,349 @@ +--- +title: podman-container-inspect +version: v5.5.1 +--- + +% podman-container-inspect 1 + +## NAME +podman\-container\-inspect - Display a container's configuration + +## SYNOPSIS +**podman container inspect** [*options*] *container* [*container* ...] + +## DESCRIPTION + +This displays the low-level information on containers identified by name or ID. By default, this renders +all results in a JSON array. If a format is specified, the given template is executed for each result. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Format the output using the given Go template. +The keys of the returned JSON can be used as the values for the --format flag (see examples below). + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------------ | -------------------------------------------------- | +| .AppArmorProfile | AppArmor profile (string) | +| .Args | Command-line arguments (array of strings) | +| .BoundingCaps | Bounding capability set (array of strings) | +| .Config ... | Structure with config info | +| .ConmonPidFile | Path to file containing conmon pid (string) | +| .Created ... | Container creation time (string, ISO3601) | +| .Dependencies | Dependencies (array of strings) | +| .Driver | Storage driver (string) | +| .EffectiveCaps | Effective capability set (array of strings) | +| .ExecIDs | Exec IDs (array of strings) | +| .GraphDriver ... | Further details of graph driver (struct) | +| .HostConfig ... | Host config details (struct) | +| .HostnamePath | Path to file containing hostname (string) | +| .HostsPath | Path to container /etc/hosts file (string) | +| .ID | Container ID (full 64-char hash) | +| .Image | Container image ID (64-char hash) | +| .ImageDigest | Container image digest (sha256:+64-char hash) | +| .ImageName | Container image name (string) | +| .IsInfra | Is this an infra container? (string: true/false) | +| .IsService | Is this a service container? (string: true/false) | +| .KubeExitCodePropagation | Kube exit-code propagation (string) | +| .LockNumber | Number of the container's Libpod lock | +| .MountLabel | SELinux label of mount (string) | +| .Mounts | Mounts (array of strings) | +| .Name | Container name (string) | +| .Namespace | Container namespace (string) | +| .NetworkSettings ... | Network settings (struct) | +| .OCIConfigPath | Path to OCI config file (string) | +| .OCIRuntime | OCI runtime name (string) | +| .Path | Path to container command (string) | +| .PidFile | Path to file containing container PID (string) | +| .Pod | Parent pod (string) | +| .ProcessLabel | SELinux label of process (string) | +| .ResolvConfPath | Path to container's resolv.conf file (string) | +| .RestartCount | Number of times container has been restarted (int) | +| .Rootfs | Container rootfs (string) | +| .SizeRootFs | Size of rootfs, in bytes [1] | +| .SizeRw | Size of upper (R/W) container layer, in bytes [1] | +| .State ... | Container state info (struct) | +| .StaticDir | Path to container metadata dir (string) | +| .UseImageHostname | Use /etc/hostname from the image if it exists? (string: true/false) +| +| .UseImageHosts | Use /etc/hosts from the image? (string: true/false) +| + +[1] This format specifier requires the **--size** option + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--size**, **-s** + +In addition to normal output, display the total file size if the type is a container. + + +## EXAMPLE + +Inspect the specified container and print its information in json format. +``` +$ podman container inspect foobar +[ + { + "Id": "99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6", + "Created": "2021-09-16T06:09:08.936623325-04:00", + "Path": "echo", + "Args": [ + "hi" + ], + "State": { + "OciVersion": "1.0.2-dev", + "Status": "exited", + "Running": false, + "Paused": false, + "Restarting": false, + "OOMKilled": false, + "Dead": false, + "Pid": 0, + "ExitCode": 0, + "Error": "", + "StartedAt": "2021-09-16T06:09:09.033564436-04:00", + "FinishedAt": "2021-09-16T06:09:09.036184314-04:00", + "Healthcheck": { + "Status": "", + "FailingStreak": 0, + "Log": null + } + }, + "Image": "14119a10abf4669e8cdbdff324a9f9605d99697215a0d21c360fe8dfa8471bab", + "ImageName": "docker.io/library/alpine:latest", + "Rootfs": "", + "Pod": "", + "ResolvConfPath": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/resolv.conf", + "HostnamePath": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/hostname", + "HostsPath": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/hosts", + "StaticDir": "/home/dwalsh/.local/share/containers/storage/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata", + "OCIConfigPath": "/home/dwalsh/.local/share/containers/storage/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/config.json", + "OCIRuntime": "crun", + "ConmonPidFile": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/conmon.pid", + "PidFile": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/pidfile", + "Name": "foobar", + "RestartCount": 0, + "Driver": "overlay", + "MountLabel": "system_u:object_r:container_file_t:s0:c25,c695", + "ProcessLabel": "system_u:system_r:container_t:s0:c25,c695", + "AppArmorProfile": "", + "EffectiveCaps": [ + "CAP_CHOWN", + "CAP_DAC_OVERRIDE", + "CAP_FOWNER", + "CAP_FSETID", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_SETFCAP", + "CAP_SETGID", + "CAP_SETPCAP", + "CAP_SETUID", + ], + "BoundingCaps": [ + "CAP_CHOWN", + "CAP_DAC_OVERRIDE", + "CAP_FOWNER", + "CAP_FSETID", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_SETFCAP", + "CAP_SETGID", + "CAP_SETPCAP", + "CAP_SETUID", + ], + "ExecIDs": [], + "GraphDriver": { + "Name": "overlay", + "Data": { + "LowerDir": "/home/dwalsh/.local/share/containers/storage/overlay/e2eb06d8af8218cfec8210147357a68b7e13f7c485b991c288c2d01dc228bb68/diff", + "UpperDir": "/home/dwalsh/.local/share/containers/storage/overlay/8f3d70434a3db17410ec4710caf4f251f3e4ed0a96a08124e4b3d4af0a0ea300/diff", + "WorkDir": "/home/dwalsh/.local/share/containers/storage/overlay/8f3d70434a3db17410ec4710caf4f251f3e4ed0a96a08124e4b3d4af0a0ea300/work" + } + }, + "Mounts": [], + "Dependencies": [], + "NetworkSettings": { + "EndpointID": "", + "Gateway": "", + "IPAddress": "", + "IPPrefixLen": 0, + "IPv6Gateway": "", + "GlobalIPv6Address": "", + "GlobalIPv6PrefixLen": 0, + "MacAddress": "", + "Bridge": "", + "SandboxID": "", + "HairpinMode": false, + "LinkLocalIPv6Address": "", + "LinkLocalIPv6PrefixLen": 0, + "Ports": {}, + "SandboxKey": "" + }, + "Namespace": "", + "IsInfra": false, + "Config": { + "Hostname": "99f66530fe9c", + "Domainname": "", + "User": "", + "AttachStdin": false, + "AttachStdout": false, + "AttachStderr": false, + "Tty": false, + "OpenStdin": false, + "StdinOnce": false, + "Env": [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "TERM=xterm", + "container=podman", + "HOME=/root", + "HOSTNAME=99f66530fe9c" + ], + "Cmd": [ + "echo", + "hi" + ], + "Image": "docker.io/library/alpine:latest", + "Volumes": null, + "WorkingDir": "/", + "Entrypoint": "", + "OnBuild": null, + "Labels": null, + "Annotations": { + "io.container.manager": "libpod", + "io.kubernetes.cri-o.Created": "2021-09-16T06:09:08.936623325-04:00", + "org.opencontainers.image.stopSignal": "15" + }, + "StopSignal": 15, + "CreateCommand": [ + "podman", + "run", + "--name", + "foobar", + "alpine", + "echo", + "hi" + ], + "Timezone": "local", + "Umask": "0022", + "Timeout": 0, + "StopTimeout": 10 + }, + "HostConfig": { + "Binds": [], + "CgroupManager": "systemd", + "CgroupMode": "private", + "ContainerIDFile": "", + "LogConfig": { + "Type": "journald", + "Config": null, + "Path": "", + "Tag": "", + "Size": "0B" + }, + "NetworkMode": "slirp4netns", + "PortBindings": {}, + "RestartPolicy": { + "Name": "", + "MaximumRetryCount": 0 + }, + "AutoRemove": false, + "VolumeDriver": "", + "VolumesFrom": null, + "CapAdd": [], + "CapDrop": [], + "Dns": [], + "DnsOptions": [], + "DnsSearch": [], + "ExtraHosts": [], + "GroupAdd": [], + "IpcMode": "shareable", + "Cgroup": "", + "Cgroups": "default", + "Links": null, + "OomScoreAdj": 0, + "PidMode": "private", + "Privileged": false, + "PublishAllPorts": false, + "ReadonlyRootfs": false, + "SecurityOpt": [], + "Tmpfs": {}, + "UTSMode": "private", + "UsernsMode": "", + "ShmSize": 65536000, + "Runtime": "oci", + "ConsoleSize": [ + 0, + 0 + ], + "Isolation": "", + "CpuShares": 0, + "Memory": 0, + "NanoCpus": 0, + "CgroupParent": "user.slice", + "BlkioWeight": 0, + "BlkioWeightDevice": null, + "BlkioDeviceReadBps": null, + "BlkioDeviceWriteBps": null, + "BlkioDeviceReadIOps": null, + "BlkioDeviceWriteIOps": null, + "CpuPeriod": 0, + "CpuQuota": 0, + "CpuRealtimePeriod": 0, + "CpuRealtimeRuntime": 0, + "CpusetCpus": "", + "CpusetMems": "", + "Devices": [], + "DiskQuota": 0, + "KernelMemory": 0, + "MemoryReservation": 0, + "MemorySwap": 0, + "MemorySwappiness": 0, + "OomKillDisable": false, + "PidsLimit": 2048, + "Ulimits": [], + "CpuCount": 0, + "CpuPercent": 0, + "IOMaximumIOps": 0, + "IOMaximumBandwidth": 0, + "CgroupConf": null + } + } +] +``` + +Inspect the specified container for the Image Name it is based on. +``` +$ podman container inspect nervous_fermi --format "{{.ImageName}}" +registry.access.redhat.com/ubi8:latest +``` + +Inspect the specified container for the GraphDriver Name it is running with. +``` +$ podman container inspect foobar --format "{{.GraphDriver.Name}}" +overlay +``` + +Inspect the latest container created for its EffectiveCaps field. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman container inspect --latest --format {{.EffectiveCaps}} +[CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_FSETID CAP_KILL CAP_NET_BIND_SERVICE CAP_SETFCAP CAP_SETGID CAP_SETPCAP CAP_SETUID] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +Sep 2021, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-container-prune.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-container-prune.1.md new file mode 100644 index 000000000..b29a42ef0 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-container-prune.1.md @@ -0,0 +1,83 @@ +--- +title: podman-container-prune +version: v5.5.1 +--- + +% podman-container-prune 1 + +## NAME +podman\-container\-prune - Remove all stopped containers from local storage + +## SYNOPSIS +**podman container prune** [*options*] + +## DESCRIPTION +**podman container prune** removes all stopped containers from local storage. + +## OPTIONS +#### **--filter**=*filters* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------:|------------------------------------------------------------------------------------------------------| +| label | Only remove containers, with (or without, in the case of label!=[...] is used) the specified labels. | +| until | Only remove containers created before given timestamp. | + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes containers with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes containers without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not provide an interactive prompt for container removal.\ +The default is **false**. + +**-h**, **--help** + +Print usage statement.\ +The default is **false**. + +## EXAMPLES +Remove all stopped containers from local storage: +``` +$ podman container prune +WARNING! This will remove all stopped containers. +Are you sure you want to continue? [y/N] y +878392adf2e6c5c9bb1fc19b69d37d2e98c8abf9d539c0bce4b15b46bbcce471 +37664467fbe3618bf9479c34393ac29c02696675addf1750f9e346581636cde7 +ed0c6468b8e1cb641b4621d1fe30cb477e1fefc5c0bceb66feaf2f7cb50e5962 +6ac6c8f0067b7a4682e6b8e18902665b57d1a0e07e885d9abcd382232a543ccd +fff1c5b6c3631746055ec40598ce8ecaa4b82aef122f9e3a85b03b55c0d06c23 +602d343cd47e7cb3dfc808282a9900a3e4555747787ec6723bb68cedab8384d5 +``` + +Remove all stopped containers from local storage without confirmation: +``` +$ podman container prune -f +878392adf2e6c5c9bb1fc19b69d37d2e98c8abf9d539c0bce4b15b46bbcce471 +37664467fbe3618bf9479c34393ac29c02696675addf1750f9e346581636cde7 +ed0c6468b8e1cb641b4621d1fe30cb477e1fefc5c0bceb66feaf2f7cb50e5962 +6ac6c8f0067b7a4682e6b8e18902665b57d1a0e07e885d9abcd382232a543ccd +fff1c5b6c3631746055ec40598ce8ecaa4b82aef122f9e3a85b03b55c0d06c23 +602d343cd47e7cb3dfc808282a9900a3e4555747787ec6723bb68cedab8384d5 +``` + +Remove all stopped containers from local storage created before the last 10 minutes: +``` +$ podman container prune --filter until="10m" +WARNING! This will remove all stopped containers. +Are you sure you want to continue? [y/N] y +3d366295e33d8cc612c4d873199bacadd55088d90d17dcafaa9a2d317ad50b4e +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-ps(1)](podman-ps.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude \ +December 2020, converted filter information from docs.docker.com documentation by Dan Walsh diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-container-restore.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-container-restore.1.md new file mode 100644 index 000000000..47e7ddde4 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-container-restore.1.md @@ -0,0 +1,198 @@ +--- +title: podman-container-restore +version: v5.5.1 +--- + +% podman-container-restore 1 + +## NAME +podman\-container\-restore - Restore one or more containers from a checkpoint + +## SYNOPSIS +**podman container restore** [*options*] *name* [...] + +## DESCRIPTION +**podman container restore** restores a container from a container checkpoint or +checkpoint image. The *container IDs*, *image IDs* or *names* are used as input. + +## OPTIONS +#### **--all**, **-a** + +Restore all checkpointed *containers*.\ +The default is **false**.\ +*IMPORTANT: This OPTION does not need a container name or ID as input argument.* + +#### **--file-locks** + +Restore a *container* with file locks. This option is required to +restore file locks from a checkpoint image. If the checkpoint image +does not contain file locks, this option is ignored. Defaults to not +restoring file locks.\ +The default is **false**. + +#### **--ignore-rootfs** + +If a *container* is restored from a checkpoint tar.gz file it is possible that it also contains all root file-system changes. With **--ignore-rootfs** it is possible to explicitly disable applying these root file-system changes to the restored *container*.\ +The default is **false**.\ +*IMPORTANT: This OPTION is only available in combination with __--import, -i__.* + +#### **--ignore-static-ip** + +If the *container* was started with **--ip** the restored *container* also tries to use that +IP address and restore fails if that IP address is already in use. This can happen, if +a *container* is restored multiple times from an exported checkpoint with **--name, -n**. + +Using **--ignore-static-ip** tells Podman to ignore the IP address if it was configured +with **--ip** during *container* creation. + +The default is **false**. + +#### **--ignore-static-mac** + +If the *container* was started with **--mac-address** the restored *container* also +tries to use that MAC address and restore fails if that MAC address is already +in use. This can happen, if a *container* is restored multiple times from an +exported checkpoint with **--name, -n**. + +Using **--ignore-static-mac** tells Podman to ignore the MAC address if it was +configured with **--mac-address** during *container* creation. + +The default is **false**. + +#### **--ignore-volumes** + +This option must be used in combination with the **--import, -i** option. +When restoring *containers* from a checkpoint tar.gz file with this option, +the content of associated volumes are not restored.\ +The default is **false**. + +#### **--import**, **-i**=*file* + +Import a checkpoint tar.gz file, which was exported by Podman. This can be used +to import a checkpointed *container* from another host.\ +*IMPORTANT: This OPTION does not need a container name or ID as input argument.* + +During the import of a checkpoint file Podman selects the same container runtime +which was used during checkpointing. This is especially important if a specific +(non-default) container runtime was specified during container creation. Podman +also aborts the restore if the container runtime specified during restore does +not much the container runtime used for container creation. + +#### **--import-previous**=*file* + +Import a pre-checkpoint tar.gz file which was exported by Podman. This option +must be used with **-i** or **--import**. It only works on `runc 1.0-rc3` or `higher`. +*IMPORTANT: This OPTION is not supported on the remote client, including Mac and Windows (excluding WSL2) machines.* + +#### **--keep**, **-k** + +Keep all temporary log and statistics files created by `CRIU` during +checkpointing as well as restoring. These files are not deleted if restoring +fails for further debugging. If restoring succeeds these files are +theoretically not needed, but if these files are needed Podman can keep the +files for further analysis. This includes the checkpoint directory with all +files created during checkpointing. The size required by the checkpoint +directory is roughly the same as the amount of memory required by the +processes in the checkpointed *container*.\ +Without the **--keep**, **-k** option, the checkpoint is consumed and cannot be used again.\ +The default is **false**. + +#### **--latest**, **-l** + +Instead of providing the *container ID* or *name*, use the last created *container*. The default is **false**. +*IMPORTANT: This OPTION is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines. This OPTION does not need a container name or ID as input argument.* + +#### **--name**, **-n**=*name* + +If a *container* is restored from a checkpoint tar.gz file it is possible to rename it with **--name, -n**. This way it is possible to restore a *container* from a checkpoint multiple times with different +names. + +If the **--name, -n** option is used, Podman does not attempt to assign the same IP +address to the *container* it was using before checkpointing as each IP address can only +be used once, and the restored *container* has another IP address. This also means +that **--name, -n** cannot be used in combination with **--tcp-established**.\ +*IMPORTANT: This OPTION is only available for a checkpoint image or in combination +with __--import, -i__.* + +#### **--pod**=*name* + +Restore a container into the pod *name*. The destination pod for this restore +has to have the same namespaces shared as the pod this container was checkpointed +from (see **[podman pod create --share](podman-pod-create.1.md#--share)**).\ +*IMPORTANT: This OPTION is only available for a checkpoint image or in combination +with __--import, -i__.* + +This option requires at least CRIU 3.16. + +#### **--print-stats** + +Print out statistics about restoring the container(s). The output is +rendered in a JSON array and contains information about how much time different +restore operations required. Many of the restore statistics are created +by CRIU and just passed through to Podman. The following information is provided +in the JSON array: + +- **podman_restore_duration**: Overall time (in microseconds) needed to restore + all checkpoints. + +- **runtime_restore_duration**: Time (in microseconds) the container runtime + needed to restore the checkpoint. + +- **forking_time**: Time (in microseconds) CRIU needed to create (fork) all + processes in the restored container (measured by CRIU). + +- **restore_time**: Time (in microseconds) CRIU needed to restore all processes + in the container (measured by CRIU). + +- **pages_restored**: Number of memory pages restored (measured by CRIU). + +The default is **false**. + +#### **--publish**, **-p**=*port* + +Replaces the ports that the *container* publishes, as configured during the +initial *container* start, with a new set of port forwarding rules. + +For more details, see **[podman run --publish](podman-run.1.md#--publish)**. + +#### **--tcp-established** + +Restore a *container* with established TCP connections. If the checkpoint image +contains established TCP connections, this option is required during restore. +If the checkpoint image does not contain established TCP connections this +option is ignored. Defaults to not restoring *containers* with established TCP +connections.\ +The default is **false**. + +## EXAMPLE +Restore the container "mywebserver". +``` +# podman container restore mywebserver +``` + +Import a checkpoint file and a pre-checkpoint file. +``` +# podman container restore --import-previous pre-checkpoint.tar.gz --import checkpoint.tar.gz +``` + +Start the container "mywebserver". Make a checkpoint of the container and export it. Restore the container with other port ranges from the exported file. +``` +$ podman run --rm -p 2345:80 -d webserver +# podman container checkpoint -l --export=dump.tar +# podman container restore -p 5432:8080 --import=dump.tar +``` + +Start a container with the name "foobar-1". Create a checkpoint image "foobar-checkpoint". Restore the container from the checkpoint image with a different name. +``` +# podman run --name foobar-1 -d webserver +# podman container checkpoint --create-image foobar-checkpoint foobar-1 +# podman inspect foobar-checkpoint +# podman container restore --name foobar-2 foobar-checkpoint +# podman container restore --name foobar-3 foobar-checkpoint +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container-checkpoint(1)](podman-container-checkpoint.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-pod-create(1)](podman-pod-create.1.md)**, **criu(8)** + +## HISTORY +September 2018, Originally compiled by Adrian Reber diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-container-runlabel.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-container-runlabel.1.md new file mode 100644 index 000000000..0cd8a4ebd --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-container-runlabel.1.md @@ -0,0 +1,128 @@ +--- +title: podman-container-runlabel +version: v5.5.1 +--- + +% podman-container-runlabel 1 + +## NAME +podman-container-runlabel - Execute a command as described by a container-image label + +## SYNOPSIS +**podman container runlabel** [*options*] *label* *image* [*arg...*] + +## DESCRIPTION +**podman container runlabel** reads the specified `label` of the `image` and executes it as command on the host. If the label does not exist, Podman exits with an error. Additional arguments are appended to the command. + +Historically, container images describe the contents (e.g., layers) and how a container runtime (e.g., crun(1) or runc(1)) executes the container. For instance, an image may set the environment and the command in its configuration. However, a container image cannot directly specify how a container engine such as Podman executes it. For instance, an image configuration does not include information about log drivers, namespaces, or which capabilities it needs to run correctly. + +`podman container runlabel` addresses the limitation of container images in a simple yet efficient way. Podman reads the contents of the label and interpret it as a command that is executed on the host. This way an image can describe exactly how it is executed by Podman. For instance, a label with the content `/usr/bin/podman run -d --pid=host --privileged \${IMAGE}` instructs the image to be executed in a detached, privileged container that is using the PID namespace of the host. This lifts the self-description of a container image from "what" to "how". + +Note that the `runlabel` command is intended to be run in trusted environments exclusively. Using the command on untrusted images is not recommended. + +## VARIABLES + +The contents of a label may refer to the following variables which is substituted while processing the label. + +**IMAGE** +The name of the image. When executing `podman container runlabel label fedora` the `IMAGE` variable is replaced with `fedora`. Valid formats are `IMAGE`, `$IMAGE`, `${IMAGE}` and `=IMAGE`. + +**NAME** +As specified by the `--name` option. The format is identical to the one of the IMAGE attribute. + +**PWD** +Will be replaced with the current working directory. + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + +#### **--display** + +Display the label's value of the image having populated its environment variables. The runlabel command is not executed if --display is specified. + +#### **--help**, **-h** +Print usage statement + +#### **--name**, **-n**=*name* + +Use this name for creating content for the container. If not specified, name defaults to the name of the image. + +#### **--quiet**, **-q** + +Suppress output information when pulling images + +#### **--replace** + +If a container exists with the current name, it is stopped, deleted and a new container is created from this image. + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Execute the `run` label of an image called foobar. +``` +$ podman container runlabel run foobar +``` + +Execute the `install` label of an image called foobar with additional arguments. +``` +$ podman container runlabel install foobar apples oranges +``` + +Display the contents of the `run` label of image foobar. +``` +$ podman container runlabel --display run foobar +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/main/man/runc.8.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-auth.json(5)](https://github.com/containers/image/blob/main/docs/containers-auth.json.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +## HISTORY +August 2021, Refinements by Valentin Rothberg (rothberg at redhat dot com) + +September 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-container.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-container.1.md new file mode 100644 index 000000000..f352366fb --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-container.1.md @@ -0,0 +1,58 @@ +--- +title: podman-container +version: v5.5.1 +--- + +% podman-container 1 + +## NAME +podman\-container - Manage containers + +## SYNOPSIS +**podman container** *subcommand* + +## DESCRIPTION +The container command allows management of containers + +## COMMANDS + +| Command | Man Page | Description | +| --------- | --------------------------------------------------- | ---------------------------------------------------------------------------- | +| attach | [podman-attach(1)](podman-attach.1.md) | Attach to a running container. | +| checkpoint | [podman-container-checkpoint(1)](podman-container-checkpoint.1.md) | Checkpoint one or more running containers. | +| cleanup | [podman-container-cleanup(1)](podman-container-cleanup.1.md) | Clean up the container's network and mountpoints. | +| clone | [podman-container-clone(1)](podman-container-clone.1.md) | Create a copy of an existing container. | +| commit | [podman-commit(1)](podman-commit.1.md) | Create new image based on the changed container. | +| cp | [podman-cp(1)](podman-cp.1.md) | Copy files/folders between a container and the local filesystem. | +| create | [podman-create(1)](podman-create.1.md) | Create a new container. | +| diff | [podman-container-diff(1)](podman-container-diff.1.md) | Inspect changes on a container's filesystem | +| exec | [podman-exec(1)](podman-exec.1.md) | Execute a command in a running container. | +| exists | [podman-container-exists(1)](podman-container-exists.1.md) | Check if a container exists in local storage | +| export | [podman-export(1)](podman-export.1.md) | Export a container's filesystem contents as a tar archive. | +| init | [podman-init(1)](podman-init.1.md) | Initialize a container | +| inspect | [podman-container-inspect(1)](podman-container-inspect.1.md)| Display a container's configuration. | +| kill | [podman-kill(1)](podman-kill.1.md) | Kill the main process in one or more containers. | +| list | [podman-ps(1)](podman-ps.1.md) | List the containers on the system.(alias ls) | +| logs | [podman-logs(1)](podman-logs.1.md) | Display the logs of a container. | +| mount | [podman-mount(1)](podman-mount.1.md) | Mount a working container's root filesystem. | +| pause | [podman-pause(1)](podman-pause.1.md) | Pause one or more containers. | +| port | [podman-port(1)](podman-port.1.md) | List port mappings for the container. | +| prune | [podman-container-prune(1)](podman-container-prune.1.md)| Remove all stopped containers from local storage. | +| ps | [podman-ps(1)](podman-ps.1.md) | Print out information about containers. | +| rename | [podman-rename(1)](podman-rename.1.md) | Rename an existing container. | +| restart | [podman-restart(1)](podman-restart.1.md) | Restart one or more containers. | +| restore | [podman-container-restore(1)](podman-container-restore.1.md) | Restore one or more containers from a checkpoint. | +| rm | [podman-rm(1)](podman-rm.1.md) | Remove one or more containers. | +| run | [podman-run(1)](podman-run.1.md) | Run a command in a container. | +| runlabel | [podman-container-runlabel(1)](podman-container-runlabel.1.md) | Execute a command as described by a container-image label. | +| start | [podman-start(1)](podman-start.1.md) | Start one or more containers. | +| stats | [podman-stats(1)](podman-stats.1.md) | Display a live stream of one or more container's resource usage statistics. | +| stop | [podman-stop(1)](podman-stop.1.md) | Stop one or more running containers. | +| top | [podman-top(1)](podman-top.1.md) | Display the running processes of a container. | +| unmount | [podman-unmount(1)](podman-unmount.1.md) | Unmount a working container's root filesystem.(Alias unmount) | +| unpause | [podman-unpause(1)](podman-unpause.1.md) | Unpause one or more containers. | +| update | [podman-update(1)](podman-update.1.md) | Update the cgroup configuration of a given container. | +| wait | [podman-wait(1)](podman-wait.1.md) | Wait on one or more containers to stop and print their exit codes. | + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-exec(1)](podman-exec.1.md)**, **[podman-run(1)](podman-run.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-cp.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-cp.1.md new file mode 100644 index 000000000..34d836082 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-cp.1.md @@ -0,0 +1,140 @@ +--- +title: podman-cp +version: v5.5.1 +--- + +% podman-cp 1 + +## NAME +podman\-cp - Copy files/folders between a container and the local filesystem + +## SYNOPSIS +**podman cp** [*options*] [*container*:]*src_path* [*container*:]*dest_path* + +**podman container cp** [*options*] [*container*:]*src_path* [*container*:]*dest_path* + +## DESCRIPTION +**podman cp** allows copying the contents of **src_path** to the **dest_path**. Files can be copied from a container to the local machine and vice versa or between two containers. +If `-` is specified for either the `SRC_PATH` or `DEST_PATH`, one can also stream a tar archive from `STDIN` or to `STDOUT`. + +The containers can be either running or stopped and the *src_path* or *dest_path* can be a file or directory. + +*IMPORTANT: The **podman cp** command assumes container paths are relative to the container's root directory (`/`), which means supplying the initial forward slash is optional and therefore sees `compassionate_darwin:/tmp/foo/myfile.txt` and `compassionate_darwin\:tmp/foo/myfile.txt` as identical.* + +Local machine paths can be an absolute or relative value. +The command interprets a local machine's relative paths as relative to the current working directory where **podman cp** is run. + +Assuming a path separator of `/`, a first argument of **src_path** and second argument of **dest_path**, the behavior is as follows: + +**src_path** specifies a file: + - **dest_path** does not exist + - the file is saved to a file created at **dest_path** (note that parent directory must exist). + - **dest_path** exists and is a file + - the destination is overwritten with the source file's contents. + - **dest_path** exists and is a directory + - the file is copied into this directory using the base name from **src_path**. + +**src_path** specifies a directory: + - **dest_path** does not exist + - **dest_path** is created as a directory and the contents of the source directory are copied into this directory. + - **dest_path** exists and is a file + - Error condition: cannot copy a directory to a file. + - **dest_path** exists and is a directory + - **src_path** ends with `/` + - the source directory is copied into this directory. + - **src_path** ends with `/.` (i.e., slash followed by dot) + - the content of the source directory is copied into this directory. + +The command requires **src_path** and **dest_path** to exist according to the above rules. + +If **src_path** is local and is a symbolic link, the symbolic target, is copied by default. + +A *colon* ( : ) is used as a delimiter between a container and its path, it can also be used when specifying paths to a **src_path** or **dest_path** on a local machine, for example, `file:name.txt`. + +*IMPORTANT: while using a *colon* ( : ) in a local machine path, one must be explicit with a relative or absolute path, for example: `/path/to/file:name.txt` or `./file:name.txt`* + +Using `-` as the **src_path** streams the contents of `STDIN` as a tar archive. The command extracts the content of the tar to the `DEST_PATH` in the container. In this case, **dest_path** must specify a directory. Using `-` as the **dest_path** streams the contents of the resource (can be a directory) as a tar archive to `STDOUT`. + +Note that `podman cp` ignores permission errors when copying from a running rootless container. The TTY devices inside a rootless container are owned by the host's root user and hence cannot be read inside the container's user namespace. + +Further note that `podman cp` does not support globbing (e.g., `cp dir/*.txt`). To copy multiple files from the host to the container use xargs(1) or find(1) (or similar tools for chaining commands) in conjunction with `podman cp`. To copy multiple files from the container to the host, use `podman mount CONTAINER` and operate on the returned mount point instead (see ALTERNATIVES below). + +## OPTIONS + +#### **--archive**, **-a** + +Archive mode (copy all UID/GID information). +When set to true, files copied to a container have changed ownership to the primary UID/GID of the container. +When set to false, maintain UID/GID from archive sources instead of changing them to the primary UID/GID of the destination container. +The default is **true**. + +#### **--overwrite** + +Allow directories to be overwritten with non-directories and vice versa. By default, `podman cp` errors out when attempting to overwrite, for instance, a regular file with a directory. + +## ALTERNATIVES + +Podman has much stronger capabilities than just `podman cp` to achieve copying files between the host and containers. + +Using standard **[podman-mount(1)](podman-mount.1.md)** and **[podman-unmount(1)](podman-unmount.1.md)** takes advantage of the entire Linux tool chain, rather than just `cp`. + +Copying contents out of a container or into a container can be achieved with a few simple commands. For example: + +To copy the `/etc/foobar` directory out of a container and onto `/tmp` on the host, the following commands can be executed: + + mnt=$(podman mount CONTAINERID) + cp -R ${mnt}/etc/foobar /tmp + podman umount CONTAINERID + +To untar a tar ball into a container, following commands can be executed: + + mnt=$(podman mount CONTAINERID) + tar xf content.tgz -C ${mnt} + podman umount CONTAINERID + +To install a package into a container that +does not have dnf installed, following commands can be executed: + + mnt=$(podman mount CONTAINERID) + dnf install --installroot=${mnt} httpd + chroot ${mnt} rm -rf /var/log/dnf /var/cache/dnf + podman umount CONTAINERID + +By using `podman mount` and `podman unmount`, one can use all of the +standard Linux tools for moving files into and out of containers, not just +the `cp` command. + +## EXAMPLES + +Copy a file from the host to a container: +``` +podman cp /myapp/app.conf containerID:/myapp/app.conf +``` + +Copy a file from a container to a directory on another container: +``` +podman cp containerID1:/myfile.txt containerID2:/tmp +``` + +Copy a directory on a container to a directory on the host: +``` +podman cp containerID:/myapp/ /myapp/ +``` + +Copy the contents of a directory on a container to a directory on the host: +``` +podman cp containerID:/home/myuser/. /home/myuser/ +``` + +Copy a directory on a container into a directory on another: +``` +podman cp containerA:/myapp containerB:/newapp +``` + +Stream a tar archive from `STDIN` to a container: +``` +podman cp - containerID:/myfiles.tar.gz < myfiles.tar.gz +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-mount(1)](podman-mount.1.md)**, **[podman-unmount(1)](podman-unmount.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-create.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-create.1.md new file mode 100644 index 000000000..7d40d7f9f --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-create.1.md @@ -0,0 +1,2905 @@ +--- +title: podman-create +version: v5.5.1 +--- + +% podman-create 1 + +## NAME +podman\-create - Create a new container + +## SYNOPSIS +**podman create** [*options*] *image* [*command* [*arg* ...]] + +**podman container create** [*options*] *image* [*command* [*arg* ...]] + +## DESCRIPTION + +Creates a writable container layer over the specified image and prepares it for +running the specified command. The container ID is then printed to STDOUT. This +is similar to **podman run -d** except the container is never started. Use the +**podman start** *container* command to start the container at any point. + +The initial status of the container created with **podman create** is 'created'. + +Default settings for flags are defined in `containers.conf`. Most settings for +remote connections use the server's containers.conf, except when documented in +man pages. + +## IMAGE + + The image is specified using transport\:path format. If no transport is specified, the `docker` (container registry) +transport is used by default. For remote Podman, including Mac and Windows (excluding WSL2) machines, `docker` is the only allowed transport. + + **dir:**_path_ + An existing local directory _path_ storing the manifest, layer tarballs and signatures as individual files. This +is a non-standardized format, primarily useful for debugging or noninvasive container inspection. + + $ podman save --format docker-dir fedora -o /tmp/fedora + $ podman create dir:/tmp/fedora echo hello + + **docker://**_docker-reference_ (Default) + An image reference stored in a remote container image registry. Example: "quay.io/podman/stable:latest". +The reference can include a path to a specific registry; if it does not, the +registries listed in registries.conf is queried to find a matching image. +By default, credentials from `podman login` (stored at +$XDG_RUNTIME_DIR/containers/auth.json by default) is used to authenticate; +otherwise it falls back to using credentials in $HOME/.docker/config.json. + + $ podman create registry.fedoraproject.org/fedora\:latest echo hello + + **docker-archive:**_path_[**:**_docker-reference_] +An image stored in the `docker save` formatted file. _docker-reference_ is only used when creating such a +file, and it must not contain a digest. + + $ podman save --format docker-archive fedora -o /tmp/fedora + $ podman create docker-archive:/tmp/fedora echo hello + + **docker-daemon:**_docker-reference_ + An image in _docker-reference_ format stored in the docker daemon internal storage. The _docker-reference_ can also be an image ID (docker-daemon\:algo\:digest). + + $ sudo docker pull fedora + $ sudo podman create docker-daemon\:docker.io/library/fedora echo hello + + **oci-archive:**_path_**:**_tag_ + An image in a directory compliant with the "Open Container Image Layout Specification" at the specified _path_ +and specified with a _tag_. + + $ podman save --format oci-archive fedora -o /tmp/fedora + $ podman create oci-archive:/tmp/fedora echo hello + +## OPTIONS + + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the container's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + + +[//]: # (BEGIN included file options/annotation.container.md) +#### **--annotation**=*key=value* + +Add an annotation to the container. This option can be set multiple times. + +[//]: # (END included file options/annotation.container.md) + + +[//]: # (BEGIN included file options/arch.md) +#### **--arch**=*ARCH* +Override the architecture, defaults to hosts, of the image to be pulled. For example, `arm`. +Unless overridden, subsequent lookups of the same image in the local storage matches this architecture, regardless of the host. + +[//]: # (END included file options/arch.md) + + +[//]: # (BEGIN included file options/attach.md) +#### **--attach**, **-a**=*stdin* | *stdout* | *stderr* + +Attach to STDIN, STDOUT or STDERR. + +In foreground mode (the default when **-d** +is not specified), **podman run** can start the process in the container +and attach the console to the process's standard input, output, and +error. It can even pretend to be a TTY (this is what most command-line +executables expect) and pass along signals. The **-a** option can be set for +each of **stdin**, **stdout**, and **stderr**. + +[//]: # (END included file options/attach.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cap-add.md) +#### **--cap-add**=*capability* + +Add Linux capabilities. + +Granting additional capabilities increases the privileges of the +processes running inside the container and potentially allow it to +break out of confinement. Capabilities like `CAP_SYS_ADMIN`, +`CAP_SYS_PTRACE`, `CAP_MKNOD` and `CAP_SYS_MODULE` are particularly +dangerous when they are not used within a user namespace. Please +refer to **user_namespaces(7)** for a more detailed explanation of the +interaction between user namespaces and capabilities. + +Before adding any capability, review its security implications and +ensure it is really necessary for the container’s functionality. See +**capabilities(7)** for more information. + +[//]: # (END included file options/cap-add.md) + + +[//]: # (BEGIN included file options/cap-drop.md) +#### **--cap-drop**=*capability* + +Drop Linux capabilities. + +[//]: # (END included file options/cap-drop.md) + + +[//]: # (BEGIN included file options/cgroup-conf.md) +#### **--cgroup-conf**=*KEY=VALUE* + +When running on cgroup v2, specify the cgroup file to write to and its value. For example **--cgroup-conf=memory.high=1073741824** sets the memory.high limit to 1GB. + +[//]: # (END included file options/cgroup-conf.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the container is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cgroupns.md) +#### **--cgroupns**=*mode* + +Set the cgroup namespace mode for the container. + +- **host**: use the host's cgroup namespace inside the container. +- **container:**_id_: join the namespace of the specified container. +- **private**: create a new cgroup namespace. +- **ns:**_path_: join the namespace at the specified path. + +If the host uses cgroups v1, the default is set to **host**. On cgroups v2, the default is **private**. + +[//]: # (END included file options/cgroupns.md) + + +[//]: # (BEGIN included file options/cgroups.md) +#### **--cgroups**=*how* + +Determines whether the container creates CGroups. + +Default is **enabled**. + +The **enabled** option creates a new cgroup under the cgroup-parent. +The **disabled** option forces the container to not create CGroups, and thus conflicts with CGroup options (**--cgroupns** and **--cgroup-parent**). +The **no-conmon** option disables a new CGroup only for the **conmon** process. +The **split** option splits the current CGroup in two sub-cgroups: one for conmon and one for the container payload. It is not possible to set **--cgroup-parent** with **split**. + +[//]: # (END included file options/cgroups.md) + + +[//]: # (BEGIN included file options/chrootdirs.md) +#### **--chrootdirs**=*path* + +Path to a directory inside the container that is treated as a `chroot` directory. +Any Podman managed file (e.g., /etc/resolv.conf, /etc/hosts, etc/hostname) that is mounted into the root directory is mounted into that location as well. +Multiple directories are separated with a comma. + +[//]: # (END included file options/chrootdirs.md) + + +[//]: # (BEGIN included file options/cidfile.write.md) +#### **--cidfile**=*file* + +Write the container ID to *file*. The file is removed along with the container, except +when used with podman --remote run on detached containers. + +[//]: # (END included file options/cidfile.write.md) + + +[//]: # (BEGIN included file options/conmon-pidfile.md) +#### **--conmon-pidfile**=*file* + +Write the pid of the **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to restart Podman containers. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/conmon-pidfile.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-rt-period.md) +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-period.md) + + +[//]: # (BEGIN included file options/cpu-rt-runtime.md) +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-runtime.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpus.container.md) +#### **--cpus**=*number* + +Number of CPUs. The default is *0.0* which means no limit. This is shorthand +for **--cpu-period** and **--cpu-quota**, therefore the option cannot be specified with +**--cpu-period** or **--cpu-quota**. + +On some systems, changing the CPU limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpus.container.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the container. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The container only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: if the user only has access rights via a group, accessing the device +from inside a rootless container fails. Use the `--group-add keep-groups` +flag to pass the user's supplementary group access into the container. + + +[//]: # (BEGIN included file options/device-cgroup-rule.md) +#### **--device-cgroup-rule**=*"type major\:minor mode"* + +Add a rule to the cgroup allowed devices list. The rule is expected to be +in the format specified in the Linux kernel documentation +[admin-guide/cgroup-v1/devices](https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.html): +- *type*: `a` (all), `c` (char), or `b` (block); +- *major* and *minor*: either a number, or `*` for all; +- *mode*: a composition of `r` (read), `w` (write), and `m` (mknod(2)). + +[//]: # (END included file options/device-cgroup-rule.md) + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-read-iops.md) +#### **--device-read-iops**=*path:rate* + +Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-iops.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + + +[//]: # (BEGIN included file options/device-write-iops.md) +#### **--device-write-iops**=*path:rate* + +Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-iops.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + + +[//]: # (BEGIN included file options/dns.md) +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. + +[//]: # (END included file options/dns.md) + +This option cannot be combined with **--network** that is set to **none** or **container:**_id_. + + +[//]: # (BEGIN included file options/dns-option.container.md) +#### **--dns-option**=*option* + +Set custom DNS options. Invalid if using **--dns-option** with **--network** that is set to **none** or **container:**_id_. + +[//]: # (END included file options/dns-option.container.md) + + +[//]: # (BEGIN included file options/dns-search.container.md) +#### **--dns-search**=*domain* + +Set custom DNS search domains. Invalid if using **--dns-search** with **--network** that is set to **none** or **container:**_id_. +Use **--dns-search=.** to remove the search domain. + +[//]: # (END included file options/dns-search.container.md) + + +[//]: # (BEGIN included file options/entrypoint.md) +#### **--entrypoint**=*"command"* | *'["command", "arg1", ...]'* + +Override the default ENTRYPOINT from the image. + +The ENTRYPOINT of an image is similar to a COMMAND +because it specifies what executable to run when the container starts, but it is +(purposely) more difficult to override. The ENTRYPOINT gives a container its +default nature or behavior. When the ENTRYPOINT is set, the +container runs as if it were that binary, complete with default options. More options can be +passed in via the COMMAND. But, if a user wants to run +something else inside the container, the **--entrypoint** option allows a new +ENTRYPOINT to be specified. + +Specify multi option commands in the form of a JSON string. + +[//]: # (END included file options/entrypoint.md) + + +[//]: # (BEGIN included file options/env.md) +#### **--env**, **-e**=*env* + +Set environment variables. + +This option allows arbitrary environment variables that are available for the process to be launched inside of the container. If an environment variable is specified without a value, Podman checks the host environment for a value and set the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the container. + +[//]: # (END included file options/env.md) + +See [**Environment**](#environment) note below for precedence and examples. + + +[//]: # (BEGIN included file options/env-file.md) +#### **--env-file**=*file* + +Read in a line-delimited file of environment variables. + +[//]: # (END included file options/env-file.md) + +See [**Environment**](#environment) note below for precedence and examples. + + +[//]: # (BEGIN included file options/env-host.md) +#### **--env-host** + +Use host environment inside of the container. See **Environment** note below for precedence. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/env-host.md) + + +[//]: # (BEGIN included file options/env-merge.md) +#### **--env-merge**=*env* + +Preprocess default environment variables for the containers. For example +if image contains environment variable `hello=world` user can preprocess +it using `--env-merge hello=${hello}-some` so new value is `hello=world-some`. + +Please note that if the environment variable `hello` is not present in the image, +then it'll be replaced by an empty string and so using `--env-merge hello=${hello}-some` +would result in the new value of `hello=-some`, notice the leading `-` delimiter. + +[//]: # (END included file options/env-merge.md) + + +[//]: # (BEGIN included file options/expose.md) +#### **--expose**=*port[/protocol]* + +Expose a port or a range of ports (e.g. **--expose=3300-3310**). +The protocol can be `tcp`, `udp` or `sctp` and if not given `tcp` is assumed. +This option matches the EXPOSE instruction for image builds and has no effect on +the actual networking rules unless **-P/--publish-all** is used to forward to all +exposed ports from random host ports. To forward specific ports from the host +into the container use the **-p/--publish** option instead. + +[//]: # (END included file options/expose.md) + + +[//]: # (BEGIN included file options/gidmap.container.md) +#### **--gidmap**=*[flags]container_uid\:from_uid[\:amount]* + +Run the container in a new user namespace using the supplied GID mapping. This +option conflicts with the **--userns** and **--subgidname** options. This +option provides a way to map host GIDs to container GIDs in the same way as +__--uidmap__ maps host UIDs to container UIDs. For details see __--uidmap__. + +Note: the **--gidmap** option cannot be called in conjunction with the **--pod** option as a gidmap cannot be set on the container level when in a pod. + +[//]: # (END included file options/gidmap.container.md) + + +[//]: # (BEGIN included file options/gpus.md) +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. + +[//]: # (END included file options/gpus.md) + + +[//]: # (BEGIN included file options/group-add.md) +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/group-add.md) + + +[//]: # (BEGIN included file options/group-entry.md) +#### **--group-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/group` file within the container when `--user` is used. + +The variables $GROUPNAME, $GID, and $USERLIST are automatically replaced with their value at runtime if present. + +[//]: # (END included file options/group-entry.md) + + +[//]: # (BEGIN included file options/health-cmd.md) +#### **--health-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set or alter a healthcheck command for a container. The command is a command to be executed inside the +container that determines the container health. The command is required for other healthcheck options +to be applied. A value of **none** disables existing healthchecks. + +Multiple options can be passed in the form of a JSON array; otherwise, the command is interpreted +as an argument to **/bin/sh -c**. + +Note: The default values are used even if healthcheck is configured in the image. + +[//]: # (END included file options/health-cmd.md) + + +[//]: # (BEGIN included file options/health-interval.md) +#### **--health-interval**=*interval* + +Set an interval for the healthchecks. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-interval.md) + + +[//]: # (BEGIN included file options/health-log-destination.md) +#### **--health-log-destination**=*directory_path* + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) (Default: local) + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. + +[//]: # (END included file options/health-log-destination.md) + + +[//]: # (BEGIN included file options/health-max-log-count.md) +#### **--health-max-log-count**=*number of stored logs* + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) (Default: 5 attempts) + +[//]: # (END included file options/health-max-log-count.md) + + +[//]: # (BEGIN included file options/health-max-log-size.md) +#### **--health-max-log-size**=*size of stored logs* + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) (Default: 500 characters) + +[//]: # (END included file options/health-max-log-size.md) + + +[//]: # (BEGIN included file options/health-on-failure.md) +#### **--health-on-failure**=*action* + +Action to take once the container transitions to an unhealthy state. The default is **none**. + +- **none**: Take no action. +- **kill**: Kill the container. +- **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. +- **stop**: Stop the container. + +[//]: # (END included file options/health-on-failure.md) + + +[//]: # (BEGIN included file options/health-retries.md) +#### **--health-retries**=*retries* + +The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is **3**. + +Note: This parameter can overwrite the healthcheck configuration from the image. + +[//]: # (END included file options/health-retries.md) + + +[//]: # (BEGIN included file options/health-start-period.md) +#### **--health-start-period**=*period* + +The initialization time needed for a container to bootstrap. The value can be expressed in time format like +**2m3s**. The default value is **0s**. + +Note: The health check command is executed as soon as a container is started, if the health check is successful +the container's health state will be updated to `healthy`. However, if the health check fails, the health state will +stay as `starting` until either the health check is successful or until the `--health-start-period` time is over. If the +health check command fails after the `--health-start-period` time is over, the health state will be updated to `unhealthy`. +The health check command is executed periodically based on the value of `--health-interval`. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-start-period.md) + + +[//]: # (BEGIN included file options/health-startup-cmd.md) +#### **--health-startup-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set a startup healthcheck command for a container. This command is executed inside the container and is used to gate the regular +healthcheck. When the startup command succeeds, the regular healthcheck begins and the startup healthcheck ceases. Optionally, +if the command fails for a set number of attempts, the container is restarted. A startup healthcheck can be used to ensure that +containers with an extended startup period are not marked as unhealthy until they are fully started. Startup healthchecks can only be +used when a regular healthcheck (from the container's image or the **--health-cmd** option) is also set. + +[//]: # (END included file options/health-startup-cmd.md) + + +[//]: # (BEGIN included file options/health-startup-interval.md) +#### **--health-startup-interval**=*interval* + +Set an interval for the startup healthcheck. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-startup-interval.md) + + +[//]: # (BEGIN included file options/health-startup-retries.md) +#### **--health-startup-retries**=*retries* + +The number of attempts allowed before the startup healthcheck restarts the container. If set to **0**, the container is never restarted. The default is **0**. + +[//]: # (END included file options/health-startup-retries.md) + + +[//]: # (BEGIN included file options/health-startup-success.md) +#### **--health-startup-success**=*retries* + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value +of **0** means that any success begins the regular healthcheck. The default is **0**. + +[//]: # (END included file options/health-startup-success.md) + + +[//]: # (BEGIN included file options/health-startup-timeout.md) +#### **--health-startup-timeout**=*timeout* + +The maximum time a startup healthcheck command has to complete before it is marked as failed. The value can be expressed in a time +format like **2m3s**. The default value is **30s**. + +[//]: # (END included file options/health-startup-timeout.md) + + +[//]: # (BEGIN included file options/health-timeout.md) +#### **--health-timeout**=*timeout* + +The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the +value can be expressed in a time format such as **1m22s**. The default value is **30s**. + +Note: A timeout marks the healthcheck as failed but does not terminate the running process. +This ensures that a slow but eventually successful healthcheck does not disrupt the container +but is still accounted for in the health status. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-timeout.md) + +#### **--help** + +Print usage statement + + +[//]: # (BEGIN included file options/hostname.container.md) +#### **--hostname**, **-h**=*name* + +Set the container's hostname inside the container. + +This option can only be used with a private UTS namespace `--uts=private` +(default). If `--pod` is given and the pod shares the same UTS namespace +(default), the pod's hostname is used. The given hostname is also added to the +`/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). + +[//]: # (END included file options/hostname.container.md) + + +[//]: # (BEGIN included file options/hosts-file.md) +#### **--hosts-file**=*path* | *none* | *image* + +Base file to create the `/etc/hosts` file inside the container. This must either +be an absolute path to a file on the host system, or one of the following +special flags: + "" Follow the `base_hosts_file` configuration in _containers.conf_ (the default) + `none` Do not use a base file (i.e. start with an empty file) + `image` Use the container image's `/etc/hosts` file as base file + +[//]: # (END included file options/hosts-file.md) + + +[//]: # (BEGIN included file options/hostuser.md) +#### **--hostuser**=*name* + +Add a user account to /etc/passwd from the host to the container. The Username +or UID must exist on the host system. + +[//]: # (END included file options/hostuser.md) + + +[//]: # (BEGIN included file options/http-proxy.md) +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. + +[//]: # (END included file options/http-proxy.md) + + +[//]: # (BEGIN included file options/image-volume.md) +#### **--image-volume**=**bind** | *tmpfs* | *ignore* + +Tells Podman how to handle the builtin image volumes. Default is **bind**. + +- **bind**: An anonymous named volume is created and mounted into the container. +- **tmpfs**: The volume is mounted onto the container as a tmpfs, which allows the users to create +content that disappears when the container is stopped. +- **ignore**: All volumes are just ignored and no action is taken. + +[//]: # (END included file options/image-volume.md) + + +[//]: # (BEGIN included file options/init.md) +#### **--init** + +Run an init inside the container that forwards signals and reaps processes. +The container-init binary is mounted at `/run/podman-init`. +Mounting over `/run` breaks container execution. + +[//]: # (END included file options/init.md) + +#### **--init-ctr**=*type* + +(Pods only). +When using pods, create an init style container, which is run after the infra container is started +but before regular pod containers are started. Init containers are useful for running +setup operations for the pod's applications. + +Valid values for `init-ctr` type are *always* or *once*. The *always* value +means the container runs with each and every `pod start`, whereas the *once* +value means the container only runs once when the pod is started and then the container is removed. + +Init containers are only run on pod `start`. Restarting a pod does not execute +any init containers. Furthermore, init containers can only be created in a +pod when that pod is not running. + + +[//]: # (BEGIN included file options/init-path.md) +#### **--init-path**=*path* + +Path to the container-init binary. + +[//]: # (END included file options/init-path.md) + + +[//]: # (BEGIN included file options/interactive.md) +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. + +[//]: # (END included file options/interactive.md) + + +[//]: # (BEGIN included file options/ip.md) +#### **--ip**=*ipv4* + +Specify a static IPv4 address for the container, for example **10.88.64.128**. +This option can only be used if the container is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IP address pool (default **10.88.0.0/16**). + +To specify multiple static IP addresses per container, set multiple networks using the **--network** option with a static IP address specified for each using the `ip` mode for that option. + +[//]: # (END included file options/ip.md) + + +[//]: # (BEGIN included file options/ip6.md) +#### **--ip6**=*ipv6* + +Specify a static IPv6 address for the container, for example **fd46\:db93\:aa76\:ac37::10**. +This option can only be used if the container is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IPv6 address pool. + +To specify multiple static IPv6 addresses per container, set multiple networks using the **--network** option with a static IPv6 address specified for each using the `ip6` mode for that option. + +[//]: # (END included file options/ip6.md) + + +[//]: # (BEGIN included file options/ipc.md) +#### **--ipc**=*ipc* + +Set the IPC namespace mode for a container. The default is to create +a private IPC namespace. + +- "": Use Podman's default, defined in containers.conf. +- **container:**_id_: reuses another container's shared memory, semaphores, and message queues +- **host**: use the host's shared memory, semaphores, and message queues inside the container. Note: the host mode gives the container full access to local shared memory and is therefore considered insecure. +- **none**: private IPC namespace, with /dev/shm not mounted. +- **ns:**_path_: path to an IPC namespace to join. +- **private**: private IPC namespace. +- **shareable**: private IPC namespace with a possibility to share it with other containers. + +[//]: # (END included file options/ipc.md) + + +[//]: # (BEGIN included file options/label.md) +#### **--label**, **-l**=*key=value* + +Add metadata to a container. + +[//]: # (END included file options/label.md) + + +[//]: # (BEGIN included file options/label-file.md) +#### **--label-file**=*file* + +Read in a line-delimited file of labels. + +[//]: # (END included file options/label-file.md) + + +[//]: # (BEGIN included file options/link-local-ip.md) +#### **--link-local-ip**=*ip* + +Not implemented. + +[//]: # (END included file options/link-local-ip.md) + + +[//]: # (BEGIN included file options/log-driver.md) +#### **--log-driver**=*driver* + +Logging driver for the container. Currently available options are **k8s-file**, **journald**, **none**, **passthrough** and **passthrough-tty**, with **json-file** aliased to **k8s-file** for scripting compatibility. (Default **journald**). + +The podman info command below displays the default log-driver for the system. +``` +$ podman info --format '{{ .Host.LogDriver }}' +journald +``` +The **passthrough** driver passes down the standard streams (stdin, stdout, stderr) to the +container. It is not allowed with the remote Podman client, including Mac and Windows (excluding WSL2) machines, and on a tty, since it is +vulnerable to attacks via TIOCSTI. + +The **passthrough-tty** driver is the same as **passthrough** except that it also allows it to be used on a TTY if the user really wants it. + +[//]: # (END included file options/log-driver.md) + + +[//]: # (BEGIN included file options/log-opt.md) +#### **--log-opt**=*name=value* + +Logging driver specific options. + +Set custom logging configuration. The following *name*s are supported: + +**path**: specify a path to the log file + (e.g. **--log-opt path=/var/log/container/mycontainer.json**); + +**max-size**: specify a max size of the log file + (e.g. **--log-opt max-size=10mb**); + +**tag**: specify a custom log tag for the container + (e.g. **--log-opt tag="{{.ImageName}}"**. +It supports the same keys as **podman inspect --format**. +This option is currently supported only by the **journald** log driver. + +[//]: # (END included file options/log-opt.md) + + +[//]: # (BEGIN included file options/mac-address.md) +#### **--mac-address**=*address* + +Container network interface MAC address (e.g. 92\:d0\:c6:0a:29:33) +This option can only be used if the container is joined to only a single network - i.e., **--network=_network-name_** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. + +Remember that the MAC address in an Ethernet network must be unique. +The IPv6 link-local address is based on the device's MAC address +according to RFC4862. + +To specify multiple static MAC addresses per container, set multiple networks using the **--network** option with a static MAC address specified for each using the `mac` mode for that option. + +[//]: # (END included file options/mac-address.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-reservation.md) +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-reservation.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/memory-swappiness.md) +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/memory-swappiness.md) + + +[//]: # (BEGIN included file options/mount.md) +#### **--mount**=*type=TYPE,TYPE-SPECIFIC-OPTION[,...]* + +Attach a filesystem mount to the container. + +Current supported mount TYPEs are **artifact**, **bind**, **devpts**, **glob**, **image**, **ramfs**, **tmpfs** and **volume**. + +Options common to all mount types: + +- *src*, *source*: mount source spec for **bind**, **glob**, and **volume**. + Mandatory for **artifact**, **bind**, **glob**, **image** and **volume**. + +- *dst*, *destination*, *target*: mount destination spec. + +When source globs are specified without the destination directory, +the files and directories are mounted with their complete path +within the container. When the destination is specified, the +files and directories matching the glob on the base file name +on the destination directory are mounted. The option +`type=glob,src=/foo*,destination=/tmp/bar` tells container engines +to mount host files matching /foo* to the /tmp/bar/ +directory in the container. + +Options specific to type=**artifact**: + +- *digest*: If the artifact source contains multiple blobs a digest can be + specified to only mount the one specific blob with the digest. + +- *title*: If the artifact source contains multiple blobs a title can be set + which is compared against `org.opencontainers.image.title` annotation. + +The *src* argument contains the name of the artifact, which must already exist locally. +The *dst* argument contains the target path, if the path in the container is a +directory or does not exist the blob title (`org.opencontainers.image.title` +annotation) will be used as filename and joined to the path. If the annotation +does not exist the digest will be used as filename instead. This results in all blobs +of the artifact mounted into the container at the given path. + +However, if the *dst* path is an existing file in the container, then the blob will be +mounted directly on it. This only works when the artifact contains a single blob +or when either *digest* or *title* are specified. + +Options specific to type=**volume**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *idmap*: If specified, create an idmapped mount to the target user namespace in the container. + The idmap option is only supported by Podman in rootful mode. The Linux kernel does not allow the use of idmapped file systems for unprivileged users. + The idmap option supports a custom mapping that can be different than the user namespace used by the container. + The mapping can be specified after the idmap option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the first value is the + start of the backing file system IDs that are mapped to the second value on the host. The length of this mapping is given in the third value. + Multiple ranges are separated with #. If the specified mapping is prepended with a '@', then the mapping is considered relative to the container + user namespace. The host ID for the mapping is changed to account for the relative position of the container user in the container user namespace. + +Options specific to type=**image**: + +- *rw*, *readwrite*: *true* or *false* (default if unspecified: *false*). + +- *subpath*: Mount only a specific path within the image, instead of the whole image. + +Options specific to **bind** and **glob**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *bind-propagation*: *shared*, *slave*, *private*, *unbindable*, *rshared*, *rslave*, *runbindable*, or **rprivate** (default).[[1]](#Footnote1) See also mount(2). + +- *bind-nonrecursive*: do not set up a recursive bind mount. By default it is recursive. + +- *relabel*: *shared*, *private*. + +- *idmap*: *true* or *false* (default if unspecified: *false*). If true, create an idmapped mount to the target user namespace in the container. The idmap option is only supported by Podman in rootful mode. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *no-dereference*: do not dereference symlinks but copy the link source into the mount destination. + +Options specific to type=**tmpfs** and **ramfs**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *tmpfs-size*: Size of the tmpfs/ramfs mount, in bytes. Unlimited by default in Linux. + +- *tmpfs-mode*: Octal file mode of the tmpfs/ramfs (e.g. 700 or 0700.). + +- *tmpcopyup*: Enable copyup from the image directory at the same location to the tmpfs/ramfs. Used by default. + +- *notmpcopyup*: Disable copying files from the image to the tmpfs/ramfs. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +Options specific to type=**devpts**: + +- *uid*: numeric UID of the file owner (default: 0). + +- *gid*: numeric GID of the file owner (default: 0). + +- *mode*: octal permission mask for the file (default: 600). + +- *max*: maximum number of PTYs (default: 1048576). + +Examples: + +- `type=bind,source=/path/on/host,destination=/path/in/container` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared,U=true` + +- `type=devpts,destination=/dev/pts` + +- `type=glob,src=/usr/lib/libfoo*,destination=/usr/lib,ro=true` + +- `type=image,source=fedora,destination=/fedora-image,rw=true` + +- `type=ramfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,destination=/path/in/container,noswap` + +- `type=artifact,src=quay.io/libpod/testartifact:20250206-single,dst=/data` + +- `type=artifact,src=quay.io/libpod/testartifact:20250206-multi,dst=/data,title=test1` + +[//]: # (END included file options/mount.md) + + +[//]: # (BEGIN included file options/name.container.md) +#### **--name**=*name* + +Assign a name to the container. + +The operator can identify a container in three ways: + +- UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”); +- UUID short identifier (“f78375b1c487”); +- Name (“jonah”). + +Podman generates a UUID for each container, and if no name is assigned to the +container using **--name**, Podman generates a random string name. The name can +be useful as a more human-friendly way to identify containers. This works for +both background and foreground containers. The container's name is also added +to the `/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). + +[//]: # (END included file options/name.container.md) + + +[//]: # (BEGIN included file options/network.md) +#### **--network**=*mode*, **--net** + +Set the network mode for the container. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + For better integration with DNS handling, **--dns-forward 169.254.1.1** is passed, + and this address is added to resolv.conf(5) as first resolver. It is possible to pass + **--dns-forward** explicitly in case a different IP address should be used. + To make the `host.containers.internal` /etc/hosts entry work and allow connections + to the host, **--map-guest-addr 169.254.1.2** is passed. Again, it can be set + explicitly to choose a different IP address. \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured (via Podman's + **--publish** or by passing the pasta **-t**/**-u** options directly), + to disable automatic port forwarding based on bound ports. Similarly, **-T none** + and **-U none** are given to disable the same functionality from container to + host. \ + All options can also be set in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**; + see the `pasta_options` key under the network section in that file. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.md) + +Invalid if using **--dns**, **--dns-option**, or **--dns-search** with **--network** set to **none** or **container:**_id_. + +If used together with **--pod**, the container does not join the pod's network namespace. + + +[//]: # (BEGIN included file options/network-alias.md) +#### **--network-alias**=*alias* + +Add a network-scoped alias for the container, setting the alias for all networks that the container joins. To set a +name only for a specific network, use the alias option as described under the **--network** option. +If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. This option can be specified multiple times. +NOTE: When using CNI a container only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. + +[//]: # (END included file options/network-alias.md) + + +[//]: # (BEGIN included file options/no-healthcheck.md) +#### **--no-healthcheck** + +Disable any defined healthchecks for container. + +[//]: # (END included file options/no-healthcheck.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the container. + +Podman assumes control over the container's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/oom-kill-disable.md) +#### **--oom-kill-disable** + +Whether to disable OOM Killer for the container or not. + +This flag is not supported on cgroups V2 systems. + +[//]: # (END included file options/oom-kill-disable.md) + + +[//]: # (BEGIN included file options/oom-score-adj.md) +#### **--oom-score-adj**=*num* + +Tune the host's OOM preferences for containers (accepts values from **-1000** to **1000**). + +When running in rootless mode, the specified value can't be lower than +the oom_score_adj for the current process. In this case, the +oom-score-adj is clamped to the current process value. + +[//]: # (END included file options/oom-score-adj.md) + + +[//]: # (BEGIN included file options/os.pull.md) +#### **--os**=*OS* + +Override the OS, defaults to hosts, of the image to be pulled. For example, `windows`. +Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. + +[//]: # (END included file options/os.pull.md) + + +[//]: # (BEGIN included file options/passwd-entry.md) +#### **--passwd-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/passwd` file within the container when `--passwd` is used. + +The variables $USERNAME, $UID, $GID, $NAME, $HOME are automatically replaced with their value at runtime. + +[//]: # (END included file options/passwd-entry.md) + + +[//]: # (BEGIN included file options/personality.md) +#### **--personality**=*persona* + +Personality sets the execution domain via Linux personality(2). + +[//]: # (END included file options/personality.md) + + +[//]: # (BEGIN included file options/pid.container.md) +#### **--pid**=*mode* + +Set the PID namespace mode for the container. +The default is to create a private PID namespace for the container. + +- **container:**_id_: join another container's PID namespace; +- **host**: use the host's PID namespace for the container. Note the host mode gives the container full access to local PID and is therefore considered insecure; +- **ns:**_path_: join the specified PID namespace; +- **private**: create a new namespace for the container (default). + +[//]: # (END included file options/pid.container.md) + + +[//]: # (BEGIN included file options/pidfile.md) +#### **--pidfile**=*path* + +When the pidfile location is specified, the container process' PID is written to the pidfile. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +If the pidfile option is not specified, the container process' PID is written to /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile. + +After the container is started, the location for the pidfile can be discovered with the following `podman inspect` command: + + $ podman inspect --format '{{ .PidFile }}' $CID + /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile + +[//]: # (END included file options/pidfile.md) + + +[//]: # (BEGIN included file options/pids-limit.md) +#### **--pids-limit**=*limit* + +Tune the container's pids limit. Set to **-1** to have unlimited pids for the container. The default is **2048** on systems that support "pids" cgroup controller. + +[//]: # (END included file options/pids-limit.md) + + +[//]: # (BEGIN included file options/platform.md) +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with --arch and --os) +The `--platform` option can be used to override the current architecture and operating system. +Unless overridden, subsequent lookups of the same image in the local storage matches this platform, regardless of the host. + +[//]: # (END included file options/platform.md) + + +[//]: # (BEGIN included file options/pod.run.md) +#### **--pod**=*name* + +Run container in an existing pod. Podman makes the pod automatically if the pod name is prefixed with **new:**. +To make a pod with more granular options, use the **podman pod create** command before creating a container. +When a container is run with a pod with an infra-container, the infra-container is started first. + +[//]: # (END included file options/pod.run.md) + + +[//]: # (BEGIN included file options/pod-id-file.container.md) +#### **--pod-id-file**=*file* + +Run container in an existing pod and read the pod's ID from the specified *file*. +When a container is run within a pod which has an infra-container, the infra-container starts first. + +[//]: # (END included file options/pod-id-file.container.md) + + +[//]: # (BEGIN included file options/privileged.md) +#### **--privileged** + +Give extended privileges to this container. The default is **false**. + +By default, Podman containers are unprivileged (**=false**) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read-only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. +Due to the disabled security features, the privileged field should almost never +be set as containers can easily break out of confinement. + +Containers running in a user namespace (e.g., rootless containers) cannot have +more privileges than the user that launched them. + +[//]: # (END included file options/privileged.md) + + +[//]: # (BEGIN included file options/publish.md) +#### **--publish**, **-p**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Publish a container's port, or range of ports, to the host. + +Both *hostPort* and *containerPort* can be specified as a range of ports. +When specifying ranges for both, the number of container ports in the +range must match the number of host ports in the range. + +If host IP is set to 0.0.0.0 or not set at all, the port is bound on all IPs on the host. + +By default, Podman publishes TCP ports. To publish a UDP port instead, give +`udp` as protocol. To publish both TCP and UDP ports, set `--publish` twice, +with `tcp`, and `udp` as protocols respectively. Rootful containers can also +publish ports using the `sctp` protocol. + +Host port does not have to be specified (e.g. `podman run -p 127.0.0.1::80`). +If it is not, the container port is randomly assigned a port on the host. + +Use **podman port** to see the actual mapping: `podman port $CONTAINER $CONTAINERPORT`. + +Note that the network drivers `macvlan` and `ipvlan` do not support port forwarding, +therefore this option will have no effect on such networks. + +[//]: # (END included file options/publish.md) + +**Note:** If a container runs within a pod, it is not necessary to publish the port for +the containers in the pod. The port must only be published by the pod itself. Pod network +stacks act like the network stack on the host - when there are a variety of containers in the pod, +and programs in the container, all sharing a single interface and IP address, and +associated ports. If one container binds to a port, no other container can use that port +within the pod while it is in use. Containers in the pod can also communicate over localhost +by having one container bind to localhost in the pod, and another connect to that port. + + +[//]: # (BEGIN included file options/publish-all.md) +#### **--publish-all**, **-P** + +Publish all exposed ports to random ports on the host interfaces. The default is **false**. + +When set to **true**, publish all exposed ports to the host interfaces. +If the operator uses **-P** (or **-p**) then Podman makes the +exposed port accessible on the host and the ports are available to any +client that can reach the host. + +When using this option, Podman binds any exposed port to a random port on the host +within an ephemeral port range defined by */proc/sys/net/ipv4/ip_local_port_range*. +To find the mapping between the host ports and the exposed ports, use **podman port**. + +[//]: # (END included file options/publish-all.md) + + +[//]: # (BEGIN included file options/pull.md) +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Pull the image only when the image is not in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error if no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. + +[//]: # (END included file options/pull.md) + +#### **--quiet**, **-q** + +Suppress output information when pulling images + + +[//]: # (BEGIN included file options/rdt-class.md) +#### **--rdt-class**=*intel-rdt-class-of-service* + +Rdt-class sets the class of service (CLOS or COS) for the container to run in. Based on the Cache Allocation Technology (CAT) feature that is part of Intel's Resource Director Technology (RDT) feature set, all container processes will run within the pre-configured COS, representing a part of the cache. The COS has to be created and configured using a pseudo file system (usually mounted at `/sys/fs/resctrl`) that the resctrl kernel driver provides. Assigning the container to a COS requires root privileges and thus doesn't work in a rootless environment. Currently, the feature is only supported using `runc` as a runtime. See for more details on creating a COS before a container can be assigned to it. + +[//]: # (END included file options/rdt-class.md) + + +[//]: # (BEGIN included file options/read-only.md) +#### **--read-only** + +Mount the container's root filesystem as read-only. + +By default, container root filesystems are writable, allowing processes +to write files anywhere. By specifying the **--read-only** flag, the containers root filesystem are mounted read-only prohibiting any writes. + +[//]: # (END included file options/read-only.md) + + +[//]: # (BEGIN included file options/read-only-tmpfs.md) +#### **--read-only-tmpfs** + +When running --read-only containers, mount a read-write tmpfs on _/dev_, _/dev/shm_, _/run_, _/tmp_, and _/var/tmp_. The default is **true**. + +| --read-only | --read-only-tmpfs | / | /run, /tmp, /var/tmp| +| ----------- | ----------------- | ---- | ----------------------------------- | +| true | true | r/o | r/w | +| true | false | r/o | r/o | +| false | false | r/w | r/w | +| false | true | r/w | r/w | + +When **--read-only=true** and **--read-only-tmpfs=true** additional tmpfs are mounted on +the /tmp, /run, and /var/tmp directories. + +When **--read-only=true** and **--read-only-tmpfs=false** /dev and /dev/shm are marked +Read/Only and no tmpfs are mounted on /tmp, /run and /var/tmp. The directories +are exposed from the underlying image, meaning they are read-only by default. +This makes the container totally read-only. No writable directories exist within +the container. In this mode writable directories need to be added via external +volumes or mounts. + +By default, when **--read-only=false**, the /dev and /dev/shm are read/write, and the /tmp, /run, and /var/tmp are read/write directories from the container image. + +[//]: # (END included file options/read-only-tmpfs.md) + + +[//]: # (BEGIN included file options/replace.md) +#### **--replace** + +If another container with the same name already exists, replace and remove it. The default is **false**. + +[//]: # (END included file options/replace.md) + + +[//]: # (BEGIN included file options/requires.md) +#### **--requires**=*container* + +Specify one or more requirements. +A requirement is a dependency container that is started before this container. +Containers can be specified by name or ID, with multiple containers being separated by commas. + +[//]: # (END included file options/requires.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + +#### **--rm** + +Automatically remove the container and any anonymous unnamed volume associated with +the container when it exits. The default is **false**. + + +[//]: # (BEGIN included file options/rootfs.md) +#### **--rootfs** + +If specified, the first argument refers to an exploded container on the file system. + +This is useful to run a container without requiring any image management, the rootfs +of the container is assumed to be managed externally. + + `Overlay Rootfs Mounts` + + The `\:O` flag tells Podman to mount the directory from the rootfs path as +storage using the `overlay file system`. The container processes +can modify content within the mount point which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +Note: On **SELinux** systems, the rootfs needs the correct label, which is by default +**unconfined_u\:object_r\:container_file_t\:s0**. + + `idmap` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. +The idmap option supports a custom mapping that can be different than the user +namespace used by the container. The mapping can be specified after the idmap +option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the +first value is the start of the backing file system IDs that are mapped to the +second value on the host. The length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/rootfs.md) + + +[//]: # (BEGIN included file options/sdnotify.md) +#### **--sdnotify**=**container** | *conmon* | *healthy* | *ignore* + +Determines how to use the NOTIFY_SOCKET, as passed with systemd and Type=notify. + +Default is **container**, which means allow the OCI runtime to proxy the socket into the +container to receive ready notification. Podman sets the MAINPID to conmon's pid. +The **conmon** option sets MAINPID to conmon's pid, and sends READY when the container +has started. The socket is never passed to the runtime or the container. +The **healthy** option sets MAINPID to conmon's pid, and sends READY when the container +has turned healthy; requires a healthcheck to be set. The socket is never passed to the runtime or the container. +The **ignore** option removes NOTIFY_SOCKET from the environment for itself and child processes, +for the case where some other process above Podman uses NOTIFY_SOCKET and Podman does not use it. + +[//]: # (END included file options/sdnotify.md) + + +[//]: # (BEGIN included file options/seccomp-policy.md) +#### **--seccomp-policy**=*policy* + +Specify the policy to select the seccomp profile. If set to *image*, Podman looks for a "io.containers.seccomp.profile" label in the container-image config and use its value as a seccomp profile. Otherwise, Podman follows the *default* policy by applying the default profile unless specified otherwise via *--security-opt seccomp* as described below. + +Note that this feature is experimental and may change in the future. + +[//]: # (END included file options/seccomp-policy.md) + + +[//]: # (BEGIN included file options/secret.md) +#### **--secret**=*secret[,opt=opt ...]* + +Give the container access to a secret. Can be specified multiple times. + +A secret is a blob of sensitive data which a container needs at runtime but +is not stored in the image or in source control, such as usernames and passwords, +TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 512 kB in size). + +When secrets are specified as type `mount`, the secrets are copied and mounted into the container when a container is created. +When secrets are specified as type `env`, the secret is set as an environment variable within the container. +Secrets are written in the container at the time of container creation, and modifying the secret using `podman secret` commands +after the container is created affects the secret inside the container. + +Secrets and its storage are managed using the `podman secret` command. + +Secret Options + +- `type=mount|env` : How the secret is exposed to the container. + `mount` mounts the secret into the container as a file. + `env` exposes the secret as an environment variable. + Defaults to `mount`. +- `target=target` : Target of secret. + For mounted secrets, this is the path to the secret inside the container. + If a fully qualified path is provided, the secret is mounted at that location. + Otherwise, the secret is mounted to + `/run/secrets/target` for Linux containers or + `/var/run/secrets/target` for FreeBSD containers. + If the target is not set, the secret is mounted to `/run/secrets/secretname` by default. + For env secrets, this is the environment variable key. Defaults to `secretname`. +- `uid=0` : UID of secret. Defaults to 0. Mount secret type only. +- `gid=0` : GID of secret. Defaults to 0. Mount secret type only. +- `mode=0` : Mode of secret. Defaults to 0444. Mount secret type only. + + +Examples + +Mount at `/my/location/mysecret` with UID 1: +``` +--secret mysecret,target=/my/location/mysecret,uid=1 +``` + +Mount at `/run/secrets/customtarget` with mode 0777: +``` +--secret mysecret,target=customtarget,mode=0777 +``` + +Create a secret environment variable called `ENVSEC`: +``` +--secret mysecret,type=env,target=ENVSEC +``` + +[//]: # (END included file options/secret.md) + + +[//]: # (BEGIN included file options/security-opt.md) +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the container +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the container + +- **label=user:**_USER_: Set the label user for the container processes +- **label=role:**_ROLE_: Set the label role for the container processes +- **label=type:**_TYPE_: Set the label process type for the container processes +- **label=level:**_LEVEL_: Set the label level for the container processes +- **label=filetype:**_TYPE_: Set the label file type for the container files +- **label=disable**: Turn off label separation for the container + +Note: Labeling can be disabled for all containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the container. + +- **no-new-privileges**: Disable container processes from gaining additional privileges through the `execve(2)` system call (e.g. via setuid or setgid bits, or via file capabilities). Programs that rely on setuid/setgid bits set on their executable to change user id or group id are no longer able to do so, and any file capabilities added to the executable (e.g. via `setcap`) are not added to the permitted capability set. For more details, see: https://docs.kernel.org/userspace-api/no_new_privs.html. + +- **seccomp=unconfined**: Turn off seccomp confinement for the container. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. + +[//]: # (END included file options/security-opt.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the container. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/shm-size-systemd.md) +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. + +[//]: # (END included file options/shm-size-systemd.md) + + +[//]: # (BEGIN included file options/stop-signal.md) +#### **--stop-signal**=*signal* + +Signal to stop a container. Default is **SIGTERM**. + +[//]: # (END included file options/stop-signal.md) + + +[//]: # (BEGIN included file options/stop-timeout.md) +#### **--stop-timeout**=*seconds* + +Timeout to stop a container. Default is **10**. +Remote connections use local containers.conf for defaults. + +[//]: # (END included file options/stop-timeout.md) + + +[//]: # (BEGIN included file options/subgidname.md) +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. + +[//]: # (END included file options/subgidname.md) + + +[//]: # (BEGIN included file options/subuidname.md) +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. + +[//]: # (END included file options/subuidname.md) + + +[//]: # (BEGIN included file options/sysctl.md) +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters at runtime. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: if using the **--ipc=host** option, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: if using the **--network=host** option, the above sysctls are not allowed. + +[//]: # (END included file options/sysctl.md) + + +[//]: # (BEGIN included file options/systemd.md) +#### **--systemd**=*true* | *false* | *always* + +Run container in systemd mode. The default is **true**. + +- **true** enables systemd mode only when the command executed inside the container is *systemd*, */usr/sbin/init*, +*/sbin/init* or */usr/local/sbin/init*. + +- **false** disables systemd mode. + +- **always** enforces the systemd mode to be enabled. + +Running the container in systemd mode causes the following changes: + +* Podman mounts tmpfs file systems on the following directories + * _/run_ + * _/run/lock_ + * _/tmp_ + * _/sys/fs/cgroup/systemd_ (on a cgroup v1 system) + * _/var/lib/journal_ +* Podman sets the default stop signal to **SIGRTMIN+3**. +* Podman sets **container_uuid** environment variable in the container to the +first 32 characters of the container ID. +* Podman does not mount virtual consoles (_/dev/tty\d+_) when running with **--privileged**. +* On cgroup v2, */sys/fs/cgroup* is mounted writable. + +This allows systemd to run in a confined container without any modifications. + +Note that on **SELinux** systems, systemd attempts to write to the cgroup +file system. Containers writing to the cgroup file system are denied by default. +The **container_manage_cgroup** boolean must be enabled for this to be allowed on an SELinux separated system. +``` +setsebool -P container_manage_cgroup true +``` + +[//]: # (END included file options/systemd.md) + + +[//]: # (BEGIN included file options/timeout.md) +#### **--timeout**=*seconds* + +Maximum time a container is allowed to run before conmon sends it the kill +signal. By default containers run until they exit or are stopped by +`podman stop`. + +[//]: # (END included file options/timeout.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/tmpfs.md) +#### **--tmpfs**=*fs* + +Create a tmpfs mount. + +Mount a temporary filesystem (**tmpfs**) mount into a container, for example: + +``` +$ podman create -d --tmpfs /tmp\:rw,size=787448k,mode=1777 my_image +``` + +This command mounts a **tmpfs** at _/tmp_ within the container. The supported mount +options are the same as the Linux default mount flags. If no options are specified, +the system uses the following options: +**rw,noexec,nosuid,nodev**. + +[//]: # (END included file options/tmpfs.md) + + +[//]: # (BEGIN included file options/tty.md) +#### **--tty**, **-t** + +Allocate a pseudo-TTY. The default is **false**. + +When set to **true**, Podman allocates a pseudo-tty and attach to the standard +input of the container. This can be used, for example, to run a throwaway +interactive shell. + +**NOTE**: The --tty flag prevents redirection of standard output. It combines STDOUT and STDERR, it can insert control characters, and it can hang pipes. This option is only used when run interactively in a terminal. When feeding input to Podman, use -i only, not -it. + +[//]: # (END included file options/tty.md) + + +[//]: # (BEGIN included file options/tz.md) +#### **--tz**=*timezone* + +Set timezone in container. This flag takes area-based timezones, GMT time, as well as `local`, which sets the timezone in the container to match the host machine. See `/usr/share/zoneinfo/` for valid timezones. +Remote connections use local containers.conf for defaults + +[//]: # (END included file options/tz.md) + + +[//]: # (BEGIN included file options/uidmap.container.md) +#### **--uidmap**=*[flags]container_uid\:from_uid[\:amount]* + +Run the container in a new user namespace using the supplied UID mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +The possible values of the optional *flags* are discussed further down on this page. +The *amount* value is optional and assumed to be **1** if not given. + +The *from_uid* value is based upon the user running the command, either rootful or rootless users. + +* rootful user: [*flags*]*container_uid*:*host_uid*[:*amount*] +* rootless user: [*flags*]*container_uid*:*intermediate_uid*[:*amount*] + + `Rootful mappings` + + +When **podman create** is called by a privileged user, the option **--uidmap** +works as a direct mapping between host UIDs and container UIDs. + +host UID -> container UID + +The _amount_ specifies the number of consecutive UIDs that is mapped. +If for example _amount_ is **4** the mapping looks like: + +| host UID | container UID | +| ---------- | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | + + `Rootless mappings` + +When **podman create** is called by an unprivileged user (i.e. running rootless), +the value *from_uid* is interpreted as an "intermediate UID". In the rootless +case, host UIDs are not mapped directly to container UIDs. Instead the mapping +happens over two mapping steps: + +host UID -> intermediate UID -> container UID + +The **--uidmap** option only influences the second mapping step. + +The first mapping step is derived by Podman from the contents of the file +_/etc/subuid_ and the UID of the user calling Podman. + +First mapping step: + +| host UID | intermediate UID | +| -------- | ---------------- | +| UID for Podman user | 0 | +| 1st subordinate UID | 1 | +| 2nd subordinate UID | 2 | +| 3rd subordinate UID | 3 | +| nth subordinate UID | n | + +To be able to use intermediate UIDs greater than zero, the user needs to have +subordinate UIDs configured in _/etc/subuid_. See **subuid**(5). + +The second mapping step is configured with **--uidmap**. + +If for example _amount_ is **5** the second mapping step looks like: + +| intermediate UID | container UID | +| ------------------ | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | +| *from_uid* + 4 | *container_uid* + 4 | + +When running as rootless, Podman uses all the ranges configured in the _/etc/subuid_ file. + +The current user ID is mapped to UID=0 in the rootless user namespace. +Every additional range is added sequentially afterward: + +| host | rootless user namespace | length | +| ------ | ----------------------- | ------ | +| $UID | 0 | 1 | +| 1 | $FIRST_RANGE_ID | $FIRST_RANGE_LENGTH | +| 1+$FIRST_RANGE_LENGTH | $SECOND_RANGE_ID | $SECOND_RANGE_LENGTH| + + `Referencing a host ID from the parent namespace` + +As a rootless user, the given host ID in **--uidmap** or **--gidmap** +is mapped from the *intermediate namespace* generated by Podman. Sometimes +it is desirable to refer directly at the *host namespace*. It is possible +to manually do so, by running `podman unshare cat /proc/self/gid_map`, +finding the desired host id at the second column of the output, and getting +the corresponding intermediate id from the first column. + +Podman can perform all that by preceding the host id in the mapping +with the `@` symbol. For instance, by specifying `--gidmap 100000:@2000:1`, +podman will look up the intermediate id corresponding to host id `2000` and +it will map the found intermediate id to the container id `100000`. The +given host id must have been subordinated (otherwise it would not be mapped +into the intermediate space in the first place). + +If the length is greater than one, for instance with `--gidmap 100000:@2000:2`, +Podman will map host ids `2000` and `2001` to `100000` and `100001`, respectively, +regardless of how the intermediate mapping is defined. + + `Extending previous mappings` + +Some mapping modifications may be cumbersome. For instance, a user +starts with a mapping such as `--gidmap="0:0:65000"`, that needs to be +changed such as the parent id `1000` is mapped to container id `100000` +instead, leaving container id `1` unassigned. The corresponding `--gidmap` +becomes `--gidmap="0:0:1" --gidmap="2:2:65534" --gidmap="100000:1:1"`. + +This notation can be simplified using the `+` flag, that takes care of +breaking previous mappings removing any conflicting assignment with +the given mapping. The flag is given before the container id +as follows: `--gidmap="0:0:65000" --gidmap="+100000:1:1"` + + + Flag | Example | Description +-----------|---------------|------------- + `+` | `+100000:1:1` | Extend the previous mapping + +This notation leads to gaps in the assignment, so it may be convenient to +fill those gaps afterwards: `--gidmap="0:0:65000" --gidmap="+100000:1:1" --gidmap="1:65001:1"` + +One specific use case for this flag is in the context of rootless +users. A rootless user may specify mappings with the `+` flag as +in `--gidmap="+100000:1:1"`. Podman will then "fill the gaps" starting +from zero with all the remaining intermediate ids. This is convenient when +a user wants to map a specific intermediate id to a container id, leaving +the rest of subordinate ids to be mapped by Podman at will. + + `Passing only one of --uidmap or --gidmap` + +Usually, subordinated user and group ids are assigned simultaneously, and +for any user the subordinated user ids match the subordinated group ids. +For convenience, if only one of **--uidmap** or **--gidmap** is given, +podman assumes the mapping refers to both UIDs and GIDs and applies the +given mapping to both. If only one value of the two needs to be changed, +the mappings should include the `u` or the `g` flags to specify that +they only apply to UIDs or GIDs and should not be copied over. + + flag | Example | Description +---------|-----------------|----------------- + `u` | `u20000:2000:1` |The mapping only applies to UIDs + `g` | `g10000:1000:1` |The mapping only applies to GIDs + +For instance given the command + + podman create --gidmap "0:0:1000" --gidmap "g2000:2000:1" + +Since no **--uidmap** is given, the **--gidmap** is copied to **--uidmap**, +giving a command equivalent to + + podman create --gidmap "0:0:1000" --gidmap "2000:2000:1" --uidmap "0:0:1000" + +The `--gidmap "g2000:2000:1"` used the `g` flag and therefore it was +not copied to **--uidmap**. + + `Rootless mapping of additional host GIDs` + +A rootless user may desire to map a specific host group that has already been +subordinated within _/etc/subgid_ without specifying the rest of the mapping. + +This can be done with **--gidmap "+g*container_gid*:@*host_gid*"** + +Where: + +- The host GID is given through the `@` symbol +- The mapping of this GID is not copied over to **--usermap** thanks to the `g` flag. +- The rest of the container IDs will be mapped starting from 0 to n, + with all the remaining subordinated GIDs, thanks to the `+` flag. + +For instance, if a user belongs to the group `2000` and that group is +subordinated to that user (with `usermod --add-subgids 2000-2000 $USER`), +the user can map the group into the container with: **--gidmap=+g100000:@2000**. + +If this mapping is combined with the option, **--group-add=keep-groups**, the +process in the container will belong to group `100000`, and files belonging +to group `2000` in the host will appear as being owned by group `100000` +inside the container. + + podman run --group-add=keep-groups --gidmap="+g100000:@2000" ... + + `No subordinate UIDs` + +Even if a user does not have any subordinate UIDs in _/etc/subuid_, +**--uidmap** can be used to map the normal UID of the user to a +container UID by running `podman create --uidmap $container_uid:0:1 --user $container_uid ...`. + + `Pods` + +The **--uidmap** option cannot be called in conjunction with the **--pod** option as a uidmap cannot be set on the container level when in a pod. + +[//]: # (END included file options/uidmap.container.md) + + +[//]: # (BEGIN included file options/ulimit.md) +#### **--ulimit**=*option* + +Ulimit options. Sets the ulimits values inside of the container. + +--ulimit with a soft and hard limit in the format =[:]. For example: + +$ podman run --ulimit nofile=1024:1024 --rm ubi9 ulimit -n +1024 + +Set -1 for the soft or hard limit to set the limit to the maximum limit of the current +process. In rootful mode this is often unlimited. + + +If nofile and nproc are unset, a default value of 1048576 will be used, unless overridden +in containers.conf(5). However, if the default value exceeds the hard limit for the current +rootless user, the current hard limit will be applied instead. + +Use **host** to copy the current configuration from the host. + +Don't use nproc with the ulimit flag as Linux uses nproc to set the +maximum number of processes available to a user, not to a container. + +Use the --pids-limit option to modify the cgroup control to limit the number +of processes within a container. + +[//]: # (END included file options/ulimit.md) + + +[//]: # (BEGIN included file options/umask.md) +#### **--umask**=*umask* + +Set the umask inside the container. Defaults to `0022`. +Remote connections use the local `containers.conf` for defaults. + +[//]: # (END included file options/umask.md) + + +[//]: # (BEGIN included file options/unsetenv.md) +#### **--unsetenv**=*env* + +Unset default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. + +[//]: # (END included file options/unsetenv.md) + + +[//]: # (BEGIN included file options/unsetenv-all.md) +#### **--unsetenv-all** + +Unset all default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. + +[//]: # (END included file options/unsetenv-all.md) + + +[//]: # (BEGIN included file options/user.md) +#### **--user**, **-u**=*user[\:group]* + +Sets the username or UID used and, optionally, the groupname or GID for the specified command. Both *user* and *group* may be symbolic or numeric. + +Without this argument, the command runs as the user specified in the container image. Unless overridden by a `USER` command in the Containerfile or by a value passed to this option, this user generally defaults to root. + +When a user namespace is not in use, the UID and GID used within the container and on the host match. When user namespaces are in use, however, the UID and GID in the container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container by default corresponds to the UID and GID of the user invoking Podman. + +[//]: # (END included file options/user.md) + + +[//]: # (BEGIN included file options/userns.container.md) +#### **--userns**=*mode* + +Set the user namespace mode for the container. + +If `--userns` is not set, the default value is determined as follows. +- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used. +- If the environment variable **PODMAN_USERNS** is set its value is used. +- If `userns` is specified in `containers.conf` this value is used. +- Otherwise, `--userns=host` is assumed. + +`--userns=""` (i.e., an empty string) is an alias for `--userns=host`. + +This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +------------------------|-----------|--------------------- +auto | $UID | nil (Host User UID is not mapped into container.) +host | $UID | 0 (Default User account mapped to root user in container.) +keep-id | $UID | $UID (Map user account to same UID within container.) +keep-id\:uid=200,gid=210 | $UID | 200:210 (Map user account to specified UID, GID value within container.) +nomap | $UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + +**auto**[\:_OPTIONS,..._]: automatically create a unique user namespace. + +* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. + + Example: `containers:2147483647:2147483648`. + +* `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5). + +Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user IDs. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. + +The option `--userns=keep-id` uses all the subuids and subgids of the user. +The option `--userns=nomap` uses all the subuids and subgids of the user except the user's own ID. +Using `--userns=auto` when starting new containers does not work as long as any containers exist that were started with `--userns=nomap` or `--userns=keep-id` without limiting the user namespace size. + + Valid `auto` options: + + - *gidmapping*=_CONTAINER\_GID\:HOST\_GID\:SIZE_: to force a GID mapping to be present in the user namespace. + - *size*=_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates a size for the user namespace. + - *uidmapping*=_CONTAINER\_UID\:HOST\_UID\:SIZE_: to force a UID mapping to be present in the user namespace. + +The host UID and GID in *gidmapping* and *uidmapping* can optionally be prefixed with the `@` symbol. +In this case, podman will look up the intermediate ID corresponding to host ID and it will map the found intermediate ID to the container id. +For details see **--uidmap**. + +**container:**_id_: join the user namespace of the specified container. + +**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user. + +**keep-id**: creates a user namespace where the current user's UID\:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace. + + Valid `keep-id` options: + + - *uid*=UID: override the UID inside the container that is used to map the current user to. + - *gid*=GID: override the GID inside the container that is used to map the current user to. + - *size*=SIZE: override the size of the configured user namespace. It is useful to not saturate all the available IDs. Not supported when running as root. + +**nomap**: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +**ns:**_namespace_: run the container in the given existing user namespace. + +[//]: # (END included file options/userns.container.md) + + +[//]: # (BEGIN included file options/uts.container.md) +#### **--uts**=*mode* + +Set the UTS namespace mode for the container. The following values are supported: + +- **host**: use the host's UTS namespace inside the container. +- **private**: create a new namespace for the container (default). +- **ns:[path]**: run the container in the given existing UTS namespace. +- **container:[container]**: join the UTS namespace of the specified container. + +[//]: # (END included file options/uts.container.md) + + +[//]: # (BEGIN included file options/variant.container.md) +#### **--variant**=*VARIANT* + +Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. + +[//]: # (END included file options/variant.container.md) + + +[//]: # (BEGIN included file options/volume.md) +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the container is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +container. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a container is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the container, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the container. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system +might prevent the processes running inside the container from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the container context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +containers share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label. Only the current container can use a private +volume. + +Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any one of the containers. Relabeling walks +the file system under the volume and changes the label on each file; if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the container. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually changed with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the container. +For example if a user wanted to volume mount their entire home directory into a +container, they need to disable SELinux separation. + + $ podman create --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The container processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous container executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the container +to work. + +Do not modify the source directory mounted into the container with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the container are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the container +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +container, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +container. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the container. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the container. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless container fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/volume.md) + +Use the **--group-add keep-groups** option to pass the user's supplementary group access into the container. + + +[//]: # (BEGIN included file options/volumes-from.md) +#### **--volumes-from**=*CONTAINER[\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +container. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target container, then the volume hides +that data on the target. + +[//]: # (END included file options/volumes-from.md) + + +[//]: # (BEGIN included file options/workdir.md) +#### **--workdir**, **-w**=*dir* + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (**/**). +The image developer can set a different default with the WORKDIR instruction. The operator +can override the working directory by using the **-w** option. + +[//]: # (END included file options/workdir.md) + +## EXAMPLES + +Create a container using a local image: +``` +$ podman create alpine ls +``` + +Create a container using a local image and annotate it: +``` +$ podman create --annotation HELLO=WORLD alpine ls +``` + +Create a container using a local image, allocating a pseudo-TTY, keeping stdin open and name it myctr: +``` + podman create -t -i --name myctr alpine ls +``` + +Running a container in a new user namespace requires a mapping of +the UIDs and GIDs from the host: +``` +$ podman create --uidmap 0:30000:7000 --gidmap 0:30000:7000 fedora echo hello +``` + +Setting automatic user-namespace separated containers: +``` +# podman create --userns=auto\:size=65536 ubi8-init +``` + +Configure the timezone in a container: +``` +$ podman create --tz=local alpine date +$ podman create --tz=Asia/Shanghai alpine date +$ podman create --tz=US/Eastern alpine date +``` + +Ensure the first container (container1) is running before the second container (container2) is started: +``` +$ podman create --name container1 -t -i fedora bash +$ podman create --name container2 --requires container1 -t -i fedora bash +$ podman start --attach container2 +``` + +Create a container which requires multiple containers: +``` +$ podman create --name container1 -t -i fedora bash +$ podman create --name container2 -t -i fedora bash +$ podman create --name container3 --requires container1,container2 -t -i fedora bash +$ podman start --attach container3 +``` + +Expose shared libraries inside of container as read-only using a glob: +``` +$ podman create --mount type=glob,src=/usr/lib64/libnvidia\*,ro -i -t fedora /bin/bash +``` + +Create a container allowing supplemental groups to have access to the volume: +``` +$ podman create -v /var/lib/design:/var/lib/design --group-add keep-groups ubi8 +``` + +Configure execution domain for containers using the personality option: +``` +$ podman create --name container1 --personality=LINUX32 fedora bash +``` + +Create a container with external rootfs mounted as an overlay: +``` +$ podman create --name container1 --rootfs /path/to/rootfs:O bash +``` + +Create a container connected to two networks (called net1 and net2) with a static ip: +``` +$ podman create --network net1\:ip=10.89.1.5 --network net2:ip=10.89.10.10 alpine ip addr +``` + +### Rootless Containers + +Podman runs as a non-root user on most systems. This feature requires that a new enough version of shadow-utils +be installed. The shadow-utils package must include the newuidmap and newgidmap executables. + +In order for users to run rootless, there must be an entry for their username in /etc/subuid and /etc/subgid which lists the UIDs for their user namespace. + +Rootless Podman works better if the fuse-overlayfs and slirp4netns packages are installed. +The fuse-overlayfs package provides a userspace overlay storage driver, otherwise users need to use +the vfs storage driver, which can be disk space expensive and less performant +than other drivers. + +To enable VPN on the container, slirp4netns or pasta needs to be specified; +without either, containers need to be run with the --network=host flag. + +## ENVIRONMENT + +Environment variables within containers can be set using multiple different options: This section describes the precedence. + +Precedence order (later entries override earlier entries): + +- **--env-host** : Host environment of the process executing Podman is added. +- **--http-proxy**: By default, several environment variables are passed in from the host, such as **http_proxy** and **no_proxy**. See **--http-proxy** for details. +- Container image : Any environment variables specified in the container image. +- **--env-file** : Any environment variables specified via env-files. If multiple files specified, then they override each other in order of entry. +- **--env** : Any environment variables specified overrides previous settings. + +Create containers and set the environment ending with a __*__. +The trailing __*__ glob functionality is only active when no value is specified: + +``` +$ export ENV1=a +$ podman create --name ctr1 --env 'ENV*' alpine env +$ podman start --attach ctr1 | grep ENV +ENV1=a +$ podman create --name ctr2 --env 'ENV*=b' alpine env +$ podman start --attach ctr2 | grep ENV +ENV*=b +``` + +## CONMON + +When Podman starts a container it actually executes the conmon program, which +then executes the OCI Runtime. Conmon is the container monitor. It is a small +program whose job is to watch the primary process of the container, and if the +container dies, save the exit code. It also holds open the tty of the +container, so that it can be attached to later. This is what allows Podman to +run in detached mode (backgrounded), so Podman can exit but conmon continues to +run. Each container has their own instance of conmon. Conmon waits for the +container to exit, gathers and saves the exit code, and then launches a Podman +process to complete the container cleanup, by shutting down the network and +storage. For more information about conmon, see the conmon(8) man +page. + +## FILES + +**/etc/subuid** +**/etc/subgid** + +NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-save(1)](podman-save.1.md)**, **[podman-ps(1)](podman-ps.1.md)**, **[podman-attach(1)](podman-attach.1.md)**, **[podman-pod-create(1)](podman-pod-create.1.md)**, **[podman-port(1)](podman-port.1.md)**, **[podman-start(1)](podman-start.1.md)**, **[podman-kill(1)](podman-kill.1.md)**, **[podman-stop(1)](podman-stop.1.md)**, **[podman-generate-systemd(1)](podman-generate-systemd.1.md)**, **[podman-rm(1)](podman-rm.1.md)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)**, **[setsebool(8)](https://man7.org/linux/man-pages/man8/setsebool.8.html)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, **[pasta(1)](https://passt.top/builds/latest/web/passt.1.html)**, **[fuse-overlayfs(1)](https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md)**, **proc(5)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)**, **personality(2)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +See [podman-rootless(7)](https://github.com/containers/podman/blob/main/rootless.md) +for rootless issues. + +## HISTORY +October 2017, converted from Docker documentation to Podman by Dan Walsh for Podman `` + +November 2014, updated by Sven Dowideit `` + +September 2014, updated by Sven Dowideit `` + +August 2014, updated by Sven Dowideit `` + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a core value of open source. The `master` and `slave` mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately. diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-diff.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-diff.1.md new file mode 100644 index 000000000..ceee4f442 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-diff.1.md @@ -0,0 +1,75 @@ +--- +title: podman-diff +version: v5.5.1 +--- + +% podman-diff 1 + +## NAME +podman\-diff - Inspect changes on a container or image's filesystem + +## SYNOPSIS +**podman diff** [*options*] *container|image* [*container|image*] + +## DESCRIPTION +Displays changes on a container or image's filesystem. The container or image is compared to its parent layer or the second argument when given. + +The output is prefixed with the following symbols: + +| Symbol | Description | +|--------|-------------| +| A | A file or directory was added. | +| D | A file or directory was deleted. | +| C | A file or directory was changed. | + +## OPTIONS + +#### **--format** + +Alter the output into a different format. The only valid format for **podman diff** is `json`. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Show container-modified files versus the container's image: +``` +$ podman diff container1 +A /myscript.sh +``` + +Show container-modified files versus the container's image in JSON format: +``` +$ podman diff --format json myimage +{ + "changed": [ + "/usr", + "/usr/local", + "/usr/local/bin" + ], + "added": [ + "/usr/local/bin/docker-entrypoint.sh" + ] +} +``` + +Show the difference between the specified container and the image: +``` +$ podman diff container1 image1 +A /test +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container-diff(1)](podman-container-diff.1.md)**, **[podman-image-diff(1)](podman-image-diff.1.md)** + +## HISTORY +August 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-events.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-events.1.md new file mode 100644 index 000000000..bff69289d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-events.1.md @@ -0,0 +1,226 @@ +--- +title: podman-events +version: v5.5.1 +--- + +% podman-events 1 + +## NAME +podman\-events - Monitor Podman events + +## SYNOPSIS +**podman events** [*options*] + +**podman system events** [*options*] + +## DESCRIPTION + +Monitor and print events that occur in Podman. Each event includes a timestamp, +a type, a status, name (if applicable), and image (if applicable). The default logging +mechanism is *journald*. This can be changed in containers.conf by changing the `events_logger` +value to `file`. Only `file` and `journald` are accepted. A `none` logger is also +available, but this logging mechanism completely disables events; nothing is reported by +`podman events`. + +By default, streaming mode is used, printing new events as they occur. Previous events can be listed via `--since` and `--until`. + +The *container* event type reports the follow statuses: + * attach + * checkpoint + * cleanup + * commit + * connect + * create + * died + * disconnect + * exec + * exec_died + * exited + * export + * import + * init + * kill + * mount + * pause + * prune + * remove + * rename + * restart + * restore + * start + * stop + * sync + * unmount + * unpause + * update + +The *pod* event type reports the follow statuses: + * create + * kill + * pause + * remove + * start + * stop + * unpause + +The *image* event type reports the following statuses: + * loadFromArchive, + * mount + * pull + * pull-error + * push + * remove + * save + * tag + * unmount + * untag + +The *system* type reports the following statuses: + * refresh + * renumber + +The *volume* type reports the following statuses: + * create + * prune + * remove + +The *secret* type reports the following statuses: + * create + * remove + +#### Verbose Create Events + +Setting `events_container_create_inspect_data=true` in containers.conf(5) instructs Podman to create more verbose container-create events which include a JSON payload with detailed information about the containers. The JSON payload is identical to the one of podman-container-inspect(1). The associated field in journald is named `PODMAN_CONTAINER_INSPECT_DATA`. + +## OPTIONS + +#### **--filter**, **-f**=*filter* + +Filter events that are displayed. They must be in the format of "filter=value". The following +filters are supported: + +| **Filter** | **Description** | +|------------|-------------------------------------| +| container | [Name or ID] Container's name or ID | +| event | event_status (described above) | +| image | [Name or ID] Image name or ID | +| label | [key=value] label | +| pod | [Name or ID] Pod name or ID | +| volume | [Name or ID] Volume name or ID | +| type | Event_type (described above) | + +In the case where an ID is used, the ID may be in its full or shortened form. The "die" event is mapped to "died" for Docker compatibility. + +#### **--format** + +Format the output to JSON Lines or using the given Go template. + +| **Placeholder** | **Description** | +| --------------------- | -------------------------------------------------------------------- | +| .Attributes ... | created_at, _by, labels, and more (map[]) | +| .ContainerExitCode | Exit code (int) | +| .ContainerInspectData | Payload of the container's inspect | +| .Error | Error message in case the event status is an error (e.g. pull-error) | +| .HealthStatus | Health Status (string) | +| .ID | Container ID (full 64-bit SHA) | +| .Image | Name of image being run (string) | +| .Name | Container name (string) | +| .Network | Name of network being used (string) | +| .PodID | ID of pod associated with container, if any | +| .Status | Event status (e.g., create, start, died, ...) | +| .Time | Event timestamp (string) | +| .TimeNano | Event timestamp with nanosecond precision (int64) | +| .Type | Event type (e.g., image, container, pod, ...) | + +#### **--help** + +Print usage statement. + +#### **--no-trunc** + +Do not truncate the output (default *true*). + +#### **--since**=*timestamp* + +Show all events created since the given timestamp + +#### **--stream** + +Stream events and do not exit after reading the last known event (default *true*). + +#### **--until**=*timestamp* + +Show all events created until the given timestamp + +The *since* and *until* values can be RFC3339Nano time stamps or a Go duration string such as 10m, 5h. If no +*since* or *until* values are provided, only new events are shown. + +## JOURNALD IDENTIFIERS + +The journald events-backend of Podman uses the following journald identifiers. You can use the identifiers to filter Podman events directly with `journalctl`. + +| **Identifier** | **Description** | +|-------------------------------|---------------------------------------------------------| +| SYSLOG_IDENTIFIER | Always set to "podman" | +| PODMAN_EVENT | The event status as described above | +| PODMAN_TYPE | The event type as described above | +| PODMAN_TIME | The time stamp when the event was written | +| PODMAN_NAME | Name of the event object (e.g., container, image) | +| PODMAN_ID | ID of the event object (e.g., container, image) | +| PODMAN_EXIT_CODE | Exit code of the container | +| PODMAN_POD_ID | Pod ID of the container | +| PODMAN_LABELS | Labels of the container | +| PODMAN_HEALTH_STATUS | Health status of the container | +| PODMAN_CONTAINER_INSPECT_DATA | The JSON payload of `podman-inspect` as described above | +| PODMAN_NETWORK_NAME | The name of the network | + +## EXAMPLES + +Show Podman events: +``` +$ podman events +2019-03-02 10:33:42.312377447 -0600 CST container create 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +2019-03-02 10:33:46.958768077 -0600 CST container init 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +2019-03-02 10:33:46.973661968 -0600 CST container start 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +2019-03-02 10:33:50.833761479 -0600 CST container stop 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +2019-03-02 10:33:51.047104966 -0600 CST container cleanup 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +``` + +Show only Podman container create events: +``` +$ podman events -f event=create +2019-03-02 10:36:01.375685062 -0600 CST container create 20dc581f6fbf (image=docker.io/library/alpine:latest, name=sharp_morse) +2019-03-02 10:36:08.561188337 -0600 CST container create 58e7e002344c (image=registry.k8s.io/pause:3.1, name=3e701f270d54-infra) +2019-03-02 10:36:13.146899437 -0600 CST volume create cad6dc50e087 (image=, name=cad6dc50e0879568e7d656bd004bd343d6035e7fc4024e1711506fe2fd459e6f) +2019-03-02 10:36:29.978806894 -0600 CST container create d81e30f1310f (image=docker.io/library/busybox:latest, name=musing_newton) +``` + +Show only Podman pod create events: +``` +$ podman events --filter event=create --filter type=pod +2019-03-02 10:44:29.601746633 -0600 CST pod create 1df5ebca7b44 (image=, name=confident_hawking) +2019-03-02 10:44:42.374637304 -0600 CST pod create ca731231718e (image=, name=webapp) +2019-03-02 10:44:47.486759133 -0600 CST pod create 71e807fc3a8e (image=, name=reverent_swanson) +``` + +Show only Podman events created in the last five minutes: +``` +$ sudo podman events --since 5m +2019-03-02 10:44:29.598835409 -0600 CST container create b629d10d3831 (image=registry.k8s.io/pause:3.1, name=1df5ebca7b44-infra) +2019-03-02 10:44:29.601746633 -0600 CST pod create 1df5ebca7b44 (image=, name=confident_hawking) +2019-03-02 10:44:42.371100253 -0600 CST container create 170a0f457d00 (image=registry.k8s.io/pause:3.1, name=ca731231718e-infra) +2019-03-02 10:44:42.374637304 -0600 CST pod create ca731231718e (image=, name=webapp) +``` + +Show Podman events in JSON Lines format: +``` +$ podman events --format json +{"ID":"683b0909d556a9c02fa8cd2b61c3531a965db42158627622d1a67b391964d519","Image":"localhost/myshdemo:latest","Name":"agitated_diffie","Status":"cleanup","Time":"2019-04-27T22:47:00.849932843-04:00","Type":"container"} +{"ID":"a0f8ab051bfd43f9c5141a8a2502139707e4b38d98ac0872e57c5315381e88ad","Image":"docker.io/library/alpine:latest","Name":"friendly_tereshkova","Status":"unmount","Time":"2019-04-28T13:43:38.063017276-04:00","Type":"container"} +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +## HISTORY +March 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-exec.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-exec.1.md new file mode 100644 index 000000000..0dd28f590 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-exec.1.md @@ -0,0 +1,212 @@ +--- +title: podman-exec +version: v5.5.1 +--- + +% podman-exec 1 + +## NAME +podman\-exec - Execute a command in a running container + +## SYNOPSIS +**podman exec** [*options*] *container* *command* [*arg* ...] + +**podman container exec** [*options*] *container* *command* [*arg* ...] + +## DESCRIPTION +**podman exec** executes a command in a running container. + +## OPTIONS + +#### **--cidfile**=*file* + +Read the ID of the target container from the specified *file*. + +#### **--detach**, **-d** + +Start the exec session, but do not attach to it. The command runs in the background, and the exec session is automatically removed when it completes. The **podman exec** command prints the ID of the exec session and exits immediately after it starts. + + +[//]: # (BEGIN included file options/detach-keys.md) +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. + +[//]: # (END included file options/detach-keys.md) + + +[//]: # (BEGIN included file options/env.md) +#### **--env**, **-e**=*env* + +Set environment variables. + +This option allows arbitrary environment variables that are available for the process to be launched inside of the container. If an environment variable is specified without a value, Podman checks the host environment for a value and set the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the container. + +[//]: # (END included file options/env.md) + + +[//]: # (BEGIN included file options/env-file.md) +#### **--env-file**=*file* + +Read in a line-delimited file of environment variables. + +[//]: # (END included file options/env-file.md) + + +[//]: # (BEGIN included file options/interactive.md) +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. + +[//]: # (END included file options/interactive.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/preserve-fd.md) +#### **--preserve-fd**=*FD1[,FD2,...]* + +Pass down to the process the additional file descriptors specified in the comma separated list. It can be specified multiple times. +This option is only supported with the crun OCI runtime. It might be a security risk to use this option with other OCI runtimes. + +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/preserve-fd.md) + + +[//]: # (BEGIN included file options/preserve-fds.md) +#### **--preserve-fds**=*N* + +Pass down to the process N additional file descriptors (in addition to 0, 1, 2). +The total FDs are 3+N. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/preserve-fds.md) + + +[//]: # (BEGIN included file options/privileged.md) +#### **--privileged** + +Give extended privileges to this container. The default is **false**. + +By default, Podman containers are unprivileged (**=false**) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read-only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. +Due to the disabled security features, the privileged field should almost never +be set as containers can easily break out of confinement. + +Containers running in a user namespace (e.g., rootless containers) cannot have +more privileges than the user that launched them. + +[//]: # (END included file options/privileged.md) + + +[//]: # (BEGIN included file options/tty.md) +#### **--tty**, **-t** + +Allocate a pseudo-TTY. The default is **false**. + +When set to **true**, Podman allocates a pseudo-tty and attach to the standard +input of the container. This can be used, for example, to run a throwaway +interactive shell. + +**NOTE**: The --tty flag prevents redirection of standard output. It combines STDOUT and STDERR, it can insert control characters, and it can hang pipes. This option is only used when run interactively in a terminal. When feeding input to Podman, use -i only, not -it. + +[//]: # (END included file options/tty.md) + + +[//]: # (BEGIN included file options/user.md) +#### **--user**, **-u**=*user[:group]* + +Sets the username or UID used and, optionally, the groupname or GID for the specified command. Both *user* and *group* may be symbolic or numeric. + +Without this argument, the command runs as the user specified in the container image. Unless overridden by a `USER` command in the Containerfile or by a value passed to this option, this user generally defaults to root. + +When a user namespace is not in use, the UID and GID used within the container and on the host match. When user namespaces are in use, however, the UID and GID in the container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container by default corresponds to the UID and GID of the user invoking Podman. + +[//]: # (END included file options/user.md) + + +[//]: # (BEGIN included file options/workdir.md) +#### **--workdir**, **-w**=*dir* + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (**/**). +The image developer can set a different default with the WORKDIR instruction. The operator +can override the working directory by using the **-w** option. + +[//]: # (END included file options/workdir.md) + +## Exit Status + +The exit code from `podman exec` gives information about why the command within the container failed to run or why it exited. When `podman exec` exits with a +non-zero code, the exit codes follow the `chroot` standard, see below: + + **125** The error is with Podman itself + + $ podman exec --foo ctrID /bin/sh; echo $? + Error: unknown flag: --foo + 125 + + **126** The _contained command_ cannot be invoked + + $ podman exec ctrID /etc; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error + 126 + + **127** The _contained command_ cannot be found + + $ podman exec ctrID foo; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error + 127 + + **Exit code** The _contained command_ exit code + + $ podman exec ctrID /bin/sh -c 'exit 3'; echo $? + 3 + +## EXAMPLES + +Execute command in selected container with a stdin and a tty allocated: +``` +$ podman exec -it ctrID ls +``` + +Execute command with the overridden working directory in selected container with a stdin and a tty allocated: +``` +$ podman exec -it -w /tmp myCtr pwd +``` + +Execute command as the specified user in selected container: +``` +$ podman exec --user root ctrID ls +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)** + +## HISTORY +December 2017, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-export.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-export.1.md new file mode 100644 index 000000000..4356b10f4 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-export.1.md @@ -0,0 +1,56 @@ +--- +title: podman-export +version: v5.5.1 +--- + +% podman-export 1 + +## NAME +podman\-export - Export a container's filesystem contents as a tar archive + +## SYNOPSIS +**podman export** [*options*] *container* + +**podman container export** [*options*] *container* + +## DESCRIPTION +**podman export** exports the filesystem of a container and saves it as a tarball +on the local machine. **podman export** writes to STDOUT by default and can be +redirected to a file using the `--output` flag. +The image of the container exported by **podman export** can be imported by **podman import**. +To export image(s) with parent layers, use **podman save**. +Note: `:` is a restricted character and cannot be part of the file name. + +**podman [GLOBAL OPTIONS]** + +**podman export [GLOBAL OPTIONS]** + +**podman export [OPTIONS] CONTAINER** + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--output**, **-o** + +Write to a file, default is STDOUT + +## EXAMPLES + +Export container into specified tar ball: +``` +$ podman export -o redis-container.tar 883504668ec465463bc0fe7e63d53154ac3b696ea8d7b233748918664ea90e57 +``` + +Export container to stdout: +``` +$ podman export 883504668ec465463bc0fe7e63d53154ac3b696ea8d7b233748918664ea90e57 > redis-container.tar +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-import(1)](podman-import.1.md)** + +## HISTORY +August 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-farm-build.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-farm-build.1.md new file mode 100644 index 000000000..a30b2caad --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-farm-build.1.md @@ -0,0 +1,1572 @@ +--- +title: podman-farm-build +version: v5.5.1 +--- + +% podman-farm-build 1 + +## NAME +podman\-farm\-build - Build images on farm nodes, then bundle them into a manifest list + +## SYNOPSIS +**podman farm build** [*options*] [*context*] + +## DESCRIPTION +**podman farm build** Builds an image on all nodes in a farm and bundles them up into a manifest list. +It executes the `podman build` command on the nodes in the farm with the given Containerfile. Once the +images are built on all the farm nodes, the images will be pushed to the registry given via the **--tag** +flag. Once all the images have been pushed, a manifest list will be created locally and pushed to the registry +as well. + +The manifest list will contain an image per native architecture type that is present in the farm. + +The primary function of this command is to create multi-architecture builds that will be faster than doing it +via emulation using `podman build --arch --platform`. + +If no farm is specified, the build will be sent out to all the nodes that `podman system connection` knows of. + +Note: Since the images built are directly pushed to a registry, the user must pass in a full image name using the +**--tag** option in the format _registry_**/**_repository_**/**_imageName_[**:**_tag_]`. + +## OPTIONS + + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the container's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + + +[//]: # (BEGIN included file options/annotation.image.md) +#### **--annotation**=*annotation=value* + +Add an image *annotation* (e.g. annotation=*value*) to the image metadata. Can +be used multiple times. + +Note: this information is not present in Docker image formats, so it is +discarded when writing images in Docker formats. + +[//]: # (END included file options/annotation.image.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/build-arg.md) +#### **--build-arg**=*arg=value* + +Specifies a build argument and its value, which is interpolated in +instructions read from the Containerfiles in the same way that environment variables are, but which are not added to environment variable list in the resulting image's configuration. + +[//]: # (END included file options/build-arg.md) + + +[//]: # (BEGIN included file options/build-arg-file.md) +#### **--build-arg-file**=*path* + +Specifies a file containing lines of build arguments of the form `arg=value`. +The suggested file name is `argfile.conf`. + +Comment lines beginning with `#` are ignored, along with blank lines. +All others must be of the `arg=value` format passed to `--build-arg`. + +If several arguments are provided via the `--build-arg-file` +and `--build-arg` options, the build arguments are merged across all +of the provided files and command line arguments. + +Any file provided in a `--build-arg-file` option is read before +the arguments supplied via the `--build-arg` option. + +When a given argument name is specified several times, the last instance +is the one that is passed to the resulting builds. This means `--build-arg` +values always override those in a `--build-arg-file`. + +[//]: # (END included file options/build-arg-file.md) + + +[//]: # (BEGIN included file options/build-context.md) +#### **--build-context**=*name=value* + +Specify an additional build context using its short name and its location. +Additional build contexts can be referenced in the same manner as we access +different stages in COPY instruction. + +Valid values are: + +* Local directory – e.g. --build-context project2=../path/to/project2/src (This option is not available with the remote Podman client. On Podman machine setup (i.e macOS and Windows) path must exists on the machine VM) +* HTTP URL to a tarball – e.g. --build-context src=https://example.org/releases/src.tar +* Container image – specified with a container-image:// prefix, e.g. --build-context alpine=container-image://alpine:3.15, (also accepts docker://, docker-image://) + +On the Containerfile side, reference the build context on all +commands that accept the “from” parameter. Here’s how that might look: + +```dockerfile +FROM [name] +COPY --from=[name] ... +RUN --mount=from=[name] … +``` + +The value of [name] is matched with the following priority order: + +* Named build context defined with --build-context [name]=.. +* Stage defined with AS [name] inside Containerfile +* Image [name], either local or in a remote registry + +[//]: # (END included file options/build-context.md) + + +[//]: # (BEGIN included file options/cache-from.md) +#### **--cache-from**=*image* + +Repository to utilize as a potential cache source. When specified, Buildah tries to look for +cache images in the specified repository and attempts to pull cache images instead of actually +executing the build steps locally. Buildah only attempts to pull previously cached images if they +are considered as valid cache hits. + +Use the `--cache-to` option to populate a remote repository with cache content. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-from` option is ignored unless `--layers` is specified. + +[//]: # (END included file options/cache-from.md) + + +[//]: # (BEGIN included file options/cache-to.md) +#### **--cache-to**=*image* + +Set this flag to specify a remote repository that is used to store cache images. Buildah attempts to +push newly built cache image to the remote repository. + +Note: Use the `--cache-from` option in order to use cache content in a remote repository. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-to` option is ignored unless `--layers` is specified. + +[//]: # (END included file options/cache-to.md) + + +[//]: # (BEGIN included file options/cache-ttl.md) +#### **--cache-ttl** + +Limit the use of cached images to only consider images with created timestamps less than *duration* ago. +For example if `--cache-ttl=1h` is specified, Buildah considers intermediate cache images which are created +under the duration of one hour, and intermediate cache images outside this duration is ignored. + +Note: Setting `--cache-ttl=0` manually is equivalent to using `--no-cache` in the +implementation since this means that the user does not want to use cache at all. + +[//]: # (END included file options/cache-ttl.md) + + +[//]: # (BEGIN included file options/cap-add.image.md) +#### **--cap-add**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability added to its capability set. +Certain capabilities are granted by default; this option can be used to add +more. + +[//]: # (END included file options/cap-add.image.md) + + +[//]: # (BEGIN included file options/cap-drop.image.md) +#### **--cap-drop**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability removed from its capability set. +The CAP\_CHOWN, CAP\_DAC\_OVERRIDE, CAP\_FOWNER, +CAP\_FSETID, CAP\_KILL, CAP\_NET\_BIND\_SERVICE, CAP\_SETFCAP, +CAP\_SETGID, CAP\_SETPCAP, and CAP\_SETUID capabilities are +granted by default; this option can be used to remove them. + +If a capability is specified to both the **--cap-add** and **--cap-drop** +options, it is dropped, regardless of the order in which the options were +given. + +[//]: # (END included file options/cap-drop.image.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the container is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cgroupns.image.md) +#### **--cgroupns**=*how* + +Sets the configuration for cgroup namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "private" to indicate +that a new cgroup namespace is created, or it can be "host" to indicate +that the cgroup namespace in which `buildah` itself is being run is reused. + +[//]: # (END included file options/cgroupns.image.md) + +#### **--cleanup** + +Remove built images from farm nodes on success (Default: false). + + +[//]: # (BEGIN included file options/compat-volumes.md) +#### **--compat-volumes** + +Handle directories marked using the VOLUME instruction (both in this build, and +those inherited from base images) such that their contents can only be modified +by ADD and COPY instructions. Any changes made in those locations by RUN +instructions will be reverted. Before the introduction of this option, this +behavior was the default, but it is now disabled by default. + +[//]: # (END included file options/compat-volumes.md) + + +[//]: # (BEGIN included file options/cpp-flag.md) +#### **--cpp-flag**=*flags* + +Set additional flags to pass to the C Preprocessor cpp(1). Containerfiles ending with a ".in" suffix is preprocessed via cpp(1). This option can be used to pass additional flags to cpp.Note: You can also set default CPPFLAGS by setting the BUILDAH_CPPFLAGS environment variable (e.g., export BUILDAH_CPPFLAGS="-DDEBUG"). + +[//]: # (END included file options/cpp-flag.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the container. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The container only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: if the user only has access rights via a group, accessing the device +from inside a rootless container fails. The **[crun(1)](https://github.com/containers/crun/tree/main/crun.1.md)** runtime offers a +workaround for this by adding the option +**--annotation run.oci.keep_original_groups=1**. + + +[//]: # (BEGIN included file options/disable-compression.md) +#### **--disable-compression**, **-D** + +Don't compress filesystem layers when building the image unless it is required +by the location where the image is being written. This is the default setting, +because image layers are compressed automatically when they are pushed to +registries, and images being written to local storage only need to be +decompressed again to be stored. Compression can be forced in all cases by +specifying **--disable-compression=false**. + +[//]: # (END included file options/disable-compression.md) + + +[//]: # (BEGIN included file options/dns.md) +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. + +[//]: # (END included file options/dns.md) + +This option cannot be combined with **--network** that is set to **none**. + +Note: this option takes effect only during *RUN* instructions in the build. +It does not affect _/etc/resolv.conf_ in the final image. + + +[//]: # (BEGIN included file options/dns-option.image.md) +#### **--dns-option**=*option* + +Set custom DNS options to be used during the build. + +[//]: # (END included file options/dns-option.image.md) + + +[//]: # (BEGIN included file options/dns-search.image.md) +#### **--dns-search**=*domain* + +Set custom DNS search domains to be used during the build. + +[//]: # (END included file options/dns-search.image.md) + + +[//]: # (BEGIN included file options/env.image.md) +#### **--env**=*env[=value]* + +Add a value (e.g. env=*value*) to the built image. Can be used multiple times. +If neither `=` nor a *value* are specified, but *env* is set in the current +environment, the value from the current environment is added to the image. +To remove an environment variable from the built image, use the `--unsetenv` +option. + +[//]: # (END included file options/env.image.md) + + +[//]: # (BEGIN included file options/farm.md) +#### **--farm** + +This option specifies the name of the farm to be used in the build process. + +[//]: # (END included file options/farm.md) + +This option specifies the name of the farm to be used in the build process. + + +[//]: # (BEGIN included file options/file.md) +#### **--file**, **-f**=*Containerfile* + +Specifies a Containerfile which contains instructions for building the image, +either a local file or an **http** or **https** URL. If more than one +Containerfile is specified, *FROM* instructions are only be accepted from the +last specified file. + +If a build context is not specified, and at least one Containerfile is a +local file, the directory in which it resides is used as the build +context. + +Specifying the option `-f -` causes the Containerfile contents to be read from stdin. + +[//]: # (END included file options/file.md) + + +[//]: # (BEGIN included file options/force-rm.md) +#### **--force-rm** + +Always remove intermediate containers after a build, even if the build fails (default true). + +[//]: # (END included file options/force-rm.md) + + +[//]: # (BEGIN included file options/format.md) +#### **--format** + +Control the format for the built image's manifest and configuration data. +Recognized formats include *oci* (OCI image-spec v1.0, the default) and +*docker* (version 2, using schema format 2 for the manifest). + +Note: You can also override the default format by setting the BUILDAH\_FORMAT +environment variable. `export BUILDAH_FORMAT=docker` + +[//]: # (END included file options/format.md) + + +[//]: # (BEGIN included file options/from.md) +#### **--from** + +Overrides the first `FROM` instruction within the Containerfile. If there are multiple +FROM instructions in a Containerfile, only the first is changed. + +With the remote podman client, not all container transports work as +expected. For example, oci-archive:/x.tar references /x.tar on the remote +machine instead of on the client. When using podman remote clients it is +best to restrict use to *containers-storage*, and *docker:// transports*. + +[//]: # (END included file options/from.md) + + +[//]: # (BEGIN included file options/group-add.md) +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/group-add.md) + + +[//]: # (BEGIN included file options/help.md) +#### **--help**, **-h** + +Print usage statement + +[//]: # (END included file options/help.md) + + +[//]: # (BEGIN included file options/hooks-dir.md) +#### **--hooks-dir**=*path* + +Each *.json file in the path configures a hook for buildah build containers. For more details on the syntax of the JSON files and the semantics of hook injection. Buildah currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. + +This option may be set multiple times; paths from later options have higher precedence. + +For the annotation conditions, buildah uses any annotations set in the generated OCI configuration. + +For the bind-mount conditions, only mounts explicitly requested by the caller via --volume are considered. Bind mounts that buildah inserts by default (e.g. /dev/shm) are not considered. + +If --hooks-dir is unset for root callers, Buildah currently defaults to /usr/share/containers/oci/hooks.d and /etc/containers/oci/hooks.d in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting --hooks-dir. + +[//]: # (END included file options/hooks-dir.md) + + +[//]: # (BEGIN included file options/http-proxy.md) +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. + +[//]: # (END included file options/http-proxy.md) + + +[//]: # (BEGIN included file options/identity-label.md) +#### **--identity-label** + +Adds default identity label `io.buildah.version` if set. (default true). + +[//]: # (END included file options/identity-label.md) + + +[//]: # (BEGIN included file options/ignorefile.md) +#### **--ignorefile** + +Path to an alternative .containerignore file. + +[//]: # (END included file options/ignorefile.md) + + +[//]: # (BEGIN included file options/iidfile.md) +#### **--iidfile**=*ImageIDfile* + +Write the built image's ID to the file. When `--platform` is specified more than once, attempting to use this option triggers an error. + +[//]: # (END included file options/iidfile.md) + + +[//]: # (BEGIN included file options/inherit-labels.md) +#### **--inherit-labels** + +Inherit the labels from the base image or base stages. (default true). + +[//]: # (END included file options/inherit-labels.md) + + +[//]: # (BEGIN included file options/ipc.image.md) +#### **--ipc**=*how* + +Sets the configuration for IPC namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate +that a new IPC namespace is created, or it can be "host" to indicate +that the IPC namespace in which `podman` itself is being run is reused, +or it can be the path to an IPC namespace which is already in use by +another process. + +[//]: # (END included file options/ipc.image.md) + + +[//]: # (BEGIN included file options/isolation.md) +#### **--isolation**=*type* + +Controls what type of isolation is used for running processes as part of `RUN` +instructions. Recognized types include *oci* (OCI-compatible runtime, the +default), *rootless* (OCI-compatible runtime invoked using a modified +configuration and its --rootless option enabled, with *--no-new-keyring +--no-pivot* added to its *create* invocation, with network and UTS namespaces +disabled, and IPC, PID, and user namespaces enabled; the default for +unprivileged users), and *chroot* (an internal wrapper that leans more toward +chroot(1) than container technology). + +Note: You can also override the default isolation type by setting the +BUILDAH\_ISOLATION environment variable. `export BUILDAH_ISOLATION=oci` + +[//]: # (END included file options/isolation.md) + + +[//]: # (BEGIN included file options/jobs.md) +#### **--jobs**=*number* + +Run up to N concurrent stages in parallel. If the number of jobs is greater +than 1, stdin is read from /dev/null. If 0 is specified, then there is +no limit in the number of jobs that run in parallel. + +[//]: # (END included file options/jobs.md) + + +[//]: # (BEGIN included file options/label.image.md) +#### **--label**=*label* + +Add an image *label* (e.g. label=*value*) to the image metadata. Can be used +multiple times. + +Users can set a special LABEL **io.containers.capabilities=CAP1,CAP2,CAP3** in +a Containerfile that specifies the list of Linux capabilities required for the +container to run properly. This label specified in a container image tells +Podman to run the container with just these capabilities. Podman launches the +container with just the specified capabilities, as long as this list of +capabilities is a subset of the default list. + +If the specified capabilities are not in the default set, Podman prints an error +message and runs the container with the default capabilities. + +[//]: # (END included file options/label.image.md) + + +[//]: # (BEGIN included file options/layer-label.md) +#### **--layer-label**=*label[=value]* + +Add an intermediate image *label* (e.g. label=*value*) to the intermediate +image metadata. It can be used multiple times. + +If *label* is named, but neither `=` nor a `value` is provided, then +the *label* is set to an empty value. + +[//]: # (END included file options/layer-label.md) + + +[//]: # (BEGIN included file options/layers.md) +#### **--layers** + +Cache intermediate images during the build process (Default is `true`). + +Note: You can also override the default value of layers by setting the +BUILDAH\_LAYERS environment variable. `export BUILDAH_LAYERS=true` + +[//]: # (END included file options/layers.md) + +#### **--local**, **-l** + +Build image on local machine as well as on farm nodes. + + +[//]: # (BEGIN included file options/logfile.md) +#### **--logfile**=*filename* + +Log output which is sent to standard output and standard error to the +specified file instead of to standard output and standard error. +This option is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. + +[//]: # (END included file options/logfile.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/network.image.md) +#### **--network**=*mode*, **--net** + +Sets the configuration for network namespaces when handling `RUN` instructions. + +Valid _mode_ values are: + +- **none**: no networking. +- **host**: use the Podman host network stack. Note: the host mode gives the +container full access to local system services such as D-bus and is therefore +considered insecure. +- **ns:**_path_: path to a network namespace to join. +- **private**: create a new namespace for the container (default) +- **\**: Join the network with the given name or ID, e.g. use `--network mynet` to join the network with the name mynet. Only supported for rootful users. +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=MTU**: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=CIDR**: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=INTERFACE**: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=IPv4**: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=INTERFACE**: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=IPv6**: Specify the outbound ipv6 address slirp binds to. +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.image.md) + + +[//]: # (BEGIN included file options/no-cache.md) +#### **--no-cache** + +Do not use existing cached images for the container build. Build from the start with a new set of cached layers. + +[//]: # (END included file options/no-cache.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the container. + +Podman assumes control over the container's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/omit-history.md) +#### **--omit-history** + +Omit build history information in the built image. (default false). + +This option is useful for the cases where end users explicitly +want to set `--omit-history` to omit the optional `History` from +built images or when working with images built using build tools that +do not include `History` information in their images. + +[//]: # (END included file options/omit-history.md) + + +[//]: # (BEGIN included file options/os-feature.md) +#### **--os-feature**=*feature* + +Set the name of a required operating system *feature* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS feature list is kept, if the base image specified any. This option is typically only meaningful when the image's OS is Windows. + +If *feature* has a trailing `-`, then the *feature* is removed from the set of required features which is listed in the image. + +[//]: # (END included file options/os-feature.md) + + +[//]: # (BEGIN included file options/os-version.image.md) +#### **--os-version**=*version* + +Set the exact required operating system *version* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS version is kept, if the base image specified one. This option is typically only meaningful when the image's OS is Windows, and is typically set in Windows base images, so using this option is usually unnecessary. + +[//]: # (END included file options/os-version.image.md) + + +[//]: # (BEGIN included file options/pid.image.md) +#### **--pid**=*pid* + +Sets the configuration for PID namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new PID namespace is created, or it can be "host" to indicate that the PID namespace in which `podman` itself is being run is reused, or it can be the path to a PID namespace which is already in use by another +process. + +[//]: # (END included file options/pid.image.md) + +#### **--platforms**=*p1,p2,p3...* + +Build only on farm nodes that match the given platforms. + + +[//]: # (BEGIN included file options/pull.image.md) +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Only pull the image when it does not exist in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error when no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. + +[//]: # (END included file options/pull.image.md) + + +[//]: # (BEGIN included file options/quiet.md) +#### **--quiet**, **-q** + +Suppress output messages which indicate which instruction is being processed, and of progress when pulling images from a registry, and when writing the output image. + +[//]: # (END included file options/quiet.md) + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + + +[//]: # (BEGIN included file options/rm.md) +#### **--rm** + +Remove intermediate containers after a successful build (default true). + +[//]: # (END included file options/rm.md) + + +[//]: # (BEGIN included file options/runtime.md) +#### **--runtime**=*path* + +The *path* to an alternate OCI-compatible runtime, which is used to run +commands specified by the **RUN** instruction. + +Note: You can also override the default runtime by setting the BUILDAH\_RUNTIME environment variable. `export BUILDAH_RUNTIME=/usr/local/bin/runc` + +[//]: # (END included file options/runtime.md) + + +[//]: # (BEGIN included file options/runtime-flag.md) +#### **--runtime-flag**=*flag* + +Adds global flags for the container runtime. To list the supported flags, please consult the manpages of the selected container runtime. + +Note: Do not pass the leading -- to the flag. To pass the runc flag --log-format json to buildah build, the option given is --runtime-flag log-format=json. + +[//]: # (END included file options/runtime-flag.md) + + +[//]: # (BEGIN included file options/sbom.md) +#### **--sbom**=*preset* + +Generate SBOMs (Software Bills Of Materials) for the output image by scanning +the working container and build contexts using the named combination of scanner +image, scanner commands, and merge strategy. Must be specified with one or +more of **--sbom-image-output**, **--sbom-image-purl-output**, **--sbom-output**, +and **--sbom-purl-output**. Recognized presets, and the set of options which +they equate to: + + - "syft", "syft-cyclonedx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output cyclonedx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output cyclonedx-json={OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "syft-spdx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output spdx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output spdx-json={OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + - "trivy", "trivy-cyclonedx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "trivy-spdx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + +[//]: # (END included file options/sbom.md) + + +[//]: # (BEGIN included file options/sbom-image-output.md) +#### **--sbom-image-output**=*path* + +When generating SBOMs, store the generated SBOM in the specified path in the +output image. There is no default. + +[//]: # (END included file options/sbom-image-output.md) + + +[//]: # (BEGIN included file options/sbom-image-purl-output.md) +#### **--sbom-image-purl-output**=*path* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the specified path in the output +image. There is no default. + +[//]: # (END included file options/sbom-image-purl-output.md) + + +[//]: # (BEGIN included file options/sbom-merge-strategy.md) +#### **--sbom-merge-strategy**=*method* + +If more than one **--sbom-scanner-command** value is being used, use the +specified method to merge the output from later commands with output from +earlier commands. Recognized values include: + + - cat + Concatenate the files. + - merge-cyclonedx-by-component-name-and-version + Merge the "component" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "version" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + - merge-spdx-by-package-name-and-versioninfo + Merge the "package" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "versionInfo" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + +[//]: # (END included file options/sbom-merge-strategy.md) + + +[//]: # (BEGIN included file options/sbom-output.md) +#### **--sbom-output**=*file* + +When generating SBOMs, store the generated SBOM in the named file on the local +filesystem. There is no default. + +[//]: # (END included file options/sbom-output.md) + + +[//]: # (BEGIN included file options/sbom-purl-output.md) +#### **--sbom-purl-output**=*file* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the named file in the local +filesystem. There is no default. + +[//]: # (END included file options/sbom-purl-output.md) + + +[//]: # (BEGIN included file options/sbom-scanner-command.md) +#### **--sbom-scanner-command**=*image* + +Generate SBOMs by running the specified command from the scanner image. If +multiple commands are specified, they are run in the order in which they are +specified. These text substitutions are performed: + - {ROOTFS} + The root of the built image's filesystem, bind mounted. + - {CONTEXT} + The build context and additional build contexts, bind mounted. + - {OUTPUT} + The name of a temporary output file, to be read and merged with others or copied elsewhere. + +[//]: # (END included file options/sbom-scanner-command.md) + + +[//]: # (BEGIN included file options/sbom-scanner-image.md) +#### **--sbom-scanner-image**=*image* + +Generate SBOMs using the specified scanner image. + +[//]: # (END included file options/sbom-scanner-image.md) + + +[//]: # (BEGIN included file options/secret.image.md) +#### **--secret**=**id=id[,src=*envOrFile*][,env=*ENV*][,type=*file* | *env*]** + +Pass secret information to be used in the Containerfile for building images +in a safe way that will not end up stored in the final image, or be seen in other stages. +The value of the secret will be read from an environment variable or file named +by the "id" option, or named by the "src" option if it is specified, or from an +environment variable specified by the "env" option. See [EXAMPLES](#examples). +The secret will be mounted in the container at `/run/secrets/id` by default. + +To later use the secret, use the --mount flag in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret` + +The location of the secret in the container can be overridden using the +"target", "dst", or "destination" option of the `RUN --mount` flag. + +`RUN --mount=type=secret,id=mysecret,target=/run/secrets/myothersecret cat /run/secrets/myothersecret` + +Note: changing the contents of secret files will not trigger a rebuild of layers that use said secrets. + +[//]: # (END included file options/secret.image.md) + + +[//]: # (BEGIN included file options/security-opt.image.md) +#### **--security-opt**=*option* + +Security Options + +- `apparmor=unconfined` : Turn off apparmor confinement for the container +- `apparmor=alternate-profile` : Set the apparmor confinement profile for the +container + +- `label=user:USER` : Set the label user for the container processes +- `label=role:ROLE` : Set the label role for the container processes +- `label=type:TYPE` : Set the label process type for the container processes +- `label=level:LEVEL` : Set the label level for the container processes +- `label=filetype\:TYPE` : Set the label file type for the container files +- `label=disable` : Turn off label separation for the container +- `no-new-privileges` : Disable container processes from gaining additional privileges + +- `seccomp=unconfined` : Turn off seccomp confinement for the container +- `seccomp=profile.json` : JSON file to be used as the seccomp filter for the container. + +[//]: # (END included file options/security-opt.image.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the container. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/skip-unused-stages.md) +#### **--skip-unused-stages** + +Skip stages in multi-stage builds which don't affect the target stage. (Default: **true**). + +[//]: # (END included file options/skip-unused-stages.md) + + +[//]: # (BEGIN included file options/squash.md) +#### **--squash** + +Squash all of the image's new layers into a single new layer; any preexisting layers are not squashed. + +[//]: # (END included file options/squash.md) + + +[//]: # (BEGIN included file options/squash-all.md) +#### **--squash-all** + +Squash all of the new image's layers (including those inherited from a base image) into a single new layer. + +[//]: # (END included file options/squash-all.md) + + +[//]: # (BEGIN included file options/ssh.md) +#### **--ssh**=*default* | *id[=socket>* + +SSH agent socket or keys to expose to the build. +The socket path can be left empty to use the value of `default=$SSH_AUTH_SOCK` + +To later use the ssh agent, use the --mount option in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=ssh,id=id mycmd` + +[//]: # (END included file options/ssh.md) + + +[//]: # (BEGIN included file options/tag.md) +#### **--tag**, **-t**=*imageName* + +Specifies the name which is assigned to the resulting image if the build process completes successfully. +If _imageName_ does not include a registry name, the registry name *localhost* is prepended to the image name. + +[//]: # (END included file options/tag.md) + + +[//]: # (BEGIN included file options/target.md) +#### **--target**=*stageName* + +Set the target build stage to build. When building a Containerfile with multiple build stages, --target can be used to specify an intermediate build stage by name as the final stage for the resulting image. Commands after the target stage is skipped. + +[//]: # (END included file options/target.md) + + +[//]: # (BEGIN included file options/timestamp.md) +#### **--timestamp**=*seconds* + +Set the create timestamp to seconds since epoch to allow for deterministic builds (defaults to current time). By default, the created timestamp is changed and written into the image manifest with every commit, causing the image's sha256 hash to be different even if the sources are exactly the same otherwise. +When --timestamp is set, the created timestamp is always set to the time specified and therefore not changed, allowing the image's sha256 hash to remain the same. All files committed to the layers of the image is created with the timestamp. + +If the only instruction in a Containerfile is `FROM`, this flag has no effect. + +[//]: # (END included file options/timestamp.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/ulimit.image.md) +#### **--ulimit**=*type=soft-limit[\:hard-limit]* + +Specifies resource limits to apply to processes launched when processing `RUN` instructions. This option can be specified multiple times. Recognized resource types include: + "core": maximum core dump size (ulimit -c) + "cpu": maximum CPU time (ulimit -t) + "data": maximum size of a process's data segment (ulimit -d) + "fsize": maximum size of new files (ulimit -f) + "locks": maximum number of file locks (ulimit -x) + "memlock": maximum amount of locked memory (ulimit -l) + "msgqueue": maximum amount of data in message queues (ulimit -q) + "nice": niceness adjustment (nice -n, ulimit -e) + "nofile": maximum number of open files (ulimit -n) + "nproc": maximum number of processes (ulimit -u) + "rss": maximum size of a process's (ulimit -m) + "rtprio": maximum real-time scheduling priority (ulimit -r) + "rttime": maximum amount of real-time execution between blocking syscalls + "sigpending": maximum number of pending signals (ulimit -i) + "stack": maximum stack size (ulimit -s) + +[//]: # (END included file options/ulimit.image.md) + + +[//]: # (BEGIN included file options/unsetenv.image.md) +#### **--unsetenv**=*env* + +Unset environment variables from the final image. + +[//]: # (END included file options/unsetenv.image.md) + + +[//]: # (BEGIN included file options/unsetlabel.md) +#### **--unsetlabel**=*label* + +Unset the image label, causing the label not to be inherited from the base image. + +[//]: # (END included file options/unsetlabel.md) + + +[//]: # (BEGIN included file options/userns.image.md) +#### **--userns**=*how* + +Sets the configuration for user namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new user namespace is created, it can be "host" to indicate that the user namespace in which `podman` itself is being run is reused, or it can be the path to a user namespace which is already in use by another process. + +[//]: # (END included file options/userns.image.md) + + +[//]: # (BEGIN included file options/userns-gid-map.md) +#### **--userns-gid-map**=*mapping* + +Directly specifies a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container GID, a corresponding starting host-level GID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-gids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-gid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-gid-map are specified, but --userns-uid-map is specified, the GID map is set to use the same numeric values as the UID map. + +[//]: # (END included file options/userns-gid-map.md) + + +[//]: # (BEGIN included file options/userns-gid-map-group.md) +#### **--userns-gid-map-group**=*group* + +Specifies that a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subgid` file which correspond to the specified group. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-uid-map-user is specified, but --userns-gid-map-group is not specified, `podman` assumes that the specified user name is also a +suitable group name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. + +[//]: # (END included file options/userns-gid-map-group.md) + + +[//]: # (BEGIN included file options/userns-uid-map.md) +#### **--userns-uid-map**=*mapping* + +Directly specifies a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions default to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container UID, a corresponding starting host-level UID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-uids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-uid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-uid-map are specified, but --userns-gid-map is specified, the UID map is set to use the same numeric values as the GID map. + +[//]: # (END included file options/userns-uid-map.md) + + +[//]: # (BEGIN included file options/userns-uid-map-user.md) +#### **--userns-uid-map-user**=*user* + +Specifies that a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subuid` file which correspond to the specified user. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-gid-map-group is specified, but --userns-uid-map-user is not specified, `podman` assumes that the specified group name is also a +suitable user name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. + +[//]: # (END included file options/userns-uid-map-user.md) + + +[//]: # (BEGIN included file options/uts.md) +#### **--uts**=*how* + +Sets the configuration for UTS namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new UTS namespace to be created, or it can be "host" to indicate that the UTS namespace in which `podman` itself is being run is reused, or it can be the path to a UTS namespace which is already in use by another process. + +[//]: # (END included file options/uts.md) + + +[//]: # (BEGIN included file options/volume.image.md) +#### **--volume**, **-v**=*[HOST-DIR\:CONTAINER-DIR[\:OPTIONS]]* + +Mount a host directory into containers when executing RUN instructions during +the build. + +The `OPTIONS` are a comma-separated list and can be one or more of: + + * [rw|ro] + * [z|Z|O] + * [U] + * [`[r]shared`|`[r]slave`|`[r]private`][[1]](#Footnote1) + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR` +must be an absolute path as well. Podman bind-mounts the `HOST-DIR` to the +specified path when processing RUN instructions. + +You can specify multiple **-v** options to mount one or more mounts. + +You can add the `:ro` or `:rw` suffix to a volume to mount it read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted. When running using user namespaces, the UID and GID inside +the namespace may correspond to another UID and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the namespace, to change recursively the owner and group of +the source volume. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add one of these two suffixes +`:z` or `:Z` to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The `z` option tells Podman that two containers +share the volume content. As a result, Podman labels the content with a shared +content label. Shared volume labels allow all containers to read/write content. +The `Z` option tells Podman to label the content with a private unshared label. +Only the current container can use a private volume. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the host machine to fail. For these types +of containers, disabling SELinux separation is recommended. The option +`--security-opt label=disable` disables SELinux separation for the container. +For example, if a user wanted to volume mount their entire home directory into the build containers, they need to disable SELinux separation. + + $ podman build --security-opt label=disable -v $HOME:/home/user . + +`Overlay Volume Mounts` + +The `:O` flag tells Podman to mount the directory from the host as a +temporary storage using the Overlay file system. The `RUN` command containers +are allowed to modify contents within the mountpoint and are stored in the +container storage in a separate directory. In Overlay FS terms the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the `RUN` command +finishes executing, similar to a tmpfs mount point. + +Any subsequent execution of `RUN` commands sees the original source directory +content, any changes from previous RUN commands no longer exists. + +One use case of the `overlay` mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: + +- Overlay mounts are not currently supported in rootless mode. +- The `O` flag is not allowed to be specified with the `Z` or `z` flags. + Content mounted into the container is labeled with the private label. + On SELinux systems, labels in the source directory needs to be readable + by the container label. If not, SELinux container separation must be disabled + for the container to work. +- Modification of the directory volume mounted into the container with an + overlay mount can cause unexpected failures. Do not modify the directory until + the container finishes running. + +By default bind mounted volumes are `private`. That means any mounts done +inside containers are not be visible on the host and vice versa. This behavior +can be changed by specifying a volume mount propagation property. + +When the mount propagation policy is set to `shared`, any mounts completed +inside the container on that volume is visible to both the host and +container. When the mount propagation policy is set to `slave`, one way mount +propagation is enabled and any mounts completed on the host for that volume is +visible only inside of the container. To control the mount propagation +property of volume use the `:[r]shared`, `:[r]slave` or `:[r]private` +propagation flag. For mount propagation to work on the source mount point (mount +point where source dir is mounted on) has to have the right propagation properties. +For shared volumes, the source mount point has to be shared. And for slave volumes, +the source mount has to be either shared or slave. [[1]](#Footnote1) + +Use `df ` to determine the source mount and then use +`findmnt -o TARGET,PROPAGATION ` to determine propagation +properties of source mount, if `findmnt` utility is not available, the source +mount point can be determined by looking at the mount entry in +`/proc/self/mountinfo`. Look at `optional fields` and see if any propagation +properties are specified. +`shared:X` means the mount is `shared`, `master\:X` means the mount is `slave` +and if nothing is there that means the mount is `private`. [[1]](#Footnote1) + +To change propagation properties of a mount point use the `mount` command. For +example, to bind mount the source directory `/foo` do +`mount --bind /foo /foo` and `mount --make-private --make-shared /foo`. This +converts /foo into a `shared` mount point. The propagation properties of +the source mount can be changed directly. For instance if `/` is the source +mount for `/foo`, then use `mount --make-shared /` to convert `/` into a +`shared` mount. + +[//]: # (END included file options/volume.image.md) + +## EXAMPLES + +Build named image and manifest list using specified Containerfile with default farm: +``` +$ podman farm build --local -t name -f /path/to/containerfile . +``` + +Build named image and manifest list using the specified farm: +``` +$ podman farm build --farm myfarm -t name . +``` + +Build named image and manifest list using the specified farm, removing all images from farm nodes, after they are pushed to registry: +``` +$ podman farm build --farm myfarm --cleanup -t name . +``` + +Build named images and manifest list for specified platforms using default farm: +``` +$ podman farm build --platforms arm64,amd64 -t name . +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/main/man/runc.8.md)**, **[useradd(8)](https://www.unix.com/man-page/redhat/8/useradd)**, **[Containerfile(5)](https://github.com/containers/common/blob/main/docs/Containerfile.5.md)**, **[containerignore(5)](https://github.com/containers/common/blob/main/docs/containerignore.5.md)** + +## HISTORY + +September 2023, Originally compiled by Urvashi Mohnani `` + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a +core value of open source. The `master` and `slave` mount propagation +terminology used here is problematic and divisive, and needs to be changed. +However, these terms are currently used within the Linux kernel and must be +used as-is at this time. When the kernel maintainers rectify this usage, +Podman will follow suit immediately. diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-farm-create.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-farm-create.1.md new file mode 100644 index 000000000..a83cdc638 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-farm-create.1.md @@ -0,0 +1,39 @@ +--- +title: podman-farm-create +version: v5.5.1 +--- + +% podman-farm-create 1 + +## NAME +podman\-farm\-create - Create a new farm + +## SYNOPSIS +**podman farm create** *name* [*connections*] + +## DESCRIPTION +Create a new farm with connections that Podman knows about which were added via the +*podman system connection add* command. + +An empty farm can be created without adding any connections to it. Add or remove +connections from a farm via the *podman farm update* command. + +## EXAMPLE + + + +Create the specified farm: +``` +$ podman farm create farm2 +``` + +Create multiple farms: +``` +$ podman farm create farm1 f37 f38 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)**, **[podman-system-connection-add(1)](podman-system-connection-add.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-farm-list.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-farm-list.1.md new file mode 100644 index 000000000..b99a885de --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-farm-list.1.md @@ -0,0 +1,47 @@ +--- +title: podman-farm-list +version: v5.5.1 +--- + +% podman-farm-list 1 + +## NAME +podman\-farm\-list - List the existing farms + +## SYNOPSIS +**podman farm list** [*options*] + +**podman farm ls** [*options*] + +## DESCRIPTION +List all the existing farms. + +## OPTIONS + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' or a Go template. +Valid placeholders for the Go template listed below: + +| **Placeholder** | **Description** | +| --------------- | --------------------------------------------------------------------- | +| .Connections | List of all system connections in the farm | +| .Default | Indicates whether farm is the default | +| .Name | Farm name | +| .ReadWrite | Indicates if this farm can be modified using the podman farm commands | + +## EXAMPLE + +List all farms: +``` +$ podman farm list +Name Connections Default ReadWrite +farm1 [f38 f37] false true +farm2 [f37] true true +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-farm-remove.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-farm-remove.1.md new file mode 100644 index 000000000..58194d1ea --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-farm-remove.1.md @@ -0,0 +1,41 @@ +--- +title: podman-farm-remove +version: v5.5.1 +--- + +% podman-farm-remove 1 + +## NAME +podman\-farm\-remove - Delete one or more farms + +## SYNOPSIS +**podman farm remove** [*options*] *name* + +**podman farm rm** [*options*] *name* + +## DESCRIPTION +Delete one or more farms. + +## OPTIONS + +#### **--all**, **-a** + +Remove all farms. + +## EXAMPLE + +Remove specified farm: +``` +$ podman farm remove farm1 +``` + +Remove all farms: +``` +$ podman farm rm --all +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com)s diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-farm-update.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-farm-update.1.md new file mode 100644 index 000000000..a2604eea8 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-farm-update.1.md @@ -0,0 +1,53 @@ +--- +title: podman-farm-update +version: v5.5.1 +--- + +% podman-farm-update 1 + +## NAME +podman\-farm\-update - Update an existing farm + +## SYNOPSIS +**podman farm update** [*options*] *name* + +## DESCRIPTION +Update a farm by either adding connections to it, removing connections from it, or setting it as the new +default farm. + +## OPTIONS + +#### **--add**, **-a** + +Add new connections to an existing farm. Multiple connections can be added at once. + +#### **--default**, **-d** + +Set the current farm as the default. + +#### **--remove**, **-r** + +Remove one or more connections from an existing farm. + +## EXAMPLE + +Add two connections to specified farm: +``` +$ podman farm update --add f35,f38 farm1 +``` + +Add connection to specified farm: +``` +$ podman farm update --remove f35 farm1 +``` + +Change specified farm to be default: +``` +$ podman farm update --default farm2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com)s diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-farm.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-farm.1.md new file mode 100644 index 000000000..93cb78624 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-farm.1.md @@ -0,0 +1,46 @@ +--- +title: podman-farm +version: v5.5.1 +--- + +% podman-farm 1 + +## NAME +podman\-farm - Farm out builds to machines running podman for different architectures + +## SYNOPSIS +**podman farm** *subcommand* + +## DESCRIPTION +Farm out builds to machines running Podman for different architectures. + +Manage farms by creating, updating, and removing them. + +Note: All farm machines must have a minimum podman version of v4.9.0. + +Podman manages the farms by writing and reading the `podman-connections.json` file located under +`$XDG_CONFIG_HOME/containers` or if the env is not set it defaults to `$HOME/.config/containers`. +Or the `PODMAN_CONNECTIONS_CONF` environment variable can be set to a full file path which podman +will use instead. +This file is managed by the podman commands and should never be edited by users directly. To manually +configure the farms use the `[farm]` section in containers.conf. + +If the ReadWrite column in the **podman farm list** output is set to true the farm is stored in the +`podman-connections.json` file otherwise it is stored in containers.conf and can therefore not be +edited with the **podman farm remove/update** commands. It can still be used with **podman farm build**. + +## COMMANDS + +| Command | Man Page | Description | +| -------- | ----------------------------------------------------| ----------------------------------------------------------------- | +| build | [podman-farm\-build(1)](podman-farm-build.1.md) | Build images on farm nodes, then bundle them into a manifest list | +| create | [podman-farm\-create(1)](podman-farm-create.1.md) | Create a new farm | +| list | [podman-farm\-list(1)](podman-farm-list.1.md) | List the existing farms | +| remove | [podman-farm\-remove(1)](podman-farm-remove.1.md) | Delete one or more farms | +| update | [podman-farm\-update(1)](podman-farm-update.1.md) | Update an existing farm | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-generate-spec.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-generate-spec.1.md new file mode 100644 index 000000000..e0109ecee --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-generate-spec.1.md @@ -0,0 +1,31 @@ +--- +title: podman-generate-spec +version: v5.5.1 +--- + +% podman-generate-spec 1 + +## NAME +podman\-generate\-spec - Generate Specgen JSON based on containers or pods + +## SYNOPSIS +**podman generate spec** [*options*] *container | *pod* + +## DESCRIPTION +**podman generate spec** generates SpecGen JSON from Podman Containers and Pods. This JSON can be printed to a file, directly to the command line, or both. + +This JSON can then be used as input for the Podman API, specifically for Podman container and pod creation. Specgen is Podman's internal structure for formulating new container-related entities. + +## OPTIONS + +#### **--compact**, **-c** + +Print the output in a compact, one line format. This is useful when piping the data to the Podman API + +#### **--filename**, **-f**=**filename** + +Output to the given file. + +#### **--name**, **-n** + +Rename the pod or container, so that it does not conflict with the existing entity. This is helpful when the JSON is to be used before the source pod or container is deleted. diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-generate-systemd.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-generate-systemd.1.md new file mode 100644 index 000000000..6605a765d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-generate-systemd.1.md @@ -0,0 +1,326 @@ +--- +title: podman-generate-systemd +version: v5.5.1 +--- + +% podman-generate-systemd 1 + +## NAME +podman\-generate\-systemd - [DEPRECATED] Generate systemd unit file(s) for a container or pod + +## SYNOPSIS +**podman generate systemd** [*options*] *container|pod* + +## DESCRIPTION +DEPRECATED: +Note: **podman generate systemd** is deprecated. We recommend using [Quadlet](podman-systemd.unit.5.md) +files when running Podman containers or pods under systemd. There are no plans to remove the command. +It will receive urgent bug fixes but no new features. + +**podman generate systemd** creates a systemd unit file that can be used to control a container or pod. +By default, the command prints the content of the unit files to stdout. + +Generating unit files for a pod requires the pod to be created with an infra container (see `--infra=true`). An infra container runs across the entire lifespan of a pod and is hence required for systemd to manage the life cycle of the pod's main unit. + +- Note: When using this command with the remote client, including Mac and Windows (excluding WSL2) machines, place the generated units on the remote system. Moreover, make sure that the `XDG_RUNTIME_DIR` environment variable is set. If unset, set it via `export XDG_RUNTIME_DIR=/run/user/$(id -u)`._ + +- Note: The generated `podman run` command contains an `--sdnotify` option with the value taken from the container. +If the container does not have any explicitly set value or the value is set to __ignore__, the value __conmon__ is used. +The reason for overriding the default value __container__ is that almost no container workloads send notify messages. +Systemd waits for a ready message that never comes, if the value __container__ is used for a container +that does not send notify messages. The use of the default value might have been unintentional by the user, +therefore the overridden default value._ + +### Kubernetes Integration + +A Kubernetes YAML can be executed in systemd via the `podman-kube@.service` systemd template. The template's argument is the path to the YAML file. Given a `workload.yaml` file in the home directory, it can be executed as follows: + +``` +$ escaped=$(systemd-escape ~/workload.yaml) +$ systemctl --user start podman-kube@$escaped.service +$ systemctl --user is-active podman-kube@$escaped.service +active +``` + +## OPTIONS + +#### **--after**=*dependency_name* + +Add the systemd unit after (`After=`) option, that ordering dependencies between the list of dependencies and this service. This option may be specified more than once. + +User-defined dependencies are appended to the generated unit file, but any existing options needed or defined by default (e.g., `online.target`) are **not** removed or overridden. + +#### **--container-prefix**=*prefix* + +Set the systemd unit name prefix for containers. The default is *container*. + +#### **--env**, **-e**=*env* + +Set environment variables to the systemd unit files. + +If an environment variable is specified without a value, Podman checks the host environment for a value and sets the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the systemd unit files. + +#### **--files**, **-f** + +Generate files instead of printing to stdout. The generated files are named {container,pod}-{ID,name}.service and are placed in the current working directory. + +Note: On a system with SELinux enabled, the generated files inherits contexts from the current working directory. Depending on the SELinux setup, changes to the generated files using `restorecon`, `chcon`, or `semanage` may be required to allow systemd to access these files. Alternatively, use the `-Z` option when running `mv` or `cp`. + +#### **--format**=*format* + +Print the created units in the specified format (json). If `--files` is specified, the paths to the created files are printed instead of the unit content. + +#### **--name**, **-n** + +Use the name of the container for the start, stop, and description in the unit file + +#### **--new** + +This option yields unit files that do not expect containers and pods to exist. Instead, new containers and pods are created based on their configuration files. The unit files are created best effort and may need further editing; please review the generated files carefully before using them in production. + +Note that `--new` only works on containers and pods created directly via Podman (i.e., `podman [container] {create,run}` or `podman pod create`). It does not work on containers or pods created via the REST API or via `podman kube play`. For `podman kube play`, use the `podman-kube@.service` systemd template instead. + +#### **--no-header** + +Do not generate the header including meta data such as the Podman version and the timestamp. + +#### **--pod-prefix**=*prefix* + +Set the systemd unit name prefix for pods. The default is *pod*. + +#### **--requires**=*dependency_name* + +Set the systemd unit requires (`Requires=`) option. Similar to wants, but declares a stronger requirement dependency. + +#### **--restart-policy**=*policy* + +Set the systemd restart policy. The restart-policy must be one of: "no", "on-success", "on-failure", "on-abnormal", +"on-watchdog", "on-abort", or "always". The default policy is *on-failure* unless the container was created with a custom restart policy. + +Note that generating a unit without `--new` on a container with a custom restart policy can lead to issues on shutdown; systemd attempts to stop the unit while Podman tries to restart it. Creating the container without `--restart` and using the `--restart-policy` option when generating the unit file is recommended. + +#### **--restart-sec**=*time* + +Set the systemd service restartsec value. Configures the time to sleep before restarting a service (as configured with restart-policy). +Takes a value in seconds. + +#### **--separator**=*separator* + +Set the systemd unit name separator between the name/id of a container/pod and the prefix. The default is *-*. + +#### **--start-timeout**=*value* + +Override the default start timeout for the container with the given value in seconds. + +#### **--stop-timeout**=*value* + +Override the default stop timeout for the container with the given value in seconds. + +#### **--template** + +Add template specifiers to run multiple services from the systemd unit file. + +Note that if `--new` was not set to true, it is set to true by default. However, the command fails if `--new` is set to `false` explicitly. + +#### **--wants**=*dependency_name* + +Add the systemd unit wants (`Wants=`) option, that this service is (weak) dependent on. This option may be specified more than once. This option does not influence the order in which services are started or stopped. + +User-defined dependencies are appended to the generated unit file, but any existing options needed or defined by default (e.g., `online.target`) are **not** removed or overridden. + +## EXAMPLES + +### Generate and print a systemd unit file for a container + +Generate a systemd unit file for a container running nginx with an *always* restart policy and 1-second timeout to stdout. Note that the **RequiresMountsFor** option in the **Unit** section ensures that the container storage for both the GraphRoot and the RunRoot are mounted prior to starting the service. For systems with container storage on disks like iSCSI or other remote block protocols, this ensures that Podman is not executed prior to any necessary storage operations coming online. + +``` +$ podman create --name nginx nginx:latest +$ podman generate systemd --restart-policy=always -t 1 nginx +# container-de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6.service +# autogenerated by Podman 1.8.0 +# Wed Mar 09 09:46:45 CEST 2020 + +[Unit] +Description=Podman container-de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6.service +Documentation=man:podman-generate-systemd(1) +Wants=network-online.target +After=network-online.target +RequiresMountsFor=/var/run/container/storage + +[Service] +Restart=always +ExecStart=/usr/bin/podman start de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6 +ExecStop=/usr/bin/podman stop \ + -t 1 de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6 +KillMode=none +Type=forking +PIDFile=/run/user/1000/overlay-containers/de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6/userdata/conmon.pid + +[Install] +WantedBy=default.target +``` + +### Generate systemd unit file for a container with `--new` flag + + The `--new` flag generates systemd unit files that create and remove containers at service start and stop commands (see ExecStartPre and ExecStopPost service actions). Such unit files are not tied to a single machine and can easily be shared and used on other machines. + +``` +$ sudo podman generate systemd --new --files --name bb310a0780ae +# container-busy_moser.service +# autogenerated by Podman 1.8.3 +# Fri Apr 3 09:40:47 EDT 2020 + +[Unit] +Description=Podman container-busy_moser.service +Documentation=man:podman-generate-systemd(1) +Wants=network-online.target +After=network-online.target +RequiresMountsFor=/var/run/container/storage + +[Service] +Environment=PODMAN_SYSTEMD_UNIT=%n +Restart=on-failure +ExecStartPre=/bin/rm -f %t/%n-pid %t/%n-cid +ExecStart=/usr/local/bin/podman run \ + --conmon-pidfile %t/%n-pid \ + --cidfile %t/%n-cid \ + --cgroups=no-conmon \ + -d \ + -dit alpine +ExecStop=/usr/local/bin/podman stop \ + --ignore \ + --cidfile %t/%n-cid -t 10 +ExecStopPost=/usr/local/bin/podman rm \ + --ignore \ + -f \ + --cidfile %t/%n-cid +PIDFile=%t/%n-pid +KillMode=none +Type=forking + +[Install] +WantedBy=default.target +``` + +### Generate systemd unit files for a pod with two simple alpine containers + +Note `systemctl` must only be used on the pod unit and not used to start or stop containers individually. The containers are managed by the pod service along with the internal infra-container. + +Use `systemctl status` or `journalctl` to examine container or pod unit files. +``` +$ podman pod create --name systemd-pod +$ podman create --pod systemd-pod alpine top +$ podman create --pod systemd-pod alpine top +$ podman generate systemd --files --name systemd-pod +/home/user/pod-systemd-pod.service +/home/user/container-amazing_chandrasekhar.service +/home/user/container-jolly_shtern.service +$ cat pod-systemd-pod.service +# pod-systemd-pod.service +# autogenerated by Podman 1.8.0 +# Wed Mar 09 09:52:37 CEST 2020 + +[Unit] +Description=Podman pod-systemd-pod.service +Documentation=man:podman-generate-systemd(1) +Requires=container-amazing_chandrasekhar.service container-jolly_shtern.service +Before=container-amazing_chandrasekhar.service container-jolly_shtern.service +Wants=network-online.target +After=network-online.target +RequiresMountsFor=/var/run/container/storage + +[Service] +Restart=on-failure +ExecStart=/usr/bin/podman start 77a818221650-infra +ExecStop=/usr/bin/podman stop \ + -t 10 77a818221650-infra +KillMode=none +Type=forking +PIDFile=/run/user/1000/overlay-containers/ccfd5c71a088768774ca7bd05888d55cc287698dde06f475c8b02f696a25adcd/userdata/conmon.pid + +[Install] +WantedBy=default.target +``` + +### Installation of generated systemd unit files. + +Podman-generated unit files include an `[Install]` section, which carries installation information for the unit. It is used by the enable and disable commands of systemctl(1) during installation. + +Once the systemd unit file is generated, install it to */etc/systemd/system* to be run by the root user or to *$HOME/.config/systemd/user* for installing it as a non-root user. Enable the copied unit file or files using `systemctl enable`. + +Note: Copying unit files to */etc/systemd/system* and enabling it marks the unit file to be automatically started at boot. And similarly, copying a unit file to *$HOME/.config/systemd/user* and enabling it marks the unit file to be automatically started on user login. + + +``` +# Generated systemd files. +$ podman pod create --name systemd-pod +$ podman create --pod systemd-pod alpine top +$ podman generate systemd --files --name systemd-pod + +# Copy all the generated files. + +$ sudo cp pod-systemd-pod.service container-great_payne.service /etc/systemd/system +$ systemctl enable pod-systemd-pod.service +Created symlink /etc/systemd/system/multi-user.target.wants/pod-systemd-pod.service → /etc/systemd/system/pod-systemd-pod.service. +Created symlink /etc/systemd/system/default.target.wants/pod-systemd-pod.service → /etc/systemd/system/pod-systemd-pod.service. +$ systemctl is-enabled pod-systemd-pod.service +enabled +``` +To run the user services placed in `$HOME/.config/systemd/user` on first login of that user, enable the service with --user flag. + +``` +$ systemctl --user enable <.service> +``` +The systemd user instance is killed after the last session for the user is closed. The systemd user instance can be started at boot and kept running even after the user logs out by enabling `lingering` using + +``` +$ loginctl enable-linger +``` +### Use `systemctl` to perform operations on generated installed unit files. + +Create and enable systemd unit files for a pod using the above examples as reference and use `systemctl` to perform operations. + +Since systemctl defaults to using the root user, all the changes using the systemctl can be seen by appending sudo to the podman cli commands. To perform `systemctl` actions as a non-root user use the `--user` flag when interacting with `systemctl`. + +Note: If the previously created containers or pods are using shared resources, such as ports, make sure to remove them before starting the generated systemd units. + +``` +$ systemctl --user start pod-systemd-pod.service +$ podman pod ps +POD ID NAME STATUS CREATED # OF CONTAINERS INFRA ID +0815c7b8e7f5 systemd-pod Running 29 minutes ago 2 6c5d116f4bbe +$ sudo podman ps # 0 Number of pods on root. +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +$ systemctl stop pod-systemd-pod.service +$ podman pod ps +POD ID NAME STATUS CREATED # OF CONTAINERS INFRA ID +272d2813c798 systemd-pod Exited 29 minutes ago 2 6c5d116f4bbe +``` + +Create a simple alpine container and generate the systemd unit file with `--new` flag. +Enable the service and control operations using the systemctl commands. + +Note: When starting the container using `systemctl start` rather than altering the already running container it spins up a "new" container with similar configuration. + +``` +# Enable the service. + +$ sudo podman ps -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +bb310a0780ae docker.io/library/alpine:latest /bin/sh 2 minutes ago Created busy_moser +$ sudo systemctl start container-busy_moser.service +$ sudo podman ps -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +772df2f8cf3b docker.io/library/alpine:latest /bin/sh 1 second ago Up 1 second distracted_albattani +bb310a0780ae docker.io/library/alpine\:latest /bin/sh 3 minutes ago Created busy_moser +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **systemctl(1)**, **systemd.unit(5)**, **systemd.service(5)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)**, **[podman-systemd.unit(5)](podman-systemd.unit.5.md)** + +## HISTORY +April 2020, Updated details and added use case to use generated .service files as root and non-root, by Sujil Shah (sushah at redhat dot com) + +August 2019, Updated with pod support by Valentin Rothberg (rothberg at redhat dot com) + +April 2019, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-generate.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-generate.1.md new file mode 100644 index 000000000..145cf5003 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-generate.1.md @@ -0,0 +1,27 @@ +--- +title: podman-generate +version: v5.5.1 +--- + +% podman-generate 1 + +## NAME +podman\-generate - Generate structured data based on containers, pods or volumes + +## SYNOPSIS +**podman generate** *subcommand* + +## DESCRIPTION +The generate command creates structured output (like YAML) based on a container, pod or volume. + +## COMMANDS + +| Command | Man Page | Description | +|---------|------------------------------------------------------------|-------------------------------------------------------------------------------------| +| kube | [podman-kube-generate(1)](podman-kube-generate.1.md) | Generate Kubernetes YAML based on containers, pods or volumes. | +| spec | [podman-generate-spec(1)](podman-generate-spec.1.md) | Generate Specgen JSON based on containers or pods. | +| systemd | [podman-generate-systemd(1)](podman-generate-systemd.1.md) | [DEPRECATED] Generate systemd unit file(s) for a container or pod. | + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-container(1)](podman-container.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-healthcheck-run.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-healthcheck-run.1.md new file mode 100644 index 000000000..87460724f --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-healthcheck-run.1.md @@ -0,0 +1,45 @@ +--- +title: podman-healthcheck-run +version: v5.5.1 +--- + +% podman-healthcheck-run 1 + +## NAME +podman\-healthcheck\-run - Run a container healthcheck + +## SYNOPSIS +**podman healthcheck run** *container* + +## DESCRIPTION + +Runs the healthcheck command defined in a running container manually. The resulting error codes are defined +as follows: + +* 0 = healthcheck command succeeded +* 1 = healthcheck command failed +* 125 = an error has occurred + +Possible errors that can occur during the healthcheck are: +* unable to find the container +* container has no defined healthcheck +* container is not running + +## OPTIONS +#### **--help** + +Print usage statement + + +## EXAMPLES + +Run healthchecks in specified container: +``` +$ podman healthcheck run mywebapp +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-healthcheck(1)](podman-healthcheck.1.md)** + +## HISTORY +Feb 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-healthcheck.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-healthcheck.1.md new file mode 100644 index 000000000..3ee111fe6 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-healthcheck.1.md @@ -0,0 +1,27 @@ +--- +title: podman-healthcheck +version: v5.5.1 +--- + +% podman-healthcheck 1 + +## NAME +podman\-healthcheck - Manage healthchecks for containers + +## SYNOPSIS +**podman healthcheck** *subcommand* + +## DESCRIPTION +podman healthcheck is a set of subcommands that manage container healthchecks + +## SUBCOMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------- | ------------------------------------------------------------------------------ | +| run | [podman-healthcheck-run(1)](podman-healthcheck-run.1.md) | Run a container healthcheck | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +Feb 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-history.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-history.1.md new file mode 100644 index 000000000..961fc18d1 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-history.1.md @@ -0,0 +1,110 @@ +--- +title: podman-history +version: v5.5.1 +--- + +% podman-history 1 + +## NAME +podman\-history - Show the history of an image + +## SYNOPSIS +**podman history** [*options*] *image*[:*tag*|@*digest*] + +**podman image history** [*options*] *image*[:*tag*|@*digest*] + +## DESCRIPTION +**podman history** displays the history of an image by printing out information +about each layer used in the image. The information printed out for each layer +include Created (time and date), Created By, Size, and Comment. The output can +be truncated or not using the **--no-trunc** flag. If the **--human** flag is +set, the time of creation and size are printed out in a human readable format. +The **--quiet** flag displays the ID of the image only when set and the **--format** +flag is used to print the information using the Go template provided by the user. + +## OPTIONS + +#### **--format**=*format* + +Alter the output for a format like 'json' or a Go template. + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|------------------------|---------------------------------------------------------------------------| +| .Comment | Comment for the layer | +| .Created | if --human, time elapsed since creation, otherwise time stamp of creation | +| .CreatedAt | Time when the image layer was created | +| .CreatedBy | Command used to create the layer | +| .CreatedSince | Elapsed time since the image layer was created | +| .ID | Image ID | +| .Size | Size of layer on disk | +| .Tags | Image tags | + +#### **--help**, **-h** + +Print usage statement + +#### **--human**, **-H** + +Display sizes and dates in human readable format (default *true*). + +#### **--no-trunc** + +Do not truncate the output (default *false*). + +#### **--quiet**, **-q** + +Print the numeric IDs only (default *false*). + +## EXAMPLES + +Show the history of the specified image: +``` +$ podman history debian +ID CREATED CREATED BY SIZE COMMENT +b676ca55e4f2c 9 weeks ago /bin/sh -c #(nop) CMD ["bash"] 0 B + 9 weeks ago /bin/sh -c #(nop) ADD file:ebba725fb97cea4... 45.14 MB +``` + +Show the history of the specified image without truncating content and using raw data: +``` +$ podman history --no-trunc=true --human=false debian +ID CREATED CREATED BY SIZE COMMENT +b676ca55e4f2c 2017-07-24T16:52:55Z /bin/sh -c #(nop) CMD ["bash"] 0 + 2017-07-24T16:52:54Z /bin/sh -c #(nop) ADD file:ebba725fb97cea4... 45142935 +``` + +Show the formatted history of the specified image: +``` +$ podman history --format "{{.ID}} {{.Created}}" debian +b676ca55e4f2c 9 weeks ago + 9 weeks ago +``` + +Show the history in JSON format for the specified image: +``` +$ podman history --format json debian +[ + { + "id": "b676ca55e4f2c0ce53d0636438c5372d3efeb5ae99b676fa5a5d1581bad46060", + "created": "2017-07-24T16:52:55.195062314Z", + "createdBy": "/bin/sh -c #(nop) CMD [\"bash\"]", + "size": 0, + "comment": "" + }, + { + "id": "b676ca55e4f2c0ce53d0636438c5372d3efeb5ae99b676fa5a5d1581bad46060", + "created": "2017-07-24T16:52:54.898893387Z", + "createdBy": "/bin/sh -c #(nop) ADD file:ebba725fb97cea45d0b1b35ccc8144e766fcfc9a78530465c23b0c4674b14042 in / ", + "size": 45142935, + "comment": "" + } +] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-image-diff.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-image-diff.1.md new file mode 100644 index 000000000..cd30cf227 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-image-diff.1.md @@ -0,0 +1,61 @@ +--- +title: podman-image-diff +version: v5.5.1 +--- + +% podman-image-diff 1 + +## NAME +podman-image-diff - Inspect changes on an image's filesystem + +## SYNOPSIS +**podman image diff** [*options*] *image* [*image*] + +## DESCRIPTION +Displays changes on an image's filesystem. The image is compared to its parent layer or the second argument when given. + +The output is prefixed with the following symbols: + +| Symbol | Description | +|--------|-------------| +| A | A file or directory was added. | +| D | A file or directory was deleted. | +| C | A file or directory was changed. | + +## OPTIONS + +#### **--format** + +Alter the output into a different format. The only valid format for **podman image diff** is `json`. + +## EXAMPLE + +Display image differences from images parent layer: +``` +$ podman image diff redis:old +C /usr +C /usr/local +C /usr/local/bin +A /usr/local/bin/docker-entrypoint.sh +``` + +Display image differences between two different images in JSON format: +``` +$ podman image diff --format json redis:old redis\:alpine +{ + "changed": [ + "/usr", + "/usr/local", + "/usr/local/bin" + ], + "added": [ + "/usr/local/bin/docker-entrypoint.sh" + ] +} +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image(1)](podman-image.1.md)** + +## HISTORY +August 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-image-exists.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-image-exists.1.md new file mode 100644 index 000000000..03a3ff7b7 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-image-exists.1.md @@ -0,0 +1,46 @@ +--- +title: podman-image-exists +version: v5.5.1 +--- + +% podman-image-exists 1 + +## NAME +podman-image-exists - Check if an image exists in local storage + +## SYNOPSIS +**podman image exists** *image* + +## DESCRIPTION +**podman image exists** checks if an image exists in local storage. The **ID** or **Name** +of the image may be used as input. Podman returns an exit code +of `0` when the image is found. A `1` is returned otherwise. An exit code of `125` indicates there +was an issue accessing the local storage. + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Check if an image called `webclient` exists in local storage (the image does actually exist): +``` +$ podman image exists webclient +$ echo $? +0 +``` + +Check if an image called `webbackend` exists in local storage (the image does not actually exist): +``` +$ podman image exists webbackend +$ echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image(1)](podman-image.1.md)** + +## HISTORY +November 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-image-inspect.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-image-inspect.1.md new file mode 100644 index 000000000..f52868c43 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-image-inspect.1.md @@ -0,0 +1,139 @@ +--- +title: podman-image-inspect +version: v5.5.1 +--- + +% podman-image-inspect 1 + +## NAME +podman\-image\-inspect - Display an image's configuration + +## SYNOPSIS +**podman image inspect** [*options*] *image* [*image* ...] + +## DESCRIPTION + +This displays the low-level information on images identified by name or ID. By default, this renders all results in a JSON array. If a format is specified, the given template is executed for each result. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Format the output using the given Go template. +The keys of the returned JSON can be used as the values for the --format flag (see examples below). + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ----------------- | ------------------ | +| .Annotations ... | Annotation information included in the image | +| .Architecture | Architecture of software in the image | +| .Author | Image author | +| .Comment | Image comment | +| .Config ... | Structure with config info | +| .Created ... | Image creation time (string, ISO3601) | +| .Digest | Image digest (sha256:+64-char hash) | +| .GraphDriver ... | Structure for the graph driver info | +| .HealthCheck ... | Structure for the health check info | +| .History | History information stored in image | +| .ID | Image ID (full 64-char hash) | +| .Labels ... | Label information included in the image | +| .ManifestType | Manifest type of the image | +| .NamesHistory | Name history information stored in image | +| .Os | Operating system of software in the image | +| .Parent | Parent image of the specified image | +| .RepoDigests | Repository digests for the image | +| .RepoTags | Repository tags for the image | +| .RootFS ... | Structure for the root file system info | +| .Size | Size of image, in bytes | +| .User | Default user to execute the image as | +| .Version | Image Version | +| .VirtualSize | Virtual size of image, in bytes | + +## EXAMPLE + +Inspect information on the specified image: +``` +$ podman image inspect fedora +[ + { + "Id": "37e5619f4a8ca9dbc4d6c0ae7890625674a10dbcfb76201399e2aaddb40da17d", + "Digest": "sha256:1b0d4ddd99b1a8c8a80e885aafe6034c95f266da44ead992aab388e6aa91611a", + "RepoTags": [ + "registry.fedoraproject.org/fedora:latest" + ], + "RepoDigests": [ + "registry.fedoraproject.org/fedora@sha256:1b0d4ddd99b1a8c8a80e885aafe6034c95f266da44ead992aab388e6aa91611a", + "registry.fedoraproject.org/fedora@sha256:b5290db40008aae9272ad3a6bd8070ef7ecd547c3bef014b894c327960acc582" + ], + "Parent": "", + "Comment": "Created by Image Factory", + "Created": "2021-08-09T05:48:47Z", + "Config": { + "Env": [ + "DISTTAG=f34container", + "FGC=f34", + "container=oci" + ], + "Cmd": [ + "/bin/bash" + ], + "Labels": { + "license": "MIT", + "name": "fedora", + "vendor": "Fedora Project", + "version": "34" + } + }, + "Version": "1.10.1", + "Author": "", + "Architecture": "amd64", + "Os": "linux", + "Size": 183852302, + "VirtualSize": 183852302, + "GraphDriver": { + "Name": "overlay", + "Data": { + "UpperDir": "/home/dwalsh/.local/share/containers/storage/overlay/0203e243f1ca4b6bb49371ecd21363212467ec6d7d3fa9f324cd4e78cc6b5fa2/diff", + "WorkDir": "/home/dwalsh/.local/share/containers/storage/overlay/0203e243f1ca4b6bb49371ecd21363212467ec6d7d3fa9f324cd4e78cc6b5fa2/work" + } + }, + "RootFS": { + "Type": "layers", + "Layers": [ + "sha256:0203e243f1ca4b6bb49371ecd21363212467ec6d7d3fa9f324cd4e78cc6b5fa2" + ] + }, + "Labels": { + "license": "MIT", + "name": "fedora", + "vendor": "Fedora Project", + "version": "34" + }, + "Annotations": {}, + "ManifestType": "application/vnd.docker.distribution.manifest.v2+json", + "User": "", + "History": [ + { + "created": "2021-08-09T05:48:47Z", + "comment": "Created by Image Factory" + } + ], + "NamesHistory": [ + "registry.fedoraproject.org/fedora:latest" + ] + } +] +``` + +Inspect image ID for the specified image: +``` +$ podman image inspect --format '{{ .Id }}' fedora +37e5619f4a8ca9dbc4d6c0ae7890625674a10dbcfb76201399e2aaddb40da17d +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image(1)](podman-image.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +Sep 2021, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-image-mount.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-image-mount.1.md new file mode 100644 index 000000000..ce927ce27 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-image-mount.1.md @@ -0,0 +1,82 @@ +--- +title: podman-image-mount +version: v5.5.1 +--- + +% podman-image-mount 1 + +## NAME +podman\-image\-mount - Mount an image's root filesystem + +## SYNOPSIS +**podman image mount** [*options*] [*image* ...] + +## DESCRIPTION +Mounts the specified images' root file system in a location which can be +accessed from the host, and returns its location. + +The `podman image mount` command without any arguments lists all of the +currently mounted images. + +Rootless mode only supports mounting VFS driver, unless podman is run in a user namespace. +Use the `podman unshare` command to enter the user namespace. All other storage drivers fail to mount. + +## RETURN VALUE +The location of the mounted file system. On error an empty string and errno is +returned. + +## OPTIONS + +#### **--all**, **-a** + +Mount all images. + +#### **--format**=*format* + +Print the mounted images in specified format (json). + +## EXAMPLE + +Mount multiple images. Note: In rootless mode, image mounting works only after executing the podman unshare command to enter the user namespace. +``` +podman image mount fedora ubi8-init +/var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +/var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged +``` + +List mounted images: +``` +podman image mount +registry.fedoraproject.org/fedora:latest /var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +registry.access.redhat.com/ubi8-init:latest /var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged +``` + +List mounted images in JSON format: +``` +podman image mount --format json +[ + { + "id": "00ff39a8bf19f810a7e641f7eb3ddc47635913a19c4996debd91fafb6b379069", + "Names": [ + "sha256:58de585a231aca14a511347bc85b912a6f000159b49bc2b0582032911e5d3a6c" + ], + "Repositories": [ + "registry.fedoraproject.org/fedora:latest" + ], + "mountpoint": "/var/lib/containers/storage/overlay/0ccfac04663bbe8813b5f24502ee0b7371ce5bf3c5adeb12e4258d191c2cf7bc/merged" + }, + { + "id": "bcc2dc9a261774ad25a15e07bb515f9b77424266abf2a1252ec7bcfed1dd0ac2", + "Names": [ + "sha256:d5f260b2e51b3ee9d05de1c31d261efc9af28e7d2d47cedf054c496d71424d63" + ], + "Repositories": [ + "registry.access.redhat.com/ubi8-init:latest" + ], + "mountpoint": "/var/lib/containers/storage/overlay/d66b58e3391ea8ce4c81316c72e22b332618f2a28b461a32ed673e8998cdaeb8/merged" + } +] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image(1)](podman-image.1.md)**, **[podman-image-unmount(1)](podman-image-unmount.1.md)**, **[podman-unshare(1)](podman-unshare.1.md)**, **mount(8)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-image-prune.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-image-prune.1.md new file mode 100644 index 000000000..836bb1bf4 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-image-prune.1.md @@ -0,0 +1,121 @@ +--- +title: podman-image-prune +version: v5.5.1 +--- + +% podman-image-prune 1 + +## NAME +podman-image-prune - Remove all unused images from the local store + +## SYNOPSIS +**podman image prune** [*options*] + +## DESCRIPTION +**podman image prune** removes all dangling images from local storage. With the `all` option, +all unused images are deleted (i.e., images not in use by any container). + +The image prune command does not prune cache images that only use layers that are necessary for other images. + +## OPTIONS +#### **--all**, **-a** + +Remove dangling images and images that have no associated containers. + +#### **--build-cache** + +Remove persistent build cache created for `--mount=type=cache`. + +#### **--external** + +Remove images even when they are used by external containers (e.g., build containers). + +#### **--filter**=*filters* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------:|--------------------------------------------------------------------------------------------------| +| label | Only remove images, with (or without, in the case of label!=[...] is used) the specified labels. | +| until | Only remove images created before given timestamp. | + + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes containers with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes containers without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not provide an interactive prompt for container removal. + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Remove all dangling images from local storage: +``` +$ sudo podman image prune + +WARNING! This will remove all dangling images. +Are you sure you want to continue? [y/N] y +f3e20dc537fb04cb51672a5cb6fdf2292e61d411315549391a0d1f64e4e3097e +324a7a3b2e0135f4226ffdd473e4099fd9e477a74230cdc35de69e84c0f9d907 +``` + +Remove all unused images from local storage without confirming: +``` +$ sudo podman image prune -a -f +f3e20dc537fb04cb51672a5cb6fdf2292e61d411315549391a0d1f64e4e3097e +324a7a3b2e0135f4226ffdd473e4099fd9e477a74230cdc35de69e84c0f9d907 +6125002719feb1ddf3030acab1df6156da7ce0e78e571e9b6e9c250424d6220c +91e732da5657264c6f4641b8d0c4001c218ae6c1adb9dcef33ad00cafd37d8b6 +e4e5109420323221f170627c138817770fb64832da7d8fe2babd863148287fca +77a57fa8285e9656dbb7b23d9efa837a106957409ddd702f995605af27a45ebe + +``` + +Remove all unused images from local storage since given time/hours: +``` +$ sudo podman image prune -a --filter until=2019-11-14T06:15:42.937792374Z + +WARNING! This will remove all dangling images. +Are you sure you want to continue? [y/N] y +e813d2135f17fadeffeea8159a34cfdd4c30b98d8111364b913a91fd930643e9 +5e6572320437022e2746467ddf5b3561bf06e099e8e6361df27e0b2a7ed0b17b +58fda2abf5042b35dfe04e5f8ee458a3cc26375bf309efb42c078b551a2055c7 +6d2bd30fe924d3414b64bd3920760617e6ced872364bc3bc6959a623252da002 +33d1c829be64a1e1d379caf4feec1f05a892c3ef7aa82c0be53d3c08a96c59c5 +f9f0a8a58c9e02a2b3250b88cc5c95b1e10245ca2c4161d19376580aaa90f55c +1ef14d5ede80db78978b25ad677fd3e897a578c3af614e1fda608d40c8809707 +45e1482040e441a521953a6da2eca9bafc769e15667a07c23720d6e0cafc3ab2 + +$ sudo podman image prune -f --filter until=10h +f3e20dc537fb04cb51672a5cb6fdf2292e61d411315549391a0d1f64e4e3097e +324a7a3b2e0135f4226ffdd473e4099fd9e477a74230cdc35de69e84c0f9d907 +``` + +Remove all unused images from local storage with label version 1.0: +``` +$ sudo podman image prune -a -f --filter label=version=1.0 +e813d2135f17fadeffeea8159a34cfdd4c30b98d8111364b913a91fd930643e9 +5e6572320437022e2746467ddf5b3561bf06e099e8e6361df27e0b2a7ed0b17b +58fda2abf5042b35dfe04e5f8ee458a3cc26375bf309efb42c078b551a2055c7 +6d2bd30fe924d3414b64bd3920760617e6ced872364bc3bc6959a623252da002 +33d1c829be64a1e1d379caf4feec1f05a892c3ef7aa82c0be53d3c08a96c59c5 +f9f0a8a58c9e02a2b3250b88cc5c95b1e10245ca2c4161d19376580aaa90f55c +1ef14d5ede80db78978b25ad677fd3e897a578c3af614e1fda608d40c8809707 +45e1482040e441a521953a6da2eca9bafc769e15667a07c23720d6e0cafc3ab2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-images(1)](podman-images.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) +December 2020, converted filter information from docs.docker.com documentation by Dan Walsh (dwalsh at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-image-scp.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-image-scp.1.md new file mode 100644 index 000000000..63b9dd6f5 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-image-scp.1.md @@ -0,0 +1,107 @@ +--- +title: podman-image-scp +version: v5.5.1 +--- + +% podman-image-scp 1 + +## NAME +podman-image-scp - Securely copy an image from one host to another + +## SYNOPSIS +**podman image scp** [*options*] *name*[:*tag*] + +## DESCRIPTION +**podman image scp** copies container images between hosts on a network. This command can copy images to the remote host or from the remote host as well as between two remote hosts. +Note: `::` is used to specify the image name depending on Podman is saving or loading. Images can also be transferred from rootful to rootless storage on the same machine without using sshd. This feature is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. + +**podman image scp [GLOBAL OPTIONS]** + +**podman image** *scp [OPTIONS] NAME[:TAG] [HOSTNAME::]* + +**podman image** *scp [OPTIONS] [HOSTNAME::]IMAGENAME* + +**podman image** *scp [OPTIONS] [HOSTNAME::]IMAGENAME [HOSTNAME::]* + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--quiet**, **-q** + +Suppress the output + +## EXAMPLES + +Copy specified image to local storage: +``` +$ podman image scp alpine +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image from local storage to remote connection: +``` +$ podman image scp alpine Fedora::/home/charliedoern/Documents/alpine +Getting image source signatures +Copying blob 72e830a4dff5 done +Copying config 85f9dc67c7 done +Writing manifest to image destination +Storing signatures +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image from remote connection to remote connection: +``` +$ podman image scp Fedora::alpine RHEL:: +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image via ssh to local storage: +``` +$ podman image scp charliedoern@192.168.68.126:22/run/user/1000/podman/podman.sock::alpine +WARN[0000] Unknown connection name given. Please use system connection add to specify the default remote socket location +Getting image source signatures +Copying blob 9450ef9feb15 [--------------------------------------] 0.0b / 0.0b +Copying config 1f97f0559c done +Writing manifest to image destination +Storing signatures +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image from root account to user accounts local storage: +``` +$ sudo podman image scp root@localhost::alpine username@localhost:: +Copying blob e2eb06d8af82 done +Copying config 696d33ca15 done +Writing manifest to image destination +Storing signatures +Getting image source signatures +Copying blob 5eb901baf107 skipped: already exists +Copying config 696d33ca15 done +Writing manifest to image destination +Storing signatures +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image from root account to local storage: +``` +$ sudo podman image scp root@localhost::alpine +Copying blob e2eb06d8af82 done +Copying config 696d33ca15 done +Writing manifest to image destination +Storing signatures +Getting image source signatures +Copying blob 5eb901baf107 +Copying config 696d33ca15 done +Writing manifest to image destination +Storing signatures +Loaded image: docker.io/library/alpine:latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-load(1)](podman-load.1.md)**, **[podman-save(1)](podman-save.1.md)**, **[podman-remote(1)](podman-remote.1.md)**, **[podman-system-connection-add(1)](podman-system-connection-add.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** + +## HISTORY +July 2021, Originally written by Charlie Doern diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-image-sign.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-image-sign.1.md new file mode 100644 index 000000000..b17ab6f5f --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-image-sign.1.md @@ -0,0 +1,94 @@ +--- +title: podman-image-sign +version: v5.5.1 +--- + +% podman-image-sign 1 + +## NAME +podman-image-sign - Create a signature for an image + +## SYNOPSIS +**podman image sign** [*options*] *image* [*image* ...] + +## DESCRIPTION +**podman image sign** creates a local signature for one or more local images that have +been pulled from a registry. The signature is written to a directory +derived from the registry configuration files in `$HOME/.config/containers/registries.d` if it exists, +otherwise `/etc/containers/registries.d` (unless overridden at compile-time), see **containers-registries.d(5)** for more information. +By default, the signature is written into `/var/lib/containers/sigstore` for root and `$HOME/.local/share/containers/sigstore` for non-root users + +## OPTIONS + +#### **--all**, **-a** + +Sign all the manifests of the multi-architecture image (default false). + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + +#### **--directory**, **-d**=*dir* + +Store the signatures in the specified directory. Default: /var/lib/containers/sigstore + +#### **--help**, **-h** + +Print usage statement. + +#### **--sign-by**=*identity* + +Override the default identity of the signature. + +## EXAMPLES +Sign the busybox image with the identity of foo@bar.com with a user's keyring and save the signature in /tmp/signatures/. + +```bash + $ sudo podman image sign --sign-by foo@bar.com --directory /tmp/signatures docker://privateregistry.example.com/foobar + + $ sudo podman image sign --authfile=/tmp/foobar.json --sign-by foo@bar.com --directory /tmp/signatures docker://privateregistry.example.com/foobar +``` + +## RELATED CONFIGURATION + +The write (and read) location for signatures is defined in YAML-based +configuration files in /etc/containers/registries.d/ for root, +or $HOME/.config/containers/registries.d for non-root users. When signing +an image, Podman uses those configuration files to determine +where to write the signature based on the name of the originating +registry or a default storage value unless overridden with the --directory +option. For example, consider the following configuration file. + +```yaml +docker: + privateregistry.example.com: + sigstore: file:///var/lib/containers/sigstore +``` + +When signing an image preceded with the registry name 'privateregistry.example.com', +the signature is written into sub-directories of +/var/lib/containers/sigstore/privateregistry.example.com. The use of 'sigstore' also means +the signature is 'read' from that same location on a pull-related function. + +## SEE ALSO +**[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.d(5)](https://github.com/containers/image/blob/main/docs/containers-registries.d.5.md)** + +## HISTORY +November 2018, Originally compiled by Qi Wang (qiwan at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-image-tree.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-image-tree.1.md new file mode 100644 index 000000000..0fabbe281 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-image-tree.1.md @@ -0,0 +1,91 @@ +--- +title: podman-image-tree +version: v5.5.1 +--- + +% podman-image-tree 1 + +## NAME +podman\-image\-tree - Print layer hierarchy of an image in a tree format + +## SYNOPSIS +**podman image tree** [*options*] *image:tag*|*image-id* + + +## DESCRIPTION +Prints layer hierarchy of an image in a tree format. +If no *tag* is provided, Podman defaults to `latest` for the *image*. +Layers are indicated with image tags as `Top Layer of`, when the tag is known locally. +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--whatrequires** + +Show all child images and layers of the specified image + +## EXAMPLES + +List image tree information on specified image: +``` +$ podman image tree docker.io/library/wordpress +Image ID: 6e880d17852f +Tags: [docker.io/library/wordpress:latest] +Size: 429.9MB +Image Layers +├── ID: 3c816b4ead84 Size: 58.47MB +├── ID: e39dad2af72e Size: 3.584kB +├── ID: b2d6a702383c Size: 213.6MB +├── ID: 94609408badd Size: 3.584kB +├── ID: f4dddbf86725 Size: 43.04MB +├── ID: 8f695df43a4c Size: 11.78kB +├── ID: c29d67bf8461 Size: 9.728kB +├── ID: 23f4315918f8 Size: 7.68kB +├── ID: d082f93a18b3 Size: 13.51MB +├── ID: 7ea8bedcac69 Size: 4.096kB +├── ID: dc3bbf7b3dc0 Size: 57.53MB +├── ID: fdbbc6404531 Size: 11.78kB +├── ID: 8d24785437c6 Size: 4.608kB +├── ID: 80715f9e8880 Size: 4.608kB Top Layer of: [docker.io/library/php:7.2-apache] +├── ID: c93cbcd6437e Size: 3.573MB +├── ID: dece674f3cd1 Size: 4.608kB +├── ID: 834f4497afda Size: 7.168kB +├── ID: bfe2ce1263f8 Size: 40.06MB +└── ID: 748e99b214cf Size: 11.78kB Top Layer of: [docker.io/library/wordpress:latest] +``` + +Show all child images and layers of the specified image: +``` +$ podman image tree ae96a4ad4f3f --whatrequires +Image ID: ae96a4ad4f3f +Tags: [docker.io/library/ruby:latest] +Size: 894.2MB +Image Layers +└── ID: 9c92106221c7 Size: 2.56kB Top Layer of: [docker.io/library/ruby\:latest] + ├── ID: 1b90f2b80ba0 Size: 3.584kB + │ ├── ID: 42b7d43ae61c Size: 169.5MB + │ ├── ID: 26dc8ba99ec3 Size: 2.048kB + │ ├── ID: b4f822db8d95 Size: 3.957MB + │ ├── ID: 044e9616ef8a Size: 164.7MB + │ ├── ID: bf94b940200d Size: 11.75MB + │ ├── ID: 4938e71bfb3b Size: 8.532MB + │ └── ID: f513034bf553 Size: 1.141MB + ├── ID: 1e55901c3ea9 Size: 3.584kB + ├── ID: b62835a63f51 Size: 169.5MB + ├── ID: 9f4e8857f3fd Size: 2.048kB + ├── ID: c3b392020e8f Size: 3.957MB + ├── ID: 880163026a0a Size: 164.8MB + ├── ID: 8c78b2b14643 Size: 11.75MB + ├── ID: 830370cfa182 Size: 8.532MB + └── ID: 567fd7b7bd38 Size: 1.141MB Top Layer of: [docker.io/circleci/ruby\\:latest] + +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +Feb 2019, Originally compiled by Kunal Kushwaha `` diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-image-trust.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-image-trust.1.md new file mode 100644 index 000000000..24da5466c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-image-trust.1.md @@ -0,0 +1,211 @@ +--- +title: podman-image-trust +version: v5.5.1 +--- + +% podman-image-trust 1 + +## NAME +podman\-image\-trust - Manage container registry image trust policy + + +## SYNOPSIS +**podman image trust** set|show [*options*] *registry[/repository]* + +## DESCRIPTION +Manages which registries to trust as a source of container images based on its location. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +The location is determined +by the transport and the registry host of the image. Using this container image `docker://docker.io/library/busybox` +as an example, `docker` is the transport and `docker.io` is the registry host. + +Trust is defined in **/etc/containers/policy.json** and is enforced when a user attempts to pull +a remote image from a registry. The trust policy in policy.json describes a registry scope (registry and/or repository) for the trust. This trust can use public keys for signed images. + +The scope of the trust is evaluated from most specific to the least specific. In other words, a policy may be: + + * Defined to an entire registry. + * Defined to a particular repository in that registry. + * Defined to a specific signed image inside of the registry. + +The following list are examples of valid scope values used in policy.json from most specific to the least specific: + +docker.io/library/busybox\:notlatest + +docker.io/library/busybox + +docker.io/library + +docker.io + +If no configuration is found for any of these scopes, the default value (specified by using "default" instead of REGISTRY[/REPOSITORY]) is used. + +Trust **type** provides a way to: + +Allowlist ("accept") or +Denylist ("reject") registries or +Require a simple signing signature (“signedBy”), +Require a sigstore signature ("sigstoreSigned"). + +Trust may be updated using the command **podman image trust set** for an existing trust scope. + +## OPTIONS +#### **--help**, **-h** + Print usage statement. + +### set OPTIONS + +#### **--pubkeysfile**, **-f**=*KEY1* + A path to an exported public key on the local system. Key paths + are referenced in policy.json. Any path to a file may be used but locating the file in **/etc/pki/containers** is recommended. Options may be used multiple times to + require an image be signed by multiple keys. The **--pubkeysfile** option is required for the **signedBy** and **sigstoreSigned** types. + +#### **--type**, **-t**=*value* + The trust type for this policy entry. + Accepted values: + **signedBy** (default): Require simple signing signatures with corresponding list of + public keys + **sigstoreSigned**: Require sigstore signatures with corresponding list of + public keys + **accept**: do not require any signatures for this + registry scope + **reject**: do not accept images for this registry scope + +### show OPTIONS + +#### **--json**, **-j** + Output trust as JSON for machine parsing + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--raw** + Output trust policy file as raw JSON + +## EXAMPLES + +Accept all unsigned images from a registry: +``` +sudo podman image trust set --type accept docker.io +``` + +Modify default trust policy: +``` +sudo podman image trust set -t reject default +``` + +Display system trust policy: +``` +podman image trust show +TRANSPORT NAME TYPE ID STORE +all default reject +repository docker.io/library accept +repository registry.access.redhat.com signed security@redhat.com https://access.redhat.com/webassets/docker/content/sigstore +repository registry.redhat.io signed security@redhat.com https://registry.redhat.io/containers/sigstore +repository docker.io reject +docker-daemon accept +``` + +Display trust policy file: +``` +podman image trust show --raw +{ + "default": [ + { + "type": "reject" + } + ], + "transports": { + "docker": { + "docker.io": [ + { + "type": "reject" + } + ], + "docker.io/library": [ + { + "type": "insecureAcceptAnything" + } + ], + "registry.access.redhat.com": [ + { + "type": "signedBy", + "keyType": "GPGKeys", + "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" + } + ], + "registry.redhat.io": [ + { + "type": "signedBy", + "keyType": "GPGKeys", + "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" + } + ] + }, + "docker-daemon": { + "": [ + { + "type": "insecureAcceptAnything" + } + ] + } + } +} +``` + +Display trust as JSON: +``` +podman image trust show --json +[ + { + "transport": "all", + "name": "* (default)", + "repo_name": "default", + "type": "reject" + }, + { + "transport": "repository", + "name": "docker.io", + "repo_name": "docker.io", + "type": "reject" + }, + { + "transport": "repository", + "name": "docker.io/library", + "repo_name": "docker.io/library", + "type": "accept" + }, + { + "transport": "repository", + "name": "registry.access.redhat.com", + "repo_name": "registry.access.redhat.com", + "sigstore": "https://access.redhat.com/webassets/docker/content/sigstore", + "type": "signed", + "gpg_id": "security@redhat.com" + }, + { + "transport": "repository", + "name": "registry.redhat.io", + "repo_name": "registry.redhat.io", + "sigstore": "https://registry.redhat.io/containers/sigstore", + "type": "signed", + "gpg_id": "security@redhat.com" + }, + { + "transport": "docker-daemon", + "type": "accept" + } +] +``` + +## SEE ALSO +**[containers-policy.json(5)](https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md)** + +## HISTORY +January 2019, updated by Tom Sweeney (tsweeney at redhat dot com) +December 2018, originally compiled by Qi Wang (qiwan at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-image-unmount.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-image-unmount.1.md new file mode 100644 index 000000000..a9fe266ba --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-image-unmount.1.md @@ -0,0 +1,55 @@ +--- +title: podman-image-unmount +version: v5.5.1 +--- + +% podman-image-unmount 1 + +## NAME +podman\-image\-unmount - Unmount an image's root filesystem + +## SYNOPSIS +**podman image unmount** [*options*] *image* [...] + +**podman image umount** [*options*] *image* [...] + +## DESCRIPTION +Unmounts the specified images' root file system, if no other processes +are using it. + +Image storage increments a mount counter each time an image is mounted. +When an image is unmounted, the mount counter is decremented, and the +image's root filesystem is physically unmounted only when the mount +counter reaches zero indicating no other processes are using the mount. +An unmount can be forced with the --force flag. + +## OPTIONS +#### **--all**, **-a** + +All of the currently mounted images are unmounted. + +#### **--force**, **-f** + +Force the unmounting of specified images' root file system, even if other +processes have mounted it. + +Note: Other processes using the file system can fail if the mount point is removed without their knowledge. + +## EXAMPLE + +Unmount image with a given ID: +``` +podman image unmount imageID +``` + +Unmount multiple images with given IDs: +``` +podman image unmount imageID1 imageID2 imageID3 +``` + +Unmount all images: +``` +podman image unmount --all +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image-mount(1)](podman-image-mount.1.md)**, **[podman-mount(1)](podman-mount.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-image.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-image.1.md new file mode 100644 index 000000000..4598def97 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-image.1.md @@ -0,0 +1,45 @@ +--- +title: podman-image +version: v5.5.1 +--- + +% podman-image 1 + +## NAME +podman\-image - Manage images + +## SYNOPSIS +**podman image** *subcommand* + +## DESCRIPTION +The image command allows the management of images + +## COMMANDS + +| Command | Man Page | Description | +| -------- | --------------------------------------------------- | ----------------------------------------------------------------------- | +| build | [podman-build(1)](podman-build.1.md) | Build a container using a Dockerfile. | +| diff | [podman-image-diff(1)](podman-image-diff.1.md) | Inspect changes on an image's filesystem. | +| exists | [podman-image-exists(1)](podman-image-exists.1.md) | Check if an image exists in local storage. | +| history | [podman-history(1)](podman-history.1.md) | Show the history of an image. | +| import | [podman-import(1)](podman-import.1.md) | Import a tarball and save it as a filesystem image. | +| inspect | [podman-image-inspect(1)](podman-image-inspect.1.md)| Display an image's configuration. | +| list | [podman-images(1)](podman-images.1.md) | List the container images on the system.(alias ls) | +| load | [podman-load(1)](podman-load.1.md) | Load an image from the docker archive. | +| mount | [podman-image-mount(1)](podman-image-mount.1.md) | Mount an image's root filesystem. | +| prune | [podman-image-prune(1)](podman-image-prune.1.md) | Remove all unused images from the local store. | +| pull | [podman-pull(1)](podman-pull.1.md) | Pull an image from a registry. | +| push | [podman-push(1)](podman-push.1.md) | Push an image from local storage to elsewhere. | +| rm | [podman-rmi(1)](podman-rmi.1.md) | Remove one or more locally stored images. | +| save | [podman-save(1)](podman-save.1.md) | Save an image to docker-archive or oci. | +| scp | [podman-image-scp(1)](podman-image-scp.1.md) | Securely copy an image from one host to another. | +| search | [podman-search(1)](podman-search.1.md) | Search a registry for an image. | +| sign | [podman-image-sign(1)](podman-image-sign.1.md) | Create a signature for an image. | +| tag | [podman-tag(1)](podman-tag.1.md) | Add an additional name to a local image. | +| tree | [podman-image-tree(1)](podman-image-tree.1.md) | Print layer hierarchy of an image in a tree format. | +| trust | [podman-image-trust(1)](podman-image-trust.1.md) | Manage container registry image trust policy. | +| unmount | [podman-image-unmount(1)](podman-image-unmount.1.md) | Unmount an image's root filesystem. | +| untag | [podman-untag(1)](podman-untag.1.md) | Remove one or more names from a locally-stored image. | + +## SEE ALSO +**[podman(1)](podman.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-images.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-images.1.md new file mode 100644 index 000000000..cd4f8935b --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-images.1.md @@ -0,0 +1,268 @@ +--- +title: podman-images +version: v5.5.1 +--- + +% podman-images 1 + +## NAME +podman\-images - List images in local storage + +## SYNOPSIS +**podman images** [*options*] [image] + +**podman image list** [*options*] [image] + +**podman image ls** [*options*] [image] + +## DESCRIPTION +Displays locally stored images, their names, and their IDs. + +## OPTIONS + +#### **--all**, **-a** + +Show all images (by default filter out the intermediate image layers). The default is false. + +#### **--digests** + +Show image digests + +#### **--filter**, **-f**=*filter* + +Provide filter values. + +The *filters* argument format is of `key=value` or `key!=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------------:|-----------------------------------------------------------------------------------------------| +| id | Filter by image ID. | +| before | Filter by images created before the given IMAGE (name or tag). | +| containers | Filter by images with a running container. | +| dangling | Filter by dangling (unused) images. | +| digest | Filter by digest. | +| intermediate | Filter by images that are dangling and have no children | +| label | Filter by images with (or without, in the case of label!=[...] is used) the specified labels. | +| manifest | Filter by images that are manifest lists. | +| readonly | Filter by read-only or read/write images. | +| reference | Filter by image name. | +| after/since | Filter by images created after the given IMAGE (name or tag). | +| until | Filter by images created until the given duration or time. | + +The `id` *filter* accepts the image ID string. + +The `before` *filter* accepts formats: `[:]`, `` or ``. + +The `containers` *filter* shows images that have a running container based on that image. + +The `dangling` *filter* shows images that are taking up disk space and serve no purpose. Dangling image is a file system layer that was used in a previous build of an image and is no longer referenced by any image. They are denoted with the `` tag, consume disk space and serve no active purpose. + +The `digest` *filter* accepts the image digest string. + +The `intermediate` *filter* shows images that are dangling and have no children. + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which shows images with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which shows images without the specified labels. + +The `manifest` *filter* shows images that are manifest lists. + +The `readonly` *filter* shows, as a default, both read-only and read/write images. Read-only images can be configured by modifying the `additionalimagestores` in the `/etc/containers/storage.conf` file. + +The `reference` *filter* accepts the pattern of an image reference `[:]`. + +The `after` or `since` *filter* accepts formats: `[:]`, `` or ``. + +The `until` *filter* accepts formats: golang duration, RFC3339 time, or a Unix timestamp and shows all images that are created until that time. + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|-----------------|------------------------------------------------------------| +| .Containers | Number of containers using this image | +| .Created | Elapsed time since the image was created | +| .CreatedAt | Time when the image was created, YYYY-MM-DD HH\:MM\:SS +nnnn | +| .CreatedSince | Same as .Created | +| .CreatedTime | Same as .CreatedAt | +| .Dangling | Same as .IsDangling | +| .Digest | Image digest | +| .History | History of the image layer | +| .ID | Image ID (truncated) | +| .Id | Image ID (full SHA) | +| .IsDangling | Is image dangling? (true/false) | +| .IsReadOnly | Is unage read-only? (true/false) | +| .Labels ... | map[] of labels | +| .Names | Image FQIN | +| .ParentId | Full SHA of parent image ID, or null (string) | +| .ReadOnly | Same as .IsReadOnly | +| .RepoDigests | map[] of zero or more repo/name@sha256\:SHA strings | +| .Repository | Image repository | +| .RepoTags | map[] of zero or more FQIN strings for this image | +| .SharedSize | Always seems to be 0 | +| .Size | Size of layer on disk (human-friendly string) | +| .Tag | Image tag | +| .VirtualSize | Size of layer on disk (bytes) | + +#### **--history** + +Display the history of image names. If an image gets re-tagged or untagged, then the image name history gets prepended (latest image first). This is especially useful when undoing a tag operation or an image does not contain any name because it has been untagged. + + +[//]: # (BEGIN included file options/no-trunc.md) +#### **--no-trunc** + +Do not truncate the output (default *false*). + +[//]: # (END included file options/no-trunc.md) + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Lists only the image IDs. + +#### **--sort**=*sort* + +Sort by *created*, *id*, *repository*, *size* or *tag* (default: **created**) +When sorting by *repository* it also sorts by the *tag* as second criteria to provide a stable output. + +## EXAMPLE + +List all non-dangling images in local storage: +``` +$ podman images +REPOSITORY TAG IMAGE ID CREATED SIZE +quay.io/podman/stable latest e0b7dabc3352 22 hours ago 331 MB +docker.io/library/alpine latest 9c6f07244728 5 days ago 5.83 MB +registry.fedoraproject.org/fedora latest 2ecb6df95994 3 weeks ago 169 MB +quay.io/libpod/testimage 20220615 f26aa69bb3f3 2 months ago 8.4 MB +``` + +List all images matching the specified name: +``` +$ podman images stable +REPOSITORY TAG IMAGE ID CREATED SIZE +quay.io/podman/stable latest e0b7dabc3352 22 hours ago 331 MB +``` + +List image ids of all images in containers storage: +``` +# podman image ls --quiet +e3d42bcaf643 +ebb91b73692b +4526339ae51c +``` + +List all images without showing the headers: +``` +# podman images --noheading +docker.io/kubernetes/pause latest e3d42bcaf643 3 years ago 251 kB + ebb91b73692b 4 weeks ago 27.2 MB +docker.io/library/ubuntu latest 4526339ae51c 6 weeks ago 126 MB +``` + +List all images without truncating output: +``` +# podman image list --no-trunc +REPOSITORY TAG IMAGE ID CREATED SIZE +docker.io/kubernetes/pause latest sha256:e3d42bcaf643097dd1bb0385658ae8cbe100a80f773555c44690d22c25d16b27 3 years ago 251 kB + sha256:ebb91b73692bd27890685846412ae338d13552165eacf7fcd5f139bfa9c2d6d9 4 weeks ago 27.2 MB +docker.io/library/ubuntu latest sha256:4526339ae51c3cdc97956a7a961c193c39dfc6bd9733b0d762a36c6881b5583a 6 weeks ago 126 MB +``` + +List all image content with the formatted content: +``` +# podman images --format "table {{.ID}} {{.Repository}} {{.Tag}}" +IMAGE ID REPOSITORY TAG +e3d42bcaf643 docker.io/kubernetes/pause latest +ebb91b73692b +4526339ae51c docker.io/library/ubuntu latest +``` + +List any image that is not tagged with a name (dangling): +``` +# podman images --filter dangling=true +REPOSITORY TAG IMAGE ID CREATED SIZE + ebb91b73692b 4 weeks ago 27.2 MB +``` + +List all images in JSON format: +``` +# podman images --format json +[ + { + "id": "e3d42bcaf643097dd1bb0385658ae8cbe100a80f773555c44690d22c25d16b27", + "names": [ + "docker.io/kubernetes/pause:latest" + ], + "digest": "sha256:0aecf73ff86844324847883f2e916d3f6984c5fae3c2f23e91d66f549fe7d423", + "created": "2014-07-19T07:02:32.267701596Z", + "size": 250665 + }, + { + "id": "ebb91b73692bd27890685846412ae338d13552165eacf7fcd5f139bfa9c2d6d9", + "names": [ + "\u003cnone\u003e" + ], + "digest": "sha256:ba7e4091d27e8114a205003ca6a768905c3395d961624a2c78873d9526461032", + "created": "2017-10-26T03:07:22.796184288Z", + "size": 27170520 + }, + { + "id": "4526339ae51c3cdc97956a7a961c193c39dfc6bd9733b0d762a36c6881b5583a", + "names": [ + "docker.io/library/ubuntu\:latest" + ], + "digest": "sha256:193f7734ddd68e0fb24ba9af8c2b673aecb0227b026871f8e932dab45add7753", + "created": "2017-10-10T20:59:05.10196344Z", + "size": 126085200 + } +] +``` + +List all images sorted by the specified column: +``` +# podman images --sort repository +REPOSITORY TAG IMAGE ID CREATED SIZE + 2460217d76fc About a minute ago 4.41 MB +docker.io/library/alpine latest 3fd9065eaf02 5 months ago 4.41 MB +localhost/myapp latest b2e0ad03474a About a minute ago 4.41 MB +registry.access.redhat.com/rhel7 latest 7a840db7f020 2 weeks ago 211 MB +registry.fedoraproject.org/fedora 27 801894bc0e43 6 weeks ago 246 MB +``` + +Show the difference between listed images in use versus all images, including dangling images: +``` +# podman images +REPOSITORY TAG IMAGE ID CREATED SIZE +localhost/test latest 18f0c080cd72 4 seconds ago 4.42 MB +docker.io/library/alpine latest 3fd9065eaf02 5 months ago 4.41 MB +# podman images -a +REPOSITORY TAG IMAGE ID CREATED SIZE +localhost/test latest 18f0c080cd72 6 seconds ago 4.42 MB + 270e70dc54c0 7 seconds ago 4.42 MB + 4ed6fbe43414 8 seconds ago 4.41 MB + 6b0df8e71508 8 seconds ago 4.41 MB +docker.io/library/alpine latest 3fd9065eaf02 5 months ago 4.41 MB +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +March 2017, Originally compiled by Dan Walsh `` diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-import.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-import.1.md new file mode 100644 index 000000000..e750608a6 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-import.1.md @@ -0,0 +1,121 @@ +--- +title: podman-import +version: v5.5.1 +--- + +% podman-import 1 + +## NAME +podman\-import - Import a tarball and save it as a filesystem image + +## SYNOPSIS +**podman import** [*options*] *path* [*reference*] + +**podman image import** [*options*] *path* [*reference*] + +## DESCRIPTION +**podman import** imports a tarball (possibly compressed using Gzip, Bzip2, XZ or Zstd) +and saves it as a filesystem image. Remote tarballs can be specified using a URL. +Various image instructions can be configured with the **--change** flag and +a commit message can be set using the **--message** flag. +**reference**, if present, is a tag to assign to the image. +**podman import** is used for importing from the archive generated by **podman export**, that includes the container's filesystem. To import the archive of image layers created by **podman save**, use **podman load**. +Note: `:` is a restricted character and cannot be part of the file name. + +## OPTIONS + +#### **--arch** + +Set architecture of the imported image. + +#### **--change**, **-c**=*instruction* + +Apply the following possible instructions to the created image: +**CMD** | **ENTRYPOINT** | **ENV** | **EXPOSE** | **LABEL** | **STOPSIGNAL** | **USER** | **VOLUME** | **WORKDIR** + +Can be set multiple times + +#### **--help**, **-h** + +Print usage statement + +#### **--message**, **-m**=*message* + +Set commit message for imported image + +#### **--os** + +Set OS of the imported image. + +#### **--quiet**, **-q** + +Shows progress on the import + +#### **--variant** + +Set variant of the imported image. + +## EXAMPLES + +Import the selected tarball into new image, specifying the CMD, ENTRYPOINT and LABEL: +``` +$ podman import --change CMD=/bin/bash --change ENTRYPOINT=/bin/sh --change LABEL=blue=image ctr.tar image-imported +Getting image source signatures +Copying blob sha256:b41deda5a2feb1f03a5c1bb38c598cbc12c9ccd675f438edc6acd815f7585b86 + 25.80 MB / 25.80 MB [======================================================] 0s +Copying config sha256:c16a6d30f3782288ec4e7521c754acc29d37155629cb39149756f486dae2d4cd + 448 B / 448 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +db65d991f3bbf7f31ed1064db9a6ced7652e3f8166c4736aa9133dadd3c7acb3 +``` + +Import the selected tarball into new image, specifying the CMD, ENTRYPOINT and LABEL: +``` +$ podman import --change 'ENTRYPOINT ["/bin/sh","-c","test-image"]' --change LABEL=blue=image test-image.tar image-imported +Getting image source signatures +Copying blob e3b0c44298fc skipped: already exists +Copying config 1105523502 done +Writing manifest to image destination +Storing signatures +110552350206337183ceadc0bdd646dc356e06514c548b69a8917b4182414b +``` + +Import new tagged image from stdin in quiet mode: +``` +$ cat ctr.tar | podman -q import --message "importing the ctr.tar file" - image-imported +db65d991f3bbf7f31ed1064db9a6ced7652e3f8166c4736aa9133dadd3c7acb3 +``` + +Import an image from stdin: +``` +$ cat ctr.tar | podman import - +Getting image source signatures +Copying blob sha256:b41deda5a2feb1f03a5c1bb38c598cbc12c9ccd675f438edc6acd815f7585b86 + 25.80 MB / 25.80 MB [======================================================] 0s +Copying config sha256:d61387b4d5edf65edee5353e2340783703074ffeaaac529cde97a8357eea7645 + 378 B / 378 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +db65d991f3bbf7f31ed1064db9a6ced7652e3f8166c4736aa9133dadd3c7acb3 +``` + +Import named image from tarball via a URL: +``` +$ podman import http://example.com/ctr.tar url-image +Downloading from "http://example.com/ctr.tar" +Getting image source signatures +Copying blob sha256:b41deda5a2feb1f03a5c1bb38c598cbc12c9ccd675f438edc6acd815f7585b86 + 25.80 MB / 25.80 MB [======================================================] 0s +Copying config sha256:5813fe8a3b18696089fd09957a12e88bda43dc1745b5240879ffffe93240d29a + 419 B / 419 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +db65d991f3bbf7f31ed1064db9a6ced7652e3f8166c4736aa9133dadd3c7acb3 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-export(1)](podman-export.1.md)** + +## HISTORY +November 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-info.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-info.1.md new file mode 100644 index 000000000..ccea54834 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-info.1.md @@ -0,0 +1,409 @@ +--- +title: podman-info +version: v5.5.1 +--- + +% podman-info 1 + +## NAME +podman\-info - Display Podman related system information + +## SYNOPSIS +**podman info** [*options*] + +**podman system info** [*options*] + +## DESCRIPTION + +Displays information pertinent to the host, current storage stats, configured container registries, and build of podman. + + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change output format to "json" or a Go template. + +| **Placeholder** | **Info pertaining to ...** | +| ------------------- | --------------------------------------- | +| .Host ... | ...the host on which podman is running | +| .Plugins ... | ...external plugins | +| .Registries ... | ...configured registries | +| .Store ... | ...the storage driver and paths | +| .Version ... | ...podman version | + +Each of the above branch out into further subfields, more than can +reasonably be enumerated in this document. + +## EXAMPLES + +Run `podman info` for a YAML formatted response: +``` +$ podman info +host: + arch: amd64 + buildahVersion: 1.23.0 + cgroupControllers: [] + cgroupManager: systemd + cgroupVersion: v2 + conmon: + package: conmon-2.0.29-2.fc34.x86_64 + path: /usr/bin/conmon + version: 'conmon version 2.0.29, commit: ' + cpu_utilization: + idle_percent: 96.84 + system_percent: 0.71 + user_percent: 2.45 + cpus: 8 + distribution: + distribution: fedora + variant: workstation + version: "34" + eventLogger: journald + hostname: localhost.localdomain + idMappings: + gidmap: + - container_id: 0 + host_id: 3267 + size: 1 + - container_id: 1 + host_id: 100000 + size: 65536 + uidmap: + - container_id: 0 + host_id: 3267 + size: 1 + - container_id: 1 + host_id: 100000 + size: 65536 + kernel: 5.13.13-200.fc34.x86_64 + linkmode: dynamic + logDriver: journald + memFree: 1833385984 + memTotal: 16401895424 + networkBackend: cni + networkBackendInfo: + backend: cni + dns: + package: podman-plugins-3.4.4-1.fc34.x86_64 + path: /usr/libexec/cni/dnsname + version: |- + CNI dnsname plugin + version: 1.3.1 + commit: unknown + package: |- + containernetworking-plugins-1.0.1-1.fc34.x86_64 + podman-plugins-3.4.4-1.fc34.x86_64 + path: /usr/libexec/cni + ociRuntime: + name: crun + package: crun-1.0-1.fc34.x86_64 + path: /usr/bin/crun + version: |- + crun version 1.0 + commit: 139dc6971e2f1d931af520188763e984d6cdfbf8 + spec: 1.0.0 + +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL + os: linux + pasta: + executable: /usr/bin/passt + package: passt-0^20221116.gace074c-1.fc34.x86_64 + version: | + passt 0^20221116.gace074c-1.fc34.x86_64 + Copyright Red Hat + GNU Affero GPL version 3 or later + This is free software: you are free to change and redistribute it. + There is NO WARRANTY, to the extent permitted by law. + remoteSocket: + path: /run/user/3267/podman/podman.sock + security: + apparmorEnabled: false + capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID + rootless: true + seccompEnabled: true + seccompProfilePath: /usr/share/containers/seccomp.json + selinuxEnabled: true + serviceIsRemote: false + slirp4netns: + executable: /bin/slirp4netns + package: slirp4netns-1.1.12-2.fc34.x86_64 + version: |- + slirp4netns version 1.1.12 + commit: 7a104a101aa3278a2152351a082a6df71f57c9a3 + libslirp: 4.4.0 + SLIRP_CONFIG_VERSION_MAX: 3 + libseccomp: 2.5.0 + swapFree: 15687475200 + swapTotal: 16886259712 + uptime: 47h 15m 9.91s (Approximately 1.96 days) +plugins: + log: + - k8s-file + - none + - journald + network: + - bridge + - macvlan + volume: + - local +registries: + search: + - registry.fedoraproject.org + - registry.access.redhat.com + - docker.io + - quay.io +store: + configFile: /home/dwalsh/.config/containers/storage.conf + containerStore: + number: 9 + paused: 0 + running: 1 + stopped: 8 + graphDriverName: overlay + graphOptions: {} + graphRoot: /home/dwalsh/.local/share/containers/storage + graphRootAllocated: 510389125120 + graphRootUsed: 129170714624 + graphStatus: + Backing Filesystem: extfs + Native Overlay Diff: "true" + Supports d_type: "true" + Using metacopy: "false" + imageCopyTmpDir: /home/dwalsh/.local/share/containers/storage/tmp + imageStore: + number: 5 + runRoot: /run/user/3267/containers + transientStore: false + volumePath: /home/dwalsh/.local/share/containers/storage/volumes +version: + APIVersion: 4.0.0 + Built: 1631648722 + BuiltTime: Tue Sep 14 15:45:22 2021 + GitCommit: 23677f92dd83e96d2bc8f0acb611865fb8b1a56d + GoVersion: go1.16.6 + OsArch: linux/amd64 + Version: 4.0.0 +``` + +Run `podman info --format json` for a JSON formatted response: +``` +$ podman info --format json +{ + "host": { + "arch": "amd64", + "buildahVersion": "1.23.0", + "cgroupManager": "systemd", + "cgroupVersion": "v2", + "cgroupControllers": [], + "conmon": { + "package": "conmon-2.0.29-2.fc34.x86_64", + "path": "/usr/bin/conmon", + "version": "conmon version 2.0.29, commit: " + }, + "cpus": 8, + "distribution": { + "distribution": "fedora", + "version": "34" + }, + "eventLogger": "journald", + "hostname": "localhost.localdomain", + "idMappings": { + "gidmap": [ + { + "container_id": 0, + "host_id": 3267, + "size": 1 + }, + { + "container_id": 1, + "host_id": 100000, + "size": 65536 + } + ], + "uidmap": [ + { + "container_id": 0, + "host_id": 3267, + "size": 1 + }, + { + "container_id": 1, + "host_id": 100000, + "size": 65536 + } + ] + }, + "kernel": "5.13.13-200.fc34.x86_64", + "logDriver": "journald", + "memFree": 1785753600, + "memTotal": 16401895424, + "networkBackend": "cni", + "networkBackendInfo": { + "backend": "cni", + "package": "containernetworking-plugins-1.0.1-1.fc34.x86_64\npodman-plugins-3.4.4-1.fc34.x86_64", + "path": "/usr/libexec/cni", + "dns": { + "version": "CNI dnsname plugin\nversion: 1.3.1\ncommit: unknown", + "package": "podman-plugins-3.4.4-1.fc34.x86_64", + "path": "/usr/libexec/cni/dnsname" + } + }, + "ociRuntime": { + "name": "crun", + "package": "crun-1.0-1.fc34.x86_64", + "path": "/usr/bin/crun", + "version": "crun version 1.0\ncommit: 139dc6971e2f1d931af520188763e984d6cdfbf8\nspec: 1.0.0\n+SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL" + }, + "os": "linux", + "remoteSocket": { + "path": "/run/user/3267/podman/podman.sock" + }, + "serviceIsRemote": false, + "security": { + "apparmorEnabled": false, + "capabilities": "CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID", + "rootless": true, + "seccompEnabled": true, + "seccompProfilePath": "/usr/share/containers/seccomp.json", + "selinuxEnabled": true + }, + "slirp4netns": { + "executable": "/bin/slirp4netns", + "package": "slirp4netns-1.1.12-2.fc34.x86_64", + "version": "slirp4netns version 1.1.12\ncommit: 7a104a101aa3278a2152351a082a6df71f57c9a3\nlibslirp: 4.4.0\nSLIRP_CONFIG_VERSION_MAX: 3\nlibseccomp: 2.5.0" + }, + "pasta": { + "executable": "/usr/bin/passt", + "package": "passt-0^20221116.gace074c-1.fc34.x86_64", + "version": "passt 0^20221116.gace074c-1.fc34.x86_64\nCopyright Red Hat\nGNU Affero GPL version 3 or later \u003chttps://www.gnu.org/licenses/agpl-3.0.html\u003e\nThis is free software: you are free to change and redistribute it.\nThere is NO WARRANTY, to the extent permitted by law.\n" + }, + "swapFree": 15687475200, + "swapTotal": 16886259712, + "uptime": "47h 17m 29.75s (Approximately 1.96 days)", + "linkmode": "dynamic" + }, + "store": { + "configFile": "/home/dwalsh/.config/containers/storage.conf", + "containerStore": { + "number": 9, + "paused": 0, + "running": 1, + "stopped": 8 + }, + "graphDriverName": "overlay", + "graphOptions": { + + }, + "graphRoot": "/home/dwalsh/.local/share/containers/storage", + "graphStatus": { + "Backing Filesystem": "extfs", + "Native Overlay Diff": "true", + "Supports d_type": "true", + "Using metacopy": "false" + }, + "imageCopyTmpDir": "/home/dwalsh/.local/share/containers/storage/tmp", + "imageStore": { + "number": 5 + }, + "runRoot": "/run/user/3267/containers", + "volumePath": "/home/dwalsh/.local/share/containers/storage/volumes", + "transientStore": false + }, + "registries": { + "search": [ + "registry.fedoraproject.org", + "registry.access.redhat.com", + "docker.io", + "quay.io" +] + }, + "plugins": { + "volume": [ + "local" + ], + "network": [ + "bridge", + "macvlan" + ], + "log": [ + "k8s-file", + "none", + "journald" + ] + }, + "version": { + "APIVersion": "4.0.0", + "Version": "4.0.0", + "GoVersion": "go1.16.6", + "GitCommit": "23677f92dd83e96d2bc8f0acb611865fb8b1a56d", + "BuiltTime": "Tue Sep 14 15:45:22 2021", + "Built": 1631648722, + "OsArch": "linux/amd64" + } +} +``` + +#### Extracting the list of container registries with a Go template + +If shell completion is enabled, type `podman info --format={{.` and then press `[TAB]` twice. + +``` +$ podman info --format={{. +{{.Host. {{.Plugins. {{.Registries}} {{.Store. {{.Version. +``` + +Press `R` `[TAB]` `[ENTER]` to print the registries information. + +``` +$ podman info -f {{.Registries}} +map[search:[registry.fedoraproject.org registry.access.redhat.com docker.io quay.io]] +$ +``` + +The output still contains a map and an array. The map value can be extracted with + +``` +$ podman info -f '{{index .Registries "search"}}' +[registry.fedoraproject.org registry.access.redhat.com docker.io quay.io] +``` + +The array can be printed as one entry per line + +``` +$ podman info -f '{{range index .Registries "search"}}{{.}}\n{{end}}' +registry.fedoraproject.org +registry.access.redhat.com +docker.io +quay.io + +``` + +#### Extracting the list of container registries from JSON with jq + +The command-line JSON processor [__jq__](https://stedolan.github.io/jq/) can be used to extract the list +of container registries. + +``` +$ podman info -f json | jq '.registries["search"]' +[ + "registry.fedoraproject.org", + "registry.access.redhat.com", + "docker.io", + "quay.io" +] +``` + +The array can be printed as one entry per line + +``` +$ podman info -f json | jq -r '.registries["search"] | .[]' +registry.fedoraproject.org +registry.access.redhat.com +docker.io +quay.io +``` + +Note, the Go template struct fields start with upper case. When running `podman info` or `podman info --format=json`, the same names start with lower case. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-init.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-init.1.md new file mode 100644 index 000000000..dd5c7fcf1 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-init.1.md @@ -0,0 +1,61 @@ +--- +title: podman-init +version: v5.5.1 +--- + +% podman-init 1 + +## NAME +podman\-init - Initialize one or more containers + +## SYNOPSIS +**podman init** [*options*] *container* [*container*...] + +**podman container init** [*options*] *container* [*container*...] + +## DESCRIPTION +Initialize one or more containers. +You may use container IDs or names as input. +Initializing a container performs all tasks necessary for starting the container (mounting filesystems, creating an OCI spec, initializing the container network) but does not start the container. +If a container is not initialized, the `podman start` and `podman run` commands initialize it automatically prior to starting it. +This command is intended to be used for inspecting a container's filesystem or OCI spec prior to starting it. +This can be used to inspect the container before it runs, or debug why a container is failing to run. + +## OPTIONS + +#### **--all**, **-a** + +Initialize all containers. Containers that have already initialized (including containers that have been started and are running) are ignored. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Initialize specified container with a given ID. +``` +podman init 35480fc9d568 +``` + +Initialize specified container with a given name. +``` +podman init test1 +``` + +Initialize the latest container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +podman init --latest +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-start(1)](podman-start.1.md)** + +## HISTORY +April 2019, Originally compiled by Matthew Heon diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-inspect.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-inspect.1.md new file mode 100644 index 000000000..2977b9570 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-inspect.1.md @@ -0,0 +1,185 @@ +--- +title: podman-inspect +version: v5.5.1 +--- + +% podman-inspect 1 + +## NAME +podman\-inspect - Display a container, image, volume, network, or pod's configuration + +## SYNOPSIS +**podman inspect** [*options*] *name* [...] + +## DESCRIPTION + +This displays the low-level information on containers and images identified by name or ID. By default, this renders +all results in a JSON array. If the inspect type is all, the order of inspection is: containers, images, volumes, network, pods. + If a container has the same name as an image, then the container JSON is returned, and so on. + If a format is specified, the given template is executed for each result. + +For more inspection options, see also +[podman-container-inspect(1)](podman-container-inspect.1.md), +[podman-image-inspect(1)](podman-image-inspect.1.md), +[podman-network-inspect(1)](podman-network-inspect.1.md), +[podman-pod-inspect(1)](podman-pod-inspect.1.md), and +[podman-volume-inspect(1)](podman-volume-inspect.1.md). + +## OPTIONS + +#### **--format**, **-f**=*format* + +Format the output using the given Go template. +The keys of the returned JSON can be used as the values for the --format flag (see examples below). + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--size**, **-s** + +In addition to normal output, display the total file size if the type is a container. + +#### **--type**, **-t**=*type* + +Return JSON for the specified type. Type can be 'container', 'image', 'volume', 'network', 'pod', or 'all' (default: all) +(Only meaningful when invoked as *podman inspect*) + +## EXAMPLE + +Inspect the fedora image: +``` +# podman inspect fedora +[ + { + "Id": "f0858ad3febdf45bb2e5501cb459affffacef081f79eaa436085c3b6d9bd46ca", + "Digest": "sha256:d4f7df6b691d61af6cee7328f82f1d8afdef63bc38f58516858ae3045083924a", + "RepoTags": [ + "docker.io/library/fedora:latest" + ], + "RepoDigests": [ + "docker.io/library/fedora@sha256:8fa60b88e2a7eac8460b9c0104b877f1aa0cea7fbc03c701b7e545dacccfb433", + "docker.io/library/fedora@sha256:d4f7df6b691d61af6cee7328f82f1d8afdef63bc38f58516858ae3045083924a" + ], + "Parent": "", + "Comment": "", + "Created": "2019-10-29T03:23:37.695123423Z", + "Config": { + "Env": [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "DISTTAG=f31-updates-candidatecontainer", + "FGC=f31-updates-candidate", + "FBR=f31-updates-candidate" + ], + "Cmd": [ + "/bin/bash" + ], + "Labels": { + "maintainer": "Clement Verna \u003ccverna@fedoraproject.org\u003e" + } + }, + "Version": "18.06.1-ce", + "Author": "", + "Architecture": "amd64", + "Os": "linux", + "Size": 201096840, + "VirtualSize": 201096840, + "GraphDriver": { + "Name": "overlay", + "Data": { + "UpperDir": "/home/user/.local/share/containers/storage/overlay/2ae3cee18c8ef9e0d448649747dab81c4f1ca2714a8c4550eff49574cab262c9/diff", + "WorkDir": "/home/user/.local/share/containers/storage/overlay/2ae3cee18c8ef9e0d448649747dab81c4f1ca2714a8c4550eff49574cab262c9/work" + } + }, + "RootFS": { + "Type": "layers", + "Layers": [ + "sha256:2ae3cee18c8ef9e0d448649747dab81c4f1ca2714a8c4550eff49574cab262c9" + ] + }, + "Labels": { + "maintainer": "Clement Verna \u003ccverna@fedoraproject.org\u003e" + }, + "Annotations": {}, + "ManifestType": "application/vnd.docker.distribution.manifest.v2+json", + "User": "", + "History": [ + { + "created": "2019-01-16T21:21:55.569693599Z", + "created_by": "/bin/sh -c #(nop) LABEL maintainer=Clement Verna \u003ccverna@fedoraproject.org\u003e", + "empty_layer": true + }, + { + "created": "2019-09-27T21:21:07.784469821Z", + "created_by": "/bin/sh -c #(nop) ENV DISTTAG=f31-updates-candidatecontainer FGC=f31-updates-candidate FBR=f31-updates-candidate", + "empty_layer": true + }, + { + "created": "2019-10-29T03:23:37.355187998Z", + "created_by": "/bin/sh -c #(nop) ADD file:298f828afc880ccde9205fc4418435d5e696ad165e283f0530d0b1a74326d6dc in / " + }, + { + "created": "2019-10-29T03:23:37.695123423Z", + "created_by": "/bin/sh -c #(nop) CMD [\"/bin/bash\"]", + "empty_layer": true + } + ], + "NamesHistory": [] + } +] +``` + +Inspect the specified image with the `ImageName` format specifier: +``` +# podman inspect a04 --format "{{.ImageName}}" +fedora +``` + +Inspect the specified image for `GraphDriver` format specifier: +``` +# podman inspect a04 --format "{{.GraphDriver.Name}}" +overlay +``` + +Inspect the specified image for its `Size` format specifier: +``` +# podman image inspect --format "size: {{.Size}}" alpine +size: 4405240 +``` + +Inspect the latest container created for `EffectiveCaps` format specifier. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman container inspect --latest --format {{.EffectiveCaps}} +[CAP_CHOWN CAP_DAC_OVERRIDE CAP_FSETID CAP_FOWNER CAP_SETGID CAP_SETUID CAP_SETFCAP CAP_SETPCAP CAP_NET_BIND_SERVICE CAP_KILL] +``` + +Inspect the specified pod for the `Name` format specifier: +``` +# podman inspect myPod --type pod --format "{{.Name}}" +myPod +``` + +Inspect the specified volume for the `Name` format specifier: +``` +# podman inspect myVolume --type volume --format "{{.Name}}" +myVolume +``` + +Inspect the specified network for the `Name` format specifier: +``` +# podman inspect nyNetwork --type network --format "{{.name}}" +myNetwork +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container-inspect(1)](podman-container-inspect.1.md)**, **[podman-image-inspect(1)](podman-image-inspect.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-pod-inspect(1)](podman-pod-inspect.1.md)**, **[podman-volume-inspect(1)](podman-volume-inspect.1.md)** + +## HISTORY +July 2017, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-kill.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-kill.1.md new file mode 100644 index 000000000..e00c373e4 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-kill.1.md @@ -0,0 +1,91 @@ +--- +title: podman-kill +version: v5.5.1 +--- + +% podman-kill 1 + +## NAME +podman\-kill - Kill the main process in one or more containers + +## SYNOPSIS +**podman kill** [*options*] [*container* ...] + +**podman container kill** [*options*] [*container* ...] + +## DESCRIPTION +The main process inside each container specified is sent SIGKILL or any signal specified with the `--signal` option. + +## OPTIONS +#### **--all**, **-a** + +Signal all running and paused containers. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and kill the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/signal.md) +#### **--signal**, **-s**=**signal** + +Signal to send to the container. For more information on Linux signals, refer to *signal(7)*. +The default is **SIGKILL**. + +[//]: # (END included file options/signal.md) + +## EXAMPLE + +Kill container with a given name: +``` +podman kill mywebserver +``` + +Kill container with a given ID: +``` +podman kill 860a4b23 +``` + +Terminate container by sending `TERM` signal: +``` +podman kill --signal TERM 860a4b23 +``` + +Kill the latest container. (This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines): +``` +podman kill --latest +``` + +Terminate all containers by sending `KILL` signal: +``` +podman kill --signal KILL -a +``` + +Kill containers using ID specified in a given files: +``` +podman kill --cidfile /home/user/cidfile-1 +podman kill --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-stop(1)](podman-stop.1.md)** + +## HISTORY +September 2017, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-kube-apply.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-kube-apply.1.md new file mode 100644 index 000000000..c88cdc1c5 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-kube-apply.1.md @@ -0,0 +1,79 @@ +--- +title: podman-kube-apply +version: v5.5.1 +--- + +% podman-kube-apply 1 + +## NAME +podman-kube-apply - Apply Kubernetes YAML based on containers, pods, or volumes to a Kubernetes cluster + +## SYNOPSIS +**podman kube apply** [*options*] [*container...* | *pod...* | *volume...*] + +## DESCRIPTION +**podman kube apply** deploys a podman container, pod, or volume to a Kubernetes cluster. Use the `--file` option to deploy a Kubernetes YAML (v1 specification) to a Kubernetes cluster as well. + +Note that the Kubernetes YAML file can be used to run the deployment in Podman via podman-play-kube(1). + +## OPTIONS + +#### **--ca-cert-file**=*ca cert file path | "insecure"* + +The path to the CA cert file for the Kubernetes cluster. Usually the kubeconfig has the CA cert file data and `generate kube` automatically picks that up if it is available in the kubeconfig. If no CA cert file data is available, set this to `insecure` to bypass the certificate verification. + +#### **--file**, **-f**=*kube yaml filepath* + +Path to the kubernetes yaml file to deploy onto the kubernetes cluster. This file can be generated using the `podman kube generate` command. The input may be in the form of a yaml file, or stdin. For stdin, use `--file=-`. + +#### **--kubeconfig**, **-k**=*kubeconfig filepath* + +Path to the kubeconfig file to be used when deploying the generated kube yaml to the Kubernetes cluster. The environment variable `KUBECONFIG` can be used to set the path for the kubeconfig file as well. +Note: A kubeconfig can have multiple cluster configurations, but `kube generate` always picks the first cluster configuration in the given kubeconfig. + +#### **--ns**=*namespace* + +The namespace or project to deploy the workloads of the generated kube yaml to in the Kubernetes cluster. + +#### **--service**, **-s** + +Used to create a service for the corresponding container or pod being deployed to the cluster. In particular, if the container or pod has portmap bindings, the service specification includes a NodePort declaration to expose the service. A random port is assigned by Podman in the service specification that is deployed to the cluster. + +## EXAMPLES + +Apply a podman volume and container to the "default" namespace in a Kubernetes cluster. +``` +$ podman kube apply --kubeconfig /tmp/kubeconfig myvol vol-test-1 +Deploying to cluster... +Successfully deployed workloads to cluster! +$ kubectl get pods +NAME READY STATUS RESTARTS AGE +vol-test-1-pod 1/1 Running 0 9m +``` + +Apply a Kubernetes YAML file to the "default" namespace in a Kubernetes cluster. +``` +$ podman kube apply --kubeconfig /tmp/kubeconfig -f vol.yaml +Deploying to cluster... +Successfully deployed workloads to cluster! +$ kubectl get pods +NAME READY STATUS RESTARTS AGE +vol-test-2-pod 1/1 Running 0 9m +``` + +Apply a Kubernetes YAML file to the "test1" namespace in a Kubernetes cluster. +``` +$ podman kube apply --kubeconfig /tmp/kubeconfig --ns test1 vol-test-3 +Deploying to cluster... +Successfully deployed workloads to cluster! +$ kubectl get pods --namespace test1 +NAME READY STATUS RESTARTS AGE +vol-test-3-pod 1/1 Running 0 9m + +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)** + +## HISTORY +September 2022, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-kube-down.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-kube-down.1.md new file mode 100644 index 000000000..b47b34206 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-kube-down.1.md @@ -0,0 +1,76 @@ +--- +title: podman-kube-down +version: v5.5.1 +--- + +% podman-kube-down 1 + +## NAME +podman-kube-down - Remove containers and pods based on Kubernetes YAML + +## SYNOPSIS +**podman kube down** [*options*] *file.yml|-|https://website.io/file.yml* + +## DESCRIPTION +**podman kube down** reads a specified Kubernetes YAML file, tearing down pods that were created by the `podman kube play` command via the same Kubernetes YAML +file. Any volumes that were created by the previous `podman kube play` command remain intact unless the `--force` options is used. If the YAML file is +specified as `-`, `podman kube down` reads the YAML from stdin. The input can also be a URL that points to a YAML file such as https://podman.io/demo.yml. +`podman kube down` tears down the pods and containers created by `podman kube play` via the same Kubernetes YAML from the URL. However, +`podman kube down` does not work with a URL if the YAML file the URL points to has been changed or altered since the creation of the pods and containers using +`podman kube play`. + +## OPTIONS + +#### **--force** + +Tear down the volumes linked to the PersistentVolumeClaims as part --down + +## EXAMPLES + +Example YAML file `demo.yml`: +``` +apiVersion: v1 +kind: Pod +metadata: +... +spec: + containers: + - command: + - top + - name: container + value: podman + image: foobar +... +``` + +Remove the pod and containers as described in the `demo.yml` file +``` +$ podman kube down demo.yml +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Remove the pod and containers as described in the `demo.yml` file YAML sent to stdin +``` +$ cat demo.yml | podman kube play - +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Remove the pods and containers as described in the `demo.yml` file YAML read from a URL +``` +$ podman kube down https://podman.io/demo.yml +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` +`podman kube down` does not work with a URL if the YAML file the URL points to has been changed +or altered since it was used to create the pods and containers. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-kube(1)](podman-kube.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-kube-generate.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-kube-generate.1.md new file mode 100644 index 000000000..9d410e75c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-kube-generate.1.md @@ -0,0 +1,254 @@ +--- +title: podman-kube-generate +version: v5.5.1 +--- + +% podman-kube-generate 1 + +## NAME +podman-kube-generate - Generate Kubernetes YAML based on containers, pods or volumes + +## SYNOPSIS +**podman kube generate** [*options*] *container...* | *pod...* | *volume...* + +## DESCRIPTION +**podman kube generate** generates Kubernetes YAML (v1 specification) from Podman containers, pods or volumes. Regardless of whether +the input is for containers or pods, Podman generates the specification as a Pod by default. The input may be in the form +of one or more containers, pods or volumes names or IDs. + +`Podman Containers or Pods` + +Volumes appear in the generated YAML according to two different volume types. Bind-mounted volumes become *hostPath* volume types and named volumes become *persistentVolumeClaim* volume types. Generated *hostPath* volume types are one of three subtypes depending on the state of the host path: *DirectoryOrCreate* when no file or directory exists at the host, *Directory* when host path is a directory, or *File* when host path is a file. The value for *claimName* for a *persistentVolumeClaim* is the name of the named volume registered in Podman. + +Potential name conflicts between volumes are avoided by using a standard naming scheme for each volume type. The *hostPath* volume types are named according to the path on the host machine, replacing forward slashes with hyphens less any leading and trailing forward slashes. The special case of the filesystem root, `/`, translates to the name `root`. Additionally, the name is suffixed with `-host` to avoid naming conflicts with *persistentVolumeClaim* volumes. Each *persistentVolumeClaim* volume type uses the name of its associated named volume suffixed with `-pvc`. + +Note that if an init container is created with type `once` and the pod has been started, it does not show up in the generated kube YAML as `once` type init containers are deleted after they are run. If the pod has only been created and not started, it is in the generated kube YAML. +Init containers created with type `always` are always generated in the kube YAML as they are never deleted, even after running to completion. + +*Note*: When using volumes and generating a Kubernetes YAML for an unprivileged and rootless podman container on an **SELinux enabled system**, one of the following options must be completed: + * Add the "privileged: true" option to the pod spec + * Add `type: spc_t` under the `securityContext` `seLinuxOptions` in the pod spec + * Relabel the volume via the CLI command `chcon -t container_file_t -R ` + +Once completed, the correct permissions are in place to access the volume when the pod/container is created in a Kubernetes cluster. + +Note that the generated Kubernetes YAML file can be used to re-run the deployment via podman-play-kube(1). + +Note that if the pod being generated was created with the **--infra-name** flag set, then the generated kube yaml will have the **io.podman.annotations.infra.name** set where the value is the name of the infra container set by the user. + +Note that both Deployment and DaemonSet can only have `restartPolicy` set to `Always`. + +Note that Job can only have `restartPolicy` set to `OnFailure` or `Never`. By default, podman sets it to `Never` when generating a kube yaml using `kube generate`. + +## OPTIONS + +#### **--filename**, **-f**=*filename* + +Output to the given file instead of STDOUT. If the file already exists, `kube generate` refuses to replace it and returns an error. + +#### **--podman-only** + +Add podman-only reserved annotations in generated YAML file (Cannot be used by Kubernetes) + +#### **--replicas**, **-r**=*replica count* + +The value to set `replicas` to when generating a **Deployment** kind. +Note: this can only be set with the option `--type=deployment`. + +#### **--service**, **-s** + +Generate a Kubernetes service object in addition to the Pods. Used to generate a Service specification for the corresponding Pod output. In particular, if the object has portmap bindings, the service specification includes a NodePort declaration to expose the service. A random port is assigned by Podman in the specification. + +#### **--type**, **-t**=*pod* | *deployment* | *daemonset* | *job* + +The Kubernetes kind to generate in the YAML file. Currently, the only supported Kubernetes specifications are `Pod`, `Deployment`, `Job`, and `DaemonSet`. By default, the `Pod` specification is generated. + +## EXAMPLES + +Create Kubernetes Pod YAML for the specified container. +``` +$ podman kube generate some-mariadb +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-4.8.2 + +# NOTE: If you generated this yaml from an unprivileged and rootless podman container on an SELinux +# enabled system, check the podman generate kube man page for steps to follow to ensure that your pod/container +# has the right permissions to access the volumes added. +--- +apiVersion: v1 +kind: Pod +metadata: + creationTimestamp: "2024-01-09T02:24:55Z" + labels: + app: some-mariadb-pod + name: some-mariadb-pod +spec: + containers: + - args: + - mariadbd + env: + - name: MARIADB_ROOT_PASSWORD + value: x + image: docker.io/library/mariadb:10.11 + name: some-mariadb + ports: + - containerPort: 3306 + hostPort: 34891 + volumeMounts: + - mountPath: /var/lib/mysql + name: mariadb_data-pvc + volumes: + - name: mariadb_data-pvc + persistentVolumeClaim: + claimName: mariadb_data +``` + +Create Kubernetes Deployment YAML with 3 replicas for the specified container. +``` +$ podman kube generate --type deployment --replicas 3 dep-ct +r +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-4.5.0-dev +apiVersion: apps/v1 +kind: Deployment +metadata: + creationTimestamp: "2023-03-27T20:45:08Z" + labels: + app: dep-ctr-pod + name: dep-ctr-pod-deployment +spec: + replicas: 3 + selector: + matchLabels: + app: dep-ctr-pod + template: + metadata: + annotations: + io.podman.annotations.ulimit: nofile=524288:524288,nproc=127332:127332 + creationTimestamp: "2023-03-27T20:45:08Z" + labels: + app: dep-ctr-pod + name: dep-ctr-pod + spec: + containers: + - command: + - top + image: docker.io/library/alpine:latest + name: dep-ctr +``` + + +Create Kubernetes Pod YAML for the specified container with the host directory `/home/user/my-data` bind-mounted onto the container path `/volume`. +``` +$ podman kube generate my-container-with-bind-mounted-data +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-3.1.0-dev +apiVersion: v1 +kind: Pod +metadata: + creationTimestamp: "2021-03-18T16:26:08Z" + labels: + app: my-container-with-bind-mounted-data + name: my-container-with-bind-mounted-data +spec: + containers: + - command: + - /bin/sh + image: docker.io/library/alpine:latest + name: test-bind-mount + volumeMounts: + - mountPath: /volume + name: home-user-my-data-host + restartPolicy: Never + volumes: + - hostPath: + path: /home/user/my-data + type: Directory + name: home-user-my-data-host +``` + +Create Kubernetes Pod YAML for the specified container with named volume `priceless-data` mounted onto the container path `/volume`. +``` +$ podman kube generate my-container-using-priceless-data +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-3.1.0-dev +apiVersion: v1 +kind: Pod +metadata: + creationTimestamp: "2021-03-18T16:26:08Z" + labels: + app: my-container-using-priceless-data + name: my-container-using-priceless-data +spec: + containers: + - command: + - /bin/sh + image: docker.io/library/alpine:latest + name: test-bind-mount + volumeMounts: + - mountPath: /volume + name: priceless-data-pvc + restartPolicy: Never + volumes: + - name: priceless-data-pvc + persistentVolumeClaim: + claimName: priceless-data +``` + +Create Kubernetes Pod YAML for the specified pod and include a service. +``` +$ sudo podman kube generate -s demoweb +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-0.12.2-dev +apiVersion: v1 +kind: Pod +metadata: + creationTimestamp: 2018-12-18T15:16:06Z + labels: + app: demoweb + name: demoweb-libpod +spec: + containers: + - command: + - python3 + - /root/code/graph.py + image: quay.io/baude/demoweb:latest + name: practicalarchimedes + tty: true + workingDir: /root/code +--- +apiVersion: v1 +kind: Service +metadata: + creationTimestamp: 2018-12-18T15:16:06Z + labels: + app: demoweb + name: demoweb-libpod +spec: + ports: + - name: "8050" + nodePort: 31269 + port: 8050 + targetPort: 0 + selector: + app: demoweb + type: NodePort +status: + loadBalancer: {} +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-down(1)](podman-kube-down.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-kube-play.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-kube-play.1.md new file mode 100644 index 000000000..bec550791 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-kube-play.1.md @@ -0,0 +1,823 @@ +--- +title: podman-kube-play +version: v5.5.1 +--- + +% podman-kube-play 1 + +## NAME +podman-kube-play - Create containers, pods and volumes based on Kubernetes YAML + +## SYNOPSIS +**podman kube play** [*options*] *file.yml|-|https://website.io/file.yml* + +## DESCRIPTION +**podman kube play** reads in a structured file of Kubernetes YAML. It recreates the containers, pods, or volumes described in the YAML. Containers within a pod are then started, and the ID of the new Pod or the name of the new Volume is output. If the YAML file is specified as "-", then `podman kube play` reads the YAML file from stdin. +The input can also be a URL that points to a YAML file such as https://podman.io/demo.yml. `podman kube play` reads the YAML from the URL and create pods and containers from it. + +Using the `--down` command line option, it is also capable of tearing down the pods created by a previous run of `podman kube play`. + +Using the `--replace` command line option, it tears down the pods(if any) created by a previous run of `podman kube play` and recreate the pods with the Kubernetes YAML file. + +Ideally the input file is created by the Podman command (see podman-kube-generate(1)). This guarantees a smooth import and expected results. + +Currently, the supported Kubernetes kinds are: + +- Pod +- Deployment +- PersistentVolumeClaim +- ConfigMap +- Secret +- DaemonSet +- Job + +`Kubernetes Pods or Deployments` + +Only five volume types are supported by kube play, the *hostPath*, *emptyDir*, *configMap*, *persistentVolumeClaim*, and *image* volume types. + +- When using the *hostPath* volume type, only the *default (empty)*, *DirectoryOrCreate*, *Directory*, *FileOrCreate*, *File*, *Socket*, *CharDevice* and *BlockDevice* subtypes are supported. Podman interprets the value of *hostPath* *path* as a file path when it contains at least one forward slash, otherwise Podman treats the value as the name of a named volume. +- When using a *persistentVolumeClaim*, the value for *claimName* is the name for the Podman named volume. +- When using an *emptyDir* volume, Podman creates an anonymous volume that is attached the containers running inside the pod and is deleted once the pod is removed. +- When using an *configMap* volume, Podman creates an anonymous volume that is attached the containers running inside the pod and is deleted once the pod is removed. +- When using an *image* volume, Podman creates a read-only image volume with an empty subpath (the whole image is mounted). The image must already exist locally. It is supported in rootful mode only. + +Note: The default restart policy for containers is `always`. You can change the default by setting the `restartPolicy` field in the spec. + +Note: When playing a kube YAML with init containers, the init container is created with init type value `once`. To change the default type, use the `io.podman.annotations.init.container.type` annotation to set the type to `always`. + +Note: *hostPath* volume types created by kube play is given an SELinux shared label (z), bind mounts are not relabeled (use `chcon -t container_file_t -R `). + +Note: To set userns of a pod, use the **io.podman.annotations.userns** annotation in the pod/deployment definition. For example, **io.podman.annotations.userns=keep-id** annotation tells Podman to create a user namespace where the current rootless user's UID\:GID are mapped to the same values in the container. This can be overridden with the `--userns` flag. + +Note: Use the **io.podman.annotations.volumes-from** annotation to bind mount volumes of one container to another. You can mount volumes from multiple source containers to a target container. The source containers that belong to the same pod must be defined before the source container in the kube YAML. The annotation format is `io.podman.annotations.volumes-from/targetContainer: "sourceContainer1\:mountOpts1;sourceContainer2:mountOpts2"`. + +Note: If the `:latest` tag is used, Podman attempts to pull the image from a registry. If the image was built locally with Podman or Buildah, it has `localhost` as the domain, in that case, Podman uses the image from the local store even if it has the `\:latest` tag. + +Note: The command `podman play kube` is an alias of `podman kube play`, and performs the same function. + +Note: The command `podman kube down` can be used to stop and remove pods or containers based on the same Kubernetes YAML used +by `podman kube play` to create them. + +Note: To customize the name of the infra container created during `podman kube play`, use the **io.podman.annotations.infra.name** annotation in the pod definition. This annotation is automatically set when generating a kube yaml from a pod that was created with the `--infra-name` flag set. + +Note: Use the **io.podman.annotations.pids-limit/$ctrname** annotation to configure the pod's pids limit. + +`Kubernetes PersistentVolumeClaims` + +A Kubernetes PersistentVolumeClaim represents a Podman named volume. Only the PersistentVolumeClaim name is required by Podman to create a volume. Kubernetes annotations can be used to make use of the available options for Podman volumes. + +- volume.podman.io/driver +- volume.podman.io/device +- volume.podman.io/type +- volume.podman.io/uid +- volume.podman.io/gid +- volume.podman.io/mount-options +- volume.podman.io/import-source +- volume.podman.io/image + +Use `volume.podman.io/import-source` to import the contents of the tarball (.tar, .tar.gz, .tgz, .bzip, .tar.xz, .txz) specified in the annotation's value into the created Podman volume + +Kube play is capable of building images on the fly given the correct directory layout and Containerfiles. This +option is not available for remote clients, including Mac and Windows (excluding WSL2) machines, yet. Consider the following excerpt from a YAML file: +``` +apiVersion: v1 +kind: Pod +metadata: +... +spec: + containers: + - name: container + image: foobar +... +``` + +If there is a directory named `foobar` in the current working directory with a file named `Containerfile` or `Dockerfile`, +Podman kube play builds that image and name it `foobar`. An example directory structure for this example looks +like: +``` +|- mykubefiles + |- myplayfile.yaml + |- foobar + |- Containerfile +``` + +The build considers `foobar` to be the context directory for the build. If there is an image in local storage +called `foobar`, the image is not built unless the `--build` flag is used. Use `--build=false` to completely +disable builds. + +Kube play supports CDI (Container Device Interface) device selectors to share +host devices (e.g. GPUs) with containers. The configuration format follows +Kubernetes extended resource management: +``` +apiVersion: v1 +kind: Pod +spec: + containers: + - name: container + resources: + limits: + nvidia.com/gpu=all: 1 +``` + +To enable sharing host devices, analogous to using the `--device` flag Podman +kube supports a custom CDI selector: `podman.io/device=`. + +`Kubernetes ConfigMap` + +Kubernetes ConfigMap can be referred as a source of environment variables or volumes in Pods or Deployments. +ConfigMaps aren't a standalone object in Podman; instead, when a container uses a ConfigMap, Podman creates environment variables or volumes as needed. + +For example, the following YAML document defines a ConfigMap and then uses it in a Pod: + +``` +apiVersion: v1 +kind: ConfigMap +metadata: + name: foo +data: + FOO: bar +--- +apiVersion: v1 +kind: Pod +metadata: + name: foobar +spec: + containers: + - name: container-1 + image: foobar + envFrom: + - configMapRef: + name: foo + optional: false +``` + +and as a result environment variable `FOO` is set to `bar` for container `container-1`. + +`Kubernetes Secret` + +Kubernetes Secret represents a Podman named secret. The Kubernetes Secret is saved as a whole and may be referred to as a source of environment variables or volumes in Pods or Deployments. + +For example, the following YAML document defines a Secret and then uses it in a Pod: + +``` +kind: Secret +apiVersion: v1 +metadata: + name: foo +data: + foo: YmFy # base64 for bar +--- +apiVersion: v1 +kind: Pod +metadata: + name: foobar +spec: + containers: + - name: container-1 + image: foobar + env: + - name: FOO + valueFrom: + secretKeyRef: + name: foo + key: foo +``` + +and as a result environment variable `FOO` is set to `bar` for container `container-1`. + +`Automounting Volumes (deprecated)` + +Note: The automounting annotation is deprecated. Kubernetes has [native support for image volumes](https://kubernetes.io/docs/tasks/configure-pod-container/image-volumes/) and that should be used rather than this podman-specific annotation. + +An image can be automatically mounted into a container if the annotation `io.podman.annotations.kube.image.automount/$ctrname` is given. The following rules apply: + +- The image must already exist locally. +- The image must have at least 1 volume directive. +- The path given by the volume directive will be mounted from the image into the container. For example, an image with a volume at `/test/test_dir` will have `/test/test_dir` in the image mounted to `/test/test_dir` in the container. +- Multiple images can be specified. If multiple images have a volume at a specific path, the last image specified trumps. +- The images are always mounted read-only. +- Images to mount are defined in the annotation "io.podman.annotations.kube.image.automount/$ctrname" as a semicolon-separated list. They are mounted into a single container in the pod, not the whole pod. The annotation can be specified for additional containers if additional mounts are required. + +## OPTIONS + + +[//]: # (BEGIN included file options/annotation.container.md) +#### **--annotation**=*key=value* + +Add an annotation to the container or pod. This option can be set multiple times. + +[//]: # (END included file options/annotation.container.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + +#### **--build** + +Build images even if they are found in the local storage. Use `--build=false` to completely disable builds. (This option is not available with the remote Podman client) + +Note: You can also override the default isolation type by setting the BUILDAH_ISOLATION environment variable. export BUILDAH_ISOLATION=oci. See podman-build.1.md for more information. + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + +#### **--configmap**=*path* + +Use Kubernetes configmap YAML at path to provide a source for environment variable values within the containers of the pod. (This option is not available with the remote Podman client) + +Note: The *--configmap* option can be used multiple times or a comma-separated list of paths can be used to pass multiple Kubernetes configmap YAMLs. +The YAML file may be in a multi-doc YAML format. But, it must container only configmaps + +#### **--context-dir**=*path* + +Use *path* as the build context directory for each image. Requires --build option be true. (This option is not available with the remote Podman client) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + +#### **--force** + +Tear down the volumes linked to the PersistentVolumeClaims as part of --down + +#### **--help**, **-h** + +Print usage statement + +#### **--ip**=*IP address* + +Assign a static ip address to the pod. This option can be specified several times when kube play creates more than one pod. +Note: When joining multiple networks use the **--network name\:ip=\** syntax. + +#### **--log-driver**=*driver* + +Set logging driver for all created containers. + + +[//]: # (BEGIN included file options/log-opt.md) +#### **--log-opt**=*name=value* + +Logging driver specific options. + +Set custom logging configuration. The following *name*s are supported: + +**path**: specify a path to the log file + (e.g. **--log-opt path=/var/log/container/mycontainer.json**); + +**max-size**: specify a max size of the log file + (e.g. **--log-opt max-size=10mb**); + +**tag**: specify a custom log tag for the container + (e.g. **--log-opt tag="{{.ImageName}}"**. +It supports the same keys as **podman inspect --format**. +This option is currently supported only by the **journald** log driver. + +[//]: # (END included file options/log-opt.md) + +#### **--mac-address**=*MAC address* + +Assign a static mac address to the pod. This option can be specified several times when kube play creates more than one pod. +Note: When joining multiple networks use the **--network name\:mac=\** syntax. + + +[//]: # (BEGIN included file options/network.md) +#### **--network**=*mode*, **--net** + +Set the network mode for the pod. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + For better integration with DNS handling, **--dns-forward 169.254.1.1** is passed, + and this address is added to resolv.conf(5) as first resolver. It is possible to pass + **--dns-forward** explicitly in case a different IP address should be used. + To make the `host.containers.internal` /etc/hosts entry work and allow connections + to the host, **--map-guest-addr 169.254.1.2** is passed. Again, it can be set + explicitly to choose a different IP address. \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured (via Podman's + **--publish** or by passing the pasta **-t**/**-u** options directly), + to disable automatic port forwarding based on bound ports. Similarly, **-T none** + and **-U none** are given to disable the same functionality from container to + host. \ + All options can also be set in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**; + see the `pasta_options` key under the network section in that file. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.md) + +When no network option is specified and *host* network mode is not configured in the YAML file, a new network stack is created and pods are attached to it making possible pod to pod communication. + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the pod. + +Podman assumes control over the pod's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with host added in the Kubernetes YAML. + +#### **--publish**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Define or override a port definition in the YAML file. + +The lists of ports in the YAML file and the command line are merged. Matching is done by using the **containerPort** field. +If **containerPort** exists in both the YAML file and the option, the latter takes precedence. + +#### **--publish-all** + +Setting this option to `true` will expose all ports to the host, +even if only specified via **containerPort** in the K8 YAML. +In terms of which port will be exposed, **--publish** has higher priority than **hostPort**, has higher priority than +**containerPort**. + +If set to `false` (which is the default), only ports defined via **hostPort** +or **--publish** are published on the host. + +#### **--quiet**, **-q** + +Suppress output information when pulling images + +#### **--replace** + +Tears down the pods created by a previous run of `kube play` and recreates the pods. This option is used to keep the existing pods up to date based upon the Kubernetes YAML. + +#### **--seccomp-profile-root**=*path* + +Directory path for seccomp profiles (default: "/var/lib/kubelet/seccomp"). (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +#### **--start** + +Start the pod after creating it, set to false to only create it. + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/userns.container.md) +#### **--userns**=*mode* + +Set the user namespace mode for the container. + +If `--userns` is not set, the default value is determined as follows. +- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used. +- If the environment variable **PODMAN_USERNS** is set its value is used. +- If `userns` is specified in `containers.conf` this value is used. +- Otherwise, `--userns=host` is assumed. + +`--userns=""` (i.e., an empty string) is an alias for `--userns=host`. + +This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +------------------------|-----------|--------------------- +auto | $UID | nil (Host User UID is not mapped into container.) +host | $UID | 0 (Default User account mapped to root user in container.) +keep-id | $UID | $UID (Map user account to same UID within container.) +keep-id\:uid=200,gid=210 | $UID | 200:210 (Map user account to specified UID, GID value within container.) +nomap | $UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + +**auto**[\:_OPTIONS,..._]: automatically create a unique user namespace. + +* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. + + Example: `containers:2147483647:2147483648`. + +* `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5). + +Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user IDs. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. + +The option `--userns=keep-id` uses all the subuids and subgids of the user. +The option `--userns=nomap` uses all the subuids and subgids of the user except the user's own ID. +Using `--userns=auto` when starting new containers does not work as long as any containers exist that were started with `--userns=nomap` or `--userns=keep-id` without limiting the user namespace size. + + Valid `auto` options: + + - *gidmapping*=_CONTAINER\_GID\:HOST\_GID\:SIZE_: to force a GID mapping to be present in the user namespace. + - *size*=_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates a size for the user namespace. + - *uidmapping*=_CONTAINER\_UID\:HOST\_UID\:SIZE_: to force a UID mapping to be present in the user namespace. + +The host UID and GID in *gidmapping* and *uidmapping* can optionally be prefixed with the `@` symbol. +In this case, podman will look up the intermediate ID corresponding to host ID and it will map the found intermediate ID to the container id. +For details see **--uidmap**. + +**container:**_id_: join the user namespace of the specified container. + +**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user. + +**keep-id**: creates a user namespace where the current user's UID\:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace. + + Valid `keep-id` options: + + - *uid*=UID: override the UID inside the container that is used to map the current user to. + - *gid*=GID: override the GID inside the container that is used to map the current user to. + - *size*=SIZE: override the size of the configured user namespace. It is useful to not saturate all the available IDs. Not supported when running as root. + +**nomap**: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +**ns:**_namespace_: run the pod in the given existing user namespace. + +[//]: # (END included file options/userns.container.md) + +#### **--wait**, **-w** + +Run pods and containers in the foreground. Default is false. + +At any time you can run `podman pod ps` in another shell to view a list of +the running pods and containers. + +When attached in the tty mode, you can kill the pods and containers by pressing +Ctrl-C or receiving any other interrupt signals. + +All pods, containers, and volumes created with `podman kube play` is removed +upon exit. + +## EXAMPLES + +Recreate the pod and containers described in the specified host YAML file. +``` +$ podman kube play demo.yml +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Recreate the pod and containers specified in a YAML file sent to stdin. +``` +$ cat demo.yml | podman kube play - +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Tear down the pod and containers as described in the specified YAML file. +``` +$ podman kube play --down demo.yml +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Provide multiple configmap files as sources for environment variables within the specified pods and containers. +``` +$ podman kube play demo.yml --configmap configmap-foo.yml,configmap-bar.yml +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 + +$ podman kube play demo.yml --configmap configmap-foo.yml --configmap configmap-bar.yml +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Create a pod connected to two networks with a static ip on each. +``` +$ podman kube play demo.yml --network net1\:ip=10.89.1.5 --network net2\:ip=10.89.10.10 +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` +Please take into account that networks must be created first using podman-network-create(1). + +Create and teardown from a URL pointing to a YAML file. +``` +$ podman kube play https://podman.io/demo.yml +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 + +$ podman kube play --down https://podman.io/demo.yml +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` +`podman kube play --down` does not work with a URL if the YAML file the URL points to +has been changed or altered. + + +[//]: # (BEGIN included file ../../kubernetes_support.md) +# Podman Kube Play Support + +This document outlines the kube yaml fields that are currently supported by the **podman kube play** command. + +Note: **N/A** means that the option cannot be supported in a single-node Podman environment. + +## Pod Fields + +| Field | Support | +|-----------------------------------------------------|---------| +| containers | ✅ | +| initContainers | ✅ | +| imagePullSecrets | no | +| enableServiceLinks | no | +| os\.name | no | +| volumes | ✅ | +| nodeSelector | N/A | +| nodeName | N/A | +| affinity\.nodeAffinity | N/A | +| affinity\.podAffinity | N/A | +| affinity\.podAntiAffinity | N/A | +| tolerations\.key | N/A | +| tolerations\.operator | N/A | +| tolerations\.effect | N/A | +| tolerations\.tolerationSeconds | N/A | +| schedulerName | N/A | +| runtimeClassName | no | +| priorityClassName | no | +| priority | no | +| topologySpreadConstraints\.maxSkew | N/A | +| topologySpreadConstraints\.topologyKey | N/A | +| topologySpreadConstraints\.whenUnsatisfiable | N/A | +| topologySpreadConstraints\.labelSelector | N/A | +| topologySpreadConstraints\.minDomains | N/A | +| restartPolicy | ✅ | +| terminationGracePeriodSeconds | ✅ | +| activeDeadlineSeconds | no | +| readinessGates\.conditionType | no | +| hostname | ✅ | +| setHostnameAsFQDN | no | +| subdomain | no | +| hostAliases\.hostnames | ✅ | +| hostAliases\.ip | ✅ | +| dnsConfig\.nameservers | ✅ | +| dnsConfig\.options\.name | ✅ | +| dnsConfig\.options\.value | ✅ | +| dnsConfig\.searches | ✅ | +| dnsPolicy | no | +| hostNetwork | ✅ | +| hostPID | ✅ | +| hostIPC | ✅ | +| shareProcessNamespace | ✅ | +| serviceAccountName | no | +| automountServiceAccountToken | no | +| securityContext\.runAsUser | ✅ | +| securityContext\.runAsNonRoot | no | +| securityContext\.runAsGroup | ✅ | +| securityContext\.supplementalGroups | ✅ | +| securityContext\.fsGroup | no | +| securityContext\.fsGroupChangePolicy | no | +| securityContext\.seccompProfile\.type | no | +| securityContext\.seccompProfile\.localhostProfile | no | +| securityContext\.seLinuxOptions\.level | ✅ | +| securityContext\.seLinuxOptions\.role | ✅ | +| securityContext\.seLinuxOptions\.type | ✅ | +| securityContext\.seLinuxOptions\.user | ✅ | +| securityContext\.sysctls\.name | ✅ | +| securityContext\.sysctls\.value | ✅ | +| securityContext\.windowsOptions\.gmsaCredentialSpec | no | +| securityContext\.windowsOptions\.hostProcess | no | +| securityContext\.windowsOptions\.runAsUserName | no | + +## Container Fields + +| Field | Support | +|-----------------------------------------------------|---------| +| name | ✅ | +| image | ✅ | +| imagePullPolicy | ✅ | +| command | ✅ | +| args | ✅ | +| workingDir | ✅ | +| ports\.containerPort | ✅ | +| ports\.hostIP | ✅ | +| ports\.hostPort | ✅ | +| ports\.name | ✅ | +| ports\.protocol | ✅ | +| env\.name | ✅ | +| env\.value | ✅ | +| env\.valueFrom\.configMapKeyRef\.key | ✅ | +| env\.valueFrom\.configMapKeyRef\.name | ✅ | +| env\.valueFrom\.configMapKeyRef\.optional | ✅ | +| env\.valueFrom\.fieldRef | ✅ | +| env\.valueFrom\.resourceFieldRef | ✅ | +| env\.valueFrom\.secretKeyRef\.key | ✅ | +| env\.valueFrom\.secretKeyRef\.name | ✅ | +| env\.valueFrom\.secretKeyRef\.optional | ✅ | +| envFrom\.configMapRef\.name | ✅ | +| envFrom\.configMapRef\.optional | ✅ | +| envFrom\.prefix | no | +| envFrom\.secretRef\.name | ✅ | +| envFrom\.secretRef\.optional | ✅ | +| volumeMounts\.mountPath | ✅ | +| volumeMounts\.name | ✅ | +| volumeMounts\.mountPropagation | no | +| volumeMounts\.readOnly | ✅ | +| volumeMounts\.subPath | ✅ | +| volumeMounts\.subPathExpr | no | +| volumeDevices\.devicePath | no | +| volumeDevices\.name | no | +| resources\.limits | ✅ | +| resources\.requests | ✅ | +| lifecycle\.postStart | no | +| lifecycle\.preStop | no | +| terminationMessagePath | no | +| terminationMessagePolicy | no | +| livenessProbe | ✅ | +| readinessProbe | no | +| startupProbe | no | +| securityContext\.runAsUser | ✅ | +| securityContext\.runAsNonRoot | no | +| securityContext\.runAsGroup | ✅ | +| securityContext\.readOnlyRootFilesystem | ✅ | +| securityContext\.procMount | ✅ | +| securityContext\.privileged | ✅ | +| securityContext\.allowPrivilegeEscalation | ✅ | +| securityContext\.capabilities\.add | ✅ | +| securityContext\.capabilities\.drop | ✅ | +| securityContext\.seccompProfile\.type | no | +| securityContext\.seccompProfile\.localhostProfile | no | +| securityContext\.seLinuxOptions\.level | ✅ | +| securityContext\.seLinuxOptions\.role | ✅ | +| securityContext\.seLinuxOptions\.type | ✅ | +| securityContext\.seLinuxOptions\.user | ✅ | +| securityContext\.windowsOptions\.gmsaCredentialSpec | no | +| securityContext\.windowsOptions\.hostProcess | no | +| securityContext\.windowsOptions\.runAsUserName | no | +| stdin | no | +| stdinOnce | no | +| tty | no | + +## PersistentVolumeClaim Fields + +| Field | Support | +|---------------------|---------| +| volumeName | no | +| storageClassName | ✅ | +| volumeMode | no | +| accessModes | ✅ | +| selector | no | +| resources\.limits | no | +| resources\.requests | ✅ | + +## ConfigMap Fields + +| Field | Support | +|------------|---------| +| binaryData | ✅ | +| data | ✅ | +| immutable | no | + +## Deployment Fields + +| Field | Support | +|-----------------------------------------|-------------------------------------------------------| +| replicas | ✅ (the actual replica count is ignored and set to 1) | +| selector | ✅ | +| template | ✅ | +| minReadySeconds | no | +| strategy\.type | no | +| strategy\.rollingUpdate\.maxSurge | no | +| strategy\.rollingUpdate\.maxUnavailable | no | +| revisionHistoryLimit | no | +| progressDeadlineSeconds | no | +| paused | no | + +## DaemonSet Fields + +| Field | Support | +|-----------------------------------------|---------| +| selector | ✅ | +| template | ✅ | +| minReadySeconds | no | +| strategy\.type | no | +| strategy\.rollingUpdate\.maxSurge | no | +| strategy\.rollingUpdate\.maxUnavailable | no | +| revisionHistoryLimit | no | + +## Job Fields + +| Field | Support | +|-------------------------|----------------------------------| +| activeDeadlineSeconds | no | +| selector | no (automatically set by k8s) | +| template | ✅ | +| backoffLimit | no | +| completionMode | no | +| completions | no (set to 1 with kube generate) | +| manualSelector | no | +| parallelism | no (set to 1 with kube generate) | +| podFailurePolicy | no | +| suspend | no | +| ttlSecondsAfterFinished | no | + +[//]: # (END included file ../../kubernetes_support.md) + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-kube(1)](podman-kube.1.md)**, **[podman-kube-down(1)](podman-kube-down.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)**, **[podman-build(1)](podman-build.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-kube.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-kube.1.md new file mode 100644 index 000000000..f64f8e9a9 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-kube.1.md @@ -0,0 +1,35 @@ +--- +title: podman-kube +version: v5.5.1 +--- + +% podman-kube 1 + +## NAME +podman\-kube - Play containers, pods or volumes based on a structured input file + +## SYNOPSIS +**podman kube** *subcommand* + +## DESCRIPTION +The kube command recreates containers, pods or volumes based on the input from a structured (like YAML) +file input. Containers are automatically started. + +Note: The kube commands in podman focus on simplifying the process of moving containers from podman to a Kubernetes +environment and from a Kubernetes environment back to podman. Podman is not replicating the kubectl CLI. Once containers +are deployed to a Kubernetes cluster from podman, please use `kubectl` to manage the workloads in the cluster. + +## COMMANDS + +| Command | Man Page | Description | +| ------- | ---------------------------------------------------- | ----------------------------------------------------------------------------- | +| apply | [podman-kube-apply(1)](podman-kube-apply.1.md) | Apply Kubernetes YAML based on containers, pods, or volumes to a Kubernetes cluster | +| down | [podman-kube-down(1)](podman-kube-down.1.md) | Remove containers and pods based on Kubernetes YAML. | +| generate | [podman-kube-generate(1)](podman-kube-generate.1.md) | Generate Kubernetes YAML based on containers, pods or volumes. | +| play | [podman-kube-play(1)](podman-kube-play.1.md) | Create containers, pods and volumes based on Kubernetes YAML. | + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-down(1)](podman-kube-down.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)**, **[podman-kube-apply(1)](podman-kube-apply.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-load.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-load.1.md new file mode 100644 index 000000000..0cf17cf4d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-load.1.md @@ -0,0 +1,92 @@ +--- +title: podman-load +version: v5.5.1 +--- + +% podman-load 1 + +## NAME +podman\-load - Load image(s) from a tar archive into container storage + +## SYNOPSIS +**podman load** [*options*] + +**podman image load** [*options*] + +## DESCRIPTION +**podman load** loads an image from either an **oci-archive** or a **docker-archive** stored on the local machine into container storage. **podman load** reads from stdin by default or a file if the **input** option is set. +**podman load** is used for loading from the archive generated by **podman save**, that includes the image parent layers. To load the archive of container's filesystem created by **podman export**, use **podman import**. + +The local client further supports loading an **oci-dir** or a **docker-dir** as created with **podman save** (1). + +The **quiet** option suppresses the progress output when set. +Note: `:` is a restricted character and cannot be part of the file name. + + +**podman [GLOBAL OPTIONS]** + +**podman load [GLOBAL OPTIONS]** + +**podman load [OPTIONS]** + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--input**, **-i**=*input* + +Load the specified input file instead of from stdin. The file can be on the local file system or on a server (e.g., https://server.com/archive.tar). Also supports loading in compressed files. + +The remote client, including Mac and Windows (excluding WSL2) machines, requires the use of this option. + +NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of container images. Podman defaults to use `/var/tmp`. + +#### **--quiet**, **-q** + +Suppress the progress output + +## EXAMPLES + +Create an image from a compressed tar file, without showing progress. +``` +$ podman load --quiet -i fedora.tar.gz +``` + +Create an image from the archive.tar file pulled from a URL, without showing progress. +``` +$ podman load -q -i https://server.com/archive.tar +``` + +Create an image from stdin using bash redirection from a tar file. +``` +$ podman load < fedora.tar +Getting image source signatures +Copying blob sha256:5bef08742407efd622d243692b79ba0055383bbce12900324f75e56f589aedb0 + 0 B / 4.03 MB [---------------------------------------------------------------] +Copying config sha256:7328f6f8b41890597575cbaadc884e7386ae0acc53b747401ebce5cf0d624560 + 0 B / 1.48 KB [---------------------------------------------------------------] +Writing manifest to image destination +Storing signatures +Loaded image: registry.fedoraproject.org/fedora:latest +``` + +Create an image from stdin using a pipe. +``` +$ cat fedora.tar | podman load +Getting image source signatures +Copying blob sha256:5bef08742407efd622d243692b79ba0055383bbce12900324f75e56f589aedb0 + 0 B / 4.03 MB [---------------------------------------------------------------] +Copying config sha256:7328f6f8b41890597575cbaadc884e7386ae0acc53b747401ebce5cf0d624560 + 0 B / 1.48 KB [---------------------------------------------------------------] +Writing manifest to image destination +Storing signatures +Loaded image: registry.fedoraproject.org/fedora:latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-save(1)](podman-save.1.md)** + +## HISTORY +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-login.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-login.1.md new file mode 100644 index 000000000..c78bf7d31 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-login.1.md @@ -0,0 +1,188 @@ +--- +title: podman-login +version: v5.5.1 +--- + +% podman-login 1 + +## NAME +podman\-login - Log in to a container registry + +## SYNOPSIS +**podman login** [*options*] [*registry*] + +## DESCRIPTION +**podman login** logs into a specified registry server with the correct username +and password. If the registry is not specified, the first registry under [registries.search] +from registries.conf is used. **podman login** reads in the username and password from STDIN. +The username and password can also be set using the **username** and **password** flags. +The path of the authentication file can be specified by the user by setting the **authfile** +flag. The default path for reading and writing credentials is **${XDG\_RUNTIME\_DIR}/containers/auth.json**. +Podman uses existing credentials if the user does not pass in a username. +Podman first searches for the username and password in the **${XDG\_RUNTIME\_DIR}/containers/auth.json**, if they are not valid, +Podman then uses any existing credentials found in **$HOME/.docker/config.json**. +If those credentials are not present, Podman creates **${XDG\_RUNTIME\_DIR}/containers/auth.json** (if the file does not exist) and +then stores the username and password from STDIN as a base64 encoded string in it. +For more details about format and configurations of the auth.json file, see containers-auth.json(5) + +**podman [GLOBAL OPTIONS]** + +**podman login [GLOBAL OPTIONS]** + +**podman login [OPTIONS] [REGISTRY] [GLOBAL OPTIONS]** + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/compat-auth-file.md) +#### **--compat-auth-file**=*path* + +Instead of updating the default credentials file, update the one at *path*, and use a Docker-compatible format. + +[//]: # (END included file options/compat-auth-file.md) + +#### **--get-login** + +Return the logged-in user for the registry. Return error if no login is found. + +#### **--help**, **-h** + +Print usage statement + +#### **--password**, **-p**=*password* + +Password for registry + +#### **--password-stdin** + +Take the password from stdin + +#### **--secret**=*name* + +Read the password for the registry from the podman secret `name`. +If --username is not specified --username=`name` is used. + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +#### **--username**, **-u**=*username* + +Username for registry + +#### **--verbose**, **-v** + +print detailed information about credential store + +## EXAMPLES + +Add login credentials for specified registry to default authentication file; +note that unlike the `docker` default, the default credentials are under `$XDG_RUNTIME_DIR` +which is a subdirectory of `/run` (an emphemeral directory) and hence do not persist across reboot. + +``` +$ podman login quay.io +Username: umohnani +Password: +Login Succeeded! +``` + +To explicitly preserve credentials across reboot, you will need to specify +the default persistent path: + +``` +$ podman login --authfile ~/.config/containers/auth.json quay.io +Username: umohnani +Password: +Login Succeeded! +``` + +Add login credentials using specified username and password for local registry to default authentication file. +``` +$ podman login -u testuser -p testpassword localhost:5000 +Login Succeeded! +``` + +Add login credentials for alternate authfile path for the specified registry. +``` +$ podman login --authfile authdir/myauths.json quay.io +Username: umohnani +Password: +Login Succeeded! +``` + +Add login credentials using a Podman secret for the password. +``` +$ echo -n MySecret! | podman secret create secretname - +a0ad54df3c97cf89d5ca6193c +$ podman login --secret secretname -u testuser quay.io +Login Succeeded! +``` + +Add login credentials for user test with password test to localhost:5000 registry disabling tls verification requirement. +``` +$ podman login --tls-verify=false -u test -p test localhost:5000 +Login Succeeded! +``` + +Add login credentials for user foo with password bar to localhost:5000 registry using the certificate directory /etc/containers/certs.d. +``` +$ podman login --cert-dir /etc/containers/certs.d/ -u foo -p bar localhost:5000 +Login Succeeded! +``` + +Add login credentials for specified registries to default authentication file for given user with password information provided via stdin from a file on disk. +``` +$ podman login -u testuser --password-stdin < testpassword.txt docker.io +Login Succeeded! +``` + +Add login credentials for specified registry to default authentication file for given user with password information provided via stdin from a pipe. +``` +$ echo $testpassword | podman login -u testuser --password-stdin quay.io +Login Succeeded! +``` + +Add login credentials for specified registry to default authentication file in verbose mode. +``` +$ podman login quay.io --verbose +Username: myusername +Password: +Used: /run/user/1000/containers/auth.json +Login Succeeded! +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-logout(1)](podman-logout.1.md)**, **[containers-auth.json(5)](https://github.com/containers/image/blob/main/docs/containers-auth.json.5.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[podman-secret(1)](podman-secret.1.md)**, **[podman-secret-create(1)](podman-secret-create.1.md)** + +## HISTORY +August 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-logout.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-logout.1.md new file mode 100644 index 000000000..180e0ad52 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-logout.1.md @@ -0,0 +1,77 @@ +--- +title: podman-logout +version: v5.5.1 +--- + +% podman-logout 1 + +## NAME +podman\-logout - Log out of a container registry + +## SYNOPSIS +**podman logout** [*options*] *registry* + +## DESCRIPTION +**podman logout** logs out of a specified registry server by deleting the cached credentials +stored in the **auth.json** file. If the registry is not specified, the first registry under [registries.search] +from registries.conf is used. The path of the authentication file can be overridden by the user by setting the **authfile** flag. +The default path used is **${XDG\_RUNTIME\_DIR}/containers/auth.json**. For more details about format and configurations of the auth,json file, see containers-auth.json(5) +All the cached credentials can be removed by setting the **all** flag. + +**podman [GLOBAL OPTIONS]** + +**podman logout [GLOBAL OPTIONS]** + +**podman logout [OPTIONS] REGISTRY [GLOBAL OPTIONS]** + +## OPTIONS + +#### **--all**, **-a** + +Remove the cached credentials for all registries in the auth file + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/compat-auth-file.md) +#### **--compat-auth-file**=*path* + +Instead of updating the default credentials file, update the one at *path*, and use a Docker-compatible format. + +[//]: # (END included file options/compat-auth-file.md) + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Remove login credentials for the docker.io registry from the authentication file: +``` +$ podman logout docker.io +``` + +Remove login credentials for the docker.io registry from the authdir/myauths.json file: +``` +$ podman logout --authfile authdir/myauths.json docker.io +``` + +Remove login credentials for all registries: +``` +$ podman logout --all +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-auth.json(5)](https://github.com/containers/image/blob/main/docs/containers-auth.json.5.md)** + +## HISTORY +August 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-logs.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-logs.1.md new file mode 100644 index 000000000..4033ad3a1 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-logs.1.md @@ -0,0 +1,173 @@ +--- +title: podman-logs +version: v5.5.1 +--- + +% podman-logs 1 + +## NAME +podman\-logs - Display the logs of one or more containers + +## SYNOPSIS +**podman logs** [*options*] *container* [*container...*] + +**podman container logs** [*options*] *container* [*container...*] + +## DESCRIPTION +The podman logs command batch-retrieves whatever logs are present for one or more containers at the time of execution. +This does not guarantee execution order when combined with podman run (i.e. the run may not have generated +any logs at the time podman logs was executed). + +## OPTIONS + + +[//]: # (BEGIN included file options/color.md) +#### **--color** + +Output the containers with different colors in the log. + +[//]: # (END included file options/color.md) + + +[//]: # (BEGIN included file options/follow.md) +#### **--follow**, **-f** + +Follow log output. Default is false. + +Note: When following a container which is removed by `podman container rm` +or removed on exit (`podman run --rm ...`), there is a chance that the log +file is removed before `podman logs` reads the final content. + +[//]: # (END included file options/follow.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/names.md) +#### **--names**, **-n** + +Output the container names instead of the container IDs in the log. + +[//]: # (END included file options/names.md) + + +[//]: # (BEGIN included file options/since.md) +#### **--since**=*TIMESTAMP* + +Show logs since TIMESTAMP. The --since option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. + +[//]: # (END included file options/since.md) + + +[//]: # (BEGIN included file options/tail.md) +#### **--tail**=*LINES* + +Output the specified number of LINES at the end of the logs. LINES must be an integer. Defaults to -1, +which prints all lines + +[//]: # (END included file options/tail.md) + + +[//]: # (BEGIN included file options/timestamps.md) +#### **--timestamps**, **-t** + +Show timestamps in the log outputs. The default is false + +[//]: # (END included file options/timestamps.md) + + +[//]: # (BEGIN included file options/until.md) +#### **--until**=*TIMESTAMP* + +Show logs until TIMESTAMP. The --until option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. + +[//]: # (END included file options/until.md) + +## EXAMPLE + +To view a container's logs: +``` +podman logs -t b3f2436bdb978c1d33b1387afb5d7ba7e3243ed2ce908db431ac0069da86cb45 + +2017/08/07 10:16:21 Seeked /var/log/crio/pods/eb296bd56fab164d4d3cc46e5776b54414af3bf543d138746b25832c816b933b/c49f49788da14f776b7aa93fb97a2a71f9912f4e5a3e30397fca7dfe0ee0367b.log - &{Offset:0 Whence:0} +1:C 07 Aug 14:10:09.055 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo +1:C 07 Aug 14:10:09.055 # Redis version=4.0.1, bits=64, commit=00000000, modified=0, pid=1, just started +1:C 07 Aug 14:10:09.055 # Warning: no config file specified, using the default config. In order to specify a config file use redis-server /path/to/redis.conf +1:M 07 Aug 14:10:09.055 # You requested maxclients of 10000 requiring at least 10032 max file descriptors. +1:M 07 Aug 14:10:09.055 # Server can't set maximum open files to 10032 because of OS error: Operation not permitted. +1:M 07 Aug 14:10:09.055 # Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit. If you need higher maxclients increase 'ulimit -n'. +1:M 07 Aug 14:10:09.056 * Running mode=standalone, port=6379. +1:M 07 Aug 14:10:09.056 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. +1:M 07 Aug 14:10:09.056 # Server initialized +``` + +To view only the last two lines in container's log: +``` +podman logs --tail 2 b3f2436bdb97 + +# WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. +# Server initialized +``` + +To view all containers logs: +``` +podman logs -t --since 0 myserver + +1:M 07 Aug 14:10:09.055 # Server can't set maximum open files to 10032 because of OS error: Operation not permitted. +1:M 07 Aug 14:10:09.055 # Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit. If you need higher maxclients increase 'ulimit -n'. +1:M 07 Aug 14:10:09.056 * Running mode=standalone, port=6379. +1:M 07 Aug 14:10:09.056 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. +1:M 07 Aug 14:10:09.056 # Server initialized +``` + +To view a container's logs since a certain time: +``` +podman logs -t --since 2017-08-07T10:10:09.055837383-04:00 myserver + +1:M 07 Aug 14:10:09.055 # Server can't set maximum open files to 10032 because of OS error: Operation not permitted. +1:M 07 Aug 14:10:09.055 # Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit. If you need higher maxclients increase 'ulimit -n'. +1:M 07 Aug 14:10:09.056 * Running mode=standalone, port=6379. +1:M 07 Aug 14:10:09.056 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. +1:M 07 Aug 14:10:09.056 # Server initialized +``` + +To view a container's logs generated in the last 10 minutes: +``` +podman logs --since 10m myserver + +# Server can't set maximum open files to 10032 because of OS error: Operation not permitted. +# Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit, Increase 'ulimit -n' when higher maxclients are required. +``` + +To view a container's logs until 30 minutes ago: +``` +podman logs --until 30m myserver + +AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.0.2.100. Set the 'ServerName' directive globally to suppress this message +AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.0.2.100. Set the 'ServerName' directive globally to suppress this message +[Tue Jul 20 13:18:14.223727 2021] [mpm_event:notice] [pid 1:tid 140021067187328] AH00489: Apache/2.4.48 (Unix) configured -- resuming normal operations +[Tue Jul 20 13:18:14.223819 2021] [core:notice] [pid 1:tid 140021067187328] AH00094: Command line: 'httpd -D FOREGROUND' +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-rm(1)](podman-rm.1.md)** + +## HISTORY +February 2018, Updated by Brent Baude + +August 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-machine-cp.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-machine-cp.1.md new file mode 100644 index 000000000..02b3aaf88 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-machine-cp.1.md @@ -0,0 +1,68 @@ +--- +title: podman-machine-cp +version: v5.5.1 +--- + +% podman-machine-cp 1 + +## NAME +podman\-machine\-cp - Securely copy contents between the host and the virtual machine + +## SYNOPSIS +**podman machine cp** [*options*] *src_path* *dest_path* + +## DESCRIPTION + +Use secure copy (scp) to copy files or directories between the virtual machine +and your host machine. + +`podman machine cp` does not support copying between two virtual machines, +which would require two machines running simultaneously. + +Additionally, `podman machine cp` will automatically do a recursive copy of +files and directories. + +## OPTIONS + +#### **--help** + +Print usage statement. + +#### **--quiet**, **-q** + +Suppress copy status output. + +## EXAMPLES +Copy a file from your host to the running Podman Machine. +``` +$ podman machine cp ~/configuration.txt podman-machine-default:~/configuration.txt +... +Copy Successful +``` + +Copy a file from the running Podman Machine to your host. +``` +$ podman machine cp podman-machine-default:~/logs/log.txt ~/logs/podman-machine-default.txt +... +Copy Successful +``` + +Copy a directory from your host to the running Podman Machine. +``` +$ podman machine cp ~/.config podman-machine-default:~/.config +... +Copy Successful +``` + +Copy a directory from the running Podman Machine to your host. +``` +$ podman machine cp podman-machine-default:~/.config ~/podman-machine-default.config +... +Copy Successful +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +February 2025, Originally compiled by Jake Correnti diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-machine-info.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-machine-info.1.md new file mode 100644 index 000000000..c7a6176f1 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-machine-info.1.md @@ -0,0 +1,107 @@ +--- +title: podman-machine-info +version: v5.5.1 +--- + +% podman-machine-info 1 + +## NAME +podman\-machine\-info - Display machine host info + +## SYNOPSIS +**podman machine info** + +## DESCRIPTION + +Display information pertaining to the machine host. +Rootless only, as all `podman machine` commands can be only be used with rootless Podman. + +*Note*: The `DefaultMachine` field in the `Host` output does not suggest that +one can set a default podman machine via system connections. This value represents +the current active system connection associated with a podman machine. Regardless +of the default system connection, the default podman machine will always be +`podman-machine-default`. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change output format to "json" or a Go template. + +| **Placeholder** | **Description** | +| ------------------- | --------------------------------- | +| .Host ... | Host information for local machine| +| .Version ... | Version of the machine | + +#### **--help** + +Print usage statement. + +## EXAMPLES + +Display default Podman machine info. +``` +$ podman machine info +Host: + Arch: amd64 + CurrentMachine: "" + DefaultMachine: "" + EventsDir: /run/user/3267/podman + MachineConfigDir: /home/myusername/.config/containers/podman/machine/qemu + MachineImageDir: /home/myusername/.local/share/containers/podman/machine/qemu + MachineState: "" + NumberOfMachines: 0 + OS: linux + VMType: qemu +Version: + APIVersion: 4.4.0 + Built: 1677097848 + BuiltTime: Wed Feb 22 15:30:48 2023 + GitCommit: aa196c0d5c9abd5800edf9e27587c60343a26c2b-dirty + GoVersion: go1.20 + Os: linux + OsArch: linux/amd64 + Version: 4.4.0 +``` + +Display default Podman machine info formatted as json. +``` +$ podman machine info --format json +{ + "Host": { + "Arch": "amd64", + "CurrentMachine": "", + "DefaultMachine": "", + "EventsDir": "/run/user/3267/podman", + "MachineConfigDir": "/home/myusername/.config/containers/podman/machine/qemu", + "MachineImageDir": "/home/myusername/.local/share/containers/podman/machine/qemu", + "MachineState": "", + "NumberOfMachines": 0, + "OS": "linux", + "VMType": "qemu" + }, + "Version": { + "APIVersion": "4.4.0", + "Version": "4.4.0", + "GoVersion": "go1.20", + "GitCommit": "aa196c0d5c9abd5800edf9e27587c60343a26c2b-dirty", + "BuiltTime": "Wed Feb 22 15:30:48 2023", + "Built": 1677097848, + "OsArch": "linux/amd64", + "Os": "linux" + } +} +``` + +Display default Podman machine Host.Arch field. +``` +$ podman machine info --format "{{ .Host.Arch }}" +amd64 + +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +June 2022, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-machine-init.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-machine-init.1.md new file mode 100644 index 000000000..14f89d103 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-machine-init.1.md @@ -0,0 +1,255 @@ +--- +title: podman-machine-init +version: v5.5.1 +--- + +% podman-machine-init 1 + +## NAME +podman\-machine\-init - Initialize a new virtual machine + +## SYNOPSIS +**podman machine init** [*options*] [*name*] + +## DESCRIPTION + +Initialize a new virtual machine for Podman. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then the new machine will be named `podman-machine-default`. + +Rootless only. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +**podman machine init** initializes a new Linux virtual machine where containers are run. +SSH keys are automatically generated to access the VM, and system connections to the root account +and a user account inside the VM are added. + +By default, the VM distribution is a custom [Fedora CoreOS](https://getfedora.org/en/coreos?stream=stable) +based image pushed to quay.io/podman/machine-os (build in https://github.com/containers/podman-machine-os). +WSL is an exception and is based on a custom Fedora image. + +To check if there is an upgrade available for your machine os, you can run the following command: + +``` +$ podman machine ssh 'sudo rpm-ostree upgrade --check' + +``` +If an update is available, you can rerun the above command and remove the `--check` and your operating system will +be updated. After updating, you must stop and start your machine with `podman machine stop && podman machine start` for +it to take effect. + +The above mechanism is only used to update patch (Z) versions of podman. For updates to new major and minor +version (X.Y) use the **[podman machine os apply](podman-machine-os-apply.1.md)** command, see the docs there for +more information. + +Note: Updating as described above can result in version mismatches between Podman on the host and Podman in the +machine. Executing `podman info` should reveal versions of both. A configuration where the Podman host and machine +mismatch are unsupported. + +To update the WSL image you must run dnf update inside, use the following command: +``` +$ podman machine ssh dnf update +``` + +Default Podman machine settings can be set via the [machine] section in the containers.conf(5) file. + +## OPTIONS + +#### **--cpus**=*number* + +Number of CPUs. + +#### **--disk-size**=*number* + +Size of the disk for the guest VM in GiB. + +#### **--help** + +Print usage statement. + +#### **--ignition-path** + +Fully qualified path of the ignition file. + +If an ignition file is provided, the file +is copied into the user's CONF_DIR and renamed. Additionally, no SSH keys are generated, nor are any system connections made. It is assumed that the user does these things manually or handled otherwise. + +#### **--image** + +Fully qualified registry, path, or URL to a VM image. +Registry target must be in the form of `docker://registry/repo/image:version`. + +Note: Only images provided by podman will be supported. + +#### **--memory**, **-m**=*number* + +Memory (in MiB). Note: 1024MiB = 1GiB. + +#### **--now** + +Start the virtual machine immediately after it has been initialized. + +#### **--playbook** + +Add the provided Ansible playbook to the machine and execute it after the first boot. + +Note: The playbook will be executed with the same privileges given to the user in the virtual machine. The playbook provided cannot include other files from the host system, as they will not be copied. +Use of the `--playbook` flag will require the image to include Ansible. The default image provided will have Ansible included. + +#### **--rootful** + +Whether this machine prefers rootful (`true`) or rootless (`false`) +container execution. This option determines the remote connection default +if there is no existing remote connection configurations. + +API forwarding, if available, follows this setting. + +#### **--timezone** + +Set the timezone for the machine and containers. Valid values are `local` or +a `timezone` such as `America/Chicago`. A value of `local`, which is the default, +means to use the timezone of the machine host. + +The timezone setting is not used with WSL. WSL automatically sets the timezone to the same +as the host Windows operating system. + +#### **--usb**=*bus=number,devnum=number* or *vendor=hexadecimal,product=hexadecimal* + +Assign a USB device from the host to the VM via USB passthrough. +Only supported for QEMU Machines. + +The device needs to have proper permissions in order to be passed to the machine. This +means the device needs to be under your user group. + +Note that using bus and device number are simpler but the values can change every boot +or when the device is unplugged. + +When specifying a USB using vendor and product ID's, if more than one device has the +same vendor and product ID, the first available device is assigned. + + +[//]: # (BEGIN included file options/user-mode-networking.md) +#### **--user-mode-networking** + +Indicates that this machine relays traffic from the guest through a user-space +process running on the host. In some VPN configurations the VPN may drop +traffic from alternate network interfaces, including VM network devices. By +enabling user-mode networking (a setting of `true`), VPNs observe all +podman machine traffic as coming from the host, bypassing the problem. + +When the qemu backend is used (Linux, Mac), user-mode networking is +mandatory and the only allowed value is `true`. In contrast, The Windows/WSL +backend defaults to `false`, and follows the standard WSL network setup. +Changing this setting to `true` on Windows/WSL informs Podman to replace +the WSL networking setup on start of this machine instance with a user-mode +networking distribution. Since WSL shares the same kernel across +distributions, all other running distributions reuses this network. +Likewise, when the last machine instance with a `true` setting stops, the +original networking setup is restored. + +[//]: # (END included file options/user-mode-networking.md) + +#### **--username** + +Username to use for executing commands in remote VM. Default value is `core` +for FCOS and `user` for Fedora (default on Windows hosts). Should match the one +used inside the resulting VM image. + +#### **--volume**, **-v**=*source:target[\\\:options]* + +Mounts a volume from source to target. + +Create a mount. If /host-dir:/machine-dir is specified as the `*source:target*`, +Podman mounts _host-dir_ in the host to _machine-dir_ in the Podman machine. + +Additional options may be specified as a comma-separated string. Recognized +options are: +* **ro**: mount volume read-only +* **rw**: mount volume read/write (default) +* **security_model=[model]**: specify 9p security model (see below) + +Note: The following destinations are forbidden for volumes: `/bin`, `/boot`, `/dev`, `/etc`, +`/home`, `/proc`, `/root`, `/run`, `/sbin`, `/sys`, `/tmp`, `/usr`, and `/var`. Subdirectories +of these destinations are allowed but users should be careful to not mount to important directories +as unexpected results may occur. + + +The 9p security model [determines] https://wiki.qemu.org/Documentation/9psetup#Starting_the_Guest_directly +if and how the 9p filesystem translates some filesystem operations before +actual storage on the host. + +In order to allow symlinks to work, on MacOS the default security model is + *none*. + +The value of *mapped-xattr* specifies that 9p store symlinks and some file +attributes as extended attributes on the host. This is suitable when the host +and the guest do not need to interoperate on the shared filesystem, but has +caveats for actual shared access; notably, symlinks on the host are not usable +on the guest and vice versa. If interoperability is required, then choose +*none* instead, but keep in mind that the guest is not able to do things +that the user running the virtual machine cannot do, e.g. create files owned by +another user. Using *none* is almost certainly the best choice for read-only +volumes. + +Example: `-v "$HOME/git:$HOME/git:ro,security_model=none"` + +Default volume mounts are defined in *containers.conf*. Unless changed, the default values +is `$HOME:$HOME`. + +**Note on Windows Subsystem for Linux (WSL)** +Since all drives are mounted at `/mnt` on startup by default in WSL, passing +`--volume` is redundant and has no effect. The host home directory for a `C:` +drive will be mounted at `/mnt/c/Users/`. + +## EXAMPLES + +Initialize the default Podman machine, pulling the content from the internet. +``` +$ podman machine init +``` + +Initialize a Podman machine for the specified name pulling the content from the internet. +``` +$ podman machine init myvm +``` + +Initialize the default Podman machine pulling the content from the internet defaulting to rootful mode. The default is rootless. +``` +$ podman machine init --rootful +``` + +Initialize the default Podman machine overriding its disk size override, pulling the content from the internet. +``` +$ podman machine init --disk-size 50 +``` + +Initialize the specified Podman machine overriding its memory size, pulling the content from the internet. +``` +$ podman machine init --memory=1024 myvm +``` + +Initialize the default Podman machine with the host directory `/Users` mounted into the VM at `/Users`. +``` +$ podman machine init -v /Users:/Users +``` + +Initialize the default Podman machine with a usb device passthrough specified with options. Only supported for QEMU Machines. +``` +$ podman machine init --usb vendor=13d3,product=5406 +``` + +Initialize the default Podman machine with a usb device passthrough with specified with options. Only supported for QEMU Machines. +``` +$ podman machine init --usb bus=1,devnum=3 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**, **containers.conf(5)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-machine-inspect.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-machine-inspect.1.md new file mode 100644 index 000000000..11a21e994 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-machine-inspect.1.md @@ -0,0 +1,60 @@ +--- +title: podman-machine-inspect +version: v5.5.1 +--- + +% podman-machine-inspect 1 + +## NAME +podman\-machine\-inspect - Inspect one or more virtual machines + +## SYNOPSIS +**podman machine inspect** [*options*] [*name*] ... + +## DESCRIPTION + +Inspect one or more virtual machines + +Obtain greater detail about Podman virtual machines. More than one virtual machine can be +inspected at once. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be inspected. + +Rootless only. + +## OPTIONS +#### **--format** + +Print results with a Go template. + +| **Placeholder** | **Description** | +| ------------------- | --------------------------------------------------------------------- | +| .ConfigDir ... | Machine configuration directory location | +| .ConnectionInfo ... | Machine connection information | +| .Created ... | Machine creation time (string, ISO3601) | +| .LastUp ... | Time when machine was last booted | +| .Name | Name of the machine | +| .Resources ... | Resources used by the machine | +| .Rootful | Whether the machine prefers rootful or rootless container execution | +| .Rosetta | Whether this machine uses Rosetta | +| .SSHConfig ... | SSH configuration info for communicating with machine | +| .State | Machine state | +| .UserModeNetworking | Whether this machine uses user-mode networking | + +#### **--help** + +Print usage statement. + +## EXAMPLES + +Inspect the specified Podman machine. +``` +$ podman machine inspect podman-machine-default +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +April 2022, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-machine-list.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-machine-list.1.md new file mode 100644 index 000000000..a6d22dbd9 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-machine-list.1.md @@ -0,0 +1,117 @@ +--- +title: podman-machine-list +version: v5.5.1 +--- + +% podman-machine-list 1 + +## NAME +podman\-machine\-list - List virtual machines + +## SYNOPSIS +**podman machine list** [*options*] + +**podman machine ls** [*options*] + +## DESCRIPTION + +List Podman managed virtual machines. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +Rootless only. + +NOTE: The podman-machine configuration file is managed under the +`$XDG_CONFIG_HOME/containers/podman/machine/` directory. Changing the `$XDG_CONFIG_HOME` +environment variable while the machines are running can lead to unexpected behavior. +(see [podman(1)](podman.1.md)) + +## OPTIONS + +#### **--all-providers** + +Show machines from all providers + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------- | ----------------------------------------- | +| .CPUs | Number of CPUs | +| .Created | Time since VM creation | +| .Default | Is default machine | +| .DiskSize | Disk size of machine | +| .IdentityPath | Path to ssh identity file | +| .LastUp | Time since the VM was last run | +| .Memory | Allocated memory for machine | +| .Name | VM name | +| .Port | SSH Port to use to connect to VM | +| .RemoteUsername | VM Username for rootless Podman | +| .Running | Is machine running | +| .Stream | Stream name | +| .UserModeNetworking | Whether machine uses user-mode networking | +| .VMType | VM type | + +#### **--help** + +Print usage statement. + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Only print the name of the machine. This also implies no table heading +is printed. + +## EXAMPLES + +List all Podman machines. +``` +$ podman machine list +NAME VM TYPE CREATED LAST UP CPUS MEMORY DISK SIZE +podman-machine-default qemu 2 weeks ago 2 weeks ago 1 2.147GB 10.74GB +``` + +List all Podman machines using the specified table format. +``` +$ podman machine ls --format "table {{.Name}}\t{{.VMType}}\t{{.Created}}\t{{.LastUp}}" +NAME VM TYPE CREATED LAST UP +podman-machine-default qemu 2 weeks ago 2 weeks ago +``` + +List all Podman machines in json format. +``` +$ podman machine ls --format json +[ + { + "Name": "podman-machine-default", + "Default": false, + "Created": "2021-12-27T10:36:14.373347492-05:00", + "Running": false, + "LastUp": "2021-12-27T11:22:50.17333371-05:00", + "Stream": "default", + "VMType": "qemu", + "CPUs": 1, + "Memory": "2147483648", + "DiskSize": "10737418240" + } +] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-machine-os-apply.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-machine-os-apply.1.md new file mode 100644 index 000000000..3d2c0ba09 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-machine-os-apply.1.md @@ -0,0 +1,70 @@ +--- +title: podman-machine-os-apply +version: v5.5.1 +--- + +% podman-machine-os-apply 1 + +## NAME +podman\-machine\-os\-apply - Apply an OCI image to a Podman Machine's OS + +## SYNOPSIS +**podman machine os apply** [*options*] *image* [vm] + +## DESCRIPTION + +Apply machine OS changes from an OCI image. + +VM's that use OS's that use rpm-ostreee have the capability to rebase itself from the content of an OCI image. +`podman machine image apply` takes an OCI image with container native ostree functionality and rebases itself on that image. + +By default, Podman machines on Mac, Linux, and Windows Hyper-V use a customized rpm-ostree based distribution (Fedora CoreOS). Machines based on Microsoft WSL use a +customized Fedora distribution and cannot be updated with this command. + +Note: WSL-based machines are upgradable by using the `podman machine ssh ` command followed by `sudo dnf update`. This can, however, result in unexpected results in +Podman client and server version differences. + +Podman machine images are stored as OCI images at `quay.io/podman/machine-os`. When applying an image using this +command, the fully qualified OCI reference name must be used including tag where the tag is the +version of Podman that is inside the VM. By default, Podman will attempt to pull only the statement +version as itself. + +For more information, see the [rpm-ostree documentation](https://coreos.github.io/rpm-ostree/container/). + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then the OS changes will be applied to `podman-machine-default`. + +## OPTIONS + +#### **--help** + +Print usage statement. + +#### **--restart** + +Restart VM after applying changes. + +## EXAMPLES + +Update the default Podman machine to the latest development version of the +bootable OCI image. + +Note: This may result in having a newer Podman version inside the machine +than the client. Unexpected results may occur. + +Update the default Podman machine to the most recent Podman 5.4 bootable +OCI image. +``` +$ podman machine os apply quay.io/podman/machine-os:5.4 +``` + +Update the specified Podman machine to latest Podman 5.3 bootable OCI image. +``` +$ podman machine os apply quay.io/podman/machine-os:5.3 mymachine +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**, **[podman-machine-os(1)](podman-machine-os.1.md)** + +## HISTORY +February 2023, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-machine-os.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-machine-os.1.md new file mode 100644 index 000000000..97befe216 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-machine-os.1.md @@ -0,0 +1,27 @@ +--- +title: podman-machine-os +version: v5.5.1 +--- + +% podman-machine-os 1 + +## NAME +podman\-machine\-os - Manage a Podman virtual machine's OS + +## SYNOPSIS +**podman machine os** *subcommand* + +## DESCRIPTION +`podman machine os` is a set of subcommands that manage a Podman virtual machine's operating system. + +## SUBCOMMANDS + +| Command | Man Page | Description | +|---------|--------------------------------------------------------------|----------------------------------------------| +| apply | [podman-machine-os-apply(1)](podman-machine-os-apply.1.md) | Apply an OCI image to a Podman Machine's OS | + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**, **[podman-machine-os-apply(1)](podman-machine-os-apply.1.md)** + +## HISTORY +February 2023, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-machine-reset.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-machine-reset.1.md new file mode 100644 index 000000000..90946b4ee --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-machine-reset.1.md @@ -0,0 +1,52 @@ +--- +title: podman-machine-reset +version: v5.5.1 +--- + +% podman-machine-reset 1 + +## NAME +podman\-machine\-reset - Reset Podman machines and environment + +## SYNOPSIS +**podman machine reset** [*options*] + +## DESCRIPTION + +Reset your Podman machine environment. This command stops any running machines +and then removes them. Configuration and data files are then removed. Data files +would include machine disk images and any previously pulled cache images. When +this command is run, all of your Podman machines will have been deleted. + +## OPTIONS + +#### **--force**, **-f** + +Reset without confirmation. + +#### **--help** + +Print usage statement. + + +## EXAMPLES + +``` +$ podman machine reset +Warning: this command will delete all existing podman machines +and all of the configuration and data directories for Podman machines + +The following machine(s) will be deleted: + +dev +podman-machine-default + +Are you sure you want to continue? [y/N] y +$ +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +Feb 2024, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-machine-rm.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-machine-rm.1.md new file mode 100644 index 000000000..667919ab8 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-machine-rm.1.md @@ -0,0 +1,71 @@ +--- +title: podman-machine-rm +version: v5.5.1 +--- + +% podman-machine-rm 1 + +## NAME +podman\-machine\-rm - Remove a virtual machine + +## SYNOPSIS +**podman machine rm** [*options*] [*name*] + +## DESCRIPTION + +Remove a virtual machine and its related files. What is actually deleted +depends on the virtual machine type. For all virtual machines, the generated +podman system connections are deleted. The ignition files +generated for that VM are also removed as is its image file on the filesystem. + +Users get a display of what is deleted and are required to confirm unless the option `--force` +is used. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be removed. + +Rootless only. + +## OPTIONS + +#### **--force**, **-f** + +Stop and delete without confirmation. + +#### **--help** + +Print usage statement. + +#### **--save-ignition** + +Do not delete the generated ignition file. + +#### **--save-image** + +Do not delete the VM image. + +## EXAMPLES + +Remove the specified Podman machine. +``` +$ podman machine rm test1 + +The following files will be deleted: + +/home/user/.config/containers/podman/machine/qemu/test1.ign +/home/user/.local/share/containers/podman/machine/qemu/test1_fedora-coreos-33.20210315.1.0-qemu.x86_64.qcow2 +/home/user/.config/containers/podman/machine/qemu/test1.json + +Are you sure you want to continue? [y/N] y +``` + +Remove the specified Podman machine even if it is running. +``` +$ podman machine rm -f test1 +$ +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-machine-set.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-machine-set.1.md new file mode 100644 index 000000000..23353749f --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-machine-set.1.md @@ -0,0 +1,126 @@ +--- +title: podman-machine-set +version: v5.5.1 +--- + +% podman-machine-set 1 + +## NAME +podman\-machine\-set - Set a virtual machine setting + +## SYNOPSIS +**podman machine set** [*options*] [*name*] + +## DESCRIPTION + +Change a machine setting. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then the settings will be applied to `podman-machine-default`. + +Rootless only. + +Default Podman machine settings can be set via the [machine] section in the containers.conf(5) file. + +## OPTIONS + +#### **--cpus**=*number* + +Number of CPUs. +Only supported for QEMU machines. + +#### **--disk-size**=*number* + +Size of the disk for the guest VM in GB. +Can only be increased. Only supported for QEMU machines. + +#### **--help** + +Print usage statement. + +#### **--memory**, **-m**=*number* + +Memory (in MB). +Only supported for QEMU machines. + +#### **--rootful** + +Whether this machine prefers rootful (`true`) or rootless (`false`) +container execution. This option updates the current podman +remote connection default if it is currently pointing at the specified +machine name (or `podman-machine-default` if no name is specified). + +Unlike [**podman system connection default**](podman-system-connection-default.1.md) +this option makes the API socket, if available, forward to the rootful/rootless +socket in the VM. + +Note that changing this option means that all the existing containers/images/volumes, etc... +are no longer visible with the default connection/socket. This is because the root and rootless +users in the VM are completely separated and do not share any storage. The data however is not +lost and you can always change this option back or use the other connection to access it. + +#### **--usb**=*bus=number,devnum=number* or *vendor=hexadecimal,product=hexadecimal* or *""* + +Assign a USB device from the host to the VM. +Only supported for QEMU Machines. + +The device needs to be present when the VM starts. +The device needs to have proper permissions in order to be assign to podman machine. + +Use an empty string to remove all previously set USB devices. + +Note that using bus and device number are simpler but the values can change every boot or when the +device is unplugged. Using vendor and product might lead to collision in the case of multiple +devices with the same vendor product value, the first available device is assigned. + + +[//]: # (BEGIN included file options/user-mode-networking.md) +#### **--user-mode-networking** + +Indicates that this machine relays traffic from the guest through a user-space +process running on the host. In some VPN configurations the VPN may drop +traffic from alternate network interfaces, including VM network devices. By +enabling user-mode networking (a setting of `true`), VPNs observe all +podman machine traffic as coming from the host, bypassing the problem. + +When the qemu backend is used (Linux, Mac), user-mode networking is +mandatory and the only allowed value is `true`. In contrast, The Windows/WSL +backend defaults to `false`, and follows the standard WSL network setup. +Changing this setting to `true` on Windows/WSL informs Podman to replace +the WSL networking setup on start of this machine instance with a user-mode +networking distribution. Since WSL shares the same kernel across +distributions, all other running distributions reuses this network. +Likewise, when the last machine instance with a `true` setting stops, the +original networking setup is restored. + +[//]: # (END included file options/user-mode-networking.md) + +## EXAMPLES + +To switch the default Podman machine from rootless to rootful: + +``` +$ podman machine set --rootful +``` + +or more explicitly set with value true. + +``` +$ podman machine set --rootful=true +``` + +Switch the default Podman machine from rootful to rootless. +``` +$ podman machine set --rootful=false +``` + +Switch the specified Podman machine from rootless to rootful. +``` +$ podman machine set --rootful myvm +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**, **containers.conf(5)** + +## HISTORY +February 2022, Originally compiled by Jason Greene diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-machine-ssh.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-machine-ssh.1.md new file mode 100644 index 000000000..0a76f94dc --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-machine-ssh.1.md @@ -0,0 +1,91 @@ +--- +title: podman-machine-ssh +version: v5.5.1 +--- + +% podman-machine-ssh 1 + +## NAME +podman\-machine\-ssh - SSH into a virtual machine + +## SYNOPSIS +**podman machine ssh** [*options*] [*name*] [*command* [*arg* ...]] + +## DESCRIPTION + +SSH into a Podman-managed virtual machine and optionally execute a command +on the virtual machine. Unless using the default virtual machine, the +first argument must be the virtual machine name. The optional command to +execute can then follow. If no command is provided, an interactive session +with the virtual machine is established. + +The exit code from ssh command is forwarded to the podman machine ssh caller, see [Exit Codes](#Exit-Codes). + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be SSH'd into. + +Rootless only. + +## OPTIONS + +#### **--help** + +Print usage statement. + +#### **--username**=*name* + +Username to use when SSH-ing into the VM. + +## Exit Codes + +The exit code from `podman machine ssh` gives information about why the command failed. +When `podman machine ssh` commands exit with a non-zero code, +the exit codes follow the `chroot` standard, see below: + + **125** The error is with podman **_itself_** + + $ podman machine ssh --foo; echo $? + Error: unknown flag: --foo + 125 + + **126** Executing a _contained command_ and the _command_ cannot be invoked + + $ podman machine ssh /etc; echo $? + Error: fork/exec /etc: permission denied + 126 + + **127** Executing a _contained command_ and the _command_ cannot be found + + $ podman machine ssh foo; echo $? + Error: fork/exec /usr/bin/bogus: no such file or directory + 127 + + **Exit code** _contained command_ exit code + + $ podman machine ssh /bin/sh -c 'exit 3'; echo $? + 3 + +## EXAMPLES + +To get an interactive session with the default Podman machine: + +SSH into the default Podman machine. +``` +$ podman machine ssh +``` + +Run command inside the default Podman machine via ssh. +``` +$ podman machine ssh myvm +``` + +Run command inside the specified Podman machine via ssh. +``` +$ podman machine ssh myvm rpm -q podman +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-machine-start.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-machine-start.1.md new file mode 100644 index 000000000..5d0d737de --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-machine-start.1.md @@ -0,0 +1,58 @@ +--- +title: podman-machine-start +version: v5.5.1 +--- + +% podman-machine-start 1 + +## NAME +podman\-machine\-start - Start a virtual machine + +## SYNOPSIS +**podman machine start** [*name*] + +## DESCRIPTION + +Starts a virtual machine for Podman. + +Rootless only. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be started. + +Only one Podman managed VM can be active at a time. If a VM is already running, +`podman machine start` returns an error. + +**podman machine start** starts a Linux virtual machine where containers are run. + +## OPTIONS + +#### **--help** + +Print usage statement. + +#### **--no-info** + +Suppress informational tips. + +#### **--quiet**, **-q** + +Suppress machine starting status output. + +## EXAMPLES + +Start the specified podman machine. +``` +$ podman machine start myvm +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-machine-stop.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-machine-stop.1.md new file mode 100644 index 000000000..f27adfa41 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-machine-stop.1.md @@ -0,0 +1,47 @@ +--- +title: podman-machine-stop +version: v5.5.1 +--- + +% podman-machine-stop 1 + +## NAME +podman\-machine\-stop - Stop a virtual machine + +## SYNOPSIS +**podman machine stop** [*name*] + +## DESCRIPTION + +Stops a virtual machine. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be stopped. + +Rootless only. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +**podman machine stop** stops a Linux virtual machine where containers are run. + +## OPTIONS + +#### **--help** + +Print usage statement. + +## EXAMPLES + +Stop a podman machine named myvm. +``` +$ podman machine stop myvm +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-machine.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-machine.1.md new file mode 100644 index 000000000..a65bd1bcc --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-machine.1.md @@ -0,0 +1,56 @@ +--- +title: podman-machine +version: v5.5.1 +--- + +% podman-machine 1 + +## NAME +podman\-machine - Manage Podman's virtual machine + +## SYNOPSIS +**podman machine** *subcommand* + +## DESCRIPTION +`podman machine` is a set of subcommands that manage Podman's virtual machine. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +All `podman machine` commands are rootless only. + +NOTE: The podman-machine configuration file is managed under the +`$XDG_CONFIG_HOME/containers/podman/machine/` directory. Changing the `$XDG_CONFIG_HOME` +environment variable while the machines are running can lead to unexpected behavior. + +Podman machine behaviour can be modified via the [machine] section in the containers.conf(5) file. + +## SUBCOMMANDS + +| Command | Man Page | Description | +|---------|----------------------------------------------------------|-----------------------------------------------------------------| +| cp | [podman-machine-cp(1)](podman-machine-cp.1.md) | Securely copy contents between the host and the virtual machine | +| info | [podman-machine-info(1)](podman-machine-info.1.md) | Display machine host info | +| init | [podman-machine-init(1)](podman-machine-init.1.md) | Initialize a new virtual machine | +| inspect | [podman-machine-inspect(1)](podman-machine-inspect.1.md) | Inspect one or more virtual machines | +| list | [podman-machine-list(1)](podman-machine-list.1.md) | List virtual machines | +| os | [podman-machine-os(1)](podman-machine-os.1.md) | Manage a Podman virtual machine's OS | +| reset | [podman-machine-reset(1)](podman-machine-reset.1.md) | Reset Podman machines and environment | +| rm | [podman-machine-rm(1)](podman-machine-rm.1.md) | Remove a virtual machine | +| set | [podman-machine-set(1)](podman-machine-set.1.md) | Set a virtual machine setting | +| ssh | [podman-machine-ssh(1)](podman-machine-ssh.1.md) | SSH into a virtual machine | +| start | [podman-machine-start(1)](podman-machine-start.1.md) | Start a virtual machine | +| stop | [podman-machine-stop(1)](podman-machine-stop.1.md) | Stop a virtual machine | + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine-cp(1)](podman-machine-cp.1.md)**, **[podman-machine-info(1)](podman-machine-info.1.md)**, **[podman-machine-init(1)](podman-machine-init.1.md)**, **[podman-machine-list(1)](podman-machine-list.1.md)**, **[podman-machine-os(1)](podman-machine-os.1.md)**, **[podman-machine-rm(1)](podman-machine-rm.1.md)**, **[podman-machine-ssh(1)](podman-machine-ssh.1.md)**, **[podman-machine-start(1)](podman-machine-start.1.md)**, **[podman-machine-stop(1)](podman-machine-stop.1.md)**, **[podman-machine-inspect(1)](podman-machine-inspect.1.md)**, **[podman-machine-reset(1)](podman-machine-reset.1.md)**, **containers.conf(5)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-manifest-add.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-manifest-add.1.md new file mode 100644 index 000000000..63be95f61 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-manifest-add.1.md @@ -0,0 +1,235 @@ +--- +title: podman-manifest-add +version: v5.5.1 +--- + +% podman-manifest-add 1 + +## NAME +podman\-manifest\-add - Add an image or artifact to a manifest list or image index + +## SYNOPSIS +**podman manifest add** [*options*] *listnameorindexname* [*transport*]:*imagename* *imageorartifactname* [...] + +## DESCRIPTION + +Adds the specified image to the specified manifest list or image index, or +creates an artifact manifest and adds it to the specified image index. + +## RETURN VALUE + +The list image's ID. + +## OPTIONS + +#### **--all** + +If the image which is added to the list or index is itself a list or +index, add all of the contents to the local list. By default, only one image +from such a list or index is added to the list or index. Combining +*--all* with any of the other options described below is NOT recommended. + + +[//]: # (BEGIN included file options/annotation.manifest.md) +#### **--annotation**=*annotation=value* + +Set an annotation on the entry for the specified image or artifact. + +[//]: # (END included file options/annotation.manifest.md) + +#### **--arch**=*architecture* + +Override the architecture which the list or index records as a requirement for +the image. If *imageName* refers to a manifest list or image index, the +architecture information is retrieved from it. Otherwise, it is +retrieved from the image's configuration information. + +#### **--artifact** + +Create an artifact manifest and add it to the image index. Arguments after the +index name will be interpreted as file names rather than as image references. +In most scenarios, the **--artifact-type** option should also be specified. + +#### **--artifact-config**=*path* + +When creating an artifact manifest and adding it to the image index, use the +specified file's contents as the configuration blob in the artifact manifest. +In most scenarios, leaving the default value, which signifies an empty +configuration, unchanged, is the preferred option. + +#### **--artifact-config-type**=*type* + +When creating an artifact manifest and adding it to the image index, use the +specified MIME type as the `mediaType` associated with the configuration blob +in the artifact manifest. In most scenarios, leaving the default value, which +signifies either an empty configuration or the standard OCI configuration type, +unchanged, is the preferred option. + +#### **--artifact-exclude-titles** + +When creating an artifact manifest and adding it to the image index, do not +set "org.opencontainers.image.title" annotations equal to the file's basename +for each file added to the artifact manifest. Tools which retrieve artifacts +from a registry may use these values to choose names for files when saving +artifacts to disk, so this option is not recommended unless it is required +for interoperability with a particular registry. + +#### **--artifact-layer-type**=*type* + +When creating an artifact manifest and adding it to the image index, use the +specified MIME type as the `mediaType` associated with the files' contents. If +not specified, guesses based on either the files names or their contents will +be made and used, but the option should be specified if certainty is needed. + +#### **--artifact-subject**=*imageName* + +When creating an artifact manifest and adding it to the image index, set the +*subject* field in the artifact manifest to mark the artifact manifest as being +associated with the specified image in some way. An artifact manifest can only +be associated with, at most, one subject. + +#### **--artifact-type**=*type* + +When creating an artifact manifest, use the specified MIME type as the +manifest's `artifactType` value instead of the less informative default value. + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/features.md) +#### **--features**=*feature* + +Specify the features list which the list or index records as requirements for +the image. This option is rarely used. + +[//]: # (END included file options/features.md) + +#### **--os**=*OS* + +Override the OS which the list or index records as a requirement for the image. +If *imagename* refers to a manifest list or image index, the OS information +is retrieved from it. Otherwise, it is retrieved from the image's +configuration information. + + +[//]: # (BEGIN included file options/os-version.md) +#### **--os-version**=*version* + +Specify the OS version which the list or index records as a requirement for the +image. This option is rarely used. + +[//]: # (END included file options/os-version.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/variant.manifest.md) +#### **--variant** + +Specify the variant which the list or index records for the image. This option +is typically used to distinguish between multiple entries which share the same +architecture value, but which expect different versions of its instruction set. + +[//]: # (END included file options/variant.manifest.md) + +## Transport + + Multiple transports are supported: + + **docker://**_docker-reference_ _(default)_ + An image in a registry implementing the "Docker Registry HTTP API V2". By default, uses the authorization state in `$XDG_RUNTIME_DIR/containers/auth.json`, which is set using `(podman login)`. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using `(docker login)`. + + $ podman manifest add mylist\:v1.11 docker://quay.io/username/myimage + + **containers-storage:**_oci-reference_ + An image in _oci-reference_ format stored in the local container storage. _oci-reference_ must contain a tag. + + $ podman manifest add mylist\:v1.11 containers-storage\:quay.io/username/myimage + + **dir:**_path_ + An existing local directory _path_ storing the manifest, layer tarballs, and signatures as individual files. This + is a non-standardized format, primarily useful for debugging or noninvasive container inspection. + + $ podman manifest add dir:/tmp/myimage + + **docker-archive:**_path_[**:**_docker-reference_] + An image is stored in the `docker save` formatted file. _docker-reference_ is only used when creating such a + file, and it must not contain a digest. + + $ podman manifest add docker-archive:/tmp/myimage + + **docker-daemon:**_docker-reference_ + An image in _docker-reference_ format stored in the docker daemon internal storage. The _docker-reference_ can also be an image ID (docker-daemon\:algo\:digest). + + $ sudo podman manifest add docker-daemon\:docker.io/library/myimage:33 + + **oci-archive:**_path_**:**_tag_ + An image _tag_ in a directory compliant with "Open Container Image Layout Specification" at _path_. + + $ podman manifest add oci-archive:/tmp/myimage + +## EXAMPLE + +Add specified default image from source manifest list to destination manifest list: +``` +podman manifest add mylist:v1.11 docker://fedora +71c201d10fffdcac52968a000d85a0a016ca1c7d5473948000d3131c1773d965 +``` + +Add all images from source manifest list to destination manifest list: +``` +podman manifest add --all mylist:v1.11 docker://fedora +71c201d10fffdcac52968a000d85a0a016ca1c7d5473948000d3131c1773d965 +``` + +Add selected image matching arch and variant from source manifest list to destination manifest list: +``` +podman manifest add --arch arm64 --variant v8 mylist\:v1.11 docker://71c201d10fffdcac52968a000d85a0a016ca1c7d5473948000d3131c1773d965 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-manifest-annotate.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-manifest-annotate.1.md new file mode 100644 index 000000000..6b872adf3 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-manifest-annotate.1.md @@ -0,0 +1,95 @@ +--- +title: podman-manifest-annotate +version: v5.5.1 +--- + +% podman-manifest-annotate 1 + +## NAME +podman\-manifest\-annotate - Add and update information about an image or artifact in a manifest list or image index + +## SYNOPSIS +**podman manifest annotate** [*options*] *listnameorindexname* *imagemanifestdigestorimageorartifactname* + +## DESCRIPTION + +Adds or updates information about an image or artifact included in a manifest list or image index. + +## OPTIONS + + +[//]: # (BEGIN included file options/annotation.manifest.md) +#### **--annotation**=*annotation=value* + +Set an annotation on the entry for the specified image or artifact. + +[//]: # (END included file options/annotation.manifest.md) +If **--index** is also specified, sets the annotation on the entire image index. + +#### **--arch**=*architecture* + +Override the architecture which the list or index records as a requirement for +the image. This is usually automatically retrieved from the image's +configuration information, so it is rarely necessary to use this option. + + +[//]: # (BEGIN included file options/features.md) +#### **--features**=*feature* + +Specify the features list which the list or index records as requirements for +the image. This option is rarely used. + +[//]: # (END included file options/features.md) + +#### **--index** + +Treats arguments to the **--annotation** option as annotation values to be set +on the image index itself rather than on an entry in the image index. Implied +for **--subject**. + +#### **--os**=*OS* + +Override the OS which the list or index records as a requirement for the image. +This is usually automatically retrieved from the image's configuration +information, so it is rarely necessary to use this option. + +#### **--os-features**=*feature* + +Specify the OS features list which the list or index records as requirements +for the image. This option is rarely used. + + +[//]: # (BEGIN included file options/os-version.md) +#### **--os-version**=*version* + +Specify the OS version which the list or index records as a requirement for the +image. This option is rarely used. + +[//]: # (END included file options/os-version.md) + +#### **--subject**=*imageName* + +Set the *subject* field in the image index to mark the image index as being +associated with the specified image in some way. An image index can only be +associated with, at most, one subject. + + +[//]: # (BEGIN included file options/variant.manifest.md) +#### **--variant** + +Specify the variant which the list or index records for the image. This option +is typically used to distinguish between multiple entries which share the same +architecture value, but which expect different versions of its instruction set. + +[//]: # (END included file options/variant.manifest.md) + +## EXAMPLE + +Update arch and variant information to specified manifest list for image: +``` +podman manifest annotate --arch arm64 --variant v8 mylist:v1.11 sha256:59eec8837a4d942cc19a52b8c09ea75121acc38114a2c68b98983ce9356b8610 +07ec8dc22b5dba3a33c60b68bce28bbd2b905e383fdb32a90708fa5eeac13a07: sha256:59eec8837a4d942cc19a52b8c09ea75121acc38114a2c68b98983ce9356b8610 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-manifest-create.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-manifest-create.1.md new file mode 100644 index 000000000..3bc2d6a81 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-manifest-create.1.md @@ -0,0 +1,79 @@ +--- +title: podman-manifest-create +version: v5.5.1 +--- + +% podman-manifest-create 1 + +## NAME +podman\-manifest\-create - Create a manifest list or image index + +## SYNOPSIS +**podman manifest create** [*options*] *listnameorindexname* [*imagename* ...] + +## DESCRIPTION + +Creates a new manifest list and stores it as an image in local storage using +the specified name. + +If additional images are specified, they are added to the newly-created list or +index. + +## OPTIONS + +#### **--all** + +If any of the images added to the new list or index are +themselves lists or indexes, add all of their contents. By default, only one +image from such a list is added to the newly-created list or index. + +#### **--amend**, **-a** + +If a manifest list named *listnameorindexname* already exists, modify the +preexisting list instead of exiting with an error. The contents of +*listnameorindexname* are not modified if no *imagename*s are given. + +#### **--annotation**=*value* + +Set an annotation on the newly-created image index. + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Create the specified manifest. +``` +podman manifest create mylist:v1.11 +9cfd24048d5fc80903f088f1531a21bff01172abe66effa8941a4c2308dc745f +``` + +Create the specified manifest manifest or modify it if it previously exist. +``` +podman manifest create --amend mylist:v1.11 +9cfd24048d5fc80903f088f1531a21bff01172abe66effa8941a4c2308dc745f +``` + +Create the named manifest including the specified image matching the current platform. +``` +podman manifest create mylist:v1.11 docker://fedora +5c2bc76bfb4ba6665a7973f7e1c05ee0536b4580637f27adc9fa5a4b2bc03cf1 +``` + +Create the named manifest including all images referred to with the specified image reference. +``` +podman manifest create --all mylist\:v1.11 docker://fedora +30330571e79c65288a4fca421d9aed29b0210d57294d9c2056743fdcf6e3967b +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-manifest-exists.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-manifest-exists.1.md new file mode 100644 index 000000000..c04bd011e --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-manifest-exists.1.md @@ -0,0 +1,47 @@ +--- +title: podman-manifest-exists +version: v5.5.1 +--- + +% podman-manifest-exists 1 + +## NAME +podman\-manifest\-exists - Check if the given manifest list exists in local storage + +## SYNOPSIS +**podman manifest exists** *manifest* + +## DESCRIPTION +**podman manifest exists** checks if a manifest list exists on local storage. +Podman returns an exit code of `0` when the manifest is found. A `1` is +returned otherwise. +An exit code of `125` indicates there was another issue. + + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement. + +## EXAMPLE + +Check if a manifest list called `list1` exists (the manifest list does actually exist): +``` +$ podman manifest exists list1 +$ echo $? +0 +``` + +Check if a manifest called `mylist` exists (the manifest list does not actually exist): +``` +$ podman manifest exists mylist +$ echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** + +## HISTORY +January 2021, Originally compiled by Paul Holzinger `` diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-manifest-inspect.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-manifest-inspect.1.md new file mode 100644 index 000000000..5143832e4 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-manifest-inspect.1.md @@ -0,0 +1,54 @@ +--- +title: podman-manifest-inspect +version: v5.5.1 +--- + +% podman-manifest-inspect 1 + +## NAME +podman\-manifest\-inspect - Display a manifest list or image index + +## SYNOPSIS +**podman manifest inspect** [*options*] *listnameorindexname* + +## DESCRIPTION + +Displays the manifest list or image index stored using the specified image name. +## RETURN VALUE + +A formatted JSON representation of the manifest list or image index. + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Inspect the manifest of mylist:v1.11. +``` +podman manifest inspect mylist\:v1.11 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-manifest-push.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-manifest-push.1.md new file mode 100644 index 000000000..e7acc09b9 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-manifest-push.1.md @@ -0,0 +1,173 @@ +--- +title: podman-manifest-push +version: v5.5.1 +--- + +% podman-manifest-push 1 + +## NAME +podman\-manifest\-push - Push a manifest list or image index to a registry + +## SYNOPSIS +**podman manifest push** [*options*] *listnameorindexname* [*destination*] + +## DESCRIPTION +Pushes a manifest list or image index to a registry. + +## RETURN VALUE +The list image's ID and the digest of the image's manifest. + +## OPTIONS + +#### **--add-compression**=*compression* + +Makes sure that requested compression variant for each platform is added to the manifest list keeping original instance +intact in the same manifest list. Supported values are (`gzip`, `zstd` and `zstd:chunked`). Following flag can be used +multiple times. + +Note that `--compression-format` controls the compression format of each instance in the manifest list. `--add-compression` +will add another variant for each instance in the list with the specified compressions. `--compression-format` gzip `--add-compression` +zstd will push a manifest list with each instance being compressed with gzip plus an additional variant of each instance +being compressed with zstd. + +#### **--all** + +Push the images mentioned in the manifest list or image index, in addition to +the list or index itself. (Default true) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/compression-format.md) +#### **--compression-format**=**gzip** | *zstd* | *zstd:chunked* + +Specifies the compression format to use. Supported values are: `gzip`, `zstd` and `zstd:chunked`. The default is `gzip` unless overridden in the containers.conf file. +`zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning in that case. + +[//]: # (END included file options/compression-format.md) + + +[//]: # (BEGIN included file options/compression-level.md) +#### **--compression-level**=*level* + +Specifies the compression level to use. The value is specific to the compression algorithm used, e.g. for zstd the accepted values are in the range 1-20 (inclusive) with a default of 3, while for gzip it is 1-9 (inclusive) and has a default of 5. + +[//]: # (END included file options/compression-level.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/digestfile.md) +#### **--digestfile**=*Digestfile* + +After copying the image, write the digest of the resulting image to the file. + +[//]: # (END included file options/digestfile.md) + + +[//]: # (BEGIN included file options/force-compression.md) +#### **--force-compression** + +If set, push uses the specified compression algorithm even if the destination contains a differently-compressed variant already. +Defaults to `true` if `--compression-format` is explicitly specified on the command-line, `false` otherwise. + +[//]: # (END included file options/force-compression.md) + +#### **--format**, **-f**=*format* + +Manifest list type (oci or v2s2) to use when pushing the list (default is oci). + +#### **--quiet**, **-q** + +When writing the manifest, suppress progress output + +#### **--remove-signatures** + +Don't copy signatures when pushing images. + +#### **--rm** + +Delete the manifest list or image index from local storage if pushing succeeds. + +#### **--sign-by**=*fingerprint* + +Sign the pushed images with a “simple signing” signature using the specified key. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-by-sigstore.md) +#### **--sign-by-sigstore**=*param-file* + +Add a sigstore signature based on further options specified in a container's sigstore signing parameter file *param-file*. +See containers-sigstore-signing-params.yaml(5) for details about the file format. + +[//]: # (END included file options/sign-by-sigstore.md) + +#### **--sign-by-sigstore-private-key**=*path* + +Sign the pushed images with a sigstore signature using a private key at the specified path. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-passphrase-file.md) +#### **--sign-passphrase-file**=*path* + +If signing the image (using either **--sign-by** or **--sign-by-sigstore-private-key**), read the passphrase to use from the specified path. + +[//]: # (END included file options/sign-passphrase-file.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## DESTINATION + + DESTINATION is the location the container image is pushed to. It supports all transports from `containers-transports(5)`. If no transport is specified, the `docker` (i.e., container registry) transport is used. For remote clients, including Mac and Windows (excluding WSL2) machines, `docker` is the only supported transport. + +## EXAMPLE + +Push manifest list to container registry: +``` +podman manifest push mylist:v1.11 docker://registry.example.org/mylist:v1.11 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-manifest-remove.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-manifest-remove.1.md new file mode 100644 index 000000000..55b83a3ac --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-manifest-remove.1.md @@ -0,0 +1,29 @@ +--- +title: podman-manifest-remove +version: v5.5.1 +--- + +% podman-manifest-remove 1 + +## NAME +podman\-manifest\-remove - Remove an item from a manifest list or image index + +## SYNOPSIS +**podman manifest remove** *listnameorindexname* *digest* + +## DESCRIPTION +Removes the item with the specified digest from the specified manifest list or image index. + +## RETURN VALUE +The list image's ID and the digest of the removed image's manifest. + +## EXAMPLE + +Remove specified digest from the manifest list: +``` +podman manifest remove mylist:v1.11 sha256:cb8a924afdf0229ef7515d9e5b3024e23b3eb03ddbba287f4a19c6ac90b8d221 +podman manifest remove e604eabaaee4858232761b4fef84e2316ed8f93e15eceafce845966ee3400036 sha256\:cb8a924afdf0229ef7515d9e5b3024e23b3eb03ddbba287f4a19c6ac90b8d221 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-manifest-rm.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-manifest-rm.1.md new file mode 100644 index 000000000..32838023e --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-manifest-rm.1.md @@ -0,0 +1,36 @@ +--- +title: podman-manifest-rm +version: v5.5.1 +--- + +% podman-manifest-rm 1 + +## NAME +podman\-manifest\-rm - Remove manifest list or image index from local storage + +## SYNOPSIS +**podman manifest rm** [*options*] *list-or-index* [...] + +## DESCRIPTION +Removes one or more locally stored manifest lists. + +## OPTIONS + +#### **--ignore**, **-i** + +If a specified manifest does not exist in the local storage, ignore it and do not throw an error. + +## EXAMPLE + +podman manifest rm `` + +podman manifest rm listid1 listid2 + +**storage.conf** (`/etc/containers/storage.conf`) + +storage.conf is the storage configuration file for all tools using containers/storage + +The storage configuration file specifies all of the available container storage options for tools using shared container storage. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-manifest.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-manifest.1.md new file mode 100644 index 000000000..69fc420db --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-manifest.1.md @@ -0,0 +1,76 @@ +--- +title: podman-manifest +version: v5.5.1 +--- + +% podman-manifest 1 + +## NAME +podman\-manifest - Create and manipulate manifest lists and image indexes + +## SYNOPSIS +**podman manifest** *subcommand* + +## DESCRIPTION +The `podman manifest` command provides subcommands which can be used to: + + * Create a working Docker manifest list or OCI image index. + +## SUBCOMMANDS + +| Command | Man Page | Description | +| -------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------------------- | +| add | [podman-manifest-add(1)](podman-manifest-add.1.md) | Add an image or artifact to a manifest list or image index. | +| annotate | [podman-manifest-annotate(1)](podman-manifest-annotate.1.md) | Add and update information about an image or artifact in a manifest list or image index. | +| create | [podman-manifest-create(1)](podman-manifest-create.1.md) | Create a manifest list or image index. | +| exists | [podman-manifest-exists(1)](podman-manifest-exists.1.md) | Check if the given manifest list exists in local storage | +| inspect | [podman-manifest-inspect(1)](podman-manifest-inspect.1.md) | Display a manifest list or image index. | +| push | [podman-manifest-push(1)](podman-manifest-push.1.md) | Push a manifest list or image index to a registry. | +| remove | [podman-manifest-remove(1)](podman-manifest-remove.1.md) | Remove an item from a manifest list or image index. | +| rm | [podman-manifest-rm(1)](podman-manifest-rm.1.md) | Remove manifest list or image index from local storage. | + +## EXAMPLES + +### Building a multi-arch manifest list from a Containerfile + +Assuming the `Containerfile` uses `RUN` instructions, the host needs +a way to execute non-native binaries. Configuring this is beyond +the scope of this example. Building a multi-arch manifest list +`shazam` in parallel across 4-threads can be done like this: + + $ platarch=linux/amd64,linux/ppc64le,linux/arm64,linux/s390x + $ podman build --jobs=4 --platform=$platarch --manifest shazam . + +**Note:** The `--jobs` argument is optional. Do not use the `podman build` command's `--tag` (or `-t`) option when building a multi-arch manifest list. + +### Assembling a multi-arch manifest from separately built images + +Assuming `example.com/example/shazam:$arch` images are built separately +on other hosts and pushed to the `example.com` registry. They may +be combined into a manifest list, and pushed using a simple loop: + + $ REPO=example.com/example/shazam + $ podman manifest create $REPO:latest + $ for IMGTAG in amd64 s390x ppc64le arm64; do \ + podman manifest add $REPO:latest docker://$REPO\:IMGTAG; \ + done + $ podman manifest push --all $REPO\:latest + +**Note:** The `add` instruction argument order is `` then ``. +Also, the `--all` push option is required to ensure all contents are +pushed, not just the native platform/arch. + +### Removing and tagging a manifest list before pushing + +Special care is needed when removing and pushing manifest lists, as opposed +to the contents. You almost always want to use the `manifest rm` and +`manifest push --all` subcommands. For example, a rename and push can +be performed like this: + + $ podman tag localhost/shazam example.com/example/shazam + $ podman manifest rm localhost/shazam + $ podman manifest push --all example.com/example/shazam + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest-add(1)](podman-manifest-add.1.md)**, **[podman-manifest-annotate(1)](podman-manifest-annotate.1.md)**, **[podman-manifest-create(1)](podman-manifest-create.1.md)**, **[podman-manifest-inspect(1)](podman-manifest-inspect.1.md)**, **[podman-manifest-push(1)](podman-manifest-push.1.md)**, **[podman-manifest-remove(1)](podman-manifest-remove.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-mount.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-mount.1.md new file mode 100644 index 000000000..5f5ed0a59 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-mount.1.md @@ -0,0 +1,86 @@ +--- +title: podman-mount +version: v5.5.1 +--- + +% podman-mount 1 + +## NAME +podman\-mount - Mount a working container's root filesystem + +## SYNOPSIS +**podman mount** [*options*] [*container* ...] + +**podman container mount** [*options*] [*container* ...] + +## DESCRIPTION +Mounts the specified containers' root file system in a location which can be +accessed from the host, and returns its location. + +Podman lists all of the currently mounted containers, including external containers, when the command is executed +without any arguments. External containers are containers in container/storage by tools other than Podman. +For example Buildah and CRI-O. + +Rootless mode only supports mounting VFS driver, unless Podman is run within the user namespace +via the `podman unshare` command. All other storage drivers fails to mount. + +## RETURN VALUE +The location of the mounted file system. On error an empty string and errno is +returned. + +## OPTIONS + +#### **--all**, **-a** + +Mount all podman containers. (External containers are not mounted) + +#### **--format**=*format* + +Print the mounted containers in specified format (json). + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--no-trunc** + +Do not truncate the output (default *false*). + +## EXAMPLE + +In rootful mode, Mount specified container. +``` +# podman mount c831414b10a3 +/var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +``` + +In rootless mode, container mounting only works from inside the user namespace. +``` +$ podman unshare +# podman mount affectionate_mcnulty +/home/dwalsh/.local/share/containers/storage/overlay/4218326b9a80619aef005ff95067f76687ad975ce101c176598fb416f6186906/merged +``` + +List the currently mounted containers: +``` +podman mount +c831414b10a3 /var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +a7060253093b /var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged +``` + +Mount multiple containers: +``` +podman mount c831414b10a3 a7060253093b +/var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +/var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-unmount(1)](podman-unmount.1.md)**, **[podman-unshare(1)](podman-unshare.1.md)**, **mount(8)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-network-connect.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-network-connect.1.md new file mode 100644 index 000000000..917d97411 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-network-connect.1.md @@ -0,0 +1,55 @@ +--- +title: podman-network-connect +version: v5.5.1 +--- + +% podman-network-connect 1 + +## NAME +podman\-network\-connect - Connect a container to a network + +## SYNOPSIS +**podman network connect** [*options*] network container + +## DESCRIPTION +Connects a container to a network. A container can be connected to a network by name or by ID. +Once connected, the container can communicate with other containers in the same network. + +## OPTIONS +#### **--alias**=*name* +Add network-scoped alias for the container. If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. Multiple *--alias* options may be specified as input. +NOTE: When using CNI, a container only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. + +#### **--ip**=*address* +Set a static ipv4 address for this container on this network. + +#### **--ip6**=*address* +Set a static ipv6 address for this container on this network. + +#### **--mac-address**=*address* +Set a static mac address for this container on this network. + +## EXAMPLE + +Connect specified container to a named network: +``` +podman network connect test web +``` + +Connect specified container to named network with two aliases: +``` +podman network connect --alias web1 --alias web2 test web +``` + +Connect specified container to named network with a static ip: +``` +podman network connect --ip 10.89.1.13 test web +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-network-disconnect(1)](podman-network-disconnect.1.md)** + +## HISTORY +November 2020, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-network-create.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-network-create.1.md new file mode 100644 index 000000000..376ad322c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-network-create.1.md @@ -0,0 +1,220 @@ +--- +title: podman-network-create +version: v5.5.1 +--- + +% podman-network-create 1 + +## NAME +podman\-network-create - Create a Podman network + +## SYNOPSIS +**podman network create** [*options*] [*name*] + +## DESCRIPTION +Create a network configuration for use with Podman. By default, Podman creates a bridge connection. +A *Macvlan* connection can be created with the *-d macvlan* option. A parent device for macvlan or +ipvlan can be designated with the *-o parent=``* or *--network-interface=``* option. + +If no options are provided, Podman assigns a free subnet and name for the network. + +Upon completion of creating the network, Podman displays the name of the newly added network. + +## OPTIONS +#### **--disable-dns** + +Disables the DNS plugin for this network which if enabled, can perform container to container name +resolution. It is only supported with the `bridge` driver, for other drivers it is always disabled. + +#### **--dns**=*ip* + +Set network-scoped DNS resolver/nameserver for containers in this network. If not set, the host servers from `/etc/resolv.conf` is used. It can be overwritten on the container level with the `podman run/create --dns` option. This option can be specified multiple times to set more than one IP. + +#### **--driver**, **-d**=*driver* + +Driver to manage the network. Currently `bridge`, `macvlan` and `ipvlan` are supported. Defaults to `bridge`. +As rootless the `macvlan` and `ipvlan` driver have no access to the host network interfaces because rootless networking requires a separate network namespace. + +The netavark backend allows the use of so called *netavark plugins*, see the +[plugin-API.md](https://github.com/containers/netavark/blob/main/plugin-API.md) +documentation in netavark. The binary must be placed in a specified directory +so podman can discover it, this list is set in `netavark_plugin_dirs` in +**[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** +under the `[network]` section. + +The name of the plugin can then be used as driver to create a network for your plugin. +The list of all supported drivers and plugins can be seen with `podman info --format {{.Plugins.Network}}`. + +Note that the `macvlan` and `ipvlan` drivers do not support port forwarding. Support for port forwarding +with a plugin depends on the implementation of the plugin. + +#### **--gateway**=*ip* + +Define a gateway for the subnet. To provide a gateway address, a +*subnet* option is required. Can be specified multiple times. +The argument order of the **--subnet**, **--gateway** and **--ip-range** options must match. + +#### **--ignore** + +Ignore the create request if a network with the same name already exists instead of failing. +Note, trying to create a network with an existing name and different parameters does not change the configuration of the existing one. + +#### **--interface-name**=*name* + +This option maps the *network_interface* option in the network config, see **podman network inspect**. +Depending on the driver, this can have different effects; for `bridge`, it uses the bridge interface name. +For `macvlan` and `ipvlan`, it is the parent device on the host. It is the same as `--opt parent=...`. + +#### **--internal** + +Restrict external access of this network when using a `bridge` network. Note when using the CNI backend +DNS will be automatically disabled, see **--disable-dns**. + +When using the `macvlan` or `ipvlan` driver with this option no default route will be added to the container. +Because it bypasses the host network stack no additional restrictions can be set by podman and if a +privileged container is run it can set a default route themselves. If this is a concern then the +container connections should be blocked on your actual network gateway. + +Using the `bridge` driver with this option has the following effects: + - Global IP forwarding sysctls will not be changed in the host network namespace. + - IP forwarding is disabled on the bridge interface instead of setting up a firewall. + - No default route will be added to the container. + +In all cases, aardvark-dns will only resolve container names with this option enabled. +Other queries will be answered with `NXDOMAIN`. + +#### **--ip-range**=*range* + +Allocate container IP from a range. The range must be a either a complete subnet in CIDR notation or be in +the `-` syntax which allows for a more flexible range compared to the CIDR subnet. +The *ip-range* option must be used with a *subnet* option. Can be specified multiple times. +The argument order of the **--subnet**, **--gateway** and **--ip-range** options must match. + +#### **--ipam-driver**=*driver* + +Set the ipam driver (IP Address Management Driver) for the network. When unset podman chooses an +ipam driver automatically based on the network driver. + +Valid values are: + + - `dhcp`: IP addresses are assigned from a dhcp server on the network. When using the netavark backend + the `netavark-dhcp-proxy.socket` must be enabled in order to start the dhcp-proxy when a container is + started, for CNI use the `cni-dhcp.socket` unit instead. + - `host-local`: IP addresses are assigned locally. + - `none`: No ip addresses are assigned to the interfaces. + +View the driver in the **podman network inspect** output under the `ipam_options` field. + +#### **--ipv6** + +Enable IPv6 (Dual Stack) networking. If no subnets are given, it allocates an ipv4 and an ipv6 subnet. + +#### **--label**=*label* + +Set metadata for a network (e.g., --label mykey=value). + +#### **--opt**, **-o**=*option* + +Set driver specific options. + +All drivers accept the `mtu`, `metric`, `no_default_route` and options. + +- `mtu`: Sets the Maximum Transmission Unit (MTU) and takes an integer value. +- `metric` Sets the Route Metric for the default route created in every container joined to this network. Accepts a positive integer value. Can only be used with the Netavark network backend. +- `no_default_route`: If set to 1, Podman will not automatically add a default route to subnets. Routes can still be added +manually by creating a custom route using `--route`. + +Additionally the `bridge` driver supports the following options: + +- `vlan`: This option assign VLAN tag and enables vlan\_filtering. Defaults to none. +- `isolate`: This option isolates networks by blocking traffic between those that have this option enabled. +- `com.docker.network.bridge.name`: This option assigns the given name to the created Linux Bridge +- `com.docker.network.driver.mtu`: Sets the Maximum Transmission Unit (MTU) and takes an integer value. +- `vrf`: This option assigns a VRF to the bridge interface. It accepts the name of the VRF and defaults to none. Can only be used with the Netavark network backend. +- `mode`: This option sets the specified bridge mode on the interface. Defaults to `managed`. Supported values: + - `managed`: Podman creates and deletes the bridge and changes sysctls of it. It adds firewall rules to masquerade outgoing traffic, as well as setup port forwarding for incoming traffic using DNAT. + - `unmanaged`: Podman uses an existing bridge. It must exist by the time you want to start a container which uses the network. There will be no NAT or port forwarding, even if such options were passed while creating the container. + +The `macvlan` and `ipvlan` driver support the following options: + +- `parent`: The host device which is used for the macvlan interface. Defaults to the default route interface. +- `mode`: This option sets the specified ip/macvlan mode on the interface. + - Supported values for `macvlan` are `bridge`, `private`, `vepa`, `passthru`. Defaults to `bridge`. + - Supported values for `ipvlan` are `l2`, `l3`, `l3s`. Defaults to `l2`. + +Additionally the `macvlan` driver supports the `bclim` option: + +- `bclim`: Set the threshold for broadcast queueing. Must be a 32 bit integer. Setting this value to `-1` disables broadcast queueing altogether. + +#### **--route**=*route* + +A static route in the format `,,`. This route will be added to every container in this network. Only available with the netavark backend. It can be specified multiple times if more than one static route is desired. + +#### **--subnet**=*subnet* + +The subnet in CIDR notation. Can be specified multiple times to allocate more than one subnet for this network. +The argument order of the **--subnet**, **--gateway** and **--ip-range** options must match. +This is useful to set a static ipv4 and ipv6 subnet. + +## EXAMPLE + +Create a network with no options. +``` +$ podman network create +podman2 +``` + +Create a network named *newnet* that uses *192.5.0.0/16* for its subnet. +``` +$ podman network create --subnet 192.5.0.0/16 newnet +newnet +``` + +Create an IPv6 network named *newnetv6* with a subnet of *2001\:db8::/64*. +``` +$ podman network create --subnet 2001:db8::/64 --ipv6 newnetv6 +newnetv6 +``` + +Create a network named *newnet* that uses *192.168.33.0/24* and defines a gateway as *192.168.33.3*. +``` +$ podman network create --subnet 192.168.33.0/24 --gateway 192.168.33.3 newnet +newnet +``` + +Create a network that uses a *192.168.55.0/24* subnet and has an IP address range of *192.168.55.129 - 192.168.55.254*. +``` +$ podman network create --subnet 192.168.55.0/24 --ip-range 192.168.55.128/25 +podman5 +``` + +Create a network with a static ipv4 and ipv6 subnet and set a gateway. +``` +$ podman network create --subnet 192.168.55.0/24 --gateway 192.168.55.3 --subnet fd52:2a5a:747e:3acd::/64 --gateway fd52:2a5a:747e:3acd::10 +podman4 +``` + +Create a network with a static subnet and a static route. +``` +$ podman network create --subnet 192.168.33.0/24 --route 10.1.0.0/24,192.168.33.10 newnet +``` + +Create a network with a static subnet and a static route without a default +route. +``` +$ podman network create --subnet 192.168.33.0/24 --route 10.1.0.0/24,192.168.33.10 --opt no_default_route=1 newnet +``` + +Create a Macvlan based network using the host interface eth0. Macvlan networks can only be used as root. +``` +$ sudo podman network create -d macvlan -o parent=eth0 --subnet 192.5.0.0/16 newnet +newnet +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-network-ls(1)](podman-network-ls.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +## HISTORY +August 2021, Updated with the new network format by Paul Holzinger + +August 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-network-disconnect.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-network-disconnect.1.md new file mode 100644 index 000000000..13ee1af75 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-network-disconnect.1.md @@ -0,0 +1,37 @@ +--- +title: podman-network-disconnect +version: v5.5.1 +--- + +% podman-network-disconnect 1 + +## NAME +podman\-network\-disconnect - Disconnect a container from a network + +## SYNOPSIS +**podman network disconnect** [*options*] network container + +## DESCRIPTION +Disconnects a container from a network. A container can be disconnected from a network by name or by ID. +If all networks are disconnected from the container, it behaves like a container created with `--network=none` +and it does not have network connectivity until a network is connected again. + + +## OPTIONS +#### **--force**, **-f** + +Force the container to disconnect from a network + +## EXAMPLE + +Disconnect container from specified network: +``` +podman network disconnect test web +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-connect(1)](podman-network-connect.1.md)** + +## HISTORY +November 2020, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-network-exists.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-network-exists.1.md new file mode 100644 index 000000000..f42d7c45f --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-network-exists.1.md @@ -0,0 +1,47 @@ +--- +title: podman-network-exists +version: v5.5.1 +--- + +% podman-network-exists 1 + +## NAME +podman\-network\-exists - Check if the given network exists + +## SYNOPSIS +**podman network exists** *network* + +## DESCRIPTION +**podman network exists** checks if a network exists. The **Name** or **ID** +of the network may be used as input. Podman returns an exit code +of `0` when the network is found. A `1` is returned otherwise. An exit code of +`125` indicates there was another issue. + + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLE + +Check if specified network exists (the network does actually exist): +``` +$ podman network exists net1 +$ echo $? +0 +``` + +Check if nonexistent network exists: +``` +$ podman network exists webbackend +$ echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)** + +## HISTORY +January 2021, Originally compiled by Paul Holzinger `` diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-network-inspect.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-network-inspect.1.md new file mode 100644 index 000000000..a55a39f64 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-network-inspect.1.md @@ -0,0 +1,83 @@ +--- +title: podman-network-inspect +version: v5.5.1 +--- + +% podman-network-inspect 1 + +## NAME +podman\-network\-inspect - Display the network configuration for one or more networks + +## SYNOPSIS +**podman network inspect** [*options*] *network* [*network* ...] + +## DESCRIPTION +Display the (JSON format) network configuration. + +## OPTIONS +#### **--format**, **-f**=*format* + +Pretty-print networks to JSON or using a Go template. + +| **Placeholder** | **Description** | +|--------------------|-------------------------------------------| +| .Containers ... | Running containers on this network. | +| .Created ... | Timestamp when the network was created | +| .DNSEnabled | Network has dns enabled (boolean) | +| .Driver | Network driver | +| .ID | Network ID | +| .Internal | Network is internal (boolean) | +| .IPAMOptions ... | Network ipam options | +| .IPv6Enabled | Network has ipv6 subnet (boolean) | +| .Labels ... | Network labels | +| .Name | Network name | +| .Network ... | Nested Network type | +| .NetworkDNSServers | Array of DNS servers used in this network | +| .NetworkInterface | Name of the network interface on the host | +| .Options ... | Network options | +| .Routes | List of static routes for this network | +| .Subnets | List of subnets on this network | + +## EXAMPLE + +Inspect the default podman network. + +``` +$ podman network inspect podman +[ + { + "name": "podman", + "id": "2f259bab93aaaaa2542ba43ef33eb990d0999ee1b9924b557b7be53c0b7a1bb9", + "driver": "bridge", + "network_interface": "podman0", + "created": "2021-06-03T12:04:33.088567413+02:00", + "subnets": [ + { + "subnet": "10.88.0.0/16", + "gateway": "10.88.0.1" + } + ], + "ipv6_enabled": false, + "internal": false, + "dns_enabled": false, + "ipam_options": { + "driver": "host-local" + } + } +] +``` + +Show the subnet and gateway for a network. + +``` +$ podman network inspect podman --format "{{range .Subnets}}Subnet: {{.Subnet}} Gateway: {{.Gateway}}{{end}}" +Subnet: 10.88.0.0/16 Gateway: 10.88.0.1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-ls(1)](podman-network-ls.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)** + +## HISTORY +August 2021, Updated with the new network format by Paul Holzinger + +August 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-network-ls.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-network-ls.1.md new file mode 100644 index 000000000..3507901c6 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-network-ls.1.md @@ -0,0 +1,124 @@ +--- +title: podman-network-ls +version: v5.5.1 +--- + +% podman-network-ls 1 + +## NAME +podman\-network\-ls - Display a summary of networks + +## SYNOPSIS +**podman network ls** [*options*] + +## DESCRIPTION +Displays a list of existing podman networks. + +## OPTIONS +#### **--filter**, **-f**=*filter=value* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| **Filter** | **Description** | +| ---------- | ------------------------------------------------------------------------------------------------ | +| driver | Filter by driver type. | +| id | Filter by full or partial network ID. | +| label | Filter by network with (or without, in the case of label!=[...] is used) the specified labels. | +| name | Filter by network name (accepts `regex`). | +| until | Filter by networks created before given timestamp. | +| dangling | Filter by networks with no containers attached. | + + +The `driver` filter accepts values: `bridge`, `macvlan`, `ipvlan`. + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which shows images with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which shows images without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +The `dangling` *filter* accepts values `true` or `false`. + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|--------------------|-------------------------------------------| +| .Created ... | Timestamp when the network was created | +| .DNSEnabled | Network has dns enabled (boolean) | +| .Driver | Network driver | +| .ID | Network ID | +| .Internal | Network is internal (boolean) | +| .IPAMOptions ... | Network ipam options | +| .IPv6Enabled | Network has ipv6 subnet (boolean) | +| .Labels | Network labels | +| .Name | Network name | +| .NetworkDNSServers | Array of DNS servers used in this network | +| .NetworkInterface | Name of the network interface on the host | +| .Options ... | Network options | +| .Routes | List of static routes for this network | +| .Subnets | List of subnets on this network | + +#### **--no-trunc** + +Do not truncate the network ID. + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +The `quiet` option restricts the output to only the network names. + +## EXAMPLE + +Display networks: +``` +$ podman network ls +NETWORK ID NAME DRIVER +88a7120ee19d podman bridge +6dd508dbf8cd podman6 bridge +8e35c2cd3bf6 podman5 macvlan +``` + +Display only network names: +``` +$ podman network ls -q +podman +podman2 +outside +podman9 +``` + +Display name of network which support bridge plugin: +``` +$ podman network ls --filter driver=bridge --format {{.Name}} +podman +podman2 +podman9 +``` +List networks with their subnets: +``` +$ podman network ls --format "{{.Name}}: {{range .Subnets}}{{.Subnet}} {{end}}" +podman: 10.88.0.0/16 +podman3: 10.89.30.0/24 fde4:f86f:4aab\:e68f::/64 +macvlan: +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)** + +## HISTORY +August 2021, Updated with the new network format by Paul Holzinger + +August 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-network-prune.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-network-prune.1.md new file mode 100644 index 000000000..00992324e --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-network-prune.1.md @@ -0,0 +1,58 @@ +--- +title: podman-network-prune +version: v5.5.1 +--- + +% podman-network-prune 1 + +## NAME +podman\-network\-prune - Remove all unused networks + +## SYNOPSIS +**podman network prune** [*options*] + +## DESCRIPTION +Remove all unused networks. An unused network is defined by a network which +has no containers connected or configured to connect to it. It does not remove +the so-called default network which goes by the name of *podman*. + +## OPTIONS + +#### **--filter** + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------:|----------------------------------------------------------------------------------------------------| +| label | Only remove networks, with (or without, in the case of label!=[...] is used) the specified labels. | +| until | Only remove networks created before given timestamp. | + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes networks with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes networks without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not prompt for confirmation + +## EXAMPLE + +Prune networks: +``` +podman network prune +``` + +Prune all networks created not created in the last two hours: +``` +podman network prune --filter until=2h +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-rm(1)](podman-network-rm.1.md)** + +## HISTORY +February 2021, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-network-reload.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-network-reload.1.md new file mode 100644 index 000000000..6a9a4be41 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-network-reload.1.md @@ -0,0 +1,67 @@ +--- +title: podman-network-reload +version: v5.5.1 +--- + +% podman-network-reload 1 + +## NAME +podman\-network\-reload - Reload network configuration for containers + +## SYNOPSIS +**podman network reload** [*options*] [*container...*] + +## DESCRIPTION +Reload one or more container network configurations. + +Rootful Podman relies on iptables rules in order to provide network connectivity. If the iptables rules are deleted, +this happens for example with `firewall-cmd --reload`, the container loses network connectivity. This command restores +the network connectivity. + +## OPTIONS +#### **--all**, **-a** + +Reload network configuration of all containers. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Reload the network configuration after a firewall reload: +``` +# podman run -p 80:80 -d nginx +b1b538e8bc4078fc3ee1c95b666ebc7449b9a97bacd15bcbe464a29e1be59c1c +# curl 127.0.0.1 +works +# sudo firewall-cmd --reload +success +# curl 127.0.0.1 +hangs +# podman network reload b1b538e8bc40 +b1b538e8bc4078fc3ee1c95b666ebc7449b9a97bacd15bcbe464a29e1be59c1c +# curl 127.0.0.1 +works +``` + +Reload the network configuration for all containers: +``` +# podman network reload --all +b1b538e8bc4078fc3ee1c95b666ebc7449b9a97bacd15bcbe464a29e1be59c1c +fe7e8eca56f844ec33af10f0aa3b31b44a172776e3277b9550a623ed5d96e72b +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)** + +## HISTORY +December 2020, Originally compiled by Paul Holzinger diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-network-rm.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-network-rm.1.md new file mode 100644 index 000000000..a590be246 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-network-rm.1.md @@ -0,0 +1,54 @@ +--- +title: podman-network-rm +version: v5.5.1 +--- + +% podman-network-rm 1 + +## NAME +podman\-network\-rm - Remove one or more networks + +## SYNOPSIS +**podman network rm** [*options*] [*network...*] + +## DESCRIPTION +Delete one or more Podman networks. + +## OPTIONS +#### **--force**, **-f** + +The `force` option removes all containers that use the named network. If the container is +running, the container is stopped and removed. + +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping the running containers that are using the specified network. The --force option must be specified to use the --time option. Use -1 for infinite wait. + +## EXAMPLE + +Delete specified network: +``` +# podman network rm podman9 +Deleted: podman9 +``` + +Delete specified network and all containers associated with the network: +``` +# podman network rm -f fred +Deleted: fred +``` + +## Exit Status + **0** All specified networks removed + + **1** One of the specified networks did not exist, and no other failures + + **2** The network is in use by a container or a Pod + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)** + +## HISTORY +August 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-network-update.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-network-update.1.md new file mode 100644 index 000000000..6920bb3eb --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-network-update.1.md @@ -0,0 +1,41 @@ +--- +title: podman-network-update +version: v5.5.1 +--- + +% podman-network-update 1 + +## NAME +podman\-network\-update - Update an existing Podman network + +## SYNOPSIS +**podman network update** [*options*] *network* + +## DESCRIPTION +Allow changes to existing container networks. At present, only changes to the DNS servers in use by a network is supported. + +NOTE: Only supported with the netavark network backend. + + +## OPTIONS +#### **--dns-add** + +Accepts array of DNS resolvers and add it to the existing list of resolvers configured for a network. + +#### **--dns-drop** + +Accepts array of DNS resolvers and removes them from the existing list of resolvers configured for a network. + +## EXAMPLE + +Update a network: +``` +$ podman network update network1 --dns-add 8.8.8.8,1.1.1.1 +``` + +Update a network and add/remove dns servers: +``` +$ podman network update network1 --dns-drop 8.8.8.8 --dns-add 3.3.3.3 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-network-ls(1)](podman-network-ls.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-network.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-network.1.md new file mode 100644 index 000000000..c1ccc4d31 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-network.1.md @@ -0,0 +1,61 @@ +--- +title: podman-network +version: v5.5.1 +--- + +% podman-network 1 + +## NAME +podman\-network - Manage Podman networks + +## SYNOPSIS +**podman network** *subcommand* + +## DESCRIPTION +The network command manages networks for Podman. + +Podman supports two network backends [Netavark](https://github.com/containers/netavark) +and [CNI](https://www.cni.dev/). Netavark is the default network backend and was added in Podman version 4.0. +CNI is deprecated and will be removed in the next major Podman version 5.0, in preference of Netavark. +To configure the network backend use the `network_backend` key under the `[Network]` in +**[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**. +New systems use netavark by default, to check what backend is used run +`podman info --format {{.Host.NetworkBackend}}`. + +All network commands work for both backends but CNI and Netavark use different config files +so networks have to be created again after a backend change. + +## COMMANDS + +| Command | Man Page | Description | +| ---------- | -------------------------------------------------------------- | --------------------------------------------------------------- | +| connect | [podman-network-connect(1)](podman-network-connect.1.md) | Connect a container to a network | +| create | [podman-network-create(1)](podman-network-create.1.md) | Create a Podman network | +| disconnect | [podman-network-disconnect(1)](podman-network-disconnect.1.md) | Disconnect a container from a network | +| exists | [podman-network-exists(1)](podman-network-exists.1.md) | Check if the given network exists | +| inspect | [podman-network-inspect(1)](podman-network-inspect.1.md) | Display the network configuration for one or more networks | +| ls | [podman-network-ls(1)](podman-network-ls.1.md) | Display a summary of networks | +| prune | [podman-network-prune(1)](podman-network-prune.1.md) | Remove all unused networks | +| reload | [podman-network-reload(1)](podman-network-reload.1.md) | Reload network configuration for containers | +| rm | [podman-network-rm(1)](podman-network-rm.1.md) | Remove one or more networks | +| update | [podman-network-update(1)](podman-network-update.1.md) | Update an existing Podman network | + +## SUBNET NOTES +Podman requires specific default IPs and, thus, network subnets. The default values used by Podman can be modified in the **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** file. + +### Podman network +The default bridge network (called `podman`) uses 10.88.0.0/16 as a subnet. When Podman runs as root, the `podman` network is used as default. It is the same as adding the option `--network bridge` or `--network podman`. This subnet can be changed in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** under the [network] section. Set the `default_subnet` to any subnet that is free in the environment. The name of the default network can also be changed from `podman` to another name using the default network key. Note that this is only done when no containers are running. + +### Pasta +Pasta by default performs no Network Address Translation (NAT) and copies the IPs from your main interface into the container namespace. If pasta cannot find an interface with the default route, it will select an interface if there is only one interface with a valid route. If you do not have a default route and several interfaces have defined routes, pasta will be unable to figure out the correct interface and it will fail to start. To specify the interface, use `-i` option to pasta. A default set of pasta options can be set in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** under the `[network]` section with the `pasta_options` key. + +The default rootless networking tool can be selected in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** under the `[network]` section with `default_rootless_network_cmd`, which can be set to `pasta` (default) or `slirp4netns`. + +### Slirp4netns +Slirp4netns uses 10.0.2.0/24 for its default network. This can also be changed in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** but under the `[engine]` section. Use the `network_cmd_options` key and add `["cidr=X.X.X.X/24"]` as a value. Note that slirp4netns needs a network prefix size between 1 and 25. This option accepts an array, so more options can be added in a comma-separated string as described on the **[podman-network-create(1)](podman-network-create.1.md)** man page. To change the CIDR for just one container, specify it on the cli using the `--network` option like this: `--network slirp4netns\:cidr=192.168.1.0/24`. + +### Podman network create +When a new network is created with a `podman network create` command, and no subnet is given with the --subnet option, Podman starts picking a free subnet from 10.89.0.0/24 to 10.255.255.0/24. Use the `default_subnet_pools` option under the `[network]` section in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** to change the range and/or size that is assigned by default. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-pause.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-pause.1.md new file mode 100644 index 000000000..53e36a8e2 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-pause.1.md @@ -0,0 +1,103 @@ +--- +title: podman-pause +version: v5.5.1 +--- + +% podman-pause 1 + +## NAME +podman\-pause - Pause one or more containers + +## SYNOPSIS +**podman pause** [*options*] [*container*...] + +**podman container pause** [*options*] [*container*...] + +## DESCRIPTION +Pauses all the processes in one or more containers. You may use container IDs or names as input. + +## OPTIONS + +#### **--all**, **-a** + +Pause all running containers. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and pause the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + +#### **--filter**, **-f**=*filter* + +Filter what containers pause. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Pause specified container: +``` +podman pause mywebserver +``` + +Pause container by partial container ID: +``` +podman pause 860a4b23 +``` + +Pause all **running** containers: +``` +podman pause --all +``` + +Pause container using ID specified in given files: +``` +podman pause --cidfile /home/user/cidfile-1 +podman pause --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +Pause the latest container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman pause --latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-unpause(1)](podman-unpause.1.md)** + +## HISTORY +September 2017, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-pod-clone.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-pod-clone.1.md new file mode 100644 index 000000000..17754316a --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-pod-clone.1.md @@ -0,0 +1,796 @@ +--- +title: podman-pod-clone +version: v5.5.1 +--- + +% podman-pod-clone 1 + +## NAME +podman\-pod\-clone - Create a copy of an existing pod + +## SYNOPSIS +**podman pod clone** [*options*] *pod* *name* + +## DESCRIPTION +**podman pod clone** creates a copy of a pod, recreating the identical config for the pod and for all of its containers. Users can modify the pods new name and select pod details within the infra container + +## OPTIONS + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the pod is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + +#### **--cpus** + +Set a number of CPUs for the pod that overrides the original pods CPU limits. If none are specified, the original pod's Nano CPUs are used. + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + +If none are specified, the original pod's CPUset is used. + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/destroy.md) +#### **--destroy** + +Remove the original pod that we are cloning once used to mimic the configuration. + +[//]: # (END included file options/destroy.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the pod. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The pod only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: the pod implements devices by storing the initial configuration passed by the user and recreating the device on each container added to the pod. + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + + +[//]: # (BEGIN included file options/gidmap.pod.md) +#### **--gidmap**=*pod_gid\:host_gid\:amount* + +GID map for the user namespace. Using this flag runs all containers in the pod with user namespace enabled. +It conflicts with the **--userns** and **--subgidname** flags. + +[//]: # (END included file options/gidmap.pod.md) + + +[//]: # (BEGIN included file options/gpus.md) +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. + +[//]: # (END included file options/gpus.md) + +#### **--help**, **-h** + +Print usage statement. + + +[//]: # (BEGIN included file options/hostname.pod.md) +#### **--hostname**=*name* + +Set the pod's hostname inside all containers. + +The given hostname is also added to the `/etc/hosts` file using the container's +primary IP address (also see the **--add-host** option). + +[//]: # (END included file options/hostname.pod.md) + + +[//]: # (BEGIN included file options/infra-command.md) +#### **--infra-command**=*command* + +The command that is run to start the infra container. Default: "/pause". + +[//]: # (END included file options/infra-command.md) + + +[//]: # (BEGIN included file options/infra-conmon-pidfile.md) +#### **--infra-conmon-pidfile**=*file* + +Write the pid of the infra container's **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to manage Podman containers and pods. + +[//]: # (END included file options/infra-conmon-pidfile.md) + + +[//]: # (BEGIN included file options/infra-name.md) +#### **--infra-name**=*name* + +The name that is used for the pod's infra container. + +[//]: # (END included file options/infra-name.md) + + +[//]: # (BEGIN included file options/label.md) +#### **--label**, **-l**=*key=value* + +Add metadata to a pod. + +[//]: # (END included file options/label.md) + + +[//]: # (BEGIN included file options/label-file.md) +#### **--label-file**=*file* + +Read in a line-delimited file of labels. + +[//]: # (END included file options/label-file.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + +#### **--name**, **-n** + +Set a custom name for the cloned pod. The default if not specified is of the syntax: **\-clone** + + +[//]: # (BEGIN included file options/pid.pod.md) +#### **--pid**=*pid* + +Set the PID mode for the pod. The default is to create a private PID namespace for the pod. Requires the PID namespace to be shared via --share. + + host: use the host’s PID namespace for the pod + ns: join the specified PID namespace + private: create a new namespace for the pod (default) + +[//]: # (END included file options/pid.pod.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + +Default restart policy for all the containers in a pod. + + +[//]: # (BEGIN included file options/security-opt.md) +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the pod +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the pod + +- **label=user:**_USER_: Set the label user for the pod processes +- **label=role:**_ROLE_: Set the label role for the pod processes +- **label=type:**_TYPE_: Set the label process type for the pod processes +- **label=level:**_LEVEL_: Set the label level for the pod processes +- **label=filetype:**_TYPE_: Set the label file type for the pod files +- **label=disable**: Turn off label separation for the pod + +Note: Labeling can be disabled for all pods/containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the containers within the pod. + +- **no-new-privileges**: Disable container processes from gaining additional privileges through the `execve(2)` system call (e.g. via setuid or setgid bits, or via file capabilities). Programs that rely on setuid/setgid bits set on their executable to change user id or group id are no longer able to do so, and any file capabilities added to the executable (e.g. via `setcap`) are not added to the permitted capability set. For more details, see: https://docs.kernel.org/userspace-api/no_new_privs.html. + +- **seccomp=unconfined**: Turn off seccomp confinement for the pod. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. + +[//]: # (END included file options/security-opt.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the pod. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/shm-size-systemd.md) +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. + +[//]: # (END included file options/shm-size-systemd.md) + +#### **--start** + +When set to true, this flag starts the newly created pod after the +clone process has completed. All containers within the pod are started. + + +[//]: # (BEGIN included file options/subgidname.md) +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. + +[//]: # (END included file options/subgidname.md) + + +[//]: # (BEGIN included file options/subuidname.md) +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. + +[//]: # (END included file options/subuidname.md) + + +[//]: # (BEGIN included file options/sysctl.md) +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters for all containers in the pod. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: if the ipc namespace is not shared within the pod, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: if the network namespace is not shared within the pod, the above sysctls are not allowed. + +[//]: # (END included file options/sysctl.md) + + +[//]: # (BEGIN included file options/uidmap.pod.md) +#### **--uidmap**=*container_uid\:from_uid\:amount* + +Run all containers in the pod in a new user namespace using the supplied mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +[//]: # (END included file options/uidmap.pod.md) + + +[//]: # (BEGIN included file options/userns.pod.md) +#### **--userns**=*mode* + +Set the user namespace mode for all the containers in a pod. It defaults to the `PODMAN_USERNS` environment variable. An empty value ("") means user namespaces are disabled. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +----------|---------------|--------------------- +"" |$UID |0 (Default User account mapped to root user in container.) +host |$UID |0 (Default User account mapped to root user in container.) +keep-id |$UID |$UID (Map user account to same UID within container.) +auto |$UID | nil (Host User UID is not mapped into container.) +nomap |$UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + + - *auto[:*_OPTIONS,..._*]*: automatically create a namespace. It is possible to specify these options to `auto`: + + - *gidmapping=*_CONTAINER\_GID\:HOST\_GID\:SIZE_ to force a GID mapping to be present in the user namespace. + + - *size=*_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates the size for the user namespace. + + - *uidmapping=*_CONTAINER\_UID\:HOST\_UID\:SIZE_ to force a UID mapping to be present in the user namespace. + + - *host*: run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user (default). + + - *keep-id*: creates a user namespace where the current rootless user's UID\:GID are mapped to the same values in the container. This option is not allowed for containers created by the root user. + + - *nomap*: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +[//]: # (END included file options/userns.pod.md) + + +[//]: # (BEGIN included file options/uts.pod.md) +#### **--uts**=*mode* + +Set the UTS namespace mode for the pod. The following values are supported: + +- **host**: use the host's UTS namespace inside the pod. +- **private**: create a new namespace for the pod (default). +- **ns:[path]**: run the pod in the given existing UTS namespace. + +[//]: # (END included file options/uts.pod.md) + + +[//]: # (BEGIN included file options/volume.md) +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the pod is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +pod. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a pod is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the pod, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the pod. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a pod. Without a label, the security system +might prevent the processes running inside the pod from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the pod context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +pods share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label. Only the current pod can use a private +volume. + +Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any one of the containers. Relabeling walks +the file system under the volume and changes the label on each file; if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the pod. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually changed with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the pod. +For example if a user wanted to volume mount their entire home directory into a +pod, they need to disable SELinux separation. + + $ podman pod clone --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The pod processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the pod +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous pod executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the pod infra container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the pod or infra container +to work. + +Do not modify the source directory mounted into the pod with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the pod are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the pod +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +pod, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +pod. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the pod. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the pod. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless pod fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/volume.md) + + +[//]: # (BEGIN included file options/volumes-from.md) +#### **--volumes-from**=*CONTAINER[\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers and pods. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +pod. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a pod. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the pod context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target pod, then the volume hides +that data on the target. + +[//]: # (END included file options/volumes-from.md) + +## EXAMPLES + +Clone the specified pod to a new pod. +``` +# podman pod clone pod-name +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone the specified pod to a new pod with a new name. +``` +# podman pod clone pod-name --name=cloned-pod +d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone and remove the specified pod to a new pod, modifying its cpus. +``` +# podman pod clone --destroy --cpus=5 d0cf1 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone the specified pod to a new named pod. +``` +# podman pod clone 2d4d4fca7219b4437e0d74fcdc272c4f031426a6eacd207372691207079551de new_name +5a9b7851013d326aa4ac4565726765901b3ecc01fcbc0f237bc7fd95588a24f9 +``` +## SEE ALSO +**[podman-pod-create(1)](podman-pod-create.1.md)** + +## HISTORY +May 2022, Originally written by Charlie Doern + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a core value of open source. The `master` and `slave` mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately. diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-pod-create.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-pod-create.1.md new file mode 100644 index 000000000..9d34a9a16 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-pod-create.1.md @@ -0,0 +1,1139 @@ +--- +title: podman-pod-create +version: v5.5.1 +--- + +% podman-pod-create 1 + +## NAME +podman\-pod\-create - Create a new pod + +## SYNOPSIS +**podman pod create** [*options*] [*name*] + +## DESCRIPTION + +Creates an empty pod, or unit of multiple containers, and prepares it to have +containers added to it. The pod can be created with a specific name. If a name +is not given a random name is generated. The pod ID is printed to STDOUT. You +can then use **podman create --pod `` ...** to add containers +to the pod, and **podman pod start ``** to start the pod. + +The operator can identify a pod in three ways: +UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”) +UUID short identifier (“f78375b1c487”) +Name (“jonah”) + +podman generates a UUID for each pod, and if a name is not assigned +to the container with **--name** then a random string name is generated +for it. This name is useful to identify a pod. + +Note: resource limit related flags work by setting the limits explicitly in the pod's cgroup parent +for all containers joining the pod. A container can override the resource limits when joining a pod. +For example, if a pod was created via **podman pod create --cpus=5**, specifying **podman container create --pod=`` --cpus=4** causes the container to use the smaller limit. Also, containers which specify their own cgroup, such as **--cgroupns=host**, do NOT get the assigned pod level cgroup resources. + +## OPTIONS + + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the pod's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + +The /etc/hosts file is shared between all containers in the pod. + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the pod is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + +#### **--cpus**=*amount* + +Set the total number of CPUs delegated to the pod. Default is 0.000 which indicates that there is no limit on computation power. + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the pod. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The pod only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: the pod implements devices by storing the initial configuration passed by the user and recreating the device on each container added to the pod. + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + +#### **--dns**=*ipaddr* + +Set custom DNS servers in the /etc/resolv.conf file that is shared between all containers in the pod. A special option, "none" is allowed which disables creation of /etc/resolv.conf for the pod. + +#### **--dns-option**=*option* + +Set custom DNS options in the /etc/resolv.conf file that is shared between all containers in the pod. + +#### **--dns-search**=*domain* + +Set custom DNS search domains in the /etc/resolv.conf file that is shared between all containers in the pod. + +#### **--exit-policy**=**continue** | *stop* + +Set the exit policy of the pod when the last container exits. Supported policies are: + +| Exit Policy | Description | +| ------------------ | -------------------------------------------------------------------------------------------------------------------------- | +| *continue* | The pod continues running, by keeping its infra container alive, when the last container exits. Used by default. | +| *stop* | The pod (including its infra container) is stopped when the last container exits. Used in `kube play`. | + + +[//]: # (BEGIN included file options/gidmap.pod.md) +#### **--gidmap**=*pod_gid\:host_gid\:amount* + +GID map for the user namespace. Using this flag runs all containers in the pod with user namespace enabled. +It conflicts with the **--userns** and **--subgidname** flags. + +[//]: # (END included file options/gidmap.pod.md) + + +[//]: # (BEGIN included file options/gpus.md) +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. + +[//]: # (END included file options/gpus.md) + +#### **--help**, **-h** + +Print usage statement. + + +[//]: # (BEGIN included file options/hostname.pod.md) +#### **--hostname**=*name* + +Set the pod's hostname inside all containers. + +The given hostname is also added to the `/etc/hosts` file using the container's +primary IP address (also see the **--add-host** option). + +[//]: # (END included file options/hostname.pod.md) + + +[//]: # (BEGIN included file options/hosts-file.md) +#### **--hosts-file**=*path* | *none* | *image* + +Base file to create the `/etc/hosts` file inside the container. This must either +be an absolute path to a file on the host system, or one of the following +special flags: + "" Follow the `base_hosts_file` configuration in _containers.conf_ (the default) + `none` Do not use a base file (i.e. start with an empty file) + `image` Use the container image's `/etc/hosts` file as base file + +[//]: # (END included file options/hosts-file.md) + +#### **--infra** + +Create an infra container and associate it with the pod. An infra container is a lightweight container used to coordinate the shared kernel namespace of a pod. Default: true. + + +[//]: # (BEGIN included file options/infra-command.md) +#### **--infra-command**=*command* + +The command that is run to start the infra container. Default: "/pause". + +[//]: # (END included file options/infra-command.md) + + +[//]: # (BEGIN included file options/infra-conmon-pidfile.md) +#### **--infra-conmon-pidfile**=*file* + +Write the pid of the infra container's **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to manage Podman containers and pods. + +[//]: # (END included file options/infra-conmon-pidfile.md) + +#### **--infra-image**=*image* + +The custom image that is used for the infra container. Unless specified, Podman builds a custom local image which does not require pulling down an image. + + +[//]: # (BEGIN included file options/infra-name.md) +#### **--infra-name**=*name* + +The name that is used for the pod's infra container. + +[//]: # (END included file options/infra-name.md) + + +[//]: # (BEGIN included file options/ip.md) +#### **--ip**=*ipv4* + +Specify a static IPv4 address for the pod, for example **10.88.64.128**. +This option can only be used if the pod is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the pod is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IP address pool (default **10.88.0.0/16**). + +To specify multiple static IP addresses per pod, set multiple networks using the **--network** option with a static IP address specified for each using the `ip` mode for that option. + +[//]: # (END included file options/ip.md) + + +[//]: # (BEGIN included file options/ip6.md) +#### **--ip6**=*ipv6* + +Specify a static IPv6 address for the pod, for example **fd46\:db93\:aa76\:ac37::10**. +This option can only be used if the pod is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the pod is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IPv6 address pool. + +To specify multiple static IPv6 addresses per pod, set multiple networks using the **--network** option with a static IPv6 address specified for each using the `ip6` mode for that option. + +[//]: # (END included file options/ip6.md) + + +[//]: # (BEGIN included file options/label.md) +#### **--label**, **-l**=*key=value* + +Add metadata to a pod. + +[//]: # (END included file options/label.md) + + +[//]: # (BEGIN included file options/label-file.md) +#### **--label-file**=*file* + +Read in a line-delimited file of labels. + +[//]: # (END included file options/label-file.md) + + +[//]: # (BEGIN included file options/mac-address.md) +#### **--mac-address**=*address* + +Pod network interface MAC address (e.g. 92\:d0\:c6:0a:29:33) +This option can only be used if the pod is joined to only a single network - i.e., **--network=_network-name_** is used at most once - +and if the pod is not joining another container's network namespace via **--network=container\:_id_**. + +Remember that the MAC address in an Ethernet network must be unique. +The IPv6 link-local address is based on the device's MAC address +according to RFC4862. + +To specify multiple static MAC addresses per pod, set multiple networks using the **--network** option with a static MAC address specified for each using the `mac` mode for that option. + +[//]: # (END included file options/mac-address.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + +#### **--name**, **-n**=*name* + +Assign a name to the pod. + + +[//]: # (BEGIN included file options/network.md) +#### **--network**=*mode*, **--net** + +Set the network mode for the pod. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + For better integration with DNS handling, **--dns-forward 169.254.1.1** is passed, + and this address is added to resolv.conf(5) as first resolver. It is possible to pass + **--dns-forward** explicitly in case a different IP address should be used. + To make the `host.containers.internal` /etc/hosts entry work and allow connections + to the host, **--map-guest-addr 169.254.1.2** is passed. Again, it can be set + explicitly to choose a different IP address. \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured (via Podman's + **--publish** or by passing the pasta **-t**/**-u** options directly), + to disable automatic port forwarding based on bound ports. Similarly, **-T none** + and **-U none** are given to disable the same functionality from container to + host. \ + All options can also be set in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**; + see the `pasta_options` key under the network section in that file. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.md) + +Invalid if using **--dns**, **--dns-option**, or **--dns-search** with **--network** set to **none** or **container:**_id_. + + +[//]: # (BEGIN included file options/network-alias.md) +#### **--network-alias**=*alias* + +Add a network-scoped alias for the pod, setting the alias for all networks that the container joins. To set a +name only for a specific network, use the alias option as described under the **--network** option. +If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. This option can be specified multiple times. +NOTE: When using CNI a pod only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. + +[//]: # (END included file options/network-alias.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the pod. + +Podman assumes control over the pod's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/pid.pod.md) +#### **--pid**=*pid* + +Set the PID mode for the pod. The default is to create a private PID namespace for the pod. Requires the PID namespace to be shared via --share. + + host: use the host’s PID namespace for the pod + ns: join the specified PID namespace + private: create a new namespace for the pod (default) + +[//]: # (END included file options/pid.pod.md) + +#### **--pod-id-file**=*path* + +Write the pod ID to the file. + + +[//]: # (BEGIN included file options/publish.md) +#### **--publish**, **-p**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Publish a container's port, or range of ports, within this pod to the host. + +Both *hostPort* and *containerPort* can be specified as a range of ports. +When specifying ranges for both, the number of container ports in the +range must match the number of host ports in the range. + +If host IP is set to 0.0.0.0 or not set at all, the port is bound on all IPs on the host. + +By default, Podman publishes TCP ports. To publish a UDP port instead, give +`udp` as protocol. To publish both TCP and UDP ports, set `--publish` twice, +with `tcp`, and `udp` as protocols respectively. Rootful containers can also +publish ports using the `sctp` protocol. + +Host port does not have to be specified (e.g. `podman run -p 127.0.0.1::80`). +If it is not, the container port is randomly assigned a port on the host. + +Use **podman port** to see the actual mapping: `podman port $CONTAINER $CONTAINERPORT`. + +Note that the network drivers `macvlan` and `ipvlan` do not support port forwarding, +therefore this option will have no effect on such networks. + +[//]: # (END included file options/publish.md) + +**Note:** You must not publish ports of containers in the pod individually, +but only by the pod itself. + +**Note:** This cannot be modified once the pod is created. + + +[//]: # (BEGIN included file options/replace.md) +#### **--replace** + +If another pod with the same name already exists, replace and remove it. The default is **false**. + +[//]: # (END included file options/replace.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + +Default restart policy for all the containers in a pod. + + +[//]: # (BEGIN included file options/security-opt.md) +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the pod +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the pod + +- **label=user:**_USER_: Set the label user for the pod processes +- **label=role:**_ROLE_: Set the label role for the pod processes +- **label=type:**_TYPE_: Set the label process type for the pod processes +- **label=level:**_LEVEL_: Set the label level for the pod processes +- **label=filetype:**_TYPE_: Set the label file type for the pod files +- **label=disable**: Turn off label separation for the pod + +Note: Labeling can be disabled for all pods/containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the containers within the pod. + +- **no-new-privileges**: Disable container processes from gaining additional privileges through the `execve(2)` system call (e.g. via setuid or setgid bits, or via file capabilities). Programs that rely on setuid/setgid bits set on their executable to change user id or group id are no longer able to do so, and any file capabilities added to the executable (e.g. via `setcap`) are not added to the permitted capability set. For more details, see: https://docs.kernel.org/userspace-api/no_new_privs.html. + +- **seccomp=unconfined**: Turn off seccomp confinement for the pod. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. + +[//]: # (END included file options/security-opt.md) + +#### **--share**=*namespace* + +A comma-separated list of kernel namespaces to share. If none or "" is specified, no namespaces are shared, and the infra container is not created unless explicitly specified via **--infra=true**. The namespaces to choose from are cgroup, ipc, net, pid, uts. If the option is prefixed with a "+", the namespace is appended to the default list. Otherwise, it replaces the default list. Defaults match Kubernetes default (ipc, net, uts) + +#### **--share-parent** + +This boolean determines whether or not all containers entering the pod use the pod as their cgroup parent. The default value of this option is true. Use the **--share** option to share the cgroup namespace rather than a cgroup parent in a pod. + +Note: This option conflicts with the **--share=cgroup** option since that option sets the pod as the cgroup parent but enters the container into the same cgroupNS as the infra container. + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the pod. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/shm-size-systemd.md) +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. + +[//]: # (END included file options/shm-size-systemd.md) + + +[//]: # (BEGIN included file options/subgidname.md) +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. + +[//]: # (END included file options/subgidname.md) + + +[//]: # (BEGIN included file options/subuidname.md) +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. + +[//]: # (END included file options/subuidname.md) + + +[//]: # (BEGIN included file options/sysctl.md) +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters for all containers in the pod. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: if the ipc namespace is not shared within the pod, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: if the network namespace is not shared within the pod, the above sysctls are not allowed. + +[//]: # (END included file options/sysctl.md) + + +[//]: # (BEGIN included file options/uidmap.pod.md) +#### **--uidmap**=*container_uid\:from_uid\:amount* + +Run all containers in the pod in a new user namespace using the supplied mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +[//]: # (END included file options/uidmap.pod.md) + + +[//]: # (BEGIN included file options/userns.pod.md) +#### **--userns**=*mode* + +Set the user namespace mode for all the containers in a pod. It defaults to the `PODMAN_USERNS` environment variable. An empty value ("") means user namespaces are disabled. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +----------|---------------|--------------------- +"" |$UID |0 (Default User account mapped to root user in container.) +host |$UID |0 (Default User account mapped to root user in container.) +keep-id |$UID |$UID (Map user account to same UID within container.) +auto |$UID | nil (Host User UID is not mapped into container.) +nomap |$UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + + - *auto[:*_OPTIONS,..._*]*: automatically create a namespace. It is possible to specify these options to `auto`: + + - *gidmapping=*_CONTAINER\_GID\:HOST\_GID\:SIZE_ to force a GID mapping to be present in the user namespace. + + - *size=*_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates the size for the user namespace. + + - *uidmapping=*_CONTAINER\_UID\:HOST\_UID\:SIZE_ to force a UID mapping to be present in the user namespace. + + - *host*: run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user (default). + + - *keep-id*: creates a user namespace where the current rootless user's UID\:GID are mapped to the same values in the container. This option is not allowed for containers created by the root user. + + - *nomap*: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +[//]: # (END included file options/userns.pod.md) + + +[//]: # (BEGIN included file options/uts.pod.md) +#### **--uts**=*mode* + +Set the UTS namespace mode for the pod. The following values are supported: + +- **host**: use the host's UTS namespace inside the pod. +- **private**: create a new namespace for the pod (default). +- **ns:[path]**: run the pod in the given existing UTS namespace. + +[//]: # (END included file options/uts.pod.md) + + +[//]: # (BEGIN included file options/volume.md) +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the pod is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +pod. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a pod is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the pod, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the pod. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a pod. Without a label, the security system +might prevent the processes running inside the pod from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the pod context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +pods share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label. Only the current pod can use a private +volume. + +Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any one of the containers. Relabeling walks +the file system under the volume and changes the label on each file; if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the pod. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually changed with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the pod. +For example if a user wanted to volume mount their entire home directory into a +pod, they need to disable SELinux separation. + + $ podman pod create --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The pod processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the pod +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous pod executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the pod infra container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the pod or infra container +to work. + +Do not modify the source directory mounted into the pod with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the pod are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the pod +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +pod, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +pod. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the pod. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the pod. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless pod fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/volume.md) + + +[//]: # (BEGIN included file options/volumes-from.md) +#### **--volumes-from**=*CONTAINER[\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers and pods. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +pod. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a pod. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the pod context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target pod, then the volume hides +that data on the target. + +[//]: # (END included file options/volumes-from.md) + +## EXAMPLES + +Create a named pod. +``` +$ podman pod create --name test +``` + +Create a named pod. +``` +$ podman pod create mypod +``` + +Create a pod without an infra container. +``` +$ podman pod create --infra=false +``` + +Create a named pod with infra container command to run. +``` +$ podman pod create --infra-command /top toppod +``` + +Create a pod with published ports on the host. +``` +$ podman pod create --publish 8443:443 +``` + +Create a pod with the specified network configuration. +``` +$ podman pod create --network slirp4netns:outbound_addr=127.0.0.1,allow_host_loopback=true +``` + +Create a pod with the specified network. +``` +$ podman pod create --network pasta +``` + +Create a pod on two networks. +``` +$ podman pod create --network net1\:ip=10.89.1.5 --network net2\:ip=10.89.10.10 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **containers.conf(1)**, **[cgroups(7)](https://man7.org/linux/man-pages/man7/cgroups.7.html)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +July 2018, Originally compiled by Peter Hunt + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a core value of open source. The `master` and `slave` mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately. diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-pod-exists.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-pod-exists.1.md new file mode 100644 index 000000000..87d4b1f17 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-pod-exists.1.md @@ -0,0 +1,38 @@ +--- +title: podman-pod-exists +version: v5.5.1 +--- + +% podman-pod-exists 1 + +## NAME +podman-pod-exists - Check if a pod exists in local storage + +## SYNOPSIS +**podman pod exists** *pod* + +## DESCRIPTION +**podman pod exists** checks if a pod exists in local storage. The **ID** or **Name** +of the pod may be used as input. Podman returns an exit code +of `0` when the pod is found. A `1` is returned otherwise. An exit code of `125` indicates there +was an issue accessing the local storage. + +## EXAMPLES + +Check if specified pod exists in local storage (the pod does actually exist): +``` +$ sudo podman pod exists web; echo $? +0 +``` + +Check if specified pod exists in local storage (the pod does not actually exist): +``` +$ sudo podman pod exists backend; echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-pod-inspect.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-pod-inspect.1.md new file mode 100644 index 000000000..9c5e6944a --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-pod-inspect.1.md @@ -0,0 +1,113 @@ +--- +title: podman-pod-inspect +version: v5.5.1 +--- + +% podman-pod-inspect 1 + +## NAME +podman\-pod\-inspect - Display information describing a pod + +## SYNOPSIS +**podman pod inspect** [*options*] *pod* ... + +## DESCRIPTION +Displays configuration and state information about a given pod. It also displays information about containers +that belong to the pod. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|----------------------|---------------------------------------------| +| .BlkioDeviceReadBps | Block I/O Device Read, in bytes/sec | +| .BlkioDeviceWriteBps | Block I/O Device Read, in bytes/sec | +| .BlkioWeight | Block I/O Weight | +| .BlkioWeightDevice | Block I/O Device Weight | +| .CgroupParent | Pod cgroup parent | +| .CgroupPath | Pod cgroup path | +| .Containers | Pod containers | +| .CPUPeriod | CPU period | +| .CPUQuota | CPU quota | +| .CPUSetCPUs | CPU Set CPUs | +| .CPUSetMems | CPU Set Mems | +| .CPUShares | CPU Shares | +| .CreateCgroup | Whether cgroup was created | +| .CreateCommand | Create command | +| .Created ... | Time when the pod was created | +| .CreateInfra | Whether infrastructure created | +| .Devices | Devices | +| .ExitPolicy | Exit policy | +| .Hostname | Pod hostname | +| .ID | Pod ID | +| .InfraConfig ... | Infra config (contains further fields) | +| .InfraContainerID | Pod infrastructure ID | +| .InspectPodData ... | Nested structure, for experts only | +| .Labels ... | Pod labels | +| .LockNumber | Number of the pod's Libpod lock | +| .MemoryLimit | Memory limit, bytes | +| .MemorySwap | Memory swap limit, in bytes | +| .Mounts | Mounts | +| .Name | Pod name | +| .Namespace | Namespace | +| .NumContainers | Number of containers in the pod | +| .RestartPolicy | Restart policy of the pod | +| .SecurityOpts | Security options | +| .SharedNamespaces | Pod shared namespaces | +| .State | Pod state | +| .VolumesFrom | Volumes from | + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Inspect specified pod: +``` +# podman pod inspect foobar +[ + { + "Id": "3513ca70583dd7ef2bac83331350f6b6c47d7b4e526c908e49d89ebf720e4693", + "Name": "foobar", + "Labels": {}, + "CgroupParent": "/libpod_parent", + "CreateCgroup": true, + "Created": "2018-08-08T11:15:18.823115347-05:00" + "State": "created", + "Hostname": "", + "SharedNamespaces": [ + "uts", + "ipc", + "net" + ] + "CreateInfra": false, + "InfraContainerID": "1020dd70583dd7ff2bac83331350f6b6e007de0d026c908e49d89ebf891d4699" + "CgroupPath": "" + "Containers": [ + { + "id": "d53f8bf1e9730281264aac6e6586e327429f62c704abea4b6afb5d8a2b2c9f2c", + "state": "configured" + } + ] + } +] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +August 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-pod-kill.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-pod-kill.1.md new file mode 100644 index 000000000..56a8ae678 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-pod-kill.1.md @@ -0,0 +1,73 @@ +--- +title: podman-pod-kill +version: v5.5.1 +--- + +% podman-pod-kill 1 + +## NAME +podman\-pod\-kill - Kill the main process of each container in one or more pods + +## SYNOPSIS +**podman pod kill** [*options*] *pod* ... + +## DESCRIPTION +The main process of each container inside the pods specified is sent SIGKILL, or any signal specified with option --signal. + +## OPTIONS +#### **--all**, **-a** + +Sends signal to all containers associated with a pod. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/signal.md) +#### **--signal**, **-s**=**signal** + +Signal to send to the containers in the pod. For more information on Linux signals, refer to *signal(7)*. +The default is **SIGKILL**. + +[//]: # (END included file options/signal.md) + +## EXAMPLE + +Kill pod with a given name: +``` +podman pod kill mywebserver +``` + +Kill pod with a given ID: +``` +podman pod kill 860a4b23 +``` + +Terminate pod by sending `TERM` signal: +``` +podman pod kill --signal TERM 860a4b23 +``` + +Kill the latest pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman pod kill --latest +``` + +Terminate all pods by sending `KILL` signal: +``` +podman pod kill --all +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-stop(1)](podman-pod-stop.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-pod-logs.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-pod-logs.1.md new file mode 100644 index 000000000..029a0fc80 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-pod-logs.1.md @@ -0,0 +1,136 @@ +--- +title: podman-pod-logs +version: v5.5.1 +--- + +% podman-pod-logs 1 + +## NAME +podman\-pod\-logs - Display logs for pod with one or more containers + +## SYNOPSIS +**podman pod logs** [*options*] *pod* + +## DESCRIPTION +The podman pod logs command batch-retrieves whatever logs are present with all the containers of a pod. Pod logs can be filtered by container name or ID using flag **-c** or **--container** if needed. + +Note: A long-running `podman pod log` command with a `-f` or `--follow` option needs to be reinvoked if a new container is added to the pod dynamically; otherwise, logs of newly added containers are not visible in the log stream. + +## OPTIONS + + +[//]: # (BEGIN included file options/color.md) +#### **--color** + +Output the containers with different colors in the log. + +[//]: # (END included file options/color.md) + +#### **--container**, **-c** + +By default, `podman pod logs` retrieves logs for all the containers available within the pod, differentiated by the field `container`. However, there are use cases where the user wants to limit the log stream only to a particular container of a pod. For such cases, `-c` can be used like `podman pod logs -c ctrNameorID podname`. + + +[//]: # (BEGIN included file options/follow.md) +#### **--follow**, **-f** + +Follow log output. Default is false. + +Note: When following a pod which is removed by `podman pod rm` +or removed on exit (`podman run --rm ...`), there is a chance that the log +file is removed before `podman pod logs` reads the final content. + +[//]: # (END included file options/follow.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/names.md) +#### **--names**, **-n** + +Output the container names instead of the container IDs in the log. + +[//]: # (END included file options/names.md) + + +[//]: # (BEGIN included file options/since.md) +#### **--since**=*TIMESTAMP* + +Show logs since TIMESTAMP. The --since option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. + +[//]: # (END included file options/since.md) + + +[//]: # (BEGIN included file options/tail.md) +#### **--tail**=*LINES* + +Output the specified number of LINES at the end of the logs. LINES must be an integer. Defaults to -1, +which prints all lines + +[//]: # (END included file options/tail.md) + + +[//]: # (BEGIN included file options/timestamps.md) +#### **--timestamps**, **-t** + +Show timestamps in the log outputs. The default is false + +[//]: # (END included file options/timestamps.md) + + +[//]: # (BEGIN included file options/until.md) +#### **--until**=*TIMESTAMP* + +Show logs until TIMESTAMP. The --until option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. + +[//]: # (END included file options/until.md) + +## EXAMPLE + +To view a pod's logs: +``` +podman pod logs -t podIdorName +``` + +To view logs of a specific container on the pod: +``` +podman pod logs -c ctrIdOrName podIdOrName +``` + +To view all pod logs: +``` +podman pod logs -t --since 0 myserver-pod-1 +``` + +To view a pod's logs since a certain time: +``` +podman pod logs -t --since 2017-08-07T10:10:09.055837383-04:00 myserver-pod-1 +``` + +To view a pod's logs generated in the last 10 minutes: +``` +podman pod logs --since 10m myserver-pod-1 +``` + +To view a pod's logs until 30 minutes ago: +``` +podman pod logs --until 30m myserver-pod-1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-rm(1)](podman-pod-rm.1.md)**, **[podman-logs(1)](podman-logs.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-pod-pause.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-pod-pause.1.md new file mode 100644 index 000000000..b3b87c866 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-pod-pause.1.md @@ -0,0 +1,43 @@ +--- +title: podman-pod-pause +version: v5.5.1 +--- + +% podman-pod-pause 1 + +## NAME +podman\-pod\-pause - Pause one or more pods + +## SYNOPSIS +**podman pod pause** [*options*] *pod* ... + +## DESCRIPTION +Pauses all the running processes in the containers of one or more pods. You may use pod IDs or names as input. + +## OPTIONS + +#### **--all**, **-a** + +Pause all pods. + +#### **--latest**, **-l** + +Instead of providing the pod name or ID, pause the last created pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +## EXAMPLE + +Pause a pod with a given name: +``` +podman pod pause mywebserverpod +``` + +Pause a pod with a given ID: +``` +podman pod pause 860a4b23 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-unpause(1)](podman-pod-unpause.1.md)**, **[podman-pause(1)](podman-pause.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-pod-prune.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-pod-prune.1.md new file mode 100644 index 000000000..f96e851f7 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-pod-prune.1.md @@ -0,0 +1,38 @@ +--- +title: podman-pod-prune +version: v5.5.1 +--- + +% podman-pod-prune 1 + +## NAME +podman-pod-prune - Remove all stopped pods and their containers + +## SYNOPSIS +**podman pod prune** [*options*] + +## DESCRIPTION +**podman pod prune** removes all stopped pods and their containers from local storage. + +## OPTIONS + +#### **--force**, **-f** +Force removal of all running pods and their containers. The default is false. + +## EXAMPLES + +Remove all stopped pods and their containers from local storage. +``` +$ sudo podman pod prune +22b8813332948064b6566370088c5e0230eeaf15a58b1c5646859fd9fc364fe7 +2afb26869fe5beab979c234afb75c7506063cd4655b1a73557c9d583ff1aebe9 +49161ad2a722cf18722f0e17199a9e840703a17d1158cdeda502b6d54080f674 +5ca429f37fb83a9f54eea89e3a9102b7780a6e6ae5f132db0672da551d862c4a +6bb06573787efb8b0675bc88ebf8361f1a56d3ac7922d1a6436d8f59ffd955f1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +April 2019, Originally compiled by Peter Hunt (pehunt at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-pod-ps.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-pod-ps.1.md new file mode 100644 index 000000000..0d669a87a --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-pod-ps.1.md @@ -0,0 +1,206 @@ +--- +title: podman-pod-ps +version: v5.5.1 +--- + +% podman-pod-ps 1 + +## NAME +podman\-pod\-ps - Print out information about pods + +## SYNOPSIS +**podman pod ps** [*options*] + +## DESCRIPTION +**podman pod ps** lists the pods on the system. +By default it lists: + + * pod ID + * pod name + * the time the pod was created + * number of containers attached to pod + * container ID of the pod infra container + * status of pod as defined by the following table + +| **Status** | **Description** | +| ------------ | ------------------------------------------------| +| Created | No containers running nor stopped | +| Running | at least one container is running | +| Stopped | At least one container stopped and none running | +| Exited | All containers stopped in pod | +| Dead | Error retrieving state | + + +## OPTIONS + +#### **--ctr-ids** + +Display the container IDs + +#### **--ctr-names** + +Display the container names + +#### **--ctr-status** + +Display the container statuses + +#### **--filter**, **-f**=*filter* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|------------|--------------------------------------------------------------------------------------------------| +| ctr-ids | Filter by container ID within the pod. (CID prefix match by default; accepts regex) | +| ctr-names | Filter by container name within the pod. | +| ctr-number | Filter by number of containers in the pod. | +| ctr-status | Filter by container status within the pod. | +| id | Filter by pod ID. (Prefix match by default; accepts regex) | +| label | Filter by container with (or without, in the case of label!=[...] is used) the specified labels. | +| name | Filter by pod name. | +| network | Filter by network name or full ID of network. | +| status | Filter by pod status. | +| until | Filter by pods created before given timestamp. | + +The `ctr-ids`, `ctr-names`, `id`, `name` filters accept `regex` format. + +The `ctr-status` filter accepts values: `created`, `running`, `paused`, `stopped`, `exited`, `unknown`. + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes containers with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes containers without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +The `status` filter accepts values: `stopped`, `running`, `paused`, `exited`, `dead`, `created`, `degraded`. + +#### **--format**=*format* + +Pretty-print containers to JSON or using a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|---------------------|------------------------------------------------------| +| .Cgroup | Cgroup path of pod | +| .ContainerIds | Comma-separated list of container IDs in the pod | +| .ContainerNames | Comma-separated list of container names in the pod | +| .ContainerStatuses | Comma-separated list of container statuses | +| .Created | Creation time of pod | +| .ID | Container ID | +| .InfraID | Pod infra container ID | +| .Label *string* | Specified label of the pod | +| .Labels ... | All the labels assigned to the pod | +| .Name | Name of pod | +| .Networks | Show all networks connected to the infra container | +| .NumberOfContainers | Show the number of containers attached to pod | +| .Restarts | Show the total number of container restarts in a pod | +| .Status | Status of pod | + +#### **--help**, **-h** + +Print usage statement + +#### **--latest**, **-l** + +Show the latest pod created (all states) (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +#### **--namespace**, **--ns** + +Display namespace information of the pod + +#### **--no-trunc** + +Do not truncate the output (default *false*). + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Print the numeric IDs of the pods only + +#### **--sort** + +Sort by created, ID, name, status, or number of containers + +Default: created + +## EXAMPLES + +List all running pods. +``` +$ podman pod ps +POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS +00dfd6fa02c0 jolly_goldstine Running 31 hours ago ba465ab0a3a4 1 +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a 2 +``` + +List all running pods along with container names within the pods. +``` +$ podman pod ps --ctr-names +POD ID NAME STATUS CREATED INFRA ID NAMES +00dfd6fa02c0 jolly_goldstine Running 31 hours ago ba465ab0a3a4 loving_archimedes +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a thirsty_hawking,wizardly_golick +``` + +List all running pods along with status, names and ids. +``` +$ podman pod ps --ctr-status --ctr-names --ctr-ids +POD ID NAME STATUS CREATED INFRA ID IDS NAMES STATUS +00dfd6fa02c0 jolly_goldstine Running 31 hours ago ba465ab0a3a4 ba465ab0a3a4 loving_archimedes running +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a 331693bff40a,8e428daeb89e thirsty_hawking,wizardly_golick configured,configured +``` + +List all running pods and print ID, Container Names, and cgroups. +``` +$ podman pod ps --format "{{.ID}} {{.ContainerNames}} {{.Cgroup}}" +00dfd6fa02c0 loving_archimedes /libpod_parent +f4df8692e116 thirsty_hawking,wizardly_golick /libpod_parent +``` + +List all running pods with two containers sorted by pod ID. +``` +$ podman pod ps --sort id --filter ctr-number=2 +POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a 2 +``` + +List all running pods with their container ids. +``` +$ podman pod ps --ctr-ids +POD ID NAME STATUS CREATED INFRA ID IDS +00dfd6fa02c0 jolly_goldstine Running 31 hours ago ba465ab0a3a4 ba465ab0a3a4 +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a 331693bff40a,8e428daeb89e +``` + +List all running pods with container ids without truncating IDs. +``` +$ podman pod ps --no-trunc --ctr-ids +POD ID NAME STATUS CREATED INFRA ID IDS +00dfd6fa02c0a2daaedfdf8fcecd06f22ad114d46d167d71777224735f701866 jolly_goldstine Running 31 hours ago ba465ab0a3a4e15e3539a1e79c32d1213a02b0989371e274f98e0f1ae9de7050 ba465ab0a3a4e15e3539a1e79c32d1213a02b0989371e274f98e0f1ae9de7050 +f4df8692e116a3e6d1d62572644ed36ca475d933808cc3c93435c45aa139314b nifty_torvalds Created 10 minutes ago 331693bff40a926b6d52b184e116afd15497610c378d5d4c42945dd6e33b75b0 331693bff40a926b6d52b184e116afd15497610c378d5d4c42945dd6e33b75b0,8e428daeb89e69b71e7916a13accfb87d122889442b5c05c2d99cf94a3230e9d +``` + +List all running pods with container names. +``` +$ podman pod ps --ctr-names +POD ID NAME STATUS CREATED INFRA ID NAMES +314f4da82d74 hi Created 17 hours ago a9f2d2165675 jovial_jackson,hopeful_archimedes,vibrant_ptolemy,heuristic_jennings,keen_raman,hopeful_newton,mystifying_bose,silly_lalande,serene_lichterman ... +``` + +## pod ps +Print a list of pods + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-pod-restart.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-pod-restart.1.md new file mode 100644 index 000000000..6777da980 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-pod-restart.1.md @@ -0,0 +1,64 @@ +--- +title: podman-pod-restart +version: v5.5.1 +--- + +% podman-pod-restart 1 + +## NAME +podman\-pod\-restart - Restart one or more pods + +## SYNOPSIS +**podman pod restart** [*options*] *pod* ... + +## DESCRIPTION +Restart containers in one or more pods. Running containers are stopped and restarted. +Stopped containers are started. You may use pod IDs or names as input. +The pod ID is printed upon successful restart. +When restarting multiple pods, an error from restarting one pod does not effect restarting other pods. + +## OPTIONS + +#### **--all**, **-a** + +Restarts all pods + +#### **--latest**, **-l** + +Instead of providing the pod name or ID, restart the last created pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +## EXAMPLE + +Restart pod with a given name: +``` +podman pod restart mywebserverpod +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` + +Restart multiple pods with given IDs: +``` +podman pod restart 490eb 3557fb +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +``` + +Restart the last created pod: +``` +podman pod restart --latest +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +``` + +Restart all pods: +``` +podman pod restart --all +19456b4cd557eaf9629825113a552681a6013f8c8cad258e36ab825ef536e818 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +70c358daecf71ef9be8f62404f926080ca0133277ef7ce4f6aa2d5af6bb2d3e9 +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-restart(1)](podman-restart.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-pod-rm.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-pod-rm.1.md new file mode 100644 index 000000000..17e1f1037 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-pod-rm.1.md @@ -0,0 +1,109 @@ +--- +title: podman-pod-rm +version: v5.5.1 +--- + +% podman-pod-rm 1 + +## NAME +podman\-pod\-rm - Remove one or more stopped pods and containers + +## SYNOPSIS +**podman pod rm** [*options*] *pod* + +## DESCRIPTION +**podman pod rm** removes one or more stopped pods and their containers from the host. The pod name or ID can be used. The \-f option stops all containers and then removes them before removing the pod. If all containers added by the user are in an exited state, the pod is removed. + +## OPTIONS + +#### **--all**, **-a** + +Remove all pods. Can be used in conjunction with \-f as well. + +#### **--force**, **-f** + +Stop running containers and delete all stopped containers before removal of pod. + + +[//]: # (BEGIN included file options/ignore.md) +#### **--ignore**, **-i** + +Ignore errors when specified pods are not in the container store. A user +might have decided to manually remove a pod which leads to a failure +during the ExecStop directive of a systemd service referencing that pod. + +[//]: # (END included file options/ignore.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/pod-id-file.pod.md) +#### **--pod-id-file**=*file* + +Read pod ID from the specified *file* and rm the pod. Can be specified multiple times. + +[//]: # (END included file options/pod-id-file.pod.md) +If specified, the pod-id-file is removed along with the pod. + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping running containers within the pod. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +The --force option must be specified to use the --time option. + +## EXAMPLE + +Remove pod with a given name: +``` +podman pod rm mywebserverpod +``` + +Remove multiple pods with given names and/or IDs: +``` +podman pod rm mywebserverpod myflaskserverpod 860a4b23 +``` + +Forcefully remove pod with a given ID: +``` +podman pod rm -f 860a4b23 +``` + +Forcefully remove all pods: +``` +podman pod rm -f -a +podman pod rm -fa +``` + +Remove pod using ID specified in a given file: +``` +podman pod rm --pod-id-file /path/to/id/file +``` + +## Exit Status + **0** All specified pods removed + + **1** One of the specified pods did not exist, and no other failures + + **2** One of the specified pods is attached to a container + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-pod-start.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-pod-start.1.md new file mode 100644 index 000000000..409f6926e --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-pod-start.1.md @@ -0,0 +1,74 @@ +--- +title: podman-pod-start +version: v5.5.1 +--- + +% podman-pod-start 1 + +## NAME +podman\-pod\-start - Start one or more pods + +## SYNOPSIS +**podman pod start** [*options*] *pod* ... + +## DESCRIPTION +Start containers in one or more pods. You may use pod IDs or names as input. The pod must have a container attached +to be started. + +## OPTIONS + +#### **--all**, **-a** + +Starts all pods + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/pod-id-file.pod.md) +#### **--pod-id-file**=*file* + +Read pod ID from the specified *file* and start the pod. Can be specified multiple times. + +[//]: # (END included file options/pod-id-file.pod.md) + +## EXAMPLE + +Start pod with a given name: +``` +podman pod start mywebserverpod +``` + +Start pods with given IDs: +``` +podman pod start 860a4b23 5421ab4 +``` + +Start the latest pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman pod start --latest +``` + +Start all pods: +``` +podman pod start --all +``` + +Start pod using ID specified in a given file: +``` +podman pod start --pod-id-file /path/to/id/file +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-stop(1)](podman-pod-stop.1.md)** + +## HISTORY +July 2018, Adapted from podman start man page by Peter Hunt diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-pod-stats.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-pod-stats.1.md new file mode 100644 index 000000000..f975717cc --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-pod-stats.1.md @@ -0,0 +1,116 @@ +--- +title: podman-pod-stats +version: v5.5.1 +--- + +% podman-pod-stats 1 + +## NAME +podman\-pod\-stats - Display a live stream of resource usage stats for containers in one or more pods + +## SYNOPSIS +**podman pod stats** [*options*] [*pod*] + +## DESCRIPTION +Display a live stream of containers in one or more pods resource usage statistics. Running rootless is only supported on cgroups v2. + +## OPTIONS + +#### **--all**, **-a** + +Show all containers. Only running containers are shown by default + +#### **--format**=*template* + +Pretty-print container statistics to JSON or using a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| --------------- | ------------------ | +| .BlockIO | Block IO | +| .CID | Container ID | +| .CPU | CPU percentage | +| .Mem | Memory percentage | +| .MemUsage | Memory usage | +| .MemUsageBytes | Memory usage (IEC) | +| .Name | Container Name | +| .NetIO | Network IO | +| .PIDS | Number of PIDs | +| .Pod | Pod ID | + +When using a Go template, precede the format with `table` to print headers. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/no-reset.md) +#### **--no-reset** + +Do not clear the terminal/screen in between reporting intervals + +[//]: # (END included file options/no-reset.md) + + +[//]: # (BEGIN included file options/no-stream.md) +#### **--no-stream** + +Disable streaming pod stats and only pull the first result, default setting is false + +[//]: # (END included file options/no-stream.md) + +## EXAMPLE + +List statistics about all pods without streaming: +``` +# podman pod stats -a --no-stream +ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS +a9f807ffaacd frosty_hodgkin -- 3.092MB / 16.7GB 0.02% -- / -- -- / -- 2 +3b33001239ee sleepy_stallman -- -- / -- -- -- / -- -- / -- -- +``` + +List statistics about specified pod without streaming: +``` +# podman pod stats --no-stream a9f80 +ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS +a9f807ffaacd frosty_hodgkin -- 3.092MB / 16.7GB 0.02% -- / -- -- / -- 2 +``` + +List statistics about specified pod in JSON format without streaming: +``` +# podman pod stats --no-stream --format=json a9f80 +[ + { + "id": "a9f807ffaacd", + "name": "frosty_hodgkin", + "cpu_percent": "--", + "mem_usage": "3.092MB / 16.7GB", + "mem_percent": "0.02%", + "netio": "-- / --", + "blocki": "-- / --", + "pids": "2" + } +] +``` + +List selected statistics formatted in a table about specified pod: +``` +# podman pod stats --no-stream --format "table {{.ID}} {{.Name}} {{.MemUsage}}" 6eae +ID NAME MEM USAGE / LIMIT +6eae9e25a564 clever_bassi 3.031MB / 16.7GB +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +February 2019, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-pod-stop.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-pod-stop.1.md new file mode 100644 index 000000000..ef02f6ed7 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-pod-stop.1.md @@ -0,0 +1,111 @@ +--- +title: podman-pod-stop +version: v5.5.1 +--- + +% podman-pod-stop 1 + +## NAME +podman\-pod\-stop - Stop one or more pods + +## SYNOPSIS +**podman pod stop** [*options*] *pod* ... + +## DESCRIPTION +Stop containers in one or more pods. You may use pod IDs or names as input. + +## OPTIONS + +#### **--all**, **-a** + +Stops all pods + + +[//]: # (BEGIN included file options/ignore.md) +#### **--ignore**, **-i** + +Ignore errors when specified pods are not in the container store. A user +might have decided to manually remove a pod which leads to a failure +during the ExecStop directive of a systemd service referencing that pod. + +[//]: # (END included file options/ignore.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/pod-id-file.pod.md) +#### **--pod-id-file**=*file* + +Read pod ID from the specified *file* and stop the pod. Can be specified multiple times. + +[//]: # (END included file options/pod-id-file.pod.md) + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping running containers within the pod. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +## EXAMPLE + +Stop pod with a given name. +``` +$ podman pod stop mywebserverpod +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` + +Stop multiple pods with given IDs. +``` +$ podman pod stop 490eb 3557fb +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +``` + +Stop the last created pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman pod stop --latest +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +``` + +Stop all pods. +``` +$ podman pod stop --all +19456b4cd557eaf9629825113a552681a6013f8c8cad258e36ab825ef536e818 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +70c358daecf71ef9be8f62404f926080ca0133277ef7ce4f6aa2d5af6bb2d3e9 +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` + +Stop two pods via --pod-id-file. +``` +$ podman pod stop --pod-id-file file1 --pod-id-file file2 +19456b4cd557eaf9629825113a552681a6013f8c8cad258e36ab825ef536e818 +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` + +Stop all pods with a timeout of 1 second. +``` +$ podman pod stop -a -t 1 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +70c358daecf71ef9be8f62404f926080ca0133277ef7ce4f6aa2d5af6bb2d3e9 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-start(1)](podman-pod-start.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-pod-top.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-pod-top.1.md new file mode 100644 index 000000000..d086ff705 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-pod-top.1.md @@ -0,0 +1,65 @@ +--- +title: podman-pod-top +version: v5.5.1 +--- + +% podman-pod-top 1 + +## NAME +podman\-pod\-top - Display the running processes of containers in a pod + +## SYNOPSIS +**podman pod top** [*options*] *pod* [*format-descriptors*] + +## DESCRIPTION +Display the running processes of containers in a pod. The *format-descriptors* are ps (1) compatible AIX format +descriptors but extended to print additional information, such as the seccomp mode or the effective capabilities +of a given process. The descriptors can either be passed as separate arguments or as a single comma-separated argument. + +## OPTIONS + +#### **--help**, **-h** + + Print usage statement + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## FORMAT DESCRIPTORS + +For a full list of available descriptors, see podman-top(1) + +## EXAMPLES + +Print top data for the specified pod. +By default, `podman-pod-top` prints data similar to `ps -ef`: +``` +$ podman pod top b031293491cc +USER PID PPID %CPU ELAPSED TTY TIME COMMAND +root 1 0 0.000 2h5m38.737137571s ? 0s top +root 8 0 0.000 2h5m15.737228361s ? 0s top +``` + +The output can be controlled by specifying format descriptors as arguments after the pod. + +Print the pod top data fields pid,seccomp, args and %C on the latest pod created. (This -l option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman pod top -l pid seccomp args %C +PID SECCOMP COMMAND %CPU +1 filter top 0.000 +1 filter /bin/sh 0.000 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **ps(1)**, **seccomp(2)**, **proc(5)**, **capabilities(7)** + +## HISTORY +August 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-pod-unpause.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-pod-unpause.1.md new file mode 100644 index 000000000..0b6e652ac --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-pod-unpause.1.md @@ -0,0 +1,43 @@ +--- +title: podman-pod-unpause +version: v5.5.1 +--- + +% podman-pod-unpause 1 + +## NAME +podman\-pod\-unpause - Unpause one or more pods + +## SYNOPSIS +**podman pod unpause** [*options*] *pod* ... + +## DESCRIPTION +Unpauses all the paused processes in the containers of one or more pods. You may use pod IDs or names as input. + +## OPTIONS + +#### **--all**, **-a** + +Unpause all pods. + +#### **--latest**, **-l** + +Instead of providing the pod name or ID, unpause the last created pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +## EXAMPLE + +Unpause pod with a given name: +``` +podman pod unpause mywebserverpod +``` + +Unpause pod with a given ID: +``` +podman pod unpause 860a4b23 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-pause(1)](podman-pod-pause.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-pod.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-pod.1.md new file mode 100644 index 000000000..a323971bc --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-pod.1.md @@ -0,0 +1,42 @@ +--- +title: podman-pod +version: v5.5.1 +--- + +% podman-pod 1 + +## NAME +podman\-pod - Management tool for groups of containers, called pods + +## SYNOPSIS +**podman pod** *subcommand* + +## DESCRIPTION +podman pod is a set of subcommands that manage pods, or groups of containers. + +## SUBCOMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------- | --------------------------------------------------------------------------------- | +| clone | [podman-pod-clone(1)](podman-pod-clone.1.md) | Create a copy of an existing pod. | +| create | [podman-pod-create(1)](podman-pod-create.1.md) | Create a new pod. | +| exists | [podman-pod-exists(1)](podman-pod-exists.1.md) | Check if a pod exists in local storage. | +| inspect | [podman-pod-inspect(1)](podman-pod-inspect.1.md) | Display information describing a pod. | +| kill | [podman-pod-kill(1)](podman-pod-kill.1.md) | Kill the main process of each container in one or more pods. | +| logs | [podman-pod-logs(1)](podman-pod-logs.1.md) | Display logs for pod with one or more containers. | +| pause | [podman-pod-pause(1)](podman-pod-pause.1.md) | Pause one or more pods. | +| prune | [podman-pod-prune(1)](podman-pod-prune.1.md) | Remove all stopped pods and their containers. | +| ps | [podman-pod-ps(1)](podman-pod-ps.1.md) | Print out information about pods. | +| restart | [podman-pod-restart(1)](podman-pod-restart.1.md) | Restart one or more pods. | +| rm | [podman-pod-rm(1)](podman-pod-rm.1.md) | Remove one or more stopped pods and containers. | +| start | [podman-pod-start(1)](podman-pod-start.1.md) | Start one or more pods. | +| stats | [podman-pod-stats(1)](podman-pod-stats.1.md) | Display a live stream of resource usage stats for containers in one or more pods. | +| stop | [podman-pod-stop(1)](podman-pod-stop.1.md) | Stop one or more pods. | +| top | [podman-pod-top(1)](podman-pod-top.1.md) | Display the running processes of containers in a pod. | +| unpause | [podman-pod-unpause(1)](podman-pod-unpause.1.md) | Unpause one or more pods. | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-port.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-port.1.md new file mode 100644 index 000000000..c5b610b1b --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-port.1.md @@ -0,0 +1,71 @@ +--- +title: podman-port +version: v5.5.1 +--- + +% podman-port 1 + +## NAME +podman\-port - List port mappings for a container + +## SYNOPSIS +**podman port** [*options*] *container* [*private-port*[/*proto*]] + +**podman container port** [*options*] *container* [*private-port*[/*proto*]] + +## DESCRIPTION +List port mappings for the *container* or look up the public-facing port that is NAT-ed to the *private-port*. + +## OPTIONS + +#### **--all**, **-a** + +List all known port mappings for running containers; when using this option, container names or private ports/protocols filters cannot be used. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +List all port mappings: +``` +# podman port -a +b4d2f05432e482e017b1a4b2eae15fa7b4f6fb7e9f65c1bde46294fdef285906 +80/udp -> 0.0.0.0:44327 +80/tcp -> 0.0.0.0:44327 +# +``` + +List port mappings for a specific container: +``` +# podman port b4d2f054 +80/udp -> 0.0.0.0:44327 +80/tcp -> 0.0.0.0:44327 +# +``` +List the specified port mappings for a specific container: +``` +# podman port b4d2f054 80 + 0.0.0.0:44327 +# +``` + +List the port mappings for a specific container for port 80 and the tcp protocol: +``` +# podman port b4d2f054 80/tcp +0.0.0.0:44327 +# +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +January 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-ps.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-ps.1.md new file mode 100644 index 000000000..3ab223c75 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-ps.1.md @@ -0,0 +1,228 @@ +--- +title: podman-ps +version: v5.5.1 +--- + +% podman-ps 1 + +## NAME +podman\-ps - Print out information about containers + +## SYNOPSIS +**podman ps** [*options*] + +**podman container ps** [*options*] + +**podman container list** [*options*] + +**podman container ls** [*options*] + +## DESCRIPTION +**podman ps** lists the running containers on the system. Use the **--all** flag to view +all the containers information. By default it lists: + + * container id + * the name of the image the container is using + * the COMMAND the container is executing + * the time the container was created + * the status of the container + * port mappings the container is using + * alternative names for the container + +## OPTIONS + +#### **--all**, **-a** + +Show all the containers, default is only running containers. + +Note: Podman shares containers storage with other tools such as Buildah and CRI-O. In some cases these `external` containers might also exist in the same storage. Use the `--external` option to see these external containers. External containers show the 'storage' status. + +#### **--external** + +Display external containers that are not controlled by Podman but are stored in containers storage. These external containers are generally created via other container technology such as Buildah or CRI-O and may depend on the same container images that Podman is also using. External containers are denoted with either a 'buildah' or 'storage' in the COMMAND and STATUS column of the ps output. + +#### **--filter**, **-f** + +Filter what containers are shown in the output. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| label! | [Key] or [Key=Value] Label NOT assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container (accepts regex) | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] container created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + +#### **--format**=*format* + +Pretty-print containers to JSON or using a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|--------------------|----------------------------------------------| +| .AutoRemove | If true, containers are removed on exit | +| .CIDFile | Container ID File | +| .Command | Quoted command used | +| .Created ... | Creation time for container, Y-M-D H:M\:S | +| .CreatedAt | Creation time for container (same as above) | +| .CreatedHuman | Creation time, relative | +| .ExitCode | Container exit code | +| .Exited | "true" if container has exited | +| .ExitedAt | Time (epoch seconds) that container exited | +| .ExposedPorts ... | Map of exposed ports on this container | +| .ID | Container ID | +| .Image | Image Name/ID | +| .ImageID | Image ID | +| .IsInfra | "true" if infra container | +| .Label *string* | Specified label of the container | +| .Labels ... | All the labels assigned to the container | +| .Mounts | Volumes mounted in the container | +| .Names | Name of container | +| .Networks | Show all networks connected to the container | +| .Pid | Process ID on host system | +| .Pod | Pod the container is associated with (SHA) | +| .PodName | PodName of the container | +| .Ports | Forwarded and exposed ports | +| .Restarts | Display the container restart count | +| .RunningFor | Time elapsed since container was started | +| .Size | Size of container | +| .StartedAt | Time (epoch seconds) the container started | +| .State | Human-friendly description of ctr state | +| .Status | Status of container | + +#### **--help**, **-h** + +Print usage statement + +#### **--last**, **-n** + +Print the n last created containers (all states) + +#### **--latest**, **-l** + +Show the latest container created (all states) (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +#### **--namespace**, **--ns** + +Display namespace information + +#### **--no-trunc** + +Do not truncate the output (default *false*). + +#### **--noheading** + +Omit the table headings from the listing of containers. + +#### **--pod**, **-p** + +Display the pods the containers are associated with + +#### **--quiet**, **-q** + +Print the numeric IDs of the containers only + +#### **--size**, **-s** + +Display the total file size + +#### **--sort**=*created* + +Sort by command, created, id, image, names, runningfor, size, or status", +Note: Choosing size sorts by size of rootFs, not alphabetically like the rest of the options + +#### **--sync** + +Force a sync of container state with the OCI runtime. +In some cases, a container's state in the runtime can become out of sync with Podman's state. +This updates Podman's state based on what the OCI runtime reports. +Forcibly syncing is much slower, but can resolve inconsistent state issues. + +#### **--watch**, **-w** + +Refresh the output with current containers on an interval in seconds. + +## EXAMPLES + +List running containers. +``` +$ podman ps +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +4089df24d4f3 docker.io/library/centos:latest /bin/bash 2 minutes ago Up 2 minutes 0.0.0.0:80->8080/tcp, 0.0.0.0:2000-2006->2000-2006/tcp manyports +92f58933c28c docker.io/library/centos:latest /bin/bash 3 minutes ago Up 3 minutes 192.168.99.100:1000-1006->1000-1006/tcp zen_sanderson +``` + +List all containers. +``` +$ podman ps -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +02f65160e14ca redis:alpine "redis-server" 19 hours ago Exited (-1) 19 hours ago 6379/tcp k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0 +69ed779d8ef9f redis:alpine "redis-server" 25 hours ago Created 6379/tcp k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 +``` + +List all containers including their size. Note: this can take longer since Podman needs to calculate the size from the file system. +``` +$ podman ps -a -s +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES SIZE +02f65160e14ca redis:alpine "redis-server" 20 hours ago Exited (-1) 20 hours ago 6379/tcp k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0 27.49 MB +69ed779d8ef9f redis:alpine "redis-server" 25 hours ago Created 6379/tcp k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 27.49 MB +``` + +List all containers, running or not, using a custom Go format. +``` +$ podman ps -a --format "{{.ID}} {{.Image}} {{.Labels}} {{.Mounts}}" +02f65160e14ca redis:alpine tier=backend proc,tmpfs,devpts,shm,mqueue,sysfs,cgroup,/var/run/,/var/run/ +69ed779d8ef9f redis:alpine batch=no,type=small proc,tmpfs,devpts,shm,mqueue,sysfs,cgroup,/var/run/,/var/run/ +``` + +List all containers and display their namespaces. +``` +$ podman ps --ns -a +CONTAINER ID NAMES PID CGROUP IPC MNT NET PIDNS USER UTS +3557d882a82e3 k8s_container2_podsandbox1_redhat.test.crio_redhat-test-crio_1 29910 4026531835 4026532585 4026532593 4026532508 4026532595 4026531837 4026532594 +09564cdae0bec k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 29851 4026531835 4026532585 4026532590 4026532508 4026532592 4026531837 4026532591 +a31ebbee9cee7 k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0 29717 4026531835 4026532585 4026532587 4026532508 4026532589 4026531837 4026532588 +``` + +List all containers including size sorted by names. +``` +$ podman ps -a --size --sort names +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +69ed779d8ef9f redis:alpine "redis-server" 25 hours ago Created 6379/tcp k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 +02f65160e14ca redis:alpine "redis-server" 19 hours ago Exited (-1) 19 hours ago 6379/tcp k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0 +``` + +List all external containers created by tools other than Podman. +``` +$ podman ps --external -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +69ed779d8ef9f redis:alpine "redis-server" 25 hours ago Created 6379/tcp k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 +38a8a78596f9 docker.io/library/busybox:latest buildah 2 hours ago storage busybox-working-container +fd7b786b5c32 docker.io/library/alpine\:latest buildah 2 hours ago storage alpine-working-container +f78620804e00 scratch buildah 2 hours ago storage working-container +``` + +## ps +Print a list of containers + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **[crio(8)](https://github.com/cri-o/cri-o/blob/main/docs/crio.8.md)** + +## HISTORY +August 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-pull.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-pull.1.md new file mode 100644 index 000000000..f5c56ca3a --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-pull.1.md @@ -0,0 +1,327 @@ +--- +title: podman-pull +version: v5.5.1 +--- + +% podman-pull 1 + +## NAME +podman\-pull - Pull an image from a registry + +## SYNOPSIS +**podman pull** [*options*] *source* [*source*...] + +**podman image pull** [*options*] *source* [*source*...] + +**podman pull** [*options*] [*transport*]*name*[:*tag*|@*digest*] + +**podman image pull** [*options*] [*transport*]*name*[:*tag*|@*digest*] + +## DESCRIPTION +podman pull copies an image from a registry onto the local machine. The command can pull one or more images. If the image reference in the command line argument does not contain a registry, it is referred to as a `short-name` reference. If the image is a 'short-name' reference, Podman prompts the user for the specific container registry to pull the image from, if an alias for the short-name has not been specified in the `short-name-aliases.conf`. If an image tag is not specified, **podman pull** defaults to the image with the **latest** tag (if it exists) and pulls it. After the image is pulled, podman prints the full image ID. **podman pull** can also pull images using a digest **podman pull** *image*@*digest* and can also be used to pull images from archives and local storage using different transports. +*IMPORTANT: Images are stored in local image storage.* + +## SOURCE +SOURCE is the location from which the container image is pulled from. It supports all transports from **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)**. If no transport is specified, the input is subject to short-name resolution and the `docker` (i.e., container registry) transport is used. For remote clients, including Mac and Windows (excluding WSL2) machines, `docker` is the only supported transport. + +``` +# Pull from a container registry +$ podman pull quay.io/username/myimage + +# Pull from a container registry with short-name resolution +$ podman pull fedora + +# Pull from a container registry via the docker transport +$ podman pull docker://quay.io/username/myimage + +# Pull from a local directory +$ podman pull dir:/tmp/myimage + +# Pull from a tarball in the docker-archive format +$ podman pull docker-archive:/tmp/myimage + +# Pull from a local docker daemon +$ sudo podman pull docker-daemon\:docker.io/library/myimage:33 + +# Pull from a tarball in the OCI-archive format +$ podman pull oci-archive:/tmp/myimage +``` + +## OPTIONS +#### **--all-tags**, **-a** + +All tagged images in the repository are pulled. + +*IMPORTANT: When using the all-tags flag, Podman does not iterate over the search registries in the **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** but always uses docker.io for unqualified image names.* + + +[//]: # (BEGIN included file options/arch.md) +#### **--arch**=*ARCH* +Override the architecture, defaults to hosts, of the image to be pulled. For example, `arm`. +Unless overridden, subsequent lookups of the same image in the local storage matches this architecture, regardless of the host. + +[//]: # (END included file options/arch.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + +#### **--help**, **-h** + +Print the usage statement. + + +[//]: # (BEGIN included file options/os.pull.md) +#### **--os**=*OS* + +Override the OS, defaults to hosts, of the image to be pulled. For example, `windows`. +Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. + +[//]: # (END included file options/os.pull.md) + + +[//]: # (BEGIN included file options/platform.md) +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with --arch and --os) +The `--platform` option can be used to override the current architecture and operating system. +Unless overridden, subsequent lookups of the same image in the local storage matches this platform, regardless of the host. + +[//]: # (END included file options/platform.md) + +#### **--quiet**, **-q** + +Suppress output information when pulling images + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/variant.container.md) +#### **--variant**=*VARIANT* + +Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. + +[//]: # (END included file options/variant.container.md) + +## FILES + +**short-name-aliases.conf** (`/var/cache/containers/short-name-aliases.conf`, `$HOME/.cache/containers/short-name-aliases.conf`) + +When users specify images that do not include the container registry where the +image is stored, this is called a short name. The use of unqualified-search registries entails an ambiguity as it is unclear from which registry a given image, referenced by a short name, may be pulled from. + +Using short names is subject to the risk of hitting squatted registry namespaces. If the unqualified-search registries are set to ["public-registry.com", "my-private-registry.com"] an attacker may take over a namespace of `public-registry.com` such that an image may be pulled from `public-registry.com` instead of the intended source `my-private-registry.com`. + +While it is highly recommended to always use fully-qualified image references, existing deployments using short names may not be easily changed. To circumvent the aforementioned ambiguity, so called short-name aliases can be configured that point to a fully-qualified image reference. Distributions often ship a default shortnames.conf expansion file in /etc/containers/registries.conf.d/ directory. Administrators can use this directory to add their own local short-name expansion files. + +When pulling an image, if the user does not specify the complete registry, container engines attempt to expand the short-name into a full name. If the command is executed with a tty, the user is prompted to select a registry from the +default list unqualified registries defined in registries.conf. The user's selection is then stored in a cache file to be used in all future short-name expansions. Rootful short-names are stored in /var/cache/containers/short-name-aliases.conf. Rootless short-names are stored in the $HOME/.cache/containers/short-name-aliases.conf file. + +For more information on short-names, see `containers-registries.conf(5)` + +**registries.conf** (`/etc/containers/registries.conf`) + +registries.conf is the configuration file which specifies which container registries is consulted when completing image names which do not include a registry or domain portion. + +NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + + +## EXAMPLES +Pull a single image with short name resolution. +``` +$ podman pull alpine:latest +Resolved "alpine" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf) +Trying to pull docker.io/library/alpine:latest... +Getting image source signatures +Copying blob 5843afab3874 done +Copying config d4ff818577 done +Writing manifest to image destination +Storing signatures +d4ff818577bc193b309b355b02ebc9220427090057b54a59e73b79bdfe139b83 +``` + +Pull multiple images with/without short name resolution. +``` +podman pull busybox:musl alpine quay.io/libpod/cirros +Trying to pull docker.io/library/busybox:musl... +Getting image source signatures +Copying blob 0c52b060233b [--------------------------------------] 0.0b / 0.0b +Copying config 9ad2c435a8 done +Writing manifest to image destination +Storing signatures +9ad2c435a887e3f723654e09b48563de44aa3c7950246b2e9305ec85dd3422db +Trying to pull docker.io/library/alpine:latest... +Getting image source signatures +Copying blob 5843afab3874 [--------------------------------------] 0.0b / 0.0b +Copying config d4ff818577 done +Writing manifest to image destination +Storing signatures +d4ff818577bc193b309b355b02ebc9220427090057b54a59e73b79bdfe139b83 +Trying to pull quay.io/libpod/cirros:latest... +Getting image source signatures +Copying blob 8da581cc9286 done +Copying blob 856628d95d17 done +Copying blob f513001ba4ab done +Copying config 3c82e4d066 done +Writing manifest to image destination +Storing signatures +3c82e4d066cf6f9e50efaead6e3ff7fddddf5527826afd68e5a969579fc4db4a +``` + +Pull an image using its digest. +``` +$ podman pull alpine@sha256:d7342993700f8cd7aba8496c2d0e57be0666e80b4c441925fc6f9361fa81d10e +Trying to pull docker.io/library/alpine@sha256:d7342993700f8cd7aba8496c2d0e57be0666e80b4c441925fc6f9361fa81d10e... +Getting image source signatures +Copying blob 188c0c94c7c5 done +Copying config d6e46aa247 done +Writing manifest to image destination +Storing signatures +d6e46aa2470df1d32034c6707c8041158b652f38d2a9ae3d7ad7e7532d22ebe0 +``` + +Pull an image by specifying an authentication file. +``` +$ podman pull --authfile temp-auths/myauths.json docker://docker.io/umohnani/finaltest +Trying to pull docker.io/umohnani/finaltest:latest...Getting image source signatures +Copying blob sha256:6d987f6f42797d81a318c40d442369ba3dc124883a0964d40b0c8f4f7561d913 + 1.90 MB / 1.90 MB [========================================================] 0s +Copying config sha256:ad4686094d8f0186ec8249fc4917b71faa2c1030d7b5a025c29f26e19d95c156 + 1.41 KB / 1.41 KB [========================================================] 0s +Writing manifest to image destination +Storing signatures +03290064078cb797f3e0a530e78c20c13dd22a3dd3adf84a5da2127b48df0438 +``` + +Pull an image by authenticating to a registry. +``` +$ podman pull --creds testuser:testpassword docker.io/umohnani/finaltest +Trying to pull docker.io/umohnani/finaltest:latest...Getting image source signatures +Copying blob sha256:6d987f6f42797d81a318c40d442369ba3dc124883a0964d40b0c8f4f7561d913 + 1.90 MB / 1.90 MB [========================================================] 0s +Copying config sha256:ad4686094d8f0186ec8249fc4917b71faa2c1030d7b5a025c29f26e19d95c156 + 1.41 KB / 1.41 KB [========================================================] 0s +Writing manifest to image destination +Storing signatures +03290064078cb797f3e0a530e78c20c13dd22a3dd3adf84a5da2127b48df0438 +``` + +Pull an image using tls verification. +``` +$ podman pull --tls-verify=false --cert-dir image/certs docker.io/umohnani/finaltest +Trying to pull docker.io/umohnani/finaltest:latest...Getting image source signatures +Copying blob sha256:6d987f6f42797d81a318c40d442369ba3dc124883a0964d40b0c8f4f7561d913 + 1.90 MB / 1.90 MB [========================================================] 0s +Copying config sha256:ad4686094d8f0186ec8249fc4917b71faa2c1030d7b5a025c29f26e19d95c156 + 1.41 KB / 1.41 KB [========================================================] 0s +Writing manifest to image destination +Storing signatures +03290064078cb797f3e0a530e78c20c13dd22a3dd3adf84a5da2127b48df0438 +``` + +Pull an image by overriding the host architecture. +``` +$ podman pull --arch=arm arm32v7/debian:stretch +Trying to pull docker.io/arm32v7/debian\:stretch... +Getting image source signatures +Copying blob b531ae4a3925 done +Copying config 3cba58dad5 done +Writing manifest to image destination +Storing signatures +3cba58dad5d9b35e755b48b634acb3fdd185ab1c996ac11510cc72c17780e13c +``` + +Pull an image with up to 6 retries, delaying 10 seconds between retries in quet mode. +``` +$ podman --remote pull -q --retry 6 --retry-delay 10s ubi9 +4d6addf62a90e392ff6d3f470259eb5667eab5b9a8e03d20b41d0ab910f92170 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-push(1)](podman-push.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-push.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-push.1.md new file mode 100644 index 000000000..388ae256c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-push.1.md @@ -0,0 +1,276 @@ +--- +title: podman-push +version: v5.5.1 +--- + +% podman-push 1 + +## NAME +podman\-push - Push an image, manifest list or image index from local storage to elsewhere + +## SYNOPSIS +**podman push** [*options*] *image* [*destination*] + +**podman image push** [*options*] *image* [*destination*] + +## DESCRIPTION +Pushes an image, manifest list or image index from local storage to a specified +destination. + +## Image storage +Images are pushed from those stored in local image storage. + +## DESTINATION + + DESTINATION is the location the container image is pushed to. It supports all transports from `containers-transports(5)`. If no transport is specified, the `docker` (i.e., container registry) transport is used. For remote clients, including Mac and Windows (excluding WSL2) machines, `docker` is the only supported transport. + +``` +# Push to a container registry +$ podman push quay.io/podman/stable + +# Push to a container registry via the docker transport +$ podman push docker://quay.io/podman/stable + +# Push to a container registry with another tag +$ podman push myimage quay.io/username/myimage + +# Push to a local directory +$ podman push myimage dir:/tmp/myimage + +# Push to a tarball in the docker-archive format +$ podman push myimage docker-archive:/tmp/myimage + +# Push to a local docker daemon +$ sudo podman push myimage docker-daemon\:docker.io/library/myimage:33 + +# Push to a tarball in the OCI format +$ podman push myimage oci-archive:/tmp/myimage +``` + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/dir-compress.md) +#### **--compress** + +Compress tarball image layers when pushing to a directory using the 'dir' transport. (default is same compression type, compressed or uncompressed, as source) + +[//]: # (END included file options/dir-compress.md) + +Note: This flag can only be set when using the **dir** transport + + +[//]: # (BEGIN included file options/compression-format.md) +#### **--compression-format**=**gzip** | *zstd* | *zstd:chunked* + +Specifies the compression format to use. Supported values are: `gzip`, `zstd` and `zstd:chunked`. The default is `gzip` unless overridden in the containers.conf file. +`zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning in that case. + +[//]: # (END included file options/compression-format.md) + + +[//]: # (BEGIN included file options/compression-level.md) +#### **--compression-level**=*level* + +Specifies the compression level to use. The value is specific to the compression algorithm used, e.g. for zstd the accepted values are in the range 1-20 (inclusive) with a default of 3, while for gzip it is 1-9 (inclusive) and has a default of 5. + +[//]: # (END included file options/compression-level.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/digestfile.md) +#### **--digestfile**=*Digestfile* + +After copying the image, write the digest of the resulting image to the file. + +[//]: # (END included file options/digestfile.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + +#### **--encrypt-layer**=*layer(s)* + +Layer(s) to encrypt: 0-indexed layer indices with support for negative indexing (e.g. 0 is the first layer, -1 is the last layer). If not defined, encrypts all layers if encryption-key flag is specified. + +#### **--encryption-key**=*key* + +The [protocol\:keyfile] specifies the encryption protocol, which can be JWE (RFC7516), PGP (RFC4880), and PKCS7 (RFC2315) and the key material required for image encryption. For instance, jwe:/path/to/key.pem or pgp\:admin@example.com or pkcs7:/path/to/x509-file. + + +[//]: # (BEGIN included file options/force-compression.md) +#### **--force-compression** + +If set, push uses the specified compression algorithm even if the destination contains a differently-compressed variant already. +Defaults to `true` if `--compression-format` is explicitly specified on the command-line, `false` otherwise. + +[//]: # (END included file options/force-compression.md) + +#### **--format**, **-f**=*format* + +Manifest Type (oci, v2s2, or v2s1) to use when pushing an image. + +#### **--quiet**, **-q** + +When writing the output image, suppress progress output + +#### **--remove-signatures** + +Discard any pre-existing signatures in the image. + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + +#### **--sign-by**=*key* + +Add a “simple signing” signature at the destination using the specified key. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-by-sigstore.md) +#### **--sign-by-sigstore**=*param-file* + +Add a sigstore signature based on further options specified in a container's sigstore signing parameter file *param-file*. +See containers-sigstore-signing-params.yaml(5) for details about the file format. + +[//]: # (END included file options/sign-by-sigstore.md) + +#### **--sign-by-sigstore-private-key**=*path* + +Add a sigstore signature at the destination using a private key at the specified path. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-passphrase-file.md) +#### **--sign-passphrase-file**=*path* + +If signing the image (using either **--sign-by** or **--sign-by-sigstore-private-key**), read the passphrase to use from the specified path. + +[//]: # (END included file options/sign-passphrase-file.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLE + +Push the specified image to a local directory: +``` +# podman push imageID dir:/path/to/image +``` + +Push the specified image to a local directory in OCI format: +``` +# podman push imageID oci-archive:/path/to/layout:image:tag +``` + +Push the specified image to a container registry: +``` +# podman push imageID docker://registry.example.com/repository:tag +``` + +Push the specified image to a container registry and save the digest in the specified file: +``` +# podman push --digestfile=/tmp/mydigest imageID docker://registry.example.com/repository:tag +``` + +Push the specified image into the local Docker daemon container store: +``` +# podman push imageID docker-daemon:image:tag +``` + +Push the specified image with a different image name using credentials from an alternate authfile path: +``` +# podman push --authfile temp-auths/myauths.json alpine docker://docker.io/umohnani/alpine +Getting image source signatures +Copying blob sha256:5bef08742407efd622d243692b79ba0055383bbce12900324f75e56f589aedb0 + 4.03 MB / 4.03 MB [========================================================] 1s +Copying config sha256:ad4686094d8f0186ec8249fc4917b71faa2c1030d7b5a025c29f26e19d95c156 + 1.41 KB / 1.41 KB [========================================================] 1s +Writing manifest to image destination +Storing signatures +``` + +Push the specified image to a local directory as an OCI image: +``` +# podman push --format oci registry.access.redhat.com/rhel7 dir\:rhel7-dir +Getting image source signatures +Copying blob sha256:9cadd93b16ff2a0c51ac967ea2abfadfac50cfa3af8b5bf983d89b8f8647f3e4 + 71.41 MB / 71.41 MB [======================================================] 9s +Copying blob sha256:4aa565ad8b7a87248163ce7dba1dd3894821aac97e846b932ff6b8ef9a8a508a + 1.21 KB / 1.21 KB [========================================================] 0s +Copying config sha256\:f1b09a81455c351eaa484b61aacd048ab613c08e4c5d1da80c4c46301b03cf3b + 3.01 KB / 3.01 KB [========================================================] 0s +Writing manifest to image destination +Storing signatures +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pull(1)](podman-pull.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-remote.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-remote.1.md new file mode 100644 index 000000000..0859eb5a1 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-remote.1.md @@ -0,0 +1,206 @@ +--- +title: podman-remote +version: v5.5.1 +--- + +% podman-remote 1 + +## NAME +podman-remote - A remote CLI for Podman: A Simple management tool for pods, containers and images. + +## SYNOPSIS +**podman-remote** [*options*] *command* + +## DESCRIPTION +Podman (Pod Manager) is a fully featured container engine that is a simple daemonless tool. +Podman provides a Docker-CLI comparable command line that eases the transition from other +container engines and allows the management of pods, containers and images. Simply put: `alias docker=podman`. +Most Podman commands can be run as a regular user, without requiring additional +privileges. + +Podman uses Buildah(1) internally to create container images. Both tools share image +(not container) storage, hence each can use or manipulate images (but not containers) +created by the other. + +Podman-remote provides a local client interacting with a Podman backend node through a RESTful API tunneled through a ssh connection. In this context, a Podman node is a Linux system with Podman installed on it and the API service activated. Credentials for this session can be passed in using flags, environment variables, or in `containers.conf`. + +The `containers.conf` file is placed under `$HOME/.config/containers/containers.conf` on Linux and Mac and `%APPDATA%\containers\containers.conf` on Windows. + +**podman [GLOBAL OPTIONS]** + +## GLOBAL OPTIONS + +#### **--connection**=*name*, **-c** + +Remote connection name + +Overrides environment variable `CONTAINER_CONNECTION` if set. + +#### **--help**, **-h** + +Print usage statement + +#### **--identity**=*path* + +Path to ssh identity file. If the identity file has been encrypted, Podman prompts the user for the passphrase. +If no identity file is provided and no user is given, Podman defaults to the user running the podman command. +Podman prompts for the login password on the remote server. + +Identity value resolution precedence: + - command line value + - environment variable `CONTAINER_SSHKEY`, if `CONTAINER_HOST` is found + - `containers.conf` + +#### **--log-level**=*level* + +Log messages above specified level: debug, info, warn, error (default), fatal or panic + +#### **--url**=*value* + +URL to access Podman service (default from `containers.conf`, rootless "unix:///run/user/$UID/podman/podman.sock" or as root "unix:///run/podman/podman.sock). + + - `CONTAINER_HOST` is of the format `://[]@][:][]` + - `CONTAINER_PROXY` is of the format `://[]@][:]` + +Details: + - `schema` is one of: + * `ssh` (default): a local unix(7) socket on the named `host` and `port`, reachable via SSH + * `tcp`: an unencrypted, unauthenticated TCP connection to the named `host` and `port`, can work with proxy if `CONTAINER_PROXY` is set + * `unix`: a local unix(7) socket at the specified `path`, or the default for the user + - `user` defaults to either `root` or the current running user (`ssh` only) + - `password` has no default (`ssh` only) + - `host` must be provided and is either the IP or name of the machine hosting the Podman service (`ssh` and `tcp`) + - `port` defaults to 22 (`ssh` and `tcp`) + - `path` defaults to either `/run/podman/podman.sock`, or `/run/user/$UID/podman/podman.sock` if running rootless (`unix`), or must be explicitly specified (`ssh`) + - `CONTAINER_PROXY`: use proxy (`socks5` or `socks5h`) to access Podman service (`tcp` only) + +URL value resolution precedence: + - command line value + - environment variable `CONTAINER_HOST` + - `engine.service_destinations` table in containers.conf, excluding the /usr/share/containers directory + - `unix:///run/podman/podman.sock` + +Remote connections use local containers.conf for default. + +Some example URL values in valid formats: + - unix:///run/podman/podman.sock + - unix:///run/user/$UID/podman/podman.sock + - ssh://notroot@localhost:22/run/user/$UID/podman/podman.sock + - ssh://root@localhost:22/run/podman/podman.sock + - tcp://localhost:34451 + - tcp://127.0.0.1:34451 + +#### **--version** + +Print the version + +## Environment Variables + +Podman can set up environment variables from env of [engine] table in containers.conf. These variables can be overridden by passing environment variables before the `podman` commands. + +#### **CONTAINERS_CONF** + +Set default locations of containers.conf file + +#### **CONTAINER_CONNECTION** + +Set default `--connection` value to access Podman service. + +#### **CONTAINER_HOST** + +Set default `--url` value to access Podman service. + +#### **CONTAINER_SSHKEY** + +Set default `--identity` path to ssh key file value used to access Podman service. + +## Exit Status + +The exit code from `podman` gives information about why the container +failed to run or why it exited. When `podman` commands exit with a non-zero code, +the exit codes follow the `chroot` standard, see below: + + **125** The error is with podman itself + + $ podman run --foo busybox; echo $? + Error: unknown flag: --foo + 125 + + **126** Executing a _contained command_ and the _command_ cannot be invoked + + $ podman run busybox /etc; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error + 126 + + **127** Executing a _contained command_ and the _command_ cannot be found + $ podman run busybox foo; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error + 127 + + **Exit code** _contained command_ exit code + + $ podman run busybox /bin/sh -c 'exit 3'; echo $? + 3 + + +## COMMANDS + +| Command | Description | +| ------------------------------------------------ | --------------------------------------------------------------------------- | +| [podman-attach(1)](podman-attach.1.md) | Attach to a running container. | +| [podman-build(1)](podman-build.1.md) | Build a container image using a Dockerfile. | +| [podman-commit(1)](podman-commit.1.md) | Create new image based on the changed container. | +| [podman-container(1)](podman-container.1.md) | Manage containers. | +| [podman-cp(1)](podman-cp.1.md) | Copy files/folders between a container and the local filesystem. | +| [podman-create(1)](podman-create.1.md) | Create a new container. | +| [podman-diff(1)](podman-diff.1.md) | Inspect changes on a container or image's filesystem. | +| [podman-events(1)](podman-events.1.md) | Monitor Podman events | +| [podman-export(1)](podman-export.1.md) | Export a container's filesystem contents as a tar archive. | +| [podman-generate(1)](podman-generate.1.md) | Generate structured data based on containers and pods. | +| [podman-healthcheck(1)](podman-healthcheck.1.md) | Manage healthchecks for containers | +| [podman-history(1)](podman-history.1.md) | Show the history of an image. | +| [podman-image(1)](podman-image.1.md) | Manage images. | +| [podman-images(1)](podman-images.1.md) | List images in local storage. | +| [podman-import(1)](podman-import.1.md) | Import a tarball and save it as a filesystem image. | +| [podman-info(1)](podman-info.1.md) | Display Podman related system information. | +| [podman-init(1)](podman-init.1.md) | Initialize a container | +| [podman-inspect(1)](podman-inspect.1.md) | Display a container or image's configuration. | +| [podman-kill(1)](podman-kill.1.md) | Kill the main process in one or more containers. | +| [podman-load(1)](podman-load.1.md) | Load an image from a container image archive into container storage. | +| [podman-logs(1)](podman-logs.1.md) | Display the logs of a container. | +| [podman-pause(1)](podman-pause.1.md) | Pause one or more containers. | +| [podman-pod(1)](podman-pod.1.md) | Management tool for groups of containers, called pods. | +| [podman-port(1)](podman-port.1.md) | List port mappings for a container. | +| [podman-ps(1)](podman-ps.1.md) | Print out information about containers. | +| [podman-pull(1)](podman-pull.1.md) | Pull an image from a registry. | +| [podman-push(1)](podman-push.1.md) | Push an image from local storage to elsewhere. | +| [podman-restart(1)](podman-restart.1.md) | Restart one or more containers. | +| [podman-rm(1)](podman-rm.1.md) | Remove one or more containers. | +| [podman-rmi(1)](podman-rmi.1.md) | Remove one or more locally stored images. | +| [podman-run(1)](podman-run.1.md) | Run a command in a new container. | +| [podman-save(1)](podman-save.1.md) | Save an image to a container archive. | +| [podman-start(1)](podman-start.1.md) | Start one or more containers. | +| [podman-stop(1)](podman-stop.1.md) | Stop one or more running containers. | +| [podman-system(1)](podman-system.1.md) | Manage podman. | +| [podman-tag(1)](podman-tag.1.md) | Add an additional name to a local image. | +| [podman-top(1)](podman-top.1.md) | Display the running processes of a container. | +| [podman-unpause(1)](podman-unpause.1.md) | Unpause one or more containers. | +| [podman-version(1)](podman-version.1.md) | Display the Podman version information. | +| [podman-volume(1)](podman-volume.1.md) | Manage Volumes. | +## FILES + +**containers.conf** (`$HOME/.config/containers/containers.conf`) + +Podman has builtin defaults for command line options. These defaults can be overridden using the containers.conf configuration files. + +Users can modify defaults by creating the `$HOME/.config/containers/containers.conf` file. Podman merges its builtin defaults with the specified fields from this file, if it exists. Fields specified in the users file override the built-in defaults. + +Podman uses builtin defaults if no containers.conf file is found. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system-service(1)](podman-system-service.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-rename.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-rename.1.md new file mode 100644 index 000000000..41ea13bd2 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-rename.1.md @@ -0,0 +1,43 @@ +--- +title: podman-rename +version: v5.5.1 +--- + +% podman-rename 1 + +## NAME +podman\-rename - Rename an existing container + +## SYNOPSIS +**podman rename** *container* *newname* + +**podman container rename** *container* *newname* + +## DESCRIPTION +Rename changes the name of an existing container. +The old name is freed, and is available for use. +This command can be run on containers in any state. +However, running containers may not fully receive the effects until they are restarted - for example, a running container may still use the old name in its logs. +At present, only containers are supported; pods and volumes cannot be renamed. + +## OPTIONS + +## EXAMPLES + +Rename container with a given name. +``` +$ podman rename oldContainer aNewName +``` + +Rename container with a given ID. +``` +$ podman rename 717716c00a6b testcontainer +``` + +Create an alias for container with a given ID. +``` +$ podman container rename 6e7514b47180 databaseCtr +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-restart.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-restart.1.md new file mode 100644 index 000000000..f6007b6e4 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-restart.1.md @@ -0,0 +1,121 @@ +--- +title: podman-restart +version: v5.5.1 +--- + +% podman-restart 1 + +## NAME +podman\-restart - Restart one or more containers + +## SYNOPSIS +**podman restart** [*options*] *container* ... + +**podman container restart** [*options*] *container* ... + +## DESCRIPTION +The restart command allows containers to be restarted using their ID or name. +Running containers are stopped and restarted. Stopped containers are started. + +## OPTIONS + +#### **--all**, **-a** + +Restart all containers regardless of their current state. + +#### **--cidfile** + +Read container ID from the specified file and restart the container. Can be specified multiple times. + +#### **--filter**, **-f**=*filter* + +Filter what containers restart. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--running** + +Restart all containers that are already in the *running* state. + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping the container. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +## EXAMPLES + +Restart the latest container. +``` +$ podman restart -l +ec588fc80b05e19d3006bf2e8aa325f0a2e2ff1f609b7afb39176ca8e3e13467 +``` + +Restart a specific container by partial container ID. +``` +$ podman restart ff6cf1 +ff6cf1e5e77e6dba1efc7f3fcdb20e8b89ad8947bc0518be1fcb2c78681f226f +``` + +Restart two containers by name with a timeout of 4 seconds. +``` +$ podman restart --time 4 test1 test2 +c3bb026838c30e5097f079fa365c9a4769d52e1017588278fa00d5c68ebc1502 +17e13a63081a995136f907024bcfe50ff532917988a152da229db9d894c5a9ec +``` + +Restart all running containers. +``` +$ podman restart --running +``` + +Restart all containers. +``` +$ podman restart --all +``` + +Restart container using ID specified in a given files. +``` +$ podman restart --cidfile /home/user/cidfile-1 +$ podman restart --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +March 2018, Originally compiled by Matt Heon diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-rm.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-rm.1.md new file mode 100644 index 000000000..415c48716 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-rm.1.md @@ -0,0 +1,163 @@ +--- +title: podman-rm +version: v5.5.1 +--- + +% podman-rm 1 + +## NAME +podman\-rm - Remove one or more containers + +## SYNOPSIS +**podman rm** [*options*] *container* + +**podman container rm** [*options*] *container* + +## DESCRIPTION +**podman rm** removes one or more containers from the host. The container name or ID can be used. This does not remove images. +Running or unusable containers are not removed without the **-f** option. + +## OPTIONS + +#### **--all**, **-a** + +Remove all containers. Can be used in conjunction with **-f** as well. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and rm the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + +Command does not fail when *file* is missing and user specified --ignore. + +#### **--depend** + +Remove selected container and recursively remove all containers that depend on it. + +#### **--filter**=*filter* + +Filter what containers remove. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + +#### **--force**, **-f** + +Force the removal of running and paused containers. Forcing a container removal also +removes containers from container storage even if the container is not known to Podman. +For example, containers that are created by different container engines like Buildah. +In addition, forcing can be used to remove unusable containers, e.g. containers +whose OCI runtime has become unavailable. + + +[//]: # (BEGIN included file options/ignore.md) +#### **--ignore**, **-i** + +Ignore errors when specified containers are not in the container store. A user +might have decided to manually remove a container which leads to a failure +during the ExecStop directive of a systemd service referencing that container. + +[//]: # (END included file options/ignore.md) +Further ignore when the specified `--cidfile` does not exist as it may have +already been removed along with the container. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping the container. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +The --force option must be specified to use the --time option. + +#### **--volumes**, **-v** + +Remove anonymous volumes associated with the container. This does not include named volumes +created with **podman volume create**, or the **--volume** option of **podman run** and **podman create**. + +## EXAMPLE +Remove container with a given name: +``` +$ podman rm mywebserver +``` + +Remove container with a given name and all of the containers that depend on it: +``` +$ podman rm --depend mywebserver +``` + +Remove multiple containers with given names or IDs: +``` +$ podman rm mywebserver myflaskserver 860a4b23 +``` + +Remove multiple containers with IDs read from files: +``` +$ podman rm --cidfile ./cidfile-1 --cidfile /home/user/cidfile-2 +``` + +Forcibly remove container with a given ID: +``` +$ podman rm -f 860a4b23 +``` + +Remove all containers regardless of the run state: +``` +$ podman rm -f -a +``` + +Forcibly remove the last created container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +$ podman rm -f --latest +``` + +## Exit Status + **0** All specified containers removed + + **1** One of the specified containers did not exist, and no other failures + + **2** One of the specified containers is paused or running + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +August 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-rmi.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-rmi.1.md new file mode 100644 index 000000000..17c2a890e --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-rmi.1.md @@ -0,0 +1,81 @@ +--- +title: podman-rmi +version: v5.5.1 +--- + +% podman-rmi 1 + +## NAME +podman\-rmi - Remove one or more locally stored images + +## SYNOPSIS +**podman rmi** [*options*] *image* [...] + +**podman image rm** [*options*] *image* [...] + +## DESCRIPTION +Removes one or more locally stored images. +Passing an argument _image_ deletes it, along with any of its dangling parent images. A dangling image is an image without a tag and without being referenced by another image. + +Note: To delete an image from a remote registry, use the [**skopeo delete**](https://github.com/containers/skopeo/blob/main/docs/skopeo-delete.1.md) command. Some registries do not allow users to delete an image via a CLI remotely. + +## OPTIONS + +#### **--all**, **-a** + +Remove all images in the local storage. + +#### **--force**, **-f** + +This option causes Podman to remove all containers that are using the image before removing the image from the system. + +#### **--ignore**, **-i** + +If a specified image does not exist in the local storage, ignore it and do not throw an error. + +#### **--no-prune** + +This option does not remove dangling parents of the specified image. + +Remove an image by its short ID +``` +$ podman rmi c0ed59d05ff7 +``` +Remove an image and its associated containers. +``` +$ podman rmi --force imageID +``` + +Remove multiple images by their shortened IDs. +``` +$ podman rmi c4dfb1609ee2 93fd78260bd1 c0ed59d05ff7 +``` + +Remove all images and containers. +``` +$ podman rmi -a -f +``` + +Remove an absent image with and without the `--ignore` flag. +``` +$ podman rmi --ignore nothing +$ podman rmi nothing +Error: nothing: image not known + +``` + + +## Exit Status + **0** All specified images removed + + **1** One of the specified images did not exist, and no other failures + + **2** One of the specified images has child images or is being used by a container + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[skopeo-delete(1)](https://github.com/containers/skopeo/blob/main/docs/skopeo-delete.1.md)** + +## HISTORY +March 2017, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-rootless.7.md b/versioned_docs/version-5.5.1/source/markdown/podman-rootless.7.md new file mode 100644 index 000000000..15d67665f --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-rootless.7.md @@ -0,0 +1,54 @@ +--- +title: Shortcomings of Rootless Podman +version: v5.5.1 +--- + +% podman-rootless 7 + +# Shortcomings of Rootless Podman + +The following list categorizes the known issues and irregularities with running Podman as a non-root user. Although currently functional, there is still a number of work items that are under consideration to be added. These proposed changes are in varying degrees of design and development. + +Contributors are more than welcomed to help with this work. If you decide to carve off a piece and work on it, please create an issue in [GitHub](https://github.com/containers/podman/issues), and assign it to yourself. If you find other unexpected behavior with rootless Podman and feel it’s warranted, please feel free to update this document. + +* Podman can not create containers that bind to ports < 1024. + * The kernel does not allow processes without CAP_NET_BIND_SERVICE to bind to low ports. + * You can modify the `net.ipv4.ip_unprivileged_port_start` sysctl to change the lowest port. For example `sysctl net.ipv4.ip_unprivileged_port_start=443` allows rootless Podman containers to bind to ports >= 443. + * A proxy server, kernel firewall rule, or redirection tool such as [redir](https://github.com/troglobit/redir) may be used to redirect traffic from a privileged port to an unprivileged one (where a podman pod is bound) in a server scenario - where a user has access to the root account (or setuid on the binary would be an acceptable risk), but wants to run the containers as an unprivileged user for enhanced security and for a limited number of pre-known ports. +* As of Podman 5.0, pasta is the default networking tool. Since pasta copies the IP address of the main interface, connections to that IP from containers do not work. This means that unless you have more than one interface, inter-container connections cannot be made without explicitly passing a pasta network configuration, either in `containers.conf` or at runtime. + * If you previously had port forwards (ex. via -p 80:80) that other containers could access, you can either revert back to slirp4netns or use the solution (setting pasta options with 10.0.2.x IPs) posted [here](https://blog.podman.io/2024/03/podman-5-0-breaking-changes-in-detail/). +* “How To” documentation is patchy at best. +* If /etc/subuid and /etc/subgid are not set up for a user, then podman commands +can easily fail + * This can be a big issue on machines using Network Based Password information (FreeIPA, Active Directory, LDAP) + * We are working to get support for NSSWITCH on the /etc/subuid and /etc/subgid files. +* No cgroup V1 Support + * cgroup V1 does not safely support cgroup delegation. + * As of Fedora 31 defaults to cgroup V2, which has full support of rootless cgroup management. Note this requires the --cgroup-manager within rootless containers to use systemd, which new containers will get by default. +* Some system unit configuration options do not work in the rootless container + * systemd fails to apply several options and failures are silently ignored (e.g. CPUShares, MemoryLimit). Should work on cgroup V2. + * Use of certain options will cause service startup failures (e.g. PrivateNetwork). The systemd services requiring `PrivateNetwork` can be made to work by passing `--cap-add SYS_ADMIN`, but the security implications should be carefully evaluated. In most cases, it's better to create an override.conf drop-in that sets `PrivateNetwork=no`. This also applies to containers run by root. +* Can not share container images with CRI-O or other rootful users +* Difficult to use additional stores for sharing content +* Does not work on NFS or parallel filesystem homedirs (e.g. [GPFS](https://www.ibm.com/support/knowledgecenter/en/SSFKCN/gpfs_welcome.html)) + * NFS and parallel filesystems enforce file creation on different UIDs on the server side and does not understand User Namespace. + * When a container root process like YUM attempts to create a file owned by a different UID, NFS Server/GPFS denies the creation. +* Does not work with homedirs mounted with noexec/nodev + * User can set up storage to point to other directories they can write to that are not mounted noexec/nodev +* Support for using native overlayfs as an unprivileged user is only available for Podman version >= 3.1 on a Linux kernel version >= 5.12, otherwise the slower _fuse-overlayfs_ may be used. + * A few Linux distributions (e.g. Ubuntu) have supported even older Podman and Linux kernel versions by modifying the normal Linux kernel behaviour. +* Only other supported driver is VFS. +* Cannot use ping out of the box. + * [(Can be fixed by setting sysctl on host)](https://github.com/containers/podman/blob/main/troubleshooting.md#5-rootless-containers-cannot-ping-hosts) +* Requires new shadow-utils (not found in older (RHEL7/Centos7 distros) Should be fixed in RHEL7.7 release) +* A few commands do not work. + * mount/unmount (on fuse-overlay) + * Only works if you enter the mount namespace with podman unshare + * podman stats (Works with cgroup V2 support) + * Checkpoint and Restore (CRIU requires root) + * Pause and Unpause (Works with cgroup V2 support) +* Issues with higher UIDs can cause builds to fail + * If a build is attempting to use a UID that is not mapped into the user namespace mapping for a container, then builds will not be able to put the UID in an image. +* Making device nodes within a container fails, even when running --privileged. + * The kernel does not allow non root user processes (processes without CAP_MKNOD) to create device nodes. If a container needs to create device nodes, it must be run as root. +* When using --net=host with rootless containers, subsequent podman execs to that container will not join the host network namespace because it is owned by root. diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-run.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-run.1.md new file mode 100644 index 000000000..54653583c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-run.1.md @@ -0,0 +1,3314 @@ +--- +title: podman-run +version: v5.5.1 +--- + +% podman-run 1 + +## NAME +podman\-run - Run a command in a new container + +## SYNOPSIS +**podman run** [*options*] *image* [*command* [*arg* ...]] + +**podman container run** [*options*] *image* [*command* [*arg* ...]] + +## DESCRIPTION + +Run a process in a new container. **podman run** starts a process with its own +file system, its own networking, and its own isolated process tree. The _image_ +which starts the process may define defaults related to the process that will be +run in the container, the networking to expose, and more, but **podman run** +gives final control to the operator or administrator who starts the container +from the image. For that reason **podman run** has more options than any other +Podman command. + +If the _image_ is not already loaded then **podman run** will pull the _image_, and +all image dependencies, from the repository in the same way running **podman +pull** _image_, before it starts the container from that image. + +Several files will be automatically created within the container. These include +_/etc/hosts_, _/etc/hostname_, and _/etc/resolv.conf_ to manage networking. +These will be based on the host's version of the files, though they can be +customized with options (for example, **--dns** will override the host's DNS +servers in the created _resolv.conf_). Additionally, a container environment +file is created in each container to indicate to programs they are running in a +container. This file is located at _/run/.containerenv_ (or +_/var/run/.containerenv_ for FreeBSD containers). When using the +--privileged flag the .containerenv contains name/value pairs indicating the +container engine version, whether the engine is running in rootless mode, the +container name and ID, as well as the image name and ID that the container is based on. Note: _/run/.containerenv_ will not be created when a volume is mounted on /run. + +When running from a user defined network namespace, the _/etc/netns/NSNAME/resolv.conf_ +will be used if it exists, otherwise _/etc/resolv.conf_ will be used. + +Default settings are defined in `containers.conf`. Most settings for remote +connections use the servers containers.conf, except when documented in man +pages. + +## IMAGE + + The image is specified using transport\:path format. If no transport is specified, the `docker` (container registry) +transport is used by default. For remote Podman, including Mac and Windows (excluding WSL2) machines, `docker` is the only allowed transport. + + **dir:**_path_ + An existing local directory _path_ storing the manifest, layer tarballs and signatures as individual files. This +is a non-standardized format, primarily useful for debugging or noninvasive container inspection. + + $ podman save --format docker-dir fedora -o /tmp/fedora + $ podman run dir:/tmp/fedora echo hello + + **docker://**_docker-reference_ (Default) + An image reference stored in a remote container image registry. Example: "quay.io/podman/stable:latest". +The reference can include a path to a specific registry; if it does not, the +registries listed in registries.conf are queried to find a matching image. +By default, credentials from `podman login` (stored at +$XDG_RUNTIME_DIR/containers/auth.json by default) are used to authenticate; +otherwise it falls back to using credentials in $HOME/.docker/config.json. + + $ podman run registry.fedoraproject.org/fedora\:latest echo hello + + **docker-archive:**_path_[**:**_docker-reference_] +An image stored in the `docker save` formatted file. _docker-reference_ is only used when creating such a +file, and it must not contain a digest. + + $ podman save --format docker-archive fedora -o /tmp/fedora + $ podman run docker-archive:/tmp/fedora echo hello + + **docker-daemon:**_docker-reference_ + An image in _docker-reference_ format stored in the docker daemon internal storage. The _docker-reference_ can also be an image ID (docker-daemon\:algo\:digest). + + $ sudo docker pull fedora + $ sudo podman run docker-daemon\:docker.io/library/fedora echo hello + + **oci-archive:**_path_**:**_tag_ + An image in a directory compliant with the "Open Container Image Layout Specification" at the specified _path_ +and specified with a _tag_. + + $ podman save --format oci-archive fedora -o /tmp/fedora + $ podman run oci-archive:/tmp/fedora echo hello + +## OPTIONS + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the container's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + + +[//]: # (BEGIN included file options/annotation.container.md) +#### **--annotation**=*key=value* + +Add an annotation to the container. This option can be set multiple times. + +[//]: # (END included file options/annotation.container.md) + + +[//]: # (BEGIN included file options/arch.md) +#### **--arch**=*ARCH* +Override the architecture, defaults to hosts, of the image to be pulled. For example, `arm`. +Unless overridden, subsequent lookups of the same image in the local storage matches this architecture, regardless of the host. + +[//]: # (END included file options/arch.md) + + +[//]: # (BEGIN included file options/attach.md) +#### **--attach**, **-a**=*stdin* | *stdout* | *stderr* + +Attach to STDIN, STDOUT or STDERR. + +In foreground mode (the default when **-d** +is not specified), **podman run** can start the process in the container +and attach the console to the process's standard input, output, and +error. It can even pretend to be a TTY (this is what most command-line +executables expect) and pass along signals. The **-a** option can be set for +each of **stdin**, **stdout**, and **stderr**. + +[//]: # (END included file options/attach.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cap-add.md) +#### **--cap-add**=*capability* + +Add Linux capabilities. + +Granting additional capabilities increases the privileges of the +processes running inside the container and potentially allow it to +break out of confinement. Capabilities like `CAP_SYS_ADMIN`, +`CAP_SYS_PTRACE`, `CAP_MKNOD` and `CAP_SYS_MODULE` are particularly +dangerous when they are not used within a user namespace. Please +refer to **user_namespaces(7)** for a more detailed explanation of the +interaction between user namespaces and capabilities. + +Before adding any capability, review its security implications and +ensure it is really necessary for the container’s functionality. See +**capabilities(7)** for more information. + +[//]: # (END included file options/cap-add.md) + + +[//]: # (BEGIN included file options/cap-drop.md) +#### **--cap-drop**=*capability* + +Drop Linux capabilities. + +[//]: # (END included file options/cap-drop.md) + + +[//]: # (BEGIN included file options/cgroup-conf.md) +#### **--cgroup-conf**=*KEY=VALUE* + +When running on cgroup v2, specify the cgroup file to write to and its value. For example **--cgroup-conf=memory.high=1073741824** sets the memory.high limit to 1GB. + +[//]: # (END included file options/cgroup-conf.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the container is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cgroupns.md) +#### **--cgroupns**=*mode* + +Set the cgroup namespace mode for the container. + +- **host**: use the host's cgroup namespace inside the container. +- **container:**_id_: join the namespace of the specified container. +- **private**: create a new cgroup namespace. +- **ns:**_path_: join the namespace at the specified path. + +If the host uses cgroups v1, the default is set to **host**. On cgroups v2, the default is **private**. + +[//]: # (END included file options/cgroupns.md) + + +[//]: # (BEGIN included file options/cgroups.md) +#### **--cgroups**=*how* + +Determines whether the container creates CGroups. + +Default is **enabled**. + +The **enabled** option creates a new cgroup under the cgroup-parent. +The **disabled** option forces the container to not create CGroups, and thus conflicts with CGroup options (**--cgroupns** and **--cgroup-parent**). +The **no-conmon** option disables a new CGroup only for the **conmon** process. +The **split** option splits the current CGroup in two sub-cgroups: one for conmon and one for the container payload. It is not possible to set **--cgroup-parent** with **split**. + +[//]: # (END included file options/cgroups.md) + + +[//]: # (BEGIN included file options/chrootdirs.md) +#### **--chrootdirs**=*path* + +Path to a directory inside the container that is treated as a `chroot` directory. +Any Podman managed file (e.g., /etc/resolv.conf, /etc/hosts, etc/hostname) that is mounted into the root directory is mounted into that location as well. +Multiple directories are separated with a comma. + +[//]: # (END included file options/chrootdirs.md) + + +[//]: # (BEGIN included file options/cidfile.write.md) +#### **--cidfile**=*file* + +Write the container ID to *file*. The file is removed along with the container, except +when used with podman --remote run on detached containers. + +[//]: # (END included file options/cidfile.write.md) + + +[//]: # (BEGIN included file options/conmon-pidfile.md) +#### **--conmon-pidfile**=*file* + +Write the pid of the **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to restart Podman containers. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/conmon-pidfile.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-rt-period.md) +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-period.md) + + +[//]: # (BEGIN included file options/cpu-rt-runtime.md) +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-runtime.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpus.container.md) +#### **--cpus**=*number* + +Number of CPUs. The default is *0.0* which means no limit. This is shorthand +for **--cpu-period** and **--cpu-quota**, therefore the option cannot be specified with +**--cpu-period** or **--cpu-quota**. + +On some systems, changing the CPU limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpus.container.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + +#### **--detach**, **-d** + +Detached mode: run the container in the background and print the new container ID. The default is *false*. + +At any time run **podman ps** in +the other shell to view a list of the running containers. Reattach to a +detached container with **podman attach** command. + +When attached via tty mode, detach from the container (and leave it +running) using a configurable key sequence. The default sequence is `ctrl-p,ctrl-q`. +Specify the key sequence using the **--detach-keys** option, or configure +it in the **containers.conf** file: see **containers.conf(5)** for more information. + + +[//]: # (BEGIN included file options/detach-keys.md) +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. + +[//]: # (END included file options/detach-keys.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the container. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The container only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: if the user only has access rights via a group, accessing the device +from inside a rootless container fails. Use the `--group-add keep-groups` +flag to pass the user's supplementary group access into the container. + + +[//]: # (BEGIN included file options/device-cgroup-rule.md) +#### **--device-cgroup-rule**=*"type major\:minor mode"* + +Add a rule to the cgroup allowed devices list. The rule is expected to be +in the format specified in the Linux kernel documentation +[admin-guide/cgroup-v1/devices](https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.html): +- *type*: `a` (all), `c` (char), or `b` (block); +- *major* and *minor*: either a number, or `*` for all; +- *mode*: a composition of `r` (read), `w` (write), and `m` (mknod(2)). + +[//]: # (END included file options/device-cgroup-rule.md) + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-read-iops.md) +#### **--device-read-iops**=*path:rate* + +Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-iops.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + + +[//]: # (BEGIN included file options/device-write-iops.md) +#### **--device-write-iops**=*path:rate* + +Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-iops.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + + +[//]: # (BEGIN included file options/dns.md) +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. + +[//]: # (END included file options/dns.md) + +This option cannot be combined with **--network** that is set to **none** or **container:**_id_. + + +[//]: # (BEGIN included file options/dns-option.container.md) +#### **--dns-option**=*option* + +Set custom DNS options. Invalid if using **--dns-option** with **--network** that is set to **none** or **container:**_id_. + +[//]: # (END included file options/dns-option.container.md) + + +[//]: # (BEGIN included file options/dns-search.container.md) +#### **--dns-search**=*domain* + +Set custom DNS search domains. Invalid if using **--dns-search** with **--network** that is set to **none** or **container:**_id_. +Use **--dns-search=.** to remove the search domain. + +[//]: # (END included file options/dns-search.container.md) + + +[//]: # (BEGIN included file options/entrypoint.md) +#### **--entrypoint**=*"command"* | *'["command", "arg1", ...]'* + +Override the default ENTRYPOINT from the image. + +The ENTRYPOINT of an image is similar to a COMMAND +because it specifies what executable to run when the container starts, but it is +(purposely) more difficult to override. The ENTRYPOINT gives a container its +default nature or behavior. When the ENTRYPOINT is set, the +container runs as if it were that binary, complete with default options. More options can be +passed in via the COMMAND. But, if a user wants to run +something else inside the container, the **--entrypoint** option allows a new +ENTRYPOINT to be specified. + +Specify multi option commands in the form of a JSON string. + +[//]: # (END included file options/entrypoint.md) + + +[//]: # (BEGIN included file options/env.md) +#### **--env**, **-e**=*env* + +Set environment variables. + +This option allows arbitrary environment variables that are available for the process to be launched inside of the container. If an environment variable is specified without a value, Podman checks the host environment for a value and set the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the container. + +[//]: # (END included file options/env.md) + +See [**Environment**](#environment) note below for precedence and examples. + + +[//]: # (BEGIN included file options/env-file.md) +#### **--env-file**=*file* + +Read in a line-delimited file of environment variables. + +[//]: # (END included file options/env-file.md) + +See [**Environment**](#environment) note below for precedence and examples. + + +[//]: # (BEGIN included file options/env-host.md) +#### **--env-host** + +Use host environment inside of the container. See **Environment** note below for precedence. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/env-host.md) + + +[//]: # (BEGIN included file options/env-merge.md) +#### **--env-merge**=*env* + +Preprocess default environment variables for the containers. For example +if image contains environment variable `hello=world` user can preprocess +it using `--env-merge hello=${hello}-some` so new value is `hello=world-some`. + +Please note that if the environment variable `hello` is not present in the image, +then it'll be replaced by an empty string and so using `--env-merge hello=${hello}-some` +would result in the new value of `hello=-some`, notice the leading `-` delimiter. + +[//]: # (END included file options/env-merge.md) + + +[//]: # (BEGIN included file options/expose.md) +#### **--expose**=*port[/protocol]* + +Expose a port or a range of ports (e.g. **--expose=3300-3310**). +The protocol can be `tcp`, `udp` or `sctp` and if not given `tcp` is assumed. +This option matches the EXPOSE instruction for image builds and has no effect on +the actual networking rules unless **-P/--publish-all** is used to forward to all +exposed ports from random host ports. To forward specific ports from the host +into the container use the **-p/--publish** option instead. + +[//]: # (END included file options/expose.md) + + +[//]: # (BEGIN included file options/gidmap.container.md) +#### **--gidmap**=*[flags]container_uid\:from_uid[\:amount]* + +Run the container in a new user namespace using the supplied GID mapping. This +option conflicts with the **--userns** and **--subgidname** options. This +option provides a way to map host GIDs to container GIDs in the same way as +__--uidmap__ maps host UIDs to container UIDs. For details see __--uidmap__. + +Note: the **--gidmap** option cannot be called in conjunction with the **--pod** option as a gidmap cannot be set on the container level when in a pod. + +[//]: # (END included file options/gidmap.container.md) + + +[//]: # (BEGIN included file options/gpus.md) +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. + +[//]: # (END included file options/gpus.md) + + +[//]: # (BEGIN included file options/group-add.md) +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/group-add.md) + + +[//]: # (BEGIN included file options/group-entry.md) +#### **--group-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/group` file within the container when `--user` is used. + +The variables $GROUPNAME, $GID, and $USERLIST are automatically replaced with their value at runtime if present. + +[//]: # (END included file options/group-entry.md) + + +[//]: # (BEGIN included file options/health-cmd.md) +#### **--health-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set or alter a healthcheck command for a container. The command is a command to be executed inside the +container that determines the container health. The command is required for other healthcheck options +to be applied. A value of **none** disables existing healthchecks. + +Multiple options can be passed in the form of a JSON array; otherwise, the command is interpreted +as an argument to **/bin/sh -c**. + +Note: The default values are used even if healthcheck is configured in the image. + +[//]: # (END included file options/health-cmd.md) + + +[//]: # (BEGIN included file options/health-interval.md) +#### **--health-interval**=*interval* + +Set an interval for the healthchecks. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-interval.md) + + +[//]: # (BEGIN included file options/health-log-destination.md) +#### **--health-log-destination**=*directory_path* + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) (Default: local) + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. + +[//]: # (END included file options/health-log-destination.md) + + +[//]: # (BEGIN included file options/health-max-log-count.md) +#### **--health-max-log-count**=*number of stored logs* + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) (Default: 5 attempts) + +[//]: # (END included file options/health-max-log-count.md) + + +[//]: # (BEGIN included file options/health-max-log-size.md) +#### **--health-max-log-size**=*size of stored logs* + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) (Default: 500 characters) + +[//]: # (END included file options/health-max-log-size.md) + + +[//]: # (BEGIN included file options/health-on-failure.md) +#### **--health-on-failure**=*action* + +Action to take once the container transitions to an unhealthy state. The default is **none**. + +- **none**: Take no action. +- **kill**: Kill the container. +- **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. +- **stop**: Stop the container. + +[//]: # (END included file options/health-on-failure.md) + + +[//]: # (BEGIN included file options/health-retries.md) +#### **--health-retries**=*retries* + +The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is **3**. + +Note: This parameter can overwrite the healthcheck configuration from the image. + +[//]: # (END included file options/health-retries.md) + + +[//]: # (BEGIN included file options/health-start-period.md) +#### **--health-start-period**=*period* + +The initialization time needed for a container to bootstrap. The value can be expressed in time format like +**2m3s**. The default value is **0s**. + +Note: The health check command is executed as soon as a container is started, if the health check is successful +the container's health state will be updated to `healthy`. However, if the health check fails, the health state will +stay as `starting` until either the health check is successful or until the `--health-start-period` time is over. If the +health check command fails after the `--health-start-period` time is over, the health state will be updated to `unhealthy`. +The health check command is executed periodically based on the value of `--health-interval`. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-start-period.md) + + +[//]: # (BEGIN included file options/health-startup-cmd.md) +#### **--health-startup-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set a startup healthcheck command for a container. This command is executed inside the container and is used to gate the regular +healthcheck. When the startup command succeeds, the regular healthcheck begins and the startup healthcheck ceases. Optionally, +if the command fails for a set number of attempts, the container is restarted. A startup healthcheck can be used to ensure that +containers with an extended startup period are not marked as unhealthy until they are fully started. Startup healthchecks can only be +used when a regular healthcheck (from the container's image or the **--health-cmd** option) is also set. + +[//]: # (END included file options/health-startup-cmd.md) + + +[//]: # (BEGIN included file options/health-startup-interval.md) +#### **--health-startup-interval**=*interval* + +Set an interval for the startup healthcheck. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-startup-interval.md) + + +[//]: # (BEGIN included file options/health-startup-retries.md) +#### **--health-startup-retries**=*retries* + +The number of attempts allowed before the startup healthcheck restarts the container. If set to **0**, the container is never restarted. The default is **0**. + +[//]: # (END included file options/health-startup-retries.md) + + +[//]: # (BEGIN included file options/health-startup-success.md) +#### **--health-startup-success**=*retries* + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value +of **0** means that any success begins the regular healthcheck. The default is **0**. + +[//]: # (END included file options/health-startup-success.md) + + +[//]: # (BEGIN included file options/health-startup-timeout.md) +#### **--health-startup-timeout**=*timeout* + +The maximum time a startup healthcheck command has to complete before it is marked as failed. The value can be expressed in a time +format like **2m3s**. The default value is **30s**. + +[//]: # (END included file options/health-startup-timeout.md) + + +[//]: # (BEGIN included file options/health-timeout.md) +#### **--health-timeout**=*timeout* + +The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the +value can be expressed in a time format such as **1m22s**. The default value is **30s**. + +Note: A timeout marks the healthcheck as failed but does not terminate the running process. +This ensures that a slow but eventually successful healthcheck does not disrupt the container +but is still accounted for in the health status. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-timeout.md) + +#### **--help** + +Print usage statement + + +[//]: # (BEGIN included file options/hostname.container.md) +#### **--hostname**, **-h**=*name* + +Set the container's hostname inside the container. + +This option can only be used with a private UTS namespace `--uts=private` +(default). If `--pod` is given and the pod shares the same UTS namespace +(default), the pod's hostname is used. The given hostname is also added to the +`/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). + +[//]: # (END included file options/hostname.container.md) + + +[//]: # (BEGIN included file options/hosts-file.md) +#### **--hosts-file**=*path* | *none* | *image* + +Base file to create the `/etc/hosts` file inside the container. This must either +be an absolute path to a file on the host system, or one of the following +special flags: + "" Follow the `base_hosts_file` configuration in _containers.conf_ (the default) + `none` Do not use a base file (i.e. start with an empty file) + `image` Use the container image's `/etc/hosts` file as base file + +[//]: # (END included file options/hosts-file.md) + + +[//]: # (BEGIN included file options/hostuser.md) +#### **--hostuser**=*name* + +Add a user account to /etc/passwd from the host to the container. The Username +or UID must exist on the host system. + +[//]: # (END included file options/hostuser.md) + + +[//]: # (BEGIN included file options/http-proxy.md) +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. + +[//]: # (END included file options/http-proxy.md) + + +[//]: # (BEGIN included file options/image-volume.md) +#### **--image-volume**=**bind** | *tmpfs* | *ignore* + +Tells Podman how to handle the builtin image volumes. Default is **bind**. + +- **bind**: An anonymous named volume is created and mounted into the container. +- **tmpfs**: The volume is mounted onto the container as a tmpfs, which allows the users to create +content that disappears when the container is stopped. +- **ignore**: All volumes are just ignored and no action is taken. + +[//]: # (END included file options/image-volume.md) + + +[//]: # (BEGIN included file options/init.md) +#### **--init** + +Run an init inside the container that forwards signals and reaps processes. +The container-init binary is mounted at `/run/podman-init`. +Mounting over `/run` breaks container execution. + +[//]: # (END included file options/init.md) + + +[//]: # (BEGIN included file options/init-path.md) +#### **--init-path**=*path* + +Path to the container-init binary. + +[//]: # (END included file options/init-path.md) + + +[//]: # (BEGIN included file options/interactive.md) +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. + +[//]: # (END included file options/interactive.md) + + +[//]: # (BEGIN included file options/ip.md) +#### **--ip**=*ipv4* + +Specify a static IPv4 address for the container, for example **10.88.64.128**. +This option can only be used if the container is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IP address pool (default **10.88.0.0/16**). + +To specify multiple static IP addresses per container, set multiple networks using the **--network** option with a static IP address specified for each using the `ip` mode for that option. + +[//]: # (END included file options/ip.md) + + +[//]: # (BEGIN included file options/ip6.md) +#### **--ip6**=*ipv6* + +Specify a static IPv6 address for the container, for example **fd46\:db93\:aa76\:ac37::10**. +This option can only be used if the container is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IPv6 address pool. + +To specify multiple static IPv6 addresses per container, set multiple networks using the **--network** option with a static IPv6 address specified for each using the `ip6` mode for that option. + +[//]: # (END included file options/ip6.md) + + +[//]: # (BEGIN included file options/ipc.md) +#### **--ipc**=*ipc* + +Set the IPC namespace mode for a container. The default is to create +a private IPC namespace. + +- "": Use Podman's default, defined in containers.conf. +- **container:**_id_: reuses another container's shared memory, semaphores, and message queues +- **host**: use the host's shared memory, semaphores, and message queues inside the container. Note: the host mode gives the container full access to local shared memory and is therefore considered insecure. +- **none**: private IPC namespace, with /dev/shm not mounted. +- **ns:**_path_: path to an IPC namespace to join. +- **private**: private IPC namespace. +- **shareable**: private IPC namespace with a possibility to share it with other containers. + +[//]: # (END included file options/ipc.md) + + +[//]: # (BEGIN included file options/label.md) +#### **--label**, **-l**=*key=value* + +Add metadata to a container. + +[//]: # (END included file options/label.md) + + +[//]: # (BEGIN included file options/label-file.md) +#### **--label-file**=*file* + +Read in a line-delimited file of labels. + +[//]: # (END included file options/label-file.md) + + +[//]: # (BEGIN included file options/link-local-ip.md) +#### **--link-local-ip**=*ip* + +Not implemented. + +[//]: # (END included file options/link-local-ip.md) + + +[//]: # (BEGIN included file options/log-driver.md) +#### **--log-driver**=*driver* + +Logging driver for the container. Currently available options are **k8s-file**, **journald**, **none**, **passthrough** and **passthrough-tty**, with **json-file** aliased to **k8s-file** for scripting compatibility. (Default **journald**). + +The podman info command below displays the default log-driver for the system. +``` +$ podman info --format '{{ .Host.LogDriver }}' +journald +``` +The **passthrough** driver passes down the standard streams (stdin, stdout, stderr) to the +container. It is not allowed with the remote Podman client, including Mac and Windows (excluding WSL2) machines, and on a tty, since it is +vulnerable to attacks via TIOCSTI. + +The **passthrough-tty** driver is the same as **passthrough** except that it also allows it to be used on a TTY if the user really wants it. + +[//]: # (END included file options/log-driver.md) + + +[//]: # (BEGIN included file options/log-opt.md) +#### **--log-opt**=*name=value* + +Logging driver specific options. + +Set custom logging configuration. The following *name*s are supported: + +**path**: specify a path to the log file + (e.g. **--log-opt path=/var/log/container/mycontainer.json**); + +**max-size**: specify a max size of the log file + (e.g. **--log-opt max-size=10mb**); + +**tag**: specify a custom log tag for the container + (e.g. **--log-opt tag="{{.ImageName}}"**. +It supports the same keys as **podman inspect --format**. +This option is currently supported only by the **journald** log driver. + +[//]: # (END included file options/log-opt.md) + + +[//]: # (BEGIN included file options/mac-address.md) +#### **--mac-address**=*address* + +Container network interface MAC address (e.g. 92\:d0\:c6:0a:29:33) +This option can only be used if the container is joined to only a single network - i.e., **--network=_network-name_** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. + +Remember that the MAC address in an Ethernet network must be unique. +The IPv6 link-local address is based on the device's MAC address +according to RFC4862. + +To specify multiple static MAC addresses per container, set multiple networks using the **--network** option with a static MAC address specified for each using the `mac` mode for that option. + +[//]: # (END included file options/mac-address.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-reservation.md) +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-reservation.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/memory-swappiness.md) +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/memory-swappiness.md) + + +[//]: # (BEGIN included file options/mount.md) +#### **--mount**=*type=TYPE,TYPE-SPECIFIC-OPTION[,...]* + +Attach a filesystem mount to the container. + +Current supported mount TYPEs are **artifact**, **bind**, **devpts**, **glob**, **image**, **ramfs**, **tmpfs** and **volume**. + +Options common to all mount types: + +- *src*, *source*: mount source spec for **bind**, **glob**, and **volume**. + Mandatory for **artifact**, **bind**, **glob**, **image** and **volume**. + +- *dst*, *destination*, *target*: mount destination spec. + +When source globs are specified without the destination directory, +the files and directories are mounted with their complete path +within the container. When the destination is specified, the +files and directories matching the glob on the base file name +on the destination directory are mounted. The option +`type=glob,src=/foo*,destination=/tmp/bar` tells container engines +to mount host files matching /foo* to the /tmp/bar/ +directory in the container. + +Options specific to type=**artifact**: + +- *digest*: If the artifact source contains multiple blobs a digest can be + specified to only mount the one specific blob with the digest. + +- *title*: If the artifact source contains multiple blobs a title can be set + which is compared against `org.opencontainers.image.title` annotation. + +The *src* argument contains the name of the artifact, which must already exist locally. +The *dst* argument contains the target path, if the path in the container is a +directory or does not exist the blob title (`org.opencontainers.image.title` +annotation) will be used as filename and joined to the path. If the annotation +does not exist the digest will be used as filename instead. This results in all blobs +of the artifact mounted into the container at the given path. + +However, if the *dst* path is an existing file in the container, then the blob will be +mounted directly on it. This only works when the artifact contains a single blob +or when either *digest* or *title* are specified. + +Options specific to type=**volume**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *idmap*: If specified, create an idmapped mount to the target user namespace in the container. + The idmap option is only supported by Podman in rootful mode. The Linux kernel does not allow the use of idmapped file systems for unprivileged users. + The idmap option supports a custom mapping that can be different than the user namespace used by the container. + The mapping can be specified after the idmap option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the first value is the + start of the backing file system IDs that are mapped to the second value on the host. The length of this mapping is given in the third value. + Multiple ranges are separated with #. If the specified mapping is prepended with a '@', then the mapping is considered relative to the container + user namespace. The host ID for the mapping is changed to account for the relative position of the container user in the container user namespace. + +Options specific to type=**image**: + +- *rw*, *readwrite*: *true* or *false* (default if unspecified: *false*). + +- *subpath*: Mount only a specific path within the image, instead of the whole image. + +Options specific to **bind** and **glob**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *bind-propagation*: *shared*, *slave*, *private*, *unbindable*, *rshared*, *rslave*, *runbindable*, or **rprivate** (default).[[1]](#Footnote1) See also mount(2). + +- *bind-nonrecursive*: do not set up a recursive bind mount. By default it is recursive. + +- *relabel*: *shared*, *private*. + +- *idmap*: *true* or *false* (default if unspecified: *false*). If true, create an idmapped mount to the target user namespace in the container. The idmap option is only supported by Podman in rootful mode. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *no-dereference*: do not dereference symlinks but copy the link source into the mount destination. + +Options specific to type=**tmpfs** and **ramfs**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *tmpfs-size*: Size of the tmpfs/ramfs mount, in bytes. Unlimited by default in Linux. + +- *tmpfs-mode*: Octal file mode of the tmpfs/ramfs (e.g. 700 or 0700.). + +- *tmpcopyup*: Enable copyup from the image directory at the same location to the tmpfs/ramfs. Used by default. + +- *notmpcopyup*: Disable copying files from the image to the tmpfs/ramfs. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +Options specific to type=**devpts**: + +- *uid*: numeric UID of the file owner (default: 0). + +- *gid*: numeric GID of the file owner (default: 0). + +- *mode*: octal permission mask for the file (default: 600). + +- *max*: maximum number of PTYs (default: 1048576). + +Examples: + +- `type=bind,source=/path/on/host,destination=/path/in/container` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared,U=true` + +- `type=devpts,destination=/dev/pts` + +- `type=glob,src=/usr/lib/libfoo*,destination=/usr/lib,ro=true` + +- `type=image,source=fedora,destination=/fedora-image,rw=true` + +- `type=ramfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,destination=/path/in/container,noswap` + +- `type=artifact,src=quay.io/libpod/testartifact:20250206-single,dst=/data` + +- `type=artifact,src=quay.io/libpod/testartifact:20250206-multi,dst=/data,title=test1` + +[//]: # (END included file options/mount.md) + + +[//]: # (BEGIN included file options/name.container.md) +#### **--name**=*name* + +Assign a name to the container. + +The operator can identify a container in three ways: + +- UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”); +- UUID short identifier (“f78375b1c487”); +- Name (“jonah”). + +Podman generates a UUID for each container, and if no name is assigned to the +container using **--name**, Podman generates a random string name. The name can +be useful as a more human-friendly way to identify containers. This works for +both background and foreground containers. The container's name is also added +to the `/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). + +[//]: # (END included file options/name.container.md) + + +[//]: # (BEGIN included file options/network.md) +#### **--network**=*mode*, **--net** + +Set the network mode for the container. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + For better integration with DNS handling, **--dns-forward 169.254.1.1** is passed, + and this address is added to resolv.conf(5) as first resolver. It is possible to pass + **--dns-forward** explicitly in case a different IP address should be used. + To make the `host.containers.internal` /etc/hosts entry work and allow connections + to the host, **--map-guest-addr 169.254.1.2** is passed. Again, it can be set + explicitly to choose a different IP address. \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured (via Podman's + **--publish** or by passing the pasta **-t**/**-u** options directly), + to disable automatic port forwarding based on bound ports. Similarly, **-T none** + and **-U none** are given to disable the same functionality from container to + host. \ + All options can also be set in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**; + see the `pasta_options` key under the network section in that file. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.md) + +Invalid if using **--dns**, **--dns-option**, or **--dns-search** with **--network** set to **none** or **container:**_id_. + +If used together with **--pod**, the container joins the pod's network namespace. + + +[//]: # (BEGIN included file options/network-alias.md) +#### **--network-alias**=*alias* + +Add a network-scoped alias for the container, setting the alias for all networks that the container joins. To set a +name only for a specific network, use the alias option as described under the **--network** option. +If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. This option can be specified multiple times. +NOTE: When using CNI a container only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. + +[//]: # (END included file options/network-alias.md) + + +[//]: # (BEGIN included file options/no-healthcheck.md) +#### **--no-healthcheck** + +Disable any defined healthchecks for container. + +[//]: # (END included file options/no-healthcheck.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the container. + +Podman assumes control over the container's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/oom-kill-disable.md) +#### **--oom-kill-disable** + +Whether to disable OOM Killer for the container or not. + +This flag is not supported on cgroups V2 systems. + +[//]: # (END included file options/oom-kill-disable.md) + + +[//]: # (BEGIN included file options/oom-score-adj.md) +#### **--oom-score-adj**=*num* + +Tune the host's OOM preferences for containers (accepts values from **-1000** to **1000**). + +When running in rootless mode, the specified value can't be lower than +the oom_score_adj for the current process. In this case, the +oom-score-adj is clamped to the current process value. + +[//]: # (END included file options/oom-score-adj.md) + + +[//]: # (BEGIN included file options/os.pull.md) +#### **--os**=*OS* + +Override the OS, defaults to hosts, of the image to be pulled. For example, `windows`. +Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. + +[//]: # (END included file options/os.pull.md) + +#### **--passwd** + +Allow Podman to add entries to /etc/passwd and /etc/group when used in conjunction with the --user option. +This is used to override the Podman provided user setup in favor of entrypoint configurations such as libnss-extrausers. + + +[//]: # (BEGIN included file options/passwd-entry.md) +#### **--passwd-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/passwd` file within the container when `--passwd` is used. + +The variables $USERNAME, $UID, $GID, $NAME, $HOME are automatically replaced with their value at runtime. + +[//]: # (END included file options/passwd-entry.md) + + +[//]: # (BEGIN included file options/personality.md) +#### **--personality**=*persona* + +Personality sets the execution domain via Linux personality(2). + +[//]: # (END included file options/personality.md) + + +[//]: # (BEGIN included file options/pid.container.md) +#### **--pid**=*mode* + +Set the PID namespace mode for the container. +The default is to create a private PID namespace for the container. + +- **container:**_id_: join another container's PID namespace; +- **host**: use the host's PID namespace for the container. Note the host mode gives the container full access to local PID and is therefore considered insecure; +- **ns:**_path_: join the specified PID namespace; +- **private**: create a new namespace for the container (default). + +[//]: # (END included file options/pid.container.md) + + +[//]: # (BEGIN included file options/pidfile.md) +#### **--pidfile**=*path* + +When the pidfile location is specified, the container process' PID is written to the pidfile. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +If the pidfile option is not specified, the container process' PID is written to /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile. + +After the container is started, the location for the pidfile can be discovered with the following `podman inspect` command: + + $ podman inspect --format '{{ .PidFile }}' $CID + /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile + +[//]: # (END included file options/pidfile.md) + + +[//]: # (BEGIN included file options/pids-limit.md) +#### **--pids-limit**=*limit* + +Tune the container's pids limit. Set to **-1** to have unlimited pids for the container. The default is **2048** on systems that support "pids" cgroup controller. + +[//]: # (END included file options/pids-limit.md) + + +[//]: # (BEGIN included file options/platform.md) +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with --arch and --os) +The `--platform` option can be used to override the current architecture and operating system. +Unless overridden, subsequent lookups of the same image in the local storage matches this platform, regardless of the host. + +[//]: # (END included file options/platform.md) + + +[//]: # (BEGIN included file options/pod.run.md) +#### **--pod**=*name* + +Run container in an existing pod. Podman makes the pod automatically if the pod name is prefixed with **new:**. +To make a pod with more granular options, use the **podman pod create** command before creating a container. +When a container is run with a pod with an infra-container, the infra-container is started first. + +[//]: # (END included file options/pod.run.md) + + +[//]: # (BEGIN included file options/pod-id-file.container.md) +#### **--pod-id-file**=*file* + +Run container in an existing pod and read the pod's ID from the specified *file*. +When a container is run within a pod which has an infra-container, the infra-container starts first. + +[//]: # (END included file options/pod-id-file.container.md) + + +[//]: # (BEGIN included file options/preserve-fd.md) +#### **--preserve-fd**=*FD1[,FD2,...]* + +Pass down to the process the additional file descriptors specified in the comma separated list. It can be specified multiple times. +This option is only supported with the crun OCI runtime. It might be a security risk to use this option with other OCI runtimes. + +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/preserve-fd.md) + + +[//]: # (BEGIN included file options/preserve-fds.md) +#### **--preserve-fds**=*N* + +Pass down to the process N additional file descriptors (in addition to 0, 1, 2). +The total FDs are 3+N. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/preserve-fds.md) + + +[//]: # (BEGIN included file options/privileged.md) +#### **--privileged** + +Give extended privileges to this container. The default is **false**. + +By default, Podman containers are unprivileged (**=false**) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read-only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. +Due to the disabled security features, the privileged field should almost never +be set as containers can easily break out of confinement. + +Containers running in a user namespace (e.g., rootless containers) cannot have +more privileges than the user that launched them. + +[//]: # (END included file options/privileged.md) + + +[//]: # (BEGIN included file options/publish.md) +#### **--publish**, **-p**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Publish a container's port, or range of ports, to the host. + +Both *hostPort* and *containerPort* can be specified as a range of ports. +When specifying ranges for both, the number of container ports in the +range must match the number of host ports in the range. + +If host IP is set to 0.0.0.0 or not set at all, the port is bound on all IPs on the host. + +By default, Podman publishes TCP ports. To publish a UDP port instead, give +`udp` as protocol. To publish both TCP and UDP ports, set `--publish` twice, +with `tcp`, and `udp` as protocols respectively. Rootful containers can also +publish ports using the `sctp` protocol. + +Host port does not have to be specified (e.g. `podman run -p 127.0.0.1::80`). +If it is not, the container port is randomly assigned a port on the host. + +Use **podman port** to see the actual mapping: `podman port $CONTAINER $CONTAINERPORT`. + +Note that the network drivers `macvlan` and `ipvlan` do not support port forwarding, +therefore this option will have no effect on such networks. + +[//]: # (END included file options/publish.md) + +**Note:** If a container runs within a pod, it is not necessary to publish the port for +the containers in the pod. The port must only be published by the pod itself. Pod network +stacks act like the network stack on the host - meaning a variety of containers in the pod +and programs in the container all share a single interface, IP address, and +associated ports. If one container binds to a port, no other container can use that port +within the pod while it is in use. Containers in the pod can also communicate over localhost +by having one container bind to localhost in the pod, and another connect to that port. + + +[//]: # (BEGIN included file options/publish-all.md) +#### **--publish-all**, **-P** + +Publish all exposed ports to random ports on the host interfaces. The default is **false**. + +When set to **true**, publish all exposed ports to the host interfaces. +If the operator uses **-P** (or **-p**) then Podman makes the +exposed port accessible on the host and the ports are available to any +client that can reach the host. + +When using this option, Podman binds any exposed port to a random port on the host +within an ephemeral port range defined by */proc/sys/net/ipv4/ip_local_port_range*. +To find the mapping between the host ports and the exposed ports, use **podman port**. + +[//]: # (END included file options/publish-all.md) + + +[//]: # (BEGIN included file options/pull.md) +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Pull the image only when the image is not in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error if no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. + +[//]: # (END included file options/pull.md) + +#### **--quiet**, **-q** + +Suppress output information when pulling images + + +[//]: # (BEGIN included file options/rdt-class.md) +#### **--rdt-class**=*intel-rdt-class-of-service* + +Rdt-class sets the class of service (CLOS or COS) for the container to run in. Based on the Cache Allocation Technology (CAT) feature that is part of Intel's Resource Director Technology (RDT) feature set, all container processes will run within the pre-configured COS, representing a part of the cache. The COS has to be created and configured using a pseudo file system (usually mounted at `/sys/fs/resctrl`) that the resctrl kernel driver provides. Assigning the container to a COS requires root privileges and thus doesn't work in a rootless environment. Currently, the feature is only supported using `runc` as a runtime. See for more details on creating a COS before a container can be assigned to it. + +[//]: # (END included file options/rdt-class.md) + + +[//]: # (BEGIN included file options/read-only.md) +#### **--read-only** + +Mount the container's root filesystem as read-only. + +By default, container root filesystems are writable, allowing processes +to write files anywhere. By specifying the **--read-only** flag, the containers root filesystem are mounted read-only prohibiting any writes. + +[//]: # (END included file options/read-only.md) + + +[//]: # (BEGIN included file options/read-only-tmpfs.md) +#### **--read-only-tmpfs** + +When running --read-only containers, mount a read-write tmpfs on _/dev_, _/dev/shm_, _/run_, _/tmp_, and _/var/tmp_. The default is **true**. + +| --read-only | --read-only-tmpfs | / | /run, /tmp, /var/tmp| +| ----------- | ----------------- | ---- | ----------------------------------- | +| true | true | r/o | r/w | +| true | false | r/o | r/o | +| false | false | r/w | r/w | +| false | true | r/w | r/w | + +When **--read-only=true** and **--read-only-tmpfs=true** additional tmpfs are mounted on +the /tmp, /run, and /var/tmp directories. + +When **--read-only=true** and **--read-only-tmpfs=false** /dev and /dev/shm are marked +Read/Only and no tmpfs are mounted on /tmp, /run and /var/tmp. The directories +are exposed from the underlying image, meaning they are read-only by default. +This makes the container totally read-only. No writable directories exist within +the container. In this mode writable directories need to be added via external +volumes or mounts. + +By default, when **--read-only=false**, the /dev and /dev/shm are read/write, and the /tmp, /run, and /var/tmp are read/write directories from the container image. + +[//]: # (END included file options/read-only-tmpfs.md) + + +[//]: # (BEGIN included file options/replace.md) +#### **--replace** + +If another container with the same name already exists, replace and remove it. The default is **false**. + +[//]: # (END included file options/replace.md) + + +[//]: # (BEGIN included file options/requires.md) +#### **--requires**=*container* + +Specify one or more requirements. +A requirement is a dependency container that is started before this container. +Containers can be specified by name or ID, with multiple containers being separated by commas. + +[//]: # (END included file options/requires.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + +#### **--rm** + +Automatically remove the container and any anonymous unnamed volume associated with +the container when it exits. The default is **false**. + +#### **--rmi** + +After exit of the container, remove the image unless another +container is using it. Implies --rm on the new container. The default is *false*. + + +[//]: # (BEGIN included file options/rootfs.md) +#### **--rootfs** + +If specified, the first argument refers to an exploded container on the file system. + +This is useful to run a container without requiring any image management, the rootfs +of the container is assumed to be managed externally. + + `Overlay Rootfs Mounts` + + The `\:O` flag tells Podman to mount the directory from the rootfs path as +storage using the `overlay file system`. The container processes +can modify content within the mount point which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +Note: On **SELinux** systems, the rootfs needs the correct label, which is by default +**unconfined_u\:object_r\:container_file_t\:s0**. + + `idmap` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. +The idmap option supports a custom mapping that can be different than the user +namespace used by the container. The mapping can be specified after the idmap +option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the +first value is the start of the backing file system IDs that are mapped to the +second value on the host. The length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/rootfs.md) + + +[//]: # (BEGIN included file options/sdnotify.md) +#### **--sdnotify**=**container** | *conmon* | *healthy* | *ignore* + +Determines how to use the NOTIFY_SOCKET, as passed with systemd and Type=notify. + +Default is **container**, which means allow the OCI runtime to proxy the socket into the +container to receive ready notification. Podman sets the MAINPID to conmon's pid. +The **conmon** option sets MAINPID to conmon's pid, and sends READY when the container +has started. The socket is never passed to the runtime or the container. +The **healthy** option sets MAINPID to conmon's pid, and sends READY when the container +has turned healthy; requires a healthcheck to be set. The socket is never passed to the runtime or the container. +The **ignore** option removes NOTIFY_SOCKET from the environment for itself and child processes, +for the case where some other process above Podman uses NOTIFY_SOCKET and Podman does not use it. + +[//]: # (END included file options/sdnotify.md) + + +[//]: # (BEGIN included file options/seccomp-policy.md) +#### **--seccomp-policy**=*policy* + +Specify the policy to select the seccomp profile. If set to *image*, Podman looks for a "io.containers.seccomp.profile" label in the container-image config and use its value as a seccomp profile. Otherwise, Podman follows the *default* policy by applying the default profile unless specified otherwise via *--security-opt seccomp* as described below. + +Note that this feature is experimental and may change in the future. + +[//]: # (END included file options/seccomp-policy.md) + + +[//]: # (BEGIN included file options/secret.md) +#### **--secret**=*secret[,opt=opt ...]* + +Give the container access to a secret. Can be specified multiple times. + +A secret is a blob of sensitive data which a container needs at runtime but +is not stored in the image or in source control, such as usernames and passwords, +TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 512 kB in size). + +When secrets are specified as type `mount`, the secrets are copied and mounted into the container when a container is created. +When secrets are specified as type `env`, the secret is set as an environment variable within the container. +Secrets are written in the container at the time of container creation, and modifying the secret using `podman secret` commands +after the container is created affects the secret inside the container. + +Secrets and its storage are managed using the `podman secret` command. + +Secret Options + +- `type=mount|env` : How the secret is exposed to the container. + `mount` mounts the secret into the container as a file. + `env` exposes the secret as an environment variable. + Defaults to `mount`. +- `target=target` : Target of secret. + For mounted secrets, this is the path to the secret inside the container. + If a fully qualified path is provided, the secret is mounted at that location. + Otherwise, the secret is mounted to + `/run/secrets/target` for Linux containers or + `/var/run/secrets/target` for FreeBSD containers. + If the target is not set, the secret is mounted to `/run/secrets/secretname` by default. + For env secrets, this is the environment variable key. Defaults to `secretname`. +- `uid=0` : UID of secret. Defaults to 0. Mount secret type only. +- `gid=0` : GID of secret. Defaults to 0. Mount secret type only. +- `mode=0` : Mode of secret. Defaults to 0444. Mount secret type only. + + +Examples + +Mount at `/my/location/mysecret` with UID 1: +``` +--secret mysecret,target=/my/location/mysecret,uid=1 +``` + +Mount at `/run/secrets/customtarget` with mode 0777: +``` +--secret mysecret,target=customtarget,mode=0777 +``` + +Create a secret environment variable called `ENVSEC`: +``` +--secret mysecret,type=env,target=ENVSEC +``` + +[//]: # (END included file options/secret.md) + + +[//]: # (BEGIN included file options/security-opt.md) +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the container +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the container + +- **label=user:**_USER_: Set the label user for the container processes +- **label=role:**_ROLE_: Set the label role for the container processes +- **label=type:**_TYPE_: Set the label process type for the container processes +- **label=level:**_LEVEL_: Set the label level for the container processes +- **label=filetype:**_TYPE_: Set the label file type for the container files +- **label=disable**: Turn off label separation for the container + +Note: Labeling can be disabled for all containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the container. + +- **no-new-privileges**: Disable container processes from gaining additional privileges through the `execve(2)` system call (e.g. via setuid or setgid bits, or via file capabilities). Programs that rely on setuid/setgid bits set on their executable to change user id or group id are no longer able to do so, and any file capabilities added to the executable (e.g. via `setcap`) are not added to the permitted capability set. For more details, see: https://docs.kernel.org/userspace-api/no_new_privs.html. + +- **seccomp=unconfined**: Turn off seccomp confinement for the container. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. + +[//]: # (END included file options/security-opt.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the container. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/shm-size-systemd.md) +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. + +[//]: # (END included file options/shm-size-systemd.md) + + +[//]: # (BEGIN included file options/sig-proxy.md) +#### **--sig-proxy** + +Proxy received signals to the container process. SIGCHLD, SIGURG, SIGSTOP, and SIGKILL are not proxied. + +[//]: # (END included file options/sig-proxy.md) + +The default is **true**. + + +[//]: # (BEGIN included file options/stop-signal.md) +#### **--stop-signal**=*signal* + +Signal to stop a container. Default is **SIGTERM**. + +[//]: # (END included file options/stop-signal.md) + + +[//]: # (BEGIN included file options/stop-timeout.md) +#### **--stop-timeout**=*seconds* + +Timeout to stop a container. Default is **10**. +Remote connections use local containers.conf for defaults. + +[//]: # (END included file options/stop-timeout.md) + + +[//]: # (BEGIN included file options/subgidname.md) +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. + +[//]: # (END included file options/subgidname.md) + + +[//]: # (BEGIN included file options/subuidname.md) +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. + +[//]: # (END included file options/subuidname.md) + + +[//]: # (BEGIN included file options/sysctl.md) +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters at runtime. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: if using the **--ipc=host** option, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: if using the **--network=host** option, the above sysctls are not allowed. + +[//]: # (END included file options/sysctl.md) + + +[//]: # (BEGIN included file options/systemd.md) +#### **--systemd**=*true* | *false* | *always* + +Run container in systemd mode. The default is **true**. + +- **true** enables systemd mode only when the command executed inside the container is *systemd*, */usr/sbin/init*, +*/sbin/init* or */usr/local/sbin/init*. + +- **false** disables systemd mode. + +- **always** enforces the systemd mode to be enabled. + +Running the container in systemd mode causes the following changes: + +* Podman mounts tmpfs file systems on the following directories + * _/run_ + * _/run/lock_ + * _/tmp_ + * _/sys/fs/cgroup/systemd_ (on a cgroup v1 system) + * _/var/lib/journal_ +* Podman sets the default stop signal to **SIGRTMIN+3**. +* Podman sets **container_uuid** environment variable in the container to the +first 32 characters of the container ID. +* Podman does not mount virtual consoles (_/dev/tty\d+_) when running with **--privileged**. +* On cgroup v2, */sys/fs/cgroup* is mounted writable. + +This allows systemd to run in a confined container without any modifications. + +Note that on **SELinux** systems, systemd attempts to write to the cgroup +file system. Containers writing to the cgroup file system are denied by default. +The **container_manage_cgroup** boolean must be enabled for this to be allowed on an SELinux separated system. +``` +setsebool -P container_manage_cgroup true +``` + +[//]: # (END included file options/systemd.md) + + +[//]: # (BEGIN included file options/timeout.md) +#### **--timeout**=*seconds* + +Maximum time a container is allowed to run before conmon sends it the kill +signal. By default containers run until they exit or are stopped by +`podman stop`. + +[//]: # (END included file options/timeout.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/tmpfs.md) +#### **--tmpfs**=*fs* + +Create a tmpfs mount. + +Mount a temporary filesystem (**tmpfs**) mount into a container, for example: + +``` +$ podman run -d --tmpfs /tmp\:rw,size=787448k,mode=1777 my_image +``` + +This command mounts a **tmpfs** at _/tmp_ within the container. The supported mount +options are the same as the Linux default mount flags. If no options are specified, +the system uses the following options: +**rw,noexec,nosuid,nodev**. + +[//]: # (END included file options/tmpfs.md) + + +[//]: # (BEGIN included file options/tty.md) +#### **--tty**, **-t** + +Allocate a pseudo-TTY. The default is **false**. + +When set to **true**, Podman allocates a pseudo-tty and attach to the standard +input of the container. This can be used, for example, to run a throwaway +interactive shell. + +**NOTE**: The --tty flag prevents redirection of standard output. It combines STDOUT and STDERR, it can insert control characters, and it can hang pipes. This option is only used when run interactively in a terminal. When feeding input to Podman, use -i only, not -it. + +[//]: # (END included file options/tty.md) + +``` +echo "asdf" | podman run --rm -i someimage /bin/cat +``` + + +[//]: # (BEGIN included file options/tz.md) +#### **--tz**=*timezone* + +Set timezone in container. This flag takes area-based timezones, GMT time, as well as `local`, which sets the timezone in the container to match the host machine. See `/usr/share/zoneinfo/` for valid timezones. +Remote connections use local containers.conf for defaults + +[//]: # (END included file options/tz.md) + + +[//]: # (BEGIN included file options/uidmap.container.md) +#### **--uidmap**=*[flags]container_uid\:from_uid[\:amount]* + +Run the container in a new user namespace using the supplied UID mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +The possible values of the optional *flags* are discussed further down on this page. +The *amount* value is optional and assumed to be **1** if not given. + +The *from_uid* value is based upon the user running the command, either rootful or rootless users. + +* rootful user: [*flags*]*container_uid*:*host_uid*[:*amount*] +* rootless user: [*flags*]*container_uid*:*intermediate_uid*[:*amount*] + + `Rootful mappings` + + +When **podman run** is called by a privileged user, the option **--uidmap** +works as a direct mapping between host UIDs and container UIDs. + +host UID -> container UID + +The _amount_ specifies the number of consecutive UIDs that is mapped. +If for example _amount_ is **4** the mapping looks like: + +| host UID | container UID | +| ---------- | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | + + `Rootless mappings` + +When **podman run** is called by an unprivileged user (i.e. running rootless), +the value *from_uid* is interpreted as an "intermediate UID". In the rootless +case, host UIDs are not mapped directly to container UIDs. Instead the mapping +happens over two mapping steps: + +host UID -> intermediate UID -> container UID + +The **--uidmap** option only influences the second mapping step. + +The first mapping step is derived by Podman from the contents of the file +_/etc/subuid_ and the UID of the user calling Podman. + +First mapping step: + +| host UID | intermediate UID | +| -------- | ---------------- | +| UID for Podman user | 0 | +| 1st subordinate UID | 1 | +| 2nd subordinate UID | 2 | +| 3rd subordinate UID | 3 | +| nth subordinate UID | n | + +To be able to use intermediate UIDs greater than zero, the user needs to have +subordinate UIDs configured in _/etc/subuid_. See **subuid**(5). + +The second mapping step is configured with **--uidmap**. + +If for example _amount_ is **5** the second mapping step looks like: + +| intermediate UID | container UID | +| ------------------ | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | +| *from_uid* + 4 | *container_uid* + 4 | + +When running as rootless, Podman uses all the ranges configured in the _/etc/subuid_ file. + +The current user ID is mapped to UID=0 in the rootless user namespace. +Every additional range is added sequentially afterward: + +| host | rootless user namespace | length | +| ------ | ----------------------- | ------ | +| $UID | 0 | 1 | +| 1 | $FIRST_RANGE_ID | $FIRST_RANGE_LENGTH | +| 1+$FIRST_RANGE_LENGTH | $SECOND_RANGE_ID | $SECOND_RANGE_LENGTH| + + `Referencing a host ID from the parent namespace` + +As a rootless user, the given host ID in **--uidmap** or **--gidmap** +is mapped from the *intermediate namespace* generated by Podman. Sometimes +it is desirable to refer directly at the *host namespace*. It is possible +to manually do so, by running `podman unshare cat /proc/self/gid_map`, +finding the desired host id at the second column of the output, and getting +the corresponding intermediate id from the first column. + +Podman can perform all that by preceding the host id in the mapping +with the `@` symbol. For instance, by specifying `--gidmap 100000:@2000:1`, +podman will look up the intermediate id corresponding to host id `2000` and +it will map the found intermediate id to the container id `100000`. The +given host id must have been subordinated (otherwise it would not be mapped +into the intermediate space in the first place). + +If the length is greater than one, for instance with `--gidmap 100000:@2000:2`, +Podman will map host ids `2000` and `2001` to `100000` and `100001`, respectively, +regardless of how the intermediate mapping is defined. + + `Extending previous mappings` + +Some mapping modifications may be cumbersome. For instance, a user +starts with a mapping such as `--gidmap="0:0:65000"`, that needs to be +changed such as the parent id `1000` is mapped to container id `100000` +instead, leaving container id `1` unassigned. The corresponding `--gidmap` +becomes `--gidmap="0:0:1" --gidmap="2:2:65534" --gidmap="100000:1:1"`. + +This notation can be simplified using the `+` flag, that takes care of +breaking previous mappings removing any conflicting assignment with +the given mapping. The flag is given before the container id +as follows: `--gidmap="0:0:65000" --gidmap="+100000:1:1"` + + + Flag | Example | Description +-----------|---------------|------------- + `+` | `+100000:1:1` | Extend the previous mapping + +This notation leads to gaps in the assignment, so it may be convenient to +fill those gaps afterwards: `--gidmap="0:0:65000" --gidmap="+100000:1:1" --gidmap="1:65001:1"` + +One specific use case for this flag is in the context of rootless +users. A rootless user may specify mappings with the `+` flag as +in `--gidmap="+100000:1:1"`. Podman will then "fill the gaps" starting +from zero with all the remaining intermediate ids. This is convenient when +a user wants to map a specific intermediate id to a container id, leaving +the rest of subordinate ids to be mapped by Podman at will. + + `Passing only one of --uidmap or --gidmap` + +Usually, subordinated user and group ids are assigned simultaneously, and +for any user the subordinated user ids match the subordinated group ids. +For convenience, if only one of **--uidmap** or **--gidmap** is given, +podman assumes the mapping refers to both UIDs and GIDs and applies the +given mapping to both. If only one value of the two needs to be changed, +the mappings should include the `u` or the `g` flags to specify that +they only apply to UIDs or GIDs and should not be copied over. + + flag | Example | Description +---------|-----------------|----------------- + `u` | `u20000:2000:1` |The mapping only applies to UIDs + `g` | `g10000:1000:1` |The mapping only applies to GIDs + +For instance given the command + + podman run --gidmap "0:0:1000" --gidmap "g2000:2000:1" + +Since no **--uidmap** is given, the **--gidmap** is copied to **--uidmap**, +giving a command equivalent to + + podman run --gidmap "0:0:1000" --gidmap "2000:2000:1" --uidmap "0:0:1000" + +The `--gidmap "g2000:2000:1"` used the `g` flag and therefore it was +not copied to **--uidmap**. + + `Rootless mapping of additional host GIDs` + +A rootless user may desire to map a specific host group that has already been +subordinated within _/etc/subgid_ without specifying the rest of the mapping. + +This can be done with **--gidmap "+g*container_gid*:@*host_gid*"** + +Where: + +- The host GID is given through the `@` symbol +- The mapping of this GID is not copied over to **--usermap** thanks to the `g` flag. +- The rest of the container IDs will be mapped starting from 0 to n, + with all the remaining subordinated GIDs, thanks to the `+` flag. + +For instance, if a user belongs to the group `2000` and that group is +subordinated to that user (with `usermod --add-subgids 2000-2000 $USER`), +the user can map the group into the container with: **--gidmap=+g100000:@2000**. + +If this mapping is combined with the option, **--group-add=keep-groups**, the +process in the container will belong to group `100000`, and files belonging +to group `2000` in the host will appear as being owned by group `100000` +inside the container. + + podman run --group-add=keep-groups --gidmap="+g100000:@2000" ... + + `No subordinate UIDs` + +Even if a user does not have any subordinate UIDs in _/etc/subuid_, +**--uidmap** can be used to map the normal UID of the user to a +container UID by running `podman run --uidmap $container_uid:0:1 --user $container_uid ...`. + + `Pods` + +The **--uidmap** option cannot be called in conjunction with the **--pod** option as a uidmap cannot be set on the container level when in a pod. + +[//]: # (END included file options/uidmap.container.md) + + +[//]: # (BEGIN included file options/ulimit.md) +#### **--ulimit**=*option* + +Ulimit options. Sets the ulimits values inside of the container. + +--ulimit with a soft and hard limit in the format =[:]. For example: + +$ podman run --ulimit nofile=1024:1024 --rm ubi9 ulimit -n +1024 + +Set -1 for the soft or hard limit to set the limit to the maximum limit of the current +process. In rootful mode this is often unlimited. + + +If nofile and nproc are unset, a default value of 1048576 will be used, unless overridden +in containers.conf(5). However, if the default value exceeds the hard limit for the current +rootless user, the current hard limit will be applied instead. + +Use **host** to copy the current configuration from the host. + +Don't use nproc with the ulimit flag as Linux uses nproc to set the +maximum number of processes available to a user, not to a container. + +Use the --pids-limit option to modify the cgroup control to limit the number +of processes within a container. + +[//]: # (END included file options/ulimit.md) + + +[//]: # (BEGIN included file options/umask.md) +#### **--umask**=*umask* + +Set the umask inside the container. Defaults to `0022`. +Remote connections use the local `containers.conf` for defaults. + +[//]: # (END included file options/umask.md) + + +[//]: # (BEGIN included file options/unsetenv.md) +#### **--unsetenv**=*env* + +Unset default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. + +[//]: # (END included file options/unsetenv.md) + + +[//]: # (BEGIN included file options/unsetenv-all.md) +#### **--unsetenv-all** + +Unset all default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. + +[//]: # (END included file options/unsetenv-all.md) + + +[//]: # (BEGIN included file options/user.md) +#### **--user**, **-u**=*user[\:group]* + +Sets the username or UID used and, optionally, the groupname or GID for the specified command. Both *user* and *group* may be symbolic or numeric. + +Without this argument, the command runs as the user specified in the container image. Unless overridden by a `USER` command in the Containerfile or by a value passed to this option, this user generally defaults to root. + +When a user namespace is not in use, the UID and GID used within the container and on the host match. When user namespaces are in use, however, the UID and GID in the container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container by default corresponds to the UID and GID of the user invoking Podman. + +[//]: # (END included file options/user.md) + + +[//]: # (BEGIN included file options/userns.container.md) +#### **--userns**=*mode* + +Set the user namespace mode for the container. + +If `--userns` is not set, the default value is determined as follows. +- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used. +- If the environment variable **PODMAN_USERNS** is set its value is used. +- If `userns` is specified in `containers.conf` this value is used. +- Otherwise, `--userns=host` is assumed. + +`--userns=""` (i.e., an empty string) is an alias for `--userns=host`. + +This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +------------------------|-----------|--------------------- +auto | $UID | nil (Host User UID is not mapped into container.) +host | $UID | 0 (Default User account mapped to root user in container.) +keep-id | $UID | $UID (Map user account to same UID within container.) +keep-id\:uid=200,gid=210 | $UID | 200:210 (Map user account to specified UID, GID value within container.) +nomap | $UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + +**auto**[\:_OPTIONS,..._]: automatically create a unique user namespace. + +* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. + + Example: `containers:2147483647:2147483648`. + +* `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5). + +Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user IDs. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. + +The option `--userns=keep-id` uses all the subuids and subgids of the user. +The option `--userns=nomap` uses all the subuids and subgids of the user except the user's own ID. +Using `--userns=auto` when starting new containers does not work as long as any containers exist that were started with `--userns=nomap` or `--userns=keep-id` without limiting the user namespace size. + + Valid `auto` options: + + - *gidmapping*=_CONTAINER\_GID\:HOST\_GID\:SIZE_: to force a GID mapping to be present in the user namespace. + - *size*=_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates a size for the user namespace. + - *uidmapping*=_CONTAINER\_UID\:HOST\_UID\:SIZE_: to force a UID mapping to be present in the user namespace. + +The host UID and GID in *gidmapping* and *uidmapping* can optionally be prefixed with the `@` symbol. +In this case, podman will look up the intermediate ID corresponding to host ID and it will map the found intermediate ID to the container id. +For details see **--uidmap**. + +**container:**_id_: join the user namespace of the specified container. + +**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user. + +**keep-id**: creates a user namespace where the current user's UID\:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace. + + Valid `keep-id` options: + + - *uid*=UID: override the UID inside the container that is used to map the current user to. + - *gid*=GID: override the GID inside the container that is used to map the current user to. + - *size*=SIZE: override the size of the configured user namespace. It is useful to not saturate all the available IDs. Not supported when running as root. + +**nomap**: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +**ns:**_namespace_: run the container in the given existing user namespace. + +[//]: # (END included file options/userns.container.md) + + +[//]: # (BEGIN included file options/uts.container.md) +#### **--uts**=*mode* + +Set the UTS namespace mode for the container. The following values are supported: + +- **host**: use the host's UTS namespace inside the container. +- **private**: create a new namespace for the container (default). +- **ns:[path]**: run the container in the given existing UTS namespace. +- **container:[container]**: join the UTS namespace of the specified container. + +[//]: # (END included file options/uts.container.md) + + +[//]: # (BEGIN included file options/variant.container.md) +#### **--variant**=*VARIANT* + +Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. + +[//]: # (END included file options/variant.container.md) + + +[//]: # (BEGIN included file options/volume.md) +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the container is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +container. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a container is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the container, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the container. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system +might prevent the processes running inside the container from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the container context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +containers share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label. Only the current container can use a private +volume. + +Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any one of the containers. Relabeling walks +the file system under the volume and changes the label on each file; if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the container. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually changed with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the container. +For example if a user wanted to volume mount their entire home directory into a +container, they need to disable SELinux separation. + + $ podman run --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The container processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous container executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the container +to work. + +Do not modify the source directory mounted into the container with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the container are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the container +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +container, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +container. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the container. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the container. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless container fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/volume.md) + +Use the **--group-add keep-groups** option to pass the user's supplementary group access into the container. + + +[//]: # (BEGIN included file options/volumes-from.md) +#### **--volumes-from**=*CONTAINER[\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +container. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target container, then the volume hides +that data on the target. + +[//]: # (END included file options/volumes-from.md) + + +[//]: # (BEGIN included file options/workdir.md) +#### **--workdir**, **-w**=*dir* + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (**/**). +The image developer can set a different default with the WORKDIR instruction. The operator +can override the working directory by using the **-w** option. + +[//]: # (END included file options/workdir.md) + +## Exit Status + +The exit code from **podman run** gives information about why the container +failed to run or why it exited. When **podman run** exits with a non-zero code, +the exit codes follow the **chroot**(1) standard, see below: + + **125** The error is with Podman itself + + $ podman run --foo busybox; echo $? + Error: unknown flag: --foo + 125 + + **126** The _contained command_ cannot be invoked + + $ podman run busybox /etc; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error + 126 + + **127** The _contained command_ cannot be found + + $ podman run busybox foo; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error + 127 + + **Exit code** _contained command_ exit code + + $ podman run busybox /bin/sh -c 'exit 3'; echo $? + 3 + +## EXAMPLES + +### Running container in read-only mode + +During container image development, containers often need to write to the image +content. Installing packages into _/usr_, for example. In production, +applications seldom need to write to the image. Container applications write +to volumes if they need to write to file systems at all. Applications can be +made more secure by running them in read-only mode using the **--read-only** switch. +This protects the container's image from modification. By default read-only +containers can write to temporary data. Podman mounts a tmpfs on _/run_ and +_/tmp_ within the container. + +``` +$ podman run --read-only -i -t fedora /bin/bash +``` + +If the container does not write to any file +system within the container, including tmpfs, set --read-only-tmpfs=false. +``` +$ podman run --read-only --read-only-tmpfs=false --tmpfs /run -i -t fedora /bin/bash +``` + +### Exposing shared libraries inside of container as read-only using a glob + +``` +$ podman run --mount type=glob,src=/usr/lib64/libnvidia\*,ro=true -i -t fedora /bin/bash +``` + +### Exposing log messages from the container to the host's log + +Bind mount the _/dev/log_ directory to have messages that are logged in the container show up in the host's +syslog/journal. + +``` +$ podman run -v /dev/log:/dev/log -i -t fedora /bin/bash +``` + +From inside the container test this by sending a message to the log. + +``` +(bash)# logger "Hello from my container" +``` + +Then exit and check the journal. + +``` +(bash)# exit + +$ journalctl -b | grep Hello +``` + +This lists the message sent to the logger. + +### Attaching to one or more from STDIN, STDOUT, STDERR + +Without specifying the **-a** option, Podman attaches everything (stdin, stdout, stderr). +Override the default by specifying -a (stdin, stdout, stderr), as in: + +``` +$ podman run -a stdin -a stdout -i -t fedora /bin/bash +``` + +### Sharing IPC between containers + +Using **shm_server.c** available here: https://www.cs.cf.ac.uk/Dave/C/node27.html + +Testing **--ipc=host** mode: + +Host shows a shared memory segment with 7 pids attached, happens to be from httpd: + +``` +$ sudo ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +0x01128e25 0 root 600 1000 7 +``` + +Now run a regular container, and it correctly does NOT see the shared memory segment from the host: + +``` +$ podman run -it shm ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +``` + +Run a container with the new **--ipc=host** option, and it now sees the shared memory segment from the host httpd: + +``` +$ podman run -it --ipc=host shm ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +0x01128e25 0 root 600 1000 7 +``` +Testing **--ipc=container:**_id_ mode: + +Start a container with a program to create a shared memory segment: +``` +$ podman run -it shm bash +$ sudo shm/shm_server & +$ sudo ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +0x0000162e 0 root 666 27 1 +``` +Create a 2nd container correctly shows no shared memory segment from 1st container: +``` +$ podman run shm ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +``` + +Create a 3rd container using the **--ipc=container:**_id_ option, now it shows the shared memory segment from the first: + +``` +$ podman run -it --ipc=container\:ed735b2264ac shm ipcs -m +$ sudo ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +0x0000162e 0 root 666 27 1 +``` + +### Mapping Ports for External Usage + +The exposed port of an application can be mapped to a host port using the **-p** +flag. For example, an httpd port 80 can be mapped to the host port 8080 using the +following: + +``` +$ podman run -p 8080:80 -d -i -t fedora/httpd +``` + +### Mounting External Volumes + +To mount a host directory as a container volume, specify the absolute path to +the directory and the absolute path for the container directory separated by a +colon. If the source is a named volume maintained by Podman, it is recommended to +use its name rather than the path to the volume. Otherwise the volume is +considered an orphan and wiped by the **podman volume prune** command: + +``` +$ podman run -v /var/db:/data1 -i -t fedora bash + +$ podman run -v data:/data2 -i -t fedora bash + +$ podman run -v /var/cache/dnf:/var/cache/dnf\:O -ti fedora dnf -y update +``` + +If the container needs a writable mounted volume by a non root user inside the container, use the **U** option. This option tells Podman to chown the source volume to match the default UID and GID used within the container. +``` +$ podman run -d -e MARIADB_ROOT_PASSWORD=root --user mysql --userns=keep-id -v ~/data:/var/lib/mysql:Z,U mariadb +``` + +Alternatively if the container needs a writable volume by a non root +user inside of the container, the --userns=keep-id option allows users to +specify the UID and GID of the user executing Podman to specific UIDs and GIDs +within the container. Since the processes running in the container run as the user's UID, they can read/write files owned by the user. +``` +$ podman run -d -e MARIADB_ROOT_PASSWORD=root --user mysql --userns=keep-id\:uid=999,gid=999 -v ~/data:/var/lib/mysql\:Z mariadb +``` + +Using **--mount** flags to mount a host directory as a container folder, specify +the absolute path to the directory or the volume name, and the absolute path +within the container directory: + +```` +$ podman run --mount type=bind,src=/var/db,target=/data1 busybox sh + +$ podman run --mount type=bind,src=volume-name,target=/data1 busybox sh +```` + +When using SELinux, be aware that the host has no knowledge of container SELinux +policy. Therefore, in the above example, if SELinux policy is enforced, the +_/var/db_ directory is not writable to the container. A "Permission Denied" +message occurs, and an **avc:** message is added to the host's syslog. + +To work around this, at time of writing this man page, the following command +needs to be run in order for the proper SELinux policy type label to be attached +to the host directory: + +``` +$ chcon -Rt svirt_sandbox_file_t /var/db +``` + +Now, writing to the _/data1_ volume in the container is allowed and the +changes are reflected on the host in _/var/db_. + +### Using alternative security labeling + +Override the default labeling scheme for each container by specifying +the **--security-opt** flag. For example, specify the MCS/MLS level, a +requirement for MLS systems. Specifying the level in the following command +allows the same content to be shared between containers. + +``` +podman run --security-opt label=level\:s0:c100,c200 -i -t fedora bash +``` + +An MLS example might be: + +``` +$ podman run --security-opt label=level\:TopSecret -i -t rhel7 bash +``` + +To disable the security labeling for this container versus running with the +#### **--permissive** flag, use the following command: + +``` +$ podman run --security-opt label=disable -i -t fedora bash +``` + +Tighten the security policy on the processes within a container by specifying an +alternate type for the container. For example, run a container +that is only allowed to listen on Apache ports by executing the following +command: + +``` +$ podman run --security-opt label=type\:svirt_apache_t -i -t centos bash +``` + +Note that an SELinux policy defining a **svirt_apache_t** type must be written. + +To mask additional specific paths in the container, specify the paths +separated by a colon using the **mask** option with the **--security-opt** +flag. + +``` +$ podman run --security-opt mask=/foo/bar:/second/path fedora bash +``` + +To unmask all the paths that are masked by default, set the **unmask** option to +**ALL**. Or to only unmask specific paths, specify the paths as shown above with +the **mask** option. + +``` +$ podman run --security-opt unmask=ALL fedora bash +``` + +To unmask all the paths that start with /proc, set the **unmask** option to +**/proc/***. + +``` +$ podman run --security-opt unmask=/proc/* fedora bash +``` + +``` +$ podman run --security-opt unmask=/foo/bar:/sys/firmware fedora bash +``` + +### Setting device weight via **--blkio-weight-device** flag. + +``` +$ podman run -it --blkio-weight-device "/dev/sda:200" ubuntu +``` + +### Using a podman container with input from a pipe + +``` +$ echo "asdf" | podman run --rm -i --entrypoint /bin/cat someimage +asdf +``` + +### Setting automatic user namespace separated containers + +``` +# podman run --userns=auto\:size=65536 ubi8-micro cat /proc/self/uid_map +0 2147483647 65536 +# podman run --userns=auto\:size=65536 ubi8-micro cat /proc/self/uid_map +0 2147549183 65536 +``` + +### Setting Namespaced Kernel Parameters (Sysctls) + +The **--sysctl** sets namespaced kernel parameters (sysctls) in the +container. For example, to turn on IP forwarding in the containers +network namespace, run this command: + +``` +$ podman run --sysctl net.ipv4.ip_forward=1 someimage +``` + +Note that not all sysctls are namespaced. Podman does not support changing sysctls +inside of a container that also modify the host system. As the kernel +evolves we expect to see more sysctls become namespaced. + +See the definition of the **--sysctl** option above for the current list of +supported sysctls. + +### Set UID/GID mapping in a new user namespace + +Running a container in a new user namespace requires a mapping of +the UIDs and GIDs from the host. + +``` +$ podman run --uidmap 0:30000:7000 --gidmap 0:30000:7000 fedora echo hello +``` + +### Configuring Storage Options from the command line + +Podman allows for the configuration of storage by changing the values +in the _/etc/container/storage.conf_ or by using global options. This +shows how to set up and use fuse-overlayfs for a one-time run of busybox +using global options. + +``` +podman --log-level=debug --storage-driver overlay --storage-opt "overlay.mount_program=/usr/bin/fuse-overlayfs" run busybox /bin/sh +``` + +### Configure timezone in a container + +``` +$ podman run --tz=local alpine date +$ podman run --tz=Asia/Shanghai alpine date +$ podman run --tz=US/Eastern alpine date +``` + +### Adding dependency containers + +The first container, container1, is not started initially, but must be running before container2 starts. +The `podman run` command starts the container automatically before starting container2. + +``` +$ podman create --name container1 -t -i fedora bash +$ podman run --name container2 --requires container1 -t -i fedora bash +``` + +Multiple containers can be required. + +``` +$ podman create --name container1 -t -i fedora bash +$ podman create --name container2 -t -i fedora bash +$ podman run --name container3 --requires container1,container2 -t -i fedora bash +``` + +### Configure keep supplemental groups for access to volume + +``` +$ podman run -v /var/lib/design:/var/lib/design --group-add keep-groups ubi8 +``` + +### Configure execution domain for containers using personality flag + +``` +$ podman run --name container1 --personality=LINUX32 fedora bash +``` + +### Run a container with external rootfs mounted as an overlay + +``` +$ podman run --name container1 --rootfs /path/to/rootfs:O bash +``` + +### Handling Timezones in java applications in a container. + +In order to use a timezone other than UTC when running a +Java application within a container, the `TZ` environment variable must be +set within the container. Java applications ignores the value set with the +`--tz` option. + +``` +# Example run +podman run -ti --rm -e TZ=EST mytzimage +lrwxrwxrwx. 1 root root 29 Nov 3 08:51 /etc/localtime -> ../usr/share/zoneinfo/Etc/UTC +Now with default timezone: +Fri Nov 19 18:10:55 EST 2021 +Java default sees the following timezone: +2021-11-19T18:10:55.651130-05:00 +Forcing UTC: +Fri Nov 19 23:10:55 UTC 2021 +``` + +### Run a container connected to two networks (called net1 and net2) with a static ip + +``` +$ podman run --network net1\:ip=10.89.1.5 --network net2\:ip=10.89.10.10 alpine ip addr +``` + +### Rootless Containers + +Podman runs as a non-root user on most systems. This feature requires that a new enough version of **shadow-utils** +be installed. The **shadow-utils** package must include the **newuidmap**(1) and **newgidmap**(1) executables. + +In order for users to run rootless, there must be an entry for their username in _/etc/subuid_ and _/etc/subgid_ which lists the UIDs for their user namespace. + +Rootless Podman works better if the fuse-overlayfs and slirp4netns packages are installed. +The **fuse-overlayfs** package provides a userspace overlay storage driver, otherwise users need to use +the **vfs** storage driver, which can be disk space expensive and less +performant than other drivers. + +To enable VPN on the container, slirp4netns or pasta needs to be specified; +without either, containers need to be run with the --network=host flag. + +## ENVIRONMENT + +Environment variables within containers can be set using multiple different options, +in the following order of precedence (later entries override earlier entries): + +- Container image: Any environment variables specified in the container image. +- **--http-proxy**: By default, several environment variables are passed in from the host, such as **http_proxy** and **no_proxy**. See **--http-proxy** for details. +- **--env-host**: Host environment of the process executing Podman is added. +- **--env-file**: Any environment variables specified via env-files. If multiple files are specified, then they override each other in order of entry. +- **--env**: Any environment variables specified overrides previous settings. + +Run containers and set the environment ending with a __*__. +The trailing __*__ glob functionality is only active when no value is specified: + +``` +$ export ENV1=a +$ podman run --env 'ENV*' alpine env | grep ENV +ENV1=a +$ podman run --env 'ENV*=b' alpine env | grep ENV +ENV*=b +``` + +## CONMON + +When Podman starts a container it actually executes the conmon program, which +then executes the OCI Runtime. Conmon is the container monitor. It is a small +program whose job is to watch the primary process of the container, and if the +container dies, save the exit code. It also holds open the tty of the +container, so that it can be attached to later. This is what allows Podman to +run in detached mode (backgrounded), so Podman can exit but conmon continues to +run. Each container has their own instance of conmon. Conmon waits for the +container to exit, gathers and saves the exit code, and then launches a Podman +process to complete the container cleanup, by shutting down the network and +storage. For more information about conmon, see the conmon(8) man +page. + +## FILES + +**/etc/subuid** + +**/etc/subgid** + +NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-save(1)](podman-save.1.md)**, **[podman-ps(1)](podman-ps.1.md)**, **[podman-attach(1)](podman-attach.1.md)**, **[podman-pod-create(1)](podman-pod-create.1.md)**, **[podman-port(1)](podman-port.1.md)**, **[podman-start(1)](podman-start.1.md)**, **[podman-kill(1)](podman-kill.1.md)**, **[podman-stop(1)](podman-stop.1.md)**, **[podman-generate-systemd(1)](podman-generate-systemd.1.md)**, **[podman-rm(1)](podman-rm.1.md)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)**, **[setsebool(8)](https://man7.org/linux/man-pages/man8/setsebool.8.html)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, **[pasta(1)](https://passt.top/builds/latest/web/passt.1.html)**, **[fuse-overlayfs(1)](https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md)**, **proc(5)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)**, **personality(2)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +See [podman-rootless(7)](https://github.com/containers/podman/blob/main/rootless.md) +for rootless issues. + +## HISTORY +September 2018, updated by Kunal Kushwaha `` + +October 2017, converted from Docker documentation to Podman by Dan Walsh for Podman `` + +November 2015, updated by Sally O'Malley `` + +June 2014, updated by Sven Dowideit `` + +April 2014, Originally compiled by William Henry `` based on docker.com source material and internal work. + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a core value of open source. The `master` and `slave` mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately. diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-save.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-save.1.md new file mode 100644 index 000000000..3391365b3 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-save.1.md @@ -0,0 +1,107 @@ +--- +title: podman-save +version: v5.5.1 +--- + +% podman-save 1 + +## NAME +podman\-save - Save image(s) to an archive + +## SYNOPSIS +**podman save** [*options*] *name*[:*tag*] + +**podman image save** [*options*] *name*[:*tag*] + +## DESCRIPTION +**podman save** saves an image to a local file or directory. +**podman save** writes to STDOUT by default and can be redirected to a +file using the **output** flag. The **quiet** flag suppresses the output when set. +**podman save** saves parent layers of the image(s) and the image(s) can be loaded using **podman load**. +To export the containers, use the **podman export**. +Note: `:` is a restricted character and cannot be part of the file name. + +**podman [GLOBAL OPTIONS]** + +**podman save [GLOBAL OPTIONS]** + +**podman save [OPTIONS] NAME[\:TAG]** + +## OPTIONS + + +[//]: # (BEGIN included file options/dir-compress.md) +#### **--compress** + +Compress tarball image layers when pushing to a directory using the 'dir' transport. (default is same compression type, compressed or uncompressed, as source) + +[//]: # (END included file options/dir-compress.md) + +Note: This flag can only be set with **--format=docker-dir**. + +#### **--format**=*format* + +An image format to produce, one of: + +| Format | Description | +| ------------------ | ---------------------------------------------------------------------------- | +| **docker-archive** | A tar archive interoperable with **docker load(1)** (the default) | +| **oci-archive** | A tar archive using the OCI Image Format | +| **oci-dir** | A directory using the OCI Image Format | +| **docker-dir** | **dir** transport (see **containers-transports(5)**) with v2s2 manifest type | + +#### **--help**, **-h** + +Print usage statement + +#### **--multi-image-archive**, **-m** + +Allow for creating archives with more than one image. Additional names are interpreted as images instead of tags. Only supported for **--format=docker-archive**. +The default for this option can be modified via the `multi_image_archive="true"|"false"` flag in containers.conf. + +#### **--output**, **-o**=*file* + +Write to a file, default is STDOUT + +#### **--quiet**, **-q** + +Suppress the output + +#### **--uncompressed** + +Accept uncompressed layers when using one of the OCI formats. + +## EXAMPLES + +Save image to a local file without displaying progress. +``` +$ podman save --quiet -o alpine.tar alpine:2.6 +``` + +Save image to stdout and redirect content via shell. +``` +$ podman save alpine > alpine-all.tar +``` + +Save image in oci-archive format to the local file. +``` +$ podman save -o oci-alpine.tar --format oci-archive alpine +``` + +Save image compressed in docker-dir format. +``` +$ podman save --compress --format docker-dir -o alp-dir alpine +Getting image source signatures +Copying blob sha256:2fdfe1cd78c20d05774f0919be19bc1a3e4729bce219968e4188e7e0f1af679d + 1.97 MB / 1.97 MB [========================================================] 0s +Copying config sha256:501d1a8f0487e93128df34ea349795bc324d5e0c0d5112e08386a9dfaff620be + 584 B / 584 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-load(1)](podman-load.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** + +## HISTORY +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-search.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-search.1.md new file mode 100644 index 000000000..737b5692d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-search.1.md @@ -0,0 +1,191 @@ +--- +title: podman-search +version: v5.5.1 +--- + +% podman-search 1 + +## NAME +podman\-search - Search a registry for an image + +## SYNOPSIS +**podman search** [*options*] *term* + +## DESCRIPTION +**podman search** searches a registry or a list of registries for a matching image. +The user can specify which registry to search by prefixing the registry in the search term +(e.g., **registry.fedoraproject.org/fedora**). By default, all +unqualified-search registries in `containers-registries.conf(5)` are used. + +The default number of results is 25. The number of results can be limited using the **--limit** flag. +If more than one registry is being searched, the limit is applied to each registry. The output can be filtered +using the **--filter** flag. To get all available images in a registry without a specific +search term, the user can just enter the registry name with a trailing "/" (example **registry.fedoraproject.org/**). + +Note that **podman search** is not a reliable way to determine the presence or existence of an image. +The search behavior of the v1 and v2 Docker distribution API is specific to the implementation of each registry. +Some registries may not support searching at all. +Further note that searching without a search term only works for registries that implement the v2 API. + +**podman [GLOBAL OPTIONS]** + +**podman search [GLOBAL OPTIONS]** + +**podman search [OPTIONS] TERM** + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + +#### **--compatible** + +After the name and the description, also show the stars, official and automated descriptors as Docker does. +Podman does not show these descriptors by default since they are not supported by most public container registries. + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + +#### **--filter**, **-f**=*filter* + +Filter output based on conditions provided (default []) + +Supported filters are: + +* stars (int) - minimum number of stars required for images to show +* is-automated (boolean - true | false) - is the image automated or not +* is-official (boolean - true | false) - is the image official or not + +#### **--format**=*format* + +Change the output format to a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| --------------- | ---------------------------- | +| .Automated | "[OK]" if image is automated | +| .Description | Image description | +| .Index | Registry | +| .Name | Image name | +| .Official | "[OK]" if image is official | +| .Stars | Star count of image | +| .Tag | Repository tag | + +Note: use .Tag only if the --list-tags is set. + +#### **--help**, **-h** + +Print usage statement + +#### **--limit**=*limit* + +Limit the number of results (default 25). +Note: The results from each registry is limited to this value. +Example if limit is 10 and two registries are being searched, the total +number of results is 20, 10 from each (if there are at least 10 matches in each). +The order of the search results is the order in which the API endpoint returns the results. + +#### **--list-tags** + +List the available tags in the repository for the specified image. +**Note:** --list-tags requires the search term to be a fully specified image name. +The result contains the Image name and its tag, one line for every tag associated with the image. + +#### **--no-trunc** + +Do not truncate the output (default *false*). + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Search for images containing the specified name, returning the first three images from each defined registry. +``` +$ podman search --limit 3 fedora +NAME DESCRIPTION +NAME DESCRIPTION +registry.fedoraproject.org/f29/fedora-toolbox +registry.fedoraproject.org/f30/fedora-toolbox +registry.fedoraproject.org/f31/fedora-toolbox +docker.io/library/fedora Official Docker builds of Fedora +docker.io/kasmweb/fedora-37-desktop Fedora 37 desktop for Kasm Workspaces +docker.io/kasmweb/fedora-38-desktop Fedora 38 desktop for Kasm Workspaces +quay.io/fedora/fedora +quay.io/containerdisks/fedora # Fedora Containerdisk Images diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-secret-create.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-secret-create.1.md new file mode 100644 index 000000000..2d11ecca7 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-secret-create.1.md @@ -0,0 +1,112 @@ +--- +title: podman-secret-create +version: v5.5.1 +--- + +% podman-secret-create 1 + +## NAME +podman\-secret\-create - Create a new secret + +## SYNOPSIS +**podman secret create** [*options*] *name* *file|-* + +## DESCRIPTION + +Creates a secret using standard input or from a file for the secret content. + +Create accepts a path to a file, or `-`, which tells podman to read the secret from stdin + +A secret is a blob of sensitive data which a container needs at runtime but +is not stored in the image or in source control, such as usernames and passwords, +TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 512 kB in size). + +Secrets are not committed to an image with `podman commit`, and do not get committed in the archive created by a `podman export` command. + +Secrets can also be used to store passwords for `podman login` to authenticate against container registries. + +## OPTIONS + +#### **--driver**, **-d**=*driver* + +Specify the secret driver (default **file**). + +#### **--driver-opts**=*key1=val1,key2=val2* + +Specify driver specific options. + +#### **--env**=*false* + +Read secret data from environment variable. + +#### **--help** + +Print usage statement. + +#### **--label**, **-l**=*key=val1,key2=val2* + +Add label to secret. These labels can be viewed in podman secrete inspect or ls. + +#### **--replace**=*false* + +If existing secret with the same name already exists, update the secret. +The `--replace` option does not change secrets within existing containers, only newly created containers. + The default is **false**. + +## SECRET DRIVERS + +#### file + +Secret resides in a read-protected file. + +#### pass + +Secret resides in a GPG-encrypted file. + +#### shell + +Secret is managed by custom scripts. An environment variable **SECRET_ID** +is passed to the scripts (except for **list**), and secrets are communicated +via stdin/stdout (where applicable). Driver options **list**, **lookup**, +**store**, and **delete** serve to install the scripts: + +``` +[secrets] +driver = "shell" + +[secrets.opts] +list = +lookup = +store = +delete = +``` + +## EXAMPLES + +Create the specified secret based on local file. +``` +echo -n mysecret > ./secret.txt +$ podman secret create my_secret ./secret.txt +``` + +Create the specified secret via stdin. +``` +$ printf | podman secret create my_secret - +``` + +Create gpg encrypted secret based on local file using the pass driver. +``` +$ podman secret create --driver=pass my_secret ./secret.txt.gpg +``` + +Create a secret from an environment variable called 'MYSECRET'. +``` +$ podman secret create --env=true my_secret MYSECRET +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)**, **[podman-login(1)](podman-login.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui +February 2024, Added example showing secret creation from an environment variable by Brett Calliss diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-secret-exists.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-secret-exists.1.md new file mode 100644 index 000000000..dfeb438b9 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-secret-exists.1.md @@ -0,0 +1,48 @@ +--- +title: podman-secret-exists +version: v5.5.1 +--- + +% podman-secret-exists 1 + +## NAME +podman\-secret\-exists - Check if the given secret exists + +## SYNOPSIS +**podman secret exists** *secret* + +## DESCRIPTION +**podman secret exists** checks if a secret exists. Podman returns an exit code +of `0` when the secret is found. A `1` is returned otherwise. An exit code of +`125` indicates there was another issue. + + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLE + +Check if a secret called `mysecret` exists (the secret does actually exist). +``` +$ podman secret exists mysecret +$ echo $? +0 +$ +``` + +Check if a secret called `mypassword` exists (the secret does not actually exist). +``` +$ podman secret exists mypassword +$ echo $? +1 +$ +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)** + +## HISTORY +April 2023, Originally compiled by Ygal Blum `` diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-secret-inspect.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-secret-inspect.1.md new file mode 100644 index 000000000..39de6f1be --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-secret-inspect.1.md @@ -0,0 +1,73 @@ +--- +title: podman-secret-inspect +version: v5.5.1 +--- + +% podman-secret-inspect 1 + +## NAME +podman\-secret\-inspect - Display detailed information on one or more secrets + +## SYNOPSIS +**podman secret inspect** [*options*] *secret* [...] + +## DESCRIPTION + +Inspects the specified secret. + +By default, this renders all results in a JSON array. If a format is specified, the given template is executed for each result. +Secrets can be queried individually by providing their full name or a unique partial name. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Format secret output using Go template. + +| **Placeholder** | **Description** | +|--------------------------|-------------------------------------------------------------------| +| .CreatedAt ... | When secret was created (relative timestamp, human-readable) | +| .ID | ID of secret | +| .SecretData | Secret Data (Displayed only with --showsecret option) | +| .Spec ... | Details of secret | +| .Spec.Driver ... | Driver info | +| .Spec.Driver.Name | Driver name (string) | +| .Spec.Driver.Options ... | Driver options (map of driver-specific options) | +| .Spec.Labels ... | Labels for this secret | +| .Spec.Name | Name of secret | +| .UpdatedAt ... | When secret was last updated (relative timestamp, human-readable) | + +#### **--help** + +Print usage statement. + +#### **--pretty** + +Print inspect output in human-readable format + +#### **--showsecret** + +Display secret data + +## EXAMPLES + +Inspect the secret mysecret. +``` +$ podman secret inspect mysecret +``` + +Inspect the secret mysecret and display the Name and Labels field. +``` +$ podman secret inspect --format "{{.Spec.Name}} {{.Spec.Labels}}" mysecret +``` + +Inspect the secret mysecret and display the Name and SecretData fields. Note this will display the secret data to the screen. +``` +$ podman secret inspect --showsecret --format "{{.Spec.Name}} {{.SecretData}}" mysecret +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-secret-ls.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-secret-ls.1.md new file mode 100644 index 000000000..2069d2f9c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-secret-ls.1.md @@ -0,0 +1,84 @@ +--- +title: podman-secret-ls +version: v5.5.1 +--- + +% podman-secret-ls 1 + +## NAME +podman\-secret\-ls - List all available secrets + +## SYNOPSIS +**podman secret ls** [*options*] + +## DESCRIPTION + +Lists all the secrets that exist. The output can be formatted to a Go template using the **--format** option. + +## OPTIONS + +#### **--filter**, **-f**=*filter=value* + +Filter output based on conditions given. +Multiple filters can be given with multiple uses of the --filter option. + +Valid filters are listed below: + +| **Filter** | **Description** | +| ---------- | ----------------------------------------------------------------- | +| name | [Name] Secret name (accepts regex) | +| id | [ID] Full or partial secret ID | + +#### **--format**=*format* + +Format secret output using Go template. + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------------ | ----------------------------------------------------------------- | +| .CreatedAt ... | When secret was created (relative timestamp, human-readable) | +| .ID | ID of secret | +| .SecretData | Secret Data (Displayed only with --showsecret option) | +| .Spec ... | Details of secret | +| .Spec.Driver ... | Driver info | +| .Spec.Driver.Name | Driver name (string) | +| .Spec.Driver.Options ... | Driver options (map of driver-specific options) | +| .Spec.Labels ... | Labels for this secret | +| .Spec.Name | Name of secret | +| .UpdatedAt ... | When secret was last updated (relative timestamp, human-readable) | + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Print secret IDs only. + +## EXAMPLES + +List all secrets. +``` +$ podman secret ls +``` + +List the name field of all secrets. +``` +$ podman secret ls --format "{{.Name}}" +``` + +List all secrets whose name includes the specified string. +``` +$ podman secret ls --filter name=confidential +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-secret-rm.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-secret-rm.1.md new file mode 100644 index 000000000..17a6e5b6a --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-secret-rm.1.md @@ -0,0 +1,48 @@ +--- +title: podman-secret-rm +version: v5.5.1 +--- + +% podman-secret-rm 1 + +## NAME +podman\-secret\-rm - Remove one or more secrets + +## SYNOPSIS +**podman secret rm** [*options*] *secret* [...] + +## DESCRIPTION + +Removes one or more secrets. + +`podman secret rm` is safe to use on secrets that are in use by a container. +The created container has access to the secret data because secrets are +copied and mounted into the container when a container is created. If a secret is deleted and +another secret is created with the same name, the secret inside the container does not change; +the old secret value still remains. + +## OPTIONS + +#### **--all**, **-a** + +Remove all existing secrets. + +#### **--help** + +Print usage statement. + +#### **--ignore**, **-i** +Ignore errors when specified secrets are not present. + +## EXAMPLES + +Remove secrets mysecret1 and mysecret2. +``` +$ podman secret rm mysecret1 mysecret2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-secret.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-secret.1.md new file mode 100644 index 000000000..f0e560772 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-secret.1.md @@ -0,0 +1,31 @@ +--- +title: podman-secret +version: v5.5.1 +--- + +% podman-secret 1 + +## NAME +podman\-secret - Manage podman secrets + +## SYNOPSIS +**podman secret** *subcommand* + +## DESCRIPTION +podman secret is a set of subcommands that manage secrets. + +## SUBCOMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------------ | ------------------------------------------------------ | +| create | [podman-secret-create(1)](podman-secret-create.1.md) | Create a new secret | +| exists | [podman-secret-exists(1)](podman-secret-exists.1.md) | Check if the given secret exists | +| inspect | [podman-secret-inspect(1)](podman-secret-inspect.1.md) | Display detailed information on one or more secrets | +| ls | [podman-secret-ls(1)](podman-secret-ls.1.md) | List all available secrets | +| rm | [podman-secret-rm(1)](podman-secret-rm.1.md) | Remove one or more secrets | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-start.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-start.1.md new file mode 100644 index 000000000..507e18d25 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-start.1.md @@ -0,0 +1,128 @@ +--- +title: podman-start +version: v5.5.1 +--- + +% podman-start 1 + +## NAME +podman\-start - Start one or more containers + +## SYNOPSIS +**podman start** [*options*] *container* ... + +**podman container start** [*options*] *container* ... + +## DESCRIPTION +Start one or more containers using container IDs or names as input. The *attach* and *interactive* +options cannot be used to override the *--tty* and *--interactive* options from when the container +was created. Starting an already running container with the *--attach* option, Podman simply +attaches to the container. + +## OPTIONS + +#### **--all** + +Start all the containers, default is only running containers. + +#### **--attach**, **-a** + +Attach container's STDOUT and STDERR. The default is false. This option cannot be used when +starting multiple containers. + + +[//]: # (BEGIN included file options/detach-keys.md) +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. + +[//]: # (END included file options/detach-keys.md) + +#### **--filter**, **-f** + +Filter what containers are going to be started from the given arguments. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + + +[//]: # (BEGIN included file options/interactive.md) +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. + +[//]: # (END included file options/interactive.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/sig-proxy.md) +#### **--sig-proxy** + +Proxy received signals to the container process. SIGCHLD, SIGURG, SIGSTOP, and SIGKILL are not proxied. + +[//]: # (END included file options/sig-proxy.md) + +The default is **true** when attaching, **false** otherwise. + +## EXAMPLE + +Start specified container: +``` +podman start mywebserver +``` + +Start multiple containers: +``` +podman start 860a4b231279 5421ab43b45 +``` + +Start specified container in interactive mode with terminal attached: +``` +podman start --interactive --attach 860a4b231279 +``` + +Start last created container in interactive mode (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman start -i -l +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +November 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-stats.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-stats.1.md new file mode 100644 index 000000000..03bbe8deb --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-stats.1.md @@ -0,0 +1,164 @@ +--- +title: podman-stats +version: v5.5.1 +--- + +% podman-stats 1 + +## NAME +podman\-stats - Display a live stream of one or more container's resource usage statistics + +## SYNOPSIS +**podman stats** [*options*] [*container*] + +**podman container stats** [*options*] [*container*] + +## DESCRIPTION +Display a live stream of one or more containers' resource usage statistics + +Note: Podman stats does not work in rootless environments that use CGroups V1. +Podman stats relies on CGroup information for statistics, and CGroup v1 is not +supported for rootless use cases. + +Note: Rootless environments that use CGroups V2 are not able to report statistics +about their networking usage. + +## OPTIONS + +#### **--all**, **-a** + +Show all containers. Only running containers are shown by default + +#### **--format**=*template* + +Pretty-print container statistics to JSON or using a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|---------------------|--------------------------------------------------| +| .AvgCPU | Average CPU, full precision float | +| .AVGCPU | Average CPU, formatted as a percent | +| .BlockInput | Total data read from block device | +| .BlockIO | Total data read/total data written to block device| +| .BlockOutput | Total data written to block device | +| .ContainerID | Container ID, full (untruncated) hash | +| .ContainerStats ... | Nested structure, for experts only | +| .CPU | Percent CPU, full precision float | +| .CPUNano | CPU Usage, total, in nanoseconds | +| .CPUPerc | Percentage of CPU used | +| .CPUSystemNano | CPU Usage, kernel, in nanoseconds | +| .Duration | Same as CPUNano | +| .ID | Container ID, truncated | +| .MemLimit | Memory limit, in bytes | +| .MemPerc | Memory percentage used | +| .MemUsage | Memory usage | +| .MemUsageBytes | Memory usage (IEC) | +| .Name | Container Name | +| .NetIO | Network IO | +| .Network ... | Network I/O, separated by network interface | +| .PerCPU | CPU time consumed by all tasks [1] | +| .PIDs | Number of PIDs | +| .PIDS | Number of PIDs (yes, we know this is a dup) | +| .SystemNano | Current system datetime, nanoseconds since epoch | +| .Up | Duration (CPUNano), in human-readable form | +| .UpTime | Same as Up | + +[1] Cgroups V1 only + +When using a Go template, precede the format with `table` to print headers. + +#### **--interval**, **-i**=*seconds* + +Time in seconds between stats reports, defaults to 5 seconds. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/no-reset.md) +#### **--no-reset** + +Do not clear the terminal/screen in between reporting intervals + +[//]: # (END included file options/no-reset.md) + + +[//]: # (BEGIN included file options/no-stream.md) +#### **--no-stream** + +Disable streaming stats and only pull the first result, default setting is false + +[//]: # (END included file options/no-stream.md) + +#### **--no-trunc** + +Do not truncate output + +## EXAMPLE + +List statistics about all running containers without streaming mode: +``` +# podman stats -a --no-stream +ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS +a9f807ffaacd frosty_hodgkin -- 3.092MB / 16.7GB 0.02% -- / -- -- / -- 2 +3b33001239ee sleepy_stallman -- -- / -- -- -- / -- -- / -- -- +``` + +List the specified container's statistics in streaming mode: +``` +# podman stats a9f80 +ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS +a9f807ffaacd frosty_hodgkin -- 3.092MB / 16.7GB 0.02% -- / -- -- / -- 2 +``` + +List the specified statistics about the specified container in table format: +``` +$ podman stats --no-trunc 3667 --format 'table {{ .ID }} {{ .MemUsage }}' +ID MEM USAGE / LIMIT +3667c6aacb06aac2eaffce914c01736420023d56ef9b0f4cfe58b6d6a78b7503 49.15kB / 67.17GB +``` + +List the specified container statistics in JSON format: +``` +# podman stats --no-stream --format=json a9f80 +[ + { + "id": "a9f807ffaacd", + "name": "frosty_hodgkin", + "cpu_percent": "--", + "mem_usage": "3.092MB / 16.7GB", + "mem_percent": "0.02%", + "netio": "-- / --", + "blocki": "-- / --", + "pids": "2" + } +] +``` + +List the specified container statistics in table format: +``` +# podman stats --no-stream --format "table {{.ID}} {{.Name}} {{.MemUsage}}" 6eae +ID NAME MEM USAGE / LIMIT +6eae9e25a564 clever_bassi 3.031MB / 16.7GB +``` + +Note: When using a slirp4netns network with the rootlesskit port +handler, the traffic sent via the port forwarding is accounted to +the `lo` device. Traffic accounted to `lo` is not accounted in the +stats output. + + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +July 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-stop.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-stop.1.md new file mode 100644 index 000000000..0d42ff0f9 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-stop.1.md @@ -0,0 +1,142 @@ +--- +title: podman-stop +version: v5.5.1 +--- + +% podman-stop 1 + +## NAME +podman\-stop - Stop one or more running containers + +## SYNOPSIS +**podman stop** [*options*] *container* ... + +**podman container stop** [*options*] *container* ... + +## DESCRIPTION +Stops one or more containers using container IDs or names as input. The **--time** option +specifies the number of seconds to wait before forcibly stopping the container after the stop command +is issued to the container. The default is 10 seconds. By default, containers are stopped with SIGTERM +and then SIGKILL after the timeout. The SIGTERM default can be overridden by the image used to create the +container and also via command line when creating the container. + +## OPTIONS + +#### **--all**, **-a** + +Stop all running containers. This does not include paused containers. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and stop the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + +Command does not fail when *file* is missing and user specified --ignore. + +#### **--filter**, **-f**=*filter* + +Filter what containers are going to be stopped. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + + +[//]: # (BEGIN included file options/ignore.md) +#### **--ignore**, **-i** + +Ignore errors when specified containers are not in the container store. A user +might have decided to manually remove a container which leads to a failure +during the ExecStop directive of a systemd service referencing that container. + +[//]: # (END included file options/ignore.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping the container. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +## EXAMPLES + +Stop the specified container via its name. +``` +$ podman stop mywebserver +``` + +Stop the container via its id. +``` +$ podman stop 860a4b235279 +``` + +Stop multiple containers. +``` +$ podman stop mywebserver 860a4b235279 +``` + +Stop the container identified in the cidfile. +``` +$ podman stop --cidfile /home/user/cidfile-1 +``` + +Stop the containers identified in the cidfiles. +``` +$ podman stop --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +Stop the specified container in 2 seconds. +``` +$ podman stop --time 2 860a4b235279 +``` + +Stop all running containers. +``` +$ podman stop -a +``` + +Stop the last created container (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman stop --latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-rm(1)](podman-rm.1.md)** + +## HISTORY +September 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-system-check.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-system-check.1.md new file mode 100644 index 000000000..5521aa8c0 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-system-check.1.md @@ -0,0 +1,64 @@ +--- +title: podman-system-check +version: v5.5.1 +--- + +% podman-system-check 1 + +## NAME +podman\-system\-check - Perform consistency checks on image and container storage + +## SYNOPSIS +**podman system check** [*options*] + +## DESCRIPTION +Perform consistency checks on image and container storage, reporting images and +containers which have identified issues. + +## OPTIONS + +#### **--force**, **-f** + +When attempting to remove damaged images, also remove containers which depend +on those images. By default, damaged images which are being used by containers +are left alone. + +Containers which depend on damaged images do so regardless of which engine +created them, but because podman only "knows" how to shut down containers that +it started, the effect on still-running containers which were started by other +engines is difficult to predict. + +#### **--max**, **-m**=*duration* + +When considering layers which are not used by any images or containers, assume +that any layers which are more than *duration* old are the results of canceled +attempts to pull images, and should be treated as though they are damaged. + +#### **--quick**, **-q** + +Skip checks which are known to be time-consuming. This will prevent some types +of errors from being detected. + +#### **--repair**, **-r** + +Remove any images which are determined to have been damaged in some way, unless +they are in use by containers. Use **--force** to remove containers which +depend on damaged images, and those damaged images, as well. + +## EXAMPLE + +A reasonably quick check: +``` +podman system check --quick --repair --force +``` + +A more thorough check: +``` +podman system check --repair --max=1h --force +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)** + +## HISTORY +April 2024 diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-system-connection-add.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-system-connection-add.1.md new file mode 100644 index 000000000..60620d9dd --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-system-connection-add.1.md @@ -0,0 +1,69 @@ +--- +title: podman-system-connection-add +version: v5.5.1 +--- + +% podman-system-connection-add 1 + +## NAME +podman\-system\-connection\-add - Record destination for the Podman service + +## SYNOPSIS +**podman system connection add** [*options*] *name* *destination* + +## DESCRIPTION +Record ssh destination for remote podman service(s). The ssh destination is given as one of: + - [user@]hostname[:port] + - ssh://[user@]hostname[:port] + - unix://path + - tcp://hostname\\:port + +The user is prompted for the remote ssh login password or key file passphrase as required. The `ssh-agent` is supported if it is running. + +## OPTIONS + +#### **--default**, **-d** + +Make the new destination the default for this user. The default is **false**. + +#### **--identity**=*path* + +Path to ssh identity file. If the identity file has been encrypted, Podman prompts the user for the passphrase. +If no identity file is provided and no user is given, Podman defaults to the user running the podman command. +Podman prompts for the login password on the remote server. + +#### **--port**, **-p**=*port* + +Port for ssh destination. The default value is `22`. + +#### **--socket-path**=*path* + +Path to the Podman service unix domain socket on the ssh destination host + +## EXAMPLE + +Add a named system connection: +``` +$ podman system connection add QA podman.example.com +``` + +Add a system connection using SSH data: +``` +$ podman system connection add --identity ~/.ssh/dev_rsa production ssh://root@server.example.com:2222 +``` + +Add a named system connection to local Unix domain socket: +``` +$ podman system connection add testing unix:///run/podman/podman.sock +``` + +Add a named system connection to local tcp socket: +``` +$ podman system connection add debug tcp://localhost:8080 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + + +## HISTORY +June 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-system-connection-default.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-system-connection-default.1.md new file mode 100644 index 000000000..015788573 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-system-connection-default.1.md @@ -0,0 +1,27 @@ +--- +title: podman-system-connection-default +version: v5.5.1 +--- + +% podman-system-connection-default 1 + +## NAME +podman\-system\-connection\-default - Set named destination as default for the Podman service + +## SYNOPSIS +**podman system connection default** *name* + +## DESCRIPTION +Set named ssh destination as default destination for the Podman service. + +## EXAMPLE + +Set the specified connection as default: +``` +$ podman system connection default production +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + +## HISTORY +July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-system-connection-list.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-system-connection-list.1.md new file mode 100644 index 000000000..2c05e526d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-system-connection-list.1.md @@ -0,0 +1,51 @@ +--- +title: podman-system-connection-list +version: v5.5.1 +--- + +% podman-system-connection-list 1 + +## NAME +podman\-system\-connection\-list - List the destination for the Podman service(s) + +## SYNOPSIS +**podman system connection list** [*options*] + +**podman system connection ls** [*options*] + +## DESCRIPTION +List ssh destination(s) for podman service(s). + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change the default output format. This can be of a supported type like 'json' or a Go template. +Valid placeholders for the Go template listed below: + +| **Placeholder** | **Description** | +| --------------- | ----------------------------------------------------------------------------- | +| .Default | Indicates whether connection is the default | +| .Identity | Path to file containing SSH identity | +| .Name | Connection Name/Identifier | +| .ReadWrite | Indicates if this connection can be modified using the system connection commands | +| .URI | URI to podman service. Valid schemes are ssh://[user@]*host*[\:port]*Unix domain socket*[?secure=True], unix://*Unix domain socket*, and tcp://localhost[:*port*] | + +#### **--quiet**, **-q** + +Only show connection names + +## EXAMPLE + +List system connections: +``` +$ podman system connection list +Name URI Identity Default ReadWrite +deva ssh://root@example.com:/run/podman/podman.sock ~/.ssh/id_rsa true true +devb ssh://user@example.com:/run/user/1000/podman/podman.sock ~/.ssh/id_rsa false true +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + +## HISTORY +July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-system-connection-remove.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-system-connection-remove.1.md new file mode 100644 index 000000000..704a5706a --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-system-connection-remove.1.md @@ -0,0 +1,33 @@ +--- +title: podman-system-connection-remove +version: v5.5.1 +--- + +% podman-system-connection-remove 1 + +## NAME +podman\-system\-connection\-remove - Delete named destination + +## SYNOPSIS +**podman system connection remove** [*options*] *name* + +## DESCRIPTION +Delete named ssh destination. + +## OPTIONS + +#### **--all**, **-a** + +Remove all connections. + +## EXAMPLE + +Remove the specified system connection: +``` +$ podman system connection remove production +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + +## HISTORY +July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-system-connection-rename.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-system-connection-rename.1.md new file mode 100644 index 000000000..4af7cb7ab --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-system-connection-rename.1.md @@ -0,0 +1,27 @@ +--- +title: podman-system-connection-rename +version: v5.5.1 +--- + +% podman-system-connection-rename 1 + +## NAME +podman\-system\-connection\-rename - Rename the destination for Podman service + +## SYNOPSIS +**podman system connection rename** *old* *new* + +## DESCRIPTION +Rename ssh destination from *old* to *new*. + +## EXAMPLE + +Rename the specified connection: +``` +$ podman system connection rename laptop devel +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + +## HISTORY +July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-system-connection.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-system-connection.1.md new file mode 100644 index 000000000..4cce4b025 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-system-connection.1.md @@ -0,0 +1,52 @@ +--- +title: podman-system-connection +version: v5.5.1 +--- + +% podman-system-connection 1 + +## NAME +podman\-system\-connection - Manage the destination(s) for Podman service(s) + +## SYNOPSIS +**podman system connection** *subcommand* + +## DESCRIPTION +Manage the destination(s) for Podman service(s). + +The user is prompted for the ssh login password or key file passphrase as required. The `ssh-agent` is supported if it is running. + +Podman manages the system connection by writing and reading the `podman-connections.json` file located under +`$XDG_CONFIG_HOME/containers` or if the env is not set it defaults to `$HOME/.config/containers`. +Or the `PODMAN_CONNECTIONS_CONF` environment variable can be set to a full file path which podman +will use instead. +This file is managed by the podman commands and should never be edited by users directly. To manually +configure the connections use `service_destinations` in containers.conf. + +If the ReadWrite column in the **podman system connection list** output is set to true the connection is +stored in the `podman-connections.json` file otherwise it is stored in containers.conf and can therefore +not be edited with the **podman system connection** commands. + +## COMMANDS + +| Command | Man Page | Description | +| -------- | ----------------------------------------------------------------------------- | ---------------------------------------------------------- | +| add | [podman-system-connection\-add(1)](podman-system-connection-add.1.md) | Record destination for the Podman service | +| default | [podman-system-connection\-default(1)](podman-system-connection-default.1.md) | Set named destination as default for the Podman service | +| list | [podman-system-connection\-list(1)](podman-system-connection-list.1.md) | List the destination for the Podman service(s) | +| remove | [podman-system-connection\-remove(1)](podman-system-connection-remove.1.md) | Delete named destination | +| rename | [podman-system-connection\-rename(1)](podman-system-connection-rename.1.md) | Rename the destination for Podman service | + +## EXAMPLE + +List system connections: +``` +$ podman system connection list +Name URI Identity Default ReadWrite +devl ssh://root@example.com/run/podman/podman.sock ~/.ssh/id_rsa true true +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)** + +## HISTORY +June 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-system-df.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-system-df.1.md new file mode 100644 index 000000000..8d52b81fe --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-system-df.1.md @@ -0,0 +1,84 @@ +--- +title: podman-system-df +version: v5.5.1 +--- + +% podman-system-df 1 + +## NAME +podman\-system\-df - Show podman disk usage + +## SYNOPSIS +**podman system df** [*options*] + +## DESCRIPTION +Show podman disk usage for images, containers and volumes. + +Note: The RECLAIMABLE size that is reported for images can be incorrect. It might +report that it can reclaim more than a prune would actually free. This will happen +if you are using different images that share some layers. + +## OPTIONS +#### **--format**=*format* + +Pretty-print images using a Go template or JSON. This flag is not allowed in combination with **--verbose** + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------------- | ------------------------------------------------ | +| .Active | Indicates whether volume is in use | +| .RawReclaimable | Raw reclaimable size of each Type | +| .RawSize | Raw size of each type | +| .Reclaimable | Reclaimable size or each type (human-readable) | +| .Size | Size of each type (human-readable) | +| .Total | Total items for each type | +| .Type | Type of data | + + +#### **--verbose**, **-v** +Show detailed information on space usage + +## EXAMPLE + +Show disk usage: +``` +$ podman system df +TYPE TOTAL ACTIVE SIZE RECLAIMABLE +Images 6 2 281MB 168MB (59%) +Containers 3 1 0B 0B (0%) +Local Volumes 1 1 22B 0B (0%) +``` + +Show disk usage in verbose mode: +``` +$ podman system df -v +Images space usage: + +REPOSITORY TAG IMAGE ID CREATED SIZE SHARED SIZE UNIQUE SIZE CONTAINERS +docker.io/library/alpine latest 5cb3aa00f899 2 weeks ago 5.79MB 0B 5.79MB 5 + +Containers space usage: + +CONTAINER ID IMAGE COMMAND LOCAL VOLUMES SIZE CREATED STATUS NAMES +073f7e62812d 5cb3 sleep 100 1 0B 20 hours ago exited zen_joliot +3f19f5bba242 5cb3 sleep 100 0 5.52kB 22 hours ago exited pedantic_archimedes +8cd89bf645cc 5cb3 ls foodir 0 58B 21 hours ago configured agitated_hamilton +a1d948a4b61d 5cb3 ls foodir 0 12B 21 hours ago exited laughing_wing +eafe3e3c5bb3 5cb3 sleep 10000 0 72B 21 hours ago exited priceless_liskov + +Local Volumes space usage: + +VOLUME NAME LINKS SIZE +data 1 0B + +$ podman system df --format "{{.Type}}\t{{.Total}}" +Images 1 +Containers 5 +Local Volumes 1 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)** + +## HISTORY +March 2019, Originally compiled by Qi Wang (qiwan at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-system-migrate.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-system-migrate.1.md new file mode 100644 index 000000000..932491dad --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-system-migrate.1.md @@ -0,0 +1,44 @@ +--- +title: podman-system-migrate +version: v5.5.1 +--- + +% podman-system-migrate 1 + +## NAME +podman\-system\-migrate - Migrate existing containers to a new podman version + +## SYNOPSIS +**podman system migrate** [*options*] + +## DESCRIPTION +**podman system migrate** migrates containers to the latest podman version. + +**podman system migrate** takes care of migrating existing containers to the latest version of podman if any change is necessary. + +"Rootless Podman uses a pause process to keep the unprivileged +namespaces alive. This prevents any change to the `/etc/subuid` and +`/etc/subgid` files from being propagated to the rootless containers +while the pause process is running. + +For these changes to be propagated, it is necessary to first stop all +running containers associated with the user and to also stop the pause +process and delete its pid file. Instead of doing it manually, `podman +system migrate` can be used to stop both the running containers and the +pause process. The `/etc/subuid` and `/etc/subgid` files can then be +edited or changed with usermod to recreate the user namespace with the +newly configured mappings. + +## OPTIONS + +#### **--new-runtime**=*runtime* + +Set a new OCI runtime for all containers. +This can be used after a system upgrade which changes the default OCI runtime to move all containers to the new runtime. +There are no guarantees that the containers continue to work under the new runtime, as some runtimes support differing options and configurations. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **usermod(8)** + +## HISTORY +April 2019, Originally compiled by Giuseppe Scrivano (gscrivan at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-system-prune.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-system-prune.1.md new file mode 100644 index 000000000..f6d41bf44 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-system-prune.1.md @@ -0,0 +1,76 @@ +--- +title: podman-system-prune +version: v5.5.1 +--- + +% podman-system-prune 1 + +## NAME +podman\-system\-prune - Remove all unused pods, containers, images, networks, and volume data + +## SYNOPSIS +**podman system prune** [*options*] + +## DESCRIPTION +**podman system prune** removes all unused containers (both dangling and unreferenced), build containers, pods, networks, and optionally, volumes from local storage. + +Use the **--all** option to delete all unused images. Unused images are dangling images as well as any image that does not have any containers based on it. + +By default, volumes are not removed to prevent important data from being deleted if there is currently no container using the volume. Use the **--volumes** flag when running the command to prune volumes as well. + +By default, build containers are not removed to prevent interference with builds in progress. Use the **--build** flag when running the command to remove build containers as well. + +## OPTIONS +#### **--all**, **-a** + +Recursively remove all unused pods, containers, images, networks, and volume data. (Maximum 50 iterations.) + +#### **--build** + +Removes any build containers that were created during the build, but were not removed because the build was unexpectedly terminated. + +Note: **This is not safe operation and should be executed only when no builds are in progress. It can interfere with builds in progress.** + +#### **--external** + +Tries to clean up remainders of previous containers or layers that are not references in the storage json files. These can happen in the case of unclean shutdowns or regular restarts in transient storage mode. + +However, when using transient storage mode, the Podman database does not persist. This means containers leave the writable layers on disk after a reboot. When using a transient store, it is recommended that the **podman system prune --external** command is run during boot. + +This option is incompatible with **--all** and **--filter** and drops the default behaviour of removing unused resources. + +#### **--filter**=*filters* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------:|-----------------------------------------------------------------------------------------------------------------| +| label | Only remove containers and images, with (or without, in the case of label!=[...] is used) the specified labels. | +| until | Only remove containers and images created before given timestamp. | + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes containers and images with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes containers and images without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not prompt for confirmation + +#### **--help**, **-h** + +Print usage statement + +#### **--volumes** + +Prune volumes currently unused by any container + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)** + +## HISTORY +February 2019, Originally compiled by Dan Walsh (dwalsh at redhat dot com) +December 2020, converted filter information from docs.docker.com documentation by Dan Walsh (dwalsh at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-system-renumber.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-system-renumber.1.md new file mode 100644 index 000000000..a7c392b86 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-system-renumber.1.md @@ -0,0 +1,31 @@ +--- +title: podman-system-renumber +version: v5.5.1 +--- + +% podman-system-renumber 1 + +## NAME +podman\-system\-renumber - Migrate lock numbers to handle a change in maximum number of locks + +## SYNOPSIS +**podman system renumber** + +## DESCRIPTION +**podman system renumber** renumbers locks used by containers and pods. + +Each Podman container and pod is allocated a lock at creation time, up to a maximum number controlled by the **num_locks** parameter in **containers.conf**. + +When all available locks are exhausted, no further containers and pods can be created until some existing containers and pods are removed. This can be avoided by increasing the number of locks available via modifying **containers.conf** and subsequently running **podman system renumber** to prepare the new locks (and reallocate lock numbers to fit the new struct). + +**podman system renumber** must be called after any changes to **num_locks** - failure to do so results in errors starting Podman as the number of locks available conflicts with the configured number of locks. + +**podman system renumber** can also be used to migrate 1.0 and earlier versions of Podman, which used a different locking scheme, to the new locking model. It is not strictly required to do this, but it is highly recommended to do so as deadlocks can occur otherwise. + +If possible, avoid calling **podman system renumber** while there are other Podman processes running. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +## HISTORY +February 2019, Originally compiled by Matt Heon (mheon at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-system-reset.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-system-reset.1.md new file mode 100644 index 000000000..ad2c5f61c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-system-reset.1.md @@ -0,0 +1,74 @@ +--- +title: podman-system-reset +version: v5.5.1 +--- + +% podman-system-reset 1 + +## NAME +podman\-system\-reset - Reset storage back to initial state + +## SYNOPSIS +**podman system reset** [*options*] + +## DESCRIPTION +**podman system reset** removes all pods, containers, images, networks and volumes, and machines. +It also removes the configured graphRoot and runRoot directories. Make sure these are not set to +some important directory. + +This command must be run **before** changing any of the following fields in the +`containers.conf` or `storage.conf` files: `driver`, `static_dir`, `tmp_dir` +or `volume_path`. + +`podman system reset` reads the current configuration and attempts to remove all +of the relevant configurations. If the administrator modified the configuration files first, +`podman system reset` might not be able to clean up the previous storage. + +`podman system reset` does not restart podman.service and podman.socket systemd units. You may need to manually restart it after running this command. + +## OPTIONS +#### **--force**, **-f** + +Do not prompt for confirmation + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Reset all storage back to a clean initialized state. +``` +$ podman system reset +WARNING! This will remove: + - all containers + - all pods + - all images + - all networks + - all build cache + - all machines + - all volumes + - the graphRoot directory: /var/lib/containers/storage + - the runRoot directory: /run/containers/storage +Are you sure you want to continue? [y/N] y +``` + +### Switching rootless user from VFS driver to overlay with fuse-overlayfs + +If the user ran rootless containers without having the `fuse-overlayfs` program +installed, podman defaults to the `vfs` storage in their home directory. If they +want to switch to use fuse-overlay, they must install the fuse-overlayfs +package. The user needs to reset the storage to use overlayfs by default. +Execute `podman system reset` as the user first to remove the VFS storage. Now +the user can edit the `/etc/containers/storage.conf` to make any changes if +necessary. If the system's default was already `overlay`, then no changes are +necessary to switch to fuse-overlayfs. Podman looks for the existence of +fuse-overlayfs to use it when set in the `overlay` driver, only falling back to vfs +if the program does not exist. Users can run `podman info` to ensure Podman is +using fuse-overlayfs and the overlay driver. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[fuse-overlayfs(1)](https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)** + +## HISTORY +November 2019, Originally compiled by Dan Walsh (dwalsh at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-system-service.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-system-service.1.md new file mode 100644 index 000000000..07c689a02 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-system-service.1.md @@ -0,0 +1,146 @@ +--- +title: podman-system-service +version: v5.5.1 +--- + +% podman-system-service 1 + +## NAME +podman\-system\-service - Run an API service + +## SYNOPSIS +**podman system service** [*options*] + +## DESCRIPTION +The **podman system service** command creates a listening service that answers API calls for Podman. +The command is available on Linux systems and is usually executed in systemd services. +The command is not available when the Podman command is executed directly on a Windows or macOS +host or in other situations where the Podman command is accessing a remote Podman API service. + +The REST API provided by **podman system service** is split into two parts: a compatibility layer offering support for the Docker v1.40 API, and a Podman-native Libpod layer. +Documentation for the latter is available at *https://docs.podman.io/en/latest/_static/api.html*. +Both APIs are versioned, but the server does not reject requests with an unsupported version set. + +### Run the command in a systemd service + +The command **podman system service** supports systemd socket activation. +When the command is run in a systemd service, the API service can therefore be provided on demand. +If the systemd service is not already running, it will be activated as soon as +a client connects to the listening socket. Systemd then executes the +**podman system service** command. +After some time of inactivity, as defined by the __--time__ option, the command terminates. +Systemd sets the _podman.service_ state as inactive. At this point there is no +**podman system service** process running. No unnecessary compute resources are wasted. +As soon as another client connects, systemd activates the systemd service again. + +The systemd unit files that declares the Podman API service for users are + +* _/usr/lib/systemd/user/podman.service_ +* _/usr/lib/systemd/user/podman.socket_ + +In the file _podman.socket_ the path of the listening Unix socket is defined by + +``` +ListenStream=%t/podman/podman.sock +``` + +The path contains the systemd specifier `%t` which systemd expands to the value of the environment variable +`XDG_RUNTIME_DIR` (see systemd specifiers in the **systemd.unit(5)** man page). + +In addition to the systemd user services, there is also a systemd system service _podman.service_. +It runs rootful Podman and is accessed from the Unix socket _/run/podman/podman.sock_. See the systemd unit files + +* _/usr/lib/systemd/system/podman.service_ +* _/usr/lib/systemd/system/podman.socket_ + +The **podman system service** command does not support more than one listening socket for the API service. + +Note: The default systemd unit files (system and user) change the log-level option to *info* from *error*. This change provides additional information on each API call. + +### Run the command directly + +To support running an API service without using a systemd service, the command also takes an +optional endpoint argument for the API in URI form. For example, *unix:///tmp/foobar.sock* or *tcp://localhost:8080*. +If no endpoint is provided, defaults is used. The default endpoint for a rootful +service is *unix:///run/podman/podman.sock* and rootless is *unix://$XDG_RUNTIME_DIR/podman/podman.sock* (for +example *unix:///run/user/1000/podman/podman.sock*) + +### Access the Unix socket from inside a container + +To access the API service inside a container: +- mount the socket as a volume +- run the container with `--security-opt label=disable` + +### Security + +Please note that the API grants full access to all Podman functionality, and thus allows arbitrary code execution as the user running the API, with no ability to limit or audit this access. +The API's security model is built upon access via a Unix socket with access restricted via standard file permissions, ensuring that only the user running the service will be able to access it. +We *strongly* recommend against making the API socket available via the network (IE, bindings the service to a *tcp* URL). +Even access via Localhost carries risks - anyone with access to the system will be able to access the API. +If remote access is required, we instead recommend forwarding the API socket via SSH, and limiting access on the remote machine to the greatest extent possible. +If a *tcp* URL must be used, using the *--cors* option is recommended to improve security. + +## OPTIONS + +#### **--cors** + +CORS headers to inject to the HTTP response. The default value is empty string which disables CORS headers. + +#### **--help**, **-h** + +Print usage statement. + +#### **--time**, **-t** + +The time until the session expires in _seconds_. The default is 5 +seconds. A value of `0` means no timeout, therefore the session does not expire. + +The default timeout can be changed via the `service_timeout=VALUE` field in containers.conf. +See **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** for more information. + +## EXAMPLES + +Start the user systemd socket for a rootless service. +``` +systemctl --user start podman.socket +``` + +Configure DOCKER_HOST environment variable to point to the Podman socket so that +it can be used via Docker API tools like docker-compose. +``` +$ export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock +$ docker-compose up +``` + +Configure the systemd socket to be automatically started after reboots, and run as the specified user. +``` +systemctl --user enable podman.socket +loginctl enable-linger +``` + +Start the systemd socket for the rootful service. +``` +sudo systemctl start podman.socket +``` + +Configure the socket to be automatically started after reboots. +``` +sudo systemctl enable podman.socket +``` + +It is possible to run the API without using systemd socket activation. +In this case the API will not be available on demand because the command will +stay terminated after the inactivity timeout has passed. +Run an API with an inactivity timeout of 5 seconds without using socket activation. +``` +podman system service --time 5 +``` + +The default socket was used as no URI argument was provided. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +## HISTORY +January 2020, Originally compiled by Brent Baude `` +November 2020, Updated by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-system.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-system.1.md new file mode 100644 index 000000000..b91a1b65d --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-system.1.md @@ -0,0 +1,33 @@ +--- +title: podman-system +version: v5.5.1 +--- + +% podman-system 1 + +## NAME +podman\-system - Manage podman + +## SYNOPSIS +**podman system** *subcommand* + +## DESCRIPTION +The system command allows management of the podman systems + +## COMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------------------ | ------------------------------------------------------------------------ | +| check | [podman-system-check(1)](podman-system-check.1.md) | Perform consistency checks on image and container storage. +| connection | [podman-system-connection(1)](podman-system-connection.1.md) | Manage the destination(s) for Podman service(s) | +| df | [podman-system-df(1)](podman-system-df.1.md) | Show podman disk usage. | +| events | [podman-events(1)](podman-events.1.md) | Monitor Podman events | +| info | [podman-info(1)](podman-info.1.md) | Display Podman related system information. | +| migrate | [podman-system-migrate(1)](podman-system-migrate.1.md) | Migrate existing containers to a new podman version. | +| prune | [podman-system-prune(1)](podman-system-prune.1.md) | Remove all unused pods, containers, images, networks, and volume data. | +| renumber | [podman-system-renumber(1)](podman-system-renumber.1.md) | Migrate lock numbers to handle a change in maximum number of locks. | +| reset | [podman-system-reset(1)](podman-system-reset.1.md) | Reset storage back to initial state. | +| service | [podman-system-service(1)](podman-system-service.1.md) | Run an API service | + +## SEE ALSO +**[podman(1)](podman.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-systemd.unit.5.md b/versioned_docs/version-5.5.1/source/markdown/podman-systemd.unit.5.md new file mode 100644 index 000000000..b83073240 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-systemd.unit.5.md @@ -0,0 +1,2188 @@ +--- +title: Restart service when sleep finishes +version: v5.5.1 +--- + +% podman-systemd.unit 5 + +## NAME + +podman\-systemd.unit - systemd units using Podman Quadlet + +## SYNOPSIS + +*name*.container, *name*.volume, *name*.network, *name*.kube *name*.image, *name*.build *name*.pod + +### Podman rootful unit search path + +Quadlet files for the root user can be placed in the following directories ordered in precedence. Meaning duplicate named quadlets found under /run take precedence over ones in /etc, as well as those in /usr: + +Temporary quadlets, usually used for testing: + +* /run/containers/systemd/ + +System administrator's defined quadlets: + +* /etc/containers/systemd/ + +Distribution defined quadlets: + +* /usr/share/containers/systemd/ + +### Podman rootless unit search path + +Quadlet files for non-root users can be placed in the following directories: + + * $XDG_RUNTIME_DIR/containers/systemd/ + * $XDG_CONFIG_HOME/containers/systemd/ or ~/.config/containers/systemd/ + * /etc/containers/systemd/users/$(UID) + * /etc/containers/systemd/users/ + +### Using symbolic links + +Quadlet supports using symbolic links for the base of the search paths and inside them. + +## DESCRIPTION + +Podman supports building and starting containers (and creating volumes) via systemd by using a +[systemd generator](https://www.freedesktop.org/software/systemd/man/systemd.generator.html). +These files are read during boot (and when `systemctl daemon-reload` is run) and generate +corresponding regular systemd service unit files. Both system and user systemd units are supported. +All options and tables available in standard systemd unit files are supported. For example, options defined in +the [Service] table and [Install] tables pass directly to systemd and are handled by it. +See systemd.unit(5) man page for more information. + +The Podman generator reads the search paths above and reads files with the extensions `.container` +`.volume`, `.network`, `.build`, `.pod` and `.kube`, and for each file generates a similarly named `.service` file. Be aware that +existing vendor services (i.e., in `/usr/`) are replaced if they have the same name. The generated unit files can +be started and managed with `systemctl` like any other systemd service. `systemctl {--user} list-unit-files` +lists existing unit files on the system. + +The Podman files use the same format as [regular systemd unit files](https://www.freedesktop.org/software/systemd/man/systemd.syntax.html). +Each file type has a custom section (for example, `[Container]`) that is handled by Podman, and all +other sections are passed on untouched, allowing the use of any normal systemd configuration options +like dependencies or cgroup limits. + +The source files also support drop-ins in the same [way systemd does](https://www.freedesktop.org/software/systemd/man/latest/systemd.unit.html). +For a given source file (`foo.container`), the corresponding `.d` directory (`foo.container.d`) will +be scanned for files with a `.conf` extension, which are then merged into the base file in alphabetical +order. Top-level type drop-ins (`container.d`) will also be included. If the unit contains dashes ("-") +in the name (`foo-bar-baz.container`), then the drop-in directories generated by truncating the name after +the dash are searched as well (`foo-.container.d` and `foo-bar-.container.d`). Drop-in files with the same name +further down the hierarchy override those further up (`foo-bar-baz.container.d/10-override.conf` overrides +`foo-bar-.container.d/10-override.conf`, which overrides `foo-.service.d/10-override.conf`, which overrides +`container.d/10-override.conf`). The format of these drop-in files is the same as the base file. This is useful +to alter or add configuration settings for a unit, without having to modify unit files. + +For rootless containers, when administrators place Quadlet files in the +/etc/containers/systemd/users directory, all users' sessions execute the +Quadlet when the login session begins. If the administrator places a Quadlet +file in the /etc/containers/systemd/users/${UID}/ directory, then only the +user with the matching UID executes the Quadlet when the login +session gets started. For unit files placed in subdirectories within +/etc/containers/systemd/user/${UID}/ and the other user unit search paths, +Quadlet will recursively search and run the unit files present in these subdirectories. + +Note: When a Quadlet is starting, Podman often pulls or builds one more container images which may take a considerable amount of time. +Systemd defaults service start time to 90 seconds, or fails the service. Pre-pulling the image or extending +the systemd timeout time for the service using the *TimeoutStartSec* Service option can fix the problem. +A word of caution: *TimeoutStartSec* is not available for `Type=oneshot` units. Refer to `systemd.service(5)` +for more information on how to handle long startup times for units which do not need to stay active +once their main process has finished. + +Adding the following snippet to a Quadlet file extends the systemd timeout to 15 minutes. + +``` +[Service] +TimeoutStartSec=900 +``` + +Quadlet requires the use of cgroup v2, use `podman info --format {{.Host.CgroupsVersion}}` to check on the system. + +### Service Type + +By default, the `Type` field of the `Service` section of the Quadlet file does not need to be set. +Quadlet will set it to `notify` for `.container` and `.kube` files, +`forking` for `.pod` files, and `oneshot` for `.volume`, `.network`, `.build`, and `.image` files. + +However, `Type` may be explicitly set to `oneshot` for `.container` and `.kube` files when no containers are expected +to run once `podman` exits. + +When setting `Type=oneshot`, it is recommended to also set `RemainAfterExit=yes` to prevent the service state +from becoming `inactive (dead)`. However, when activating a service via a timer unit, having `RemainAfterExit=yes` +leaves the job in a "started" state which prevents subsequent activations by the timer. For more information, see the +`systemd.service(5)` man page. + +Examples for such cases: +- `.container` file with an image that exits after their entrypoint has finished + +- `.kube` file pointing to a Kubernetes Yaml file that does not define any containers. E.g. PVCs only + +### Enabling unit files + +The services created by Podman are considered transient by systemd, which means they don't have the same +persistence rules as regular units. In particular, it is not possible to `systemctl enable` them +in order for them to become automatically enabled on the next boot. + +To compensate for this, the generator manually applies the `[Install]` section of the container definition +unit files during generation, in the same way `systemctl enable` does when run later. + +For example, to start a container on boot, add something like this to the file: + +``` +[Install] +WantedBy=default.target +``` + +Currently, only the `Alias`, `WantedBy`, `RequiredBy`, and `UpheldBy` keys are supported. + +The Install section can be part of the main file, or it can be in a +separate drop-in file as described above. The latter allows you to +install an non-enabled unit and then later enabling it by installing +the drop-in. + +### Template files + +Systemd supports a concept of [template files](https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html#Service%20Templates). +They are units with names of the form "basename@instancename.service" +when they are running, but that can be instantiated multiple times +from a single "basename@.service" file. The individual instances can +also be different by using drop-in files with the full instance name. + +Quadlets support these in two ways. First of all, a quadlet unit with +a template form will generate a systemd service with a template form, +and the template systemd service can be used as a regular template. +For example, "foo@.container" will generate "foo@.service" and you can +then "systemctl start foo@bar.service". + +Secondly, if you make a symlink like "foo@instance.container", that +will generate an instantiated template file. When generating this file +quadlet will read drop-in files both from the instanced directory +(foo@instance.container.d) and the template directory +(foo@.container.d). This allows customization of individual instances. + +Instanced template files (like `foo@bar.container`) can be enabled +just like non-templated ones. However, templated ones +(`foo@.container`) are different, because they need to be +instantiated. If the `[Install]` section contains a `DefaultInstance=` +key, then that instance will be enabled, but if not, nothing will +happen and the options will only be used as the default for units +that are instantiated using symlinks. + +An example template file `sleep@.container` might look like this: + +``` +[Unit] +Description=A templated sleepy container + +[Container] +Image=quay.io/fedora/fedora +Exec=sleep %i + +[Service] +# Restart service when sleep finishes +Restart=always + +[Install] +WantedBy=multi-user.target +DefaultInstance=100 +``` + +If this is installed, then on boot there will be a `sleep@100.service` +running that sleeps for 100 seconds. You can then do something like +`systemctl start sleep@50.service` to start another instance that +sleeps 50 seconds, or alternatively another service can start it via a +dependency like `Wants=sleep@50.service`. + +In addition, if you do `ln -s sleep@.container sleep@10.container` you +will also have a 10 second sleep running at boot. And, if you want +that particular instance to be running with another image, you can +create a drop-in file like `sleep@10.container.d/10-image.conf`: +``` +[Container] +Image=quay.io/centos/centos +``` + +### Relative paths + +In order to support Systemd specifiers, Quadlet does not resolve relative paths that start with `%`. +To resolve such a path, prepend it with `./`. + +For example, instead of `EnvironmentFile=%n/env` use `EnvironmentFile=./%n/env` + +### Debugging unit files + +After placing the unit file in one of the unit search paths (mentioned +above), you can start it with `systemctl start {--user}`. If it fails +with "Failed to start example.service: Unit example.service not +found.", then it is possible that you used incorrect syntax or you +used an option from a newer version of Podman Quadlet and the +generator failed to create a service file. + +View the generated files and/or error messages with: +``` +/usr/lib/systemd/system-generators/podman-system-generator {--user} --dryrun +``` + +Alternatively, show only the errors with: +``` +systemd-analyze {--user} --generators=true verify example.service +``` + +That command also performs additional checks on the generated service unit. +For details, see systemd-analyze(1) man page. + +#### Debugging a limited set of unit files + +If you would like to debug a limited set of unit files, you can copy them to a separate directory and set the +`QUADLET_UNIT_DIRS` environment variable to this directory when running the command below: + +``` +QUADLET_UNIT_DIRS= /usr/lib/systemd/system-generators/podman-system-generator {--user} --dryrun +``` + +This will instruct Quadlet to look for units in this directory instead of the common ones and by +that limit the output to only the units you are debugging. + +### Implicit network dependencies + +Quadlet will add dependencies on `network-online.target` (as root) or `podman-user-wait-network-online.service` +(as user) by adding `After=` and `Wants=` properties to the unit. This is to ensure that the network is reachable +if an image needs to be pulled and by the time the container is started. + +The special case `podman-user-wait-network-online.service` unit is needed as user because user units are unable to wait +for system (root) units so `network-online.target` doesn't do anything there and is instead ignored. As this caused +a significant amount of issues we decided to work around this with our own special purpose unit that simply checks if +the `network-online.target` unit is active with `systemctl is-active network-online.target`. + +This behavior can be disabled by adding `DefaultDependencies=false` in the `Quadlet` section. +Note, the _systemd_ `[Unit]` section has an option with the same name but a different meaning. + +### Dependency between Quadlet units + +Quadlet will automatically translate dependencies, specified in the keys +`Wants`, `Requires`, `Requisite`, `BindsTo`, `PartOf`, `Upholds`, `Conflicts`, `Before` and `After` +of the `[Unit]` section, between different Quadlet units. + +For example the `fedora.container` unit below specifies a dependency on the `basic.container` unit. +``` +[Unit] +After=basic.container +Requires=basic.container + +[Container] +Image=registry.fedoraproject.org/fedora:41 +``` + +## Container units [Container] + +Container units are named with a `.container` extension and contain a `[Container]` section describing +the container that is run as a service. The resulting service file contains a line like +`ExecStart=podman run … image-name`, and most of the keys in this section control the command-line +options passed to Podman. However, some options also affect the details of how systemd is set up to run and +interact with the container. + +By default, the Podman container has the same name as the unit, but with a `systemd-` prefix, i.e. +a `$name.container` file creates a `$name.service` unit and a `systemd-$name` Podman container. The +`ContainerName` option allows for overriding this default name with a user-provided one. + +There is only one required key, `Image`, which defines the container image the service runs. + +Valid options for `[Container]` are listed below: + +| **[Container] options** | **podman run equivalent** | +|--------------------------------------|------------------------------------------------------| +| AddCapability=CAP | --cap-add CAP | +| AddDevice=/dev/foo | --device /dev/foo | +| AddHost=example\.com:192.168.10.11 | --add-host example.com:192.168.10.11 | +| Annotation="XYZ" | --annotation "XYZ" | +| AutoUpdate=registry | --label "io.containers.autoupdate=registry" | +| CgroupsMode=no-conmon | --cgroups=no-conmon | +| ContainerName=name | --name name | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| DNS=192.168.55.1 | --dns=192.168.55.1 | +| DNSOption=ndots:1 | --dns-option=ndots:1 | +| DNSSearch=example.com | --dns-search example.com | +| DropCapability=CAP | --cap-drop=CAP | +| Entrypoint=/foo.sh | --entrypoint=/foo.sh | +| Environment=foo=bar | --env foo=bar | +| EnvironmentFile=/tmp/env | --env-file /tmp/env | +| EnvironmentHost=true | --env-host | +| Exec=/usr/bin/command | Command after image specification - /usr/bin/command | +| ExposeHostPort=50-59 | --expose 50-59 | +| GIDMap=0:10000:10 | --gidmap=0:10000:10 | +| GlobalArgs=--log-level=debug | --log-level=debug | +| Group=1234 | --user UID:1234 | +| GroupAdd=keep-groups | --group-add=keep-groups | +| HealthCmd=/usr/bin/command | --health-cmd=/usr/bin/command | +| HealthInterval=2m | --health-interval=2m | +| HealthLogDestination=/foo/log | --health-log-destination=/foo/log | +| HealthMaxLogCount=5 | --health-max-log-count=5 | +| HealthMaxLogSize=500 | --health-max-log-size=500 | +| HealthOnFailure=kill | --health-on-failure=kill | +| HealthRetries=5 | --health-retries=5 | +| HealthStartPeriod=1m | --health-start-period=period=1m | +| HealthStartupCmd=command | --health-startup-cmd=command | +| HealthStartupInterval=1m | --health-startup-interval=1m | +| HealthStartupRetries=8 | --health-startup-retries=8 | +| HealthStartupSuccess=2 | --health-startup-success=2 | +| HealthStartupTimeout=1m33s | --health-startup-timeout=1m33s | +| HealthTimeout=20s | --health-timeout=20s | +| HostName=example.com | --hostname example.com | +| Image=ubi8 | Image specification - ubi8 | +| IP=192.5.0.1 | --ip 192.5.0.1 | +| IP6=2001:db8::1 | --ip6 2001:db8::1 | +| Label="XYZ" | --label "XYZ" | +| LogDriver=journald | --log-driver journald | +| LogOpt=path=/var/log/mykube\.json | --log-opt path=/var/log/mykube\.json | +| Mask=/proc/sys/foo\:/proc/sys/bar | --security-opt mask=/proc/sys/foo:/proc/sys/bar | +| Memory=20g | --memory 20g | +| Mount=type=... | --mount type=... | +| Network=host | --network host | +| NetworkAlias=name | --network-alias name | +| NoNewPrivileges=true | --security-opt no-new-privileges | +| Notify=true | --sdnotify container | +| PidsLimit=10000 | --pids-limit 10000 | +| Pod=pod-name | --pod=pod-name | +| PodmanArgs=--publish 8080:80 | --publish 8080:80 | +| PublishPort=8080:80 | --publish 8080:80 | +| Pull=never | --pull never | +| ReadOnly=true | --read-only | +| ReadOnlyTmpfs=true | --read-only-tmpfs | +| ReloadCmd=/usr/bin/command | Add ExecReload and run exec with the value | +| ReloadSignal=SIGHUP | Add ExecReload and run kill with the signal | +| Retry=5 | --retry=5 | +| RetryDelay=5s | --retry-delay=5s | +| Rootfs=/var/lib/rootfs | --rootfs /var/lib/rootfs | +| RunInit=true | --init | +| SeccompProfile=/tmp/s.json | --security-opt seccomp=/tmp/s.json | +| Secret=secret | --secret=secret[,opt=opt ...] | +| SecurityLabelDisable=true | --security-opt label=disable | +| SecurityLabelFileType=usr_t | --security-opt label=filetype:usr_t | +| SecurityLabelLevel=s0:c1,c2 | --security-opt label=level\:s0\:c1,c2 | +| SecurityLabelNested=true | --security-opt label=nested | +| SecurityLabelType=spc_t | --security-opt label=type\:spc_t | +| ShmSize=100m | --shm-size=100m | +| StartWithPod=true | If Pod= is defined, container is started by pod | +| StopSignal=SIGINT | --stop-signal=SIGINT | +| StopTimeout=20 | --stop-timeout=20 | +| SubGIDMap=gtest | --subgidname=gtest | +| SubUIDMap=utest | --subuidname=utest | +| Sysctl=name=value | --sysctl=name=value | +| Timezone=local | --tz local | +| Tmpfs=/work | --tmpfs /work | +| UIDMap=0:10000:10 | --uidmap=0:10000:10 | +| Ulimit=nofile=1000:10000 | --ulimit nofile=1000:10000 | +| Unmask=ALL | --security-opt unmask=ALL | +| User=bin | --user bin | +| UserNS=keep-id\:uid=200,gid=210 | --userns keep-id:uid=200,gid=210 | +| Volume=/source:/dest | --volume /source:/dest | +| WorkingDir=$HOME | --workdir $HOME | + +Description of `[Container]` section are: + +### `AddCapability=` + +Add these capabilities, in addition to the default Podman capability set, to the container. + +This is a space separated list of capabilities. This key can be listed multiple times. + +For example: +``` +AddCapability=CAP_DAC_OVERRIDE CAP_IPC_OWNER +``` + +### `AddDevice=` + +Adds a device node from the host into the container. The format of this is +`HOST-DEVICE[\:CONTAINER-DEVICE][:PERMISSIONS]`, where `HOST-DEVICE` is the path of +the device node on the host, `CONTAINER-DEVICE` is the path of the device node in +the container, and `PERMISSIONS` is a list of permissions combining 'r' for read, +'w' for write, and 'm' for mknod(2). The `-` prefix tells Quadlet to add the device +only if it exists on the host. + +This key can be listed multiple times. + +### `AddHost=` + +Add host-to-IP mapping to /etc/hosts. +The format is `hostname\:ip`. + +Equivalent to the Podman `--add-host` option. +This key can be listed multiple times. + +### `Annotation=` + +Set one or more OCI annotations on the container. The format is a list of `key=value` items, +similar to `Environment`. + +This key can be listed multiple times. + +### `AutoUpdate=` + +Indicates whether the container will be auto-updated ([podman-auto-update(1)](podman-auto-update.1.md)). The following values are supported: + +* `registry`: Requires a fully-qualified image reference (e.g., quay.io/podman/stable:latest) to be used to create the container. This enforcement is necessary to know which image to actually check and pull. If an image ID was used, Podman does not know which image to check/pull anymore. + +* `local`: Tells Podman to compare the image a container is using to the image with its raw name in local storage. If an image is updated locally, Podman simply restarts the systemd unit executing the container. + +### `CgroupsMode=` + +The cgroups mode of the Podman container. Equivalent to the Podman `--cgroups` option. + +By default, the cgroups mode of the container created by Quadlet is `split`, +which differs from the default (`enabled`) used by the Podman CLI. + +If the container joins a pod (i.e. `Pod=` is specified), you may want to change this to +`no-conmon` or `enabled` so that pod level cgroup resource limits can take effect. + +### `ContainerName=` + +The (optional) name of the Podman container. If this is not specified, the default value +of `systemd-%N` is used, which is the same as the service name but with a `systemd-` +prefix to avoid conflicts with user-managed containers. + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `DNS=` + +Set network-scoped DNS resolver/nameserver for containers in this network. + +This key can be listed multiple times. + +### `DNSOption=` + +Set custom DNS options. + +This key can be listed multiple times. + +### `DNSSearch=` + +Set custom DNS search domains. Use **DNSSearch=.** to remove the search domain. + +This key can be listed multiple times. + +### `DropCapability=` + +Drop these capabilities from the default podman capability set, or `all` to drop all capabilities. + +This is a space separated list of capabilities. This key can be listed multiple times. + +For example: +``` +DropCapability=CAP_DAC_OVERRIDE CAP_IPC_OWNER +``` + +### `Entrypoint=` + +Override the default ENTRYPOINT from the image. +Equivalent to the Podman `--entrypoint` option. +Specify multi option commands in the form of a JSON string. + +### `Environment=` + +Set an environment variable in the container. This uses the same format as +[services in systemd](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Environment=) +and can be listed multiple times. + +### `EnvironmentFile=` + +Use a line-delimited file to set environment variables in the container. +The path may be absolute or relative to the location of the unit file. +This key may be used multiple times, and the order persists when passed to `podman run`. + +### `EnvironmentHost=` + +Use the host environment inside of the container. + +### `Exec=` + +Additional arguments for the container; this has exactly the same effect as passing +more arguments after a `podman run ` invocation. + +The format is the same as for [systemd command lines](https://www.freedesktop.org/software/systemd/man/systemd.service.html#Command%20lines), +However, unlike the usage scenario for similarly-named systemd `ExecStart=` verb +which operates on the ambient root filesystem, it is very common for container +images to have their own `ENTRYPOINT` or `CMD` metadata which this interacts with. + +The default expectation for many images is that the image will include an `ENTRYPOINT` +with a default binary, and this field will add arguments to that entrypoint. + +Another way to describe this is that it works the same way as the [args field in a Kubernetes pod](https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell). + +### `ExposeHostPort=` + +Exposes a port, or a range of ports (e.g. `50-59`), from the host to the container. Equivalent +to the Podman `--expose` option. + +This key can be listed multiple times. + +### `GIDMap=` + +Run the container in a new user namespace using the supplied GID mapping. +Equivalent to the Podman `--gidmap` option. + +This key can be listed multiple times. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `run` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Group=` + +The (numeric) GID to run as inside the container. This does not need to match the GID on the host, +which can be modified with `UserNS`, but if that is not specified, this GID is also used on the host. + +### `GroupAdd=` + +Assign additional groups to the primary user running within the container process. Also supports the `keep-groups` special flag. +Equivalent to the Podman `--group-add` option. + +### `HealthCmd=` + +Set or alter a healthcheck command for a container. A value of none disables existing healthchecks. +Equivalent to the Podman `--health-cmd` option. + +### `HealthInterval=` + +Set an interval for the healthchecks. An interval of disable results in no automatic timer setup. +Equivalent to the Podman `--health-interval` option. + +### `HealthLogDestination=` + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) +(Default: local) +Equivalent to the Podman `--health-log-destination` option. + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. + +### `HealthMaxLogCount=` + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) +(Default: 5 attempts) +Equivalent to the Podman `--Health-max-log-count` option. + +### `HealthMaxLogSize=` + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) +(Default: 500 characters) +Equivalent to the Podman `--Health-max-log-size` option. + +### `HealthOnFailure=` + +Action to take once the container transitions to an unhealthy state. +The "kill" action in combination integrates best with systemd. Once +the container turns unhealthy, it gets killed, and systemd restarts the +service. +Equivalent to the Podman `--health-on-failure` option. + +### `HealthRetries=` + +The number of retries allowed before a healthcheck is considered to be unhealthy. +Equivalent to the Podman `--health-retries` option. + +### `HealthStartPeriod=` + +The initialization time needed for a container to bootstrap. +Equivalent to the Podman `--health-start-period` option. + +### `HealthStartupCmd=` + +Set a startup healthcheck command for a container. +Equivalent to the Podman `--health-startup-cmd` option. + +### `HealthStartupInterval=` + +Set an interval for the startup healthcheck. An interval of disable results in no automatic timer setup. +Equivalent to the Podman `--health-startup-interval` option. + +### `HealthStartupRetries=` + +The number of attempts allowed before the startup healthcheck restarts the container. +Equivalent to the Podman `--health-startup-retries` option. + +### `HealthStartupSuccess=` + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. +Equivalent to the Podman `--health-startup-success` option. + +### `HealthStartupTimeout=` + +The maximum time a startup healthcheck command has to complete before it is marked as failed. +Equivalent to the Podman `--health-startup-timeout` option. + +### `HealthTimeout=` + +The maximum time allowed to complete the healthcheck before an interval is considered failed. +Equivalent to the Podman `--health-timeout` option. + +### `HostName=` + +Sets the host name that is available inside the container. +Equivalent to the Podman `--hostname` option. + +### `Image=` + +The image to run in the container. +It is recommended to use a fully qualified image name rather than a short name, both for +performance and robustness reasons. + +The format of the name is the same as when passed to `podman pull`. So, it supports using +`\:tag` or digests to guarantee the specific image version. + +Special Cases: + +* If the `name` of the image ends with `.image`, Quadlet will use the image pulled by the corresponding `.image` file, and the generated systemd service contains a dependency on the `$name-image.service` (or the service name set in the .image file). Note that the corresponding `.image` file must exist. +* If the `name` of the image ends with `.build`, Quadlet will use the image built by the corresponding `.build` file, and the generated systemd service contains a dependency on the `$name-build.service`. Note: the corresponding `.build` file must exist. + +### `IP=` + +Specify a static IPv4 address for the container, for example **10.88.64.128**. +Equivalent to the Podman `--ip` option. + +### `IP6=` + +Specify a static IPv6 address for the container, for example **fd46\:db93\:aa76\:ac37::10**. +Equivalent to the Podman `--ip6` option. + +### `Label=` + +Set one or more OCI labels on the container. The format is a list of `key=value` items, +similar to `Environment`. + +This key can be listed multiple times. + +### `LogDriver=` + +Set the log-driver used by Podman when running the container. +Equivalent to the Podman `--log-driver` option. + +### `LogOpt=` + +Set the log-opt (logging options) used by Podman when running the container. +Equivalent to the Podman `--log-opt` option. +This key can be listed multiple times. + +### `Mask=` + +Specify the paths to mask separated by a colon. `Mask=/path/1:/path/2`. A masked path cannot be accessed inside the container. + +### `Memory=` + +Specify the amount of memory for the container. + +### `Mount=` + +Attach a filesystem mount to the container. +This is equivalent to the Podman `--mount` option, and +generally has the form `type=TYPE,TYPE-SPECIFIC-OPTION[,...]`. + +Special cases: + +* For `type=volume`, if `source` ends with `.volume`, the Podman named volume generated by the corresponding `.volume` file is used. +* For `type=image`, if `source` ends with `.image`, the image generated by the corresponding `.image` file is used. + +In both cases, the generated systemd service will contain a dependency on the service generated for the corresponding unit. Note: the corresponding `.volume` or `.image` file must exist. + +This key can be listed multiple times. + +### `Network=` + +Specify a custom network for the container. This has the same format as the `--network` option +to `podman run`. For example, use `host` to use the host network in the container, or `none` to +not set up networking in the container. + +Special cases: + +* If the `name` of the network ends with `.network`, a Podman network called +`systemd-$name` is used, and the generated systemd service contains +a dependency on the `$name-network.service`. Such a network can be automatically +created by using a `$name.network` Quadlet file. Note: the corresponding `.network` file must exist. + +* If the `name` ends with `.container`, +the container will reuse the network stack of another container created by `$name.container`. +The generated systemd service contains a dependency on `$name.service`. Note: the corresponding `.container` file must exist. + +This key can be listed multiple times. + +### `NetworkAlias=` + +Add a network-scoped alias for the container. This has the same format as the `--network-alias` +option to `podman run`. Aliases can be used to group containers together in DNS resolution: for +example, setting `NetworkAlias=web` on multiple containers will make a DNS query for `web` resolve +to all the containers with that alias. + +This key can be listed multiple times. + +### `NoNewPrivileges=` (defaults to `false`) + +If enabled, this disables the container processes from gaining additional privileges via things like +setuid and file capabilities. + +### `Notify=` (defaults to `false`) + +By default, Podman is run in such a way that the systemd startup notify command is handled by +the container runtime. In other words, the service is deemed started when the container runtime +starts the child in the container. However, if the container application supports +[sd_notify](https://www.freedesktop.org/software/systemd/man/sd_notify.html), then setting +`Notify` to true passes the notification details to the container allowing it to notify +of startup on its own. + +In addition, setting `Notify` to `healthy` will postpone startup notifications until such time as +the container is marked healthy, as determined by Podman healthchecks. Note that this requires +setting up a container healthcheck, see the `HealthCmd` option for more. + +### `PidsLimit=` + +Tune the container's pids limit. +This is equivalent to the Podman `--pids-limit` option. + +### `Pod=` + +Specify a Quadlet `.pod` unit to link the container to. +The value must take the form of `.pod` and the `.pod` unit must exist. + +Quadlet will add all the necessary parameters to link between the container and the pod and between their corresponding services. + + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman run` command +in the generated file (right before the image name in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `PublishPort=` + +Exposes a port, or a range of ports (e.g. `50-59`), from the container to the host. Equivalent +to the Podman `--publish` option. The format is similar to the Podman options, which is of +the form `ip\:hostPort:containerPort`, `ip::containerPort`, `hostPort:containerPort` or +`containerPort`, where the number of host and container ports must be the same (in the case +of a range). + +If the IP is set to 0.0.0.0 or not set at all, the port is bound on all IPv4 addresses on +the host; use [::] for IPv6. + +Note that not listing a host port means that Podman automatically selects one, and it +may be different for each invocation of service. This makes that a less useful option. The +allocated port can be found with the `podman port` command. + +This key can be listed multiple times. + +### `Pull=` + +Set the image pull policy. +This is equivalent to the Podman `--pull` option + +### `ReadOnly=` (defaults to `false`) + +If enabled, makes the image read-only. + +### `ReadOnlyTmpfs=` (defaults to `true`) + +If ReadOnly is set to `true`, mount a read-write tmpfs on /dev, /dev/shm, /run, /tmp, and /var/tmp. + +### `ReloadCmd=` + +Add `ExecReload` line to the `Service` that runs ` podman exec` with this command in this container. + +In order to execute the reload run `systemctl reload ` + +Mutually exclusive with `ReloadSignal` + +### `ReloadSignal=` + +Add `ExecReload` line to the `Service` that runs `podman kill` with this signal which sends the signal to the main container process. + +In order to execute the reload run `systemctl reload ` + +Mutually exclusive with `ReloadCmd` + +### `Retry=` + +Number of times to retry the image pull when a HTTP error occurs. Equivalent to the Podman `--retry` option. + +### `RetryDelay=` + +Delay between retries. Equivalent to the Podman `--retry-delay` option. + +### `Rootfs=` + +The rootfs to use for the container. Rootfs points to a directory on the system that contains the content to be run within the container. This option conflicts with the `Image` option. + +The format of the rootfs is the same as when passed to `podman run --rootfs`, so it supports overlay mounts as well. + +Note: On SELinux systems, the rootfs needs the correct label, which is by default unconfined_u\:object_r\:container_file_t\:s0. + +### `RunInit=` (defaults to `false`) + +If enabled, the container has a minimal init process inside the +container that forwards signals and reaps processes. + +### `SeccompProfile=` + +Set the seccomp profile to use in the container. If unset, the default podman profile is used. +Set to either the pathname of a JSON file, or `unconfined` to disable the seccomp filters. + +### `Secret=` + +Use a Podman secret in the container either as a file or an environment variable. +This is equivalent to the Podman `--secret` option and generally has the form `secret[,opt=opt ...]` + +### `SecurityLabelDisable=` + +Turn off label separation for the container. + +### `SecurityLabelFileType=` + +Set the label file type for the container files. + +### `SecurityLabelLevel=` + +Set the label process level for the container processes. + +### `SecurityLabelNested=` + +Allow SecurityLabels to function within the container. This allows separation of containers created within the container. + +### `SecurityLabelType=` + +Set the label process type for the container processes. + +### `ShmSize=` + +Size of /dev/shm. + +This is equivalent to the Podman `--shm-size` option and generally has the form `number[unit]` + +### `StartWithPod=` + +Start the container after the associated pod is created. Default to **true**. + +If `true`, container will be started/stopped/restarted alongside the pod. + +If `false`, the container will not be started when the pod starts. The container will be stopped with the pod. Restarting the pod will also restart the container as long as the container was also running before. + +Note, the container can still be started manually or through a target by configuring the `[Install]` section. The pod will be started as needed in any case. + +### `StopSignal=` + +Signal to stop a container. Default is **SIGTERM**. + +This is equivalent to the Podman `--stop-signal` option + +### `StopTimeout=` + +Seconds to wait before forcibly stopping the container. + +Note, this value should be lower than the actual systemd unit timeout to make sure the podman rm command is not killed by systemd. + +This is equivalent to the Podman `--stop-timeout` option + +### `SubGIDMap=` + +Run the container in a new user namespace using the map with name in the /etc/subgid file. +Equivalent to the Podman `--subgidname` option. + +### `SubUIDMap=` + +Run the container in a new user namespace using the map with name in the /etc/subuid file. +Equivalent to the Podman `--subuidname` option. + +### `Sysctl=` + +Configures namespaced kernel parameters for the container. The format is `Sysctl=name=value`. + +This is a space separated list of kernel parameters. This key can be listed multiple times. + +For example: +``` +Sysctl=net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.all.use_tempaddr=1 +``` + +### `Timezone=` (if unset uses system-configured default) + +The timezone to run the container in. + +### `Tmpfs=` + +Mount a tmpfs in the container. This is equivalent to the Podman `--tmpfs` option, and +generally has the form `CONTAINER-DIR[\:OPTIONS]`. + +This key can be listed multiple times. + +### `UIDMap=` + +Run the container in a new user namespace using the supplied UID mapping. +Equivalent to the Podman `--uidmap` option. + +This key can be listed multiple times. + +### `Ulimit=` + +Ulimit options. Sets the ulimits values inside of the container. + +This key can be listed multiple times. + +### `Unmask=` + +Specify the paths to unmask separated by a colon. unmask=ALL or /path/1:/path/2, or shell expanded paths (/proc/*): + +If set to `ALL`, Podman will unmask all the paths that are masked or made read-only by default. + +The default masked paths are /proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux. + +The default paths that are read-only are /proc/asound, /proc/bus, /proc/fs, /proc/irq, /proc/sys, /proc/sysrq-trigger, /sys/fs/cgroup. + +### `User=` + +The (numeric) UID to run as inside the container. This does not need to match the UID on the host, +which can be modified with `UserNS`, but if that is not specified, this UID is also used on the host. + +### `UserNS=` + +Set the user namespace mode for the container. This is equivalent to the Podman `--userns` option and +generally has the form `MODE[:OPTIONS,...]`. + +### `Volume=` + +Mount a volume in the container. This is equivalent to the Podman `--volume` option, and +generally has the form `[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[:OPTIONS]]`. + +If `SOURCE-VOLUME` starts with `.`, Quadlet resolves the path relative to the location of the unit file. + +Special case: + +* If `SOURCE-VOLUME` ends with `.volume`, a Podman named volume called `systemd-$name` is used as the source, and the generated systemd service contains a dependency on the `$name-volume.service`. Note that the corresponding `.volume` file must exist. + +This key can be listed multiple times. + +### `WorkingDir=` + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (/). The image developer can set a different default with the WORKDIR instruction. This option overrides the working directory by using the -w option. + +## Pod units [Pod] + +Pod units are named with a `.pod` extension and contain a `[Pod]` section describing +the pod that is created and run as a service. The resulting service file contains a line like +`ExecStartPre=podman pod create …`, and most of the keys in this section control the command-line +options passed to Podman. + +By default, the Podman pod has the same name as the unit, but with a `systemd-` prefix, i.e. +a `$name.pod` file creates a `$name-pod.service` unit and a `systemd-$name` Podman pod. The +`PodName` option allows for overriding this default name with a user-provided one. + +Valid options for `[Pod]` are listed below: + +| **[Pod] options** | **podman pod create equivalent** | +|-------------------------------------|----------------------------------------| +| AddHost=example\.com:192.168.10.11 | --add-host example.com:192.168.10.11 | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| DNS=192.168.55.1 | --dns=192.168.55.1 | +| DNSOption=ndots:1 | --dns-option=ndots:1 | +| DNSSearch=example.com | --dns-search example.com | +| GIDMap=0:10000:10 | --gidmap=0:10000:10 | +| GlobalArgs=--log-level=debug | --log-level=debug | +| HostName=name | --hostname=name | +| IP=192.5.0.1 | --ip 192.5.0.1 | +| IP6=2001\:db8::1 | --ip6 2001:db8::1 | +| Network=host | --network host | +| NetworkAlias=name | --network-alias name | +| PodmanArgs=\-\-cpus=2 | --cpus=2 | +| PodName=name | --name=name | +| PublishPort=8080:80 | --publish 8080:80 | +| ServiceName=name | Name the systemd unit `name.service` | +| ShmSize=100m | --shm-size=100m | +| SubGIDMap=gtest | --subgidname=gtest | +| SubUIDMap=utest | --subuidname=utest | +| UIDMap=0:10000:10 | --uidmap=0:10000:10 | +| UserNS=keep-id\:uid=200,gid=210 | --userns keep-id:uid=200,gid=210 | +| Volume=/source:/dest | --volume /source:/dest | + +Supported keys in the `[Pod]` section are: + +### `AddHost=` + +Add host-to-IP mapping to /etc/hosts. +The format is `hostname\:ip`. + +Equivalent to the Podman `--add-host` option. +This key can be listed multiple times. + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `DNS=` + +Set network-scoped DNS resolver/nameserver for containers in this pod. + +This key can be listed multiple times. + +### `DNSOption=` + +Set custom DNS options. + +This key can be listed multiple times. + +### `DNSSearch=` + +Set custom DNS search domains. Use **DNSSearch=.** to remove the search domain. + +This key can be listed multiple times. + +### `GIDMap=` + +Create the pod in a new user namespace using the supplied GID mapping. +Equivalent to the Podman `--gidmap` option. + +This key can be listed multiple times. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `pod` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `HostName=` + +Set the pod’s hostname inside all containers. + +The given hostname is also added to the /etc/hosts file using the container’s primary IP address (also see the `--add-host` option). + +Equivalent to the Podman `--hostname` option. +This key can be listed multiple times. + +### `IP=` + +Specify a static IPv4 address for the pod, for example **10.88.64.128**. +Equivalent to the Podman `--ip` option. + +### `IP6=` + +Specify a static IPv6 address for the pod, for example **fd46\:db93\:aa76\:ac37::10**. +Equivalent to the Podman `--ip6` option. + +### `Network=` + +Specify a custom network for the pod. +This has the same format as the `--network` option to `podman pod create`. +For example, use `host` to use the host network in the pod, or `none` to not set up networking in the pod. + +Special case: + +* If the `name` of the network ends with `.network`, Quadlet will look for the corresponding `.network` Quadlet unit. If found, Quadlet will use the name of the Network set in the Unit, otherwise, `systemd-$name` is used. + +The generated systemd service contains a dependency on the service unit generated for that `.network` unit. Note: the corresponding `.network` file must exist. + +This key can be listed multiple times. + +### `NetworkAlias=` + +Add a network-scoped alias for the pod. This has the same format as the `--network-alias` option to +`podman pod create`. Aliases can be used to group containers together in DNS resolution: for +example, setting `NetworkAlias=web` on multiple containers will make a DNS query for `web` resolve +to all the containers with that alias. + +This key can be listed multiple times. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman pod create` command +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `PodName=` + +The (optional) name of the Podman pod. If this is not specified, the default value +of `systemd-%N` is used, which is the same as the service name but with a `systemd-` +prefix to avoid conflicts with user-managed containers. + +Please note that pods and containers cannot have the same name. +So, if PodName is set, it must not conflict with any container. + +### `PublishPort=` + +Exposes a port, or a range of ports (e.g. `50-59`), from the pod to the host. Equivalent +to the Podman `--publish` option. The format is similar to the Podman options, which is of +the form `ip\:hostPort:containerPort`, `ip::containerPort`, `hostPort:containerPort` or +`containerPort`, where the number of host and container ports must be the same (in the case +of a range). + +If the IP is set to 0.0.0.0 or not set at all, the port is bound on all IPv4 addresses on +the host; use [::] for IPv6. + +Note that not listing a host port means that Podman automatically selects one, and it +may be different for each invocation of service. This makes that a less useful option. The +allocated port can be found with the `podman port` command. + +When using `host` networking via `Network=host`, the `PublishPort=` option cannot be used. + +This key can be listed multiple times. + + +### `ServiceName=` + +By default, Quadlet will name the systemd service unit by appending `-pod` to the name of the Quadlet. +Setting this key overrides this behavior by instructing Quadlet to use the provided name. + +Note, the name should not include the `.service` file extension + +### `ShmSize=` + +Size of /dev/shm. + +This is equivalent to the Podman `--shm-size` option and generally has the form `number[unit]` + +### `SubGIDMap=` + +Create the pod in a new user namespace using the map with name in the /etc/subgid file. +Equivalent to the Podman `--subgidname` option. + +### `SubUIDMap=` + +Create the pod in a new user namespace using the map with name in the /etc/subuid file. +Equivalent to the Podman `--subuidname` option. + +### `UIDMap=` + +Create the pod in a new user namespace using the supplied UID mapping. +Equivalent to the Podman `--uidmap` option. + +This key can be listed multiple times. + +### `UserNS=` + +Set the user namespace mode for the pod. This is equivalent to the Podman `--userns` option and +generally has the form `MODE[:OPTIONS,...]`. + +### `Volume=` + +Mount a volume in the pod. This is equivalent to the Podman `--volume` option, and +generally has the form `[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]`. + +If `SOURCE-VOLUME` starts with `.`, Quadlet resolves the path relative to the location of the unit file. + +Special case: + +* If `SOURCE-VOLUME` ends with `.volume`, Quadlet will look for the corresponding `.volume` Quadlet unit. If found, Quadlet will use the name of the Volume set in the Unit, otherwise, `systemd-$name` is used. Note: the corresponding `.volume` file must exist. + +The generated systemd service contains a dependency on the service unit generated for that `.volume` unit, +or on `$name-volume.service` if the `.volume` unit is not found. + +This key can be listed multiple times. + +## Kube units [Kube] + +Kube units are named with a `.kube` extension and contain a `[Kube]` section describing +how `podman kube play` runs as a service. The resulting service file contains a line like +`ExecStart=podman kube play … file.yml`, and most of the keys in this section control the command-line +options passed to Podman. However, some options also affect the details of how systemd is set up to run and +interact with the container. + +There is only one required key, `Yaml`, which defines the path to the Kubernetes YAML file. + +Valid options for `[Kube]` are listed below: + +| **[Kube] options** | **podman kube play equivalent** | +| ------------------------------------| -----------------------------------------------------------------| +| AutoUpdate=registry | --annotation "io.containers.autoupdate=registry" | +| ConfigMap=/tmp/config.map | --config-map /tmp/config.map | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| ExitCodePropagation=how | How to propagate container error status | +| GlobalArgs=--log-level=debug | --log-level=debug | +| KubeDownForce=true | --force (for `podman kube down`) | +| LogDriver=journald | --log-driver journald | +| Network=host | --network host | +| PodmanArgs=\-\-annotation=key=value | --annotation=key=value | +| PublishPort=8080:80 | --publish 8080:80 | +| SetWorkingDirectory=yaml | Set `WorkingDirectory` of unit file to location of the YAML file | +| UserNS=keep-id\:uid=200,gid=210 | --userns keep-id\:uid=200,gid=210 | +| Yaml=/tmp/kube.yaml | podman kube play /tmp/kube.yaml | + +Supported keys in the `[Kube]` section are: + +### `AutoUpdate=` + +Indicates whether containers will be auto-updated ([podman-auto-update(1)](podman-auto-update.1.md)). AutoUpdate can be specified multiple times. The following values are supported: + +* `registry`: Requires a fully-qualified image reference (e.g., quay.io/podman/stable:latest) to be used to create the container. This enforcement is necessary to know which images to actually check and pull. If an image ID was used, Podman does not know which image to check/pull anymore. + +* `local`: Tells Podman to compare the image a container is using to the image with its raw name in local storage. If an image is updated locally, Podman simply restarts the systemd unit executing the Kubernetes Quadlet. + +* `name/(local|registry)`: Tells Podman to perform the `local` or `registry` autoupdate on the specified container name. + +### `ConfigMap=` + +Pass the Kubernetes ConfigMap YAML path to `podman kube play` via the `--configmap` argument. +Unlike the `configmap` argument, the value may contain only one path but +it may be absolute or relative to the location of the unit file. + +This key may be used multiple times + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `ExitCodePropagation=` + +Control how the main PID of the systemd service should exit. The following values are supported: +- `all`: exit non-zero if all containers have failed (i.e., exited non-zero) +- `any`: exit non-zero if any container has failed +- `none`: exit zero and ignore failed containers + +The current default value is `none`. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `kube` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `KubeDownForce=` + +Remove all resources, including volumes, when calling `podman kube down`. +Equivalent to the Podman `--force` option. + +### `LogDriver=` + +Set the log-driver Podman uses when running the container. +Equivalent to the Podman `--log-driver` option. + +### `Network=` + +Specify a custom network for the container. This has the same format as the `--network` option +to `podman kube play`. For example, use `host` to use the host network in the container, or `none` to +not set up networking in the container. + +Special case: + +* If the `name` of the network ends with `.network`, a Podman network called `systemd-$name` is used, and the generated systemd service contains a dependency on the `$name-network.service`. Such a network can be automatically created by using a `$name.network` Quadlet file. Note: the corresponding `.network` file must exist. + +This key can be listed multiple times. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman kube play` command +in the generated file (right before the path to the yaml file in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `PublishPort=` + +Exposes a port, or a range of ports (e.g. `50-59`), from the container to the host. Equivalent +to the `podman kube play`'s `--publish` option. The format is similar to the Podman options, which is of +the form `ip\:hostPort:containerPort`, `ip::containerPort`, `hostPort:containerPort` or +`containerPort`, where the number of host and container ports must be the same (in the case +of a range). + +If the IP is set to 0.0.0.0 or not set at all, the port is bound on all IPv4 addresses on +the host; use [::] for IPv6. + +The list of published ports specified in the unit file is merged with the list of ports specified +in the Kubernetes YAML file. If the same container port and protocol is specified in both, the +entry from the unit file takes precedence + +This key can be listed multiple times. + +### `SetWorkingDirectory=` + +Set the `WorkingDirectory` field of the `Service` group of the Systemd service unit file. +Used to allow `podman kube play` to correctly resolve relative paths. +Supported values are `yaml` and `unit` to set the working directory to that of the YAML or Quadlet Unit file respectively. + +Alternatively, users can explicitly set the `WorkingDirectory` field of the `Service` group in the `.kube` file. +Please note that if the `WorkingDirectory` field of the `Service` group is set, +Quadlet will not set it even if `SetWorkingDirectory` is set + +### `UserNS=` + +Set the user namespace mode for the container. This is equivalent to the Podman `--userns` option and +generally has the form `MODE[\:OPTIONS,...]`. + +### `Yaml=` + +The path, absolute or relative to the location of the unit file, to the Kubernetes YAML file to use. + +## Network units [Network] + +Network files are named with a `.network` extension and contain a section `[Network]` describing the +named Podman network. The generated service is a one-time command that ensures that the network +exists on the host, creating it if needed. + +By default, the Podman network has the same name as the unit, but with a `systemd-` prefix, i.e. for +a network file named `$NAME.network`, the generated Podman network is called `systemd-$NAME`, and +the generated service file is `$NAME-network.service`. The `NetworkName` option allows for +overriding this default name with a user-provided one. + +Please note that stopping the corresponding service will not remove the podman network. +In addition, updating an existing network is not supported. +In order to update the network parameters you will first need to manually remove the podman network and then restart the service. + +Using network units allows containers to depend on networks being automatically pre-created. This is +particularly interesting when using special options to control network creation, as Podman otherwise creates networks with the default options. + +Valid options for `[Network]` are listed below: + +| **[Network] options** | **podman network create equivalent** | +|-------------------------------------|-----------------------------------------------------------------| +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| DisableDNS=true | --disable-dns | +| DNS=192.168.55.1 | --dns=192.168.55.1 | +| Driver=bridge | --driver bridge | +| Gateway=192.168.55.3 | --gateway 192.168.55.3 | +| GlobalArgs=--log-level=debug | --log-level=debug | +| Internal=true | --internal | +| IPAMDriver=dhcp | --ipam-driver dhcp | +| IPRange=192.168.55.128/25 | --ip-range 192.168.55.128/25 | +| IPv6=true | --ipv6 | +| Label="XYZ" | --label "XYZ" | +| NetworkDeleteOnStop=true | Add ExecStopPost to delete the network when the unit is stopped | +| NetworkName=foo | podman network create foo | +| Options=isolate=true | --opt isolate=true | +| PodmanArgs=--dns=192.168.55.1 | --dns=192.168.55.1 | +| Subnet=192.5.0.0/16 | --subnet 192.5.0.0/16 | + +Supported keys in `[Network]` section are: + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `DisableDNS=` (defaults to `false`) + +If enabled, disables the DNS plugin for this network. + +This is equivalent to the Podman `--disable-dns` option + +### `DNS=` + +Set network-scoped DNS resolver/nameserver for containers in this network. + +This key can be listed multiple times. + +### `Driver=` (defaults to `bridge`) + +Driver to manage the network. Currently `bridge`, `macvlan` and `ipvlan` are supported. + +This is equivalent to the Podman `--driver` option + +### `Gateway=` + +Define a gateway for the subnet. If you want to provide a gateway address, you must also provide a subnet option. + +This is equivalent to the Podman `--gateway` option + +This key can be listed multiple times. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `network` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Internal=` (defaults to `false`) + +Restrict external access of this network. + +This is equivalent to the Podman `--internal` option + +### `IPAMDriver=` + +Set the ipam driver (IP Address Management Driver) for the network. Currently `host-local`, `dhcp` and `none` are supported. + +This is equivalent to the Podman `--ipam-driver` option + +### `IPRange=` + +Allocate container IP from a range. The range must be a either a complete subnet in CIDR notation or be +in the `-` syntax which allows for a more flexible range compared to the CIDR subnet. +The ip-range option must be used with a subnet option. + +This is equivalent to the Podman `--ip-range` option + +This key can be listed multiple times. + +### `IPv6=` + +Enable IPv6 (Dual Stack) networking. + +This is equivalent to the Podman `--ipv6` option + +### `Label=` + +Set one or more OCI labels on the network. The format is a list of +`key=value` items, similar to `Environment`. + +This key can be listed multiple times. + +### `NetworkDeleteOnStop=` (defaults to `false`) + +When set to `true` the network is deleted when the service is stopped + +### `NetworkName=` + +The (optional) name of the Podman network. If this is not specified, the default value of +`systemd-%N` is used, which is the same as the unit name but with a `systemd-` prefix to avoid +conflicts with user-managed networks. + +### `Options=` + +Set driver specific options. + +This is equivalent to the Podman `--opt` option + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman network create` command +in the generated file (right before the name of the network in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Subnet=` + +The subnet in CIDR notation. + +This is equivalent to the Podman `--subnet` option + +This key can be listed multiple times. + +## Volume units [Volume] + +Volume files are named with a `.volume` extension and contain a section `[Volume]` describing the +named Podman volume. The generated service is a one-time command that ensures that the volume +exists on the host, creating it if needed. + +By default, the Podman volume has the same name as the unit, but with a `systemd-` prefix, i.e. for +a volume file named `$NAME.volume`, the generated Podman volume is called `systemd-$NAME`, and the +generated service file is `$NAME-volume.service`. The `VolumeName` option allows for overriding this +default name with a user-provided one. + +Using volume units allows containers to depend on volumes being automatically pre-created. This is +particularly interesting when using special options to control volume creation, +as Podman otherwise creates volumes with the default options. + +Valid options for `[Volume]` are listed below: + +| **[Volume] options** | **podman volume create equivalent** | +|-------------------------------------|-------------------------------------------| +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| Copy=true | --opt copy | +| Device=tmpfs | --opt device=tmpfs | +| Driver=image | --driver=image | +| GlobalArgs=--log-level=debug | --log-level=debug | +| Group=192 | --opt group=192 | +| Image=quay.io/centos/centos\:latest | --opt image=quay.io/centos/centos:latest | +| Label="foo=bar" | --label "foo=bar" | +| Options=XYZ | --opt "o=XYZ" | +| PodmanArgs=--driver=image | --driver=image | +| Type=type | Filesystem type of Device | +| User=123 | --opt uid=123 | +| VolumeName=foo | podman volume create foo | + +Supported keys in `[Volume]` section are: + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `Copy=` (default to `true`) + +If enabled, the content of the image located at the mountpoint of the volume is copied into the +volume on the first run. + +### `Device=` + +The path of a device which is mounted for the volume. + +### `Driver=` + +Specify the volume driver name. When set to `image`, the `Image` key must also be set. + +This is equivalent to the Podman `--driver` option. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `volume` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Group=` + +The host (numeric) GID, or group name to use as the group for the volume + +### `Image=` + +Specifies the image the volume is based on when `Driver` is set to the `image`. +It is recommended to use a fully qualified image name rather than a short name, both for +performance and robustness reasons. + +The format of the name is the same as when passed to `podman pull`. So, it supports using +`\:tag` or digests to guarantee the specific image version. + +Special case: + +* If the `name` of the image ends with `.image`, Quadlet will use the image +pulled by the corresponding `.image` file, and the generated systemd service contains a dependency on the `$name-image.service` (or the service name set in the .image file). Note: the corresponding `.image` file must exist. + +### `Label=` + +Set one or more OCI labels on the volume. The format is a list of +`key=value` items, similar to `Environment`. + +This key can be listed multiple times. + +### `Options=` + +The mount options to use for a filesystem as used by the **mount(8)** command `-o` option. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman volume create` command +in the generated file (right before the name of the volume in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Type=` + +The filesystem type of `Device` as used by the **mount(8)** commands `-t` option. + +### `User=` + +The host (numeric) UID, or user name to use as the owner for the volume + +### `VolumeName=` + +The (optional) name of the Podman volume. If this is not specified, the default value of +`systemd-%N` is used, which is the same as the unit name but with a `systemd-` prefix to avoid +conflicts with user-managed volumes. + +## Build units [Build] + +Build files are named with a `.build` extension and contain a section `[Build]` describing the image +build command. The generated service is a one-time command that ensures that the image is built on +the host from a supplied Containerfile and context directory. Subsequent (re-)starts of the +generated built service will usually finish quickly, as image layer caching will skip unchanged +build steps. + +A minimal `.build` unit needs at least the `ImageTag=` key, and either of `File=` or +`SetWorkingDirectory=` keys. + +Using build units allows containers and volumes to depend on images being built locally. This can be +interesting for creating container images not available on container registries, or for local +testing and development. + +Valid options for `[Build]` are listed below: + +| **[Build] options** | **podman build equivalent** | +|-------------------------------------|---------------------------------------------| +| Annotation=annotation=value | --annotation=annotation=value | +| Arch=aarch64 | --arch=aarch64 | +| AuthFile=/etc/registry/auth\.json | --authfile=/etc/registry/auth\.json | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| DNS=192.168.55.1 | --dns=192.168.55.1 | +| DNSOption=ndots:1 | --dns-option=ndots:1 | +| DNSSearch=example.com | --dns-search example.com | +| Environment=foo=bar | --env foo=bar | +| File=/path/to/Containerfile | --file=/path/to/Containerfile | +| ForceRM=false | --force-rm=false | +| GlobalArgs=--log-level=debug | --log-level=debug | +| GroupAdd=keep-groups | --group-add=keep-groups | +| ImageTag=localhost/imagename | --tag=localhost/imagename | +| Label=label | --label=label | +| Network=host | --network=host | +| PodmanArgs=--pull never | --pull never | +| Pull=never | --pull never | +| Retry=5 | --retry=5 | +| RetryDelay=10s | --retry-delay=10s | +| Secret=secret | --secret=id=mysecret,src=path | +| SetWorkingDirectory=unit | Set `WorkingDirectory` of systemd unit file | +| Target=my-app | --target=my-app | +| TLSVerify=false | --tls-verify=false | +| Variant=arm/v7 | --variant=arm/v7 | +| Volume=/source:/dest | --volume /source:/dest | + +### `Annotation=` + +Add an image *annotation* (e.g. annotation=*value*) to the image metadata. Can be used multiple +times. + +This is equivalent to the `--annotation` option of `podman build`. + +### `Arch=` + +Override the architecture, defaults to hosts', of the image to be built. + +This is equivalent to the `--arch` option of `podman build`. + +### `AuthFile=` + +Path of the authentication file. + +This is equivalent to the `--authfile` option of `podman build`. + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `DNS=` + +Set network-scoped DNS resolver/nameserver for the build container. + +This key can be listed multiple times. + +This is equivalent to the `--dns` option of `podman build`. + +### `DNSOption=` + +Set custom DNS options. + +This key can be listed multiple times. + +This is equivalent to the `--dns-option` option of `podman build`. + +### `DNSSearch=` + +Set custom DNS search domains. Use **DNSSearch=.** to remove the search domain. + +This key can be listed multiple times. + +This is equivalent to the `--dns-search` option of `podman build`. + +### `Environment=` + +Add a value (e.g. env=*value*) to the built image. This uses the same format as [services in +systemd](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Environment=) and can be +listed multiple times. + +### `File=` + +Specifies a Containerfile which contains instructions for building the image. A URL starting with +`http(s)://` allows you to specify a remote Containerfile to be downloaded. Note that for a given +relative path to a Containerfile, or when using a `http(s)://` URL, you also must set +`SetWorkingDirectory=` in order for `podman build` to find a valid context directory for the +resources specified in the Containerfile. + +Note that setting a `File=` field is mandatory for a `.build` file, unless `SetWorkingDirectory` (or +a `WorkingDirectory` in the `Service` group) has also been set. + +This is equivalent to the `--file` option of `podman build`. + +### `ForceRM=` + +Always remove intermediate containers after a build, even if the build fails (default true). + +This is equivalent to the `--force-rm` option of `podman build`. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `build` in the generated +file. It can be used to access Podman features otherwise unsupported by the generator. Since the +generator is unaware of what unexpected interactions can be caused by these arguments, it is not +recommended to use this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `GroupAdd=` + +Assign additional groups to the primary user running within the container process. Also supports the +`keep-groups` special flag. + +This is equivalent to the `--group-add` option of `podman build`. + +### `ImageTag=` + +Specifies the name which is assigned to the resulting image if the build process completes +successfully. + +This is equivalent to the `--tag` option of `podman build`. + +This key can be listed multiple times. The first instance will be used as the name of the created artifact when the `.build` file is referenced by another Quadlet unit. + +### `Label=` + +Add an image *label* (e.g. label=*value*) to the image metadata. Can be used multiple times. + +This is equivalent to the `--label` option of `podman build`. + +### `Network=` + +Sets the configuration for network namespaces when handling RUN instructions. This has the same +format as the `--network` option to `podman build`. For example, use `host` to use the host network, +or `none` to not set up networking. + +Special case: + +* If the `name` of the network ends with `.network`, Quadlet will look for the corresponding `.network` Quadlet unit. If found, Quadlet will use the name of the Network set in the Unit, otherwise, `systemd-$name` is used. The generated systemd service contains a dependency on the service unit generated for that `.network` unit, or on `$name-network.service` if the `.network` unit is not found. Note: the corresponding `.network` file must exist. + +This key can be listed multiple times. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman build` command +in the generated file (right before the image name in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Pull=` + +Set the image pull policy. + +This is equivalent to the `--pull` option of `podman build`. + +### `Retry=` + +Number of times to retry the image pull when a HTTP error occurs. Equivalent to the Podman `--retry` option. + +### `RetryDelay=` + +Delay between retries. Equivalent to the Podman `--retry-delay` option. + +### `Secret=` + +Pass secret information used in Containerfile build stages in a safe way. + +This is equivalent to the `--secret` option of `podman build` and generally has the form +`secret[,opt=opt ...]`. + +### `SetWorkingDirectory=` + +Provide context (a working directory) to `podman build`. Supported values are a path, a URL, or the +special keys `file` or `unit` to set the context directory to the parent directory of the file from +the `File=` key or to that of the Quadlet `.build` unit file, respectively. This allows Quadlet to +resolve relative paths. + +When using one of the special keys (`file` or `unit`), the `WorkingDirectory` field of the `Service` +group of the Systemd service unit will also be set to accordingly. Alternatively, users can +explicitly set the `WorkingDirectory` field of the `Service` group in the `.build` file. Please note +that if the `WorkingDirectory` field of the `Service` group is set by the user, Quadlet will not +overwrite it even if `SetWorkingDirectory` is set to `file` or `unit`. + +By providing a URL to `SetWorkingDirectory=` you can instruct `podman build` to clone a Git +repository or download an archive file extracted to a temporary location by `podman build` as build +context. Note that in this case, the `WorkingDirectory` of the Systemd service unit is left +untouched by Quadlet. + +Note that providing context directory is mandatory for a `.build` file, unless a `File=` key has +also been provided. + +### `Target=` + +Set the target build stage to build. Commands in the Containerfile after the target stage are +skipped. + +This is equivalent to the `--target` option of `podman build`. + +### `TLSVerify=` + +Require HTTPS and verification of certificates when contacting registries. + +This is equivalent to the `--tls-verify` option of `podman build`. + +### `Variant=` + +Override the default architecture variant of the container image to be built. + +This is equivalent to the `--variant` option of `podman build`. + +### `Volume=` + +Mount a volume to containers when executing RUN instructions during the build. This is equivalent to +the `--volume` option of `podman build`, and generally has the form +`[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]`. + +If `SOURCE-VOLUME` starts with `.`, Quadlet resolves the path relative to the location of the unit file. + +Special case: + +* If `SOURCE-VOLUME` ends with `.volume`, Quadlet will look for the corresponding `.volume` Quadlet unit. If found, Quadlet will use the name of the Volume set in the Unit, otherwise, `systemd-$name` is used. The generated systemd service contains a dependency on the service unit generated for that `.volume` unit, or on `$name-volume.service` if the `.volume` unit is not found. Note: the corresponding `.volume` file must exist. + +This key can be listed multiple times. + +## Image units [Image] + +Image files are named with a `.image` extension and contain a section `[Image]` describing the +container image pull command. The generated service is a one-time command that ensures that the image +exists on the host, pulling it if needed. + +Using image units allows containers and volumes to depend on images being automatically pulled. This is +particularly interesting when using special options to control image pulls. + +Valid options for `[Image]` are listed below: + +| **[Image] options** | **podman image pull equivalent** | +|----------------------------------------|--------------------------------------------------| +| AllTags=true | --all-tags | +| Arch=aarch64 | --arch=aarch64 | +| AuthFile=/etc/registry/auth\.json | --authfile=/etc/registry/auth\.json | +| CertDir=/etc/registry/certs | --cert-dir=/etc/registry/certs | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| Creds=myname\:mypassword | --creds=myname\:mypassword | +| DecryptionKey=/etc/registry\.key | --decryption-key=/etc/registry\.key | +| GlobalArgs=--log-level=debug | --log-level=debug | +| Image=quay\.io/centos/centos\:latest | podman image pull quay.io/centos/centos\:latest | +| ImageTag=quay\.io/centos/centos\:latest | Use this name when resolving `.image` references | +| OS=windows | --os=windows | +| PodmanArgs=--os=linux | --os=linux | +| Retry=5 | --retry=5 | +| RetryDelay=10s | --retry-delay=10s | +| TLSVerify=false | --tls-verify=false | +| Variant=arm/v7 | --variant=arm/v7 | + +### `AllTags=` + +All tagged images in the repository are pulled. + +This is equivalent to the Podman `--all-tags` option. + +### `Arch=` + +Override the architecture, defaults to hosts, of the image to be pulled. + +This is equivalent to the Podman `--arch` option. + +### `AuthFile=` + +Path of the authentication file. + +This is equivalent to the Podman `--authfile` option. + +### `CertDir=` + +Use certificates at path (*.crt, *.cert, *.key) to connect to the registry. + +This is equivalent to the Podman `--cert-dir` option. + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `Creds=` + +The `[username[:password]]` to use to authenticate with the registry, if required. + +This is equivalent to the Podman `--creds` option. + +### `DecryptionKey=` + +The `[key[:passphrase]]` to be used for decryption of images. + +This is equivalent to the Podman `--decryption-key` option. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `image` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Image=` + +The image to pull. +It is recommended to use a fully qualified image name rather than a short name, both for +performance and robustness reasons. + +The format of the name is the same as when passed to `podman pull`. So, it supports using +`:tag` or digests to guarantee the specific image version. + +### `ImageTag=` + +Actual FQIN of the referenced `Image`. +Only meaningful when source is a file or directory archive. + +For example, an image saved into a `docker-archive` with the following Podman command: + +`podman image save --format docker-archive --output /tmp/archive-file.tar quay.io/podman/stable:latest` + +requires setting +- `Image=docker-archive:/tmp/archive-file.tar` +- `ImageTag=quay.io/podman/stable\:latest` + +### `OS=` + +Override the OS, defaults to hosts, of the image to be pulled. + +This is equivalent to the Podman `--os` option. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman image pull` command +in the generated file (right before the image name in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Retry=` + +Number of times to retry the image pull when a HTTP error occurs. Equivalent to the Podman `--retry` option. + +### `RetryDelay=` + +Delay between retries. Equivalent to the Podman `--retry-delay` option. + +### `TLSVerify=` + +Require HTTPS and verification of certificates when contacting registries. + +This is equivalent to the Podman `--tls-verify` option. + +### `Variant=` + +Override the default architecture variant of the container image. + +This is equivalent to the Podman `--variant` option. + +## Quadlet section [Quadlet] +Some quadlet specific configuration is shared between different unit types. Those settings +can be configured in the `[Quadlet]` section. + +Valid options for `[Quadlet]` are listed below: + +| **[Quadlet] options** | **Description** | +|----------------------------|---------------------------------------------------| +| DefaultDependencies=false | Disable implicit network dependencies to the unit | + +### `DefaultDependencies=` + +Add Quadlet's default network dependencies to the unit (default is `true`). + +When set to false, Quadlet will **not** add a dependency (After=, Wants=) to +`network-online.target`/`podman-user-wait-network-online.service` to the generated unit. + +Note, this option is set in the `[Quadlet]` section. The _systemd_ `[Unit]` section +has an option with the same name but a different meaning. + +## EXAMPLES + +Example `test.container`: + +``` +[Unit] +Description=A minimal container + +[Container] +# Use the centos image +Image=quay.io/centos/centos:latest + +# Use volume and network defined below +Volume=test.volume:/data +Network=test.network + +# In the container we just run sleep +Exec=sleep 60 + +[Service] +# Restart service when sleep finishes +Restart=always +# Extend Timeout to allow time to pull the image +TimeoutStartSec=900 +# ExecStartPre flag and other systemd commands can go here, see systemd.unit(5) man page. +ExecStartPre=/usr/share/mincontainer/setup.sh + +[Install] +# Start by default on boot +WantedBy=multi-user.target default.target +``` + +Example `test.kube`: +``` +[Unit] +Description=A kubernetes yaml based service +Before=local-fs.target + +[Kube] +Yaml=/opt/k8s/deployment.yml + +[Install] +# Start by default on boot +WantedBy=multi-user.target default.target +``` + +Example for locally built image to be used in a container: + +`test.build` +``` +[Build] +# Tag the image to be built +ImageTag=localhost/imagename + +# Set the working directory to the path of the unit file, +# expecting to find a Containerfile/Dockerfile +# + other files needed to build the image +SetWorkingDirectory=unit +``` + +`test.container` +``` +[Container] +Image=test.build +``` + +Example `test.volume`: + +``` +[Volume] +User=root +Group=root +Label=org.test.Key=value +``` + +Example `test.network`: +``` +[Network] +Subnet=172.16.0.0/24 +Gateway=172.16.0.1 +IPRange=172.16.0.0/28 +Label=org.test.Key=value +``` + +Example for Container in a Pod: + +`test.pod` +``` +[Pod] +PodName=test +``` + +`centos.container` +``` +[Container] +Image=quay.io/centos/centos\:latest +Exec=sh -c "sleep inf" +Pod=test.pod +``` + +Example `s3fs.volume`: + +For further details, please see the [s3fs-fuse](https://github.com/s3fs-fuse/s3fs-fuse) project. +Remember to read the [FAQ](https://github.com/s3fs-fuse/s3fs-fuse/wiki/FAQ) + +> NOTE: Enabling the cache massively speeds up access and write times on static files/objects. + +> However, `use_cache` is [UNBOUNDED](https://github.com/s3fs-fuse/s3fs-fuse/wiki/FAQ#q-how-does-the-local-file-cache-work)! + +> Be careful, it will fill up with any files accessed on the s3 bucket through the file system. + +Please remember to set `S3_BUCKET`, `PATH`, `AWS_REGION`. `CACHE_DIRECTORY` should be set up by [systemd](https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#RuntimeDirectory=) + +``` +[Service] +CacheDirectory=s3fs +ExecStartPre=/usr/local/bin/aws s3api put-object --bucket ${S3_BUCKET} --key ${PATH}/ + +[Volume] +Device=${S3_BUCKET}:/${PATH} +Type=fuse.s3fs +VolumeName=s3fs-volume +Options=iam_role,endpoint=${AWS_REGION},use_xattr,listobjectsv2,del_cache,use_cache=${CACHE_DIRECTORY} +# `iam_role` assumes inside EC2, if not, Use `profile=` instead +``` + +## SEE ALSO +**[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)**, +**[systemd.service(5)](https://www.freedesktop.org/software/systemd/man/systemd.service.html)**, +**[systemd-analyze(1)](https://www.freedesktop.org/software/systemd/man/latest/systemd-analyze.html)**, +**[podman-run(1)](podman-run.1.md)**, +**[podman-network-create(1)](podman-network-create.1.md)**, +**[podman-auto-update(1)](podman-auto-update.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-tag.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-tag.1.md new file mode 100644 index 000000000..5fc2cdc43 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-tag.1.md @@ -0,0 +1,51 @@ +--- +title: podman-tag +version: v5.5.1 +--- + +% podman-tag 1 + +## NAME +podman\-tag - Add an additional name to a local image + +## SYNOPSIS +**podman tag** *image*[:*tag*] [*target-name*[:*tag*]...] [*options*] + +**podman image tag** *image*[:*tag*] [*target-name*[:*tag*]...] [*options*] + +## DESCRIPTION +Assigns a new image name to an existing image. A full name refers to the entire +image name, including the optional *tag* after the `:`. If there is no *tag* +provided, then Podman defaults to `latest` for both the *image* and the +*target-name*. + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Tag specified image with an image name defaulting to :latest. +``` +$ podman tag 0e3bbc2 fedora:latest +``` + +Tag specified image with fully specified image name. +``` +$ podman tag httpd myregistryhost:5000/fedora/httpd\:v2 +``` + +Tag specified image with multiple tags. +``` +$ podman tag mymariadb mycontainerregistry.io/namespace/mariadb:10 mycontainerregistry.io/namespace/mariadb:10.11 mycontainerregistry.io/namespace/mariadb:10.11.12 +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +December 2019, Update description to refer to 'name' instead of 'alias' by Sascha Grunert +July 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-top.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-top.1.md new file mode 100644 index 000000000..81d63dd55 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-top.1.md @@ -0,0 +1,125 @@ +--- +title: podman-top +version: v5.5.1 +--- + +% podman-top 1 + +## NAME +podman\-top - Display the running processes of a container + +## SYNOPSIS +**podman top** [*options*] *container* [*format-descriptors*] + +**podman container top** [*options*] *container* [*format-descriptors*] + +## DESCRIPTION +Display the running processes of the container. The *format-descriptors* are ps (1) compatible AIX format +descriptors but extended to print additional information, such as the seccomp mode or the effective capabilities +of a given process. The descriptors can either be passed as separated arguments or as a single comma-separated +argument. Note that options and or flags of ps(1) can also be specified; in this case, Podman falls back to +executing ps(1) from the host with the specified arguments and flags in the container namespace. If the container +has the `CAP_SYS_PTRACE` capability then we will execute ps(1) in the container so it must be installed there. +To extract host-related information, use the "h*" descriptors. For instance, `podman top $name hpid huser` +to display the PID and user of the processes in the host context. + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## FORMAT DESCRIPTORS + +The following descriptors are supported in addition to the AIX format descriptors mentioned in ps (1): + +**args, capbnd, capeff, capinh, capprm, comm, etime, group, hgroup, hpid, huser, label, nice, pcpu, pgid, pid, ppid, rgroup, ruser, seccomp, state, time, tty, user, vsz** + +**capbnd** + + Set of bounding capabilities. See capabilities (7) for more information. + +**capeff** + + Set of effective capabilities. See capabilities (7) for more information. + +**capinh** + + Set of inheritable capabilities. See capabilities (7) for more information. + +**capprm** + + Set of permitted capabilities. See capabilities (7) for more information. + +**hgroup** + + The corresponding effective group of a container process on the host. + +**hpid** + + The corresponding host PID of a container process. + +**huser** + + The corresponding effective user of a container process on the host. + +**label** + + Current security attributes of the process. + +**seccomp** + + Seccomp mode of the process (i.e., disabled, strict or filter). See seccomp (2) for more information. + +**state** + + Process state codes (e.g, **R** for *running*, **S** for *sleeping*). See proc(5) for more information. + +**stime** + + Process start time (e.g, "2019-12-09 10:50:36 +0100 CET). + +## EXAMPLES + +By default, `podman-top` prints data similar to `ps -ef`. +``` +$ podman top f5a62a71b07 +USER PID PPID %CPU ELAPSED TTY TIME COMMAND +root 1 0 0.000 20.386825206s pts/0 0s sh +root 7 1 0.000 16.386882887s pts/0 0s sleep +root 8 1 0.000 11.386886562s pts/0 0s vi +``` + +The output can be controlled by specifying format descriptors as arguments after the container. +``` +$ podman top -l pid seccomp args %C +PID SECCOMP COMMAND %CPU +1 filter sh 0.000 +8 filter vi /etc/ 0.000 +``` + +Podman falls back to executing ps(1) from the host in the container namespace if an unknown descriptor is specified. +``` +$ podman top -l -- aux +USER PID PPID %CPU ELAPSED TTY TIME COMMAND +root 1 0 0.000 1h2m12.497061672s ? 0s sleep 100000 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **ps(1)**, **seccomp(2)**, **proc(5)**, **capabilities(7)** + +## HISTORY +July 2018, Introduce format descriptors by Valentin Rothberg + +December 2017, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-troubleshooting.7.md b/versioned_docs/version-5.5.1/source/markdown/podman-troubleshooting.7.md new file mode 100644 index 000000000..3477474ee --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-troubleshooting.7.md @@ -0,0 +1,1552 @@ +--- +title: Troubleshooting +version: v5.5.1 +--- + +% podman-troubleshooting 7 + + +# Troubleshooting + +## A list of common issues and solutions for Podman + +--- +### 1) Variety of issues - Validate Version + +A large number of issues reported against Podman are often found to already be fixed +in more current versions of the project. Before reporting an issue, please verify the +version you are running with `podman version` and compare it to the latest release +documented on the top of Podman's [README.md](README.md). + +If they differ, please update your version of PODMAN to the latest possible +and retry your command before reporting the issue. + +--- +### 2) Can't use volume mount, get permission denied + +```console +$ podman run -v ~/mycontent:/content fedora touch /content/file +touch: cannot touch '/content/file': Permission denied +``` + +#### Solution + +This is sometimes caused by SELinux, and sometimes by user namespaces. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, you can add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two containers +share the volume content. As a result, Podman labels the content with a shared +content label. Shared volume labels allow all containers to read/write content. +The **Z** option tells Podman to label the content with a private unshared label. +Only the current container can use a private volume. + +```console +$ podman run -v ~/mycontent:/content\:Z fedora touch /content/file +``` + +Make sure the content is private for the container. Do not relabel system directories and content. +Relabeling system content might cause other confined services on your machine to fail. For these +types of containers we recommend having SELinux separation disabled. The option `--security-opt label=disable` +will disable SELinux separation for the container. + +```console +$ podman run --security-opt label=disable -v ~:/home/user fedora touch /home/user/file +``` + +In cases where the container image runs as a specific, non-root user, though, the +solution is to fix the user namespace. This would include container images such as +the Jupyter Notebook image (which runs as "jovyan") and the Postgres image (which runs +as "postgres"). In either case, use the `--userns` switch to map user namespaces, +most of the time by using the **keep-id** option. + +```console +$ podman run -v "$PWD":/home/jovyan/work --userns=keep-id jupyter/scipy-notebook +``` + +--- +### 3) No such image or Bare keys cannot contain ':' + +When doing a `podman pull` or `podman build` command and a "common" image cannot be pulled, +it is likely that the `/etc/containers/registries.conf` file is either not installed or possibly +misconfigured. + +#### Symptom + +```console +$ sudo podman build -f Dockerfile +STEP 1: FROM alpine +error building: error creating build container: no such image "alpine" in registry: image not known +``` + +or + +```console +$ sudo podman pull fedora +error pulling image "fedora": unable to pull fedora: error getting default registries to try: Near line 9 (last key parsed ''): Bare keys cannot contain ':'. +``` + +#### Solution + + * Verify that the `/etc/containers/registries.conf` file exists. If not, verify that the containers-common package is installed. + * Verify that the entries in the `unqualified-search-registries` list of the `/etc/containers/registries.conf` file are valid and reachable. + * i.e. `unqualified-search-registries = ["registry.fedoraproject.org", "quay.io", "registry.access.redhat.com"]` + +--- +### 4) http: server gave HTTP response to HTTPS client + +When doing a Podman command such as `build`, `commit`, `pull`, or `push` to a registry, +TLS verification is turned on by default. If encryption is not used with +those commands, this error can occur. + +#### Symptom + +```console +$ sudo podman push alpine docker://localhost:5000/myalpine\:latest +Getting image source signatures +Get https://localhost:5000/v2/: http: server gave HTTP response to HTTPS client +``` + +#### Solution + +By default TLS verification is turned on when communicating to registries from +Podman. If the registry does not require encryption the Podman commands +such as `build`, `commit`, `pull` and `push` will fail unless TLS verification is turned +off using the `--tls-verify` option. **NOTE:** It is not at all recommended to +communicate with a registry and not use TLS verification. + + * Turn off TLS verification by passing false to the tls-verify option. + * I.e. `podman push --tls-verify=false alpine docker://localhost:5000/myalpine\:latest` + + +For a global workaround, users[1] can create the file `/etc/containers/registries.conf.d/registry-NAME.conf` +(replacing NAME with the name of this registry) with the following content (replacing FULLY.QUALIFIED.NAME.OF.REGISTRY with the address of this registry): + +``` +[[registry]] +location = "FULLY.QUALIFIED.NAME.OF.REGISTRY" +insecure = true +``` + +[1] If you are using a Mac / Windows, you should execute `podman machine ssh` to login into podman machine before adding the insecure entry to the registry—conf file. + +**This is an insecure method and should be used cautiously.** + +--- +### 5) rootless containers cannot ping hosts + +When using the ping command from a non-root container, the command may +fail because of a lack of privileges. + +#### Symptom + +```console +$ podman run --rm fedora ping -W10 -c1 redhat.com +PING redhat.com (209.132.183.105): 56 data bytes + +--- redhat.com ping statistics --- +1 packets transmitted, 0 packets received, 100% packet loss +``` + +#### Solution + +It is most likely necessary to enable unprivileged pings on the host. +Be sure the UID of the user is part of the range in the +`/proc/sys/net/ipv4/ping_group_range` file. + +To change its value you can use something like: + +```console +# sysctl -w "net.ipv4.ping_group_range=0 2000000" +``` + +To make the change persistent, you'll need to add a file in +`/etc/sysctl.d` that contains `net.ipv4.ping_group_range=0 $MAX_UID`. + +--- +### 6) Build hangs when the Dockerfile contains the useradd command + +When the Dockerfile contains a command like `RUN useradd -u 99999000 -g users newuser` the build can hang. + +#### Symptom + +If you are using a useradd command within a Dockerfile with a large UID/GID, it will create a large sparse file `/var/log/lastlog`. This can cause the build to hang forever. Go language does not support sparse files correctly, which can lead to some huge files being created in your container image. + +#### Solution + +If the entry in the Dockerfile looked like: RUN useradd -u 99999000 -g users newuser then add the `--no-log-init` parameter to change it to: `RUN useradd --no-log-init -u 99999000 -g users newuser`. This option tells useradd to stop creating the lastlog file. + +### 7) Permission denied when running Podman commands + +When rootless Podman attempts to execute a container on a non exec home directory a permission error will be raised. + +#### Symptom + +If you are running Podman or Buildah on a home directory that is mounted noexec, +then they will fail with a message like: + +```console +$ podman run centos:7 +standard_init_linux.go:203: exec user process caused "permission denied" +``` + +#### Solution + +Since the administrator of the system set up your home directory to be noexec, you will not be allowed to execute containers from storage in your home directory. It is possible to work around this by manually specifying a container storage path that is not on a noexec mount. Simply copy the file /etc/containers/storage.conf to ~/.config/containers/ (creating the directory if necessary). Specify a graphroot directory which is not on a noexec mount point and to which you have read/write privileges. You will need to modify other fields to writable directories as well. + +For example + +```console +$ cat ~/.config/containers/storage.conf +[storage] + driver = "overlay" + runroot = "/run/user/1000" + graphroot = "/execdir/myuser/storage" + [storage.options] + mount_program = "/bin/fuse-overlayfs" +``` + +### 8) Permission denied when running systemd within a Podman container + +When running systemd as PID 1 inside of a container on an SELinux +separated machine, it needs to write to the cgroup file system. + +#### Symptom + +Systemd gets permission denied when attempting to write to the cgroup file +system, and AVC messages start to show up in the audit.log file or journal on +the system. + +#### Solution + +Newer versions of Podman (2.0 or greater) support running init based containers +with a different SELinux labels, which allow the container process access to the +cgroup file system. This feature requires container-selinux-2.132 or newer +versions. + +Prior to Podman 2.0, the SELinux boolean `container_manage_cgroup` allows +container processes to write to the cgroup file system. Turn on this boolean, +on SELinux separated systems, to allow systemd to run properly in the container. +Only do this on systems running older versions of Podman. + +```console +# setsebool -P container_manage_cgroup true +``` + +### 9) Newuidmap missing when running rootless Podman commands + +Rootless Podman requires the newuidmap and newgidmap programs to be installed. + +#### Symptom + +If you are running Podman or Buildah as a rootless user, you get an error complaining about +a missing newuidmap executable. + +```console +$ podman run -ti fedora sh +command required for rootless mode with multiple IDs: exec: "newuidmap": executable file not found in $PATH +``` + +#### Solution + +Install a version of shadow-utils that includes these executables. Note that for RHEL and CentOS 7, at least the 7.7 release must be installed for support to be available. + +### 10) rootless setup user: invalid argument + +Rootless Podman requires the user running it to have a range of UIDs listed in /etc/subuid and /etc/subgid. + +#### Symptom + +A user, either via --user or through the default configured for the image, is not mapped inside the namespace. + +```console +$ podman run --rm -ti --user 1000000 alpine echo hi +Error: container create failed: container_linux.go:344: starting container process caused "setup user: invalid argument" +``` + +#### Solution + +Update the /etc/subuid and /etc/subgid with fields for users that look like: + +```console +$ cat /etc/subuid +johndoe:100000:65536 +test:165536:65536 +``` + +The format of this file is `USERNAME\:UID\:RANGE` + +* username as listed in `/etc/passwd` or `getpwent`. +* The initial uid allocated for the user. +* The size of the range of UIDs allocated for the user. + +This means johndoe is allocated UIDs 100000-165535 as well as his standard UID in the +`/etc/passwd` file. + +You should ensure that each user has a unique range of UIDs, because overlapping UIDs, +would potentially allow one user to attack another user. In addition, make sure +that the range of UIDs you allocate can cover all UIDs that the container +requires. For example, if the container has a user with UID 10000, ensure you +have at least 10000 subuids, and if the container needs to be run as a user with +UID 1000000, ensure you have at least 1000000 subuids. + +You could also use the `usermod` program to assign UIDs to a user. + +If you update either the `/etc/subuid` or `/etc/subgid` file, you need to +stop all running containers and kill the pause process. This is done +automatically by the `system migrate` command, which can also be used +to stop all the containers and kill the pause process. + +```console +# usermod --add-subuids 200000-201000 --add-subgids 200000-201000 johndoe +# grep johndoe /etc/subuid /etc/subgid +/etc/subuid:johndoe:200000:1001 +/etc/subgid:johndoe:200000:1001 +``` + +### 11) Changing the location of the Graphroot leads to permission denied + +When I change the graphroot storage location in storage.conf, the next time I +run Podman, I get an error like: + +```console +# podman run -p 5000:5000 -it centos bash + +bash: error while loading shared libraries: /lib64/libc.so.6: cannot apply additional memory protection after relocation: Permission denied +``` + +For example, the admin sets up a spare disk to be mounted at `/src/containers`, +and points storage.conf at this directory. + + +#### Symptom + +SELinux blocks containers from using arbitrary locations for overlay storage. +These directories need to be labeled with the same labels as if the content was +under `/var/lib/containers/storage`. + +#### Solution + +Tell SELinux about the new containers storage by setting up an equivalence record. +This tells SELinux to label content under the new path, as if it was stored +under `/var/lib/containers/storage`. + +```console +# semanage fcontext -a -e /var/lib/containers /srv/containers +# restorecon -R -v /srv/containers +``` + +The semanage command above tells SELinux to set up the default labeling of +`/srv/containers` to match `/var/lib/containers`. The `restorecon` command +tells SELinux to apply the labels to the actual content. + +Now all new content created in these directories will automatically be created +with the correct label. + +### 12) Anonymous image pull fails with 'invalid username/password' + +Pulling an anonymous image that doesn't require authentication can result in an +`invalid username/password` error. + +#### Symptom + +If you pull an anonymous image, one that should not require credentials, you can receive +an `invalid username/password` error if you have credentials established in the +authentication file for the target container registry that are no longer valid. + +```console +$ podman run -it --rm docker://docker.io/library/alpine:latest ls +Trying to pull docker://docker.io/library/alpine:latest...ERRO[0000] Error pulling image ref //alpine:latest: Error determining manifest MIME type for docker://alpine:latest: unable to retrieve auth token: invalid username/password +Failed +Error: unable to pull docker://docker.io/library/alpine:latest: unable to pull image: Error determining manifest MIME type for docker://alpine:latest: unable to retrieve auth token: invalid username/password +``` + +This can happen if the authentication file is modified 'by hand' or if the credentials +are established locally and then the password is updated later in the container registry. + +#### Solution + +Depending upon which container tool was used to establish the credentials, use `podman logout` +or `docker logout` to remove the credentials from the authentication file. + +### 13) Running Podman inside a container causes container crashes and inconsistent states + +Running Podman in a container and forwarding some, but not all, of the required host directories can cause inconsistent container behavior. + +#### Symptom + +After creating a container with Podman's storage directories mounted in from the host and running Podman inside a container, all containers show their state as "configured" or "created", even if they were running or stopped. + +#### Solution + +When running Podman inside a container, it is recommended to mount at a minimum `/var/lib/containers/storage/` as a volume. +Typically, you will not mount in the host version of the directory, but if you wish to share containers with the host, you can do so. +If you do mount in the host's `/var/lib/containers/storage`, however, you must also mount in the host's `/run/libpod` and `/run/containers/storage` directories. +Not doing this will cause Podman in the container to detect that temporary files have been cleared, leading it to assume a system restart has taken place. +This can cause Podman to reset container states and lose track of running containers. + +For running containers on the host from inside a container, we also recommend the [Podman remote client](docs/tutorials/remote_client.md), which only requires a single socket to be mounted into the container. + +### 14) Rootless 'podman build' fails EPERM on NFS: + +NFS enforces file creation on different UIDs on the server side and does not understand user namespace, which rootless Podman requires. +When a container root process like YUM attempts to create a file owned by a different UID, NFS Server denies the creation. +NFS is also a problem for the file locks when the storage is on it. Other distributed file systems (for example: Lustre, Spectrum Scale, the General Parallel File System (GPFS)) are also not supported when running in rootless mode as these file systems do not understand user namespace. + +#### Symptom +```console +$ podman build . +ERRO[0014] Error while applying layer: ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied +error creating build container: Error committing the finished image: error adding layer with blob "sha256\:a02a4930cb5d36f3290eb84f4bfa30668ef2e9fe3a1fb73ec015fc58b9958b17": ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied +``` + +#### Solution +Choose one of the following: + * Set up containers/storage in a different directory, not on an NFS share. + * Create a directory on a local file system. + * Edit `~/.config/containers/containers.conf` and point the `volume_path` option to that local directory. (Copy `/usr/share/containers/containers.conf` if `~/.config/containers/containers.conf` does not exist) + * Otherwise just run Podman as root, via `sudo podman` + +### 15) Rootless 'podman build' fails when using OverlayFS: + +The Overlay file system (OverlayFS) requires the ability to call the `mknod` command when creating whiteout files +when extracting an image. However, a rootless user does not have the privileges to use `mknod` in this capacity. + +#### Symptom +```console +$ podman build --storage-driver overlay . +STEP 1: FROM docker.io/ubuntu\:xenial +Getting image source signatures +Copying blob edf72af6d627 done +Copying blob 3e4f86211d23 done +Copying blob 8d3eac894db4 done +Copying blob f7277927d38a done +Copying config 5e13f8dd4c done +Writing manifest to image destination +Storing signatures +Error: creating build container: Error committing the finished image: error adding layer with blob "sha256:8d3eac894db4dc4154377ad28643dfe6625ff0e54bcfa63e0d04921f1a8ef7f8": Error processing tar file(exit status 1): operation not permitted +$ podman build . +ERRO[0014] Error while applying layer: ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied +error creating build container: Error committing the finished image: error adding layer with blob "sha256\:a02a4930cb5d36f3290eb84f4bfa30668ef2e9fe3a1fb73ec015fc58b9958b17": ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied +``` + +#### Solution +Choose one of the following: + * Complete the build operation as a privileged user. + * Install and configure fuse-overlayfs. + * Install the fuse-overlayfs package for your Linux Distribution. + * Add `mount_program = "/usr/bin/fuse-overlayfs"` under `[storage.options]` in your `~/.config/containers/storage.conf` file. + +### 16) RHEL 7 and CentOS 7 based `init` images don't work with cgroup v2 + +The systemd version shipped in RHEL 7 and CentOS 7 doesn't have support for cgroup v2. Support for cgroup v2 requires version 230 of systemd or newer, which +was never shipped or supported on RHEL 7 or CentOS 7. + +#### Symptom +```console +# podman run --name test -d registry.access.redhat.com/rhel7-init\:latest && sleep 10 && podman exec test systemctl status +c8567461948439bce72fad3076a91ececfb7b14d469bfa5fbc32c6403185beff +Failed to get D-Bus connection: Operation not permitted +Error: non zero exit code: 1: OCI runtime error +``` + +#### Solution +You'll need to either: + +* configure the host to use cgroup v1. On Fedora you can do: + +```console +# dnf install -y grubby +# grubby --update-kernel=ALL --args=”systemd.unified_cgroup_hierarchy=0" +# reboot +``` + +* update the image to use an updated version of systemd. + +### 17) rootless containers exit once the user session exits + +You need to set lingering mode through loginctl to prevent user processes to be killed once +the user session completed. + +#### Symptom + +Once the user logs out all the containers exit. + +#### Solution + +```console +# loginctl enable-linger $UID +``` + +### 18) `podman run` fails with "bpf create: permission denied error" + +The Kernel Lockdown patches deny eBPF programs when Secure Boot is enabled in the BIOS. [Matthew Garrett's post](https://mjg59.dreamwidth.org/50577.html) describes the relationship between Lockdown and Secure Boot and [Jan-Philip Gehrcke's](https://gehrcke.de/2019/09/running-an-ebpf-program-may-require-lifting-the-kernel-lockdown/) connects this with eBPF. [RH bug 1768125](https://bugzilla.redhat.com/show_bug.cgi?id=1768125) contains some additional details. + +#### Symptom + +Attempts to run podman result in + +```Error: bpf create : Operation not permitted: OCI runtime permission denied error``` + +#### Solution + +One workaround is to disable Secure Boot in your BIOS. + +### 19) error creating libpod runtime: there might not be enough IDs available in the namespace + +Unable to pull images + +#### Symptom + +```console +$ podman unshare cat /proc/self/uid_map + 0 1000 1 +``` + +#### Solution + +```console +$ podman system migrate +``` + +Original command now returns + +```console +$ podman unshare cat /proc/self/uid_map + 0 1000 1 + 1 100000 65536 +``` + +Reference [subuid](https://man7.org/linux/man-pages/man5/subuid.5.html) and [subgid](https://man7.org/linux/man-pages/man5/subgid.5.html) man pages for more detail. + +### 20) Passed-in devices or files can't be accessed in rootless container + +As a non-root user you have group access rights to a device or files that you +want to pass into a rootless container with `--device=...` or `--volume=...` + +#### Symptom + +Any access inside the container is rejected with "Permission denied". + +#### Solution + +The runtime uses `setgroups(2)` hence the process loses all additional groups +the non-root user has. Use the `--group-add keep-groups` flag to pass the +user's supplementary group access into the container. Currently only available +with the `crun` OCI runtime. + +### 21) A rootless container running in detached mode is closed at logout + + +When running a container with a command like `podman run --detach httpd` as +a rootless user, the container is closed upon logout and is not kept running. + +#### Symptom + +When logging out of a rootless user session, all containers that were started +in detached mode are stopped and are not kept running. As the root user, these +same containers would survive the logout and continue running. + +#### Solution + +When systemd notes that a session that started a Podman container has exited, +it will also stop any containers that have been associated with it. To avoid +this, use the following command before logging out: `loginctl enable-linger`. +To later revert the linger functionality, use `loginctl disable-linger`. + +LOGINCTL(1), SYSTEMD(1) + +### 22) Containers default detach keys conflict with shell history navigation + +Podman defaults to `ctrl-p,ctrl-q` to detach from a running containers. The +bash and zsh shells default to `ctrl-p` for the displaying of the previous +command. This causes issues when running a shell inside of a container. + +#### Symptom + +With the default detach key combo ctrl-p,ctrl-q, shell history navigation +(tested in bash and zsh) using ctrl-p to access the previous command will not +display this previous command, or anything else. Conmon is waiting for an +additional character to see if the user wants to detach from the container. +Adding additional characters to the command will cause it to be displayed along +with the additional character. If the user types ctrl-p a second time the shell +display the 2nd to last command. + +#### Solution + +The solution to this is to change the default detach_keys. For example in order +to change the defaults to `ctrl-q,ctrl-q` use the `--detach-keys` option. + +```console +$ podman run -ti --detach-keys ctrl-q,ctrl-q fedora sh +``` + +To make this change the default for all containers, users can modify the +containers.conf file. This can be done simply in your home directory, but adding the +following lines to users containers.conf + +```console +$ cat >> ~/.config/containers/containers.conf << _eof +[engine] +detach_keys="ctrl-q,ctrl-q" +_eof +``` + +In order to effect root running containers and all users, modify the system +wide defaults in `/etc/containers/containers.conf`. + + +### 23) Container with exposed ports won't run in a pod + +A container with ports that have been published with the `--publish` or `-p` option +can not be run within a pod. + +#### Symptom + +```console +$ podman pod create --name srcview -p 127.0.0.1:3434:3434 -p 127.0.0.1:7080:7080 -p 127.0.0.1:3370:3370 4b2f4611fa2cbd60b3899b936368c2b3f4f0f68bc8e6593416e0ab8ecb0a3f1d + +$ podman run --pod srcview --name src-expose -p 3434:3434 -v "${PWD}:/var/opt/localrepo":Z,ro sourcegraph/src-expose:latest serve /var/opt/localrepo +Error: cannot set port bindings on an existing container network namespace +``` + +#### Solution + +This is a known limitation. If a container will be run within a pod, it is not necessary +to publish the port for the containers in the pod. The port must only be published by the +pod itself. Pod network stacks act like the network stack on the host - you have a +variety of containers in the pod, and programs in the container, all sharing a single +interface and IP address, and associated ports. If one container binds to a port, no other +container can use that port within the pod while it is in use. Containers in the pod can +also communicate over localhost by having one container bind to localhost in the pod, and +another connect to that port. + +In the example from the symptom section, dropping the `-p 3434:3434` would allow the +`podman run` command to complete, and the container as part of the pod would still have +access to that port. For example: + +```console +$ podman run --pod srcview --name src-expose -v "${PWD}:/var/opt/localrepo":Z,ro sourcegraph/src-expose:latest serve /var/opt/localrepo +``` + +### 24) Podman container images fail with `fuse: device not found` when run + +Some container images require that the fuse kernel module is loaded in the kernel +before they will run with the fuse filesystem in play. + +#### Symptom + +When trying to run the container images found at quay.io/podman, quay.io/containers +registry.access.redhat.com/ubi8 or other locations, an error will sometimes be returned: + + +``` +ERRO error unmounting /var/lib/containers/storage/overlay/30c058cdadc888177361dd14a7ed7edab441c58525b341df321f07bc11440e68/merged: invalid argument +error mounting container "1ae176ca72b3da7c70af31db7434bcf6f94b07dbc0328bc7e4e8fc9579d0dc2e": error mounting build container "1ae176ca72b3da7c70af31db7434bcf6f94b07dbc0328bc7e4e8fc9579d0dc2e": error creating overlay mount to /var/lib/containers/storage/overlay/30c058cdadc888177361dd14a7ed7edab441c58525b341df321f07bc11440e68/merged: using mount program /usr/bin/fuse-overlayfs: fuse: device not found, try 'modprobe fuse' first +fuse-overlayfs: cannot mount: No such device +: exit status 1 +ERRO exit status 1 +``` + +#### Solution + +If you encounter a `fuse: device not found` error when running the container image, it is likely that +the fuse kernel module has not been loaded on your host system. Use the command `modprobe fuse` to load the +module and then run the container image afterwards. To enable this automatically at boot time, you can add a configuration +file to `/etc/modules.load.d`. See `man modules-load.d` for more details. + +### 25) podman run --rootfs link/to//read/only/dir does not work + +An error such as "OCI runtime error" on a read-only filesystem or the error "{image} is not an absolute path or is a symlink" are often times indicators for this issue. For more details, review this [issue]( +https://github.com/containers/podman/issues/5895). + +#### Symptom + +Rootless Podman requires certain files to exist in a file system in order to run. +Podman will create /etc/resolv.conf, /etc/hosts and other file descriptors on the rootfs in order +to mount volumes on them. + +#### Solution + +Run the container once in read/write mode, Podman will generate all of the FDs on the rootfs, and +from that point forward you can run with a read-only rootfs. + +```console +$ podman run --rm --rootfs /path/to/rootfs true +``` + +The command above will create all the missing directories needed to run the container. + +After that, it can be used in read-only mode, by multiple containers at the same time: + +```console +$ podman run --read-only --rootfs /path/to/rootfs .... +``` + +Another option is to use an Overlay Rootfs Mount: + +```console +$ podman run --rootfs /path/to/rootfs\:O .... +``` + +Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +### 26) Running containers with resource limits fails with a permissions error + +On some systemd-based systems, non-root users do not have resource limit delegation +permissions. This causes setting resource limits to fail. + +#### Symptom + +Running a container with a resource limit options will fail with an error similar to the following: + +`--cpus`, `--cpu-period`, `--cpu-quota`, `--cpu-shares`: + + Error: OCI runtime error: crun: the requested cgroup controller `cpu` is not available + +`--cpuset-cpus`, `--cpuset-mems`: + + Error: OCI runtime error: crun: the requested cgroup controller `cpuset` is not available + +This means that resource limit delegation is not enabled for the current user. + +#### Solution + +You can verify whether resource limit delegation is enabled by running the following command: + +```console +$ cat "/sys/fs/cgroup/user.slice/user-$(id -u).slice/user@$(id -u).service/cgroup.controllers" +``` + +Example output might be: + + memory pids + +In the above example, `cpu` and `cpuset` are not listed, which means the current user does +not have permission to set CPU or CPUSET limits. + +If you want to enable CPU or CPUSET limit delegation for all users, you can create the +file `/etc/systemd/system/user@.service.d/delegate.conf` with the contents: + +```ini +[Service] +Delegate=memory pids cpu cpuset +``` + +After logging out and logging back in, you should have permission to set +CPU and CPUSET limits. + +### 27) `exec container process '/bin/sh': Exec format error` (or another binary than `bin/sh`) + +This can happen when running a container from an image for another architecture than the one you are running on. + +For example, if a remote repository only has, and thus send you, a `linux/arm64` _OS/ARCH_ but you run on `linux/amd64` (as happened in https://github.com/openMF/community-app/issues/3323 due to https://github.com/timbru31/docker-ruby-node/issues/564). + +### 28) `Error: failed to create sshClient: Connection to bastion host (ssh://user@host:22/run/user/.../podman/podman.sock) failed.: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain` + +In some situations where the client is not on the same machine as where the podman daemon is running the client key could be using a cipher not supported by the host. This indicates an issue with one's SSH config. Until remedied using podman over ssh +with a pre-shared key will be impossible. + +#### Symptom + +The accepted ciphers per `/etc/crypto-policies/back-ends/openssh.config` are not one that was used to create the public/private key pair that was transferred over to the host for ssh authentication. + +You can confirm this is the case by attempting to connect to the host via `podman-remote info` from the client and simultaneously on the host running `journalctl -f` and watching for the error `userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]`. + +#### Solution + +Create a new key using a supported algorithm e.g. ecdsa: + +```console +$ ssh-keygen -t ecdsa -f ~/.ssh/podman +``` + +Then copy the new id over: + +```console +$ ssh-copy-id -i ~/.ssh/podman.pub user@host +``` + +And then re-add the connection (removing the old one if necessary): + +```console +$ podman-remote system connection add myuser --identity ~/.ssh/podman ssh://user@host/run/user/1000/podman/podman.sock +``` + +And now this should work: + +```console +$ podman-remote info +``` + +### 29) Rootless CNI networking fails in RHEL with Podman v2.2.1 to v3.0.1. + +A failure is encountered when trying to use networking on a rootless +container in Podman v2.2.1 through v3.0.1 on RHEL. This error does not +occur on other Linux distributions. + +#### Symptom + +A rootless container is created using a CNI network, but the `podman run` command +returns an error that an image must be built. + +#### Solution + +In order to use a CNI network in a rootless container on RHEL, +an Infra container image for CNI-in-slirp4netns must be created. The +instructions for building the Infra container image can be found for +v2.2.1 [here](https://github.com/containers/podman/tree/v2.2.1-rhel/contrib/rootless-cni-infra), +and for v3.0.1 [here](https://github.com/containers/podman/tree/v3.0.1-rhel/contrib/rootless-cni-infra). + +### 30) Container related firewall rules are lost after reloading firewalld +Container network can't be reached after `firewall-cmd --reload` and `systemctl restart firewalld` Running `podman network reload` will fix it but it has to be done manually. + +#### Symptom +The firewall rules created by podman are lost when the firewall is reloaded. + +#### Solution +[@ranjithrajaram](https://github.com/containers/podman/issues/5431#issuecomment-847758377) has created a systemd-hook to fix this issue + +1) For "firewall-cmd --reload", create a systemd unit file with the following +```ini +[Unit] +Description=firewalld reload hook - run a hook script on firewalld reload +Wants=dbus.service +After=dbus.service + +[Service] +Type=simple +ExecStart=/bin/bash -c '/bin/busctl monitor --system --match "interface=org.fedoraproject.FirewallD1,member=Reloaded" --match "interface=org.fedoraproject.FirewallD1,member=PropertiesChanged" | while read -r line ; do podman network reload --all ; done' + +[Install] +WantedBy=default.target +``` + +2) For "systemctl restart firewalld", create a systemd unit file with the following +```ini +[Unit] +Description=podman network reload +Wants=firewalld.service +After=firewalld.service +PartOf=firewalld.service + +[Service] +Type=simple +RemainAfterExit=yes +ExecStart=/usr/bin/podman network reload --all + +[Install] +WantedBy=default.target +``` + +However, If you use busctl monitor then you can't get machine-readable output on RHEL 8. +Since it doesn't have `busctl -j` as mentioned here by [@yrro](https://github.com/containers/podman/issues/5431#issuecomment-896943018). + +For RHEL 8, you can use the following one-liner bash script. +```ini +[Unit] +Description=Redo podman NAT rules after firewalld starts or reloads +Wants=dbus.service +After=dbus.service +Requires=firewalld.service + +[Service] +Type=simple +ExecStart=/bin/bash -c "dbus-monitor --profile --system 'type=signal,sender=org.freedesktop.DBus,path=/org/freedesktop/DBus,interface=org.freedesktop.DBus,member=NameAcquired,arg0=org.fedoraproject.FirewallD1' 'type=signal,path=/org/fedoraproject/FirewallD1,interface=org.fedoraproject.FirewallD1,member=Reloaded' | sed -u '/^#/d' | while read -r type timestamp serial sender destination path interface member _junk; do if [[ $type = '#'* ]]; then continue; elif [[ $interface = org.freedesktop.DBus && $member = NameAcquired ]]; then echo 'firewalld started'; podman network reload --all; elif [[ $interface = org.fedoraproject.FirewallD1 && $member = Reloaded ]]; then echo 'firewalld reloaded'; podman network reload --all; fi; done" +Restart=Always + +[Install] +WantedBy=default.target +``` +`busctl-monitor` is almost usable in RHEL 8, except that it always outputs two bogus events when it starts up, +one of which is (in its only machine-readable format) indistinguishable from the `NameOwnerChanged` that you get when firewalld starts up. +This means you would get an extra `podman network reload --all` when this unit starts. + +Apart from this, you can use the following systemd service with the python3 code. + +```ini +[Unit] +Description=Redo podman NAT rules after firewalld starts or reloads +Wants=dbus.service +Requires=firewalld.service +After=dbus.service + +[Service] +Type=simple +ExecStart=/usr/bin/python /path/to/python/code/podman-redo-nat.py +Restart=always + +[Install] +WantedBy=default.target +``` +The code reloads podman network twice when you use `systemctl restart firewalld`. +```python3 +import dbus +from gi.repository import GLib +from dbus.mainloop.glib import DBusGMainLoop +import subprocess +import sys + +# I'm a bit confused on the return values in the code +# Not sure if they are needed. + +def reload_podman_network(): + try: + subprocess.run(["podman","network","reload","--all"],timeout=90) + # I'm not sure about this part + sys.stdout.write("podman network reload done\n") + sys.stdout.flush() + except subprocess.TimeoutExpired as t: + sys.stderr.write(f"Podman reload failed due to Timeout {t}") + except subprocess.CalledProcessError as e: + sys.stderr.write(f"Podman reload failed due to {e}") + except Exception as e: + sys.stderr.write(f"Podman reload failed with an Unhandled Exception {e}") + + return False + +def signal_handler(*args, **kwargs): + if kwargs.get('member') == "Reloaded": + reload_podman_network() + elif kwargs.get('member') == "NameOwnerChanged": + reload_podman_network() + else: + return None + return None + +def signal_listener(): + try: + DBusGMainLoop(set_as_default=True)# Define the loop. + loop = GLib.MainLoop() + system_bus = dbus.SystemBus() + # Listens to systemctl restart firewalld with a filter added, will cause podman network to be reloaded twice + system_bus.add_signal_receiver(signal_handler,dbus_interface='org.freedesktop.DBus',arg0='org.fedoraproject.FirewallD1',member_keyword='member') + # Listens to firewall-cmd --reload + system_bus.add_signal_receiver(signal_handler,dbus_interface='org.fedoraproject.FirewallD1',signal_name='Reloaded',member_keyword='member') + loop.run() + except KeyboardInterrupt: + loop.quit() + sys.exit(0) + except Exception as e: + loop.quit() + sys.stderr.write(f"Error occurred {e}") + sys.exit(1) + +if __name__ == "__main__": + signal_listener() +``` + +### 31) Podman run fails with `ERRO[0000] XDG_RUNTIME_DIR directory "/run/user/0" is not owned by the current user` or `Error: creating tmpdir: mkdir /run/user/1000: permission denied`. + +A failure is encountered when performing `podman run` with a warning `XDG_RUNTIME_DIR is pointing to a path which is not writable. Most likely podman will fail.` + +#### Symptom + +A rootless container is being invoked with cgroup configuration as `cgroupv2` for user with missing or invalid **systemd session**. + +Example cases +```console +# su user1 -c 'podman images' +ERRO[0000] XDG_RUNTIME_DIR directory "/run/user/0" is not owned by the current user +``` +```console +# su - user1 -c 'podman images' +Error: creating tmpdir: mkdir /run/user/1000: permission denied +``` + +#### Solution + +Podman expects a valid login session for the `rootless+cgroupv2` use-case. Podman execution is expected to fail if the login session is not present. In most cases, podman will figure out a solution on its own but if `XDG_RUNTIME_DIR` is pointing to a path that is not writable execution will most likely fail. Typical scenarios of such cases are seen when users are trying to use Podman with `su - -c ''`, or `sudo -l` and badly configured systemd session. + +Alternatives: + +* Execute Podman via __systemd-run__ that will first start a systemd login session: + + ```console + $ sudo systemd-run --machine=username@ --quiet --user --collect --pipe --wait podman run --rm docker.io/library/alpine echo hello + ``` +* Start an interactive shell in a systemd login session with the command `machinectl shell @` + and then run Podman + + ```console + $ sudo -i + # machinectl shell username@ + Connected to the local host. Press ^] three times within 1s to exit session. + $ podman run --rm docker.io/library/alpine echo hello + ``` +* Start a new systemd login session by logging in with `ssh` i.e. `ssh @localhost` and then run Podman. + +* Before invoking Podman command create a valid login session for your rootless user using `loginctl enable-linger ` + +### 32) 127.0.0.1:7777 port already bound + +After deleting a VM on macOS, the initialization of subsequent VMs fails. + +#### Symptom + +After deleting a client VM on macOS via `podman machine stop` && `podman machine rm`, attempting to `podman machine init` a new client VM leads to an error with the 127.0.0.1:7777 port already bound. + +#### Solution + +You will need to remove the hanging gv-proxy process bound to the port in question. For example, if the port mentioned in the error message is 127.0.0.1:7777, you can use the command `kill -9 $(lsof -i:7777)` in order to identify and remove the hanging process which prevents you from starting a new VM on that default port. + +### 33) The sshd process fails to run inside of the container. + +#### Symptom + +The sshd process running inside the container fails with the error +"Error writing /proc/self/loginuid". + +### Solution + +If the `/proc/self/loginuid` file is already initialized then the +`CAP_AUDIT_CONTROL` capability is required to override it. + +This happens when running Podman from a user session since the +`/proc/self/loginuid` file is already initialized. The solution is to +run Podman from a system service, either using the Podman service, and +then using podman -remote to start the container or simply by running +something like `systemd-run podman run ...`. In this case the +container will only need `CAP_AUDIT_WRITE`. + +### 34) Container creates a file that is not owned by the user's regular UID + +After running a container with rootless Podman, the non-root user sees a numerical UID and GID instead of a username and groupname. + +#### Symptom + +When listing file permissions with `ls -l` on the host in a directory that was passed as `--volume /some/dir` to `podman run`, +the UID and GID are displayed rather than the corresponding username and groupname. The UID and GID numbers displayed are +from the user's subordinate UID and GID ranges on the host system. + +An example + +```console +$ mkdir dir1 +$ chmod 777 dir1 +$ podman run --rm -v ./dir1:/dir1\:Z \ + --user 2003:2003 \ + docker.io/library/ubuntu bash -c "touch /dir1/a; chmod 600 /dir1/a" +$ ls -l dir1/a +-rw-------. 1 102002 102002 0 Jan 19 19:35 dir1/a +$ less dir1/a +less: dir1/a: Permission denied +``` + +#### Solution + +If you want to read, chown, or remove such a file, enter a user +namespace. Instead of running commands such as `less dir1/a` or `rm dir1/a`, you +need to prepend the command-line with `podman unshare`, i.e., +`podman unshare less dir1/a` or `podman unshare rm dir1/a`. To change the ownership +of the file `dir1/a` to your regular user's UID and GID, run `podman unshare chown 0:0 dir1/a`. +A file having the ownership `0:0` in the user namespace is owned by the regular +user on the host. To use Bash features, such as variable expansion and +globbing, you need to wrap the command with `bash -c`, e.g. +`podman unshare bash -c 'ls $HOME/dir1/a*'`. + +Would it have been possible to run Podman in another way so that your regular +user would have become the owner of the file? Yes, you can use the option +`--userns keep-id:uid=$uid,gid=$gid` to change how UIDs and GIDs are mapped +between the container and the host. Let's try it out. + +In the example above `ls -l` shows the UID 102002 and GID 102002. Set shell variables + +```console +$ uid_from_ls=102002 +$ gid_from_ls=102002 +``` + +Set shell variables to the lowest subordinate UID and GID + +```console +$ lowest_subuid=$(podman info --format "{{ (index .Host.IDMappings.UIDMap 1).HostID }}") +$ lowest_subgid=$(podman info --format "{{ (index .Host.IDMappings.GIDMap 1).HostID }}") +``` + +Compute the UID and GID inside the container that map to the owner of the created file on the host. + +```console +$ uid=$(( $uid_from_ls - $lowest_subuid + 1)) +$ gid=$(( $gid_from_ls - $lowest_subgid + 1)) +``` +(In the computation it was assumed that there is only one subuid range and one subgid range) + +```console +$ echo $uid +2003 +$ echo $gid +2003 +``` + +The computation shows that the UID is `2003` and the GID is `2003` inside the container. +This comes as no surprise as this is what was specified before with `--user=2003:2003`, +but the same computation could be used whenever a username is specified +or the `--user` option is not used. + +Run the container again but now with UIDs and GIDs mapped + +```console +$ mkdir dir1 +$ chmod 777 dir1 +$ podman run --rm + -v ./dir1:/dir1:Z \ + --user $uid:$gid \ + --userns keep-id:uid=$uid,gid=$gid \ + docker.io/library/ubuntu bash -c "touch /dir1/a; chmod 600 /dir1/a" +$ id -u +tester +$ id -g +tester +$ ls -l dir1/a +-rw-------. 1 tester tester 0 Jan 19 20:31 dir1/a +$ +``` + +In this example the `--user` option specified a rootless user in the container. +As the rootless user could also have been specified in the container image, e.g. + +```console +$ podman image inspect --format "user: {{.User}}" IMAGE +user: hpc +``` +the same problem could also occur even without specifying `--user`. + +Another variant of the same problem could occur when using +`--user=root:root` (the default), but where the root user creates non-root owned files +in some way (e.g by creating them themselves, or switching the effective UID to +a rootless user and then creates files). + +See also the troubleshooting tip: + +[_Podman run fails with "Error: unrecognized namespace mode keep-id\:uid=1000,gid=1000 passed"_](#39-podman-run-fails-with-error-unrecognized-namespace-mode-keep-iduid1000gid1000-passed) + +### 35) Passed-in devices or files can't be accessed in rootless container (UID/GID mapping problem) + +As a non-root user you have access rights to devices, files and directories that you +want to pass into a rootless container with `--device=...`, `--volume=...` or `--mount=..`. + +Podman by default maps a non-root user inside a container to one of the user's +subordinate UIDs and subordinate GIDs on the host. When the container user tries to access a +file, a "Permission denied" error could occur because the container user does not have the +permissions of the regular user of the host. + +#### Symptom + +* Any access inside the container is rejected with "Permission denied" +for files, directories or devices passed in to the container +with `--device=..`,`--volume=..` or `--mount=..`, e.g. + +```console +$ mkdir dir1 +$ chmod 700 dir1 +$ podman run --rm -v ./dir1:/dir1:Z \ + --user 2003:2003 \ + docker.io/library/ubuntu ls /dir1 +ls: cannot open directory '/dir1': Permission denied +``` + +#### Solution + +We follow essentially the same solution as in the previous +troubleshooting tip: + +[_Container creates a file that is not owned by the user's regular UID_](#34-container-creates-a-file-that-is-not-owned-by-the-users-regular-uid) + +but for this problem the container UID and GID can't be as +easily computed by mere addition and subtraction. + +In other words, it might be more challenging to find out the UID and +the GID inside the container that we want to map to the regular +user on the host. + +If the `--user` option is used together with a numerical UID and GID +to specify a rootless user, we already know the answer. + +If the `--user` option is used together with a username and groupname, +we could look up the UID and GID in the file `/etc/passwd` of the container. + +If the container user is not set via `--user` but instead from the +container image, we could inspect the container image + +```console +$ podman image inspect --format "user: {{.User}}" IMAGE +user: hpc +``` + +and then look it up in `/etc/passwd` of the container. + +If the problem occurs in a container that is started to run as root but later +switches to an effictive UID of a rootless user, it might be less +straightforward to find out the UID and the GID. Reading the +`Containerfile`, `Dockerfile` or the `/etc/passwd` could give a clue. + +To run the container with the rootless container UID and GID mapped to the +user's regular UID and GID on the host follow these steps: + +Set the `uid` and `gid` shell variables in a Bash shell to the UID and GID +of the user that will be running inside the container, e.g. + +```console +$ uid=2003 +$ gid=2003 +``` + +and run + +```console +$ mkdir dir1 +$ echo hello > dir1/file.txt +$ chmod 700 dir1/file.txt +$ podman run --rm \ + -v ./dir1:/dir1:Z \ + --user $uid:$gid \ + --userns keep-id:uid=$uid,gid=$gid \ + docker.io/library/alpine cat /dir1/file.txt +hello +``` + +See also the troubleshooting tip: + +[_Podman run fails with "Error: unrecognized namespace mode keep-id:uid=1000,gid=1000 passed"_](#39-podman-run-fails-with-error-unrecognized-namespace-mode-keep-iduid1000gid1000-passed) + +### 36) Images in the additional stores can be deleted even if there are containers using them + +When an image in an additional store is used, it is not locked thus it +can be deleted even if there are containers using it. + +#### Symptom + +WARN[0000] Can't stat lower layer "/var/lib/containers/storage/overlay/l/7HS76F2P5N73FDUKUQAOJA3WI5" because it does not exist. Going through storage to recreate the missing symlinks. + +#### Solution + +It is the user responsibility to make sure images in an additional +store are not deleted while being used by containers in another +store. + +### 37) Syncing bugfixes for podman-remote or setups using Podman API + +After upgrading Podman to a newer version an issue with the earlier version of Podman still presents itself while using podman-remote. + +#### Symptom + +While running podman remote commands with the most updated Podman, issues that were fixed in a prior version of Podman can arise either on the Podman client side or the Podman server side. + +#### Solution + +When upgrading Podman to a particular version for the required fixes, users often make the mistake of only upgrading the Podman client. However, suppose a setup uses `podman-remote` or uses a client that communicates with the Podman server on a remote machine via the REST API. In that case, it is required to upgrade both the Podman client and the Podman server running on the remote machine. Both the Podman client and server must be upgraded to the same version. + +Example: If a particular bug was fixed in `v4.1.0` then the Podman client must have version `v4.1.0` as well the Podman server must have version `v4.1.0`. + +### 38) Unexpected carriage returns are outputted on the terminal + +When using the __--tty__ (__-t__) flag, unexpected carriage returns are outputted on the terminal. + +#### Symptom + +The container program prints a newline (`\n`) but the terminal outputs a carriage return and a newline (`\r\n`). + +``` +$ podman run --rm -t fedora echo abc | od -c +0000000 a b c \r \n +0000005 +``` + +When run directly on the host, the result is as expected. + +``` +$ echo abc | od -c +0000000 a b c \n +0000004 +``` + +Extra carriage returns can also shift the prompt to the right. + +``` +$ podman run --rm -t fedora sh -c "echo 1; echo 2; echo 3" | cat -A +1^M$ + 2^M$ + 3^M$ + $ +``` + +#### Solution + +Run Podman without the __--tty__ (__-t__) flag. + +``` +$ podman run --rm fedora echo abc | od -c +0000000 a b c \n +0000004 +``` + +The __--tty__ (__-t__) flag should only be used when the program requires user interaction in the termainal, for instance expecting +the user to type an answer to a question. + +Where does the extra carriage return `\r` come from? + +The extra `\r` is not outputted by Podman but by the terminal. In fact, a reconfiguration of the terminal can make the extra `\r` go away. + +``` +$ podman run --rm -t fedora /bin/sh -c "stty -onlcr && echo abc" | od -c +0000000 a b c \n +0000004 +``` + +### 39) Podman run fails with "Error: unrecognized namespace mode keep-id:uid=1000,gid=1000 passed" + +Podman 4.3.0 introduced the options _uid_ and _gid_ that can be given to `--userns keep-id` which are not recognized by older versions of Podman. + +#### Symptom + +When using a Podman version older than 4.3.0, the options _uid_ and _gid_ are not recognized, and an "unrecognized namespace mode" error is raised. + +``` +$ uid=1000 +$ gid=1000 +$ podman run --rm + --user $uid:$gid \ + --userns keep-id:uid=$uid,gid=$gid \ + docker.io/library/ubuntu /bin/cat /proc/self/uid_map +Error: unrecognized namespace mode keep-id:uid=1000,gid=1000 passed +$ +``` + +#### Solution + +Use __--uidmap__ and __--gidmap__ options to describe the same UID and GID mapping. + +Run + +``` +$ uid=1000 +$ gid=1000 +$ subuidSize=$(( $(podman info --format "{{ range \ + .Host.IDMappings.UIDMap }}+{{.Size }}{{end }}" ) - 1 )) +$ subgidSize=$(( $(podman info --format "{{ range \ + .Host.IDMappings.GIDMap }}+{{.Size }}{{end }}" ) - 1 )) +$ podman run --rm \ + --user $uid:$gid \ + --uidmap 0:1:$uid \ + --uidmap $uid:0:1 \ + --uidmap $(($uid+1)):$(($uid+1)):$(($subuidSize-$uid)) \ + --gidmap 0:1:$gid \ + --gidmap $gid:0:1 \ + --gidmap $(($gid+1)):$(($gid+1)):$(($subgidSize-$gid)) \ + docker.io/library/ubuntu /bin/cat /proc/self/uid_map + 0 1 1000 + 1000 0 1 + 1001 1001 64536 +``` + +which uses the same UID and GID mapping as when specifying +`--userns keep-id:uid=$uid,gid=$gid` with Podman 4.3.0 (or greater) + +``` +$ uid=1000 +$ gid=1000 +$ podman run --rm \ + --user $uid:$gid \ + --userns keep-id:uid=$uid,gid=$gid \ + docker.io/library/ubuntu /bin/cat /proc/self/uid_map + 0 1 1000 + 1000 0 1 + 1001 1001 64536 +``` + +Replace `/bin/cat /proc/self/uid_map` with +`/bin/cat /proc/self/gid_map` to show the GID mapping. + +### 40) Podman fails to find expected image with "error locating pulled image", "image not known" + +When trying to do a Podman command that pulls an image from local storage or a remote repository, +an error is raised saying "image not known" or "error locating pulled image". Even though the image +had been verified before the Podman command was invoked. + +#### Symptom + +After verifying that an image is in place either locally or on a remote repository, a Podman command +referencing that image will fail in a manner like: +``` +# ls Containerfile +FROM registry.access.redhat.com/ubi8-minimal:latest +MAINTAINER Podman Community +USER root + +# podman build . +STEP 1/2: FROM registry.access.redhat.com/ubi8-minimal +Trying to pull registry.access.redhat.com/ubi8-minimal:latest... +Getting image source signatures +Checking if image destination supports signatures +Copying blob a6577091999b done +Copying config abb1ba1bce done +Writing manifest to image destination +Storing signatures +Error: error creating build container: error locating pulled image "registry.access.redhat.com/ubi8-minimal:latest" name in containers storage: registry.access.redhat.com/ubi8-minimal\:latest: image not known +``` + +#### Solution +The general cause for this is a timing issue. To make Podman commands as +efficient as possible, read and write locks are only established for critical +sections within the code. When pulling an image from a repository, a copy of +that image is first written to local storage using a write lock. This lock is +released before the image is then acquired/read. If another process does a +harmful command such as `podman system prune --all` or `podman system reset` +or `podman rmi --all`, between the time the image is written and before the +first process can acquire it, this type of `image not known` error can arise. + +The maintainers of Podman have considered heavier-duty locks to close this +timing window. However, the slowdown that all Podman commands would encounter +was not considered worth the cost of completely closing this small timing window. + +### 41) A podman build step with `--mount=type=secret` fails with "operation not permitted" + +Executing a step in a `Dockerfile`/`Containerfile` which mounts secrets using `--mount=type=secret` fails with "operation not permitted" when running on a host filesystem mounted with `nosuid` and when using the `runc` runtime. + +#### Symptom + +A `RUN` line in the `Dockerfile`/`Containerfile` contains a [secret mount](https://github.com/containers/common/blob/main/docs/Containerfile.5.md) such as `--mount=type=secret,id=MY_USER,target=/etc/dnf/vars/MY_USER`. +When running `podman build` the process fails with an error message like: + +``` +STEP 3/13: RUN --mount=type=secret,id=MY_USER,target=/etc/dnf/vars/MY_USER --mount=type=secret,id=MY_USER,target=/etc/dnf/vars/MY_USER ...: time="2023-06-13T18:04:59+02:00" level=error msg="runc create failed: unable to start container process: error during container init: error mounting \"/var/tmp/buildah2251989386/mnt/buildah-bind-target-11\" to rootfs at \"/etc/dnf/vars/MY_USER\": mount /var/tmp/buildah2251989386/mnt/buildah-bind-target-11:/etc/dnf/vars/MY_USER (via /proc/self/fd/7), flags: 0x1021: operation not permitted" +: exit status 1 +ERRO[0002] did not get container create message from subprocess: EOF +``` + +#### Solution + +* Install `crun`, e.g. with `dnf install crun`. +* Use the `crun` runtime by passing `--runtime /usr/bin/crun` to `podman build`. + +See also [Buildah issue 4228](https://github.com/containers/buildah/issues/4228) for a full discussion of the problem. + +### 42) podman-in-podman builds that are file I/0 intensive are very slow + +When using the `overlay` storage driver to do a nested `podman build` inside a running container, file I/O operations such as `COPY` of a large amount of data is very slow or can hang completely. + +#### Symptom + +Using the default `overlay` storage driver, a `COPY`, `ADD`, or an I/O intensive `RUN` line in a `Containerfile` that is run inside another container is very slow or hangs completely when running a `podman build` inside the running parent container. + +#### Solution + +This could be caused by the child container using `fuse-overlayfs` for writing to `/var/lib/containers/storage`. Writes can be slow with `fuse-overlayfs`. The solution is to use the native `overlay` filesystem by using a local directory on the host system as a volume to `/var/lib/containers/storage` like so: `podman run --privileged --rm -it -v ./nested_storage:/var/lib/containers/storage parent:latest`. Ensure that the base image of `parent:latest` in this example has no contents in `/var/lib/containers/storage` in the image itself for this to work. Once using the native volume, the nested container should not fall back to `fuse-overlayfs` to write files and the nested build will complete much faster. + +If you don't have access to the parent run process, such as in a CI environment, then the second option is to change the storage driver to `vfs` in the parent image by changing changing this line in your `storage.conf` file: `driver = "vfs"`. You may have to run `podman system reset` for this to take effect. You know it's changed when `podman info |grep graphDriverName` outputs `graphDriverName: vfs`. This method is slower performance than using the volume method above but is significantly faster than `fuse-overlayfs` + +### 43) `podman run --userns=auto` fails with "Error: creating container storage: not enough unused IDs in user namespace" + +Using `--userns=auto` when creating new containers does not work as long as any containers exist that were created with `--userns=keep-id` or `--userns=nomap` + +#### Symptom + +1. Run with `--userns=auto` + ``` + $ podman run --rm -d --userns=auto alpine sleep 3600 + ``` + The command succeeds. +2. Run with `--userns=auto` + ``` + $ podman run --rm -d --userns=auto alpine sleep 3600 + ``` + The command succeeds. +3. Run with `--userns=keep-id` + ``` + $ podman run --rm -d --userns=keep-id alpine sleep 3600 + ``` + The command succeeds. +4. Run with `--userns=auto` + ``` + $ podman run --rm -d --userns=auto alpine sleep 3600 + ``` + The command fails with the error message + ``` + Error: creating container storage: not enough unused IDs in user namespace + ``` + +#### Solution + +Any existing containers that were created using `--userns=keep-id` or `--userns=nomap` must first be deleted before any new container can be created with `--userns=auto` + +### 44) `sudo podman run --userns=auto` fails with `Cannot find mappings for user "containers"` + +When rootful podman is invoked with `--userns=auto`, podman needs to +pick subranges of subuids and subgids for the user namespace of the container. +Rootful podman ensures that the subuid and subgid ranges for such containers +do not overlap, but how can rootful podman prevent other tools +from accidentally using these IDs? + +It's not possible to block other tools that are running as root from using these IDs, +but such tools would normally not use subuids and subgids that have already +been assigned to a user in _/etc/subuid_ and _/etc/subgid_. + +The username _containers_ on the host has a special function for rootful Podman. +Rootful podman uses the subuids and subgids of the user _containers_ when +running `--userns=auto` containers. The user _containers_ has no need for these +subuids and subgids because no processes should be started as the user _containers_. +In other words, the user _containers_ is a special user that only exists on the system +to reserve _subuids_ and _subgids_ for rootful podman. + +_containers_ is the default username but it can be changed by setting the +option `root-auto-userns-user` in the file _/etc/containers/storage.conf_ + +#### Symptom + +Run rootful podman with `--userns=auto` +``` +sudo podman run --rm --userns=auto alpine echo hello +``` +The command fails with the error message: +``` +ERRO[0000] Cannot find mappings for user "containers": no subuid ranges found for user "containers" in /etc/subuid +Error: creating container storage: not enough unused IDs in user namespace +``` + +The files _/etc/subuid_ and _/etc/subgid_ do not have any lines that start with `containers:` + +#### Solution + +Add subuid and subgid ranges for the user _containers_ in _/etc/subuid_ and _/etc/subgid_ +or provide such ranges with _/etc/nsswitch.conf_. +For details, see [subid(5)](https://man7.org/linux/man-pages/man5/subuid.5.html). + +The following steps create the user _containers_ and assigns big subuid and subgid ranges to it: + +1. Create the user _containers_ + ``` + sudo useradd --comment "Helper user to reserve subuids and subgids for Podman" \ + --no-create-home \ + --shell /usr/sbin/nologin \ + containers + ``` +2. Check the subuid and subgid ranges of the user _containers_ + ``` + $ grep ^containers: /etc/subuid + containers:720896:65536 + $ grep ^containers: /etc/subgid + containers:720896:65536 + ``` + By default __useradd__ assigns 65536 subuids and 65536 subgids to a new user. + Typically you would like the reserved pool to be bigger than that. The bigger + the size, the more containers could be started with `sudo podman run --userns=auto ...` +3. Edit the line for the user _containers_ in the files _/etc/subuid_ and _/etc/subgid_ + to make the ranges bigger. Ensure that the subuid range of the user _containers_ do + not overlap with any other subuid ranges in the files _/etc/subuid_. Ensure that the + subgid range of the user _containers_ do not overlap with any other subgid ranges in + the files _/etc/subgid_. + +Test the echo command again + +``` +sudo podman run --rm --userns=auto alpine echo hello +``` + +The command succeeds and prints `hello` diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-unmount.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-unmount.1.md new file mode 100644 index 000000000..3789b5332 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-unmount.1.md @@ -0,0 +1,75 @@ +--- +title: podman-unmount +version: v5.5.1 +--- + +% podman-unmount 1 + +## NAME +podman\-unmount - Unmount a working container's root filesystem + +## SYNOPSIS +**podman unmount** [*options*] *container* [...] + +**podman umount** [*options*] *container* [...] + +**podman container unmount** [*options*] *container* [...] + +**podman container umount** [*options*] *container* [...] + +## DESCRIPTION +Unmounts the specified containers' root file system, if no other processes +are using it. + +Container storage increments a mount counter each time a container is mounted. +When a container is unmounted, the mount counter is decremented, and the +container's root filesystem is physically unmounted only when the mount +counter reaches zero indicating no other processes are using the mount. +An unmount can be forced with the --force flag. + +Note: Podman can be used to unmount Podman containers as well as external containers. +External containers are containers created in container/storage by other tools like +Buildah and CRI-O. + +## OPTIONS +#### **--all**, **-a** + +All of the currently mounted containers are unmounted. + +#### **--force**, **-f** + +Force the unmounting of specified containers' root file system, even if other +processes have mounted it. + +Note: Other processes can fail if the mount point they are using is removed without their knowledge. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Unmount container with a given ID: +``` +podman container unmount containerID +``` + +Unmount multiple containers with given IDs: +``` +podman unmount containerID1 containerID2 containerID3 +``` + +Unmount all containers: +``` +podman unmount --all +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-mount(1)](podman-mount.1.md)**, **[podman-image-mount(1)](podman-image-mount.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-unpause.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-unpause.1.md new file mode 100644 index 000000000..85a9cf251 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-unpause.1.md @@ -0,0 +1,103 @@ +--- +title: podman-unpause +version: v5.5.1 +--- + +% podman-unpause 1 + +## NAME +podman\-unpause - Unpause one or more containers + +## SYNOPSIS +**podman unpause** [*options*]|[*container* ...] + +**podman container unpause** [*options*]|[*container* ...] + +## DESCRIPTION +Unpauses the processes in one or more containers. Container IDs or names can be used as input. + +## OPTIONS + +#### **--all**, **-a** + +Unpause all paused containers. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and unpause the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + +#### **--filter**, **-f**=*filter* + +Filter what containers unpause. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Unpause specified container: +``` +podman unpause mywebserver +``` + +Unpause container by a partial container ID: +``` +podman unpause 860a4b23 +``` + +Unpause all **paused** containers: +``` +podman unpause --all +``` + +Unpause container using ID specified in given files: +``` +podman unpause --cidfile /home/user/cidfile-1 +podman unpause --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +Unpause the latest container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman unpause --latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pause(1)](podman-pause.1.md)** + +## HISTORY +September 2017, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-unshare.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-unshare.1.md new file mode 100644 index 000000000..c30762965 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-unshare.1.md @@ -0,0 +1,114 @@ +--- +title: podman-unshare +version: v5.5.1 +--- + +% podman-unshare 1 + +## NAME +podman\-unshare - Run a command inside of a modified user namespace + +## SYNOPSIS +**podman unshare** [*options*] [*command*] + +## DESCRIPTION +Launches a process (by default, *$SHELL*) in a new user namespace. The user +namespace is configured so that the invoking user's UID and primary GID appear +to be UID 0 and GID 0, respectively. Any ranges which match that user and +group in `/etc/subuid` and `/etc/subgid` are also mapped in as themselves with the +help of the *newuidmap(1)* and *newgidmap(1)* helpers. + +**podman unshare** is useful for troubleshooting unprivileged operations and for +manually clearing storage and other data related to images and containers. + +It is also useful to use the **podman mount** command. If an unprivileged user wants to mount and work with a container, then they need to execute +**podman unshare**. Executing **podman mount** fails for unprivileged users unless the user is running inside a **podman unshare** session. + +The unshare session defines two environment variables: + +- **CONTAINERS_GRAPHROOT**: the path to the persistent container's data. +- **CONTAINERS_RUNROOT**: the path to the volatile container's data. + +*IMPORTANT: This command is not available with the remote Podman client.* + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--rootless-netns** + +Join the rootless network namespace used for netavark networking. It can be used to +connect to a rootless container via IP address (bridge networking). This is otherwise +not possible from the host network namespace. + +## Exit Codes + +The exit code from `podman unshare` gives information about why the container +failed to run or why it exited. When `podman unshare` commands exit with a non-zero code, +the exit codes follow the `chroot` standard, see below: + + **125** The error is with podman **_itself_** + + $ podman unshare --foo; echo $? + Error: unknown flag: --foo + 125 + + **126** Executing a _contained command_ and the _command_ cannot be invoked + + $ podman unshare /etc; echo $? + Error: fork/exec /etc: permission denied + 126 + + **127** Executing a _contained command_ and the _command_ cannot be found + + $ podman unshare foo; echo $? + Error: fork/exec /usr/bin/bogus: no such file or directory + 127 + + **Exit code** _contained command_ exit code + + $ podman unshare /bin/sh -c 'exit 3'; echo $? + 3 + +## EXAMPLE + +Execute specified command in rootless user namespace: +``` +$ podman unshare id +uid=0(root) gid=0(root) groups=0(root),65534(nobody) +``` + +Show user namespace mappings for rootless containers: +``` +$ podman unshare cat /proc/self/uid_map /proc/self/gid_map + 0 1000 1 + 1 10000 65536 + 0 1000 1 + 1 10000 65536 +``` + + +Show rootless netns information in user namespace for rootless containers: +``` +$ podman unshare --rootless-netns ip addr +1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 + link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 + inet 127.0.0.1/8 scope host lo + valid_lft forever preferred_lft forever + inet6 ::1/128 scope host + valid_lft forever preferred_lft forever +2: tap0: mtu 65520 qdisc fq_codel state UNKNOWN group default qlen 1000 + link/ether aa:8c:0b:73:98:f6 brd ff:ff:ff:ff:ff:ff + inet 10.0.2.100/24 brd 10.0.2.255 scope global tap0 + valid_lft forever preferred_lft forever + inet6 fd00::a88c:bff:fe73:98f6/64 scope global dynamic mngtmpaddr + valid_lft 86389sec preferred_lft 14389sec + inet6 fe80::a88c:bff:fe73:98f6/64 scope link + valid_lft forever preferred_lft forever +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-mount(1)](podman-mount.1.md)**, **namespaces(7)**, **newuidmap(1)**, **newgidmap(1)**, **user\_namespaces(7)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-untag.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-untag.1.md new file mode 100644 index 000000000..6f72d7d8c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-untag.1.md @@ -0,0 +1,46 @@ +--- +title: podman-untag +version: v5.5.1 +--- + +% podman-untag 1 + +## NAME +podman\-untag - Remove one or more names from a locally-stored image + +## SYNOPSIS +**podman untag** *image* [*name*[:*tag*]...] + +**podman image untag** *image* [*name*[:*tag*]...] + +## DESCRIPTION +Remove one or more names from an image in the local storage. The image can be referred to by ID or reference. If no name is specified, all names are removed from the image. If a specified name is a short name and does not include a registry, `localhost/` is prefixed (e.g., `fedora` -> `localhost/fedora`). If a specified name does not include a tag, `:latest` is appended (e.g., `localhost/fedora` -> `localhost/fedora\\:latest`). + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Remove all tags from the specified image. +``` +$ podman untag 0e3bbc2 +``` + +Remove tag from specified image. +``` +$ podman untag imageName:latest otherImageName:latest +``` + +Remove multiple tags from the specified image. +``` +$ podman untag httpd myhttpd myregistryhost:5000/fedora/httpd\\:v2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +December 2019, Originally compiled by Sascha Grunert diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-update.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-update.1.md new file mode 100644 index 000000000..64585fedf --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-update.1.md @@ -0,0 +1,562 @@ +--- +title: podman-update +version: v5.5.1 +--- + +% podman-update 1 + +## NAME +podman\-update - Update the configuration of a given container + +## SYNOPSIS +**podman update** [*options*] *container* + +**podman container update** [*options*] *container* + +## DESCRIPTION + +Updates the configuration of an existing container, allowing changes to resource limits and healthchecks. + +## OPTIONS + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-rt-period.md) +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-period.md) + + +[//]: # (BEGIN included file options/cpu-rt-runtime.md) +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-runtime.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpus.container.md) +#### **--cpus**=*number* + +Number of CPUs. The default is *0.0* which means no limit. This is shorthand +for **--cpu-period** and **--cpu-quota**, therefore the option cannot be specified with +**--cpu-period** or **--cpu-quota**. + +On some systems, changing the CPU limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpus.container.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-read-iops.md) +#### **--device-read-iops**=*path:rate* + +Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-iops.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + + +[//]: # (BEGIN included file options/device-write-iops.md) +#### **--device-write-iops**=*path:rate* + +Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-iops.md) + + +[//]: # (BEGIN included file options/env.update.md) +#### **--env**, **-e**=*env* + +Add a value (e.g. env=*value*) to the container. Can be used multiple times. +If the value already exists in the container, it is overridden. +To remove an environment variable from the container, use the `--unsetenv` +option. + +Note that the env updates only affect the main container process after +the next start. + +[//]: # (END included file options/env.update.md) + + +[//]: # (BEGIN included file options/health-cmd.md) +#### **--health-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set or alter a healthcheck command for a container. The command is a command to be executed inside the +container that determines the container health. The command is required for other healthcheck options +to be applied. A value of **none** disables existing healthchecks. + +Multiple options can be passed in the form of a JSON array; otherwise, the command is interpreted +as an argument to **/bin/sh -c**. + +Note: The default values are used even if healthcheck is configured in the image. + +[//]: # (END included file options/health-cmd.md) + + +[//]: # (BEGIN included file options/health-interval.md) +#### **--health-interval**=*interval* + +Set an interval for the healthchecks. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-interval.md) + +Changing this setting resets the timer. + + +[//]: # (BEGIN included file options/health-log-destination.md) +#### **--health-log-destination**=*directory_path* + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) (Default: local) + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. + +[//]: # (END included file options/health-log-destination.md) + +Warning: Changing this setting may cause the loss of previous logs. + + +[//]: # (BEGIN included file options/health-max-log-count.md) +#### **--health-max-log-count**=*number of stored logs* + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) (Default: 5 attempts) + +[//]: # (END included file options/health-max-log-count.md) + + +[//]: # (BEGIN included file options/health-max-log-size.md) +#### **--health-max-log-size**=*size of stored logs* + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) (Default: 500 characters) + +[//]: # (END included file options/health-max-log-size.md) + + +[//]: # (BEGIN included file options/health-on-failure.md) +#### **--health-on-failure**=*action* + +Action to take once the container transitions to an unhealthy state. The default is **none**. + +- **none**: Take no action. +- **kill**: Kill the container. +- **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. +- **stop**: Stop the container. + +[//]: # (END included file options/health-on-failure.md) + + +[//]: # (BEGIN included file options/health-retries.md) +#### **--health-retries**=*retries* + +The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is **3**. + +Note: This parameter can overwrite the healthcheck configuration from the image. + +[//]: # (END included file options/health-retries.md) + + +[//]: # (BEGIN included file options/health-start-period.md) +#### **--health-start-period**=*period* + +The initialization time needed for a container to bootstrap. The value can be expressed in time format like +**2m3s**. The default value is **0s**. + +Note: The health check command is executed as soon as a container is started, if the health check is successful +the container's health state will be updated to `healthy`. However, if the health check fails, the health state will +stay as `starting` until either the health check is successful or until the `--health-start-period` time is over. If the +health check command fails after the `--health-start-period` time is over, the health state will be updated to `unhealthy`. +The health check command is executed periodically based on the value of `--health-interval`. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-start-period.md) + + +[//]: # (BEGIN included file options/health-startup-cmd.md) +#### **--health-startup-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set a startup healthcheck command for a container. This command is executed inside the container and is used to gate the regular +healthcheck. When the startup command succeeds, the regular healthcheck begins and the startup healthcheck ceases. Optionally, +if the command fails for a set number of attempts, the container is restarted. A startup healthcheck can be used to ensure that +containers with an extended startup period are not marked as unhealthy until they are fully started. Startup healthchecks can only be +used when a regular healthcheck (from the container's image or the **--health-cmd** option) is also set. + +[//]: # (END included file options/health-startup-cmd.md) + + +[//]: # (BEGIN included file options/health-startup-interval.md) +#### **--health-startup-interval**=*interval* + +Set an interval for the startup healthcheck. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-startup-interval.md) + +Changing this setting resets the timer, depending on the state of the container. + + +[//]: # (BEGIN included file options/health-startup-retries.md) +#### **--health-startup-retries**=*retries* + +The number of attempts allowed before the startup healthcheck restarts the container. If set to **0**, the container is never restarted. The default is **0**. + +[//]: # (END included file options/health-startup-retries.md) + + +[//]: # (BEGIN included file options/health-startup-success.md) +#### **--health-startup-success**=*retries* + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value +of **0** means that any success begins the regular healthcheck. The default is **0**. + +[//]: # (END included file options/health-startup-success.md) + + +[//]: # (BEGIN included file options/health-startup-timeout.md) +#### **--health-startup-timeout**=*timeout* + +The maximum time a startup healthcheck command has to complete before it is marked as failed. The value can be expressed in a time +format like **2m3s**. The default value is **30s**. + +[//]: # (END included file options/health-startup-timeout.md) + + +[//]: # (BEGIN included file options/health-timeout.md) +#### **--health-timeout**=*timeout* + +The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the +value can be expressed in a time format such as **1m22s**. The default value is **30s**. + +Note: A timeout marks the healthcheck as failed but does not terminate the running process. +This ensures that a slow but eventually successful healthcheck does not disrupt the container +but is still accounted for in the health status. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-timeout.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-reservation.md) +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-reservation.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/memory-swappiness.md) +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/memory-swappiness.md) + + +[//]: # (BEGIN included file options/no-healthcheck.md) +#### **--no-healthcheck** + +Disable any defined healthchecks for container. + +[//]: # (END included file options/no-healthcheck.md) + + +[//]: # (BEGIN included file options/pids-limit.md) +#### **--pids-limit**=*limit* + +Tune the container's pids limit. Set to **-1** to have unlimited pids for the container. The default is **2048** on systems that support "pids" cgroup controller. + +[//]: # (END included file options/pids-limit.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + + +[//]: # (BEGIN included file options/unsetenv.update.md) +#### **--unsetenv**=*env* + +Unset environment variables from the container. + +Note that the env updates only affect the main container process after +the next start. + +[//]: # (END included file options/unsetenv.update.md) + + +## EXAMPLEs + +Update a container with a new cpu quota and period. +``` +podman update --cpus=5 myCtr +``` + +Update a container with all available options for cgroups v2. +``` +podman update --cpus 5 --cpuset-cpus 0 --cpu-shares 123 --cpuset-mems 0 --memory 1G --memory-swap 2G --memory-reservation 2G --blkio-weight-device /dev/zero:123 --blkio-weight 123 --device-read-bps /dev/zero:10mb --device-write-bps /dev/zero:10mb --device-read-iops /dev/zero:1000 --device-write-iops /dev/zero:1000 --pids-limit 123 ctrID +``` + +Update a container with all available options for cgroups v1. +``` +podman update --cpus 5 --cpuset-cpus 0 --cpu-shares 123 --cpuset-mems 0 --memory 1G --memory-swap 2G --memory-reservation 2G --memory-swappiness 50 --pids-limit 123 ctrID +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-create(1)](podman-create.1.md)**, **[podman-run(1)](podman-run.1.md)** + +## HISTORY +August 2022, Originally written by Charlie Doern diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-version.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-version.1.md new file mode 100644 index 000000000..c23b50cb9 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-version.1.md @@ -0,0 +1,60 @@ +--- +title: podman-version +version: v5.5.1 +--- + +% podman-version 1 + +## NAME +podman\-version - Display the Podman version information + +## SYNOPSIS +**podman version** [*options*] + +## DESCRIPTION +Shows the following information: Remote API Version, Version, Go Version, Git Commit, Build Time, +OS, and Architecture. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change output format to "json" or a Go template. + +| **Placeholder** | **Description** | +| ------------------- | ------------------------ | +| .Client ... | Version of local podman | +| .Server ... | Version of remote podman | + +Each of the above fields branch deeper into further subfields +such as .Version, .APIVersion, .GoVersion, and more. + +## Example + +A sample output of the `version` command: +``` +$ podman version +Version: 2.0.0 +API Version: 1 +Go Version: go1.14.2 +Git Commit: 4520664f63c3a7f9a80227715359e20069d95542 +Built: Tue May 19 10:48:59 2020 +OS/Arch: linux/amd64 +``` + +Filtering out only the version: +``` +$ podman version --format '{{.Client.Version}}' +2.0.0 +``` + +#### **--help**, **-h** + +Print usage statement + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +November 2018, Added --format flag by Tomas Tomecek +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-volume-create.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-volume-create.1.md new file mode 100644 index 000000000..36be4d19e --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-volume-create.1.md @@ -0,0 +1,213 @@ +--- +title: podman-volume-create +version: v5.5.1 +--- + +% podman-volume-create 1 + +## NAME +podman\-volume\-create - Create a new volume + +## SYNOPSIS +**podman volume create** [*options*] [*name*] + +## DESCRIPTION + +Creates an empty volume and prepares it to be used by containers. The volume +can be created with a specific name, if a name is not given a random name is +generated. You can add metadata to the volume by using the **--label** flag and +driver options can be set using the **--opt** flag. + +## OPTIONS + +#### **--driver**, **-d**=*driver* + +Specify the volume driver name (default **local**). +There are two drivers supported by Podman itself: **local** and **image**. + +The **local** driver uses a directory on disk as the backend by default, but can also use the **mount(8)** command to mount a filesystem as the volume if **--opt** is specified. + +The **image** driver uses an image as the backing store of for the volume. +An overlay filesystem is created, which allows changes to the volume to be committed as a new layer on top of the image. + +Using a value other than **local** or **image**, Podman attempts to create the volume using a volume plugin with the given name. +Such plugins must be defined in the **volume_plugins** section of the **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** configuration file. + +#### **--help** + +Print usage statement + +#### **--ignore** + +Don't fail if the named volume already exists, instead just print the name. Note that the new options are not applied to the existing volume. + +#### **--label**, **-l**=*label* + +Set metadata for a volume (e.g., --label mykey=value). + +#### **--opt**, **-o**=*option* + +Set driver specific options. +For the default driver, **local**, this allows a volume to be configured to mount a filesystem on the host. + +For the `local` driver the following options are supported: `type`, `device`, `o`, and `[no]copy`. + + - The `type` option sets the type of the filesystem to be mounted, and is equivalent to the `-t` flag to **mount(8)**. + - The `device` option sets the device to be mounted, and is equivalent to the `device` argument to **mount(8)**. + - The `copy` option enables copying files from the container image path where the mount is created to the newly created volume on the first run. `copy` is the default. + +The `o` option sets options for the mount, and is equivalent to the filesystem +options (also `-o`) passed to **mount(8)** with the following exceptions: + + - The `o` option supports `uid` and `gid` options to set the UID and GID of the created volume that are not normally supported by **mount(8)**. + - The `o` option supports the `size` option to set the maximum size of the created volume, the `inodes` option to set the maximum number of inodes for the volume, and `noquota` to completely disable quota support even for tracking of disk usage. + The `size` option is supported on the "tmpfs" and "xfs[note]" file systems. + The `inodes` option is supported on the "xfs[note]" file systems. + Note: xfs filesystems must be mounted with the `prjquota` flag described in the **xfs_quota(8)** man page. Podman will throw an error if they're not. + - The `o` option supports using volume options other than the UID/GID options with the **local** driver and requires root privileges. + - The `o` options supports the `timeout` option which allows users to set a driver specific timeout in seconds before volume creation fails. For example, **--opt=o=timeout=10** sets a driver timeout of 10 seconds. + +***Note*** Do not confuse the `--opt,-o` create option with the `-o` mount option. For example, with `podman volume create`, use `-o=o=uid=1000` *not* `-o=uid=1000`. + +For the **image** driver, the only supported option is `image`, which specifies the image the volume is based on. +This option is mandatory when using the **image** driver. + +When not using the **local** and **image** drivers, the given options are passed directly to the volume plugin. In this case, supported options are dictated by the plugin in question, not Podman. + +## EXAMPLES + +Create empty volume. +``` +$ podman volume create +``` + +Create empty named volume. +``` +$ podman volume create myvol +``` + +Create empty named volume with specified label. +``` +$ podman volume create --label foo=bar myvol +``` + +Create tmpfs named volume with specified size and mount options. +``` +# podman volume create --opt device=tmpfs --opt type=tmpfs --opt o=size=2M,nodev,noexec myvol +``` + +Create tmpfs named volume testvol with specified options. +``` +# podman volume create --opt device=tmpfs --opt type=tmpfs --opt o=uid=1000,gid=1000 testvol +``` + +Create image named volume using the specified local image in containers/storage. +``` +# podman volume create --driver image --opt image=fedora\:latest fedoraVol +``` + +## QUOTAS + +`podman volume create` uses `XFS project quota controls` for controlling the size and the number of inodes of builtin volumes. The directory used to store the volumes must be an `XFS` file system and be mounted with the `pquota` option. + +Example /etc/fstab entry: +``` +/dev/podman/podman-var /var xfs defaults,x-systemd.device-timeout=0,pquota 1 2 +``` + +Podman generates project IDs for each builtin volume, but these project IDs need to be unique for the XFS file system. These project IDs by default are generated randomly, with a potential for overlap with other quotas on the same file +system. + +The xfs_quota tool can be used to assign a project ID to the storage driver directory, e.g.: + +``` +echo 100000:/var/lib/containers/storage/overlay >> /etc/projects +echo 200000:/var/lib/containers/storage/volumes >> /etc/projects +echo storage:100000 >> /etc/projid +echo volumes:200000 >> /etc/projid +xfs_quota -x -c 'project -s storage volumes' / +``` + +In the example above we are configuring the overlay storage driver for newly +created containers as well as volumes to use project IDs with a **start offset**. +All containers are assigned larger project IDs (e.g. >= 100000). +All volume assigned project IDs larger project IDs starting with 200000. +This prevents xfs_quota management conflicts with containers/storage. + +## MOUNT EXAMPLES + +`podman volume create` allows the `type`, `device`, and `o` options to be passed to `mount(8)` when using the `local` driver. + +## [s3fs-fuse](https://github.com/s3fs-fuse/s3fs-fuse) + +[s3fs-fuse](https://github.com/s3fs-fuse/s3fs-fuse) or just `s3fs`, is a [fuse](https://github.com/libfuse/libfuse) filesystem that allows s3 prefixes to be mounted as filesystem mounts. + +**Installing:** +```shell +$ doas dnf install s3fs-fuse +``` + +**Simple usage:** +```shell +$ s3fs --help +$ s3fs -o use_xattr,endpoint=aq-central-1 bucket:/prefix /mnt +``` + +**Equivalent through `mount(8)`** +```shell +$ mount -t fuse.s3fs -o use_xattr,endpoint=aq-central-1 bucket:/prefix /mnt +``` + +**Equivalent through `podman volume create`** +```shell +$ podman volume create s3fs-fuse-volume -o type=fuse.s3fs -o device=bucket:/prefix -o o=use_xattr,endpoint=aq-central-1 +``` + +**The volume can then be mounted in a container with** +```shell +$ podman run -v s3fs-fuse-volume:/s3:z --rm -it fedora:latest +``` + +Please see the available [options](https://github.com/s3fs-fuse/s3fs-fuse/wiki/Fuse-Over-Amazon#options) on their wiki. + +### Using with other container users + +The above example works because the volume is mounted as the host user and inside the container `root` is mapped to the user in the host. + +If the mount is accessed by a different user inside the container, a "Permission denied" error will be raised. + +```shell +$ podman run --user bin:bin -v s3fs-fuse-volume:/s3:z,U --rm -it fedora:latest +$ ls /s3 +# ls: /s3: Permission denied +``` + +In FUSE-land, mounts are protected for the user who mounted them; specify the `allow_other` mount option if other users need access. +> Note: This will remove the normal fuse [security measures](https://github.com/libfuse/libfuse/wiki/FAQ#why-dont-other-users-have-access-to-the-mounted-filesystem) on the mount point, after which, the normal filesystem permissions will have to protect it + +```shell +$ podman volume create s3fs-fuse-other-volume -o type=fuse.s3fs -o device=bucket:/prefix -o o=allow_other,use_xattr,endpoint=aq-central-1 +$ podman run --user bin:bin -v s3fs-fuse-volume:/s3:z,U --rm -it fedora\:latest +$ ls /s3 +``` + +### The Prefix must exist + +`s3fs` will fail to mount if the prefix does not exist in the bucket. + +Create a s3-directory by putting an empty object at the desired `prefix/` key +```shell +$ aws s3api put-object --bucket bucket --key prefix/ +``` + +If performance is the priority, please check out the more performant [goofys](https://github.com/kahing/goofys). + +> FUSE filesystems exist for [Google Cloud Storage](https://github.com/GoogleCloudPlatform/gcsfuse) and [Azure Blob Storage](https://github.com/Azure/azure-storage-fuse) + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[podman-volume(1)](podman-volume.1.md)**, **mount(8)**, **xfs_quota(8)**, **xfs_quota(8)**, **projects(5)**, **projid(5)** + +## HISTORY +January 2020, updated with information on volume plugins by Matthew Heon +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-volume-exists.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-volume-exists.1.md new file mode 100644 index 000000000..0bfb8b4ca --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-volume-exists.1.md @@ -0,0 +1,48 @@ +--- +title: podman-volume-exists +version: v5.5.1 +--- + +% podman-volume-exists 1 + +## NAME +podman\-volume\-exists - Check if the given volume exists + +## SYNOPSIS +**podman volume exists** *volume* + +## DESCRIPTION +**podman volume exists** checks if a volume exists. Podman returns an exit code +of `0` when the volume is found. A `1` is returned otherwise. An exit code of +`125` indicates there was another issue. + + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLE + +Check if a volume called `myvol` exists (the volume does actually exist). +``` +$ podman volume exists myvol +$ echo $? +0 +$ +``` + +Check if a volume called `mysql` exists (the volume does not actually exist). +``` +$ podman volume exists mysql +$ echo $? +1 +$ +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** + +## HISTORY +January 2021, Originally compiled by Paul Holzinger `` diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-volume-export.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-volume-export.1.md new file mode 100644 index 000000000..3c5274e8a --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-volume-export.1.md @@ -0,0 +1,43 @@ +--- +title: podman-volume-export +version: v5.5.1 +--- + +% podman-volume-export 1 + +## NAME +podman\-volume\-export - Export volume to external tar + +## SYNOPSIS +**podman volume export** [*options*] *volume* + +## DESCRIPTION + +**podman volume export** exports the contents of a podman volume and saves it as a tarball +on the local machine. **podman volume export** writes to STDOUT by default and can be +redirected to a file using the `--output` flag. + +Note: Following command is not supported by podman-remote. + +**podman volume export [OPTIONS] VOLUME** + +## OPTIONS + +#### **--help** + +Print usage statement + +#### **--output**, **-o**=*file* + +Write to a file, default is STDOUT + +## EXAMPLES + +Export named volume content into the specified file. +``` +$ podman volume export myvol --output myvol.tar + +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-volume-import(1)](podman-volume-import.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-volume-import.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-volume-import.1.md new file mode 100644 index 000000000..b3322830c --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-volume-import.1.md @@ -0,0 +1,46 @@ +--- +title: podman-volume-import +version: v5.5.1 +--- + +% podman-volume-import 1 + +## NAME +podman\-volume\-import - Import tarball contents into an existing podman volume + +## SYNOPSIS +**podman volume import** *volume* [*source*] + +## DESCRIPTION + +**podman volume import** imports the contents of a tarball into the podman volume's mount point. +The contents of the volume is merged with the content of the tarball with the latter taking precedence. +**podman volume import** can consume piped input when using `-` as source path. + +The given volume must already exist and is not created by podman volume import. + +Note: Following command is not supported by podman-remote. + +#### **--help** + +Print usage statement + +## EXAMPLES + +Import named volume content from the specified file. +``` +$ podman volume import myvol test.tar +``` + +Import named volume content from stdin. +``` +$ gunzip -c hello.tar.gz | podman volume import myvol - +``` + +Export the content from named volume and pipe it into the named volume via stdin. +``` +$ podman volume export oldmyvol | podman volume import myvol - +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-volume-export(1)](podman-volume-export.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-volume-inspect.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-volume-inspect.1.md new file mode 100644 index 000000000..76a1d52af --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-volume-inspect.1.md @@ -0,0 +1,109 @@ +--- +title: podman-volume-inspect +version: v5.5.1 +--- + +% podman-volume-inspect 1 + +## NAME +podman\-volume\-inspect - Get detailed information on one or more volumes + +## SYNOPSIS +**podman volume inspect** [*options*] *volume* [...] + +## DESCRIPTION + +Display detailed information on one or more volumes. The output can be formatted using +the **--format** flag and a Go template. To get detailed information about all the +existing volumes, use the **--all** flag. +Volumes can be queried individually by providing their full name or a unique partial name. + + +## OPTIONS + +#### **--all**, **-a** + +Inspect all volumes. + +#### **--format**, **-f**=*format* + +Format volume output using Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------- | --------------------------------------------------------------------------- | +| .Anonymous | Indicates whether volume is anonymous | +| .CreatedAt ... | Volume creation time | +| .Driver | Volume driver | +| .GID | GID the volume was created with | +| .Labels ... | Label information associated with the volume | +| .LockNumber | Number of the volume's Libpod lock | +| .MountCount | Number of times the volume is mounted | +| .Mountpoint | Source of volume mount point | +| .Name | Volume name | +| .NeedsChown | Indicates volume will be chowned on next use | +| .NeedsCopyUp | Indicates data at the destination will be copied into the volume on next use| +| .Options ... | Volume options | +| .Scope | Volume scope | +| .Status ... | Status of the volume | +| .StorageID | StorageID of the volume | +| .Timeout | Timeout of the volume | +| .UID | UID the volume was created with | + +#### **--help** + +Print usage statement + + +## EXAMPLES + +Inspect named volume. +``` +$ podman volume inspect myvol +[ + { + "Name": "myvol", + "Driver": "local", + "Mountpoint": "/home/myusername/.local/share/containers/storage/volumes/myvol/_data", + "CreatedAt": "2023-03-13T16:26:48.423069028-04:00", + "Labels": {}, + "Scope": "local", + "Options": {}, + "MountCount": 0, + "NeedsCopyUp": true, + "NeedsChown": true + } +] +``` + +Inspect all volumes. +``` +$ podman volume inspect --all +[ + { + "Name": "myvol", + "Driver": "local", + "Mountpoint": "/home/myusername/.local/share/containers/storage/volumes/myvol/_data", + "CreatedAt": "2023-03-13T16:26:48.423069028-04:00", + "Labels": {}, + "Scope": "local", + "Options": {}, + "MountCount": 0, + "NeedsCopyUp": true, + "NeedsChown": true + } +] +``` + +Inspect named volume and display its Driver and Scope field. +``` +$ podman volume inspect --format "{{.Driver}} {{.Scope}}" myvol +local local +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-volume-ls.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-volume-ls.1.md new file mode 100644 index 000000000..91d403283 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-volume-ls.1.md @@ -0,0 +1,117 @@ +--- +title: podman-volume-ls +version: v5.5.1 +--- + +% podman-volume-ls 1 + +## NAME +podman\-volume\-ls - List all the available volumes + +## SYNOPSIS +**podman volume ls** [*options*] + +## DESCRIPTION + +Lists all the volumes that exist. The output can be filtered using the **--filter** +flag and can be formatted to either JSON or a Go template using the **--format** +flag. Use the **--quiet** flag to print only the volume names. + +## OPTIONS + +#### **--filter**, **-f**=*filter* + +Filter what volumes are shown in the output. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive, with the only exception being `label` +which is exclusive. Filters with different keys always work exclusive. + +Volumes can be filtered by the following attributes: + +| **Filter** | **Description** | +| ---------- | ------------------------------------------------------------------------------------- | +| dangling | [Dangling] Matches all volumes not referenced by any containers | +| driver | [Driver] Matches volumes based on their driver | +| label | [Key] or [Key=Value] Label assigned to a volume | +| name | [Name] Volume name (accepts regex) | +| opt | Matches a storage driver options | +| scope | Filters volume by scope | +| after/since | Filter by volumes created after the given VOLUME (name or tag) | +| until | Only remove volumes created before given timestamp | + +#### **--format**=*format* + +Format volume output using Go template. + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------------- | -------------------------------------------- | +| .Anonymous | Indicates whether volume is anonymous | +| .CreatedAt ... | Volume creation time | +| .Driver | Volume driver | +| .GID | GID of volume | +| .InspectVolumeData ... | Don't use | +| .Labels ... | Label information associated with the volume | +| .LockNumber | Number of the volume's Libpod lock | +| .MountCount | Number of times the volume is mounted | +| .Mountpoint | Source of volume mount point | +| .Name | Volume name | +| .NeedsChown | Indicates whether volume needs to be chowned | +| .NeedsCopyUp | Indicates if volume needs to be copied up to | +| .Options ... | Volume options | +| .Scope | Volume scope | +| .Status ... | Status of the volume | +| .StorageID | StorageID of the volume | +| .Timeout | Timeout of the volume | +| .UID | UID of volume | +| .VolumeConfigResponse ... | Don't use | + +#### **--help** + +Print usage statement. + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Print volume output in quiet mode. Only print the volume names. + +## EXAMPLES + +List all volumes. +``` +$ podman volume ls +``` + +List all volumes and display content as json format. +``` +$ podman volume ls --format json +``` + +List all volumes and display their Driver and Scope fields +``` +$ podman volume ls --format "{{.Driver}} {{.Scope}}" +``` + +List volumes with the name foo and label blue. +``` +$ podman volume ls --filter name=foo,label=blue +``` + +List volumes with the label key=value. +``` +$ podman volume ls --filter label=key=value +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-volume-mount.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-volume-mount.1.md new file mode 100644 index 000000000..c54c1e218 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-volume-mount.1.md @@ -0,0 +1,41 @@ +--- +title: podman-volume-mount +version: v5.5.1 +--- + +% podman-volume-mount 1 + +## NAME +podman\-volume\-mount - Mount a volume filesystem + +## SYNOPSIS +**podman volume mount** [*volume* ...] + +## DESCRIPTION +Mounts the specified volumes' file system in a location which can be +accessed from the host, and returns its location. + +Rootless mode only supports mounting file volumes unless Podman is run within the user namespace +via the `podman unshare` command. All other volume types fail to mount. + +## RETURN VALUE +The location of the mounted file system. On error an empty string and errno is +returned. + +## EXAMPLE + +Mount specified volume. As Root: +``` +# podman volume mount foo +/home/dwalsh/.local/share/containers/storage/volumes/foo/_data +``` + +In rootless mode, volume mounting only works after executing the podman unshare command to enter the user namespace. +``` +$ podman unshare +# podman volume mount foo +/home/dwalsh/.local/share/containers/storage/volumes/foo/_data +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-volume-unmount(1)](podman-volume-unmount.1.md)**, **[podman-unshare(1)](podman-unshare.1.md)**, **mount(8)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-volume-prune.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-volume-prune.1.md new file mode 100644 index 000000000..7fcfa2447 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-volume-prune.1.md @@ -0,0 +1,77 @@ +--- +title: podman-volume-prune +version: v5.5.1 +--- + +% podman-volume-prune 1 + +## NAME +podman\-volume\-prune - Remove all unused volumes + +## SYNOPSIS +**podman volume prune** [*options*] + +## DESCRIPTION + +Removes unused volumes. By default all unused volumes are removed, the **--filter** flag can +be used to filter specific volumes. Users are prompted to confirm the removal of all the +unused volumes. To bypass the confirmation, use the **--force** flag. + + +## OPTIONS + +#### **--filter** + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:-----------:|------------------------------------------------------------------------------------------------------------| +| dangling | [Bool] Only remove volumes not referenced by any containers | +| driver | [String] Only remove volumes with the given driver | +| label | [String] Only remove volumes, with (or without, in the case of label!=[...] is used) the specified labels. | +| name | [String] Only remove volume with the given name | +| opt | [String] Only remove volumes created with the given options | +| scope | [String] Only remove volumes with the given scope | +| until | [DateTime] Only remove volumes created before given timestamp. | +| after/since | [Volume] Filter by volumes created after the given VOLUME (name or tag) | + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes volumes with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes volumes without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not prompt for confirmation. + +#### **--help** + +Print usage statement + + +## EXAMPLES + + +Prune all unused volumes. +``` +$ podman volume prune +``` + +Prune all volumes. Note: this command will also remove all containers that are using a volume. +``` +$ podman volume prune --force +``` + +Prune all volumes that contain the specified label. +``` +$ podman volume prune --filter label=mylabel=mylabelvalue +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-volume-reload.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-volume-reload.1.md new file mode 100644 index 000000000..a2b9c069b --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-volume-reload.1.md @@ -0,0 +1,35 @@ +--- +title: podman-volume-reload +version: v5.5.1 +--- + +% podman-volume-reload 1 + +## NAME +podman\-volume\-reload - Reload all volumes from volumes plugins + +## SYNOPSIS +**podman volume reload** + +## DESCRIPTION + +**podman volume reload** checks all configured volume plugins and updates the libpod database with all available volumes. +Existing volumes are also removed from the database when they are no longer present in the plugin. + +This command it is best effort and cannot guarantee a perfect state because plugins can be modified from the outside at any time. + +Note: This command is not supported with podman-remote. + +## EXAMPLES + +Reload the volume plugins. +``` +$ podman volume reload +Added: +vol6 +Removed: +t3 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-volume-rm.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-volume-rm.1.md new file mode 100644 index 000000000..e6d6ad503 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-volume-rm.1.md @@ -0,0 +1,70 @@ +--- +title: podman-volume-rm +version: v5.5.1 +--- + +% podman-volume-rm 1 + +## NAME +podman\-volume\-rm - Remove one or more volumes + +## SYNOPSIS +**podman volume rm** [*options*] *volume* [...] + +## DESCRIPTION + +Removes one or more volumes. Only volumes that are not being used are removed. +If a volume is being used by a container, an error is returned unless the **--force** +flag is being used. To remove all volumes, use the **--all** flag. +Volumes can be removed individually by providing their full name or a unique partial name. + +## OPTIONS + +#### **--all**, **-a** + +Remove all volumes. + +#### **--force**, **-f** + +Remove a volume by force. +If it is being used by containers, the containers are removed first. + +#### **--help** + +Print usage statement + +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping running containers that are using the specified volume. The --force option must be specified to use the --time option. Use -1 for infinite wait. + +## EXAMPLES + +Remove multiple specified volumes. +``` +$ podman volume rm myvol1 myvol2 +``` + +Remove all volumes. +``` +$ podman volume rm --all +``` + +Remove the specified volume even if it is in use. Note, this removes all containers using the volume. +``` +$ podman volume rm --force myvol +``` + +## Exit Status + **0** All specified volumes removed + + **1** One of the specified volumes did not exist, and no other failures + + **2** One of the specified volumes is being used by a container + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-volume-unmount.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-volume-unmount.1.md new file mode 100644 index 000000000..23a0d16fd --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-volume-unmount.1.md @@ -0,0 +1,37 @@ +--- +title: podman-volume-unmount +version: v5.5.1 +--- + +% podman-volume-unmount 1 + +## NAME +podman\-volume\-unmount - Unmount a volume + +## SYNOPSIS +**podman volume unmount** *volume* [...] + +**podman volume umount** *volume* [...] + +## DESCRIPTION +Unmounts the specified volume, if there are no other containers +using it. + +Volume storage increments a mount counter each time a volume is mounted. +When a volume is unmounted, the mount counter is decremented, and the +volume's filesystem is physically unmounted only when the mount +counter reaches zero indicating no other processes are using the mount. + +## EXAMPLE + +Unmount volume with a given ID: +``` +podman volume unmount volumeID +``` + +Unmount multiple volumes with given IDs: +``` +podman volume unmount volumeID1 volumeID2 volumeID3 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-volume-mount(1)](podman-volume-mount.1.md)** diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-volume.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-volume.1.md new file mode 100644 index 000000000..5777e63e0 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-volume.1.md @@ -0,0 +1,37 @@ +--- +title: podman-volume +version: v5.5.1 +--- + +% podman-volume 1 + +## NAME +podman\-volume - Simple management tool for volumes + +## SYNOPSIS +**podman volume** *subcommand* + +## DESCRIPTION +podman volume is a set of subcommands that manage volumes. + +## SUBCOMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------------ | ------------------------------------------------------------------------------ | +| create | [podman-volume-create(1)](podman-volume-create.1.md) | Create a new volume. | +| exists | [podman-volume-exists(1)](podman-volume-exists.1.md) | Check if the given volume exists. | +| export | [podman-volume-export(1)](podman-volume-export.1.md) | Export volume to external tar. | +| import | [podman-volume-import(1)](podman-volume-import.1.md) | Import tarball contents into an existing podman volume. | +| inspect | [podman-volume-inspect(1)](podman-volume-inspect.1.md) | Get detailed information on one or more volumes. | +| ls | [podman-volume-ls(1)](podman-volume-ls.1.md) | List all the available volumes. | +| mount | [podman-volume-mount(1)](podman-volume-mount.1.md) | Mount a volume filesystem. | +| prune | [podman-volume-prune(1)](podman-volume-prune.1.md) | Remove all unused volumes. | +| reload | [podman-volume-reload(1)](podman-volume-reload.1.md) | Reload all volumes from volumes plugins. | +| rm | [podman-volume-rm(1)](podman-volume-rm.1.md) | Remove one or more volumes. | +| unmount | [podman-volume-unmount(1)](podman-volume-unmount.1.md) | Unmount a volume. | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.1/source/markdown/podman-wait.1.md b/versioned_docs/version-5.5.1/source/markdown/podman-wait.1.md new file mode 100644 index 000000000..b10a17ad9 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman-wait.1.md @@ -0,0 +1,103 @@ +--- +title: podman-wait +version: v5.5.1 +--- + +% podman-wait 1 + +## NAME +podman\-wait - Wait on one or more containers to stop and print their exit codes + +## SYNOPSIS +**podman wait** [*options*] *container* [...] + +**podman container wait** [*options*] *container* [...] + +## DESCRIPTION +Waits on one or more containers to stop. The container can be referred to by its +name or ID. In the case of multiple containers, Podman waits on each consecutively. +After all conditions are satisfied, the containers' return codes are printed +separated by newline in the same order as they were given to the command. An +exit code of -1 is emitted for all conditions other than "stopped" and +"exited". + +When waiting for containers with a restart policy of `always` or `on-failure`, +such as those created by `podman kube play`, the containers may be repeatedly +exiting and restarting, possibly with different exit codes. `podman wait` will +only display and detect the first exit after the wait command was started. + +When running a container with podman run --rm wait does not wait for the +container to be fully removed. To wait for the removal of a container use +`--condition=removing`. + +## OPTIONS + +#### **--condition**=*state* +Container state or condition to wait for. Can be specified multiple times where at least one condition must match for the command to return. Supported values are "configured", "created", "exited", "healthy", "initialized", "paused", "removing", "running", "stopped", "stopping", "unhealthy". The default condition is "stopped". + +#### **--help**, **-h** + + Print usage statement + + +#### **--ignore** +Ignore errors when a specified container is missing and mark its return code as -1. + +#### **--interval**, **-i**=*duration* + Time interval to wait before polling for completion. A duration string is a sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". Time unit defaults to "ms". + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLES + +Wait for the specified container to exit. +``` +$ podman wait mywebserver +0 +``` + +Wait for the latest container to exit. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman wait --latest +0 +``` + +Wait for the container to exit, checking every two seconds. +``` +$ podman wait --interval 2s mywebserver +0 +``` + +Wait for the container by ID. This container exits with error status 1: +``` +$ podman wait 860a4b23 +1 +``` + +Wait for both specified containers to exit. +``` +$ podman wait mywebserver myftpserver +0 +125 +``` + +Wait for the named container to exit, but do not fail if the container does not exist. +``` +$ podman wait --ignore does-not-exist +-1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +September 2017, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.1/source/markdown/podman.1.md b/versioned_docs/version-5.5.1/source/markdown/podman.1.md new file mode 100644 index 000000000..2975528e3 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podman.1.md @@ -0,0 +1,491 @@ +--- +title: podman +version: v5.5.1 +--- + +% podman 1 + +## NAME +podman - Simple management tool for pods, containers and images + +## SYNOPSIS +**podman** [*options*] *command* + +## DESCRIPTION +Podman (Pod Manager) is a fully featured container engine that is a simple daemonless tool. +Podman provides a Docker-CLI comparable command line that eases the transition from other +container engines and allows the management of pods, containers and images. Simply put: `alias docker=podman`. +Most Podman commands can be run as a regular user, without requiring additional +privileges. + +Podman uses Buildah(1) internally to create container images. Both tools share image +(not container) storage, hence each can use or manipulate images (but not containers) +created by the other. + +Default settings for flags are defined in `containers.conf`. Most settings for +Remote connections use the server's containers.conf, except when documented in +man pages. + +**podman [GLOBAL OPTIONS]** + +## GLOBAL OPTIONS + +#### **--cdi-spec-dir**=*path* + +The CDI spec directory path (may be set multiple times). Default path is `/etc/cdi`. + +#### **--cgroup-manager**=*manager* + +The CGroup manager to use for container cgroups. Supported values are __cgroupfs__ or __systemd__. Default is _systemd_ unless overridden in the containers.conf file. + +Note: Setting this flag can cause certain commands to break when called on containers previously created by the other CGroup manager type. +Note: CGroup manager is not supported in rootless mode when using CGroups Version V1. + +#### **--config** +Location of config file. Mainly for docker compatibility, only the authentication parts of the config are supported. + +#### **--conmon** +Path of the conmon binary (Default path is configured in `containers.conf`) + +#### **--connection**, **-c** +Connection to use for remote podman, including Mac and Windows (excluding WSL2) machines, (Default connection is configured in `containers.conf`) +Setting this option switches the **--remote** option to true. +Remote connections use local containers.conf for default. + +#### **--events-backend**=*type* + +Backend to use for storing events. Allowed values are **file**, **journald**, and +**none**. When *file* is specified, the events are stored under +`/events/events.log` (see **--tmpdir** below). + +#### **--help**, **-h** + +Print usage statement + +#### **--hooks-dir**=*path* + +Each `*.json` file in the path configures a hook for Podman containers. For more details on the syntax of the JSON files and the semantics of hook injection, see `oci-hooks(5)`. Podman and libpod currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. + +This option may be set multiple times; paths from later options have higher precedence (`oci-hooks(5)` discusses directory precedence). + +For the annotation conditions, libpod uses any annotations set in the generated OCI configuration. + +For the bind-mount conditions, only mounts explicitly requested by the caller via `--volume` are considered. Bind mounts that libpod inserts by default (e.g. `/dev/shm`) are not considered. + +If `--hooks-dir` is unset for root callers, Podman and libpod currently default to `/usr/share/containers/oci/hooks.d` and `/etc/containers/oci/hooks.d` in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting `--hooks-dir`. + +Podman and libpod currently support an additional `precreate` state which is called before the runtime's `create` operation. Unlike the other stages, which receive the container state on their standard input, `precreate` hooks receive the proposed runtime configuration on their standard input. They may alter that configuration as they see fit, and write the altered form to their standard output. + +**WARNING**: the `precreate` hook allows powerful changes to occur, such as adding additional mounts to the runtime configuration. That power also makes it easy to break things. Before reporting libpod errors, try running a container with `precreate` hooks disabled to see if the problem is due to one of the hooks. + +#### **--identity**=*path* + +Path to ssh identity file. If the identity file has been encrypted, podman prompts the user for the passphrase. +If no identity file is provided and no user is given, podman defaults to the user running the podman command. +Podman prompts for the login password on the remote server. + +Identity value resolution precedence: + - command line value + - environment variable `CONTAINER_SSHKEY`, if `CONTAINER_HOST` is found + - `containers.conf` +Remote connections use local containers.conf for default. + +#### **--imagestore**=*path* + +Path of the imagestore where images are stored. By default, the storage library stores all the images in the graphroot but if an imagestore is provided, then the storage library will store newly pulled images in the provided imagestore and keep using the graphroot for everything else. If the user is using the overlay driver, then the images which were already part of the graphroot will still be accessible. + +This will override *imagestore* option in `containers-storage.conf(5)`, refer to `containers-storage.conf(5)` for more details. + +#### **--log-level**=*level* + +Log messages at and above specified level: __debug__, __info__, __warn__, __error__, __fatal__ or __panic__ (default: _warn_) + +#### **--module**=*path* + +Load the specified `containers.conf(5)` module. Can be an absolute or relative path. Please refer to `containers.conf(5)` for details. + +This flag is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. +Further note that the flag is a root-level flag and must be specified before any Podman sub-command. + +#### **--network-cmd-path**=*path* +Path to the `slirp4netns(1)` command binary to use for setting up a slirp4netns network. +If "" is used, then the binary will first be searched using the `helper_binaries_dir` option in `containers.conf`, and second using the `$PATH` environment variable. +**Note:** This option is deprecated and will be removed with Podman 6.0. Use the `helper_binaries_dir` option in `containers.conf` instead. + +#### **--network-config-dir**=*directory* + +Path to the directory where network configuration files are located. +For the netavark backend "/etc/containers/networks" is used as root +and "$graphroot/networks" as rootless. +For the CNI backend the default is "/etc/cni/net.d" as root +and "$HOME/.config/cni/net.d" as rootless. +CNI is deprecated and will be removed in the next major Podman version 5.0 in preference of Netavark. + +#### **--out**=*path* +Redirect the output of podman to the specified path without affecting the container output or its logs. This parameter can be used to capture the output from any of podman's commands directly into a file and enable suppression of podman's output by specifying /dev/null as the path. To explicitly disable the container logging, the **--log-driver** option should be used. + +#### **--remote**, **-r** +When true, access to the Podman service is remote. Defaults to false. +Settings can be modified in the containers.conf file. If the CONTAINER_HOST +environment variable is set, the **--remote** option defaults to true. + +#### **--root**=*value* + +Storage root dir in which data, including images, is stored (default: "/var/lib/containers/storage" for UID 0, "$HOME/.local/share/containers/storage" for other users). +Default root dir configured in `containers-storage.conf(5)`. + +Overriding this option causes the *storage-opt* settings in `containers-storage.conf(5)` to be ignored. The user must specify additional options via the `--storage-opt` flag. + +#### **--runroot**=*value* + +Storage state directory where all state information is stored (default: "/run/containers/storage" for UID 0, "/run/user/$UID/run" for other users). +Default state dir configured in `containers-storage.conf(5)`. + +#### **--runtime**=*value* + +Name of the OCI runtime as specified in containers.conf or absolute path to the OCI compatible binary used to run containers. + +#### **--runtime-flag**=*flag* + +Adds global flags for the container runtime. To list the supported flags, please +consult the manpages of the selected container runtime (`runc` is the default +runtime, the manpage to consult is `runc(8)`. When the machine is configured +for cgroup V2, the default runtime is `crun`, the manpage to consult is `crun(8)`.). + +Note: Do not pass the leading `--` to the flag. To pass the runc flag `--log-format json` +to podman build, the option given can be `--runtime-flag log-format=json`. + + +#### **--ssh**=*value* + +This option allows the user to change the ssh mode, meaning that rather than using the default **golang** mode, one can instead use **--ssh=native** +to use the installed ssh binary and config file declared in containers.conf. + +#### **--storage-driver**=*value* + +Storage driver. The default storage driver for UID 0 is configured in `containers-storage.conf(5)` in rootless mode), and is *vfs* for non-root users when *fuse-overlayfs* is not available. The `STORAGE_DRIVER` environment variable overrides the default. The --storage-driver specified driver overrides all. + +Overriding this option causes the *storage-opt* settings in `containers-storage.conf(5)` to be ignored. The user must +specify additional options via the `--storage-opt` flag. + +#### **--storage-opt**=*value* + +Specify a storage driver option. Default storage driver options are configured in `containers-storage.conf(5)`. The `STORAGE_OPTS` environment variable overrides the default. The --storage-opt specified options override all. Specify --storage-opt="" so no storage options is used. + +#### **--syslog** + +Output logging information to syslog as well as the console (default *false*). + +On remote clients, including Mac and Windows (excluding WSL2) machines, logging is directed to the file $HOME/.config/containers/podman.log. + +#### **--tmpdir**=*path* + +Path to the tmp directory, for libpod runtime content. Defaults to `$XDG_RUNTIME_DIR/libpod/tmp` as rootless and `/run/libpod/tmp` as rootful. + +NOTE --tmpdir is not used for the temporary storage of downloaded images. Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + +#### **--transient-store** + +Enables a global transient storage mode where all container metadata is stored on non-persistent media (i.e. in the location specified by `--runroot`). +This mode allows starting containers faster, as well as guaranteeing a fresh state on boot in case of unclean shutdowns or other problems. However +it is not compatible with a traditional model where containers persist across reboots. + +Default value for this is configured in `containers-storage.conf(5)`. + +#### **--url**=*value* +URL to access Podman service (default from `containers.conf`, rootless `unix:///run/user/$UID/podman/podman.sock` or as root `unix:///run/podman/podman.sock`). +Setting this option switches the **--remote** option to true. + + - `CONTAINER_HOST` is of the format `://[]@][:][]` + +Details: + - `schema` is one of: + * `ssh` (default): a local unix(7) socket on the named `host` and `port`, reachable via SSH + * `tcp`: an unencrypted, unauthenticated TCP connection to the named `host` and `port` + * `unix`: a local unix(7) socket at the specified `path`, or the default for the user + - `user` defaults to either `root` or the current running user (`ssh` only) + - `password` has no default (`ssh` only) + - `host` must be provided and is either the IP or name of the machine hosting the Podman service (`ssh` and `tcp`) + - `port` defaults to 22 (`ssh` and `tcp`) + - `path` defaults to either `/run/podman/podman.sock`, or `/run/user/$UID/podman/podman.sock` if running rootless (`unix`), or must be explicitly specified (`ssh`) + +URL value resolution precedence: + - command line value + - environment variable `CONTAINER_HOST` + - `engine.service_destinations` table in containers.conf, excluding the /usr/share/containers directory + - `unix:///run/podman/podman.sock` + +Remote connections use local containers.conf for default. + +Some example URL values in valid formats: + - `unix:///run/podman/podman.sock` + - `unix:///run/user/$UID/podman/podman.sock` + - `ssh://notroot@localhost:22/run/user/$UID/podman/podman.sock` + - `ssh://root@localhost:22/run/podman/podman.sock` + - `tcp://localhost:34451` + - `tcp://127.0.0.1:34451` + +#### **--version**, **-v** + +Print the version + +#### **--volumepath**=*value* + +Volume directory where builtin volume information is stored (default: "/var/lib/containers/storage/volumes" for UID 0, "$HOME/.local/share/containers/storage/volumes" for other users). Default volume path can be overridden in `containers.conf`. + +## Environment Variables + +Podman can set up environment variables from env of [engine] table in containers.conf. These variables can be overridden by passing environment variables before the `podman` commands. + +#### **CONTAINERS_CONF** + +Set default locations of containers.conf file + +#### **CONTAINERS_REGISTRIES_CONF** + +Set default location of the registries.conf file. + +#### **CONTAINERS_STORAGE_CONF** + +Set default location of the storage.conf file. + +#### **CONTAINER_CONNECTION** + +Override default `--connection` value to access Podman service. Automatically enables the --remote option. + +#### **CONTAINER_HOST** + +Set default `--url` value to access Podman service. Automatically enables --remote option. + +#### **CONTAINER_SSHKEY** + +Set default `--identity` path to ssh key file value used to access Podman service. + +#### **PODMAN_CONNECTIONS_CONF** + +The path to the file where the system connections and farms created with `podman system connection add` +and `podman farm add` are stored, by default it uses `~/.config/containers/podman-connections.json`. + +#### **STORAGE_DRIVER** + +Set default `--storage-driver` value. + +#### **STORAGE_OPTS** + +Set default `--storage-opt` value. + +#### **TMPDIR** + +Set the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + +#### **XDG_CONFIG_HOME** + +In Rootless mode configuration files are read from `XDG_CONFIG_HOME` when +specified, otherwise in the home directory of the user under +`$HOME/.config/containers`. + +#### **XDG_DATA_HOME** + +In Rootless mode images are pulled under `XDG_DATA_HOME` when specified, +otherwise in the home directory of the user under +`$HOME/.local/share/containers/storage`. + +#### **XDG_RUNTIME_DIR** + +In Rootless mode temporary configuration data is stored in `${XDG_RUNTIME_DIR}/containers`. + +## Remote Access + +The Podman command can be used with remote services using the `--remote` flag. Connections can +be made using local unix domain sockets, ssh or directly to tcp sockets. When specifying the +podman --remote flag, only the global options `--url`, `--identity`, `--log-level`, `--connection` are used. + +Connection information can also be managed using the containers.conf file. + +## Exit Codes + +The exit code from `podman` gives information about why the container +failed to run or why it exited. When `podman` commands exit with a non-zero code, +the exit codes follow the `chroot` standard, see below: + + **125** The error is with podman **_itself_** + + $ podman run --foo busybox; echo $? + Error: unknown flag: --foo + 125 + + **126** Executing a _container command_ and the _command_ cannot be invoked + + $ podman run busybox /etc; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error + 126 + + **127** Executing a _container command_ and the _command_ cannot be found + + $ podman run busybox foo; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error + 127 + + **Exit code** otherwise, `podman` returns the exit code of the _container command_ + + $ podman run busybox /bin/sh -c 'exit 3'; echo $? + 3 + + +## COMMANDS + +| Command | Description | +|--------------------------------------------------|------------------------------------------------------------------------------| +| [podman-artifact(1)](podman-artifact.1.md) | Manage OCI artifacts. | +| [podman-attach(1)](podman-attach.1.md) | Attach to a running container. | +| [podman-auto-update(1)](podman-auto-update.1.md) | Auto update containers according to their auto-update policy | +| [podman-build(1)](podman-build.1.md) | Build a container image using a Containerfile. | +| [podman-farm(1)](podman-farm.1.md) | Farm out builds to machines running podman for different architectures | +| [podman-commit(1)](podman-commit.1.md) | Create new image based on the changed container. | +| [podman-completion(1)](podman-completion.1.md) | Generate shell completion scripts | +| [podman-compose(1)](podman-compose.1.md) | Run Compose workloads via an external compose provider. | +| [podman-container(1)](podman-container.1.md) | Manage containers. | +| [podman-cp(1)](podman-cp.1.md) | Copy files/folders between a container and the local filesystem. | +| [podman-create(1)](podman-create.1.md) | Create a new container. | +| [podman-diff(1)](podman-diff.1.md) | Inspect changes on a container or image's filesystem. | +| [podman-events(1)](podman-events.1.md) | Monitor Podman events | +| [podman-exec(1)](podman-exec.1.md) | Execute a command in a running container. | +| [podman-export(1)](podman-export.1.md) | Export a container's filesystem contents as a tar archive. | +| [podman-generate(1)](podman-generate.1.md) | Generate structured data based on containers, pods or volumes. | +| [podman-healthcheck(1)](podman-healthcheck.1.md) | Manage healthchecks for containers | +| [podman-history(1)](podman-history.1.md) | Show the history of an image. | +| [podman-image(1)](podman-image.1.md) | Manage images. | +| [podman-images(1)](podman-images.1.md) | List images in local storage. | +| [podman-import(1)](podman-import.1.md) | Import a tarball and save it as a filesystem image. | +| [podman-info(1)](podman-info.1.md) | Display Podman related system information. | +| [podman-init(1)](podman-init.1.md) | Initialize one or more containers | +| [podman-inspect(1)](podman-inspect.1.md) | Display a container, image, volume, network, or pod's configuration. | +| [podman-kill(1)](podman-kill.1.md) | Kill the main process in one or more containers. | +| [podman-load(1)](podman-load.1.md) | Load image(s) from a tar archive into container storage. | +| [podman-login(1)](podman-login.1.md) | Log in to a container registry. | +| [podman-logout(1)](podman-logout.1.md) | Log out of a container registry. | +| [podman-logs(1)](podman-logs.1.md) | Display the logs of one or more containers. | +| [podman-machine(1)](podman-machine.1.md) | Manage Podman's virtual machine | +| [podman-manifest(1)](podman-manifest.1.md) | Create and manipulate manifest lists and image indexes. | +| [podman-mount(1)](podman-mount.1.md) | Mount a working container's root filesystem. | +| [podman-network(1)](podman-network.1.md) | Manage Podman networks. | +| [podman-pause(1)](podman-pause.1.md) | Pause one or more containers. | +| [podman-kube(1)](podman-kube.1.md) | Play containers, pods or volumes based on a structured input file. | +| [podman-pod(1)](podman-pod.1.md) | Management tool for groups of containers, called pods. | +| [podman-port(1)](podman-port.1.md) | List port mappings for a container. | +| [podman-ps(1)](podman-ps.1.md) | Print out information about containers. | +| [podman-pull(1)](podman-pull.1.md) | Pull an image from a registry. | +| [podman-push(1)](podman-push.1.md) | Push an image, manifest list or image index from local storage to elsewhere. | +| [podman-rename(1)](podman-rename.1.md) | Rename an existing container. | +| [podman-restart(1)](podman-restart.1.md) | Restart one or more containers. | +| [podman-rm(1)](podman-rm.1.md) | Remove one or more containers. | +| [podman-rmi(1)](podman-rmi.1.md) | Remove one or more locally stored images. | +| [podman-run(1)](podman-run.1.md) | Run a command in a new container. | +| [podman-save(1)](podman-save.1.md) | Save image(s) to an archive. | +| [podman-search(1)](podman-search.1.md) | Search a registry for an image. | +| [podman-secret(1)](podman-secret.1.md) | Manage podman secrets. | +| [podman-start(1)](podman-start.1.md) | Start one or more containers. | +| [podman-stats(1)](podman-stats.1.md) | Display a live stream of one or more container's resource usage statistics. | +| [podman-stop(1)](podman-stop.1.md) | Stop one or more running containers. | +| [podman-system(1)](podman-system.1.md) | Manage podman. | +| [podman-tag(1)](podman-tag.1.md) | Add an additional name to a local image. | +| [podman-top(1)](podman-top.1.md) | Display the running processes of a container. | +| [podman-unmount(1)](podman-unmount.1.md) | Unmount a working container's root filesystem. | +| [podman-unpause(1)](podman-unpause.1.md) | Unpause one or more containers. | +| [podman-unshare(1)](podman-unshare.1.md) | Run a command inside of a modified user namespace. | +| [podman-untag(1)](podman-untag.1.md) | Remove one or more names from a locally-stored image. | +| [podman-update(1)](podman-update.1.md) | Update the configuration of a given container. | +| [podman-version(1)](podman-version.1.md) | Display the Podman version information. | +| [podman-volume(1)](podman-volume.1.md) | Simple management tool for volumes. | +| [podman-wait(1)](podman-wait.1.md) | Wait on one or more containers to stop and print their exit codes. | + +## CONFIGURATION FILES + +**containers.conf** (`/usr/share/containers/containers.conf`, `/etc/containers/containers.conf`, `$HOME/.config/containers/containers.conf`) + +Podman has builtin defaults for command line options. These defaults can be overridden using the containers.conf configuration files. + +Distributions ship the `/usr/share/containers/containers.conf` file with their default settings. Administrators can override fields in this file by creating the `/etc/containers/containers.conf` file. Users can further modify defaults by creating the `$HOME/.config/containers/containers.conf` file. Podman merges its builtin defaults with the specified fields from these files, if they exist. Fields specified in the users file override the administrator's file, which overrides the distribution's file, which override the built-in defaults. + +Podman uses builtin defaults if no containers.conf file is found. + +If the **CONTAINERS_CONF** environment variable is set, then its value is used for the containers.conf file rather than the default. + +**mounts.conf** (`/usr/share/containers/mounts.conf`) + +The mounts.conf file specifies volume mount directories that are automatically mounted inside containers when executing the `podman run` or `podman start` commands. Administrators can override the defaults file by creating `/etc/containers/mounts.conf`. + +When Podman runs in rootless mode, the file `$HOME/.config/containers/mounts.conf` overrides the default if it exists. For details, see containers-mounts.conf(5). + +**policy.json** (`/etc/containers/policy.json`, `$HOME/.config/containers/policy.json`) + +Signature verification policy files are used to specify policy, e.g. trusted keys, applicable when deciding whether to accept an image, or individual signatures of that image, as valid. For details, see containers-policy.json(5). + +**registries.conf** (`/etc/containers/registries.conf`, `$HOME/.config/containers/registries.conf`) + +registries.conf is the configuration file which specifies which container registries is consulted when completing image names which do not include a registry or domain portion. + +Non root users of Podman can create the `$HOME/.config/containers/registries.conf` file to be used instead of the system defaults. + +If the **CONTAINERS_REGISTRIES_CONF** environment variable is set, then its value is used for the registries.conf file rather than the default. + +**storage.conf** (`/etc/containers/storage.conf`, `$HOME/.config/containers/storage.conf`) + +storage.conf is the storage configuration file for all tools using containers/storage + +The storage configuration file specifies all of the available container storage options for tools using shared container storage. + +When Podman runs in rootless mode, the file `$HOME/.config/containers/storage.conf` is used instead of the system defaults. + +If the **CONTAINERS_STORAGE_CONF** environment variable is set, then its value is used for the storage.conf file rather than the default. + +## Rootless mode +Podman can also be used as non-root user. When podman runs in rootless mode, a user namespace is automatically created for the user, defined in `/etc/subuid` and `/etc/subgid`. + +Containers created by a non-root user are not visible to other users and are not seen or managed by Podman running as root. + +It is required to have multiple UIDS/GIDS set for a user. Be sure the user is present in the files `/etc/subuid` and `/etc/subgid`. + +Execute the following commands to add the ranges to the files + + $ sudo usermod --add-subuids 10000-75535 USERNAME + $ sudo usermod --add-subgids 10000-75535 USERNAME + +Or just add the content manually. + + $ echo USERNAME:10000:65536 >> /etc/subuid + $ echo USERNAME:10000:65536 >> /etc/subgid + +See the `subuid(5)` and `subgid(5)` man pages for more information. + + + +Note: whitespace in any row of `/etc/subuid` or `/etc/subgid`, including trailing blanks, may result in no entry failures. + +Images are pulled under `XDG_DATA_HOME` when specified, otherwise in the home directory of the user under `.local/share/containers/storage`. + +Currently slirp4netns or pasta is required to be installed to create a network +device, otherwise rootless containers need to run in the network namespace of +the host. + +In certain environments like HPC (High Performance Computing), users cannot take advantage of the additional UIDs and GIDs from the `/etc/subuid` and `/etc/subgid` systems. However, in this environment, rootless Podman can operate with a single UID. To make this work, set the `ignore_chown_errors` option in the `containers-storage.conf(5)` file. This option tells Podman when pulling an image to ignore chown errors when attempting to change a file in a container image to match the non-root UID in the image. This means all files get saved as the user's UID. Note this can cause issues when running the container. + +### **NOTE:** Unsupported file systems in rootless mode + +The Overlay file system (OverlayFS) is not supported with kernels prior to 5.12.9 in rootless mode. The fuse-overlayfs package is a tool that provides the functionality of OverlayFS in user namespace that allows mounting file systems in rootless environments. It is recommended to install the fuse-overlayfs package. In rootless mode, Podman automatically uses the fuse-overlayfs program as the mount_program if installed, as long as the `$HOME/.config/containers/storage.conf` file was not previously created. If storage.conf exists in the homedir, add `mount_program = "/usr/bin/fuse-overlayfs"` under `[storage.options.overlay]` to enable this feature. + +The Network File System (NFS) and other distributed file systems (for example: Lustre, Spectrum Scale, the General Parallel File System (GPFS)) are not supported when running in rootless mode as these file systems do not understand user namespace. However, rootless Podman can make use of an NFS Homedir by modifying the `$HOME/.config/containers/storage.conf` to have the `graphroot` option point to a directory stored on local (Non NFS) storage. + +## SEE ALSO +**[containers-mounts.conf(5)](https://github.com/containers/common/blob/main/docs/containers-mounts.conf.5.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **[oci-hooks(5)](https://github.com/containers/common/blob/main/pkg/hooks/docs/oci-hooks.5.md)**, **[containers-policy.json(5)](https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/main/man/runc.8.md)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, **[pasta(1)](https://passt.top/builds/latest/web/passt.1.html)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +See [podman-rootless(7)](https://github.com/containers/podman/blob/main/rootless.md) +for rootless issues. + +## HISTORY +Dec 2016, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.1/source/markdown/podmansh.1.md b/versioned_docs/version-5.5.1/source/markdown/podmansh.1.md new file mode 100644 index 000000000..f6ac95ad3 --- /dev/null +++ b/versioned_docs/version-5.5.1/source/markdown/podmansh.1.md @@ -0,0 +1,138 @@ +--- +title: podmansh +version: v5.5.1 +--- + +% podmansh 1 + +## NAME +podmansh - Execute login shell within the Podman `podmansh` container + +## SYNOPSIS +**podmansh** + +## DESCRIPTION + +Execute a user shell within a container when the user logs into the system. The container that the users get added to can be defined via a Podman Quadlet file. This user only has access to volumes and capabilities configured into the Quadlet file. + +Administrators can create a Quadlet in /etc/containers/systemd/users, which systemd will start for all users when they log in. The administrator can create a specific Quadlet with the container name `podmansh`, then enable users to use the login shell /usr/bin/podmansh. These user login shells are automatically executed inside the `podmansh` container via Podman. + +Optionally, the administrator can place Quadlet files in the /etc/containers/systemd/users/${UID} directory for a user. Only this UID will execute these Quadlet services when that user logs in. + +The user is confined to the container environment via all of the security mechanisms, including SELinux. The only information that will be available from the system comes from volumes leaked into the container. + +Systemd will automatically create the container when the user session is started. Systemd will take down the container when all connections to the user session are removed. This means users can log in to the system multiple times, with each session connected to the same container. + +Administrators can use volumes to expose specific host data from the host system to the user, without the user being exposed to other parts of the system. + +Timeout for podmansh can be set using the `podmansh_timeout` option in containers.conf. + +## Setup +Create user login session using useradd while running as root. + +``` +# useradd -s /usr/bin/podmansh lockedu +# grep lockedu /etc/passwd +lockedu:x:4008:4008::/home/lockedu:/usr/bin/podmansh +``` + +Create a Podman Quadlet file that looks something like one of the following. + +Fully locked down container, no access to host OS. + +``` +# USERID=$(id -u lockedu) +# mkdir -p /etc/containers/systemd/users/${USERID} +# cat > /etc/containers/systemd/users/${USERID}/podmansh.container << _EOF +[Unit] +Description=The podmansh container +After=local-fs.target + +[Container] +Image=registry.fedoraproject.org/fedora +ContainerName=podmansh +RemapUsers=keep-id +RunInit=yes +DropCapability=all +NoNewPrivileges=true + +Exec=sleep infinity + +[Install] +RequiredBy=default.target +_EOF +``` + +Alternatively, while running as root, create a Quadlet where the user is allowed to become root within the user namespace. They can also permanently read/write content from their home directory which is volume mounted from the actual host's users account, rather than being inside of the container. + +``` +# useradd -s /usr/bin/podmansh confinedu +# grep confinedu /etc/passwd +confinedu:x:4009:4009::/home/confinedu:/usr/bin/podmansh +# USERID=$(id -u confinedu) +# mkdir -p /etc/containers/systemd/users/${USERID} +# cat > /etc/containers/systemd/users/${USERID}/podmansh.container << _EOF +[Unit] +Description=The podmansh container +After=local-fs.target + +[Container] +Image=registry.fedoraproject.org/fedora +ContainerName=podmansh +RemapUsers=keep-id +RunInit=yes + +Volume=%h/data:%h:Z +Exec=sleep infinity + +[Service] +ExecStartPre=/usr/bin/mkdir -p %h/data + +[Install] +RequiredBy=default.target +_EOF +``` + +Another example, while running as root, create a Quadlet where the users inside this container are allowed to execute containers with SELinux separation and able to read and write content in the $HOME/data directory. + +``` +# useradd -s /usr/bin/podmansh fullu +# grep fullu /etc/passwd +fullu:x:4010:4010::/home/fullu:/usr/bin/podmansh +# USERID=$(id -u fullu) +# mkdir -p /etc/containers/systemd/users/${USERID} +# cat > /etc/containers/systemd/users/${USERID}/podmansh.container << _EOF +[Unit] +Description=The podmansh container +After=local-fs.target + +[Container] +Image=registry.fedoraproject.org/fedora +ContainerName=podmansh +RemapUsers=keep-id +RunInit=yes +PodmanArgs=--security-opt=unmask=/sys/fs/selinux \ + --security-opt=label=nested \ + --security-opt=label=user:container_user_u \ + --security-opt=label=type:container_user_t \ + --security-opt=label=role:container_user_r \ + --security-opt=label=level:s0-s0:c0.c1023 + +Volume=%h/data:%h:Z +WorkingDir=%h +Volume=/sys/fs/selinux:/sys/fs/selinux +Exec=sleep infinity + +[Service] +ExecStartPre=/usr/bin/mkdir -p %h/data + +[Install] +RequiredBy=default.target +_EOF +``` + +## SEE ALSO +**[containers.conf(5)](containers.conf.5.md)**, **[podman(1)](podman.1.md)**, **[podman-exec(1)](podman-exec.1.md)**, **[podman-systemd.unit(5)](podman-systemd.unit.5.md)** + +## HISTORY +May 2023, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.1/tutorials/README.md b/versioned_docs/version-5.5.1/tutorials/README.md new file mode 100644 index 000000000..cc8f1aed2 --- /dev/null +++ b/versioned_docs/version-5.5.1/tutorials/README.md @@ -0,0 +1,46 @@ +--- +title: Podman Tutorials +version: v5.5.1 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +# Podman Tutorials + +## Links to a number of useful tutorials for the Podman utility. + +**[Introduction Tutorial](podman_tutorial.md)** + +Learn how to set up Podman and perform some basic commands with the utility. + +**[Basic Setup and Use of Podman in a Rootless environment](rootless_tutorial.md)** + +The steps required to set up rootless Podman are enumerated. + +**[Setup Mac/Windows](mac_win_client.md)** + +Special setup for running the Podman remote client on a Mac or Windows PC and connecting to Podman running on a Linux VM are documented. + +**[Remote Client](remote_client.md)** + +A brief how-to on using the Podman remote-client. + +**[How to use libpod for custom/derivative projects](podman-derivative-api.md)** + +How the libpod API can be used within your own project. + +**[Image Signing](image_signing.md)** + +Learn how to set up and use image signing with Podman. + +**[Basic Networking](basic_networking.md)** + +A basic guide to common network setups with Podman + +**[Socket activation](socket_activation.md)** + +Learn how to run containers that support socket activation. + +**[Performance](performance.md)** + +Performance guide regarding Podman configuration and usage. diff --git a/versioned_docs/version-5.5.1/tutorials/basic_networking.md b/versioned_docs/version-5.5.1/tutorials/basic_networking.md new file mode 100644 index 000000000..aa25f0790 --- /dev/null +++ b/versioned_docs/version-5.5.1/tutorials/basic_networking.md @@ -0,0 +1,336 @@ +--- +title: Basic Networking Guide for Podman +version: v5.5.1 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + + +# Basic Networking Guide for Podman + + +It seems once people understand the basics of containers, networking is one of the first +aspects they begin experimenting with. And regarding networking, it takes very +little experimentation before ending up on the deep end of the pool. The following +guide shows the most common network setups for Podman rootful and rootless containers. +Each setup is supported with an example. + + +## Differences between rootful and rootless container networking + +One of the guiding factors on networking for containers with Podman is going to +be whether or not the container is run by a root user or not. This is because +unprivileged users cannot create networking interfaces on the host. Therefore, +for rootless containers, the default network mode is slirp4netns. Because of the +limited privileges, slirp4netns lacks some of the features of networking +compared to rootful Podman's networking; for example, slirp4netns cannot give +containers a routable IP address. The default networking mode for rootful +containers on the other side is netavark, which allows a container to have a +routable IP address. + +## Firewalls + +The role of a firewall will not impact the setup and configuration of networking, +but it will impact traffic on those networks. The most obvious is inbound network +traffic to the container host, which is being passed onto containers usually with +port mapping. Depending on the firewall implementation, we have observed firewall +ports being opened automatically due to running a container with a port mapping (for +example). If container traffic does not seem to work properly, check the firewall +and allow traffic on ports the container is using. A common problem is that +reloading the firewall deletes the netavark iptables rules resulting in a loss of +network connectivity for rootful containers. Podman v3 provides the podman +network reload command to restore this without having to restart the container. + +## Basic Network Setups + +Most containers and pods being run with Podman adhere to a couple of simple scenarios. +By default, rootful Podman will create a bridged network. This is the most straightforward +and preferred network setup for Podman. Bridge networking creates an interface for +the container on an internal bridge network, which is then connected to the internet +via Network Address Translation(NAT). We also see users wanting to use `macvlan` +for networking as well. The `macvlan` plugin forwards an entire network interface +from the host into the container, allowing it access to the network the host is connected +to. And finally, the default network configuration for rootless containers is slirp4netns. +The slirp4netns network mode has limited capabilities but can be run on users without +root privileges. It creates a tunnel from the host into the container to forward +traffic. + +### Bridge + +A bridge network is defined as an internal network is created where both the +container and host are attached. Then this network is capable of allowing the containers +to communicate outside the host. + + +*[Image: bridge_network]* + +Consider the above illustration. It depicts a laptop user running two containers: +a web and db instance. These two containers are on the virtual network with the +host. Additionally, by default, these containers can initiate communications outside +the laptop (to the Internet for example). The containers on the virtual network +typically have non-routable, also known as private IP addresses. + +When dealing with communication that is being initiated outside the host, the outside +client typically must address the laptop’s external network interface and given port +number. Assuming the host allows incoming traffic, the host will know to forward +the incoming traffic on that port to the specific container. To accomplish this, +firewall rules are added to forward traffic when a container requests a specific +port be forwarded. + +Bridge networking is the default for Podman containers created as root. Podman provides +a default bridge network, but you can create others using the `podman network create` +command. Containers can be joined to a network when they are created with the +`--network` flag, or after they are created via the `podman network connect` and +`podman network disconnect` commands. + +As mentioned earlier, slirp4netns is the default network configuration for rootless +users. But as of Podman version 4.0, rootless users can also use netavark. +The user experience of rootless netavark is very akin to a rootful netavark, except that +there is no default network configuration provided. You simply need to create a +network, and the one will be created as a bridge network. If you would like to switch from +CNI networking to netavark, you must issue the `podman system reset --force` command. +This will delete all of your images, containers, and custom networks. + +``` +$ podman network create +``` + +When rootless containers are run, network operations +will be executed inside an extra network namespace. To join this namespace, use +`podman unshare --rootless-netns`. + +#### Default Network + +The default network `podman` with netavark is memory-only. It does not support dns resolution because of backwards compatibility with Docker. To change settings, export the in-memory network and change the file. + +For the default rootful network use +``` +podman network inspect podman | jq .[] > /etc/containers/networks/podman.json +``` + +And for the rootless network use + +``` +podman network inspect podman | jq .[] > ~/.local/share/containers/storage/networks/podman.json +``` + + +#### Example + +By default, rootful containers use the netavark for its default network if +you have not migrated from Podman v3. +In this case, no network name must be passed to Podman. However, you can create +additional bridged networks with the podman create command. + +The following example shows how to set up a web server and expose it to the network +outside the host as both rootful and rootless. It will also show how an outside +client can connect to the container. + +``` +(rootful) $ sudo podman run -dt --name webserver -p 8080:80 quay.io/libpod/banner +00f3440c7576aae2d5b193c40513c29c7964e96bf797cf0cc352c2b68ccbe66a +``` + +Now run the container. +``` +$ podman run -dt --name webserver --network podman1 -p 8081:80 quay.io/libpod/banner +269fd0d6b2c8ed60f2ca41d7beceec2471d72fb9a33aa8ca45b81dc9a0abbb12 +``` +Note in the above run command, the container’s port 80 (where the Nginx server is +running) was mapped to the host’s port 8080. Port 8080 was chosen to demonstrate +how the host and container ports can be mapped for external access. The port could +very well have been 80 as well (except for rootless users). + +To connect from an outside client to the webserver, simply point an HTTP client to +the host’s IP address at port 8080 for rootful and port 8081 for rootless. +``` +(outside_host): $ curl 192.168.99.109:8080 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ + +(outside_host): $ curl 192.168.99.109:8081 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ +``` + +### Macvlan + +With macvlan, the container is given access to a physical network interface on the +host. This interface can configure multiple subinterfaces. And each subinterface +is capable of having its own MAC and IP address. In the case of Podman containers, +the container will present itself as if it is on the same network as the host. + +*[Image: macvlan_network]* + +In the illustration, outside clients will be able to access the web container by +its IP address directly. Usually the network information, including IP address, +is leased from a DHCP server like most other network clients on the network. If +the laptop is running a firewall, such as firewalld, then accommodations will need +to be made for proper access. + +Note that Podman has to be run as root in order to use macvlan. + +#### Example + +The following example demonstrates how to set up a web container on a macvlan and +how to access that container from outside the host. First, create the macvlan network. + You need to know the network interface on the host that connects to the routable +network. In the example case, it is eth0. + +``` +$ sudo podman network create -d macvlan -o parent=eth0 webnetwork +webnetwork +``` + +The next step is to ensure that the DHCP service is running. This handles +the DHCP leases from the network. If DHCP is not needed, the `--subnet` option +can be used to assign a static subnet in the `network create` command above. + +CNI and netavark both use their own DHCP service; therefore, you need to know +what backend you are using. To see what you are using, run this command: +``` +$ sudo podman info --format {{.Host.NetworkBackend}} +``` +If this command does not work, you are using an older version prior to Podman +v4.0 which means you are using CNI. +If the netavark backend is used, at least Podman v4.5 with netavark v1.6 is +required to use DHCP. + +For netavark use: +``` +$ sudo systemctl enable --now netavark-dhcp-proxy.socket +``` +Or if the system doesn't use systemd, start the daemon manually: +``` +$ /usr/libexec/podman/netavark dhcp-proxy --activity-timeout 0 +``` + +With CNI use: +``` +$ sudo systemctl enable --now cni-dhcp.socket +``` +Or if the system doesn't use systemd, start the daemon manually: +``` +$ sudo /usr/libexec/cni/dhcp daemon +``` +Note that depending on the distribution, the binary location may differ. + +Now run the container and be certain to attach it to the network we created earlier. +``` +$ sudo podman run -dt --name webserver --network webnetwork quay.io/libpod/banner +03d82083c434d7e937fc0b87c25401f46ab5050007df403bf988e25e52c5cc40 +[baude@localhost ~]$ sudo podman exec webserver ip address show eth0 +2: eth0@if3: mtu 1500 qdisc noqueue state +UP +link/ether 0a:3c:e2:eb:87:0f brd ff:ff:ff:ff:ff:ff +inet 192.168.99.186/24 brd 192.168.99.255 scope global eth0 +valid_lft forever preferred_lft forever +inet6 fe80::83c:e2ff:feeb:870f/64 scope link +valid_lft forever preferred_lft forever +``` +Because the container has a routable IP address (on this network) and is not being +managed by firewalld, no change to the firewall is needed. +``` +(outside_host): $ curl http://192.168.99.186 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ +``` + + + +### Slirp4netns + +Slirp4netns is the default network setup for rootless containers and pods. It was +invented because unprivileged users are not allowed to make network interfaces on +the host. Slirp4netns creates a TAP device in the container’s network namespace +and connects to the usermode TCP/IP stack. Consider the following illustration. + +*[Image: slirp_network]* + +The unprivileged user on this laptop has created two containers: a DB container and +a web container. Both of these containers have the ability to access content on +networks outside the laptop. And outside clients can access the containers if the +container is bound to a host port and the laptop firewall allows it. Remember, unprivileged +users must use ports 1024 through 65535 as lower ports require root privileges. (CAP_NET_BIND_SERVICE) +Note: this can be adjusted using the `sysctl net.ipv4.ip_unprivileged_port_start` + +One of the drawbacks of slirp4netns is that the containers are completely isolated +from each other. Unlike the bridge approach, there is no virtual network. For containers +to communicate with each other, they can use the port mappings with the host system, +or they can be put into a Pod where they share the same network namespace. See [Communicating +between containers and pods](#Communicating-between-containers-and-pods) for more information. + +#### Example + +The following example will show how two rootless containers can communicate with +each other where one is a web server. Then it will show how a client on the host’s +network can communicate with the rootless web server. + +First, run the rootless web server and map port 80 from the container to a non-privileged +port like 8080. +``` +$ podman run -dt --name webserver -p 8080:80 quay.io/libpod/banner +17ea33ccd7f55ff45766b3ec596b990a5f2ba66eb9159cb89748a85dc3cebfe0 +``` +Because rootless containers cannot communicate with each other directly with TCP/IP +via IP addresses, the host and the port mapping are used. To do so, the IP address +of the host (interface) must be known. +``` +$ ip address show eth0 +3: eth0: mtu 1500 qdisc fq_codel state UP group +default qlen 1000 +link/ether 3c:e1:a1:c1:7a:3f brd ff:ff:ff:ff:ff:ff +altname eth0 +inet 192.168.99.109/24 brd 192.168.99.255 scope global dynamic noprefixroute eth0 +valid_lft 78808sec preferred_lft 78808sec +inet6 fe80::5632:6f10:9e76:c33/64 scope link noprefixroute +valid_lft forever preferred_lft forever +``` +From another rootless container, use the host’s IP address and port to communicate +between the two rootless containers successfully. +``` +$ podman run -it quay.io/libpod/banner curl http://192.168.99.109:8080 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ +``` + +From a client outside the host, the IP address and port can also be used: +``` +(outside_host): $ curl http://192.168.99.109:8080 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ +``` + +## Communicating between containers and pods + +Most users of containers have a decent understanding of how containers communicate +with each other and the rest of the world. Usually each container has its own IP +address and networking information. They communicate amongst each other using regular +TCP/IP means like IP addresses or, in many cases, using DNS names often based on +the container name. But pods are a collection of one or more containers, and with +that, some uniqueness is inherited. + +By definition, all containers in a Podman pod share the same network namespace. This +fact means that they will have the same IP address, MAC addresses, and port mappings. +You can conveniently communicate between containers in a pod by using localhost. + +*[Image: slirp_network]* + +The above illustration describes a Pod on a bridged network. As depicted, the Pod +has two containers “inside” it: a DB and a Web container. Because they share the +same network namespace, the DB and Web container can communicate with each other +using localhost (127.0.0.1). Furthermore, they are also both addressable by the +IP address (and DNS name if applicable) assigned to the Pod itself. + +For more information on container to container networking, see [Configuring container +networking with Podman](https://www.redhat.com/sysadmin/container-networking-podman). diff --git a/versioned_docs/version-5.5.1/tutorials/image_signing.md b/versioned_docs/version-5.5.1/tutorials/image_signing.md new file mode 100644 index 000000000..a2c3dcb22 --- /dev/null +++ b/versioned_docs/version-5.5.1/tutorials/image_signing.md @@ -0,0 +1,199 @@ +--- +title: How to sign and distribute container images using Podman +version: v5.5.1 +--- + +# How to sign and distribute container images using Podman + +Signing container images originates from the motivation of trusting only +dedicated image providers to mitigate man-in-the-middle (MITM) attacks or +attacks on container registries. One way to sign images is to utilize a GNU +Privacy Guard ([GPG][0]) key. This technique is generally compatible with any +OCI compliant container registry like [Quay.io][1]. It is worth mentioning that +the OpenShift integrated container registry supports this signing mechanism out +of the box, which makes separate signature storage unnecessary. + +[0]: https://gnupg.org +[1]: https://quay.io + +From a technical perspective, we can utilize Podman to sign the image before +pushing it into a remote registry. After that, all systems running Podman have +to be configured to retrieve the signatures from a remote server, which can +be any simple web server. This means that every unsigned image will be rejected +during an image pull operation. But how does this work? + +First of all, we have to create a GPG key pair or select an already locally +available one. To generate a new GPG key, just run `gpg --full-gen-key` and +follow the interactive dialog. Now we should be able to verify that the key +exists locally: + +```bash +> gpg --list-keys sgrunert@suse.com +pub rsa2048 2018-11-26 [SC] [expires: 2020-11-25] + XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX +uid [ultimate] Sascha Grunert +sub rsa2048 2018-11-26 [E] [expires: 2020-11-25] +``` + +Now let’s assume that we run a container registry. For example we could simply +start one on our local machine: + +```bash +sudo podman run -d -p 5000:5000 docker.io/registry +``` + +The registry does not know anything about image signing, it just provides the remote +storage for the container images. This means if we want to sign an image, we +have to take care of how to distribute the signatures. + +Let’s choose a standard `alpine` image for our signing experiment: + +```bash +sudo podman pull docker://docker.io/alpine:latest +``` + +```bash +sudo podman images alpine +REPOSITORY TAG IMAGE ID CREATED SIZE +docker.io/library/alpine latest e7d92cdc71fe 6 weeks ago 5.86 MB +``` + +Now we can re-tag the image to point it to our local registry: + +```bash +sudo podman tag alpine localhost:5000/alpine +``` + +```bash +sudo podman images alpine +REPOSITORY TAG IMAGE ID CREATED SIZE +localhost:5000/alpine latest e7d92cdc71fe 6 weeks ago 5.86 MB +docker.io/library/alpine latest e7d92cdc71fe 6 weeks ago 5.86 MB +``` + +Podman would now be able to push the image and sign it in one command. But to +let this work, we have to modify our system-wide registries configuration at +`/etc/containers/registries.d/default.yaml`: + +```yaml +default-docker: + sigstore: http://localhost:8000 # Added by us + sigstore-staging: file:///var/lib/containers/sigstore +``` + +We can see that we have two signature stores configured: + +- `sigstore`: referencing a web server for signature reading +- `sigstore-staging`: referencing a file path for signature writing + +Now, let’s push and sign the image: + +```bash +sudo -E GNUPGHOME=$HOME/.gnupg \ + podman push \ + --tls-verify=false \ + --sign-by sgrunert@suse.com \ + localhost:5000/alpine +… +Storing signatures +``` + +If we now take a look at the systems signature storage, then we see that there +is a new signature available, which was caused by the image push: + +```bash +sudo ls /var/lib/containers/sigstore +'alpine@sha256=e9b65ef660a3ff91d28cc50eba84f21798a6c5c39b4dd165047db49e84ae1fb9' +``` + +The default signature store in our edited version of +`/etc/containers/registries.d/default.yaml` references a web server listening at +`http://localhost:8000`. For our experiment, we simply start a new server inside +the local staging signature store: + +```bash +sudo bash -c 'cd /var/lib/containers/sigstore && python3 -m http.server' +Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ... +``` + +Let’s remove the local images for our verification test: + +``` +sudo podman rmi docker.io/alpine localhost:5000/alpine +``` + +We have to write a policy to enforce that the signature has to be valid. This +can be done by adding a new rule in `/etc/containers/policy.json`. From the +below example, copy the `"docker"` entry into the `"transports"` section of your +`policy.json`. + +```json +{ + "default": [{ "type": "insecureAcceptAnything" }], + "transports": { + "docker": { + "localhost:5000": [ + { + "type": "signedBy", + "keyType": "GPGKeys", + "keyPath": "/tmp/key.gpg" + } + ] + } + } +} +``` + +The `keyPath` does not exist yet, so we have to put the GPG key there: + +```bash +gpg --output /tmp/key.gpg --armor --export sgrunert@suse.com +``` + +If we now pull the image: + +```bash +sudo podman pull --tls-verify=false localhost:5000/alpine +… +Storing signatures +e7d92cdc71feacf90708cb59182d0df1b911f8ae022d29e8e95d75ca6a99776a +``` + +Then we can see in the logs of the web server that the signature has been +accessed: + +``` +127.0.0.1 - - [04/Mar/2020 11:18:21] "GET /alpine@sha256=e9b65ef660a3ff91d28cc50eba84f21798a6c5c39b4dd165047db49e84ae1fb9/signature-1 HTTP/1.1" 200 - +``` + +As a counterpart example, if we specify the wrong key at `/tmp/key.gpg`: + +```bash +gpg --output /tmp/key.gpg --armor --export mail@saschagrunert.de +File '/tmp/key.gpg' exists. Overwrite? (y/N) y +``` + +Then a pull is not possible any more: + +```bash +sudo podman pull --tls-verify=false localhost:5000/alpine +Trying to pull localhost:5000/alpine... +Error: pulling image "localhost:5000/alpine": unable to pull localhost:5000/alpine: unable to pull image: Source image rejected: Invalid GPG signature: … +``` + +So in general there are four main things to be taken into consideration when +signing container images with Podman and GPG: + +1. We need a valid private GPG key on the signing machine and corresponding + public keys on every system which would pull the image +2. A web server has to run somewhere which has access to the signature storage +3. The web server has to be configured in any + `/etc/containers/registries.d/*.yaml` file +4. Every image pulling system has to be configured to contain the enforcing + policy configuration via `policy.conf` + +That’s it for image signing and GPG. The cool thing is that this setup works out +of the box with [CRI-O][2] as well and can be used to sign container images in +Kubernetes environments. + +[2]: https://cri-o.io diff --git a/versioned_docs/version-5.5.1/tutorials/mac_client.md b/versioned_docs/version-5.5.1/tutorials/mac_client.md new file mode 100644 index 000000000..4879499a6 --- /dev/null +++ b/versioned_docs/version-5.5.1/tutorials/mac_client.md @@ -0,0 +1,7 @@ +--- +title: "[Podman Mac Client tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md)" +version: v5.5.1 +--- + +# [Podman Mac Client tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) +This tutorial has moved! You can find out how to set up Podman on macOS (as well as Windows) [here](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) diff --git a/versioned_docs/version-5.5.1/tutorials/mac_win_client.md b/versioned_docs/version-5.5.1/tutorials/mac_win_client.md new file mode 100644 index 000000000..fd3eff169 --- /dev/null +++ b/versioned_docs/version-5.5.1/tutorials/mac_win_client.md @@ -0,0 +1,120 @@ +--- +title: Podman Remote clients for macOS and Windows +version: v5.5.1 +--- + +# Podman Remote clients for macOS and Windows + +*** +**_NOTE:_** For running Podman on Windows, refer to the [Podman for Windows](podman-for-windows.md) guide, which uses the recommended approach of a Podman-managed Linux backend. For Mac, see the [Podman installation instructions](https://podman.io/getting-started/installation). This guide covers the advanced usage of Podman with a custom Linux VM or a remote external Linux system. +*** + +## Introduction + +The core Podman runtime environment can only run on Linux operating systems. But other operating systems can use the “remote client” to manage their containers to a Linux backend. This remote client is nearly identical to the standard Podman program. Certain functions that do not make sense for remote clients have been removed. For example, the “--latest” switch for container commands has been removed. + +### Brief architecture + +The remote client uses a client-server model. You need Podman installed on a Linux machine or VM that also has the SSH daemon running. On the local operating system, when you execute a Podman command, Podman connects to the server via SSH. It then connects to the Podman service by using systemd socket activation. The Podman commands are executed on the server. From the client's point of view, it seems like Podman runs locally. + +## Obtaining and installing Podman + +### Windows + +Installing the Windows Podman client begins by downloading the Podman Windows installer. The Windows installer is built with each Podman release and is downloadable from its [release description page](https://github.com/containers/podman/releases/latest). The Windows installer file is named `podman-#.#.#-setup.exe`, where the `#` symbols represent the version number of Podman. + +Once you have downloaded the installer to your Windows host, simply double click the installer and Podman will be installed. The path is also set to put `podman` in the default user path. + +Podman must be run at a command prompt using the Windows Command Prompt (`cmd.exe`) or PowerShell (`pwsh.exe`) applications. + +### macOS + +The Mac Client is available through [Homebrew](https://brew.sh/). You can download homebrew via the instructions on their site. Install podman using: +``` +$ brew install podman +``` + +## Creating the first connection + +### Enable the Podman service on the server machine. + +Before performing any Podman client commands, you must enable the podman.sock SystemD service on the Linux server. In these examples, we are running Podman as a normal, unprivileged user, also known as a rootless user. By default, the rootless socket listens at `/run/user/${UID}/podman/podman.sock`. You can enable and start this socket permanently, using the following commands: +``` +$ systemctl --user enable --now podman.socket +``` +You will need to enable linger for this user in order for the socket to work when the user is not logged in. + +``` +sudo loginctl enable-linger $USER +``` + +You can verify that the socket is listening with a simple Podman command. + +``` +$ podman --remote info +host: + arch: amd64 + buildahVersion: 1.16.0-dev + cgroupVersion: v2 + conmon: + package: conmon-2.0.19-1.fc32.x86_64 +``` + +#### Enable sshd + +In order for the client to communicate with the server you need to enable and start the SSH daemon on your Linux machine, if it is not currently enabled. +``` +sudo systemctl enable --now sshd +``` + +#### Setting up SSH +Remote podman uses SSH to communicate between the client and server. The remote client works considerably smoother using SSH keys. To set up your ssh connection, you need to generate an ssh key pair from your client machine. +``` +$ ssh-keygen +``` +Your public key by default should be in your home directory under .ssh\id_rsa.pub. You then need to copy the contents of id_rsa.pub and append it into ~/.ssh/authorized_keys on the Linux server. On a Mac, you can automate this using ssh-copy-id. + +If you do not wish to use SSH keys, you will be prompted with each Podman command for your login password. + +## Using the client + +The first step in using the Podman remote client is to configure a connection.. + +You can add a connection by using the `podman system connection add` command. + +``` +C:\Users\baude> podman system connection add baude --identity c:\Users\baude\.ssh\id_rsa ssh://192.168.122.1/run/user/1000/podman/podman.sock +``` + +This will add a remote connection to Podman and if it is the first connection added, it will mark the connection as the default. You can observe your connections with `podman system connection list` + +``` +C:\Users\baude> podman system connection list +Name Identity URI +baude* id_rsa ssh://baude@192.168.122.1/run/user/1000/podman/podman.sock +``` + +Now we can test the connection with `podman info`. + +``` +C:\Users\baude> podman info +host: + arch: amd64 + buildahVersion: 1.16.0-dev + cgroupVersion: v2 + conmon: + package: conmon-2.0.19-1.fc32.x86_64 +``` + +Podman has also introduced a “--connection” flag where you can use other connections you have defined. If no connection is provided, the default connection will be used. + +``` +C:\Users\baude> podman system connection --help +``` + +## Wrap up + +You can use the podman remote clients to manage your containers running on a Linux server. The communication between client and server relies heavily on SSH connections and the use of SSH keys are encouraged. Once you have Podman installed on your remote client, you should set up a connection using `podman system connection add` which will then be used by subsequent Podman commands. + +## History +Originally published on [Red Hat Enable Sysadmin](https://www.redhat.com/sysadmin/podman-clients-macos-windows) diff --git a/versioned_docs/version-5.5.1/tutorials/performance.md b/versioned_docs/version-5.5.1/tutorials/performance.md new file mode 100644 index 000000000..793d45a14 --- /dev/null +++ b/versioned_docs/version-5.5.1/tutorials/performance.md @@ -0,0 +1,249 @@ +--- +title: Podman performance guide +version: v5.5.1 +--- + +# Podman performance guide + +The performance of Podman may be influenced by a number of factors, such as, + +* the specified Podman command-line options and configuration +* the OCI runtime +* the host file system +* the container image + +Changing any of these may or may not have any noticeable effect on the performance of Podman on your system. + +## Using a separate user account for benchmarking + +Some performance tips, such as using a different storage driver would require the user to run `podman system reset`, +which erases all containers and container images for the user. +Instead of benchmarking different alternatives in your own home directory, you could create a new user +that afterwards can be removed. + +### Example: Specify the storage driver _vfs_ and run `/bin/true` in an Alpine container + +Interactively + +``` +sudo useradd testuser +sudo machinectl shell testuser@ +podman pull docker.io/library/alpine +/usr/bin/time -v podman --storage-driver=vfs run --rm docker.io/library/alpine /bin/true +exit +``` + +Noninteractively + +``` +sudo useradd testuser +systemd-run --machine=testuser@ --quiet --user --collect --pipe --wait \ + podman --storage-driver=vfs pull docker.io/library/alpine +systemd-run --machine=testuser@ --quiet --user --collect --pipe --wait \ + /usr/bin/time -v podman --storage-driver=vfs run --rm docker.io/library/alpine /bin/true +``` + +The command `/usr/bin/time -v` measures and displays benchmarking information. + +## Performance considerations + +### Use a fast OCI runtime + +Podman uses an OCI runtime when running containers. +The fastest OCI runtime is probably [__crun__](https://github.com/containers/crun). + +Check that you are using crun + +``` +$ podman info --format={{.Host.OCIRuntime.Name}} +crun +``` + +To benchmark an OCI runtime, create a test user account and +specify the OCI runtime path with [__--runtime__](https://docs.podman.io/en/latest/markdown/podman.1.html#runtime-value). + +### Choosing a storage driver + +The following storage drivers are listed from fastest to slowest: + +1. native overlayfs +2. fuse-overlayfs +3. vfs + +There is one notable exception to this speed ranking. +Creating a container takes significantly longer with _native overlayfs_ than _fuse-overlayfs_ +when these conditions are all met: + +* rootless Podman is used +* a modified UID/GID mapping is used +* _native overlayfs_ is used +* no container has yet been created with the specified container image and UID/GID mapping + +Runtime speed is not affected. Only __podman create__ and the container creation phases of +__podman run__ and __podman build__ are affected. +For more details, see [GitHub comment](https://github.com/containers/podman/issues/16541#issuecomment-1352790422). +Command-line options that modify the UID/GID mapping are for example __--userns__, __--uidmap__ and __--gidmap__. +The command-line option `--userns auto` is particularly affected by this performance penalty, +because different UID/GID mappings could potentially be used on each invocation. For other uses of +__--userns__, __--uidmap__ and __--gidmap__ the performance penalty is a one-time cost +that only occurs the first time the command is run. + +Using native overlayfs as an unprivileged user is available for Podman version >= 3.1 on a Linux kernel version >= 5.13. +If SELinux is not used, then Linux kernel version 5.11 or later is sufficient. +Native overlayfs support is included in RHEL >= 8.5, see [release notes](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/8.5_release_notes/index). + +To show the current storage driver + +``` +$ podman info -f {{.Store.GraphDriverName}} +overlay +$ podman info -f '{{index .Store.GraphStatus "Native Overlay Diff"}}' +true +``` + +Storage driver | Result of `podman info -f {{.Store.GraphDriverName}}` | Result of `podman info -f '{{index .Store.GraphStatus "Native Overlay Diff"}}` +---- | ------ | ----- +native overlayfs | overlay | true +fuse-overlayfs | overlay | false +VFS | vfs | false + +Before changing the storage driver, running `podman system reset` is required. +The command erases all containers and container images for the user. +See the example above "_Using a separate user account for benchmarking_" for how to benchmark a storage driver in a separate test account. + +#### Specifying the storage driver with command-line options + +Storage driver | Podman command +---- | ------ +native overlayfs | `podman --storage-driver=overlay run ...` +fuse-overlayfs | `podman --storage-driver=overlay --storage-opt overlay.mount_program=/usr/bin/fuse-overlayfs run ...` +VFS | `podman --storage-driver=vfs run ...` + +#### Configuring the default storage driver + +The default storage driver can be configured in +_/etc/containers/storage.conf_ and overridden by a user in +_~/.config/containers/storage.conf_ + +To configure native overlayfs: +``` +[storage] +driver = "overlay" +``` + +To configure fuse-overlayfs: +``` +[storage] +driver = "overlay" +[storage.options.overlay] +mount_program = "/usr/bin/fuse-overlayfs" +``` + +To configure VFS: +``` +[storage] +driver = "vfs" +``` + +See storage.conf(5) for all available configuration settings. + +### Network performance for rootless Podman + +When using rootless Podman, network traffic is normally passed through the network driver +[pasta](https://passt.top/passt/about/#pasta). This comes with a performance penalty. + +You can avoid using _pasta_ in the following ways: + +* Use socket activation for listening network sockets. Communication over the activated socket does not pass through + pasta, so it has the same performance characteristics as the normal network on the host. + Socket-activated services can be started and stopped in different ways: + + Let systemd start the service when the first client connects. Let the service terminate by itself after some time of inactivity. + Using a service on demand, can free up compute resources. + + Start the service explicitly (`systemctl --user enable foobar.service`). If the service is already + running when the first client connects, there will be no delay due to container startup. + The [socket activation tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/socket_activation.md) + provides more information about socket activation support in Podman. + +* Set up the network manually as root. Create a bridge and virtual ethernet pair (VETH). Note: compared to other methods, + this setup doesn't provide any network isolation. In containers granted CAP_NET_ADMIN or CAP_NET_RAW, processes can + open packet or raw sockets directly facing the host, which allows them to send arbitrary frames, including + crafted Ethernet and IP packets, as well as receiving packets that were not originally intended for the container, + by means of ARP spoofing. + For more information, see + + An [example](https://lists.podman.io/archives/list/podman@lists.podman.io/thread/W6MCYO6RY5YFRTSUDAOEZA7SC2EFXRZE/) posted on the Podman mailing list + + The section _DIY networking_ in [Podman-Rootless-Networking.pdf](https://containers.github.io/podman.io_old/old/community/meeting/notes/2021-10-05/Podman-Rootless-Networking.pdf) + +* Use `--network=host`. No network namespace is created. The container will use the host’s network. + Note: By using `--network=host`, the container is given full access to local system services such as D-bus and is therefore considered insecure. + +Side note: Pasta is faster than the network driver [slirp4netns](https://github.com/containers/podman/blob/main/docs/tutorials/basic_networking.md#slirp4netns). +Pasta is the default network driver since Podman 5.0.0. + +Since Podman 5.1.0 the default network driver can be shown with + +``` +$ podman info -f '{{.Host.RootlessNetworkCmd}}' +pasta +``` + +### Lazy pulling of container images + +Podman supports lazy pulling for the following container image formats: + +* __zstd:chunked__ + +* __eStargz__ + +__zstd:chunked__ has better performance than __eStargz__. + +See the article [_Pull container images faster with partial pulls_](https://www.redhat.com/sysadmin/faster-container-image-pulls) by Giuseppe Scrivano and Dan Walsh. + +### Choosing a host file system + +Lazy pulling of container images can run more efficiently when the file system has reflink support. The file systems XFS and BTRFS have reflink support. + +### Option --log-driver + +The `podman run` option [__--log-driver__](https://docs.podman.io/en/latest/markdown/podman-run.1.html#log-driver-driver) specifies the logging driver for the container. + +If logging is not needed, consider using `--log-driver=none` to disable logging. + +### Reuse the package repository cache when building container images + +The first step of a container build is often to download metadata from +the package repositories and post-process that data. + +To speed up container builds, you could prepare a directory on the host +that contains the package metadata and then make the directory available +to the container build by using an _overlay mount_. + +#### Example : Speed up _podman build_ by reusing the DNF metadata cache + +In this example the containers are based on Fedora 36. + +First create an empty directory on the host, for example *$HOME/dnf_cache_f36*. + +``` +$ mkdir $HOME/dnf_cache_f36 +``` + +Fill the directory with the most recent __dnf__ metadata cache. + +``` +$ podman run --rm -v $HOME/dnf_cache_f36:/var/cache/dnf:Z registry.fedoraproject.org/fedora:36 dnf makecache +``` + +Create a new directory, for example, _$HOME/ctr_ and a file _$HOME/ctr/Containerfile_ with these contents + +``` +FROM registry.fedoraproject.org/fedora:36 +RUN dnf -y update && dnf -y install cowsay && dnf clean all +``` + +To build the Containerfile using the prepared metadata cache, provide the directory _$HOME/dnf_cache_f36_ as an _overlay mount_ (volume option `:O`) + +``` +$ podman build -v $HOME/dnf_cache_f36:/var/cache/dnf:O -t cowsay $HOME/ctr +``` + +The article [_Speeding up container image builds with Buildah_](https://www.redhat.com/sysadmin/speeding-container-buildah) by Dan Walsh provides more details. diff --git a/versioned_docs/version-5.5.1/tutorials/podman-derivative-api.md b/versioned_docs/version-5.5.1/tutorials/podman-derivative-api.md new file mode 100644 index 000000000..733220064 --- /dev/null +++ b/versioned_docs/version-5.5.1/tutorials/podman-derivative-api.md @@ -0,0 +1,60 @@ +--- +title: How to use libpod for custom/derivative projects +version: v5.5.1 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +# How to use libpod for custom/derivative projects + +libpod today is a Golang library and a CLI. The choice of interface you make has advantages and disadvantages. + +Using the REST API +--- + +Advantages: + + - Stable, versioned API + - Language-agnostic + - [Well-documented](http://docs.podman.io/en/latest/_static/api.html) API + +Disadvantages: + + - Error handling is less verbose than Golang API + - May be slower + +Running as a subprocess +--- + +Advantages: + + - Many commands output JSON + - Works with languages other than Golang + - Easy to get started + +Disadvantages: + + - Error handling is harder + - May be slower + - Can't hook into or control low-level things like how images are pulled + +Vendoring into a Go project +--- + +Advantages: + + - Significant power and control + +Disadvantages: + + - You are now on the hook for container runtime security updates (partially, `runc`/`crun` are separate) + - Binary size + - Potential skew between multiple libpod versions operating on the same storage can cause problems + +Making the choice +--- + +A good question to ask first is: Do you want users to be able to use `podman` to manipulate the containers created by your project? +If so, that makes it more likely that you want to run `podman` as a subprocess or using the HTTP API. If you want a separate image store and a fundamentally +different experience; if what you're doing with containers is quite different from those created by the `podman` CLI, +that may drive you towards vendoring. diff --git a/versioned_docs/version-5.5.1/tutorials/podman-for-windows.md b/versioned_docs/version-5.5.1/tutorials/podman-for-windows.md new file mode 100644 index 000000000..89a2604d4 --- /dev/null +++ b/versioned_docs/version-5.5.1/tutorials/podman-for-windows.md @@ -0,0 +1,426 @@ +--- +title: Documentation +version: v5.5.1 +--- + +![](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +Podman for Windows +================== + +While "containers are Linux," Podman also runs on Mac and Windows, where it +provides a native CLI and embeds a guest Linux system to launch your +containers. This guest is referred to as a Podman machine and is managed with +the `podman machine` command. On Windows, each Podman machine is backed by a +virtualized Windows Subsystem for Linux (WSLv2) distribution. The podman command +can be run directly from your Windows PowerShell (or CMD) prompt, where it +remotely communicates with the podman service running in the WSL environment. +Alternatively, you can access Podman directly from the WSL instance if you +prefer a Linux prompt and Linux tooling. In addition to command-line access, +Podman also listens for Docker API clients, supporting direct usage of +Docker-based tools and programmatic access from your language of choice. + +Prerequisites +------------- + +Since Podman uses WSL, you need a recent release of Windows 10 or Windows 11. +On x64, WSL requires build 18362 or later, and 19041 or later is required for +arm64 systems. Internally, WSL uses virtualization, so your system must +support and have hardware virtualization enabled. If you are running Windows +on a VM, you must have a VM that supports nested virtualization. + +It is also recommended to install the modern "Windows Terminal," which +provides a superior user experience to the standard PowerShell and CMD +prompts, as well as a WSL prompt, should you want it. + +You can install it by searching the Windows Store or by running the following +`winget` command: + +`winget install Microsoft.WindowsTerminal` + + +Installing Podman +----------------- + +Installing the Windows Podman client begins by downloading the Podman Windows +installer. The Windows installer is built with each Podman release and can be +downloaded from the official + [GitHub release page](https://github.com/containers/podman/releases). +Be sure to download a 4.1 or later release for the capabilities discussed +in this guide. + +*[Image: Installing Podman 4.1.0]* + +Once downloaded, simply run the EXE file, and relaunch a new terminal. After +this point, podman.exe will be present on your PATH, and you will be able to run +the `podman machine init` command to create your first machine. + +`PS C:\Users\User> podman machine init` + +Automatic WSL Installation +-------------------------- + +If WSL has not been installed on your system, the first machine init command +will prompt a dialog to begin an automated install. If accepted, this process +will install the necessary Windows components, restart the system, and after +login, relaunch the machine creation process in a terminal window. Be sure to +wait a minute or two for the relaunch to occur, as Windows has a delay before +executing startup items. Alternatively, you can decline automatic installation +and install WSL manually. However, this will require additional download and +setup time. + +Machine Init Process +-------------------- + +After WSL is installed, the init command will install a minimal installation +of Fedora, customizing it to run podman. + +``` +PS C:\Users\User> podman machine init +Extracting compressed file +Importing operating system into WSL (this may take 5+ minutes on a new WSL install)... +Installing packages (this will take a while)... +Complete! +Configuring system... +Generating public/private ed25519 key pair. +Your identification has been saved in podman-machine-default +Your public key has been saved in podman-machine-default.pub +The key fingerprint is: +SHA256:RGTGg2Q/LX7ijN+mzu8+BzcS3cEWP6Hir6pYllJtceA root@WINPC +Machine init complete +To start your machine run: + + podman machine start +``` + + +Starting Machine +---------------- + +After the machine init process completes, it can then be started and stopped +as desired: + +``` +PS C:\Users\User> podman machine start + +Starting machine "podman-machine-default" + +This machine is currently configured in rootless mode. If your containers +require root permissions (e.g. ports < 1024), or if you run into compatibility +issues with non-podman clients, you can switch using the following command: + + podman machine set --rootful + +API forwarding listening on: npipe:////./pipe/docker_engine + +Docker API clients default to this address. You do not need to set DOCKER_HOST. +Machine "podman-machine-default" started successfully +``` + +First Podman Command +-------------------- + +From this point on, podman commands operate similarly to how they would on +Linux. + +For a quick working example with a small image, you can run the Linux date +command on PowerShell. + +``` +PS C:\Users\User> podman run ubi8-micro date +Thu May 5 21:56:42 UTC 2022 +``` + +Port Forwarding +--------------- + +Port forwarding also works as expected; ports will be bound against localhost +(127.0.0.1). Note: When running as rootless (the default), you must use a port +greater than 1023. See the Rootful and Rootless section for more details. + +To launch httpd, you can run: + +``` +PS C:\Users\User> podman run --rm -d -p 8080:80 --name httpd docker.io/library/httpd +f708641300564a6caf90c145e64cd852e76f77f6a41699478bb83a162dceada9 +``` + +A curl command against localhost on the PowerShell prompt will return a +successful HTTP response: + +``` +PS C:\Users\User> curl http://localhost:8080/ -UseBasicParsing + +StatusCode : 200 +StatusDescription : OK +Content :

It works!

+``` + +As with Linux, to stop, run: + +`podman stop httpd` + + +Using API Forwarding +-------------------- + +API forwarding allows Docker API tools and clients to use podman as if it was +Docker. Provided there is no other service listening on the Docker API pipe; +no special settings will be required. + +``` +PS C:\Users\User> .\docker.exe run -it fedora echo "Hello Podman!" +Hello Podman! +``` + +Otherwise, after starting the machine, you will be notified of an environment +variable you can set for tools to point to podman. Alternatively, you can shut +down both the conflicting service and podman, then finally run `podman machine +start` to restart, which should grab the Docker API address. + + +``` +Another process was listening on the default Docker API pipe address. +You can still connect Docker API clients by setting DOCKER HOST using the +following PowerShell command in your terminal session: + + $Env:DOCKER_HOST = 'npipe:////./pipe/podman-machine-default' + +Or in a classic CMD prompt: + + set DOCKER_HOST=npipe:////./pipe/podman-machine-default + +Alternatively, terminate the other process and restart podman machine. +Machine "podman-machine-default" started successfully + +PS C:\Users\User> $Env:DOCKER_HOST = 'npipe:////./pipe/podman-machine-default' +PS C:\Users\User>.\docker.exe version --format '{{(index .Server.Components 0).Name}}' +Podman Engine +``` + +Rootful & Rootless +------------------ + +On the embedded WSL Linux distro, podman can either be run under the root user +(rootful) or a non-privileged user (rootless). For behavioral consistency with +Podman on Linux, rootless is the default. Note: Rootful and Rootless +containers are distinct and isolated from one another. Podman commands against +one (e.g., podman ps) will not represent results/state for the other. + +While most containers run fine in a rootless setting, you may find a case +where the container only functions with root privileges. If this is the case, +you can switch the machine to rootful by stopping it and using the set +command: + +``` +podman machine stop +podman machine set --rootful +``` + +To restore rootless execution, set rootful to false: + +``` +podman machine stop +podman machine set --rootful=false +``` + +Another case in which you may wish to use rootful execution is binding a port +less than 1024. However, future versions of podman will likely drop this to a +lower number to improve compatibility with defaults on system port services (such +as MySQL) + +Volume Mounting +--------------- + +New in Podman v4.1 is the ability to perform volume mounts from Windows paths into a +Linux container. This supports several notation schemes, including: + +Windows Style Paths: + +`podman run --rm -v c:\Users\User\myfolder:/myfolder ubi8-micro ls /myfolder` + +Unixy Windows Paths: + +`podman run --rm -v /c/Users/User/myfolder:/myfolder ubi8-micro ls /myfolder` + +Linux paths local to the WSL filesystem: + +`podman run --rm -v /var/myfolder:/myfolder ubi-micro ls /myfolder` + +All of the above conventions work, whether running on a Windows prompt or the +WSL Linux shell. Although when using Windows paths on Linux, appropriately quote +or escape the Windows path portion of the argument. + + +Listing Podman Machine(s) +------------------------- + +To list the available podman machine instances and their current resource +usage, use the `podman machine ls` command: + +``` +PS C:\Users\User> podman machine ls + + +NAME VM TYPE CREATED LAST UP CPUS MEMORY DISK SIZE +podman-machine-default wsl 2 hours ago Currently running 4 331.1MB 768MB +``` + +Since WSL shares the same virtual machine and Linux kernel across multiple +distributions, the CPU and Memory values represent the total resources shared +across running systems. The opposite applies to the Disk value. It is +independent and represents the amount of storage for each individual +distribution. + + +Accessing the Podman Linux Environment +-------------------------------------- + +While using the podman.exe client on the Windows environment provides a +seamless native experience supporting the usage of local desktop tools and +APIs, there are a few scenarios in which you may wish to access the Linux +environment: + ++ Updating to the latest stable packages on the embedded Fedora instance ++ Using Linux development tools directly ++ Using a workflow that relies on EXT4 filesystem performance or behavior + semantics + +There are three mechanisms to access the embedded WSL distribution: +1. SSH using `podman machine ssh` +2. WSL command on the Windows PowerShell prompt +3. Windows Terminal Integration + +### Using SSH + +SSH access provides a similar experience as Podman on Mac. It immediately +drops you into the appropriate user based on your machine's rootful/rootless +configuration (root in the former, 'user' in the latter). The --username +option can be used to override with a specific user. + +An example task using SSH is updating your Linux environment to pull down the +latest OS bugfixes: + +`podman machine ssh sudo dnf upgrade -y` + +### Using the WSL Command + +The `wsl` command provides direct access to the Linux system but enters the +shell as root first. This is due to design limitations of WSL, where running +systemd (Linux's system services) requires the usage of a privileged process +namespace. + +Unless you have no other distributions of WSL installed, it's recommended to +use the `-d` option with the name of your podman machine (podman-machine-default +is the default) + +``` +PS C:\Users\User> wsl -d podman-machine-default +``` + +You will be automatically entered into a nested process namespace where +systemd is running. If you need to access the parent namespace, hit `ctrl-d` +or type exit. This also means to log out, you need to exit twice. + +``` +[root@WINPC /]# podman --version +podman version 4.1.0 +``` + + +To access commands as the non-privileged user (rootless podman), you must +first type `su user`. Alternatively, you can prefix the `wsl` command to use the +special `enterns`: + +``` +wsl -d podman-machine-default enterns su user +[user@WINPC /]$ id +uid=1000(user) gid=1000(user) groups=1000(user),10(wheel) +``` + +Likewise, running commands as root without entering a prompt should also be +prefixed with `enterns`. + +`wsl -d podman-machine-default enterns systemctl status` + +Accessing the WSL instance as a specific user using `wsl -u` or using inline +commands without `enterns` is not recommended since commands will execute +against the incorrect namespace. + +### Using Windows Terminal Integration + +Entering WSL as root is a 2-click operation. Simply click the drop-down tag, +and pick 'podman-machine-default,' where you will be entered directly as root. + +*[Image: Using WSL in Windows Terminal]* + +As before, to switch to a non-privileged user for rootless podman commands, +type `su user`. + +``` +[root@WINPC /]# su user +[user@WINPC /]$ podman info --format '{{.Store.RunRoot}}' +/run/user/1000/containers +``` + +Stopping a Podman Machine +------------------------- + +To stop a running podman machine, use the `podman machine stop` command: + +``` +PS C:\Users\User> podman machine stop +Machine "podman-machine-default" stopped successfully +``` + +Removing a Podman Machine +------------------------- + +To remove a machine, use the `podman machine rm` command: + +``` +PS C:\Users\User> podman machine rm + +The following files will be deleted: + +C:\Users\User\.ssh\podman-machine-default +C:\Users\User\.ssh\podman-machine-default.pub +C:\Users\User\.local\share\containers\podman\machine\wsl\podman-machine-default_fedora-35-x86_64.tar +C:\Users\User\.config\containers\podman\machine\wsl\podman-machine-default.json +C:\Users\User\.local\share\containers\podman\machine\wsl\wsldist\podman-machine-default + + +Are you sure you want to continue? [y/N] y +``` + + + +Troubleshooting +--------------- + +Recovering from a failed auto-installation of WSL + +If auto-install fails and retrying is unsuccessful, you can attempt to reset +your WSL system state and perform a manual WSL installation using the `wsl +--install` command. To do so, perform the following steps: + +1. Launch PowerShell as administrator + ``` + Start-Process powershell -Verb RunAs + ``` +2. Disable WSL Features + ``` + dism.exe /online /disable-feature /featurename:Microsoft-Windows-Subsystem-Linux /norestart + dism.exe /online /disable-feature /featurename:VirtualMachinePlatform /norestart + ``` +3. Reboot +4. Run manual WSL install + ``` + wsl --install + ``` +5. Continue with podman machine init + +Install Certificate Authority +============================= + +Instructions for installing a CA certificate can be found [here](podman-install-certificate-authority.md). diff --git a/versioned_docs/version-5.5.1/tutorials/podman-install-certificate-authority.md b/versioned_docs/version-5.5.1/tutorials/podman-install-certificate-authority.md new file mode 100644 index 000000000..684a61d8b --- /dev/null +++ b/versioned_docs/version-5.5.1/tutorials/podman-install-certificate-authority.md @@ -0,0 +1,114 @@ +--- +title: Documentation +version: v5.5.1 +--- + +*[Image: PODMAN logo]* + +Install Certificate Authority +============================= + +Organizations may create their own local certificate authority (CA) or acquire one from a third party. This may mean more than one certificate, such as one or more intermediate certificates and a root certificate, for example. In any case, it is necessary to add the certificate authority (CA) certificate(s) so that it can be employed for various use cases. + +### Method one + +Certificates may be either individual or concatenated (bundles). The following steps are one method to add such certificates to Podman. It is assumed that Podman is running and the certificate(s) to be installed are available on an accessible server via curl. If such access is not possible, an alternative method follows. + +First, assuming a running Podman machine, ssh into the machine: +``` +podman machine ssh +``` + +If Podman is running in the default rootless mode, an additional command is required to get to a root shell: + +``` +[core@localhost ~]$ sudo su - +``` + +After issuing the above command, the prompt should change to indicate the "root" instead of the "core" user. + +Next, while in the machine, change to the directory where the certificate(s) should be installed: +``` +[root@localhost ~]# cd /etc/pki/ca-trust/source/anchors +``` + +Then use curl to download the certificate. Notes: +* The -k is only necessary if connecting securely to a server for which the certificate is not yet trusted +* The MY-SERVER.COM/SOME-CERTIFICATE.pem should be replaced as appropriate +``` +[root@localhost anchors]# curl -k -o some-certificate.pem https://MY-SERVER.COM/SOME-CERTIFICATE.pem +``` + +Repeat as necessary for multiple certificates. + +Once all of the certificates have been downloaded, run the command to add the certificates to the list of trusted CAs: +``` +[root@localhost anchors]# update-ca-trust +``` + +Exit the machine: +``` +[root@localhost anchors]# exit +``` + +If the "sudo su -" command was used to switch to a root shell as described above, an additional exit command is needed to exit the machine: + +``` +[core@localhost ~]$ exit +``` + +If the certificates are still not accepted, it might be necessary to restart the Podman machine. To do this, issue the following commands on the host (and not inside the Podman machine): + +``` +podman machine stop +podman machine start +``` + +### Alternative Method + +If the above method is for some reason not practical or desirable, the certificate may be created using vi. + +As above, assuming a running Podman machine, ssh into the machine: + +``` +podman machine ssh +``` + +If the prompt starts with "core" instead of "root", switch to a root shell: + +``` +[core@localhost ~]$ sudo su - +``` + +Next, change to the directory where the certificate(s) should be installed: +``` +[root@localhost ~]# cd /etc/pki/ca-trust/source/anchors +``` + +Then use vi to create the certificate. +``` +[root@localhost ~]# vi SOME-CERTIFICATE.pem +``` +After vi opens, copy the certificate to the clipboard, then in insert mode, paste the clipboard contents to vi. Lastly, save the file and close vi. + +Repeat as necessary for multiple certificates. + +Once all of the certificates have been created, run the command to add the certificates to the list of trusted CAs: +``` +[root@localhost anchors]# update-ca-trust +``` + +Exit the machine: +``` +[root@localhost anchors]# exit +``` + +If the "sudo su -" command described above was used, an additional exit command is needed: + +``` +[core@localhost ~]$ exit +``` + +### Final Notes + +The certificate installation will persist during machine restarts. There is no need to stop and start the machine to begin using the certificate. diff --git a/versioned_docs/version-5.5.1/tutorials/podman_tutorial.md b/versioned_docs/version-5.5.1/tutorials/podman_tutorial.md new file mode 100644 index 000000000..19ff51c03 --- /dev/null +++ b/versioned_docs/version-5.5.1/tutorials/podman_tutorial.md @@ -0,0 +1,149 @@ +--- +title: Basic Setup and Use of Podman +version: v5.5.1 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +# Basic Setup and Use of Podman +Podman is a utility provided as part of the libpod library. It can be used to create and maintain +containers. The following tutorial will teach you how to set up Podman and perform some basic +commands with Podman. + +If you are running on a Mac or Windows PC, you should instead follow the [Mac and Windows tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) +to set up the remote Podman client. + +**NOTE**: the code samples are intended to be run as a non-root user, and use `sudo` where +root escalation is required. + +## Installing Podman + +For installing or building Podman, see the [installation instructions](https://podman.io/getting-started/installation). + +## Familiarizing yourself with Podman + +### Running a sample container +This sample container will run a very basic httpd server (named basic_httpd) that serves only its index +page. +```console +podman run --name basic_httpd -dt -p 8080:80/tcp docker.io/nginx +``` +Because the container is being run in detached mode, represented by the *-d* in the `podman run` command, Podman +will print the container ID after it has run. Note that we use port forwarding to be able to +access the HTTP server. For successful running at least slirp4netns v0.3.0 is needed. + +### Listing running containers +The Podman *ps* command is used to list creating and running containers. +```console +podman ps +``` + +Note: If you add *-a* to the *ps* command, Podman will show all containers. +### Inspecting a running container +You can "inspect" a running container for metadata and details about itself. We can even use +the inspect subcommand to see what IP address was assigned to the container. As the container is running in rootless mode, an IP address is not assigned and the value will be listed as "none" in the output from inspect. +```console +podman inspect basic_httpd | grep IPAddress\": + "SecondaryIPAddresses": null, + "IPAddress": "", +``` + +### Testing the httpd server +As we do not have the IP address of the container, we can test the network communication between the host +operating system and the container using curl. The following command should display the index page of our +containerized httpd server. +```console +curl http://localhost:8080 +``` + +### Viewing the container's logs +You can view the container's logs with Podman as well: +```console +podman logs +10.88.0.1 - - [07/Feb/2018:15:22:11 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:30 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:30 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:31 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:31 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +``` + +### Viewing the container's pids +And you can observe the httpd pid in the container with *top*. +```console +podman top + UID PID PPID C STIME TTY TIME CMD + 0 31873 31863 0 09:21 ? 00:00:00 nginx: master process nginx -g daemon off; + 101 31889 31873 0 09:21 ? 00:00:00 nginx: worker process +``` + +### Checkpointing the container +Checkpointing a container stops the container while writing the state of all processes in the container to disk. +With this a container can later be restored and continue running at exactly the same point in time as the +checkpoint. This capability requires CRIU 3.11 or later installed on the system. +This feature is not supported as rootless; as such, if you wish to try it, you'll need to re-create your container as root, using the same command but with sudo. + +To checkpoint the container use: +```console +sudo podman container checkpoint +``` + +### Restoring the container +Restoring a container is only possible for a previously checkpointed container. The restored container will +continue to run at exactly the same point in time it was checkpointed. +To restore the container use: +```console +sudo podman container restore +``` + +After being restored, the container will answer requests again as it did before checkpointing. +```console +curl http://:8080 +``` + +### Migrate the container +To live migrate a container from one host to another the container is checkpointed on the source +system of the migration, transferred to the destination system and then restored on the destination +system. When transferring the checkpoint, it is possible to specify an output-file. + +On the source system: +```console +sudo podman container checkpoint -e /tmp/checkpoint.tar.gz +scp /tmp/checkpoint.tar.gz :/tmp +``` + +On the destination system: +```console +sudo podman container restore -i /tmp/checkpoint.tar.gz +``` + +After being restored, the container will answer requests again as it did before checkpointing. This +time the container will continue to run on the destination system. +```console +curl http://:8080 +``` + +### Stopping the container +To stop the httpd container: +```console +podman stop +``` +You can also check the status of one or more containers using the *ps* subcommand. In this case, we should +use the *-a* argument to list all containers. +```console +podman ps -a +``` + +### Removing the container +To remove the httpd container: +```console +podman rm +``` +You can verify the deletion of the container by running *podman ps -a*. + +## Integration Tests +For more information on how to set up and run the integration tests in your environment, checkout the Integration Tests [README.md](https://github.com/containers/podman/blob/main/test/README.md) + +## More information + +For more information on Podman and its subcommands, checkout the asciiart demos on the [README.md](https://github.com/containers/podman/blob/main/README.md#commands) +page. diff --git a/versioned_docs/version-5.5.1/tutorials/podman_tutorial_cn.md b/versioned_docs/version-5.5.1/tutorials/podman_tutorial_cn.md new file mode 100644 index 000000000..93f315608 --- /dev/null +++ b/versioned_docs/version-5.5.1/tutorials/podman_tutorial_cn.md @@ -0,0 +1,175 @@ +--- +title: Documentation +version: v5.5.1 +--- + +> - 译文出自：[掘金翻译计划](https://juejin.cn/translate) + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +Podman是由libpod库提供一个实用的程序，可以被用于创建和管理容器。 + +下面的教程会教你如何启动 Podman 并使用 Podman 执行一些基本的命令。 + +如果你正在使用 Mac 或者 Windows +，你应该先查看[Mac 和 Windows 使用说明](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md)来设置 Podman +远程客户端。 + +**注意**：示例中所有命令皆以非 root 的用户运行，必要的时候通过 `sudo` 命令来获取 root 权限。 + +## 安装Podman + +安装或者编译 Podman ，请参照[安装说明](https://podman.io/getting-started/installation)。 + +## 熟悉podman + +### 运行一个示例容器 + +这个示例容器会运行一个简单的只有主页的 httpd 服务器。 + +```console +podman run --name basic_httpd -dt -p 8080:80/tcp docker.io/nginx +``` + +因为命令中的 *-d* 参数表明容器以 "detached" 模式运行，所以 Podman 会在容器运行后打印容器的 ID。 + +注意为了访问这个 HTTP 服务器，我们将使用端口转发。成功运行需要 slirp4netns 的 v0.3.0+ 版本。 + +Podman 的 *ps* 命令用于列出正在创建和运行的容器。 + +```console +podman ps +``` + +**注意**：如果为 *ps* 命令添加 *-a* 参数，Podman 将展示所有的容器。 + +### 查看正在运行的容器 + +你可以 "inspect" (查看)一个正在运行的容器的元数据以及其他详细信息。我们甚至可以使用 inspect 的子命令查看分配给容器的 IP 地址。由于容器以非 root 模式运行，没有分配 IP 地址，inspect 的输出会是 " +none" 。 + +```console +podman inspect -l | grep IPAddress\": + "SecondaryIPAddresses": null, + "IPAddress": "", +``` + +**注意**：*-l* 参数是**最近的容器**的指代，你也可以使用容器的ID 代替 *-l* + +### 测试httpd服务器 + +由于我们没有容器的 IP 地址，我们可以使用 curl 测试主机和容器之间的网络通信。下面的命令应该显示我们的容器化 httpd 服务器 的主页。 + +```console +curl http://localhost:8080 +``` + +### 查看容器的日志 + +你也可以使用 podman 查看容器的日志 + +```console +podman logs --latest +10.88.0.1 - - [07/Feb/2018:15:22:11 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:30 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:30 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:31 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:31 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +``` + +### 查看容器中的进程pid + +你可以使用 *top* 命令查看容器中 httpd 的 pid + +```console +podman top + UID PID PPID C STIME TTY TIME CMD + 0 31873 31863 0 09:21 ? 00:00:00 nginx: master process nginx -g daemon off; + 101 31889 31873 0 09:21 ? 00:00:00 nginx: worker process +``` + +### 设置容器的检查点 + +设置检查点会在停止容器的同时把容器中所有进程的状态写入磁盘。 + +有了它，容器后续可以被恢复，并在与检查点完全相同的时间点继续运行。 这个功能需要在系统上安装 CRIU 的 3.11+ 版本。 + +这个功能不支持非 root 模式，因此，如果你想尝试使用它，你需要使用 sudo 方式重新创建容器。 + +设置容器检查点请使用： + +```console +sudo podman container checkpoint +``` + +### 恢复容器 + +恢复容器只能在以前设置过检查点的容器上使用。恢复的容器会在与设置检查点时完全相同的时间点继续运行。 + +恢复容器请使用： + +```console +sudo podman container restore +``` + +恢复之后。容器会像设置检查点之前一样回复请求 + +```console +curl http://:8080 +``` + +### 迁移容器 + +为了将容器从一个主机上热迁移到另一个主机，容器可以在在源系统上创建检查点，传输到目的系统，然后再在目的系统上恢复。 +为了便于传输容器的检查点，可以将其存储在一个指定的输出文件中。 + +在源系统上： + +```console +sudo podman container checkpoint -e /tmp/checkpoint.tar.gz +scp /tmp/checkpoint.tar.gz :/tmp +``` + +在目标系统上： + +```console +sudo podman container restore -i /tmp/checkpoint.tar.gz +``` + +恢复之后，容器会像设置检查点之前一样回复请求。这时，容器会在目标系统上继续运行。 + +```console +curl http://:8080 +``` + +### 停止容器 + +停止 httpd 容器 + +```console +podman stop --latest +``` + +你还可以使用 *ps* 命令检查一个或多个容器的状态，在这个例子中，我们使用 *-a* 参数列出所有的容器。 + +```console +podman ps -a +``` + +### 移除容器 + +移除 httpd 容器 + +```console +podman rm --latest +``` + +你可以使用 *podman ps -a* 验证容器的删除。 + +## 集成测试 + +在环境中如何设置并运行集成测试请查看集成测试的[自述页面](https://github.com/containers/podman/blob/main/test/README.md) + +## 更多信息 + +有关podman 和它的子命令的更多信息请查看 podman 的[自述页面](https://github.com/containers/podman/blob/main/README.md#commands) diff --git a/versioned_docs/version-5.5.1/tutorials/qemu-remote-tutorial.md b/versioned_docs/version-5.5.1/tutorials/qemu-remote-tutorial.md new file mode 100644 index 000000000..c39d6fa2b --- /dev/null +++ b/versioned_docs/version-5.5.1/tutorials/qemu-remote-tutorial.md @@ -0,0 +1,137 @@ +--- +title: Podman-remote client for Windows with QEMU VM +version: v5.5.1 +--- + +# Podman-remote client for Windows with QEMU VM + +*** +**_NOTE:_** For running Podman on Windows, refer to the [Podman for Windows](podman-for-windows.md) guide, which uses the recommended approach of a Podman-managed Linux backend. For Mac, see the [Podman installation instructions](https://podman.io/getting-started/installation). This guide covers the advanced usage of Podman with a custom Linux VM. +*** + +## Introduction + +This is an experimental setup using QEMU VM for running Podman for the already supported [Podman-remote](https://docs.podman.io/en/latest/markdown/podman-remote.1.html) client on Windows. +The officially supported and recommended way of running Podman on Windows is using [Podman machine](https://docs.podman.io/en/latest/markdown/podman-machine.1.html). + +## Prerequisites + +* Windows 10 Build 18362 or later (Build 19044/Version 21H2 or later recommended) +* SSH client feature installed on the machine +* Hyper-V acceleration should be operational on the machine +* Directory `C:\qemu-remote\` will be used for storing needed assets +* Port `57561` is free to use for ssh over a loopback interface + +## Obtaining and installing + +### QEMU + +Download QEMU (7.2.0 minimal) from https://qemu.weilnetz.de/w64/ + +Then download the Fedora CoreOS (FCOS) image for QEMU from https://getfedora.org/coreos/download?tab=metal_virtualized&stream=testing&arch=x86_64 + +One will need `.xz` format extraction tool like xz itself or 7-zip. Use it to extract the `.qcow2` image to C:\qemu-remote\fedora-coreos-37.20221127.2.0-qemu.x86_64.qcow2 + +With xz the command line (when run from the same directory) will be +``` +xz -d fedora-coreos-37.20221127.2.0-qemu.x86_64.qcow2.xz +``` + +### Podman + +Download and install the latest release of Podman for Windows. Podman releases can be obtained from the official Podman GitHub release page: https://github.com/containers/podman/releases + +#### Older Podman releases + +When using older Podman releases (4.3.x and earlier), where `gvproxy.exe` is missing from the installation directory, +it could be obtained from the official releases https://github.com/containers/gvisor-tap-vsock/releases +One would need version `0.5.0` or a more recent release. Download `gvproxy-windows.exe` and copy it to +the Podman installation directory (or any other location, which is added to the PATH environment variable) +renaming the binary to `gvproxy.exe`. + +### SSH + +Generate ssh keys with an empty passphrase + +ssh-keygen -t ed25519 -f C:\qemu-remote\remote + +### Ignition for FCOS + +Create ignition file C:\qemu-remote\remote.ign with the content of +``` +{"ignition":{"config":{"replace":{"verification":{}}},"proxy":{},"security":{"tls":{}},"timeouts":{},"version":"3.2.0"},"passwd":{"users":[{"name":"core","sshAuthorizedKeys":["YOURSSHKEYHERE"],"uid":501},{"name":"root","sshAuthorizedKeys":["YOURSSHKEYHERE"]}]},"storage":{"directories":[{"group":{"name":"core"},"path":"/home/core/.config","user":{"name":"core"},"mode":493},{"group":{"name":"core"},"path":"/home/core/.config/containers","user":{"name":"core"},"mode":493},{"group":{"name":"core"},"path":"/home/core/.config/systemd","user":{"name":"core"},"mode":493},{"group":{"name":"core"},"path":"/home/core/.config/systemd/user","user":{"name":"core"},"mode":493},{"group":{"name":"core"},"path":"/home/core/.config/systemd/user/default.target.wants","user":{"name":"core"},"mode":493},{"group":{"name":"root"},"path":"/etc/containers/registries.conf.d","user":{"name":"root"},"mode":493},{"group":{"name":"root"},"path":"/etc/systemd/system.conf.d","user":{"name":"root"},"mode":493},{"group":{"name":"root"},"path":"/etc/environment.d","user":{"name":"root"},"mode":493}],"files":[{"group":{"name":"core"},"path":"/home/core/.config/systemd/user/linger-example.service","user":{"name":"core"},"contents":{"source":"data:,%5BUnit%5D%0ADescription=A%20systemd%20user%20unit%20demo%0AAfter=network-online.target%0AWants=network-online.target%20podman.socket%0A%5BService%5D%0AExecStart=%2Fusr%2Fbin%2Fsleep%20infinity%0A","verification":{}},"mode":484},{"group":{"name":"core"},"path":"/home/core/.config/containers/containers.conf","user":{"name":"core"},"contents":{"source":"data:,%5Bcontainers%5D%0Anetns=%22bridge%22%0A","verification":{}},"mode":484},{"group":{"name":"root"},"overwrite":true,"path":"/etc/subuid","user":{"name":"root"},"contents":{"source":"data:,core:100000:1000000","verification":{}},"mode":484},{"group":{"name":"root"},"overwrite":true,"path":"/etc/subgid","user":{"name":"root"},"contents":{"source":"data:,core:100000:1000000","verification":{}},"mode":484},{"group":{"name":"root"},"path":"/etc/systemd/system/user@.service.d/delegate.conf","user":{"name":"root"},"contents":{"source":"data:,%5BService%5D%0ADelegate=memory%20pids%20cpu%20io%0A","verification":{}},"mode":420},{"group":{"name":"core"},"path":"/var/lib/systemd/linger/core","user":{"name":"core"},"contents":{"verification":{}},"mode":420},{"group":{"name":"root"},"path":"/etc/containers/containers.conf","user":{"name":"root"},"contents":{"source":"data:,%5Bengine%5D%0Amachine_enabled=true%0A","verification":{}},"mode":420},{"group":{"name":"root"},"path":"/etc/containers/podman-machine","user":{"name":"root"},"contents":{"source":"data:,qemu%0A","verification":{}},"mode":420},{"group":{"name":"root"},"path":"/etc/containers/registries.conf.d/999-podman-machine.conf","user":{"name":"root"},"contents":{"source":"data:,unqualified-search-registries=%5B%22docker.io%22%5D%0A","verification":{}},"mode":420},{"group":{},"path":"/etc/tmpfiles.d/podman-docker.conf","user":{},"contents":{"source":"data:,L+%20%20%2Frun%2Fdocker.sock%20%20%20-%20%20%20%20-%20%20%20%20-%20%20%20%20%20-%20%20%20%2Frun%2Fpodman%2Fpodman.sock%0A","verification":{}},"mode":420},{"group":{"name":"root"},"path":"/etc/profile.d/docker-host.sh","user":{"name":"root"},"contents":{"source":"data:,export%20DOCKER_HOST=%22unix:%2F%2F$%28podman%20info%20-f%20%22%7B%7B.Host.RemoteSocket.Path%7D%7D%22%29%22%0A","verification":{}},"mode":420}],"links":[{"group":{"name":"core"},"path":"/home/core/.config/systemd/user/default.target.wants/linger-example.service","user":{"name":"core"},"hard":false,"target":"/home/core/.config/systemd/user/linger-example.service"},{"group":{"name":"root"},"overwrite":true,"path":"/usr/local/bin/docker","user":{"name":"root"},"hard":false,"target":"/usr/bin/podman"},{"group":{"name":"root"},"overwrite":false,"path":"/etc/localtime","user":{"name":"root"},"hard":false,"target":"\\usr\\share\\zoneinfo"}]},"systemd":{"units":[{"enabled":true,"name":"podman.socket"},{"contents":"[Unit]\nRequires=dev-virtio\\\\x2dports-vport1p1.device\nAfter=remove-moby.service sshd.socket sshd.service\nOnFailure=emergency.target\nOnFailureJobMode=isolate\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/bin/sh -c '/usr/bin/echo Ready \u003e/dev/vport1p1'\n[Install]\nRequiredBy=default.target\n","enabled":true,"name":"ready.service"},{"enabled":false,"mask":true,"name":"docker.service"},{"enabled":false,"mask":true,"name":"docker.socket"},{"contents":"[Unit]\nDescription=Remove moby-engine\n# Run once for the machine\nAfter=systemd-machine-id-commit.service\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/rpm-ostree override remove moby-engine\nExecStart=/usr/bin/rpm-ostree ex apply-live --allow-replacement\nExecStartPost=/bin/touch /var/lib/%N.stamp\n\n[Install]\nWantedBy=default.target\n","enabled":true,"name":"remove-moby.service"},{"contents":"[Unit]\nDescription=Environment setter from QEMU FW_CFG\n[Service]\nType=oneshot\nRemainAfterExit=yes\nEnvironment=FWCFGRAW=/sys/firmware/qemu_fw_cfg/by_name/opt/com.coreos/environment/raw\nEnvironment=SYSTEMD_CONF=/etc/systemd/system.conf.d/default-env.conf\nEnvironment=ENVD_CONF=/etc/environment.d/default-env.conf\nEnvironment=PROFILE_CONF=/etc/profile.d/default-env.sh\nExecStart=/usr/bin/bash -c '/usr/bin/test -f ${FWCFGRAW} \u0026\u0026\\\n\techo \"[Manager]\\n#Got from QEMU FW_CFG\\nDefaultEnvironment=$(/usr/bin/base64 -d ${FWCFGRAW} | sed -e \"s+|+ +g\")\\n\" \u003e ${SYSTEMD_CONF} ||\\\n\techo \"[Manager]\\n#Got nothing from QEMU FW_CFG\\n#DefaultEnvironment=\\n\" \u003e ${SYSTEMD_CONF}'\nExecStart=/usr/bin/bash -c '/usr/bin/test -f ${FWCFGRAW} \u0026\u0026 (\\\n\techo \"#Got from QEMU FW_CFG\"\u003e ${ENVD_CONF};\\\n\tIFS=\"|\";\\\n\tfor iprxy in $(/usr/bin/base64 -d ${FWCFGRAW}); do\\\n\t\techo \"$iprxy\" \u003e\u003e ${ENVD_CONF}; done ) || \\\n\techo \"#Got nothing from QEMU FW_CFG\"\u003e ${ENVD_CONF}'\nExecStart=/usr/bin/bash -c '/usr/bin/test -f ${FWCFGRAW} \u0026\u0026 (\\\n\techo \"#Got from QEMU FW_CFG\"\u003e ${PROFILE_CONF};\\\n\tIFS=\"|\";\\\n\tfor iprxy in $(/usr/bin/base64 -d ${FWCFGRAW}); do\\\n\t\techo \"export $iprxy\" \u003e\u003e ${PROFILE_CONF}; done ) || \\\n\techo \"#Got nothing from QEMU FW_CFG\"\u003e ${PROFILE_CONF}'\nExecStartPost=/usr/bin/systemctl daemon-reload\n[Install]\nWantedBy=sysinit.target\n","enabled":true,"name":"envset-fwcfg.service"}]}} +``` + +Replace "YOURSSHKEYHERE" with the actual pub keys you generated. + +## Launching + +### gvproxy + +One needs to run gvproxy first to make it ready for the QEMU VM launched afterward. Run it with the command below: +``` +gvproxy.exe -listen-qemu unix://C:/qemu-remote/vlan_remote.sock -pid-file C:\qemu-remote\proxy.pid -ssh-port 57561 -forward-sock C:\qemu-remote\podman.sock -forward-dest /run/user/501/podman/podman.sock -forward-user core -forward-identity C:\qemu-remote\remote +``` + +### QEMU + +Launch QEMU with the following command (the following configures it to use 4 CPUs and 8 GB RAM, but it could be adjusted for less): + +``` +qemu-system-x86_64w.exe -m 8192 -smp 4 -fw_cfg name=opt/com.coreos/config,file=C:\qemu-remote\remote.ign -netdev stream,id=vlan,server=off,addr.type=unix,addr.path=C:\qemu-remote\vlan_remote.sock -device virtio-net-pci,netdev=vlan,mac=5a:94:ef:e4:0c:ee -device virtio-serial -chardev socket,path=C:\qemu-remote\ready.sock,server=on,wait=off,id=apodman-machine-default_ready -device virtserialport,chardev=apodman-machine-default_ready,name=org.fedoraproject.port.0 -pidfile C:\qemu-remote\vm.pid -machine q35,accel=whpx:tcg -cpu max,vmx=off,monitor=off -drive if=virtio,file=C:\qemu-remote\fedora-coreos-37.20221127.2.0-qemu.x86_64.qcow2 +``` + +### First time launch extras + +Observe QEMU loading and wait for the message of SSH keys being provisioned to the machine. Next, before making the first ssh connection, one would need to add it to known hosts. +We are using `127.0.0.1` instead of `localhost` to force IPv4. + +``` +ssh-keyscan -p 57561 127.0.0.1 >> %USERPROFILE%\.ssh\known_hosts +``` + +### Add new connection to Podman + +Create a connection named "qemuremote" + +``` +podman system connection add --identity C:\qemu-remote\remote -p 57561 qemuremote ssh://core@127.0.0.1 +``` + +#### Optional + +Make it default for simplicity of operation/testing + +``` +podman system connection default qemuremote +``` + +## Using Podman + +Choose the active connection to be "qemuremote" (not needed if one made it default). + +Run some basic network enabled workload: + +``` +podman run -d --rm -p 8080:80 nginx +``` + +Test it with + +``` +curl http -v http://localhost:8080 +``` + +## Shutting down the machine + +The built-in machinery of Podman machine will not work for a custom machine. One needs to gracefully shut it down by connecting via SSH: + +``` +ssh -i C:\qemu-remote\remote -p 57561 core@127.0.0.1 +``` + +And then executing + +``` +sudo poweroff +``` diff --git a/versioned_docs/version-5.5.1/tutorials/remote_client.md b/versioned_docs/version-5.5.1/tutorials/remote_client.md new file mode 100644 index 000000000..41683556d --- /dev/null +++ b/versioned_docs/version-5.5.1/tutorials/remote_client.md @@ -0,0 +1,124 @@ +--- +title: Podman remote-client tutorial +version: v5.5.1 +--- + +# Podman remote-client tutorial + +## Introduction +The purpose of the Podman remote-client is to allow users to interact with a Podman "backend" while on a separate client. The command line interface of the remote client is exactly the same as the regular Podman commands with the exception of some flags being removed as they do not apply to the remote-client. + +The remote client takes advantage of a client-server model. You need Podman installed on a Linux machine or VM that also has the SSH daemon running. On the local operating system, when you execute a Podman command, Podman connects to the server via SSH. It then connects to the Podman service by using systemd socket activation, and hitting our [Rest API](https://docs.podman.io/en/latest/_static/api.html). The Podman commands are executed on the server. From the client's point of view, it seems like Podman runs locally. + +This tutorial is for running Podman remotely on Linux. If you are using a Mac or a Windows PC, please follow the [Mac and Windows tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) + +## Obtaining and installing Podman + +### Client machine +You will need either Podman or the podman-remote client. The difference between the two is that the compiled podman-remote client can only act as a remote client connecting to a backend, while Podman can run local, standard Podman commands, as well as act as a remote client (using `podman --remote`) + +If you already have Podman installed, you do not need to install podman-remote. + +You can find out how to [install Podman here](https://podman.io/getting-started/installation) + +If you would like to install only the podman-remote client, it is downloadable from its [release description page](https://github.com/containers/podman/releases/latest). You can also build it from source using the `make podman-remote` + + +### Server Machine +You will need to [install Podman](https://podman.io/getting-started/installation) on your server machine. + + +## Creating the first connection + +### Enable the Podman service on the server machine. + +Before performing any Podman client commands, you must enable the podman.sock SystemD service on the Linux server. In these examples, we are running Podman as a normal, unprivileged user, also known as a rootless user. By default, the rootless socket listens at `/run/user/${UID}/podman/podman.sock`. You can enable this socket permanently using the following command: +``` +systemctl --user enable --now podman.socket +``` +You will need to enable linger for this user in order for the socket to work when the user is not logged in: + +``` +sudo loginctl enable-linger $USER +``` +This is only required if you are not running Podman as root. + +You can verify that the socket is listening with a simple Podman command. + +``` +podman --remote info +host: + arch: amd64 + buildahVersion: 1.16.0-dev + cgroupVersion: v2 + conmon: + package: conmon-2.0.19-1.fc32.x86_64 +``` + +#### Enable sshd + +In order for the Podman client to communicate with the server you need to enable and start the SSH daemon on your Linux machine, if it is not currently enabled. +``` +sudo systemctl enable --now sshd +``` + +#### Setting up SSH +Remote Podman uses SSH to communicate between the client and server. The remote client works considerably smoother using SSH keys. To set up your ssh connection, you need to generate an ssh key pair from your client machine. *NOTE:* in some instances, using a `rsa` key will cause connection issues, be sure to create an `ed25519` key. +``` +ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 +``` +Your public key by default should be in your home directory under `~/.ssh/id_ed25519.pub`. You then need to copy the contents of `id_ed25519.pub` and append it into `~/.ssh/authorized_keys` on the Linux server. You can automate this using `ssh-copy-id`: +``` +ssh-copy-id -i ~/.ssh/id_ed25519.pub 192.168.122.1 +``` + +If you do not wish to use SSH keys, you will be prompted with each Podman command for your login password. + +## Using the client + +Note: `podman-remote` is equivalent to `podman --remote` here, depending on what you have chosen to install. + +The first step in using the Podman remote client is to configure a connection. + +You can add a connection by using the `podman-remote system connection add` command. + +``` +podman-remote system connection add myuser --identity ~/.ssh/id_ed25519 ssh://myuser@192.168.122.1/run/user/1000/podman/podman.sock +``` + +This will add a remote connection to Podman and if it is the first connection added, it will mark the connection as the default. You can observe your connections with `podman-remote system connection list`: + +``` +podman-remote system connection list +Name Identity URI +myuser* id_ed25519 ssh://myuser@192.168.122.1/run/user/1000/podman/podman.sock +``` + +Now we can test the connection with `podman info`: + +``` +podman-remote info +host: + arch: amd64 + buildahVersion: 1.16.0-dev + cgroupVersion: v2 + conmon: + package: conmon-2.0.19-1.fc32.x86_64 +``` + +Podman-remote has also introduced a “--connection” flag where you can use other connections you have defined. If no connection is provided, the default connection will be used. + +``` +podman-remote system connection --help +``` + +## Wrap up + +You can use the Podman remote clients to manage your containers running on a Linux server. The communication between client and server relies heavily on SSH connections and the use of SSH keys are encouraged. Once you have Podman installed on your remote client, you should set up a connection using `podman-remote system connection add` which will then be used by subsequent Podman commands. + +# Troubleshooting + +See the [Troubleshooting](https://github.com/containers/podman/blob/main/troubleshooting.md) document if you run into issues. + +## History +Adapted from the [Mac and Windows tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) diff --git a/versioned_docs/version-5.5.1/tutorials/rootless_tutorial.md b/versioned_docs/version-5.5.1/tutorials/rootless_tutorial.md new file mode 100644 index 000000000..c95c05fb4 --- /dev/null +++ b/versioned_docs/version-5.5.1/tutorials/rootless_tutorial.md @@ -0,0 +1,221 @@ +--- +title: Basic Setup and Use of Podman in a Rootless environment. +version: v5.5.1 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +# Basic Setup and Use of Podman in a Rootless environment. + +Prior to allowing users without root privileges to run Podman, the administrator must install or build Podman and complete the following configurations. + +## Administrator Actions + +### Installing Podman + +For installing Podman, see the [installation instructions](https://podman.io/getting-started/installation). + +### Building Podman + +For building Podman, see the [build instructions](https://podman.io/getting-started/installation#building-from-scratch). + +### Networking configuration + +A user-mode networking tool for unprivileged network namespaces must be installed on the machine in order for Podman to run in a rootless environment. + +Podman supports two rootless networking tools: [pasta](https://passt.top/passt/about/#pasta) (provided by [passt](https://passt.top/passt/about/)) and [slirp4netns](https://github.com/rootless-containers/slirp4netns). + +pasta is the default since Podman 5.0, while slirp4netns was the default for previous versions. Passt is a more modern replacement for SLIRP that amongst other things fully supports IPv6 and is more secure architecturally (runs in a separate process, uses modern Linux mechanisms for isolation etc). + +Passt is [available on most Linux distributions](https://passt.top/passt/about/#availability) via their package distribution software such as `yum`, `dnf`, `apt`, `zypper`, etc. under the name `passt`. If the package is not available, you can build and install `passt` from [its upstream](https://passt.top/passt/about/#try-it). + +Alternatively, slirp4netns can be installed in the same fashion either from your distribution's repositories or by following [the instructions](https://github.com/rootless-containers/slirp4netns?tab=readme-ov-file#install) provided on its GitHub. + +The major user-facing difference between the two is outlined in [Shortcomings of Rootless Podman](https://github.com/containers/podman/blob/main/rootless.md?plain=1#L11) and expanded upon in **[podman-network(1)](https://github.com/containers/podman/blob/main/docs/source/markdown/podman-network.1.md#pasta)**. + +> [!note] +> pasta's default situation of not being being able to communicate between the container and the host has been fixed in Podman 5.3: see [Podman 5.3 changes for improved networking experience with pasta](https://blog.podman.io/2024/10/podman-5-3-changes-for-improved-networking-experience-with-pasta/). + +The default rootless networking tool can be selected in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** under the `[network]` section with `default_rootless_network_cmd`, which can be set to `pasta` (default) or `slirp4netns`. + +### `/etc/subuid` and `/etc/subgid` configuration + +Rootless Podman requires the user running it to have a range of UIDs listed in the files `/etc/subuid` and `/etc/subgid`. The `shadow-utils` or `newuid` package provides these files on different distributions and they must be installed on the system. Root privileges are required to add or update entries within these files. The following is a summary from the [How does rootless Podman work?](https://opensource.com/article/19/2/how-does-rootless-podman-work) article by Dan Walsh on [opensource.com](https://opensource.com) + +For each user that will be allowed to create containers, update `/etc/subuid` and `/etc/subgid` for the user with fields that look like the following. Note that the values for each user must be unique. If there is overlap, there is a potential for a user to use another user's namespace and they could corrupt it. + +``` +# cat /etc/subuid +johndoe:100000:65536 +test:165536:65536 +``` + +The format of this file is `USERNAME:UID:RANGE` + +* username as listed in `/etc/passwd` or in the output of [`getpwent`](https://man7.org/linux/man-pages/man3/getpwent.3.html). +* The initial UID allocated for the user. +* The size of the range of UIDs allocated for the user. + +This means the user `johndoe` is allocated UIDs 100000-165535 as well as their standard UID in the `/etc/passwd` file. NOTE: this is not currently supported with network installs; these files must be available locally to the host machine. It is not possible to configure this with LDAP or Active Directory. + +Rather than updating the files directly, the `usermod` program can be used to assign UIDs and GIDs to a user. + +``` +# usermod --add-subuids 100000-165535 --add-subgids 100000-165535 johndoe +grep johndoe /etc/subuid /etc/subgid +/etc/subuid:johndoe:100000:65536 +/etc/subgid:johndoe:100000:65536 +``` + +If you update either `/etc/subuid` or `/etc/subgid`, you need to stop all the running containers owned by the user and kill the pause process that is running on the system for that user. This can be done automatically by running [`podman system migrate`](https://github.com/containers/podman/blob/main/docs/source/markdown/podman-system-migrate.1.md) as that user. + +#### Giving access to additional groups + +Users can fully map additional groups to a container namespace if +those groups subordinated to the user: + +``` +# usermod --add-subgids 2000-2000 johndoe +grep johndoe /etc/subgid +``` + +This means the user `johndoe` can "impersonate" the group `2000` inside the +container. Note that it is usually not a good idea to subordinate active +user ids to other users, because it would allow user impersonation. + +`johndoe` can use `--group-add keep-groups` to preserve the additional +groups, and `--gidmap="+g102000:@2000"` to map the group `2000` in the host +to the group `102000` in the container: + +``` +$ podman run \ + --rm \ + --group-add keep-groups \ + --gidmap="+g102000:@2000" \ + --volume "$PWD:/data:ro" \ + --workdir /data \ + alpine ls -lisa +``` + +### Enable unprivileged `ping` + +(It is very unlikely that you will need to do this on a modern distro). + +Users running in a non-privileged container may not be able to use the `ping` utility from that container. + +If this is required, the administrator must verify that the UID of the user is part of the range in the `/proc/sys/net/ipv4/ping_group_range` file. + +To change its value the administrator can use a call similar to: `sysctl -w "net.ipv4.ping_group_range=0 2000000"`. + +To make the change persist, the administrator will need to add a file with the `.conf` file extension in `/etc/sysctl.d` that contains `net.ipv4.ping_group_range=0 $MAX_GID`, where `$MAX_GID` is the highest assignable GID of the user running the container. + + +## User Actions + +The majority of the work necessary to run Podman in a rootless environment is on the shoulders of the machine’s administrator. + +Once the Administrator has completed the setup on the machine and then the configurations for the user in `/etc/subuid` and `/etc/subgid`, the user can just start using any Podman command that they wish. + +### User Configuration Files + +The Podman configuration files for root reside in `/usr/share/containers` with overrides in `/etc/containers`. In the rootless environment they reside in `${XDG_CONFIG_HOME}/containers` and are owned by each individual user. + +Note: in environments without `XDG` environment variables, Podman internally sets the following defaults: + +- `$XDG_CONFIG_HOME` = `$HOME/.config` +- `$XDG_DATA_HOME` = `$HOME/.local/share` +- `$XDG_RUNTIME_DIR` = + - `/run/user/$UID` on `systemd` environments + - `$TMPDIR/podman-run-$UID` otherwise + +The three main configuration files are [containers.conf](https://github.com/containers/common/blob/main/docs/containers.conf.5.md), [storage.conf](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md) and [registries.conf](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md). The user can modify these files as they wish. + +#### containers.conf +Podman reads + +1. `/usr/share/containers/containers.conf` +2. `/etc/containers/containers.conf` +3. `${XDG_CONFIG_HOME}/containers/containers.conf` + +if they exist, in that order. Each file can override the previous for particular fields. + +#### storage.conf +For `storage.conf` the order is + +1. `/etc/containers/storage.conf` +2. `${XDG_CONFIG_HOME}/containers/storage.conf` + +In rootless Podman, certain fields in `/etc/containers/storage.conf` are ignored. These fields are: +``` +graphroot="" + container storage graph dir (default: "/var/lib/containers/storage") + Default directory to store all writable content created by container storage programs. + +runroot="" + container storage run dir (default: "/run/containers/storage") + Default directory to store all temporary writable content created by container storage programs. +``` +In rootless Podman these fields default to +``` +graphroot="${XDG_DATA_HOME}/containers/storage" +runroot="${XDG_RUNTIME_DIR}/containers" +``` +[\$XDG_RUNTIME_DIR](https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html#variables) defaults on most systems to `/run/user/$UID`. + +#### registries +Registry configuration is read in this order + +1. `/etc/containers/registries.conf` +2. `/etc/containers/registries.d/*` +3. `${XDG_CONFIG_HOME}/containers/registries.conf` + +The files in the home directory should be used to configure rootless Podman for personal needs. These files are not created by default. Users can copy the files from `/usr/share/containers` or `/etc/containers` and modify them. + +#### Authorization files +The default authorization file used by the `podman login` and `podman logout` commands is `${XDG_RUNTIME_DIR}/containers/auth.json`. + +### Using volumes + +Rootless Podman is not, and will never be, root; it's not a `setuid` binary, and gains no privileges when it runs. Instead, Podman makes use of a user namespace to shift the UIDs and GIDs of a block of users it is given access to on the host (via the `newuidmap` and `newgidmap` executables) and your own user within the containers that Podman creates. + +If your container runs with the root user, then `root` in the container is actually your user on the host. UID/GID 1 is the first UID/GID specified in your user's mapping in `/etc/subuid` and `/etc/subgid`, etc. If you mount a directory from the host into a container as a rootless user, and create a file in that directory as root in the container, you'll see it's actually owned by your user on the host. + +So, for example, + +``` +host$ whoami +john + +# a folder which is empty +host$ ls /home/john/folder +host$ podman run -it -v /home/john/folder:/container/volume mycontainer /bin/bash + +# Now I'm in the container +root@container# whoami +root +root@container# touch /container/volume/test +root@container# ls -l /container/volume +total 0 +-rw-r--r-- 1 root root 0 May 20 21:47 test +root@container# exit + +# I check again +host$ ls -l /home/john/folder +total 0 +-rw-r--r-- 1 john john 0 May 20 21:47 test +``` + +We do recognize that this doesn't really match how many people intend to use rootless Podman - they want their UID inside and outside the container to match. Thus, we provide the `--userns=keep-id` flag, which ensures that your user is mapped to its own UID and GID inside the container. + +It is also helpful to distinguish between running Podman as a rootless user, and a container which is built to run rootless. If the container you're trying to run has a `USER` which is not root, then when mounting volumes you **must** use `--userns=keep-id`. This is because the container user would not be able to become `root` and access the mounted volumes. + +Another consideration in regards to volumes: + +- When providing the path of a directory you'd like to bind-mount, the path needs to be provided as an absolute path + or a relative path that starts with `.` (a dot), otherwise the string will be interpreted as the name of a named volume. + +## More information + +If you are still experiencing problems running Podman in a rootless environment, please refer to the [Shortcomings of Rootless Podman](https://github.com/containers/podman/blob/main/rootless.md) page which lists known issues and solutions to known issues in this environment. + +For more information on Podman and its subcommands, follow the links on the main [README.md](https://github.com/containers/podman/blob/main/README.md#podman-information-for-developers) page or the [podman.io](https://podman.io) web site. diff --git a/versioned_docs/version-5.5.1/tutorials/socket_activation.md b/versioned_docs/version-5.5.1/tutorials/socket_activation.md new file mode 100644 index 000000000..a879ae65b --- /dev/null +++ b/versioned_docs/version-5.5.1/tutorials/socket_activation.md @@ -0,0 +1,289 @@ +--- +title: Podman socket activation +version: v5.5.1 +--- + +# Podman socket activation + +Socket activation conceptually works by having systemd create a socket (e.g. TCP, UDP or Unix +socket). As soon as a client connects to the socket, systemd will start the systemd service that is +configured for the socket. The newly started program inherits the file descriptor of the socket +and can then accept the incoming connection (in other words run the system call `accept()`). +This description corresponds to the default systemd socket configuration +[`Accept=no`](https://www.freedesktop.org/software/systemd/man/systemd.socket.html#Accept=) +that lets the service accept the socket. + +Podman supports two forms of socket activation: + +* Socket activation of the API service +* Socket activation of containers + +## Socket activation of the API service + +The architecture looks like this + +``` mermaid +stateDiagram-v2 + [*] --> systemd: first client connects + systemd --> podman: socket inherited via fork/exec +``` + +The file _/usr/lib/systemd/user/podman.socket_ on a Fedora system defines the Podman API socket for +rootless users: + +``` +$ cat /usr/lib/systemd/user/podman.socket +[Unit] +Description=Podman API Socket +Documentation=man:podman-system-service(1) + +[Socket] +ListenStream=%t/podman/podman.sock +SocketMode=0660 + +[Install] +WantedBy=sockets.target +``` + +The socket is configured to be a Unix socket and can be started like this + +``` +$ systemctl --user start podman.socket +$ ls $XDG_RUNTIME_DIR/podman/podman.sock +/run/user/1000/podman/podman.sock +$ +``` +The socket can later be used by for instance __docker-compose__ that needs a Docker-compatible API + +``` +$ export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock +$ docker-compose up +``` + +When __docker-compose__ or any other client connects to the UNIX socket `$XDG_RUNTIME_DIR/podman/podman.sock`, +the service _podman.service_ is started. See its definition in the file _/usr/lib/systemd/user/podman.service_. + +## Socket activation of containers + +Since version 3.4.0 Podman supports socket activation of containers, i.e., passing +a socket-activated socket to the container. Thanks to the fork/exec model of Podman, the socket will be first +inherited by conmon and then by the OCI runtime and finally by the container +as can be seen in the following diagram: + + +``` mermaid +stateDiagram-v2 + [*] --> systemd: first client connects + systemd --> podman: socket inherited via fork/exec + state "OCI runtime" as s2 + podman --> conmon: socket inherited via double fork/exec + conmon --> s2: socket inherited via fork/exec + s2 --> container: socket inherited via exec +``` + +This type of socket activation can be used in systemd services that are generated from container unit files (see [podman-systemd.unit(5)](https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html)) (Note, quadlet requires the use of cgroup v2) or from the command [`podman generate systemd`](https://docs.podman.io/en/latest/markdown/podman-generate-systemd.1.html). +The container must also support socket activation. Not all software daemons support socket activation +but it's getting more popular. For instance Apache HTTP server, MariaDB, DBUS, PipeWire, Gunicorn, CUPS +all have socket activation support. + +### Example: socket-activated echo server container in a systemd service + +This example shows how to run the socket-activated echo server +[socket-activate-echo](https://github.com/eriksjolund/socket-activate-echo/pkgs/container/socket-activate-echo) +in a systemd user service. Podman version 4.4.0 or higher is required. + +Enable lingering for your regular user + +``` +$ loginctl enable-linger $USER +``` + +The command has these effects on your enabled systemd user units: + +* the units are automatically started after a reboot +* the units are not automatically stopped after you log out + +Create directories + +``` +$ mkdir -p ~/.config/systemd/user +$ mkdir -p ~/.config/containers/systemd +``` + +Create the file _~/.config/containers/systemd/echo.container_ with the file contents: + +``` +[Unit] +Description=Example echo service +Requires=echo.socket +After=echo.socket + +[Container] +Image=ghcr.io/eriksjolund/socket-activate-echo +Network=none + +[Install] +WantedBy=default.target +``` + +The file follows the syntax described in [__podman-systemd.unit__(5)](https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html). + +The `[Install]` section is optional. If you remove the two last lines, the _echo.service_ will not +be automatically started after a reboot. Instead, the _echo.service_ is started when the first +client connects to the socket. + +The line `Network=none` is optional. It improves security by removing network connectivity for the container. +The container can still be serving the internet because `Network=none` has no effect on activated sockets. + +A socket-activated service also requires a systemd socket unit. +Create the file _~/.config/systemd/user/echo.socket_ that defines the +sockets that the container should use + +``` +[Unit] +Description=Example echo socket + +[Socket] +ListenStream=127.0.0.1:3000 +ListenDatagram=127.0.0.1:3000 +ListenStream=[::1]:3000 +ListenDatagram=[::1]:3000 +ListenStream=%h/echo_stream_sock + +# VMADDR_CID_ANY (-1U) = 2^32 -1 = 4294967295 +# See "man vsock" +ListenStream=vsock:4294967295:3000 + +[Install] +WantedBy=sockets.target +``` + +`%h` is a systemd specifier that expands to the user's home directory. + +After editing the unit files, systemd needs to reload its configuration. + +``` +$ systemctl --user daemon-reload +``` + +While reloading its configuration systemd generates the unit _echo.service_ +from the file _~/.config/containers/systemd/echo.container_ +by executing the unit generator `/usr/lib/systemd/system-generators/podman-system-generator`. + +Optional: View the generated _echo.service_ to see the `podman run` command that +will be run. + +``` +$ systemctl --user cat echo.service +``` + +Configure systemd to automatically start _echo.socket_ after reboots. + +``` +$ systemctl --user enable echo.socket +``` + +Pull the container image beforehand + +``` +$ podman pull ghcr.io/eriksjolund/socket-activate-echo +``` + +Start the socket unit + +``` +$ systemctl --user start echo.socket +``` + +Test the echo server with the program __socat__ + +``` +$ echo hello | socat -t 30 - tcp4:127.0.0.1:3000 +hello +$ echo hello | socat -t 30 - tcp6:[::1]:3000 +hello +$ echo hello | socat -t 30 - udp4:127.0.0.1:3000 +hello +$ echo hello | socat -t 30 - udp6:[::1]:3000 +hello +$ echo hello | socat -t 30 - unix:$HOME/echo_stream_sock +hello +$ echo hello | socat -t 30 - VSOCK-CONNECT:1:3000 +hello +``` + +The option `-t 30` configures socat to use a timeout of 30 seconds when socat reads from the socket awaiting to get an EOF (End-Of-File). +As the container image has already been pulled, such a long timeout is not really needed. + +The echo server works as expected. It replies _"hello"_ after receiving the text _"hello"_. + +### Example: socket activate an Apache HTTP server with systemd-socket-activate + +Instead of setting up a systemd service to test out socket activation, an alternative is to use the command-line +tool [__systemd-socket-activate__](https://www.freedesktop.org/software/systemd/man/systemd-socket-activate.html#). + +Let's build a container image for the Apache HTTP server that is configured to support socket activation on port 8080. + +Create a new directory _ctr_ and a file _ctr/Containerfile_ with this contents + +``` +FROM docker.io/library/fedora +RUN dnf -y update && dnf install -y httpd && dnf clean all +RUN sed -i "s/Listen 80/Listen 127.0.0.1:8080/g" /etc/httpd/conf/httpd.conf +CMD ["/usr/sbin/httpd", "-DFOREGROUND"] +``` + +Build the container image + +``` +$ podman build -t socket-activate-httpd ctr +``` + +In one shell, start __systemd-socket-activate__. + +``` +$ systemd-socket-activate -l 8080 podman run --rm --network=none localhost/socket-activate-httpd +``` + +The TCP port number 8080 is given as an option to __systemd-socket-activate__. The __--publish__ (__-p__) +option for `podman run` is not used. + +In another shell, fetch a web page from _localhost:8080_ + +``` +$ curl -s localhost:8080 | head -6 + + + + + +Test Page for the HTTP Server on Fedora +$ +``` + +### Disabling the network with _--network=none_ + +If the container only needs to communicate over the socket-activated socket, it's possible to disable +the network by passing __--network=none__ to `podman run`. This improves security because the +container then runs with less privileges. + +### Native network performance over the socket-activated socket + +When using rootless Podman, network traffic is normally passed through slirp4netns. This comes with +a performance penalty. Fortunately, communication over the socket-activated socket does not pass through +slirp4netns so it has the same performance characteristics as the normal network on the host. + +### Starting a socket-activated service + +There is a delay when the first connection is made because the container needs to +start up. To minimize this delay, consider passing __--pull=never__ to `podman run` and instead +pull the container image beforehand. Instead of waiting for the start of the service to be triggered by the +first client connecting to it, the service can also be explicitly started (`systemctl --user start echo.service`). + +### Stopping a socket-activated service + +Some services run a command (configured by the systemd directive __ExecStart__) that exits after some time of inactivity. +Depending on the restart configuration for the service +(systemd directive [__Restart__](https://www.freedesktop.org/software/systemd/man/systemd.service.html#Restart=)), +it may then be stopped. An example of this is _podman.service_ that stops after some time of inactivity. +The service will be started again when the next client connects to the socket. diff --git a/versioned_docs/version-5.5.2/MANPAGE_SYNTAX.md b/versioned_docs/version-5.5.2/MANPAGE_SYNTAX.md new file mode 100644 index 000000000..e8dd56af6 --- /dev/null +++ b/versioned_docs/version-5.5.2/MANPAGE_SYNTAX.md @@ -0,0 +1,147 @@ +--- +title: podman-command +version: v5.5.2 +--- + +% podman-command(1) + +## NAME +podman\-command - short description + +## SYNOPSIS +(Shows the command structure. If the command can be written in two different ways, both of them have to be shown.\ +Many manpages include the OPTIONS **--all**, **-a** and/or **--latest**, **-l**. In this case, there is no `container name` or `ID` needed after the initial command. Because most of the other OPTIONS still need the `container name` or ` ID`, it is defined that the *container* argument in the command should **not** be put in brackets. It should also be noted in the *IMPORTANT* section in the description of the OPTION with the following sentence: *IMPORTANT: This OPTION does not need a container name or ID as input argument.*.) + +**podman command** [*optional*] *mandatory value* + +**podman subcommand command** [*optional*] *mandatory value* + +(If there is the possibility to chose between two or more mandatory command values. There should also always be a space before and after a vertical bar to ensure better readability.) + +**podman command** [*optional*] *value1* | *value2* + +**podman subcommand command** [*optional*] *value1* | *value2* + +(If an optional value follows a mandatory one.) + +**podman command** [*optional*] *value1* | *value2* [*optional*] + +**podman subcommand command** [*optional*] *value1* | *value2* [*optional*] + +(If the command accepts an infinite number of values.) + +**podman command** [*optional*] *value* [*value* ...] + +**podman subcommand command** [*optional*] *value* [*value* ...] + +## DESCRIPTION +**podman command** is always the beginning of the DESCRIPTION section. Putting the command as the first part of the DESCRIPTION ensures uniformity. All commands mentioned in the text retain their appearance and form.\ +Example for the first sentence: **podman command** is an example command. + +Commands or files that are quoted from other podman manpages or podman repositories have to be linked to those. Non-podman commands are not to be linked.\ +Example sentence: Use **[podman-run](podman-run.1.md)** or **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** for the problem. + +It should also be specified if the command can only be run as root. In addition, it should be described when a command, OPTION, or other content cannot be executed with the remote client or in combination with other commands, OPTIONS, or content. In this case, the following sentence is put at the end of a command, OPTION, or content:\ +*IMPORTANT: This command/OPTION/content is not available with the command/OPTION/content/on the remote Podman client.*\ +For a command, this should be done in the DESCRIPTION section. For the OPTIONS, it should be done in the DESCRIPTION of the specified OPTION. + +Do not use pronouns in the man pages, especially the word `you`. + +There should be **no** new line after H2-headers (`##`). + +## OPTIONS +All flags are referred to as OPTIONS. The term flags should not be used. All OPTIONS are listed in this section. OPTIONS that appear in descriptions of other OPTIONS and sections retain their appearance, for example: **--exit**. + +OPTIONS that are quoted from other podman manpages or podman repositories have to be linked to those.\ +Example sentence: Use **[podman-generate-systemd --new](./source/markdown/podman-generate-systemd.1.md#--new)** for the problem. + + Each OPTION should be explained to the fullest extent below the OPTION itself. Each OPTION is behind an H4-header (`####`). If the OPTION has a default argument, it has to be explained in the description of the OPTION. If the OPTION is also not available with a command/OPTION/content/ on the remote Podman client, the sentence about the default argument should the second to last sentence. The sentence about the default argument should be in a new line as well as the *IMPORTANT* sentence. + + All OPTIONS are to be sorted in alphabetical order. + + Tables should be used when there is a different definition for multiple arguments, and these have to be explained. This is shown with the OPTION **--test**.\ + Lists should be used when arguments are used that do not need a definition for each argument and a single description explains them. An example is shown with **[podman-commit --change](./source/markdown/podman-commit.1.md#--change--cinstruction)** + + +#### **--version**, **-v** + +OPTIONS can be put after the command in two different ways. Either the long version with **--option** or as the short version **-o**. If there are two ways to write an OPTION they are separated by a comma. If there are two versions of one command the long version is always shown in front. If OPTION is boolean, *true/false* are not enumerated. The default boolean argument is shown in the same way normal default arguments are displayed.\ +Example: The default is **false**.\ +*IMPORTANT: This OPTION is not available with the remote Podman client.* + +#### **--exit** + +An example of a boolean OPTION that is only available in long form. + +#### **--answer**, **-a**=**active** | *disable* + +The **--answer** OPTION above is an example of an OPTION that accepts two possible arguments as inputs. If a default argument is selected when the OPTION is not used in the command, it is shown in **bold**. If the OPTION is used, it must include an argument afterward. It must always be ensured that the standard argument is in the first position after the OPTION. In this example, there are two different ways to execute the command. Both possible OPTIONS have to be shown with the arguments following them.\ +The default value is shown as **active**. + +#### **--status**=**good** | *better* | *best* + +This is an example of three arguments following an OPTION. If the number of arguments is greater than three, the arguments are **not** listed after the equal sign. The arguments must be shown in a table like in **--test**=**_test_**. This form should also be used if the understanding of the content is in danger of becoming incomprehensible. An example for this is **[podman-container-prune --filters](./source/markdown/podman-container-prune.1.md#--filterfilters)**.\ +The default value is shown as **good**. + +#### **--test**=**test** + +OPTIONS that are followed by an equal sign include an argument after the equal sign in **bold** or *italic*. If there is a default argument that is used if the OPTION is not specified in the command, the argument after the equal sign is displayed in **bold**. All arguments must be listed and explained in the text below the OPTION. + +| Argument | Description | +| ------------------ | --------------------------------------------------------------------------- | +| **example one** | This argument is the default argument if the OPTION is not specified. | +| *example two* | If one refers to a command, one should use **bold** marks. | +| *example three* | Example: In combination with **podman command** highly effective. | +| *example four* | Example: Can be combined with **--exit**. | +| *example five* | The fifth description | + +The table shows an example for a listing of arguments. The contents in the table should be aligned left. If the content in the table conflicts with this, it can be aligned to support the understanding of the content. If there is a default argument, it **must** be listed as the first entry in the table.\ +The default value is shown as **example one**. + +If the number of arguments is smaller than four they have to be listed behind the OPTION as seen in the OPTION **--status**. + +#### **--problem**=*problem* + +OPTIONS that are followed by an equal sign that is then followed by an unspecified argument, have no default argument. If this OPTION is written with an equal sign and the argument is left empty, there will be no error, but the OPTION will be ignored. The meaning of the argument is described preferably in `one` word after the equal sign in *italic* format. + +## SUBCHAPTER +For chapters that are made specifically as an individual SUBCHAPTER in a man page, the previous conditions regarding formatting apply. + +There are no restrictions for the use of paragraphs and tables. Within these paragraphs and tables the previous conditions regarding formatting apply. + +Strings of characters or numbers can be highlighted with `backticks`. Paths of any kind **must** be highlighted. + +IMPORTANT: Only characters that are **not** part of categories mentioned before can be highlighted. This includes headers. For example it is not advised to highlight an OPTION or a **command**. + +SUBHEADINGS are displayed as follows: +### SUBHEADING +Text for SUBHEADINGS. + +## EXAMPLES +All EXAMPLES are listed in this section. This section should be at the end of each man page. Each EXAMPLE is always in one box. The box starts and ends with the last written line, **not** with a blank line. The `$` in front of the commands indicates that it can be run as a normal user, while the commands starting with `#` can only be run as root. If there is the need for a comment in a box the comment should have `###` in front of it. + +Description of the EXAMPLE +``` +### Example comment +$ podman command +$ podman command -o +$ cat $HOME/Dockerfile | podman command --option +``` + +Description of the EXAMPLE two +``` +# podman command --status=better +``` +## SEE ALSO +All commands, including commands with OPTIONS, and config-files mentioned in the manpage have to be listed here. Podman commands, including commands with OPTIONS, and config-files have to be linked. If a command is mentioned several times with different OPTIONS it just have to be linked once. All other commands, including commands with OPTIONS, and config-files just have to be mentioned. If a command is mentioned several times with different OPTIONS it just has to be linked once. + +Example: +**[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-create(1)](podman-create.1.md)** + +## HISTORY +Normally, the dates of changes, the content of the changes and the person who provided them is listed here. Most manpages don't keep this record. + +Example:\ +December 2021, Originally compiled by Alexander Richter + +`Every manpage should end with an empty line.` diff --git a/versioned_docs/version-5.5.2/index.md b/versioned_docs/version-5.5.2/index.md new file mode 100644 index 000000000..718f8a53b --- /dev/null +++ b/versioned_docs/version-5.5.2/index.md @@ -0,0 +1,42 @@ +--- +title: Podman Documentation +version: v5.5.2 +--- + +# Podman Documentation (v5.5.2) + +Welcome to the Podman documentation for version v5.5.2. + +## Getting Started + +- [Installation Instructions](https://podman.io/get-started) +- [Basic Tutorial](tutorials/podman_tutorial.md) +- [Rootless Containers](tutorials/rootless_tutorial.md) + +## Commands + +- [podman](source/markdown/podman.1.md) +- [podman-build](source/markdown/podman-build.1.md) +- [podman-run](source/markdown/podman-run.1.md) +- [podman-ps](source/markdown/podman-ps.1.md) + +## Tutorials + +- [Basic Networking](tutorials/basic_networking.md) +- [Rootless Tutorial](tutorials/rootless_tutorial.md) +- [Podman Tutorial](tutorials/podman_tutorial.md) +- [Performance](tutorials/performance.md) + +## System & Management + +- [System Commands](source/markdown/podman-system.1.md) +- [Machine Commands](source/markdown/podman-machine.1.md) +- [Pod Management](source/markdown/podman-pod.1.md) +- [Volume Management](source/markdown/podman-volume.1.md) + +## Advanced Features + +- [Systemd Integration](source/markdown/podman-systemd.unit.5.md) +- [Kubernetes Support](source/markdown/podman-kube.1.md) +- [Secret Management](source/markdown/podman-secret.1.md) +- [Code Generation](source/markdown/podman-generate.1.md) diff --git a/versioned_docs/version-5.5.2/kubernetes_support.md b/versioned_docs/version-5.5.2/kubernetes_support.md new file mode 100644 index 000000000..5ea8e221f --- /dev/null +++ b/versioned_docs/version-5.5.2/kubernetes_support.md @@ -0,0 +1,208 @@ +--- +title: Podman Kube Play Support +version: v5.5.2 +--- + +# Podman Kube Play Support + +This document outlines the kube yaml fields that are currently supported by the **podman kube play** command. + +Note: **N/A** means that the option cannot be supported in a single-node Podman environment. + +## Pod Fields + +| Field | Support | +|-----------------------------------------------------|---------| +| containers | ✅ | +| initContainers | ✅ | +| imagePullSecrets | no | +| enableServiceLinks | no | +| os\.name | no | +| volumes | ✅ | +| nodeSelector | N/A | +| nodeName | N/A | +| affinity\.nodeAffinity | N/A | +| affinity\.podAffinity | N/A | +| affinity\.podAntiAffinity | N/A | +| tolerations\.key | N/A | +| tolerations\.operator | N/A | +| tolerations\.effect | N/A | +| tolerations\.tolerationSeconds | N/A | +| schedulerName | N/A | +| runtimeClassName | no | +| priorityClassName | no | +| priority | no | +| topologySpreadConstraints\.maxSkew | N/A | +| topologySpreadConstraints\.topologyKey | N/A | +| topologySpreadConstraints\.whenUnsatisfiable | N/A | +| topologySpreadConstraints\.labelSelector | N/A | +| topologySpreadConstraints\.minDomains | N/A | +| restartPolicy | ✅ | +| terminationGracePeriodSeconds | ✅ | +| activeDeadlineSeconds | no | +| readinessGates\.conditionType | no | +| hostname | ✅ | +| setHostnameAsFQDN | no | +| subdomain | no | +| hostAliases\.hostnames | ✅ | +| hostAliases\.ip | ✅ | +| dnsConfig\.nameservers | ✅ | +| dnsConfig\.options\.name | ✅ | +| dnsConfig\.options\.value | ✅ | +| dnsConfig\.searches | ✅ | +| dnsPolicy | no | +| hostNetwork | ✅ | +| hostPID | ✅ | +| hostIPC | ✅ | +| shareProcessNamespace | ✅ | +| serviceAccountName | no | +| automountServiceAccountToken | no | +| securityContext\.runAsUser | ✅ | +| securityContext\.runAsNonRoot | no | +| securityContext\.runAsGroup | ✅ | +| securityContext\.supplementalGroups | ✅ | +| securityContext\.fsGroup | no | +| securityContext\.fsGroupChangePolicy | no | +| securityContext\.seccompProfile\.type | no | +| securityContext\.seccompProfile\.localhostProfile | no | +| securityContext\.seLinuxOptions\.level | ✅ | +| securityContext\.seLinuxOptions\.role | ✅ | +| securityContext\.seLinuxOptions\.type | ✅ | +| securityContext\.seLinuxOptions\.user | ✅ | +| securityContext\.sysctls\.name | ✅ | +| securityContext\.sysctls\.value | ✅ | +| securityContext\.windowsOptions\.gmsaCredentialSpec | no | +| securityContext\.windowsOptions\.hostProcess | no | +| securityContext\.windowsOptions\.runAsUserName | no | + +## Container Fields + +| Field | Support | +|-----------------------------------------------------|---------| +| name | ✅ | +| image | ✅ | +| imagePullPolicy | ✅ | +| command | ✅ | +| args | ✅ | +| workingDir | ✅ | +| ports\.containerPort | ✅ | +| ports\.hostIP | ✅ | +| ports\.hostPort | ✅ | +| ports\.name | ✅ | +| ports\.protocol | ✅ | +| env\.name | ✅ | +| env\.value | ✅ | +| env\.valueFrom\.configMapKeyRef\.key | ✅ | +| env\.valueFrom\.configMapKeyRef\.name | ✅ | +| env\.valueFrom\.configMapKeyRef\.optional | ✅ | +| env\.valueFrom\.fieldRef | ✅ | +| env\.valueFrom\.resourceFieldRef | ✅ | +| env\.valueFrom\.secretKeyRef\.key | ✅ | +| env\.valueFrom\.secretKeyRef\.name | ✅ | +| env\.valueFrom\.secretKeyRef\.optional | ✅ | +| envFrom\.configMapRef\.name | ✅ | +| envFrom\.configMapRef\.optional | ✅ | +| envFrom\.prefix | no | +| envFrom\.secretRef\.name | ✅ | +| envFrom\.secretRef\.optional | ✅ | +| volumeMounts\.mountPath | ✅ | +| volumeMounts\.name | ✅ | +| volumeMounts\.mountPropagation | no | +| volumeMounts\.readOnly | ✅ | +| volumeMounts\.subPath | ✅ | +| volumeMounts\.subPathExpr | no | +| volumeDevices\.devicePath | no | +| volumeDevices\.name | no | +| resources\.limits | ✅ | +| resources\.requests | ✅ | +| lifecycle\.postStart | no | +| lifecycle\.preStop | no | +| terminationMessagePath | no | +| terminationMessagePolicy | no | +| livenessProbe | ✅ | +| readinessProbe | no | +| startupProbe | no | +| securityContext\.runAsUser | ✅ | +| securityContext\.runAsNonRoot | no | +| securityContext\.runAsGroup | ✅ | +| securityContext\.readOnlyRootFilesystem | ✅ | +| securityContext\.procMount | ✅ | +| securityContext\.privileged | ✅ | +| securityContext\.allowPrivilegeEscalation | ✅ | +| securityContext\.capabilities\.add | ✅ | +| securityContext\.capabilities\.drop | ✅ | +| securityContext\.seccompProfile\.type | no | +| securityContext\.seccompProfile\.localhostProfile | no | +| securityContext\.seLinuxOptions\.level | ✅ | +| securityContext\.seLinuxOptions\.role | ✅ | +| securityContext\.seLinuxOptions\.type | ✅ | +| securityContext\.seLinuxOptions\.user | ✅ | +| securityContext\.windowsOptions\.gmsaCredentialSpec | no | +| securityContext\.windowsOptions\.hostProcess | no | +| securityContext\.windowsOptions\.runAsUserName | no | +| stdin | no | +| stdinOnce | no | +| tty | no | + +## PersistentVolumeClaim Fields + +| Field | Support | +|---------------------|---------| +| volumeName | no | +| storageClassName | ✅ | +| volumeMode | no | +| accessModes | ✅ | +| selector | no | +| resources\.limits | no | +| resources\.requests | ✅ | + +## ConfigMap Fields + +| Field | Support | +|------------|---------| +| binaryData | ✅ | +| data | ✅ | +| immutable | no | + +## Deployment Fields + +| Field | Support | +|-----------------------------------------|-------------------------------------------------------| +| replicas | ✅ (the actual replica count is ignored and set to 1) | +| selector | ✅ | +| template | ✅ | +| minReadySeconds | no | +| strategy\.type | no | +| strategy\.rollingUpdate\.maxSurge | no | +| strategy\.rollingUpdate\.maxUnavailable | no | +| revisionHistoryLimit | no | +| progressDeadlineSeconds | no | +| paused | no | + +## DaemonSet Fields + +| Field | Support | +|-----------------------------------------|---------| +| selector | ✅ | +| template | ✅ | +| minReadySeconds | no | +| strategy\.type | no | +| strategy\.rollingUpdate\.maxSurge | no | +| strategy\.rollingUpdate\.maxUnavailable | no | +| revisionHistoryLimit | no | + +## Job Fields + +| Field | Support | +|-------------------------|----------------------------------| +| activeDeadlineSeconds | no | +| selector | no (automatically set by k8s) | +| template | ✅ | +| backoffLimit | no | +| completionMode | no | +| completions | no (set to 1 with kube generate) | +| manualSelector | no | +| parallelism | no (set to 1 with kube generate) | +| podFailurePolicy | no | +| suspend | no | +| ttlSecondsAfterFinished | no | diff --git a/versioned_docs/version-5.5.2/source/markdown/options/README.md b/versioned_docs/version-5.5.2/source/markdown/options/README.md new file mode 100644 index 000000000..b5a3ae30a --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/README.md @@ -0,0 +1,68 @@ +--- +title: Documentation +version: v5.5.2 +--- + +Common Man Page Options +======================= + +This subdirectory contains option (flag) names and descriptions +common to multiple podman man pages. Each file is one option. The +filename does not necessarily need to be identical to the option +name: for instance, `hostname.container.md` and `hostname.pod.md` +exist because the **--hostname** option is sufficiently different +between `podman-{create,run}` and `podman-pod-{create,run}` to +warrant living separately. + +How +=== + +The files here are included in `podman-*.md.in` files using the `@@option` +mechanism: + +``` +@@option foo ! includes options/foo.md +``` + +The tool that does this is `hack/markdown-preprocess`. It is a python +script because it needs to run on `readthedocs.io`. From a given `.md.in` +file, this script creates a `.md` file that can then be read by +`go-md2man`, `sphinx`, anything that groks markdown. This runs as +part of `make docs`. + +Special Substitutions +===================== + +Some options are almost identical except for 'pod' vs 'container' +differences. For those, use `<>`. +Order is immaterial: the important thing is the presence of the +string "`pod`" in one half but not the other. The correct string +is chosen based on the filename: if the file contains `-pod`, +such as `podman-pod-create`, the string with `pod` (case-insensitive) +in it is chosen. + +The string `<>` is replaced with the podman subcommand +as determined from the filename, e.g., `create` for `podman-create.1.md.in`. +This allows the shared use of examples in the option file: +``` + Example: podman <> --foo --bar +``` +As a special case, `podman-pod-X` becomes just `X` (the "pod" is removed). +This makes the `pod-id-file` man page more useful. To get the full +subcommand including 'pod', use `<>`. + +Restrictions +============ + +There is a restriction for having a single text line with three +back-ticks in the front and the end of the line. For instance: + +\`\`\`Some man page text\`\`\` + +This is currently not allowed and causes a corruption of the +compiled man page. Instead, put the three back-ticks on separate +lines like: + +\`\`\` +Some man page text +\`\`\` diff --git a/versioned_docs/version-5.5.2/source/markdown/options/add-host.md b/versioned_docs/version-5.5.2/source/markdown/options/add-host.md new file mode 100644 index 000000000..6501ed478 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/add-host.md @@ -0,0 +1,44 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, create, farm build, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the <>'s `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/annotation.container.md b/versioned_docs/version-5.5.2/source/markdown/options/annotation.container.md new file mode 100644 index 000000000..785a24f93 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/annotation.container.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, kube play, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--annotation**=*key=value* + +Add an annotation to the container<<| or pod>>. This option can be set multiple times. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/annotation.image.md b/versioned_docs/version-5.5.2/source/markdown/options/annotation.image.md new file mode 100644 index 000000000..77433c18b --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/annotation.image.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--annotation**=*annotation=value* + +Add an image *annotation* (e.g. annotation=*value*) to the image metadata. Can +be used multiple times. + +Note: this information is not present in Docker image formats, so it is +discarded when writing images in Docker formats. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/annotation.manifest.md b/versioned_docs/version-5.5.2/source/markdown/options/annotation.manifest.md new file mode 100644 index 000000000..987b99e4a --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/annotation.manifest.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman artifact add, manifest add, manifest annotate +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--annotation**=*annotation=value* + +Set an annotation on the entry for the specified image or artifact. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/arch.md b/versioned_docs/version-5.5.2/source/markdown/options/arch.md new file mode 100644 index 000000000..39b938659 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/arch.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--arch**=*ARCH* +Override the architecture, defaults to hosts, of the image to be pulled. For example, `arm`. +Unless overridden, subsequent lookups of the same image in the local storage matches this architecture, regardless of the host. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/attach.md b/versioned_docs/version-5.5.2/source/markdown/options/attach.md new file mode 100644 index 000000000..09c1aef35 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/attach.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--attach**, **-a**=*stdin* | *stdout* | *stderr* + +Attach to STDIN, STDOUT or STDERR. + +In foreground mode (the default when **-d** +is not specified), **podman run** can start the process in the container +and attach the console to the process's standard input, output, and +error. It can even pretend to be a TTY (this is what most command-line +executables expect) and pass along signals. The **-a** option can be set for +each of **stdin**, **stdout**, and **stderr**. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/authfile.md b/versioned_docs/version-5.5.2/source/markdown/options/authfile.md new file mode 100644 index 000000000..53795a99c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/authfile.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, auto update, build, container runlabel, create, farm build, image sign, kube play, login, logout, manifest add, manifest inspect, manifest push, pull, push, run, search +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/blkio-weight-device.md b/versioned_docs/version-5.5.2/source/markdown/options/blkio-weight-device.md new file mode 100644 index 000000000..ea7d46fb3 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/blkio-weight-device.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman container clone, create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/blkio-weight.md b/versioned_docs/version-5.5.2/source/markdown/options/blkio-weight.md new file mode 100644 index 000000000..57d7ec2ca --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/blkio-weight.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman container clone, create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/build-arg-file.md b/versioned_docs/version-5.5.2/source/markdown/options/build-arg-file.md new file mode 100644 index 000000000..d75a5f157 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/build-arg-file.md @@ -0,0 +1,27 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--build-arg-file**=*path* + +Specifies a file containing lines of build arguments of the form `arg=value`. +The suggested file name is `argfile.conf`. + +Comment lines beginning with `#` are ignored, along with blank lines. +All others must be of the `arg=value` format passed to `--build-arg`. + +If several arguments are provided via the `--build-arg-file` +and `--build-arg` options, the build arguments are merged across all +of the provided files and command line arguments. + +Any file provided in a `--build-arg-file` option is read before +the arguments supplied via the `--build-arg` option. + +When a given argument name is specified several times, the last instance +is the one that is passed to the resulting builds. This means `--build-arg` +values always override those in a `--build-arg-file`. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/build-arg.md b/versioned_docs/version-5.5.2/source/markdown/options/build-arg.md new file mode 100644 index 000000000..91f395b4e --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/build-arg.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--build-arg**=*arg=value* + +Specifies a build argument and its value, which is interpolated in +instructions read from the Containerfiles in the same way that environment variables are, but which are not added to environment variable list in the resulting image's configuration. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/build-context.md b/versioned_docs/version-5.5.2/source/markdown/options/build-context.md new file mode 100644 index 000000000..c2c6deb6e --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/build-context.md @@ -0,0 +1,35 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--build-context**=*name=value* + +Specify an additional build context using its short name and its location. +Additional build contexts can be referenced in the same manner as we access +different stages in COPY instruction. + +Valid values are: + +* Local directory – e.g. --build-context project2=../path/to/project2/src (This option is not available with the remote Podman client. On Podman machine setup (i.e macOS and Windows) path must exists on the machine VM) +* HTTP URL to a tarball – e.g. --build-context src=https://example.org/releases/src.tar +* Container image – specified with a container-image:// prefix, e.g. --build-context alpine=container-image://alpine:3.15, (also accepts docker://, docker-image://) + +On the Containerfile side, reference the build context on all +commands that accept the “from” parameter. Here’s how that might look: + +```dockerfile +FROM [name] +COPY --from=[name] ... +RUN --mount=from=[name] … +``` + +The value of [name] is matched with the following priority order: + +* Named build context defined with --build-context [name]=.. +* Stage defined with AS [name] inside Containerfile +* Image [name], either local or in a remote registry diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cache-from.md b/versioned_docs/version-5.5.2/source/markdown/options/cache-from.md new file mode 100644 index 000000000..7174af533 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cache-from.md @@ -0,0 +1,26 @@ +--- +title: populate a cache and also consult it +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cache-from**=*image* + +Repository to utilize as a potential cache source. When specified, Buildah tries to look for +cache images in the specified repository and attempts to pull cache images instead of actually +executing the build steps locally. Buildah only attempts to pull previously cached images if they +are considered as valid cache hits. + +Use the `--cache-to` option to populate a remote repository with cache content. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-from` option is ignored unless `--layers` is specified. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cache-to.md b/versioned_docs/version-5.5.2/source/markdown/options/cache-to.md new file mode 100644 index 000000000..a4e4ada0b --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cache-to.md @@ -0,0 +1,24 @@ +--- +title: populate a cache and also consult it +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cache-to**=*image* + +Set this flag to specify a remote repository that is used to store cache images. Buildah attempts to +push newly built cache image to the remote repository. + +Note: Use the `--cache-from` option in order to use cache content in a remote repository. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-to` option is ignored unless `--layers` is specified. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cache-ttl.md b/versioned_docs/version-5.5.2/source/markdown/options/cache-ttl.md new file mode 100644 index 000000000..4f8da10a6 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cache-ttl.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cache-ttl** + +Limit the use of cached images to only consider images with created timestamps less than *duration* ago. +For example if `--cache-ttl=1h` is specified, Buildah considers intermediate cache images which are created +under the duration of one hour, and intermediate cache images outside this duration is ignored. + +Note: Setting `--cache-ttl=0` manually is equivalent to using `--no-cache` in the +implementation since this means that the user does not want to use cache at all. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cap-add.image.md b/versioned_docs/version-5.5.2/source/markdown/options/cap-add.image.md new file mode 100644 index 000000000..0f85e92d7 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cap-add.image.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cap-add**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability added to its capability set. +Certain capabilities are granted by default; this option can be used to add +more. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cap-add.md b/versioned_docs/version-5.5.2/source/markdown/options/cap-add.md new file mode 100644 index 000000000..e80ef6d6b --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cap-add.md @@ -0,0 +1,24 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cap-add**=*capability* + +Add Linux capabilities. + +Granting additional capabilities increases the privileges of the +processes running inside the container and potentially allow it to +break out of confinement. Capabilities like `CAP_SYS_ADMIN`, +`CAP_SYS_PTRACE`, `CAP_MKNOD` and `CAP_SYS_MODULE` are particularly +dangerous when they are not used within a user namespace. Please +refer to **user_namespaces(7)** for a more detailed explanation of the +interaction between user namespaces and capabilities. + +Before adding any capability, review its security implications and +ensure it is really necessary for the container’s functionality. See +**capabilities(7)** for more information. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cap-drop.image.md b/versioned_docs/version-5.5.2/source/markdown/options/cap-drop.image.md new file mode 100644 index 000000000..ab0f90342 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cap-drop.image.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cap-drop**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability removed from its capability set. +The CAP\_CHOWN, CAP\_DAC\_OVERRIDE, CAP\_FOWNER, +CAP\_FSETID, CAP\_KILL, CAP\_NET\_BIND\_SERVICE, CAP\_SETFCAP, +CAP\_SETGID, CAP\_SETPCAP, and CAP\_SETUID capabilities are +granted by default; this option can be used to remove them. + +If a capability is specified to both the **--cap-add** and **--cap-drop** +options, it is dropped, regardless of the order in which the options were +given. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cap-drop.md b/versioned_docs/version-5.5.2/source/markdown/options/cap-drop.md new file mode 100644 index 000000000..dcbf7b03c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cap-drop.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cap-drop**=*capability* + +Drop Linux capabilities. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cert-dir.md b/versioned_docs/version-5.5.2/source/markdown/options/cert-dir.md new file mode 100644 index 000000000..e7f6bc010 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cert-dir.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, build, container runlabel, farm build, image sign, kube play, login, manifest add, manifest push, pull, push, search +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cgroup-conf.md b/versioned_docs/version-5.5.2/source/markdown/options/cgroup-conf.md new file mode 100644 index 000000000..0e466ef6c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cgroup-conf.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroup-conf**=*KEY=VALUE* + +When running on cgroup v2, specify the cgroup file to write to and its value. For example **--cgroup-conf=memory.high=1073741824** sets the memory.high limit to 1GB. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cgroup-parent.md b/versioned_docs/version-5.5.2/source/markdown/options/cgroup-parent.md new file mode 100644 index 000000000..b0ee40ac9 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cgroup-parent.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, create, farm build, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the <> is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cgroupns.image.md b/versioned_docs/version-5.5.2/source/markdown/options/cgroupns.image.md new file mode 100644 index 000000000..07e2816b1 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cgroupns.image.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroupns**=*how* + +Sets the configuration for cgroup namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "private" to indicate +that a new cgroup namespace is created, or it can be "host" to indicate +that the cgroup namespace in which `buildah` itself is being run is reused. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cgroupns.md b/versioned_docs/version-5.5.2/source/markdown/options/cgroupns.md new file mode 100644 index 000000000..3c0145ef7 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cgroupns.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroupns**=*mode* + +Set the cgroup namespace mode for the container. + +- **host**: use the host's cgroup namespace inside the container. +- **container:**_id_: join the namespace of the specified container. +- **private**: create a new cgroup namespace. +- **ns:**_path_: join the namespace at the specified path. + +If the host uses cgroups v1, the default is set to **host**. On cgroups v2, the default is **private**. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cgroups.md b/versioned_docs/version-5.5.2/source/markdown/options/cgroups.md new file mode 100644 index 000000000..416c46779 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cgroups.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cgroups**=*how* + +Determines whether the container creates CGroups. + +Default is **enabled**. + +The **enabled** option creates a new cgroup under the cgroup-parent. +The **disabled** option forces the container to not create CGroups, and thus conflicts with CGroup options (**--cgroupns** and **--cgroup-parent**). +The **no-conmon** option disables a new CGroup only for the **conmon** process. +The **split** option splits the current CGroup in two sub-cgroups: one for conmon and one for the container payload. It is not possible to set **--cgroup-parent** with **split**. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/chrootdirs.md b/versioned_docs/version-5.5.2/source/markdown/options/chrootdirs.md new file mode 100644 index 000000000..e78c7eb41 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/chrootdirs.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--chrootdirs**=*path* + +Path to a directory inside the container that is treated as a `chroot` directory. +Any Podman managed file (e.g., /etc/resolv.conf, /etc/hosts, etc/hostname) that is mounted into the root directory is mounted into that location as well. +Multiple directories are separated with a comma. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cidfile.read.md b/versioned_docs/version-5.5.2/source/markdown/options/cidfile.read.md new file mode 100644 index 000000000..e5ef1c4d6 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cidfile.read.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman kill, pause, rm, stop, unpause +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cidfile**=*file* + +Read container ID from the specified *file* and <> the container. +Can be specified multiple times. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cidfile.write.md b/versioned_docs/version-5.5.2/source/markdown/options/cidfile.write.md new file mode 100644 index 000000000..f54484e75 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cidfile.write.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cidfile**=*file* + +Write the container ID to *file*. The file is removed along with the container, except +when used with podman --remote run on detached containers. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/color.md b/versioned_docs/version-5.5.2/source/markdown/options/color.md new file mode 100644 index 000000000..dbe0d84d1 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/color.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--color** + +Output the containers with different colors in the log. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/compat-auth-file.md b/versioned_docs/version-5.5.2/source/markdown/options/compat-auth-file.md new file mode 100644 index 000000000..ad20a1af0 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/compat-auth-file.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman login, logout +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compat-auth-file**=*path* + +Instead of updating the default credentials file, update the one at *path*, and use a Docker-compatible format. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/compat-volumes.md b/versioned_docs/version-5.5.2/source/markdown/options/compat-volumes.md new file mode 100644 index 000000000..09d9abeb1 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/compat-volumes.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compat-volumes** + +Handle directories marked using the VOLUME instruction (both in this build, and +those inherited from base images) such that their contents can only be modified +by ADD and COPY instructions. Any changes made in those locations by RUN +instructions will be reverted. Before the introduction of this option, this +behavior was the default, but it is now disabled by default. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/compression-format.md b/versioned_docs/version-5.5.2/source/markdown/options/compression-format.md new file mode 100644 index 000000000..dfb911d68 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/compression-format.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compression-format**=**gzip** | *zstd* | *zstd:chunked* + +Specifies the compression format to use. Supported values are: `gzip`, `zstd` and `zstd:chunked`. The default is `gzip` unless overridden in the containers.conf file. +`zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning in that case. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/compression-level.md b/versioned_docs/version-5.5.2/source/markdown/options/compression-level.md new file mode 100644 index 000000000..af99fbf9b --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/compression-level.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compression-level**=*level* + +Specifies the compression level to use. The value is specific to the compression algorithm used, e.g. for zstd the accepted values are in the range 1-20 (inclusive) with a default of 3, while for gzip it is 1-9 (inclusive) and has a default of 5. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/conmon-pidfile.md b/versioned_docs/version-5.5.2/source/markdown/options/conmon-pidfile.md new file mode 100644 index 000000000..f29c211cb --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/conmon-pidfile.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--conmon-pidfile**=*file* + +Write the pid of the **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to restart Podman containers. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cpp-flag.md b/versioned_docs/version-5.5.2/source/markdown/options/cpp-flag.md new file mode 100644 index 000000000..333f3f5c9 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cpp-flag.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpp-flag**=*flags* + +Set additional flags to pass to the C Preprocessor cpp(1). Containerfiles ending with a ".in" suffix is preprocessed via cpp(1). This option can be used to pass additional flags to cpp.Note: You can also set default CPPFLAGS by setting the BUILDAH_CPPFLAGS environment variable (e.g., export BUILDAH_CPPFLAGS="-DDEBUG"). diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cpu-period.md b/versioned_docs/version-5.5.2/source/markdown/options/cpu-period.md new file mode 100644 index 000000000..5784fe8b7 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cpu-period.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cpu-quota.md b/versioned_docs/version-5.5.2/source/markdown/options/cpu-quota.md new file mode 100644 index 000000000..c5309abf7 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cpu-quota.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cpu-rt-period.md b/versioned_docs/version-5.5.2/source/markdown/options/cpu-rt-period.md new file mode 100644 index 000000000..237164416 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cpu-rt-period.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman container clone, create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cpu-rt-runtime.md b/versioned_docs/version-5.5.2/source/markdown/options/cpu-rt-runtime.md new file mode 100644 index 000000000..8059f88a2 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cpu-rt-runtime.md @@ -0,0 +1,19 @@ +--- +title: of +version: v5.5.2 +--- + +####> This option file is used in: +####> podman container clone, create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cpu-shares.md b/versioned_docs/version-5.5.2/source/markdown/options/cpu-shares.md new file mode 100644 index 000000000..1b3df014f --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cpu-shares.md @@ -0,0 +1,50 @@ +--- +title: of +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cpus.container.md b/versioned_docs/version-5.5.2/source/markdown/options/cpus.container.md new file mode 100644 index 000000000..50f69a4be --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cpus.container.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpus**=*number* + +Number of CPUs. The default is *0.0* which means no limit. This is shorthand +for **--cpu-period** and **--cpu-quota**, therefore the option cannot be specified with +**--cpu-period** or **--cpu-quota**. + +On some systems, changing the CPU limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cpuset-cpus.md b/versioned_docs/version-5.5.2/source/markdown/options/cpuset-cpus.md new file mode 100644 index 000000000..aa51c6613 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cpuset-cpus.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/cpuset-mems.md b/versioned_docs/version-5.5.2/source/markdown/options/cpuset-mems.md new file mode 100644 index 000000000..3274bae68 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/cpuset-mems.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/creds.md b/versioned_docs/version-5.5.2/source/markdown/options/creds.md new file mode 100644 index 000000000..9bcbf9031 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/creds.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, build, container runlabel, farm build, kube play, manifest add, manifest push, pull, push, search +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--creds**=*[username[\\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/decryption-key.md b/versioned_docs/version-5.5.2/source/markdown/options/decryption-key.md new file mode 100644 index 000000000..27e132733 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/decryption-key.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman artifact pull, build, create, farm build, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--decryption-key**=*key[\\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/destroy.md b/versioned_docs/version-5.5.2/source/markdown/options/destroy.md new file mode 100644 index 000000000..8c57c82a6 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/destroy.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman container clone, pod clone +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--destroy** + +Remove the original <> that we are cloning once used to mimic the configuration. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/detach-keys.md b/versioned_docs/version-5.5.2/source/markdown/options/detach-keys.md new file mode 100644 index 000000000..daa353a51 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/detach-keys.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman attach, exec, run, start +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/device-cgroup-rule.md b/versioned_docs/version-5.5.2/source/markdown/options/device-cgroup-rule.md new file mode 100644 index 000000000..3f5e37df6 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/device-cgroup-rule.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-cgroup-rule**=*"type major\\:minor mode"* + +Add a rule to the cgroup allowed devices list. The rule is expected to be +in the format specified in the Linux kernel documentation +[admin-guide/cgroup-v1/devices](https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.html): +- *type*: `a` (all), `c` (char), or `b` (block); +- *major* and *minor*: either a number, or `*` for all; +- *mode*: a composition of `r` (read), `w` (write), and `m` (mknod(2)). diff --git a/versioned_docs/version-5.5.2/source/markdown/options/device-read-bps.md b/versioned_docs/version-5.5.2/source/markdown/options/device-read-bps.md new file mode 100644 index 000000000..5fea21fb3 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/device-read-bps.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman container clone, create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/device-read-iops.md b/versioned_docs/version-5.5.2/source/markdown/options/device-read-iops.md new file mode 100644 index 000000000..99b2526e1 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/device-read-iops.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-read-iops**=*path:rate* + +Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/device-write-bps.md b/versioned_docs/version-5.5.2/source/markdown/options/device-write-bps.md new file mode 100644 index 000000000..23eec5572 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/device-write-bps.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman container clone, create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/device-write-iops.md b/versioned_docs/version-5.5.2/source/markdown/options/device-write-iops.md new file mode 100644 index 000000000..e059893fc --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/device-write-iops.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device-write-iops**=*path:rate* + +Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/device.md b/versioned_docs/version-5.5.2/source/markdown/options/device.md new file mode 100644 index 000000000..3c9e73c59 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/device.md @@ -0,0 +1,31 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, create, farm build, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--device**=*host-device[:container-device][\\\:permissions]* + +Add a host device to the <>. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The <> only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true diff --git a/versioned_docs/version-5.5.2/source/markdown/options/digestfile.md b/versioned_docs/version-5.5.2/source/markdown/options/digestfile.md new file mode 100644 index 000000000..ae05f4880 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/digestfile.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman artifact push, manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--digestfile**=*Digestfile* + +After copying the image, write the digest of the resulting image to the file. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/dir-compress.md b/versioned_docs/version-5.5.2/source/markdown/options/dir-compress.md new file mode 100644 index 000000000..c8f8eccd5 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/dir-compress.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman push, save +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--compress** + +Compress tarball image layers when pushing to a directory using the 'dir' transport. (default is same compression type, compressed or uncompressed, as source) diff --git a/versioned_docs/version-5.5.2/source/markdown/options/disable-compression.md b/versioned_docs/version-5.5.2/source/markdown/options/disable-compression.md new file mode 100644 index 000000000..ce3359ac2 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/disable-compression.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--disable-compression**, **-D** + +Don't compress filesystem layers when building the image unless it is required +by the location where the image is being written. This is the default setting, +because image layers are compressed automatically when they are pushed to +registries, and images being written to local storage only need to be +decompressed again to be stored. Compression can be forced in all cases by +specifying **--disable-compression=false**. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/disable-content-trust.md b/versioned_docs/version-5.5.2/source/markdown/options/disable-content-trust.md new file mode 100644 index 000000000..9d773f48c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/disable-content-trust.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, create, pull, push, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/dns-option.container.md b/versioned_docs/version-5.5.2/source/markdown/options/dns-option.container.md new file mode 100644 index 000000000..6443afaa0 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/dns-option.container.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns-option**=*option* + +Set custom DNS options. Invalid if using **--dns-option** with **--network** that is set to **none** or **container:**_id_. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/dns-option.image.md b/versioned_docs/version-5.5.2/source/markdown/options/dns-option.image.md new file mode 100644 index 000000000..6630f16b4 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/dns-option.image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns-option**=*option* + +Set custom DNS options to be used during the build. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/dns-search.container.md b/versioned_docs/version-5.5.2/source/markdown/options/dns-search.container.md new file mode 100644 index 000000000..ea2059ec2 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/dns-search.container.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns-search**=*domain* + +Set custom DNS search domains. Invalid if using **--dns-search** with **--network** that is set to **none** or **container:**_id_. +Use **--dns-search=.** to remove the search domain. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/dns-search.image.md b/versioned_docs/version-5.5.2/source/markdown/options/dns-search.image.md new file mode 100644 index 000000000..2bea39a80 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/dns-search.image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns-search**=*domain* + +Set custom DNS search domains to be used during the build. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/dns.md b/versioned_docs/version-5.5.2/source/markdown/options/dns.md new file mode 100644 index 000000000..98335baf9 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/dns.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, create, farm build, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/entrypoint.md b/versioned_docs/version-5.5.2/source/markdown/options/entrypoint.md new file mode 100644 index 000000000..192dc16ac --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/entrypoint.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--entrypoint**=*"command"* | *'["command", "arg1", ...]'* + +Override the default ENTRYPOINT from the image. + +The ENTRYPOINT of an image is similar to a COMMAND +because it specifies what executable to run when the container starts, but it is +(purposely) more difficult to override. The ENTRYPOINT gives a container its +default nature or behavior. When the ENTRYPOINT is set, the +container runs as if it were that binary, complete with default options. More options can be +passed in via the COMMAND. But, if a user wants to run +something else inside the container, the **--entrypoint** option allows a new +ENTRYPOINT to be specified. + +Specify multi option commands in the form of a JSON string. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/env-file.md b/versioned_docs/version-5.5.2/source/markdown/options/env-file.md new file mode 100644 index 000000000..a0ae65799 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/env-file.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env-file**=*file* + +Read in a line-delimited file of environment variables. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/env-host.md b/versioned_docs/version-5.5.2/source/markdown/options/env-host.md new file mode 100644 index 000000000..6bb616c62 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/env-host.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env-host** + +Use host environment inside of the container. See **Environment** note below for precedence. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.2/source/markdown/options/env-merge.md b/versioned_docs/version-5.5.2/source/markdown/options/env-merge.md new file mode 100644 index 000000000..8571e4ace --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/env-merge.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env-merge**=*env* + +Preprocess default environment variables for the containers. For example +if image contains environment variable `hello=world` user can preprocess +it using `--env-merge hello=${hello}-some` so new value is `hello=world-some`. + +Please note that if the environment variable `hello` is not present in the image, +then it'll be replaced by an empty string and so using `--env-merge hello=${hello}-some` +would result in the new value of `hello=-some`, notice the leading `-` delimiter. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/env.image.md b/versioned_docs/version-5.5.2/source/markdown/options/env.image.md new file mode 100644 index 000000000..61d6ae281 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/env.image.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env**=*env[=value]* + +Add a value (e.g. env=*value*) to the built image. Can be used multiple times. +If neither `=` nor a *value* are specified, but *env* is set in the current +environment, the value from the current environment is added to the image. +To remove an environment variable from the built image, use the `--unsetenv` +option. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/env.md b/versioned_docs/version-5.5.2/source/markdown/options/env.md new file mode 100644 index 000000000..213ed446b --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/env.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env**, **-e**=*env* + +Set environment variables. + +This option allows arbitrary environment variables that are available for the process to be launched inside of the container. If an environment variable is specified without a value, Podman checks the host environment for a value and set the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the container. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/env.update.md b/versioned_docs/version-5.5.2/source/markdown/options/env.update.md new file mode 100644 index 000000000..fa2cbd799 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/env.update.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--env**, **-e**=*env* + +Add a value (e.g. env=*value*) to the container. Can be used multiple times. +If the value already exists in the container, it is overridden. +To remove an environment variable from the container, use the `--unsetenv` +option. + +Note that the env updates only affect the main container process after +the next start. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/expose.md b/versioned_docs/version-5.5.2/source/markdown/options/expose.md new file mode 100644 index 000000000..d93ae486c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/expose.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--expose**=*port[/protocol]* + +Expose a port or a range of ports (e.g. **--expose=3300-3310**). +The protocol can be `tcp`, `udp` or `sctp` and if not given `tcp` is assumed. +This option matches the EXPOSE instruction for image builds and has no effect on +the actual networking rules unless **-P/--publish-all** is used to forward to all +exposed ports from random host ports. To forward specific ports from the host +into the container use the **-p/--publish** option instead. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/farm.md b/versioned_docs/version-5.5.2/source/markdown/options/farm.md new file mode 100644 index 000000000..66c11660f --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/farm.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--farm** + +This option specifies the name of the farm to be used in the build process. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/features.md b/versioned_docs/version-5.5.2/source/markdown/options/features.md new file mode 100644 index 000000000..d1619bc8c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/features.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman manifest add, manifest annotate +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--features**=*feature* + +Specify the features list which the list or index records as requirements for +the image. This option is rarely used. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/file.md b/versioned_docs/version-5.5.2/source/markdown/options/file.md new file mode 100644 index 000000000..aa4cba4ff --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/file.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--file**, **-f**=*Containerfile* + +Specifies a Containerfile which contains instructions for building the image, +either a local file or an **http** or **https** URL. If more than one +Containerfile is specified, *FROM* instructions are only be accepted from the +last specified file. + +If a build context is not specified, and at least one Containerfile is a +local file, the directory in which it resides is used as the build +context. + +Specifying the option `-f -` causes the Containerfile contents to be read from stdin. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/follow.md b/versioned_docs/version-5.5.2/source/markdown/options/follow.md new file mode 100644 index 000000000..15c70ba93 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/follow.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--follow**, **-f** + +Follow log output. Default is false. + +Note: When following a <> which is removed by `podman <> rm` +or removed on exit (`podman run --rm ...`), there is a chance that the log +file is removed before `podman<< pod|>> logs` reads the final content. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/force-compression.md b/versioned_docs/version-5.5.2/source/markdown/options/force-compression.md new file mode 100644 index 000000000..23f1fee09 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/force-compression.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--force-compression** + +If set, push uses the specified compression algorithm even if the destination contains a differently-compressed variant already. +Defaults to `true` if `--compression-format` is explicitly specified on the command-line, `false` otherwise. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/force-rm.md b/versioned_docs/version-5.5.2/source/markdown/options/force-rm.md new file mode 100644 index 000000000..a76e10167 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/force-rm.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--force-rm** + +Always remove intermediate containers after a build, even if the build fails (default true). diff --git a/versioned_docs/version-5.5.2/source/markdown/options/format.md b/versioned_docs/version-5.5.2/source/markdown/options/format.md new file mode 100644 index 000000000..fca9f0cac --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/format.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--format** + +Control the format for the built image's manifest and configuration data. +Recognized formats include *oci* (OCI image-spec v1.0, the default) and +*docker* (version 2, using schema format 2 for the manifest). + +Note: You can also override the default format by setting the BUILDAH\_FORMAT +environment variable. `export BUILDAH_FORMAT=docker` diff --git a/versioned_docs/version-5.5.2/source/markdown/options/from.md b/versioned_docs/version-5.5.2/source/markdown/options/from.md new file mode 100644 index 000000000..b9aecc4a2 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/from.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--from** + +Overrides the first `FROM` instruction within the Containerfile. If there are multiple +FROM instructions in a Containerfile, only the first is changed. + +With the remote podman client, not all container transports work as +expected. For example, oci-archive:/x.tar references /x.tar on the remote +machine instead of on the client. When using podman remote clients it is +best to restrict use to *containers-storage*, and *docker:// transports*. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/gidmap.container.md b/versioned_docs/version-5.5.2/source/markdown/options/gidmap.container.md new file mode 100644 index 000000000..4a87c1a3a --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/gidmap.container.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--gidmap**=*[flags]container_uid\:from_uid[\\:amount]* + +Run the container in a new user namespace using the supplied GID mapping. This +option conflicts with the **--userns** and **--subgidname** options. This +option provides a way to map host GIDs to container GIDs in the same way as +__--uidmap__ maps host UIDs to container UIDs. For details see __--uidmap__. + +Note: the **--gidmap** option cannot be called in conjunction with the **--pod** option as a gidmap cannot be set on the container level when in a pod. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/gidmap.pod.md b/versioned_docs/version-5.5.2/source/markdown/options/gidmap.pod.md new file mode 100644 index 000000000..0cf9e8de7 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/gidmap.pod.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--gidmap**=*pod_gid\:host_gid\\:amount* + +GID map for the user namespace. Using this flag runs all containers in the pod with user namespace enabled. +It conflicts with the **--userns** and **--subgidname** flags. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/gpus.md b/versioned_docs/version-5.5.2/source/markdown/options/gpus.md new file mode 100644 index 000000000..95e10b825 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/gpus.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/group-add.md b/versioned_docs/version-5.5.2/source/markdown/options/group-add.md new file mode 100644 index 000000000..d0969d78c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/group-add.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, create, farm build, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.2/source/markdown/options/group-entry.md b/versioned_docs/version-5.5.2/source/markdown/options/group-entry.md new file mode 100644 index 000000000..9f5186f69 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/group-entry.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--group-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/group` file within the container when `--user` is used. + +The variables $GROUPNAME, $GID, and $USERLIST are automatically replaced with their value at runtime if present. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/health-cmd.md b/versioned_docs/version-5.5.2/source/markdown/options/health-cmd.md new file mode 100644 index 000000000..34b6e0b2e --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/health-cmd.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set or alter a healthcheck command for a container. The command is a command to be executed inside the +container that determines the container health. The command is required for other healthcheck options +to be applied. A value of **none** disables existing healthchecks. + +Multiple options can be passed in the form of a JSON array; otherwise, the command is interpreted +as an argument to **/bin/sh -c**. + +Note: The default values are used even if healthcheck is configured in the image. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/health-interval.md b/versioned_docs/version-5.5.2/source/markdown/options/health-interval.md new file mode 100644 index 000000000..b5bb402e4 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/health-interval.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-interval**=*interval* + +Set an interval for the healthchecks. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +Note: This parameter will overwrite related healthcheck configuration from the image. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/health-log-destination.md b/versioned_docs/version-5.5.2/source/markdown/options/health-log-destination.md new file mode 100644 index 000000000..6826e47d9 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/health-log-destination.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-log-destination**=*directory_path* + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) (Default: local) + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/health-max-log-count.md b/versioned_docs/version-5.5.2/source/markdown/options/health-max-log-count.md new file mode 100644 index 000000000..214a81bc3 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/health-max-log-count.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-max-log-count**=*number of stored logs* + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) (Default: 5 attempts) diff --git a/versioned_docs/version-5.5.2/source/markdown/options/health-max-log-size.md b/versioned_docs/version-5.5.2/source/markdown/options/health-max-log-size.md new file mode 100644 index 000000000..7c8ec5dae --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/health-max-log-size.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-max-log-size**=*size of stored logs* + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) (Default: 500 characters) diff --git a/versioned_docs/version-5.5.2/source/markdown/options/health-on-failure.md b/versioned_docs/version-5.5.2/source/markdown/options/health-on-failure.md new file mode 100644 index 000000000..960c4f498 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/health-on-failure.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-on-failure**=*action* + +Action to take once the container transitions to an unhealthy state. The default is **none**. + +- **none**: Take no action. +- **kill**: Kill the container. +- **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. +- **stop**: Stop the container. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/health-retries.md b/versioned_docs/version-5.5.2/source/markdown/options/health-retries.md new file mode 100644 index 000000000..3e68287bd --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/health-retries.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-retries**=*retries* + +The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is **3**. + +Note: This parameter can overwrite the healthcheck configuration from the image. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/health-start-period.md b/versioned_docs/version-5.5.2/source/markdown/options/health-start-period.md new file mode 100644 index 000000000..af51d0737 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/health-start-period.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-start-period**=*period* + +The initialization time needed for a container to bootstrap. The value can be expressed in time format like +**2m3s**. The default value is **0s**. + +Note: The health check command is executed as soon as a container is started, if the health check is successful +the container's health state will be updated to `healthy`. However, if the health check fails, the health state will +stay as `starting` until either the health check is successful or until the `--health-start-period` time is over. If the +health check command fails after the `--health-start-period` time is over, the health state will be updated to `unhealthy`. +The health check command is executed periodically based on the value of `--health-interval`. + +Note: This parameter will overwrite related healthcheck configuration from the image. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/health-startup-cmd.md b/versioned_docs/version-5.5.2/source/markdown/options/health-startup-cmd.md new file mode 100644 index 000000000..913b84bb3 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/health-startup-cmd.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set a startup healthcheck command for a container. This command is executed inside the container and is used to gate the regular +healthcheck. When the startup command succeeds, the regular healthcheck begins and the startup healthcheck ceases. Optionally, +if the command fails for a set number of attempts, the container is restarted. A startup healthcheck can be used to ensure that +containers with an extended startup period are not marked as unhealthy until they are fully started. Startup healthchecks can only be +used when a regular healthcheck (from the container's image or the **--health-cmd** option) is also set. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/health-startup-interval.md b/versioned_docs/version-5.5.2/source/markdown/options/health-startup-interval.md new file mode 100644 index 000000000..b9343ef83 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/health-startup-interval.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-interval**=*interval* + +Set an interval for the startup healthcheck. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/health-startup-retries.md b/versioned_docs/version-5.5.2/source/markdown/options/health-startup-retries.md new file mode 100644 index 000000000..15c2dd299 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/health-startup-retries.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-retries**=*retries* + +The number of attempts allowed before the startup healthcheck restarts the container. If set to **0**, the container is never restarted. The default is **0**. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/health-startup-success.md b/versioned_docs/version-5.5.2/source/markdown/options/health-startup-success.md new file mode 100644 index 000000000..ebd7f7d6e --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/health-startup-success.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-success**=*retries* + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value +of **0** means that any success begins the regular healthcheck. The default is **0**. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/health-startup-timeout.md b/versioned_docs/version-5.5.2/source/markdown/options/health-startup-timeout.md new file mode 100644 index 000000000..8a697726e --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/health-startup-timeout.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-startup-timeout**=*timeout* + +The maximum time a startup healthcheck command has to complete before it is marked as failed. The value can be expressed in a time +format like **2m3s**. The default value is **30s**. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/health-timeout.md b/versioned_docs/version-5.5.2/source/markdown/options/health-timeout.md new file mode 100644 index 000000000..d7d69bc70 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/health-timeout.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--health-timeout**=*timeout* + +The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the +value can be expressed in a time format such as **1m22s**. The default value is **30s**. + +Note: A timeout marks the healthcheck as failed but does not terminate the running process. +This ensures that a slow but eventually successful healthcheck does not disrupt the container +but is still accounted for in the health status. + +Note: This parameter will overwrite related healthcheck configuration from the image. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/help.md b/versioned_docs/version-5.5.2/source/markdown/options/help.md new file mode 100644 index 000000000..b31381af2 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/help.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--help**, **-h** + +Print usage statement diff --git a/versioned_docs/version-5.5.2/source/markdown/options/hooks-dir.md b/versioned_docs/version-5.5.2/source/markdown/options/hooks-dir.md new file mode 100644 index 000000000..574dfa20b --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/hooks-dir.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hooks-dir**=*path* + +Each *.json file in the path configures a hook for buildah build containers. For more details on the syntax of the JSON files and the semantics of hook injection. Buildah currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. + +This option may be set multiple times; paths from later options have higher precedence. + +For the annotation conditions, buildah uses any annotations set in the generated OCI configuration. + +For the bind-mount conditions, only mounts explicitly requested by the caller via --volume are considered. Bind mounts that buildah inserts by default (e.g. /dev/shm) are not considered. + +If --hooks-dir is unset for root callers, Buildah currently defaults to /usr/share/containers/oci/hooks.d and /etc/containers/oci/hooks.d in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting --hooks-dir. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/hostname.container.md b/versioned_docs/version-5.5.2/source/markdown/options/hostname.container.md new file mode 100644 index 000000000..d12e1a747 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/hostname.container.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hostname**, **-h**=*name* + +Set the container's hostname inside the container. + +This option can only be used with a private UTS namespace `--uts=private` +(default). If `--pod` is given and the pod shares the same UTS namespace +(default), the pod's hostname is used. The given hostname is also added to the +`/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). diff --git a/versioned_docs/version-5.5.2/source/markdown/options/hostname.pod.md b/versioned_docs/version-5.5.2/source/markdown/options/hostname.pod.md new file mode 100644 index 000000000..9d6456288 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/hostname.pod.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hostname**=*name* + +Set the pod's hostname inside all containers. + +The given hostname is also added to the `/etc/hosts` file using the container's +primary IP address (also see the **--add-host** option). diff --git a/versioned_docs/version-5.5.2/source/markdown/options/hosts-file.md b/versioned_docs/version-5.5.2/source/markdown/options/hosts-file.md new file mode 100644 index 000000000..4698d76d6 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/hosts-file.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hosts-file**=*path* | *none* | *image* + +Base file to create the `/etc/hosts` file inside the container. This must either +be an absolute path to a file on the host system, or one of the following +special flags: + "" Follow the `base_hosts_file` configuration in _containers.conf_ (the default) + `none` Do not use a base file (i.e. start with an empty file) + `image` Use the container image's `/etc/hosts` file as base file diff --git a/versioned_docs/version-5.5.2/source/markdown/options/hostuser.md b/versioned_docs/version-5.5.2/source/markdown/options/hostuser.md new file mode 100644 index 000000000..4f04842dd --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/hostuser.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--hostuser**=*name* + +Add a user account to /etc/passwd from the host to the container. The Username +or UID must exist on the host system. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/http-proxy.md b/versioned_docs/version-5.5.2/source/markdown/options/http-proxy.md new file mode 100644 index 000000000..45fe52f47 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/http-proxy.md @@ -0,0 +1,25 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, create, farm build, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/identity-label.md b/versioned_docs/version-5.5.2/source/markdown/options/identity-label.md new file mode 100644 index 000000000..5153bde27 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/identity-label.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--identity-label** + +Adds default identity label `io.buildah.version` if set. (default true). diff --git a/versioned_docs/version-5.5.2/source/markdown/options/ignore.md b/versioned_docs/version-5.5.2/source/markdown/options/ignore.md new file mode 100644 index 000000000..1abba9de9 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/ignore.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman pod rm, pod stop, rm, stop +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ignore**, **-i** + +Ignore errors when specified <> are not in the container store. A user +might have decided to manually remove a <> which leads to a failure +during the ExecStop directive of a systemd service referencing that <>. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/ignorefile.md b/versioned_docs/version-5.5.2/source/markdown/options/ignorefile.md new file mode 100644 index 000000000..69eec7371 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/ignorefile.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ignorefile** + +Path to an alternative .containerignore file. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/iidfile.md b/versioned_docs/version-5.5.2/source/markdown/options/iidfile.md new file mode 100644 index 000000000..00816e392 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/iidfile.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--iidfile**=*ImageIDfile* + +Write the built image's ID to the file. When `--platform` is specified more than once, attempting to use this option triggers an error. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/image-volume.md b/versioned_docs/version-5.5.2/source/markdown/options/image-volume.md new file mode 100644 index 000000000..bd10fe26a --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/image-volume.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--image-volume**=**bind** | *tmpfs* | *ignore* + +Tells Podman how to handle the builtin image volumes. Default is **bind**. + +- **bind**: An anonymous named volume is created and mounted into the container. +- **tmpfs**: The volume is mounted onto the container as a tmpfs, which allows the users to create +content that disappears when the container is stopped. +- **ignore**: All volumes are just ignored and no action is taken. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/infra-command.md b/versioned_docs/version-5.5.2/source/markdown/options/infra-command.md new file mode 100644 index 000000000..8f9a1f450 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/infra-command.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--infra-command**=*command* + +The command that is run to start the infra container. Default: "/pause". diff --git a/versioned_docs/version-5.5.2/source/markdown/options/infra-conmon-pidfile.md b/versioned_docs/version-5.5.2/source/markdown/options/infra-conmon-pidfile.md new file mode 100644 index 000000000..02e235bdb --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/infra-conmon-pidfile.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--infra-conmon-pidfile**=*file* + +Write the pid of the infra container's **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to manage Podman containers and pods. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/infra-name.md b/versioned_docs/version-5.5.2/source/markdown/options/infra-name.md new file mode 100644 index 000000000..38428336c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/infra-name.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--infra-name**=*name* + +The name that is used for the pod's infra container. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/inherit-labels.md b/versioned_docs/version-5.5.2/source/markdown/options/inherit-labels.md new file mode 100644 index 000000000..55c28ca09 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/inherit-labels.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--inherit-labels** + +Inherit the labels from the base image or base stages. (default true). diff --git a/versioned_docs/version-5.5.2/source/markdown/options/init-path.md b/versioned_docs/version-5.5.2/source/markdown/options/init-path.md new file mode 100644 index 000000000..da7b04136 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/init-path.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--init-path**=*path* + +Path to the container-init binary. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/init.md b/versioned_docs/version-5.5.2/source/markdown/options/init.md new file mode 100644 index 000000000..19e5948d0 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/init.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--init** + +Run an init inside the container that forwards signals and reaps processes. +The container-init binary is mounted at `/run/podman-init`. +Mounting over `/run` breaks container execution. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/interactive.md b/versioned_docs/version-5.5.2/source/markdown/options/interactive.md new file mode 100644 index 000000000..8cc13f430 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/interactive.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, exec, run, start +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/ip.md b/versioned_docs/version-5.5.2/source/markdown/options/ip.md new file mode 100644 index 000000000..40672c7a4 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/ip.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ip**=*ipv4* + +Specify a static IPv4 address for the <>, for example **10.88.64.128**. +This option can only be used if the <> is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the <> is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IP address pool (default **10.88.0.0/16**). + +To specify multiple static IP addresses per <>, set multiple networks using the **--network** option with a static IP address specified for each using the `ip` mode for that option. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/ip6.md b/versioned_docs/version-5.5.2/source/markdown/options/ip6.md new file mode 100644 index 000000000..1abb91db9 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/ip6.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ip6**=*ipv6* + +Specify a static IPv6 address for the <>, for example **fd46:db93:aa76\:ac37::10**. +This option can only be used if the <> is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the <> is not joining another container's network namespace via **--network=container\\:_id_**. +The address must be within the network's IPv6 address pool. + +To specify multiple static IPv6 addresses per <>, set multiple networks using the **--network** option with a static IPv6 address specified for each using the `ip6` mode for that option. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/ipc.image.md b/versioned_docs/version-5.5.2/source/markdown/options/ipc.image.md new file mode 100644 index 000000000..4dcb30957 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/ipc.image.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ipc**=*how* + +Sets the configuration for IPC namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate +that a new IPC namespace is created, or it can be "host" to indicate +that the IPC namespace in which `podman` itself is being run is reused, +or it can be the path to an IPC namespace which is already in use by +another process. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/ipc.md b/versioned_docs/version-5.5.2/source/markdown/options/ipc.md new file mode 100644 index 000000000..03441131f --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/ipc.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ipc**=*ipc* + +Set the IPC namespace mode for a container. The default is to create +a private IPC namespace. + +- "": Use Podman's default, defined in containers.conf. +- **container:**_id_: reuses another container's shared memory, semaphores, and message queues +- **host**: use the host's shared memory, semaphores, and message queues inside the container. Note: the host mode gives the container full access to local shared memory and is therefore considered insecure. +- **none**: private IPC namespace, with /dev/shm not mounted. +- **ns:**_path_: path to an IPC namespace to join. +- **private**: private IPC namespace. +- **shareable**: private IPC namespace with a possibility to share it with other containers. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/isolation.md b/versioned_docs/version-5.5.2/source/markdown/options/isolation.md new file mode 100644 index 000000000..844491e54 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/isolation.md @@ -0,0 +1,22 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--isolation**=*type* + +Controls what type of isolation is used for running processes as part of `RUN` +instructions. Recognized types include *oci* (OCI-compatible runtime, the +default), *rootless* (OCI-compatible runtime invoked using a modified +configuration and its --rootless option enabled, with *--no-new-keyring +--no-pivot* added to its *create* invocation, with network and UTS namespaces +disabled, and IPC, PID, and user namespaces enabled; the default for +unprivileged users), and *chroot* (an internal wrapper that leans more toward +chroot(1) than container technology). + +Note: You can also override the default isolation type by setting the +BUILDAH\_ISOLATION environment variable. `export BUILDAH_ISOLATION=oci` diff --git a/versioned_docs/version-5.5.2/source/markdown/options/jobs.md b/versioned_docs/version-5.5.2/source/markdown/options/jobs.md new file mode 100644 index 000000000..bf275be2d --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/jobs.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--jobs**=*number* + +Run up to N concurrent stages in parallel. If the number of jobs is greater +than 1, stdin is read from /dev/null. If 0 is specified, then there is +no limit in the number of jobs that run in parallel. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/label-file.md b/versioned_docs/version-5.5.2/source/markdown/options/label-file.md new file mode 100644 index 000000000..0c044aefd --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/label-file.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--label-file**=*file* + +Read in a line-delimited file of labels. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/label.image.md b/versioned_docs/version-5.5.2/source/markdown/options/label.image.md new file mode 100644 index 000000000..084923cba --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/label.image.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--label**=*label* + +Add an image *label* (e.g. label=*value*) to the image metadata. Can be used +multiple times. + +Users can set a special LABEL **io.containers.capabilities=CAP1,CAP2,CAP3** in +a Containerfile that specifies the list of Linux capabilities required for the +container to run properly. This label specified in a container image tells +Podman to run the container with just these capabilities. Podman launches the +container with just the specified capabilities, as long as this list of +capabilities is a subset of the default list. + +If the specified capabilities are not in the default set, Podman prints an error +message and runs the container with the default capabilities. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/label.md b/versioned_docs/version-5.5.2/source/markdown/options/label.md new file mode 100644 index 000000000..d80471a68 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/label.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--label**, **-l**=*key=value* + +Add metadata to a <>. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/latest.md b/versioned_docs/version-5.5.2/source/markdown/options/latest.md new file mode 100644 index 000000000..0dbb2d75a --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/latest.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman attach, container diff, container inspect, diff, exec, init, inspect, kill, logs, mount, network reload, pause, pod inspect, pod kill, pod logs, pod rm, pod start, pod stats, pod stop, pod top, port, restart, rm, start, stats, stop, top, unmount, unpause, wait +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--latest**, **-l** + +Instead of providing the <> name or ID, use the last created <>. +Note: the last started <> can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.2/source/markdown/options/layer-label.md b/versioned_docs/version-5.5.2/source/markdown/options/layer-label.md new file mode 100644 index 000000000..4a0ea59df --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/layer-label.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--layer-label**=*label[=value]* + +Add an intermediate image *label* (e.g. label=*value*) to the intermediate +image metadata. It can be used multiple times. + +If *label* is named, but neither `=` nor a `value` is provided, then +the *label* is set to an empty value. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/layers.md b/versioned_docs/version-5.5.2/source/markdown/options/layers.md new file mode 100644 index 000000000..8dffbf42a --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/layers.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--layers** + +Cache intermediate images during the build process (Default is `true`). + +Note: You can also override the default value of layers by setting the +BUILDAH\_LAYERS environment variable. `export BUILDAH_LAYERS=true` diff --git a/versioned_docs/version-5.5.2/source/markdown/options/link-local-ip.md b/versioned_docs/version-5.5.2/source/markdown/options/link-local-ip.md new file mode 100644 index 000000000..19c83bb45 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/link-local-ip.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--link-local-ip**=*ip* + +Not implemented. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/log-driver.md b/versioned_docs/version-5.5.2/source/markdown/options/log-driver.md new file mode 100644 index 000000000..2aad8e166 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/log-driver.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--log-driver**=*driver* + +Logging driver for the container. Currently available options are **k8s-file**, **journald**, **none**, **passthrough** and **passthrough-tty**, with **json-file** aliased to **k8s-file** for scripting compatibility. (Default **journald**). + +The podman info command below displays the default log-driver for the system. +``` +$ podman info --format '{{ .Host.LogDriver }}' +journald +``` +The **passthrough** driver passes down the standard streams (stdin, stdout, stderr) to the +container. It is not allowed with the remote Podman client, including Mac and Windows (excluding WSL2) machines, and on a tty, since it is +vulnerable to attacks via TIOCSTI. + +The **passthrough-tty** driver is the same as **passthrough** except that it also allows it to be used on a TTY if the user really wants it. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/log-opt.md b/versioned_docs/version-5.5.2/source/markdown/options/log-opt.md new file mode 100644 index 000000000..bedd27fb8 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/log-opt.md @@ -0,0 +1,25 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, kube play, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--log-opt**=*name=value* + +Logging driver specific options. + +Set custom logging configuration. The following *name*s are supported: + +**path**: specify a path to the log file + (e.g. **--log-opt path=/var/log/container/mycontainer.json**); + +**max-size**: specify a max size of the log file + (e.g. **--log-opt max-size=10mb**); + +**tag**: specify a custom log tag for the container + (e.g. **--log-opt tag="{{.ImageName}}"**. +It supports the same keys as **podman inspect --format**. +This option is currently supported only by the **journald** log driver. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/logfile.md b/versioned_docs/version-5.5.2/source/markdown/options/logfile.md new file mode 100644 index 000000000..982b989c0 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/logfile.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--logfile**=*filename* + +Log output which is sent to standard output and standard error to the +specified file instead of to standard output and standard error. +This option is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/mac-address.md b/versioned_docs/version-5.5.2/source/markdown/options/mac-address.md new file mode 100644 index 000000000..96652c989 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/mac-address.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--mac-address**=*address* + +<> network interface MAC address (e.g. 92:d0\:c6:0a:29:33) +This option can only be used if the <> is joined to only a single network - i.e., **--network=_network-name_** is used at most once - +and if the <> is not joining another container's network namespace via **--network=container\:_id_**. + +Remember that the MAC address in an Ethernet network must be unique. +The IPv6 link-local address is based on the device's MAC address +according to RFC4862. + +To specify multiple static MAC addresses per <>, set multiple networks using the **--network** option with a static MAC address specified for each using the `mac` mode for that option. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/manifest.md b/versioned_docs/version-5.5.2/source/markdown/options/manifest.md new file mode 100644 index 000000000..cd2d6b45f --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/manifest.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--manifest**=*manifest* + +Name of the manifest list to which the image is added. Creates the manifest list if it does not exist. This option is useful for building multi architecture images. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/memory-reservation.md b/versioned_docs/version-5.5.2/source/markdown/options/memory-reservation.md new file mode 100644 index 000000000..757242697 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/memory-reservation.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman container clone, create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/memory-swap.md b/versioned_docs/version-5.5.2/source/markdown/options/memory-swap.md new file mode 100644 index 000000000..83ccfa62d --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/memory-swap.md @@ -0,0 +1,22 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/memory-swappiness.md b/versioned_docs/version-5.5.2/source/markdown/options/memory-swappiness.md new file mode 100644 index 000000000..5a7a687d3 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/memory-swappiness.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman container clone, create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/memory.md b/versioned_docs/version-5.5.2/source/markdown/options/memory.md new file mode 100644 index 000000000..930b0fff9 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/memory.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, container clone, create, farm build, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/mount.md b/versioned_docs/version-5.5.2/source/markdown/options/mount.md new file mode 100644 index 000000000..e62b59bce --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/mount.md @@ -0,0 +1,133 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--mount**=*type=TYPE,TYPE-SPECIFIC-OPTION[,...]* + +Attach a filesystem mount to the container. + +Current supported mount TYPEs are **artifact**, **bind**, **devpts**, **glob**, **image**, **ramfs**, **tmpfs** and **volume**. + +Options common to all mount types: + +- *src*, *source*: mount source spec for **bind**, **glob**, and **volume**. + Mandatory for **artifact**, **bind**, **glob**, **image** and **volume**. + +- *dst*, *destination*, *target*: mount destination spec. + +When source globs are specified without the destination directory, +the files and directories are mounted with their complete path +within the container. When the destination is specified, the +files and directories matching the glob on the base file name +on the destination directory are mounted. The option +`type=glob,src=/foo*,destination=/tmp/bar` tells container engines +to mount host files matching /foo* to the /tmp/bar/ +directory in the container. + +Options specific to type=**artifact**: + +- *digest*: If the artifact source contains multiple blobs a digest can be + specified to only mount the one specific blob with the digest. + +- *title*: If the artifact source contains multiple blobs a title can be set + which is compared against `org.opencontainers.image.title` annotation. + +The *src* argument contains the name of the artifact, which must already exist locally. +The *dst* argument contains the target path, if the path in the container is a +directory or does not exist the blob title (`org.opencontainers.image.title` +annotation) will be used as filename and joined to the path. If the annotation +does not exist the digest will be used as filename instead. This results in all blobs +of the artifact mounted into the container at the given path. + +However, if the *dst* path is an existing file in the container, then the blob will be +mounted directly on it. This only works when the artifact contains a single blob +or when either *digest* or *title* are specified. + +Options specific to type=**volume**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *idmap*: If specified, create an idmapped mount to the target user namespace in the container. + The idmap option is only supported by Podman in rootful mode. The Linux kernel does not allow the use of idmapped file systems for unprivileged users. + The idmap option supports a custom mapping that can be different than the user namespace used by the container. + The mapping can be specified after the idmap option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the first value is the + start of the backing file system IDs that are mapped to the second value on the host. The length of this mapping is given in the third value. + Multiple ranges are separated with #. If the specified mapping is prepended with a '@', then the mapping is considered relative to the container + user namespace. The host ID for the mapping is changed to account for the relative position of the container user in the container user namespace. + +Options specific to type=**image**: + +- *rw*, *readwrite*: *true* or *false* (default if unspecified: *false*). + +- *subpath*: Mount only a specific path within the image, instead of the whole image. + +Options specific to **bind** and **glob**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *bind-propagation*: *shared*, *slave*, *private*, *unbindable*, *rshared*, *rslave*, *runbindable*, or **rprivate** (default).[[1]](#Footnote1) See also mount(2). + +- *bind-nonrecursive*: do not set up a recursive bind mount. By default it is recursive. + +- *relabel*: *shared*, *private*. + +- *idmap*: *true* or *false* (default if unspecified: *false*). If true, create an idmapped mount to the target user namespace in the container. The idmap option is only supported by Podman in rootful mode. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *no-dereference*: do not dereference symlinks but copy the link source into the mount destination. + +Options specific to type=**tmpfs** and **ramfs**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *tmpfs-size*: Size of the tmpfs/ramfs mount, in bytes. Unlimited by default in Linux. + +- *tmpfs-mode*: Octal file mode of the tmpfs/ramfs (e.g. 700 or 0700.). + +- *tmpcopyup*: Enable copyup from the image directory at the same location to the tmpfs/ramfs. Used by default. + +- *notmpcopyup*: Disable copying files from the image to the tmpfs/ramfs. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +Options specific to type=**devpts**: + +- *uid*: numeric UID of the file owner (default: 0). + +- *gid*: numeric GID of the file owner (default: 0). + +- *mode*: octal permission mask for the file (default: 600). + +- *max*: maximum number of PTYs (default: 1048576). + +Examples: + +- `type=bind,source=/path/on/host,destination=/path/in/container` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared,U=true` + +- `type=devpts,destination=/dev/pts` + +- `type=glob,src=/usr/lib/libfoo*,destination=/usr/lib,ro=true` + +- `type=image,source=fedora,destination=/fedora-image,rw=true` + +- `type=ramfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,destination=/path/in/container,noswap` + +- `type=artifact,src=quay.io/libpod/testartifact:20250206-single,dst=/data` + +- `type=artifact,src=quay.io/libpod/testartifact:20250206-multi,dst=/data,title=test1` diff --git a/versioned_docs/version-5.5.2/source/markdown/options/name.container.md b/versioned_docs/version-5.5.2/source/markdown/options/name.container.md new file mode 100644 index 000000000..37e688ccc --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/name.container.md @@ -0,0 +1,25 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--name**=*name* + +Assign a name to the container. + +The operator can identify a container in three ways: + +- UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”); +- UUID short identifier (“f78375b1c487”); +- Name (“jonah”). + +Podman generates a UUID for each container, and if no name is assigned to the +container using **--name**, Podman generates a random string name. The name can +be useful as a more human-friendly way to identify containers. This works for +both background and foreground containers. The container's name is also added +to the `/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). diff --git a/versioned_docs/version-5.5.2/source/markdown/options/names.md b/versioned_docs/version-5.5.2/source/markdown/options/names.md new file mode 100644 index 000000000..df0d3edff --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/names.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--names**, **-n** + +Output the container names instead of the container IDs in the log. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/network-alias.md b/versioned_docs/version-5.5.2/source/markdown/options/network-alias.md new file mode 100644 index 000000000..a87b719c9 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/network-alias.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--network-alias**=*alias* + +Add a network-scoped alias for the <>, setting the alias for all networks that the container joins. To set a +name only for a specific network, use the alias option as described under the **--network** option. +If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. This option can be specified multiple times. +NOTE: When using CNI a <> only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/network.image.md b/versioned_docs/version-5.5.2/source/markdown/options/network.image.md new file mode 100644 index 000000000..208cef188 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/network.image.md @@ -0,0 +1,68 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--network**=*mode*, **--net** + +Sets the configuration for network namespaces when handling `RUN` instructions. + +Valid _mode_ values are: + +- **none**: no networking. +- **host**: use the Podman host network stack. Note: the host mode gives the +container full access to local system services such as D-bus and is therefore +considered insecure. +- **ns:**_path_: path to a network namespace to join. +- **private**: create a new namespace for the container (default) +- **\**: Join the network with the given name or ID, e.g. use `--network mynet` to join the network with the name mynet. Only supported for rootful users. +- **slirp4netns[\\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=MTU**: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=CIDR**: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=INTERFACE**: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=IPv4**: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=INTERFACE**: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=IPv6**: Specify the outbound ipv6 address slirp binds to. +- **pasta[\\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance diff --git a/versioned_docs/version-5.5.2/source/markdown/options/network.md b/versioned_docs/version-5.5.2/source/markdown/options/network.md new file mode 100644 index 000000000..5097bd076 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/network.md @@ -0,0 +1,99 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, kube play, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--network**=*mode*, **--net** + +Set the network mode for the <>. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + For better integration with DNS handling, **--dns-forward 169.254.1.1** is passed, + and this address is added to resolv.conf(5) as first resolver. It is possible to pass + **--dns-forward** explicitly in case a different IP address should be used. + To make the `host.containers.internal` /etc/hosts entry work and allow connections + to the host, **--map-guest-addr 169.254.1.2** is passed. Again, it can be set + explicitly to choose a different IP address. \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured (via Podman's + **--publish** or by passing the pasta **-t**/**-u** options directly), + to disable automatic port forwarding based on bound ports. Similarly, **-T none** + and **-U none** are given to disable the same functionality from container to + host. \ + All options can also be set in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**; + see the `pasta_options` key under the network section in that file. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance diff --git a/versioned_docs/version-5.5.2/source/markdown/options/no-cache.md b/versioned_docs/version-5.5.2/source/markdown/options/no-cache.md new file mode 100644 index 000000000..5a5f92fe1 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/no-cache.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-cache** + +Do not use existing cached images for the container build. Build from the start with a new set of cached layers. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/no-healthcheck.md b/versioned_docs/version-5.5.2/source/markdown/options/no-healthcheck.md new file mode 100644 index 000000000..3b1c110b1 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/no-healthcheck.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-healthcheck** + +Disable any defined healthchecks for container. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/no-hostname.md b/versioned_docs/version-5.5.2/source/markdown/options/no-hostname.md new file mode 100644 index 000000000..d86021cc2 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/no-hostname.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, create, farm build, kube play, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/no-hosts.md b/versioned_docs/version-5.5.2/source/markdown/options/no-hosts.md new file mode 100644 index 000000000..5ef8a8506 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/no-hosts.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, create, farm build, kube play, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the <>. + +Podman assumes control over the <>'s `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/no-reset.md b/versioned_docs/version-5.5.2/source/markdown/options/no-reset.md new file mode 100644 index 000000000..bc656f861 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/no-reset.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman pod stats, stats +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-reset** + +Do not clear the terminal/screen in between reporting intervals diff --git a/versioned_docs/version-5.5.2/source/markdown/options/no-stream.md b/versioned_docs/version-5.5.2/source/markdown/options/no-stream.md new file mode 100644 index 000000000..a96cb1d22 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/no-stream.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman pod stats, stats +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-stream** + +Disable streaming <<|pod >>stats and only pull the first result, default setting is false diff --git a/versioned_docs/version-5.5.2/source/markdown/options/no-trunc.md b/versioned_docs/version-5.5.2/source/markdown/options/no-trunc.md new file mode 100644 index 000000000..c651c0103 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/no-trunc.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman artifact ls, images +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--no-trunc** + +Do not truncate the output (default *false*). diff --git a/versioned_docs/version-5.5.2/source/markdown/options/noheading.md b/versioned_docs/version-5.5.2/source/markdown/options/noheading.md new file mode 100644 index 000000000..acd0451d2 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/noheading.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman artifact ls, image trust, images, machine list, network ls, pod ps, secret ls, volume ls +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--noheading**, **-n** + +Omit the table headings from the listing. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/omit-history.md b/versioned_docs/version-5.5.2/source/markdown/options/omit-history.md new file mode 100644 index 000000000..af332ebd9 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/omit-history.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--omit-history** + +Omit build history information in the built image. (default false). + +This option is useful for the cases where end users explicitly +want to set `--omit-history` to omit the optional `History` from +built images or when working with images built using build tools that +do not include `History` information in their images. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/oom-kill-disable.md b/versioned_docs/version-5.5.2/source/markdown/options/oom-kill-disable.md new file mode 100644 index 000000000..2b0e371db --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/oom-kill-disable.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--oom-kill-disable** + +Whether to disable OOM Killer for the container or not. + +This flag is not supported on cgroups V2 systems. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/oom-score-adj.md b/versioned_docs/version-5.5.2/source/markdown/options/oom-score-adj.md new file mode 100644 index 000000000..212c52ae8 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/oom-score-adj.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--oom-score-adj**=*num* + +Tune the host's OOM preferences for containers (accepts values from **-1000** to **1000**). + +When running in rootless mode, the specified value can't be lower than +the oom_score_adj for the current process. In this case, the +oom-score-adj is clamped to the current process value. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/os-feature.md b/versioned_docs/version-5.5.2/source/markdown/options/os-feature.md new file mode 100644 index 000000000..a81bd186c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/os-feature.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os-feature**=*feature* + +Set the name of a required operating system *feature* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS feature list is kept, if the base image specified any. This option is typically only meaningful when the image's OS is Windows. + +If *feature* has a trailing `-`, then the *feature* is removed from the set of required features which is listed in the image. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/os-version.image.md b/versioned_docs/version-5.5.2/source/markdown/options/os-version.image.md new file mode 100644 index 000000000..34fd65867 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/os-version.image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os-version**=*version* + +Set the exact required operating system *version* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS version is kept, if the base image specified one. This option is typically only meaningful when the image's OS is Windows, and is typically set in Windows base images, so using this option is usually unnecessary. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/os-version.md b/versioned_docs/version-5.5.2/source/markdown/options/os-version.md new file mode 100644 index 000000000..b6fb738f5 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/os-version.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman manifest add, manifest annotate +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os-version**=*version* + +Specify the OS version which the list or index records as a requirement for the +image. This option is rarely used. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/os.md b/versioned_docs/version-5.5.2/source/markdown/options/os.md new file mode 100644 index 000000000..0d8effc97 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/os.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os**=*string* + +Set the OS of the image to be built, and that of the base image to be pulled, if the build uses one, instead of using the current operating system of the build host. Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/os.pull.md b/versioned_docs/version-5.5.2/source/markdown/options/os.pull.md new file mode 100644 index 000000000..29da4b50a --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/os.pull.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--os**=*OS* + +Override the OS, defaults to hosts, of the image to be pulled. For example, `windows`. +Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/passwd-entry.md b/versioned_docs/version-5.5.2/source/markdown/options/passwd-entry.md new file mode 100644 index 000000000..1a89b46f1 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/passwd-entry.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--passwd-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/passwd` file within the container when `--passwd` is used. + +The variables $USERNAME, $UID, $GID, $NAME, $HOME are automatically replaced with their value at runtime. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/personality.md b/versioned_docs/version-5.5.2/source/markdown/options/personality.md new file mode 100644 index 000000000..5296501e4 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/personality.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--personality**=*persona* + +Personality sets the execution domain via Linux personality(2). diff --git a/versioned_docs/version-5.5.2/source/markdown/options/pid.container.md b/versioned_docs/version-5.5.2/source/markdown/options/pid.container.md new file mode 100644 index 000000000..940011aa0 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/pid.container.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pid**=*mode* + +Set the PID namespace mode for the container. +The default is to create a private PID namespace for the container. + +- **container:**_id_: join another container's PID namespace; +- **host**: use the host's PID namespace for the container. Note the host mode gives the container full access to local PID and is therefore considered insecure; +- **ns:**_path_: join the specified PID namespace; +- **private**: create a new namespace for the container (default). diff --git a/versioned_docs/version-5.5.2/source/markdown/options/pid.image.md b/versioned_docs/version-5.5.2/source/markdown/options/pid.image.md new file mode 100644 index 000000000..a9ea6f909 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/pid.image.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pid**=*pid* + +Sets the configuration for PID namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new PID namespace is created, or it can be "host" to indicate that the PID namespace in which `podman` itself is being run is reused, or it can be the path to a PID namespace which is already in use by another +process. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/pid.pod.md b/versioned_docs/version-5.5.2/source/markdown/options/pid.pod.md new file mode 100644 index 000000000..8f2404c45 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/pid.pod.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pid**=*pid* + +Set the PID mode for the pod. The default is to create a private PID namespace for the pod. Requires the PID namespace to be shared via --share. + + host: use the host’s PID namespace for the pod + ns: join the specified PID namespace + private: create a new namespace for the pod (default) diff --git a/versioned_docs/version-5.5.2/source/markdown/options/pidfile.md b/versioned_docs/version-5.5.2/source/markdown/options/pidfile.md new file mode 100644 index 000000000..144aa8aa7 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/pidfile.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pidfile**=*path* + +When the pidfile location is specified, the container process' PID is written to the pidfile. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +If the pidfile option is not specified, the container process' PID is written to /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile. + +After the container is started, the location for the pidfile can be discovered with the following `podman inspect` command: + + $ podman inspect --format '{{ .PidFile }}' $CID + /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile diff --git a/versioned_docs/version-5.5.2/source/markdown/options/pids-limit.md b/versioned_docs/version-5.5.2/source/markdown/options/pids-limit.md new file mode 100644 index 000000000..a6292cf3b --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/pids-limit.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pids-limit**=*limit* + +Tune the container's pids limit. Set to **-1** to have unlimited pids for the container. The default is **2048** on systems that support "pids" cgroup controller. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/platform.md b/versioned_docs/version-5.5.2/source/markdown/options/platform.md new file mode 100644 index 000000000..d7eefc0cc --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/platform.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with --arch and --os) +The `--platform` option can be used to override the current architecture and operating system. +Unless overridden, subsequent lookups of the same image in the local storage matches this platform, regardless of the host. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/pod-id-file.container.md b/versioned_docs/version-5.5.2/source/markdown/options/pod-id-file.container.md new file mode 100644 index 000000000..4c9b6b56e --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/pod-id-file.container.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pod-id-file**=*file* + +Run container in an existing pod and read the pod's ID from the specified *file*. +When a container is run within a pod which has an infra-container, the infra-container starts first. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/pod-id-file.pod.md b/versioned_docs/version-5.5.2/source/markdown/options/pod-id-file.pod.md new file mode 100644 index 000000000..5e64d0428 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/pod-id-file.pod.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman pod rm, pod start, pod stop +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pod-id-file**=*file* + +Read pod ID from the specified *file* and <> the pod. Can be specified multiple times. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/pod.run.md b/versioned_docs/version-5.5.2/source/markdown/options/pod.run.md new file mode 100644 index 000000000..59bc5e256 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/pod.run.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pod**=*name* + +Run container in an existing pod. Podman makes the pod automatically if the pod name is prefixed with **new:**. +To make a pod with more granular options, use the **podman pod create** command before creating a container. +When a container is run with a pod with an infra-container, the infra-container is started first. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/preserve-fd.md b/versioned_docs/version-5.5.2/source/markdown/options/preserve-fd.md new file mode 100644 index 000000000..f3ddaccf6 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/preserve-fd.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--preserve-fd**=*FD1[,FD2,...]* + +Pass down to the process the additional file descriptors specified in the comma separated list. It can be specified multiple times. +This option is only supported with the crun OCI runtime. It might be a security risk to use this option with other OCI runtimes. + +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.2/source/markdown/options/preserve-fds.md b/versioned_docs/version-5.5.2/source/markdown/options/preserve-fds.md new file mode 100644 index 000000000..180e0d20f --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/preserve-fds.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--preserve-fds**=*N* + +Pass down to the process N additional file descriptors (in addition to 0, 1, 2). +The total FDs are 3+N. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) diff --git a/versioned_docs/version-5.5.2/source/markdown/options/privileged.md b/versioned_docs/version-5.5.2/source/markdown/options/privileged.md new file mode 100644 index 000000000..013c9dce7 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/privileged.md @@ -0,0 +1,28 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--privileged** + +Give extended privileges to this container. The default is **false**. + +By default, Podman containers are unprivileged (**=false**) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read-only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. +Due to the disabled security features, the privileged field should almost never +be set as containers can easily break out of confinement. + +Containers running in a user namespace (e.g., rootless containers) cannot have +more privileges than the user that launched them. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/publish-all.md b/versioned_docs/version-5.5.2/source/markdown/options/publish-all.md new file mode 100644 index 000000000..f3908ed02 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/publish-all.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--publish-all**, **-P** + +Publish all exposed ports to random ports on the host interfaces. The default is **false**. + +When set to **true**, publish all exposed ports to the host interfaces. +If the operator uses **-P** (or **-p**) then Podman makes the +exposed port accessible on the host and the ports are available to any +client that can reach the host. + +When using this option, Podman binds any exposed port to a random port on the host +within an ephemeral port range defined by */proc/sys/net/ipv4/ip_local_port_range*. +To find the mapping between the host ports and the exposed ports, use **podman port**. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/publish.md b/versioned_docs/version-5.5.2/source/markdown/options/publish.md new file mode 100644 index 000000000..ceae8859c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/publish.md @@ -0,0 +1,31 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--publish**, **-p**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Publish a container's port, or range of ports,<<| within this pod>> to the host. + +Both *hostPort* and *containerPort* can be specified as a range of ports. +When specifying ranges for both, the number of container ports in the +range must match the number of host ports in the range. + +If host IP is set to 0.0.0.0 or not set at all, the port is bound on all IPs on the host. + +By default, Podman publishes TCP ports. To publish a UDP port instead, give +`udp` as protocol. To publish both TCP and UDP ports, set `--publish` twice, +with `tcp`, and `udp` as protocols respectively. Rootful containers can also +publish ports using the `sctp` protocol. + +Host port does not have to be specified (e.g. `podman run -p 127.0.0.1::80`). +If it is not, the container port is randomly assigned a port on the host. + +Use **podman port** to see the actual mapping: `podman port $CONTAINER $CONTAINERPORT`. + +Note that the network drivers `macvlan` and `ipvlan` do not support port forwarding, +therefore this option will have no effect on such networks. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/pull.image.md b/versioned_docs/version-5.5.2/source/markdown/options/pull.image.md new file mode 100644 index 000000000..af284efc0 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/pull.image.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Only pull the image when it does not exist in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error when no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/pull.md b/versioned_docs/version-5.5.2/source/markdown/options/pull.md new file mode 100644 index 000000000..5b8312c64 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/pull.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Pull the image only when the image is not in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error if no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/quiet.md b/versioned_docs/version-5.5.2/source/markdown/options/quiet.md new file mode 100644 index 000000000..36bb94531 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/quiet.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--quiet**, **-q** + +Suppress output messages which indicate which instruction is being processed, and of progress when pulling images from a registry, and when writing the output image. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/rdt-class.md b/versioned_docs/version-5.5.2/source/markdown/options/rdt-class.md new file mode 100644 index 000000000..60b59e36f --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/rdt-class.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--rdt-class**=*intel-rdt-class-of-service* + +Rdt-class sets the class of service (CLOS or COS) for the container to run in. Based on the Cache Allocation Technology (CAT) feature that is part of Intel's Resource Director Technology (RDT) feature set, all container processes will run within the pre-configured COS, representing a part of the cache. The COS has to be created and configured using a pseudo file system (usually mounted at `/sys/fs/resctrl`) that the resctrl kernel driver provides. Assigning the container to a COS requires root privileges and thus doesn't work in a rootless environment. Currently, the feature is only supported using `runc` as a runtime. See for more details on creating a COS before a container can be assigned to it. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/read-only-tmpfs.md b/versioned_docs/version-5.5.2/source/markdown/options/read-only-tmpfs.md new file mode 100644 index 000000000..7aa5ff504 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/read-only-tmpfs.md @@ -0,0 +1,31 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--read-only-tmpfs** + +When running --read-only containers, mount a read-write tmpfs on _/dev_, _/dev/shm_, _/run_, _/tmp_, and _/var/tmp_. The default is **true**. + +| --read-only | --read-only-tmpfs | / | /run, /tmp, /var/tmp| +| ----------- | ----------------- | ---- | ----------------------------------- | +| true | true | r/o | r/w | +| true | false | r/o | r/o | +| false | false | r/w | r/w | +| false | true | r/w | r/w | + +When **--read-only=true** and **--read-only-tmpfs=true** additional tmpfs are mounted on +the /tmp, /run, and /var/tmp directories. + +When **--read-only=true** and **--read-only-tmpfs=false** /dev and /dev/shm are marked +Read/Only and no tmpfs are mounted on /tmp, /run and /var/tmp. The directories +are exposed from the underlying image, meaning they are read-only by default. +This makes the container totally read-only. No writable directories exist within +the container. In this mode writable directories need to be added via external +volumes or mounts. + +By default, when **--read-only=false**, the /dev and /dev/shm are read/write, and the /tmp, /run, and /var/tmp are read/write directories from the container image. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/read-only.md b/versioned_docs/version-5.5.2/source/markdown/options/read-only.md new file mode 100644 index 000000000..94021ef33 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/read-only.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--read-only** + +Mount the container's root filesystem as read-only. + +By default, container root filesystems are writable, allowing processes +to write files anywhere. By specifying the **--read-only** flag, the containers root filesystem are mounted read-only prohibiting any writes. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/replace.md b/versioned_docs/version-5.5.2/source/markdown/options/replace.md new file mode 100644 index 000000000..de83f79ea --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/replace.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--replace** + +If another <> with the same name already exists, replace and remove it. The default is **false**. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/requires.md b/versioned_docs/version-5.5.2/source/markdown/options/requires.md new file mode 100644 index 000000000..474617e0c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/requires.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--requires**=*container* + +Specify one or more requirements. +A requirement is a dependency container that is started before this container. +Containers can be specified by name or ID, with multiple containers being separated by commas. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/restart.md b/versioned_docs/version-5.5.2/source/markdown/options/restart.md new file mode 100644 index 000000000..586d5346b --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/restart.md @@ -0,0 +1,27 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run, update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). diff --git a/versioned_docs/version-5.5.2/source/markdown/options/retry-delay.md b/versioned_docs/version-5.5.2/source/markdown/options/retry-delay.md new file mode 100644 index 000000000..e6ec6e82e --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/retry-delay.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, build, create, farm build, pull, push, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/retry.md b/versioned_docs/version-5.5.2/source/markdown/options/retry.md new file mode 100644 index 000000000..03a611daf --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/retry.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, build, create, farm build, pull, push, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/rm.md b/versioned_docs/version-5.5.2/source/markdown/options/rm.md new file mode 100644 index 000000000..9d1deab48 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/rm.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--rm** + +Remove intermediate containers after a successful build (default true). diff --git a/versioned_docs/version-5.5.2/source/markdown/options/rootfs.md b/versioned_docs/version-5.5.2/source/markdown/options/rootfs.md new file mode 100644 index 000000000..11f487d2c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/rootfs.md @@ -0,0 +1,39 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--rootfs** + +If specified, the first argument refers to an exploded container on the file system. + +This is useful to run a container without requiring any image management, the rootfs +of the container is assumed to be managed externally. + + `Overlay Rootfs Mounts` + + The `\:O` flag tells Podman to mount the directory from the rootfs path as +storage using the `overlay file system`. The container processes +can modify content within the mount point which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +Note: On **SELinux** systems, the rootfs needs the correct label, which is by default +**unconfined_u:object_r:container_file_t\\:s0**. + + `idmap` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. +The idmap option supports a custom mapping that can be different than the user +namespace used by the container. The mapping can be specified after the idmap +option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the +first value is the start of the backing file system IDs that are mapped to the +second value on the host. The length of this mapping is given in the third value. +Multiple ranges are separated with #. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/runtime-flag.md b/versioned_docs/version-5.5.2/source/markdown/options/runtime-flag.md new file mode 100644 index 000000000..98c383125 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/runtime-flag.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--runtime-flag**=*flag* + +Adds global flags for the container runtime. To list the supported flags, please consult the manpages of the selected container runtime. + +Note: Do not pass the leading -- to the flag. To pass the runc flag --log-format json to buildah build, the option given is --runtime-flag log-format=json. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/runtime.md b/versioned_docs/version-5.5.2/source/markdown/options/runtime.md new file mode 100644 index 000000000..0d05b697e --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/runtime.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--runtime**=*path* + +The *path* to an alternate OCI-compatible runtime, which is used to run +commands specified by the **RUN** instruction. + +Note: You can also override the default runtime by setting the BUILDAH\_RUNTIME environment variable. `export BUILDAH_RUNTIME=/usr/local/bin/runc` diff --git a/versioned_docs/version-5.5.2/source/markdown/options/sbom-image-output.md b/versioned_docs/version-5.5.2/source/markdown/options/sbom-image-output.md new file mode 100644 index 000000000..2de403fae --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/sbom-image-output.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-image-output**=*path* + +When generating SBOMs, store the generated SBOM in the specified path in the +output image. There is no default. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/sbom-image-purl-output.md b/versioned_docs/version-5.5.2/source/markdown/options/sbom-image-purl-output.md new file mode 100644 index 000000000..4e0e77c2e --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/sbom-image-purl-output.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-image-purl-output**=*path* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the specified path in the output +image. There is no default. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/sbom-merge-strategy.md b/versioned_docs/version-5.5.2/source/markdown/options/sbom-merge-strategy.md new file mode 100644 index 000000000..7713fae99 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/sbom-merge-strategy.md @@ -0,0 +1,29 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-merge-strategy**=*method* + +If more than one **--sbom-scanner-command** value is being used, use the +specified method to merge the output from later commands with output from +earlier commands. Recognized values include: + + - cat + Concatenate the files. + - merge-cyclonedx-by-component-name-and-version + Merge the "component" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "version" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + - merge-spdx-by-package-name-and-versioninfo + Merge the "package" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "versionInfo" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/sbom-output.md b/versioned_docs/version-5.5.2/source/markdown/options/sbom-output.md new file mode 100644 index 000000000..68e2c5681 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/sbom-output.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-output**=*file* + +When generating SBOMs, store the generated SBOM in the named file on the local +filesystem. There is no default. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/sbom-purl-output.md b/versioned_docs/version-5.5.2/source/markdown/options/sbom-purl-output.md new file mode 100644 index 000000000..84c57c2a5 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/sbom-purl-output.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-purl-output**=*file* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the named file in the local +filesystem. There is no default. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/sbom-scanner-command.md b/versioned_docs/version-5.5.2/source/markdown/options/sbom-scanner-command.md new file mode 100644 index 000000000..ddd48817c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/sbom-scanner-command.md @@ -0,0 +1,20 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-scanner-command**=*image* + +Generate SBOMs by running the specified command from the scanner image. If +multiple commands are specified, they are run in the order in which they are +specified. These text substitutions are performed: + - {ROOTFS} + The root of the built image's filesystem, bind mounted. + - {CONTEXT} + The build context and additional build contexts, bind mounted. + - {OUTPUT} + The name of a temporary output file, to be read and merged with others or copied elsewhere. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/sbom-scanner-image.md b/versioned_docs/version-5.5.2/source/markdown/options/sbom-scanner-image.md new file mode 100644 index 000000000..aeeaec071 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/sbom-scanner-image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom-scanner-image**=*image* + +Generate SBOMs using the specified scanner image. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/sbom.md b/versioned_docs/version-5.5.2/source/markdown/options/sbom.md new file mode 100644 index 000000000..197779238 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/sbom.md @@ -0,0 +1,38 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sbom**=*preset* + +Generate SBOMs (Software Bills Of Materials) for the output image by scanning +the working container and build contexts using the named combination of scanner +image, scanner commands, and merge strategy. Must be specified with one or +more of **--sbom-image-output**, **--sbom-image-purl-output**, **--sbom-output**, +and **--sbom-purl-output**. Recognized presets, and the set of options which +they equate to: + + - "syft", "syft-cyclonedx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output cyclonedx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output cyclonedx-json={OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "syft-spdx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output spdx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output spdx-json={OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + - "trivy", "trivy-cyclonedx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "trivy-spdx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo diff --git a/versioned_docs/version-5.5.2/source/markdown/options/sdnotify.md b/versioned_docs/version-5.5.2/source/markdown/options/sdnotify.md new file mode 100644 index 000000000..167be131b --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/sdnotify.md @@ -0,0 +1,21 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sdnotify**=**container** | *conmon* | *healthy* | *ignore* + +Determines how to use the NOTIFY_SOCKET, as passed with systemd and Type=notify. + +Default is **container**, which means allow the OCI runtime to proxy the socket into the +container to receive ready notification. Podman sets the MAINPID to conmon's pid. +The **conmon** option sets MAINPID to conmon's pid, and sends READY when the container +has started. The socket is never passed to the runtime or the container. +The **healthy** option sets MAINPID to conmon's pid, and sends READY when the container +has turned healthy; requires a healthcheck to be set. The socket is never passed to the runtime or the container. +The **ignore** option removes NOTIFY_SOCKET from the environment for itself and child processes, +for the case where some other process above Podman uses NOTIFY_SOCKET and Podman does not use it. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/seccomp-policy.md b/versioned_docs/version-5.5.2/source/markdown/options/seccomp-policy.md new file mode 100644 index 000000000..36544fe1e --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/seccomp-policy.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--seccomp-policy**=*policy* + +Specify the policy to select the seccomp profile. If set to *image*, Podman looks for a "io.containers.seccomp.profile" label in the container-image config and use its value as a seccomp profile. Otherwise, Podman follows the *default* policy by applying the default profile unless specified otherwise via *--security-opt seccomp* as described below. + +Note that this feature is experimental and may change in the future. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/secret.image.md b/versioned_docs/version-5.5.2/source/markdown/options/secret.image.md new file mode 100644 index 000000000..da475e3ca --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/secret.image.md @@ -0,0 +1,28 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--secret**=**id=id[,src=*envOrFile*][,env=*ENV*][,type=*file* | *env*]** + +Pass secret information to be used in the Containerfile for building images +in a safe way that will not end up stored in the final image, or be seen in other stages. +The value of the secret will be read from an environment variable or file named +by the "id" option, or named by the "src" option if it is specified, or from an +environment variable specified by the "env" option. See [EXAMPLES](#examples). +The secret will be mounted in the container at `/run/secrets/id` by default. + +To later use the secret, use the --mount flag in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret` + +The location of the secret in the container can be overridden using the +"target", "dst", or "destination" option of the `RUN --mount` flag. + +`RUN --mount=type=secret,id=mysecret,target=/run/secrets/myothersecret cat /run/secrets/myothersecret` + +Note: changing the contents of secret files will not trigger a rebuild of layers that use said secrets. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/secret.md b/versioned_docs/version-5.5.2/source/markdown/options/secret.md new file mode 100644 index 000000000..6ccdd3687 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/secret.md @@ -0,0 +1,59 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--secret**=*secret[,opt=opt ...]* + +Give the container access to a secret. Can be specified multiple times. + +A secret is a blob of sensitive data which a container needs at runtime but +is not stored in the image or in source control, such as usernames and passwords, +TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 512 kB in size). + +When secrets are specified as type `mount`, the secrets are copied and mounted into the container when a container is created. +When secrets are specified as type `env`, the secret is set as an environment variable within the container. +Secrets are written in the container at the time of container creation, and modifying the secret using `podman secret` commands +after the container is created affects the secret inside the container. + +Secrets and its storage are managed using the `podman secret` command. + +Secret Options + +- `type=mount|env` : How the secret is exposed to the container. + `mount` mounts the secret into the container as a file. + `env` exposes the secret as an environment variable. + Defaults to `mount`. +- `target=target` : Target of secret. + For mounted secrets, this is the path to the secret inside the container. + If a fully qualified path is provided, the secret is mounted at that location. + Otherwise, the secret is mounted to + `/run/secrets/target` for Linux containers or + `/var/run/secrets/target` for FreeBSD containers. + If the target is not set, the secret is mounted to `/run/secrets/secretname` by default. + For env secrets, this is the environment variable key. Defaults to `secretname`. +- `uid=0` : UID of secret. Defaults to 0. Mount secret type only. +- `gid=0` : GID of secret. Defaults to 0. Mount secret type only. +- `mode=0` : Mode of secret. Defaults to 0444. Mount secret type only. + + +Examples + +Mount at `/my/location/mysecret` with UID 1: +``` +--secret mysecret,target=/my/location/mysecret,uid=1 +``` + +Mount at `/run/secrets/customtarget` with mode 0777: +``` +--secret mysecret,target=customtarget,mode=0777 +``` + +Create a secret environment variable called `ENVSEC`: +``` +--secret mysecret,type=env,target=ENVSEC +``` diff --git a/versioned_docs/version-5.5.2/source/markdown/options/security-opt.image.md b/versioned_docs/version-5.5.2/source/markdown/options/security-opt.image.md new file mode 100644 index 000000000..13e27ca21 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/security-opt.image.md @@ -0,0 +1,27 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--security-opt**=*option* + +Security Options + +- `apparmor=unconfined` : Turn off apparmor confinement for the container +- `apparmor=alternate-profile` : Set the apparmor confinement profile for the +container + +- `label=user:USER` : Set the label user for the container processes +- `label=role:ROLE` : Set the label role for the container processes +- `label=type:TYPE` : Set the label process type for the container processes +- `label=level:LEVEL` : Set the label level for the container processes +- `label=filetype:TYPE` : Set the label file type for the container files +- `label=disable` : Turn off label separation for the container +- `no-new-privileges` : Disable container processes from gaining additional privileges + +- `seccomp=unconfined` : Turn off seccomp confinement for the container +- `seccomp=profile.json` : JSON file to be used as the seccomp filter for the container. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/security-opt.md b/versioned_docs/version-5.5.2/source/markdown/options/security-opt.md new file mode 100644 index 000000000..789927317 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/security-opt.md @@ -0,0 +1,41 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the <> +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the <> + +- **label=user:**_USER_: Set the label user for the <> processes +- **label=role:**_ROLE_: Set the label role for the <> processes +- **label=type:**_TYPE_: Set the label process type for the <> processes +- **label=level:**_LEVEL_: Set the label level for the <> processes +- **label=filetype:**_TYPE_: Set the label file type for the <> files +- **label=disable**: Turn off label separation for the <> + +Note: Labeling can be disabled for all <<|pods/>>containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the container<>. + +- **no-new-privileges**: Disable container processes from gaining additional privileges through the `execve(2)` system call (e.g. via setuid or setgid bits, or via file capabilities). Programs that rely on setuid/setgid bits set on their executable to change user id or group id are no longer able to do so, and any file capabilities added to the executable (e.g. via `setcap`) are not added to the permitted capability set. For more details, see: https://docs.kernel.org/userspace-api/no_new_privs.html. + +- **seccomp=unconfined**: Turn off seccomp confinement for the <>. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/shm-size-systemd.md b/versioned_docs/version-5.5.2/source/markdown/options/shm-size-systemd.md new file mode 100644 index 000000000..0f6ae4c74 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/shm-size-systemd.md @@ -0,0 +1,15 @@ +--- +title: of +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/shm-size.md b/versioned_docs/version-5.5.2/source/markdown/options/shm-size.md new file mode 100644 index 000000000..cf8987572 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/shm-size.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, create, farm build, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the <>. +This option conflicts with **--ipc=host**. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/sig-proxy.md b/versioned_docs/version-5.5.2/source/markdown/options/sig-proxy.md new file mode 100644 index 000000000..a3e109e8d --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/sig-proxy.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman attach, run, start +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sig-proxy** + +Proxy received signals to the container process. SIGCHLD, SIGURG, SIGSTOP, and SIGKILL are not proxied. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/sign-by-sigstore.md b/versioned_docs/version-5.5.2/source/markdown/options/sign-by-sigstore.md new file mode 100644 index 000000000..661dc9b0a --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/sign-by-sigstore.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman artifact push, manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sign-by-sigstore**=*param-file* + +Add a sigstore signature based on further options specified in a container's sigstore signing parameter file *param-file*. +See containers-sigstore-signing-params.yaml(5) for details about the file format. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/sign-passphrase-file.md b/versioned_docs/version-5.5.2/source/markdown/options/sign-passphrase-file.md new file mode 100644 index 000000000..bce6b392d --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/sign-passphrase-file.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman artifact push, manifest push, push +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sign-passphrase-file**=*path* + +If signing the image (using either **--sign-by** or **--sign-by-sigstore-private-key**), read the passphrase to use from the specified path. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/signal.md b/versioned_docs/version-5.5.2/source/markdown/options/signal.md new file mode 100644 index 000000000..c99ebd300 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/signal.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman kill, pod kill +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--signal**, **-s**=**signal** + +Signal to send to the container<<|s in the pod>>. For more information on Linux signals, refer to *signal(7)*. +The default is **SIGKILL**. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/since.md b/versioned_docs/version-5.5.2/source/markdown/options/since.md new file mode 100644 index 000000000..7015b6d01 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/since.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--since**=*TIMESTAMP* + +Show logs since TIMESTAMP. The --since option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/skip-unused-stages.md b/versioned_docs/version-5.5.2/source/markdown/options/skip-unused-stages.md new file mode 100644 index 000000000..11928e81b --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/skip-unused-stages.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--skip-unused-stages** + +Skip stages in multi-stage builds which don't affect the target stage. (Default: **true**). diff --git a/versioned_docs/version-5.5.2/source/markdown/options/squash-all.md b/versioned_docs/version-5.5.2/source/markdown/options/squash-all.md new file mode 100644 index 000000000..c878d852e --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/squash-all.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--squash-all** + +Squash all of the new image's layers (including those inherited from a base image) into a single new layer. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/squash.md b/versioned_docs/version-5.5.2/source/markdown/options/squash.md new file mode 100644 index 000000000..04985c975 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/squash.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--squash** + +Squash all of the image's new layers into a single new layer; any preexisting layers are not squashed. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/ssh.md b/versioned_docs/version-5.5.2/source/markdown/options/ssh.md new file mode 100644 index 000000000..37a43d858 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/ssh.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ssh**=*default* | *id[=socket>* + +SSH agent socket or keys to expose to the build. +The socket path can be left empty to use the value of `default=$SSH_AUTH_SOCK` + +To later use the ssh agent, use the --mount option in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=ssh,id=id mycmd` diff --git a/versioned_docs/version-5.5.2/source/markdown/options/stop-signal.md b/versioned_docs/version-5.5.2/source/markdown/options/stop-signal.md new file mode 100644 index 000000000..457fa1cd8 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/stop-signal.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--stop-signal**=*signal* + +Signal to stop a container. Default is **SIGTERM**. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/stop-timeout.md b/versioned_docs/version-5.5.2/source/markdown/options/stop-timeout.md new file mode 100644 index 000000000..9e428f5ed --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/stop-timeout.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--stop-timeout**=*seconds* + +Timeout to stop a container. Default is **10**. +Remote connections use local containers.conf for defaults. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/subgidname.md b/versioned_docs/version-5.5.2/source/markdown/options/subgidname.md new file mode 100644 index 000000000..dfa042f04 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/subgidname.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/subuidname.md b/versioned_docs/version-5.5.2/source/markdown/options/subuidname.md new file mode 100644 index 000000000..98a532c5a --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/subuidname.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/sysctl.md b/versioned_docs/version-5.5.2/source/markdown/options/sysctl.md new file mode 100644 index 000000000..5d86768bc --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/sysctl.md @@ -0,0 +1,30 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters <>. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: <>, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: <>, the above sysctls are not allowed. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/systemd.md b/versioned_docs/version-5.5.2/source/markdown/options/systemd.md new file mode 100644 index 000000000..b0a94a09b --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/systemd.md @@ -0,0 +1,42 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--systemd**=*true* | *false* | *always* + +Run container in systemd mode. The default is **true**. + +- **true** enables systemd mode only when the command executed inside the container is *systemd*, */usr/sbin/init*, +*/sbin/init* or */usr/local/sbin/init*. + +- **false** disables systemd mode. + +- **always** enforces the systemd mode to be enabled. + +Running the container in systemd mode causes the following changes: + +* Podman mounts tmpfs file systems on the following directories + * _/run_ + * _/run/lock_ + * _/tmp_ + * _/sys/fs/cgroup/systemd_ (on a cgroup v1 system) + * _/var/lib/journal_ +* Podman sets the default stop signal to **SIGRTMIN+3**. +* Podman sets **container_uuid** environment variable in the container to the +first 32 characters of the container ID. +* Podman does not mount virtual consoles (_/dev/tty\d+_) when running with **--privileged**. +* On cgroup v2, */sys/fs/cgroup* is mounted writable. + +This allows systemd to run in a confined container without any modifications. + +Note that on **SELinux** systems, systemd attempts to write to the cgroup +file system. Containers writing to the cgroup file system are denied by default. +The **container_manage_cgroup** boolean must be enabled for this to be allowed on an SELinux separated system. +``` +setsebool -P container_manage_cgroup true +``` diff --git a/versioned_docs/version-5.5.2/source/markdown/options/tag.md b/versioned_docs/version-5.5.2/source/markdown/options/tag.md new file mode 100644 index 000000000..c8fc8609c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/tag.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tag**, **-t**=*imageName* + +Specifies the name which is assigned to the resulting image if the build process completes successfully. +If _imageName_ does not include a registry name, the registry name *localhost* is prepended to the image name. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/tail.md b/versioned_docs/version-5.5.2/source/markdown/options/tail.md new file mode 100644 index 000000000..15ebd0e19 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/tail.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tail**=*LINES* + +Output the specified number of LINES at the end of the logs. LINES must be an integer. Defaults to -1, +which prints all lines diff --git a/versioned_docs/version-5.5.2/source/markdown/options/target.md b/versioned_docs/version-5.5.2/source/markdown/options/target.md new file mode 100644 index 000000000..05657b2c2 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/target.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--target**=*stageName* + +Set the target build stage to build. When building a Containerfile with multiple build stages, --target can be used to specify an intermediate build stage by name as the final stage for the resulting image. Commands after the target stage is skipped. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/time.md b/versioned_docs/version-5.5.2/source/markdown/options/time.md new file mode 100644 index 000000000..66e176eeb --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/time.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman pod rm, pod stop, restart, rm, stop +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping <>. +Use -1 for infinite wait. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/timeout.md b/versioned_docs/version-5.5.2/source/markdown/options/timeout.md new file mode 100644 index 000000000..f77a7211b --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/timeout.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--timeout**=*seconds* + +Maximum time a container is allowed to run before conmon sends it the kill +signal. By default containers run until they exit or are stopped by +`podman stop`. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/timestamp.md b/versioned_docs/version-5.5.2/source/markdown/options/timestamp.md new file mode 100644 index 000000000..7f1eedcf3 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/timestamp.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--timestamp**=*seconds* + +Set the create timestamp to seconds since epoch to allow for deterministic builds (defaults to current time). By default, the created timestamp is changed and written into the image manifest with every commit, causing the image's sha256 hash to be different even if the sources are exactly the same otherwise. +When --timestamp is set, the created timestamp is always set to the time specified and therefore not changed, allowing the image's sha256 hash to remain the same. All files committed to the layers of the image is created with the timestamp. + +If the only instruction in a Containerfile is `FROM`, this flag has no effect. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/timestamps.md b/versioned_docs/version-5.5.2/source/markdown/options/timestamps.md new file mode 100644 index 000000000..9ffec1736 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/timestamps.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--timestamps**, **-t** + +Show timestamps in the log outputs. The default is false diff --git a/versioned_docs/version-5.5.2/source/markdown/options/tls-verify.md b/versioned_docs/version-5.5.2/source/markdown/options/tls-verify.md new file mode 100644 index 000000000..07e9e1547 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/tls-verify.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman artifact pull, artifact push, auto update, build, container runlabel, create, farm build, kube play, login, manifest add, manifest create, manifest inspect, manifest push, pull, push, run, search +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/options/tmpfs.md b/versioned_docs/version-5.5.2/source/markdown/options/tmpfs.md new file mode 100644 index 000000000..864ee05b4 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/tmpfs.md @@ -0,0 +1,23 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tmpfs**=*fs* + +Create a tmpfs mount. + +Mount a temporary filesystem (**tmpfs**) mount into a container, for example: + +``` +$ podman <> -d --tmpfs /tmp\:rw,size=787448k,mode=1777 my_image +``` + +This command mounts a **tmpfs** at _/tmp_ within the container. The supported mount +options are the same as the Linux default mount flags. If no options are specified, +the system uses the following options: +**rw,noexec,nosuid,nodev**. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/tty.md b/versioned_docs/version-5.5.2/source/markdown/options/tty.md new file mode 100644 index 000000000..b5aadf6fd --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/tty.md @@ -0,0 +1,18 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tty**, **-t** + +Allocate a pseudo-TTY. The default is **false**. + +When set to **true**, Podman allocates a pseudo-tty and attach to the standard +input of the container. This can be used, for example, to run a throwaway +interactive shell. + +**NOTE**: The --tty flag prevents redirection of standard output. It combines STDOUT and STDERR, it can insert control characters, and it can hang pipes. This option is only used when run interactively in a terminal. When feeding input to Podman, use -i only, not -it. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/tz.md b/versioned_docs/version-5.5.2/source/markdown/options/tz.md new file mode 100644 index 000000000..ae9d6b38e --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/tz.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--tz**=*timezone* + +Set timezone in container. This flag takes area-based timezones, GMT time, as well as `local`, which sets the timezone in the container to match the host machine. See `/usr/share/zoneinfo/` for valid timezones. +Remote connections use local containers.conf for defaults diff --git a/versioned_docs/version-5.5.2/source/markdown/options/uidmap.container.md b/versioned_docs/version-5.5.2/source/markdown/options/uidmap.container.md new file mode 100644 index 000000000..2b89c8fd9 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/uidmap.container.md @@ -0,0 +1,201 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uidmap**=*[flags]container_uid\:from_uid[\\:amount]* + +Run the container in a new user namespace using the supplied UID mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +The possible values of the optional *flags* are discussed further down on this page. +The *amount* value is optional and assumed to be **1** if not given. + +The *from_uid* value is based upon the user running the command, either rootful or rootless users. + +* rootful user: [*flags*]*container_uid*:*host_uid*[:*amount*] +* rootless user: [*flags*]*container_uid*:*intermediate_uid*[:*amount*] + + `Rootful mappings` + + +When **podman <>** is called by a privileged user, the option **--uidmap** +works as a direct mapping between host UIDs and container UIDs. + +host UID -> container UID + +The _amount_ specifies the number of consecutive UIDs that is mapped. +If for example _amount_ is **4** the mapping looks like: + +| host UID | container UID | +| ---------- | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | + + `Rootless mappings` + +When **podman <>** is called by an unprivileged user (i.e. running rootless), +the value *from_uid* is interpreted as an "intermediate UID". In the rootless +case, host UIDs are not mapped directly to container UIDs. Instead the mapping +happens over two mapping steps: + +host UID -> intermediate UID -> container UID + +The **--uidmap** option only influences the second mapping step. + +The first mapping step is derived by Podman from the contents of the file +_/etc/subuid_ and the UID of the user calling Podman. + +First mapping step: + +| host UID | intermediate UID | +| -------- | ---------------- | +| UID for Podman user | 0 | +| 1st subordinate UID | 1 | +| 2nd subordinate UID | 2 | +| 3rd subordinate UID | 3 | +| nth subordinate UID | n | + +To be able to use intermediate UIDs greater than zero, the user needs to have +subordinate UIDs configured in _/etc/subuid_. See **subuid**(5). + +The second mapping step is configured with **--uidmap**. + +If for example _amount_ is **5** the second mapping step looks like: + +| intermediate UID | container UID | +| ------------------ | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | +| *from_uid* + 4 | *container_uid* + 4 | + +When running as rootless, Podman uses all the ranges configured in the _/etc/subuid_ file. + +The current user ID is mapped to UID=0 in the rootless user namespace. +Every additional range is added sequentially afterward: + +| host | rootless user namespace | length | +| ------ | ----------------------- | ------ | +| $UID | 0 | 1 | +| 1 | $FIRST_RANGE_ID | $FIRST_RANGE_LENGTH | +| 1+$FIRST_RANGE_LENGTH | $SECOND_RANGE_ID | $SECOND_RANGE_LENGTH| + + `Referencing a host ID from the parent namespace` + +As a rootless user, the given host ID in **--uidmap** or **--gidmap** +is mapped from the *intermediate namespace* generated by Podman. Sometimes +it is desirable to refer directly at the *host namespace*. It is possible +to manually do so, by running `podman unshare cat /proc/self/gid_map`, +finding the desired host id at the second column of the output, and getting +the corresponding intermediate id from the first column. + +Podman can perform all that by preceding the host id in the mapping +with the `@` symbol. For instance, by specifying `--gidmap 100000:@2000:1`, +podman will look up the intermediate id corresponding to host id `2000` and +it will map the found intermediate id to the container id `100000`. The +given host id must have been subordinated (otherwise it would not be mapped +into the intermediate space in the first place). + +If the length is greater than one, for instance with `--gidmap 100000:@2000:2`, +Podman will map host ids `2000` and `2001` to `100000` and `100001`, respectively, +regardless of how the intermediate mapping is defined. + + `Extending previous mappings` + +Some mapping modifications may be cumbersome. For instance, a user +starts with a mapping such as `--gidmap="0:0:65000"`, that needs to be +changed such as the parent id `1000` is mapped to container id `100000` +instead, leaving container id `1` unassigned. The corresponding `--gidmap` +becomes `--gidmap="0:0:1" --gidmap="2:2:65534" --gidmap="100000:1:1"`. + +This notation can be simplified using the `+` flag, that takes care of +breaking previous mappings removing any conflicting assignment with +the given mapping. The flag is given before the container id +as follows: `--gidmap="0:0:65000" --gidmap="+100000:1:1"` + + + Flag | Example | Description +-----------|---------------|------------- + `+` | `+100000:1:1` | Extend the previous mapping + +This notation leads to gaps in the assignment, so it may be convenient to +fill those gaps afterwards: `--gidmap="0:0:65000" --gidmap="+100000:1:1" --gidmap="1:65001:1"` + +One specific use case for this flag is in the context of rootless +users. A rootless user may specify mappings with the `+` flag as +in `--gidmap="+100000:1:1"`. Podman will then "fill the gaps" starting +from zero with all the remaining intermediate ids. This is convenient when +a user wants to map a specific intermediate id to a container id, leaving +the rest of subordinate ids to be mapped by Podman at will. + + `Passing only one of --uidmap or --gidmap` + +Usually, subordinated user and group ids are assigned simultaneously, and +for any user the subordinated user ids match the subordinated group ids. +For convenience, if only one of **--uidmap** or **--gidmap** is given, +podman assumes the mapping refers to both UIDs and GIDs and applies the +given mapping to both. If only one value of the two needs to be changed, +the mappings should include the `u` or the `g` flags to specify that +they only apply to UIDs or GIDs and should not be copied over. + + flag | Example | Description +---------|-----------------|----------------- + `u` | `u20000:2000:1` |The mapping only applies to UIDs + `g` | `g10000:1000:1` |The mapping only applies to GIDs + +For instance given the command + + podman <> --gidmap "0:0:1000" --gidmap "g2000:2000:1" + +Since no **--uidmap** is given, the **--gidmap** is copied to **--uidmap**, +giving a command equivalent to + + podman <> --gidmap "0:0:1000" --gidmap "2000:2000:1" --uidmap "0:0:1000" + +The `--gidmap "g2000:2000:1"` used the `g` flag and therefore it was +not copied to **--uidmap**. + + `Rootless mapping of additional host GIDs` + +A rootless user may desire to map a specific host group that has already been +subordinated within _/etc/subgid_ without specifying the rest of the mapping. + +This can be done with **--gidmap "+g*container_gid*:@*host_gid*"** + +Where: + +- The host GID is given through the `@` symbol +- The mapping of this GID is not copied over to **--usermap** thanks to the `g` flag. +- The rest of the container IDs will be mapped starting from 0 to n, + with all the remaining subordinated GIDs, thanks to the `+` flag. + +For instance, if a user belongs to the group `2000` and that group is +subordinated to that user (with `usermod --add-subgids 2000-2000 $USER`), +the user can map the group into the container with: **--gidmap=+g100000:@2000**. + +If this mapping is combined with the option, **--group-add=keep-groups**, the +process in the container will belong to group `100000`, and files belonging +to group `2000` in the host will appear as being owned by group `100000` +inside the container. + + podman run --group-add=keep-groups --gidmap="+g100000:@2000" ... + + `No subordinate UIDs` + +Even if a user does not have any subordinate UIDs in _/etc/subuid_, +**--uidmap** can be used to map the normal UID of the user to a +container UID by running `podman <> --uidmap $container_uid:0:1 --user $container_uid ...`. + + `Pods` + +The **--uidmap** option cannot be called in conjunction with the **--pod** option as a uidmap cannot be set on the container level when in a pod. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/uidmap.pod.md b/versioned_docs/version-5.5.2/source/markdown/options/uidmap.pod.md new file mode 100644 index 000000000..c5550b4d0 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/uidmap.pod.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uidmap**=*container_uid\:from_uid\\:amount* + +Run all containers in the pod in a new user namespace using the supplied mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/ulimit.image.md b/versioned_docs/version-5.5.2/source/markdown/options/ulimit.image.md new file mode 100644 index 000000000..359501513 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/ulimit.image.md @@ -0,0 +1,27 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ulimit**=*type=soft-limit[\\:hard-limit]* + +Specifies resource limits to apply to processes launched when processing `RUN` instructions. This option can be specified multiple times. Recognized resource types include: + "core": maximum core dump size (ulimit -c) + "cpu": maximum CPU time (ulimit -t) + "data": maximum size of a process's data segment (ulimit -d) + "fsize": maximum size of new files (ulimit -f) + "locks": maximum number of file locks (ulimit -x) + "memlock": maximum amount of locked memory (ulimit -l) + "msgqueue": maximum amount of data in message queues (ulimit -q) + "nice": niceness adjustment (nice -n, ulimit -e) + "nofile": maximum number of open files (ulimit -n) + "nproc": maximum number of processes (ulimit -u) + "rss": maximum size of a process's (ulimit -m) + "rtprio": maximum real-time scheduling priority (ulimit -r) + "rttime": maximum amount of real-time execution between blocking syscalls + "sigpending": maximum number of pending signals (ulimit -i) + "stack": maximum stack size (ulimit -s) diff --git a/versioned_docs/version-5.5.2/source/markdown/options/ulimit.md b/versioned_docs/version-5.5.2/source/markdown/options/ulimit.md new file mode 100644 index 000000000..4a50317d8 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/ulimit.md @@ -0,0 +1,33 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--ulimit**=*option* + +Ulimit options. Sets the ulimits values inside of the container. + +--ulimit with a soft and hard limit in the format =[:]. For example: + +$ podman run --ulimit nofile=1024:1024 --rm ubi9 ulimit -n +1024 + +Set -1 for the soft or hard limit to set the limit to the maximum limit of the current +process. In rootful mode this is often unlimited. + + +If nofile and nproc are unset, a default value of 1048576 will be used, unless overridden +in containers.conf(5). However, if the default value exceeds the hard limit for the current +rootless user, the current hard limit will be applied instead. + +Use **host** to copy the current configuration from the host. + +Don't use nproc with the ulimit flag as Linux uses nproc to set the +maximum number of processes available to a user, not to a container. + +Use the --pids-limit option to modify the cgroup control to limit the number +of processes within a container. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/umask.md b/versioned_docs/version-5.5.2/source/markdown/options/umask.md new file mode 100644 index 000000000..588475096 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/umask.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--umask**=*umask* + +Set the umask inside the container. Defaults to `0022`. +Remote connections use the local `containers.conf` for defaults. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/unsetenv-all.md b/versioned_docs/version-5.5.2/source/markdown/options/unsetenv-all.md new file mode 100644 index 000000000..7b23d9e75 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/unsetenv-all.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetenv-all** + +Unset all default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/unsetenv.image.md b/versioned_docs/version-5.5.2/source/markdown/options/unsetenv.image.md new file mode 100644 index 000000000..67b62e7d8 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/unsetenv.image.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetenv**=*env* + +Unset environment variables from the final image. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/unsetenv.md b/versioned_docs/version-5.5.2/source/markdown/options/unsetenv.md new file mode 100644 index 000000000..4e96bf84c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/unsetenv.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetenv**=*env* + +Unset default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/unsetenv.update.md b/versioned_docs/version-5.5.2/source/markdown/options/unsetenv.update.md new file mode 100644 index 000000000..f34bb6317 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/unsetenv.update.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman update +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetenv**=*env* + +Unset environment variables from the container. + +Note that the env updates only affect the main container process after +the next start. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/unsetlabel.md b/versioned_docs/version-5.5.2/source/markdown/options/unsetlabel.md new file mode 100644 index 000000000..17358a53e --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/unsetlabel.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--unsetlabel**=*label* + +Unset the image label, causing the label not to be inherited from the base image. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/until.md b/versioned_docs/version-5.5.2/source/markdown/options/until.md new file mode 100644 index 000000000..508f49f0d --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/until.md @@ -0,0 +1,15 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman logs, pod logs +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--until**=*TIMESTAMP* + +Show logs until TIMESTAMP. The --until option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/user-mode-networking.md b/versioned_docs/version-5.5.2/source/markdown/options/user-mode-networking.md new file mode 100644 index 000000000..a585bed56 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/user-mode-networking.md @@ -0,0 +1,26 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman machine init, machine set +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--user-mode-networking** + +Indicates that this machine relays traffic from the guest through a user-space +process running on the host. In some VPN configurations the VPN may drop +traffic from alternate network interfaces, including VM network devices. By +enabling user-mode networking (a setting of `true`), VPNs observe all +podman machine traffic as coming from the host, bypassing the problem. + +When the qemu backend is used (Linux, Mac), user-mode networking is +mandatory and the only allowed value is `true`. In contrast, The Windows/WSL +backend defaults to `false`, and follows the standard WSL network setup. +Changing this setting to `true` on Windows/WSL informs Podman to replace +the WSL networking setup on start of this machine instance with a user-mode +networking distribution. Since WSL shares the same kernel across +distributions, all other running distributions reuses this network. +Likewise, when the last machine instance with a `true` setting stops, the +original networking setup is restored. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/user.md b/versioned_docs/version-5.5.2/source/markdown/options/user.md new file mode 100644 index 000000000..29a321844 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/user.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--user**, **-u**=*user[\:group]* + +Sets the username or UID used and, optionally, the groupname or GID for the specified command. Both *user* and *group* may be symbolic or numeric. + +Without this argument, the command runs as the user specified in the container image. Unless overridden by a `USER` command in the Containerfile or by a value passed to this option, this user generally defaults to root. + +When a user namespace is not in use, the UID and GID used within the container and on the host match. When user namespaces are in use, however, the UID and GID in the container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container by default corresponds to the UID and GID of the user invoking Podman. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/userns-gid-map-group.md b/versioned_docs/version-5.5.2/source/markdown/options/userns-gid-map-group.md new file mode 100644 index 000000000..7f68fa400 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/userns-gid-map-group.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns-gid-map-group**=*group* + +Specifies that a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subgid` file which correspond to the specified group. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-uid-map-user is specified, but --userns-gid-map-group is not specified, `podman` assumes that the specified user name is also a +suitable group name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/userns-gid-map.md b/versioned_docs/version-5.5.2/source/markdown/options/userns-gid-map.md new file mode 100644 index 000000000..89a953bfe --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/userns-gid-map.md @@ -0,0 +1,24 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns-gid-map**=*mapping* + +Directly specifies a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container GID, a corresponding starting host-level GID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-gids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-gid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-gid-map are specified, but --userns-uid-map is specified, the GID map is set to use the same numeric values as the UID map. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/userns-uid-map-user.md b/versioned_docs/version-5.5.2/source/markdown/options/userns-uid-map-user.md new file mode 100644 index 000000000..0e1f8f021 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/userns-uid-map-user.md @@ -0,0 +1,19 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns-uid-map-user**=*user* + +Specifies that a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subuid` file which correspond to the specified user. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-gid-map-group is specified, but --userns-uid-map-user is not specified, `podman` assumes that the specified group name is also a +suitable user name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/userns-uid-map.md b/versioned_docs/version-5.5.2/source/markdown/options/userns-uid-map.md new file mode 100644 index 000000000..e6bc58353 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/userns-uid-map.md @@ -0,0 +1,24 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns-uid-map**=*mapping* + +Directly specifies a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions default to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container UID, a corresponding starting host-level UID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-uids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-uid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-uid-map are specified, but --userns-gid-map is specified, the UID map is set to use the same numeric values as the GID map. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/userns.container.md b/versioned_docs/version-5.5.2/source/markdown/options/userns.container.md new file mode 100644 index 000000000..405bb4809 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/userns.container.md @@ -0,0 +1,74 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, kube play, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns**=*mode* + +Set the user namespace mode for the container. + +If `--userns` is not set, the default value is determined as follows. +- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used. +- If the environment variable **PODMAN_USERNS** is set its value is used. +- If `userns` is specified in `containers.conf` this value is used. +- Otherwise, `--userns=host` is assumed. + +`--userns=""` (i.e., an empty string) is an alias for `--userns=host`. + +This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +------------------------|-----------|--------------------- +auto | $UID | nil (Host User UID is not mapped into container.) +host | $UID | 0 (Default User account mapped to root user in container.) +keep-id | $UID | $UID (Map user account to same UID within container.) +keep-id\:uid=200,gid=210 | $UID | 200:210 (Map user account to specified UID, GID value within container.) +nomap | $UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + +**auto**[\:_OPTIONS,..._]: automatically create a unique user namespace. + +* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. + + Example: `containers:2147483647:2147483648`. + +* `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5). + +Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user IDs. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. + +The option `--userns=keep-id` uses all the subuids and subgids of the user. +The option `--userns=nomap` uses all the subuids and subgids of the user except the user's own ID. +Using `--userns=auto` when starting new containers does not work as long as any containers exist that were started with `--userns=nomap` or `--userns=keep-id` without limiting the user namespace size. + + Valid `auto` options: + + - *gidmapping*=_CONTAINER\_GID\:HOST\_GID\:SIZE_: to force a GID mapping to be present in the user namespace. + - *size*=_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates a size for the user namespace. + - *uidmapping*=_CONTAINER\_UID\:HOST\_UID\:SIZE_: to force a UID mapping to be present in the user namespace. + +The host UID and GID in *gidmapping* and *uidmapping* can optionally be prefixed with the `@` symbol. +In this case, podman will look up the intermediate ID corresponding to host ID and it will map the found intermediate ID to the container id. +For details see **--uidmap**. + +**container:**_id_: join the user namespace of the specified container. + +**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user. + +**keep-id**: creates a user namespace where the current user's UID\:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace. + + Valid `keep-id` options: + + - *uid*=UID: override the UID inside the container that is used to map the current user to. + - *gid*=GID: override the GID inside the container that is used to map the current user to. + - *size*=SIZE: override the size of the configured user namespace. It is useful to not saturate all the available IDs. Not supported when running as root. + +**nomap**: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +**ns:**_namespace_: run the <> in the given existing user namespace. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/userns.image.md b/versioned_docs/version-5.5.2/source/markdown/options/userns.image.md new file mode 100644 index 000000000..12a05ba57 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/userns.image.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns**=*how* + +Sets the configuration for user namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new user namespace is created, it can be "host" to indicate that the user namespace in which `podman` itself is being run is reused, or it can be the path to a user namespace which is already in use by another process. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/userns.pod.md b/versioned_docs/version-5.5.2/source/markdown/options/userns.pod.md new file mode 100644 index 000000000..9c0dc646c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/userns.pod.md @@ -0,0 +1,38 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--userns**=*mode* + +Set the user namespace mode for all the containers in a pod. It defaults to the `PODMAN_USERNS` environment variable. An empty value ("") means user namespaces are disabled. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +----------|---------------|--------------------- +"" |$UID |0 (Default User account mapped to root user in container.) +host |$UID |0 (Default User account mapped to root user in container.) +keep-id |$UID |$UID (Map user account to same UID within container.) +auto |$UID | nil (Host User UID is not mapped into container.) +nomap |$UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + + - *auto[:*_OPTIONS,..._*]*: automatically create a namespace. It is possible to specify these options to `auto`: + + - *gidmapping=*_CONTAINER\_GID\:HOST\_GID\:SIZE_ to force a GID mapping to be present in the user namespace. + + - *size=*_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates the size for the user namespace. + + - *uidmapping=*_CONTAINER\_UID\:HOST\_UID\:SIZE_ to force a UID mapping to be present in the user namespace. + + - *host*: run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user (default). + + - *keep-id*: creates a user namespace where the current rootless user's UID\:GID are mapped to the same values in the container. This option is not allowed for containers created by the root user. + + - *nomap*: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/uts.container.md b/versioned_docs/version-5.5.2/source/markdown/options/uts.container.md new file mode 100644 index 000000000..a8f33a058 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/uts.container.md @@ -0,0 +1,17 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uts**=*mode* + +Set the UTS namespace mode for the container. The following values are supported: + +- **host**: use the host's UTS namespace inside the container. +- **private**: create a new namespace for the container (default). +- **ns:[path]**: run the container in the given existing UTS namespace. +- **container:[container]**: join the UTS namespace of the specified container. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/uts.md b/versioned_docs/version-5.5.2/source/markdown/options/uts.md new file mode 100644 index 000000000..7c18f4633 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/uts.md @@ -0,0 +1,13 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uts**=*how* + +Sets the configuration for UTS namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new UTS namespace to be created, or it can be "host" to indicate that the UTS namespace in which `podman` itself is being run is reused, or it can be the path to a UTS namespace which is already in use by another process. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/uts.pod.md b/versioned_docs/version-5.5.2/source/markdown/options/uts.pod.md new file mode 100644 index 000000000..cf51a22b9 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/uts.pod.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman pod clone, pod create +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--uts**=*mode* + +Set the UTS namespace mode for the pod. The following values are supported: + +- **host**: use the host's UTS namespace inside the pod. +- **private**: create a new namespace for the pod (default). +- **ns:[path]**: run the pod in the given existing UTS namespace. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/variant.container.md b/versioned_docs/version-5.5.2/source/markdown/options/variant.container.md new file mode 100644 index 000000000..7b31a6a24 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/variant.container.md @@ -0,0 +1,12 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pull, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--variant**=*VARIANT* + +Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/variant.manifest.md b/versioned_docs/version-5.5.2/source/markdown/options/variant.manifest.md new file mode 100644 index 000000000..2f31cc369 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/variant.manifest.md @@ -0,0 +1,14 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman manifest add, manifest annotate +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--variant** + +Specify the variant which the list or index records for the image. This option +is typically used to distinguish between multiple entries which share the same +architecture value, but which expect different versions of its instruction set. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/volume.image.md b/versioned_docs/version-5.5.2/source/markdown/options/volume.image.md new file mode 100644 index 000000000..42c832154 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/volume.image.md @@ -0,0 +1,125 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman build, farm build +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--volume**, **-v**=*[HOST-DIR\:CONTAINER-DIR[\\\:OPTIONS]]* + +Mount a host directory into containers when executing RUN instructions during +the build. + +The `OPTIONS` are a comma-separated list and can be one or more of: + + * [rw|ro] + * [z|Z|O] + * [U] + * [`[r]shared`|`[r]slave`|`[r]private`][[1]](#Footnote1) + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR` +must be an absolute path as well. Podman bind-mounts the `HOST-DIR` to the +specified path when processing RUN instructions. + +You can specify multiple **-v** options to mount one or more mounts. + +You can add the `:ro` or `:rw` suffix to a volume to mount it read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted. When running using user namespaces, the UID and GID inside +the namespace may correspond to another UID and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the namespace, to change recursively the owner and group of +the source volume. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add one of these two suffixes +`:z` or `:Z` to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The `z` option tells Podman that two containers +share the volume content. As a result, Podman labels the content with a shared +content label. Shared volume labels allow all containers to read/write content. +The `Z` option tells Podman to label the content with a private unshared label. +Only the current container can use a private volume. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the host machine to fail. For these types +of containers, disabling SELinux separation is recommended. The option +`--security-opt label=disable` disables SELinux separation for the container. +For example, if a user wanted to volume mount their entire home directory into the build containers, they need to disable SELinux separation. + + $ podman build --security-opt label=disable -v $HOME:/home/user . + +`Overlay Volume Mounts` + +The `:O` flag tells Podman to mount the directory from the host as a +temporary storage using the Overlay file system. The `RUN` command containers +are allowed to modify contents within the mountpoint and are stored in the +container storage in a separate directory. In Overlay FS terms the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the `RUN` command +finishes executing, similar to a tmpfs mount point. + +Any subsequent execution of `RUN` commands sees the original source directory +content, any changes from previous RUN commands no longer exists. + +One use case of the `overlay` mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: + +- Overlay mounts are not currently supported in rootless mode. +- The `O` flag is not allowed to be specified with the `Z` or `z` flags. + Content mounted into the container is labeled with the private label. + On SELinux systems, labels in the source directory needs to be readable + by the container label. If not, SELinux container separation must be disabled + for the container to work. +- Modification of the directory volume mounted into the container with an + overlay mount can cause unexpected failures. Do not modify the directory until + the container finishes running. + +By default bind mounted volumes are `private`. That means any mounts done +inside containers are not be visible on the host and vice versa. This behavior +can be changed by specifying a volume mount propagation property. + +When the mount propagation policy is set to `shared`, any mounts completed +inside the container on that volume is visible to both the host and +container. When the mount propagation policy is set to `slave`, one way mount +propagation is enabled and any mounts completed on the host for that volume is +visible only inside of the container. To control the mount propagation +property of volume use the `:[r]shared`, `:[r]slave` or `:[r]private` +propagation flag. For mount propagation to work on the source mount point (mount +point where source dir is mounted on) has to have the right propagation properties. +For shared volumes, the source mount point has to be shared. And for slave volumes, +the source mount has to be either shared or slave. [[1]](#Footnote1) + +Use `df ` to determine the source mount and then use +`findmnt -o TARGET,PROPAGATION ` to determine propagation +properties of source mount, if `findmnt` utility is not available, the source +mount point can be determined by looking at the mount entry in +`/proc/self/mountinfo`. Look at `optional fields` and see if any propagation +properties are specified. +`shared:X` means the mount is `shared`, `master:X` means the mount is `slave` +and if nothing is there that means the mount is `private`. [[1]](#Footnote1) + +To change propagation properties of a mount point use the `mount` command. For +example, to bind mount the source directory `/foo` do +`mount --bind /foo /foo` and `mount --make-private --make-shared /foo`. This +converts /foo into a `shared` mount point. The propagation properties of +the source mount can be changed directly. For instance if `/` is the source +mount for `/foo`, then use `mount --make-shared /` to convert `/` into a +`shared` mount. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/volume.md b/versioned_docs/version-5.5.2/source/markdown/options/volume.md new file mode 100644 index 000000000..ead48c31a --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/volume.md @@ -0,0 +1,216 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the <> is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +<>. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a <> is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the <>, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the <>. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a <>. Without a label, the security system +might prevent the processes running inside the <> from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the <> context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +<> share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label. Only the current <> can use a private +volume. + +Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any one of the containers. Relabeling walks +the file system under the volume and changes the label on each file; if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the <>. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually changed with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the <>. +For example if a user wanted to volume mount their entire home directory into a +<>, they need to disable SELinux separation. + + $ podman <> --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The <> processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the <> +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous <> executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the <<|pod infra>> container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the <<|pod or infra>> container +to work. + +Do not modify the source directory mounted into the <> with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the <> are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the <> +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +<>, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +<>. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the <>. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the <>. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless <> fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/volumes-from.md b/versioned_docs/version-5.5.2/source/markdown/options/volumes-from.md new file mode 100644 index 000000000..dc8dd9202 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/volumes-from.md @@ -0,0 +1,41 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, pod clone, pod create, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--volumes-from**=*CONTAINER[\\\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers<<| and pods>>. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +<>. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a <>. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the <> context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target <>, then the volume hides +that data on the target. diff --git a/versioned_docs/version-5.5.2/source/markdown/options/workdir.md b/versioned_docs/version-5.5.2/source/markdown/options/workdir.md new file mode 100644 index 000000000..059009221 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/options/workdir.md @@ -0,0 +1,16 @@ +--- +title: Documentation +version: v5.5.2 +--- + +####> This option file is used in: +####> podman create, exec, run +####> If file is edited, make sure the changes +####> are applicable to all of those. +#### **--workdir**, **-w**=*dir* + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (**/**). +The image developer can set a different default with the WORKDIR instruction. The operator +can override the working directory by using the **-w** option. diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-artifact-add.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-artifact-add.1.md new file mode 100644 index 000000000..b5f3a9fb9 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-artifact-add.1.md @@ -0,0 +1,88 @@ +--- +title: podman-artifact-add +version: v5.5.2 +--- + +% podman-artifact-add 1 + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-add - Add an OCI artifact to the local store + +## SYNOPSIS +**podman artifact add** *name* *file* [*file*]... + +## DESCRIPTION + +Add an OCI artifact to the local store from the local filesystem. You must +provide at least one file to create the artifact, but several can also be +added. + + +## OPTIONS + + +[//]: # (BEGIN included file options/annotation.manifest.md) +#### **--annotation**=*annotation=value* + +Set an annotation on the entry for the specified image or artifact. + +[//]: # (END included file options/annotation.manifest.md) + +Note: Set annotations for each file being added. + +#### **--append**, **-a** + +Append files to an existing artifact. This option cannot be used with the **--type** option. + +#### **--file-type** + +Set the media type of the artifact file instead of allowing detection to determine the type + +#### **--help** + +Print usage statement. + +#### **--type** + +Set a type for the artifact being added. + +## EXAMPLES + +Add a single file to an artifact + +``` +$ podman artifact add quay.io/myartifact/myml:latest /tmp/foobar.ml +0fe1488ecdef8cc4093e11a55bc048d9fc3e13a4ba846efd24b5a715006c95b3 +``` + +Add multiple files to an artifact +``` +$ podman artifact add quay.io/myartifact/myml:latest /tmp/foobar1.ml /tmp/foobar2.ml +1487acae11b5a30948c50762882036b41ac91a7b9514be8012d98015c95ddb78 +``` + +Set an annotation for an artifact +``` +$ podman artifact add --annotation date=2025-01-30 quay.io/myartifact/myml:latest /tmp/foobar1.ml +``` + +Append a file to an existing artifact +``` +$ podman artifact add --append quay.io/myartifact/tarballs:latest /tmp/foobar.tar.gz +``` + +Override the media type of the artifact being added +``` +$ podman artifact add --file-type text/yaml quay.io/myartifact/descriptors\:latest /tmp/info.yaml +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-artifact-extract.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-artifact-extract.1.md new file mode 100644 index 000000000..df1b37209 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-artifact-extract.1.md @@ -0,0 +1,88 @@ +--- +title: podman-artifact-extract +version: v5.5.2 +--- + +% podman-artifact-extract 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-extract - Extract an OCI artifact to a local path + +## SYNOPSIS +**podman artifact extract** *artifact* *target* + +## DESCRIPTION + +Extract the blobs of an OCI artifact to a local file or directory. + +If the target path is a file or does not exist, the artifact must either consist +of one blob (layer) or if it has multiple blobs (layers) then the **--digest** or +**--title** option must be used to select only a single blob. If the file already +exists it will be overwritten. + +If the target is a directory (it must exist), all blobs will be copied to the +target directory. As the target file name the value from the `org.opencontainers.image.title` +annotation is used. If the annotation is missing, the target file name will be the +digest of the blob (with `:` replaced by `-` in the name). +If the target file already exists in the directory, it will be overwritten. + +## OPTIONS + +#### **--digest**=**digest** + +When extracting blobs from the artifact only use the one with the specified digest. +If the target is a directory then the digest is always used as file name instead even +when the title annotation exists on the blob. +Conflicts with **--title**. + +#### **--help** + +Print usage statement. + +#### **--title**=**title** + +When extracting blobs from the artifact only use the one with the specified title. +It looks for the `org.opencontainers.image.title` annotation and compares that +against the given title. +Conflicts with **--digest**. + +## EXAMPLES + +Extract an artifact with a single blob + +``` +$ podman artifact extract quay.io/artifact/foobar1:test /tmp/myfile +``` + +Extract an artifact with multiple blobs + +``` +$ podman artifact extract quay.io/artifact/foobar2:test /tmp/mydir +$ ls /tmp/mydir +CONTRIBUTING.md README.md +``` + +Extract only a single blob from an artifact with multiple blobs + +``` +$ podman artifact extract --title README.md quay.io/artifact/foobar2:test /tmp/mydir +$ ls /tmp/mydir +README.md +``` +Or using the digest instead of the title +``` +$ podman artifact extract --digest sha256:c0594e012b17fd9e6548355ceb571a79613f7bb988d7d883f112513601ac6e9a quay.io/artifact/foobar2\:test /tmp/mydir +$ ls /tmp/mydir +README.md +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Feb 2025, Originally compiled by Paul Holzinger diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-artifact-inspect.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-artifact-inspect.1.md new file mode 100644 index 000000000..e9c8df69d --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-artifact-inspect.1.md @@ -0,0 +1,43 @@ +--- +title: podman-artifact-inspect +version: v5.5.2 +--- + +% podman-artifact-inspect 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-inspect - Inspect an OCI artifact + +## SYNOPSIS +**podman artifact inspect** [*name*] ... + +## DESCRIPTION + +Inspect an artifact in the local store. The artifact can be referred to with either: + +1. Fully qualified artifact name +2. Full or partial digest of the artifact's manifest + +## OPTIONS + +#### **--help** + +Print usage statement. + +## EXAMPLES + +Inspect an OCI image in the local store. +``` +$ podman artifact inspect quay.io/myartifact/myml\:latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Sept 2024, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-artifact-ls.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-artifact-ls.1.md new file mode 100644 index 000000000..b9b2cf493 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-artifact-ls.1.md @@ -0,0 +1,90 @@ +--- +title: podman-artifact-ls +version: v5.5.2 +--- + +% podman-artifact-ls 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-ls - List OCI artifacts in local store + +## SYNOPSIS +**podman artifact ls** [*options*] + +## DESCRIPTION + +List all local artifacts in your local store. + +## OPTIONS + +#### **--format** + +Print results with a Go template. + +| **Placeholder** | **Description** | +|-----------------|------------------------------------------------| +| .Digest | The computed digest of the artifact's manifest | +| .Repository | Repository name of the artifact | +| .Size | Size artifact in human readable units | +| .Tag | Tag of the artifact name | + + +[//]: # (BEGIN included file options/no-trunc.md) +#### **--no-trunc** + +Do not truncate the output (default *false*). + +[//]: # (END included file options/no-trunc.md) + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +## EXAMPLES + +List artifacts in the local store +``` +$ podman artifact ls +REPOSITORY TAG DIGEST SIZE +quay.io/artifact/foobar1 latest ab609fad386d 2.097GB +quay.io/artifact/foobar2 special cd734b558ceb 12.58MB +``` + +List artifacts in the local store without truncating the digest +``` +$ podman artifact ls --no-trunc +REPOSITORY TAG DIGEST SIZE +quay.io/artifact/foobar1 latest ab609fad386df1433f461b0643d9cf575560baf633809dcc9c190da6cc3a3c29 2.097GB +quay.io/artifact/foobar2 special cd734b558ceb8ccc0281ca76530e1dea1eb479407d3163f75fb601bffb6f73d0 12.58MB +``` + +List artifacts in the local store without the title header +``` +$ podman artifact ls --noheading +quay.io/artifact/foobar1 latest ab609fad386d 2.097GB +quay.io/artifact/foobar2 special cd734b558ceb 12.58MB +``` + +List artifact digests and size using a --format +``` +$ podman artifact ls --format "{{.Digest}} {{.Size}}" +ab609fad386d 2.097GB +cd734b558ceb 12.58MB +``` + + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-artifact-pull.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-artifact-pull.1.md new file mode 100644 index 000000000..7e95cae36 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-artifact-pull.1.md @@ -0,0 +1,140 @@ +--- +title: podman-artifact-pull +version: v5.5.2 +--- + +% podman-artifact-pull 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-pull - Pulls an artifact from a registry and stores it locally + +## SYNOPSIS +**podman artifact pull** [*options*] *source* + + +## DESCRIPTION +podman artifact pull copies an artifact from a registry onto the local machine. + + +## SOURCE +SOURCE is the location from which the artifact image is obtained. + +``` +# Pull from a registry +$ podman artifact pull quay.io/foobar/artifact\:special +``` + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +#### **--help**, **-h** + +Print the usage statement. + +#### **--quiet**, **-q** + +Suppress output information when pulling images + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## FILES + +## EXAMPLES +Pull an artifact from a registry + +``` +podman artifact pull quay.io/baude/artifact\:josey +Getting image source signatures +Copying blob e741c35a27bb done | +Copying config 44136fa355 done | +Writing manifest to image destination + +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-artifact-push.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-artifact-push.1.md new file mode 100644 index 000000000..244a25aa0 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-artifact-push.1.md @@ -0,0 +1,149 @@ +--- +title: podman-artifact-push +version: v5.5.2 +--- + +% podman-artifact-push 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-push - Push an OCI artifact from local storage to an image registry + +## SYNOPSIS +**podman artifact push** [*options*] *image* + +## DESCRIPTION +Pushes an artifact from the local artifact store to an image registry. + +``` +# Push artifact to a container registry +$ podman artifact push quay.io/artifact/foobar1\:latest +``` + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\\\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/digestfile.md) +#### **--digestfile**=*Digestfile* + +After copying the image, write the digest of the resulting image to the file. + +[//]: # (END included file options/digestfile.md) + +#### **--quiet**, **-q** + +When writing the output image, suppress progress output + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + +#### **--sign-by**=*key* + +Add a “simple signing” signature at the destination using the specified key. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-by-sigstore.md) +#### **--sign-by-sigstore**=*param-file* + +Add a sigstore signature based on further options specified in a container's sigstore signing parameter file *param-file*. +See containers-sigstore-signing-params.yaml(5) for details about the file format. + +[//]: # (END included file options/sign-by-sigstore.md) + + +#### **--sign-by-sigstore-private-key**=*path* + +Add a sigstore signature at the destination using a private key at the specified path. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-passphrase-file.md) +#### **--sign-passphrase-file**=*path* + +If signing the image (using either **--sign-by** or **--sign-by-sigstore-private-key**), read the passphrase to use from the specified path. + +[//]: # (END included file options/sign-passphrase-file.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLE + +Push the specified iage to a container registry: +``` +$ podman artifact push quay.io/baude/artifact\:single +Getting image source signatures +Copying blob 3ddc0a3cdb61 done | +Copying config 44136fa355 done | +Writing manifest to image destination +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)**, **[podman-pull(1)](podman-pull.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** + + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-artifact-rm.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-artifact-rm.1.md new file mode 100644 index 000000000..a95dc7613 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-artifact-rm.1.md @@ -0,0 +1,63 @@ +--- +title: podman-artifact-rm +version: v5.5.2 +--- + +% podman-artifact-rm 1 + + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact\-rm - Remove an OCI from local storage + +## SYNOPSIS +**podman artifact rm** [*options*] *name* + +## DESCRIPTION + +Remove an artifact from the local artifact store. The input may be the fully +qualified artifact name or a full or partial artifact digest. + +## OPTIONS + +#### **--all**, **-a** + +Remove all artifacts in the local store. The use of this option conflicts with +providing a name or digest of the artifact. + +#### **--help** + +Print usage statement. + + +## EXAMPLES + +Remove an artifact by name + +``` +$ podman artifact rm quay.io/artifact/foobar2\:test +Deleted: e7b417f49fc24fc7ead6485da0ebd5bc4419d8a3f394c169fee5a6f38faa4056 +``` + +Remove an artifact by partial digest + +``` +$ podman artifact rm e7b417f49fc +Deleted: e7b417f49fc24fc7ead6485da0ebd5bc4419d8a3f394c169fee5a6f38faa4056 +``` + +Remove all artifacts in local storage +``` +$ podman artifact rm -a +Deleted: cee15f7c5ce3e86ae6ce60d84bebdc37ad34acfa9a2611cf47501469ac83a1ab +Deleted: 72875f8f6f78d5b8ba98b2dd2c0a6f395fde8f05ff63a1df580d7a88f5afa97b +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-artifact(1)](podman-artifact.1.md)** + +## HISTORY +Jan 2025, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-artifact.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-artifact.1.md new file mode 100644 index 000000000..65d69b557 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-artifact.1.md @@ -0,0 +1,42 @@ +--- +title: podman-artifact +version: v5.5.2 +--- + +% podman-artifact 1 + +## WARNING: Experimental command +*This command is considered experimental and still in development. Inputs, options, and outputs are all +subject to change.* + +## NAME +podman\-artifact - Manage OCI artifacts + +## SYNOPSIS +**podman artifact** *subcommand* + +## DESCRIPTION +`podman artifact` is a set of subcommands that manage OCI artifacts. + +OCI artifacts are a common way to distribute files that are associated with OCI images and +containers. Podman is capable of managing (pulling, inspecting, pushing) these artifacts +from its local "artifact store". + +## SUBCOMMANDS + +| Command | Man Page | Description | +|---------|------------------------------------------------------------|--------------------------------------------------------------| +| add | [podman-artifact-add(1)](podman-artifact-add.1.md) | Add an OCI artifact to the local store | +| extract | [podman-artifact-extract(1)](podman-artifact-extract.1.md) | Extract an OCI artifact to a local path | +| inspect | [podman-artifact-inspect(1)](podman-artifact-inspect.1.md) | Inspect an OCI artifact | +| ls | [podman-artifact-ls(1)](podman-artifact-ls.1.md) | List OCI artifacts in local store | +| pull | [podman-artifact-pull(1)](podman-artifact-pull.1.md) | Pulls an artifact from a registry and stores it locally | +| push | [podman-artifact-push(1)](podman-artifact-push.1.md) | Push an OCI artifact from local storage to an image registry | +| rm | [podman-artifact-rm(1)](podman-artifact-rm.1.md) | Remove an OCI from local storage | + + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +Sept 2024, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-attach.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-attach.1.md new file mode 100644 index 000000000..a835b2210 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-attach.1.md @@ -0,0 +1,78 @@ +--- +title: podman-attach +version: v5.5.2 +--- + +% podman-attach 1 + +## NAME +podman\-attach - Attach to a running container + +## SYNOPSIS +**podman attach** [*options*] *container* + +**podman container attach** [*options*] *container* + +## DESCRIPTION +**podman attach** attaches to a running *container* using the *container's name* or *ID*, to either view its ongoing output or to control it interactively.\ +The *container* can be detached from (and leave it running) using a configurable key sequence. The default sequence is `ctrl-p,ctrl-q`. Configure the keys sequence using the **--detach-keys** OPTION, or specifying it in the `containers.conf` file: see **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** for more information. + +## OPTIONS + +[//]: # (BEGIN included file options/detach-keys.md) +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. + +[//]: # (END included file options/detach-keys.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--no-stdin** + +Do not attach STDIN. The default is **false**. + + +[//]: # (BEGIN included file options/sig-proxy.md) +#### **--sig-proxy** + +Proxy received signals to the container process. SIGCHLD, SIGURG, SIGSTOP, and SIGKILL are not proxied. + +[//]: # (END included file options/sig-proxy.md) + +The default is **true**. + +## EXAMPLES +Attach to a container called "foobar". +``` +$ podman attach foobar +``` + +Attach to the latest created container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman attach --latest +``` + +Attach to a container that start with the ID "1234". +``` +$ podman attach 1234 +``` + +Attach to a container without attaching STDIN. +``` +$ podman attach --no-stdin foobar +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-exec(1)](podman-exec.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-auto-update.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-auto-update.1.md new file mode 100644 index 000000000..bab88f136 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-auto-update.1.md @@ -0,0 +1,146 @@ +--- +title: podman-auto-update +version: v5.5.2 +--- + +% podman-auto-update 1 + +## NAME +podman\-auto-update - Auto update containers according to their auto-update policy + +## SYNOPSIS +**podman auto-update** [*options*] + +## DESCRIPTION +**podman auto-update** pulls down new container images and restarts containers configured for auto updates. +To make use of auto updates, the container or Kubernetes workloads must run inside a systemd unit. +After a successful update of an image, the containers using the image get updated by restarting the systemd units they run in. +Please refer to `podman-systemd.unit(5)` on how to run Podman under systemd. + +To configure a container for auto updates, it must be created with the `io.containers.autoupdate` label or the `AutoUpdate` field in `podman-systemd.unit(5)` with one of the following two values: + +* `registry`: If the label is present and set to `registry`, Podman reaches out to the corresponding registry to check if the image has been updated. +The label `image` is an alternative to `registry` maintained for backwards compatibility. +An image is considered updated if the digest in the local storage is different than the one of the remote image. +If an image must be updated, Podman pulls it down and restarts the systemd unit executing the container. +The registry policy requires a fully-qualified image reference (e.g., quay.io/podman/stable\\:latest) to be used to create the container. +This enforcement is necessary to know which image to actually check and pull. +If an image ID was used, Podman would not know which image to check/pull anymore. + +* `local`: If the autoupdate label is set to `local`, Podman compares the image digest of the container to the one in the local container storage. +If they differ, the local image is considered to be newer and the systemd unit gets restarted. + +### Auto Updates and Kubernetes YAML + +Podman supports auto updates for Kubernetes workloads. The auto-update policy can be configured directly via `podman-systemd.unit(5)` or inside the Kubernetes YAML with the Podman-specific annotations mentioned below: + +* `io.containers.autoupdate`: "registry|local" to apply the auto-update policy to all containers +* `io.containers.autoupdate/$container`: "registry|local" to apply the auto-update policy to `$container` only +* `io.containers.sdnotify`: "conmon|container" to apply the sdnotify policy to all containers +* `io.containers.sdnotify/$container`: "conmon|container" to apply the sdnotify policy to `$container` only + +By default, the autoupdate policy is set to "disabled", the sdnotify policy is set to "conmon". + +### Systemd Unit and Timer + +Podman ships with a `podman-auto-update.service` systemd unit. This unit is triggered daily at midnight by the `podman-auto-update.timer` systemd timer. +The timer can be altered for custom time-based updates if desired. +The unit can further be invoked by other systemd units (e.g., via the dependency tree) or manually via **systemctl start podman-auto-update.service**. + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + +Alternatively, the `io.containers.autoupdate.authfile` container label can be configured. In that case, Podman will use the specified label's value instead. + +#### **--dry-run** + +Check for the availability of new images but do not perform any pull operation or restart any service or container. +The `UPDATED` field indicates the availability of a new image with "pending". + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| --------------- | -------------------------------------- | +| .Container | ID and name of the container | +| .ContainerID | ID of the container | +| .ContainerName | Name of the container | +| .Image | Name of the image | +| .Policy | Auto-update policy of the container | +| .Unit | Name of the systemd unit | +| .Updated | Update status: true,false,failed | + +#### **--rollback** + +If restarting a systemd unit after updating the image has failed, rollback to using the previous image and restart the unit another time. Default is true. + +Note that detecting if a systemd unit has failed is best done by the container sending the READY message via SDNOTIFY. +This way, restarting the unit waits until having received the message or a timeout kicked in. +Without that, restarting the systemd unit may succeed even if the container has failed shortly after. + +For a container to send the READY message via SDNOTIFY it must be created with the `--sdnotify=container` option (see podman-run(1)). +The application running inside the container can then execute `systemd-notify --ready` when ready or use the sdnotify bindings of the specific programming language (e.g., sd_notify(3)). + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Create a Quadlet file configured for auto updates: +``` +$ cat ~/.config/containers/systemd/sleep.container +[Container] +Image=registry.fedoraproject.org/fedora:latest +Exec=sleep infinity +AutoUpdate=registry +``` + +Generate a systemd service from the Quadlet file by reloading the systemd user daemon: +``` +$ systemctl --user daemon-reload +``` + +Start the systemd service and make sure the container is running +``` +$ systemctl --user start sleep.service +$ podman ps +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +f8e4759798d4 registry.fedoraproject.org/fedora:latest sleep infinity 2 seconds ago Up 2 seconds systemd-sleep +``` + +Check if a new image is available via `--dry-run`: +``` +$ podman auto-update --dry-run --format "{{.Image}} {{.Updated}}" +registry.fedoraproject.org/fedora:latest pending +``` + +Update the service: +``` +$ podman auto-update +UNIT CONTAINER IMAGE POLICY UPDATED +sleep.service f8e4759798d4 (systemd-sleep) registry.fedoraproject.org/fedora\\:latest registry true +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-generate-systemd(1)](podman-generate-systemd.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-systemd.unit(5)](podman-systemd.unit.5.md)**, **sd_notify(3)**, **[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-build.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-build.1.md new file mode 100644 index 000000000..fafd18d84 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-build.1.md @@ -0,0 +1,1951 @@ +--- +title: podman-build +version: v5.5.2 +--- + +% podman-build 1 + +## NAME +podman\-build - Build a container image using a Containerfile + +## SYNOPSIS +**podman build** [*options*] [*context*] + +**podman image build** [*options*] [*context*] + +## DESCRIPTION +**podman build** Builds an image using instructions from one or more +Containerfiles or Dockerfiles and a specified build context directory. A +Containerfile uses the same syntax as a Dockerfile internally. For this +document, a file referred to as a Containerfile can be a file named +either 'Containerfile' or 'Dockerfile' exclusively. Any file that has additional +extension attached will not be recognized by `podman build .` unless a `-f` flag is +used to specify the file. + +The build context directory can be specified as the http(s) URL of an archive, +git repository or Containerfile. + +When invoked with `-f` and a path to a Containerfile, with no explicit CONTEXT +directory, Podman uses the Containerfile's parent directory as its build context. + +Containerfiles ending with a ".in" suffix are preprocessed via CPP(1). This +can be useful to decompose Containerfiles into several reusable parts that can +be used via CPP's **#include** directive. Containerfiles ending in .in are +restricted to no comment lines unless they are CPP commands. +Note, a Containerfile.in file can still be used by other tools when manually +preprocessing them via `cpp -E`. + +When the URL is an archive, the contents of the URL is downloaded to a temporary +location and extracted before execution. + +When the URL is a Containerfile, the Containerfile is downloaded to a temporary +location. + +When a Git repository is set as the URL, the repository is cloned locally and +then set as the context. A URL is treated as a Git repository if it +has a `git://` prefix or a `.git` suffix. + +NOTE: `podman build` uses code sourced from the `Buildah` project to build +container images. This `Buildah` code creates `Buildah` containers for the +`RUN` options in container storage. In certain situations, when the +`podman build` crashes or users kill the `podman build` process, these external +containers can be left in container storage. Use the `podman ps --all --external` +command to see these containers. + +`podman buildx build` command is an alias of `podman build`. Not all `buildx build` features are available in Podman. The `buildx build` option is provided for scripting compatibility. + +## OPTIONS + + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the container's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + +#### **--all-platforms** + +Instead of building for a set of platforms specified using the **--platform** option, inspect the build's base images, and build for all of the platforms for which they are all available. Stages that use *scratch* as a starting point can not be inspected, so at least one non-*scratch* stage must be present for detection to work usefully. + + +[//]: # (BEGIN included file options/annotation.image.md) +#### **--annotation**=*annotation=value* + +Add an image *annotation* (e.g. annotation=*value*) to the image metadata. Can +be used multiple times. + +Note: this information is not present in Docker image formats, so it is +discarded when writing images in Docker formats. + +[//]: # (END included file options/annotation.image.md) + +#### **--arch**=*arch* + +Set the architecture of the image to be built, and that of the base image to be +pulled, if the build uses one, to the provided value instead of using the +architecture of the build host. Unless overridden, subsequent lookups of the +same image in the local storage matches this architecture, regardless of the +host. (Examples: arm, arm64, 386, amd64, ppc64le, s390x) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/build-arg.md) +#### **--build-arg**=*arg=value* + +Specifies a build argument and its value, which is interpolated in +instructions read from the Containerfiles in the same way that environment variables are, but which are not added to environment variable list in the resulting image's configuration. + +[//]: # (END included file options/build-arg.md) + + +[//]: # (BEGIN included file options/build-arg-file.md) +#### **--build-arg-file**=*path* + +Specifies a file containing lines of build arguments of the form `arg=value`. +The suggested file name is `argfile.conf`. + +Comment lines beginning with `#` are ignored, along with blank lines. +All others must be of the `arg=value` format passed to `--build-arg`. + +If several arguments are provided via the `--build-arg-file` +and `--build-arg` options, the build arguments are merged across all +of the provided files and command line arguments. + +Any file provided in a `--build-arg-file` option is read before +the arguments supplied via the `--build-arg` option. + +When a given argument name is specified several times, the last instance +is the one that is passed to the resulting builds. This means `--build-arg` +values always override those in a `--build-arg-file`. + +[//]: # (END included file options/build-arg-file.md) + + +[//]: # (BEGIN included file options/build-context.md) +#### **--build-context**=*name=value* + +Specify an additional build context using its short name and its location. +Additional build contexts can be referenced in the same manner as we access +different stages in COPY instruction. + +Valid values are: + +* Local directory – e.g. --build-context project2=../path/to/project2/src (This option is not available with the remote Podman client. On Podman machine setup (i.e macOS and Windows) path must exists on the machine VM) +* HTTP URL to a tarball – e.g. --build-context src=https://example.org/releases/src.tar +* Container image – specified with a container-image:// prefix, e.g. --build-context alpine=container-image://alpine:3.15, (also accepts docker://, docker-image://) + +On the Containerfile side, reference the build context on all +commands that accept the “from” parameter. Here’s how that might look: + +```dockerfile +FROM [name] +COPY --from=[name] ... +RUN --mount=from=[name] … +``` + +The value of [name] is matched with the following priority order: + +* Named build context defined with --build-context [name]=.. +* Stage defined with AS [name] inside Containerfile +* Image [name], either local or in a remote registry + +[//]: # (END included file options/build-context.md) + + +[//]: # (BEGIN included file options/cache-from.md) +#### **--cache-from**=*image* + +Repository to utilize as a potential cache source. When specified, Buildah tries to look for +cache images in the specified repository and attempts to pull cache images instead of actually +executing the build steps locally. Buildah only attempts to pull previously cached images if they +are considered as valid cache hits. + +Use the `--cache-to` option to populate a remote repository with cache content. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-from` option is ignored unless `--layers` is specified. + +[//]: # (END included file options/cache-from.md) + + +[//]: # (BEGIN included file options/cache-to.md) +#### **--cache-to**=*image* + +Set this flag to specify a remote repository that is used to store cache images. Buildah attempts to +push newly built cache image to the remote repository. + +Note: Use the `--cache-from` option in order to use cache content in a remote repository. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-to` option is ignored unless `--layers` is specified. + +[//]: # (END included file options/cache-to.md) + + +[//]: # (BEGIN included file options/cache-ttl.md) +#### **--cache-ttl** + +Limit the use of cached images to only consider images with created timestamps less than *duration* ago. +For example if `--cache-ttl=1h` is specified, Buildah considers intermediate cache images which are created +under the duration of one hour, and intermediate cache images outside this duration is ignored. + +Note: Setting `--cache-ttl=0` manually is equivalent to using `--no-cache` in the +implementation since this means that the user does not want to use cache at all. + +[//]: # (END included file options/cache-ttl.md) + + +[//]: # (BEGIN included file options/cap-add.image.md) +#### **--cap-add**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability added to its capability set. +Certain capabilities are granted by default; this option can be used to add +more. + +[//]: # (END included file options/cap-add.image.md) + + +[//]: # (BEGIN included file options/cap-drop.image.md) +#### **--cap-drop**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability removed from its capability set. +The CAP\_CHOWN, CAP\_DAC\_OVERRIDE, CAP\_FOWNER, +CAP\_FSETID, CAP\_KILL, CAP\_NET\_BIND\_SERVICE, CAP\_SETFCAP, +CAP\_SETGID, CAP\_SETPCAP, and CAP\_SETUID capabilities are +granted by default; this option can be used to remove them. + +If a capability is specified to both the **--cap-add** and **--cap-drop** +options, it is dropped, regardless of the order in which the options were +given. + +[//]: # (END included file options/cap-drop.image.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the container is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cgroupns.image.md) +#### **--cgroupns**=*how* + +Sets the configuration for cgroup namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "private" to indicate +that a new cgroup namespace is created, or it can be "host" to indicate +that the cgroup namespace in which `buildah` itself is being run is reused. + +[//]: # (END included file options/cgroupns.image.md) + + +[//]: # (BEGIN included file options/compat-volumes.md) +#### **--compat-volumes** + +Handle directories marked using the VOLUME instruction (both in this build, and +those inherited from base images) such that their contents can only be modified +by ADD and COPY instructions. Any changes made in those locations by RUN +instructions will be reverted. Before the introduction of this option, this +behavior was the default, but it is now disabled by default. + +[//]: # (END included file options/compat-volumes.md) + +#### **--compress** + +This option is added to be aligned with other containers CLIs. +Podman doesn't communicate with a daemon or a remote server. +Thus, compressing the data before sending it is irrelevant to Podman. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/cpp-flag.md) +#### **--cpp-flag**=*flags* + +Set additional flags to pass to the C Preprocessor cpp(1). Containerfiles ending with a ".in" suffix is preprocessed via cpp(1). This option can be used to pass additional flags to cpp.Note: You can also set default CPPFLAGS by setting the BUILDAH_CPPFLAGS environment variable (e.g., export BUILDAH_CPPFLAGS="-DDEBUG"). + +[//]: # (END included file options/cpp-flag.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + +#### **--cw**=*options* + +Produce an image suitable for use as a confidential workload running in a +trusted execution environment (TEE) using krun (i.e., *crun* built with the +libkrun feature enabled and invoked as *krun*). Instead of the conventional +contents, the root filesystem of the image will contain an encrypted disk image +and configuration information for krun. + +The value for *options* is a comma-separated list of key=value pairs, supplying +configuration information which is needed for producing the additional data +which will be included in the container image. + +Recognized _keys_ are: + +*attestation_url*: The location of a key broker / attestation server. +If a value is specified, the new image's workload ID, along with the passphrase +used to encrypt the disk image, will be registered with the server, and the +server's location will be stored in the container image. +At run-time, krun is expected to contact the server to retrieve the passphrase +using the workload ID, which is also stored in the container image. +If no value is specified, a *passphrase* value *must* be specified. + +*cpus*: The number of virtual CPUs which the image expects to be run with at +run-time. If not specified, a default value will be supplied. + +*firmware_library*: The location of the libkrunfw-sev shared library. If not +specified, `buildah` checks for its presence in a number of hard-coded +locations. + +*memory*: The amount of memory which the image expects to be run with at +run-time, as a number of megabytes. If not specified, a default value will be +supplied. + +*passphrase*: The passphrase to use to encrypt the disk image which will be +included in the container image. +If no value is specified, but an *attestation_url* value is specified, a +randomly-generated passphrase will be used. +The authors recommend setting an *attestation_url* but not a *passphrase*. + +*slop*: Extra space to allocate for the disk image compared to the size of the +container image's contents, expressed either as a percentage (..%) or a size +value (bytes, or larger units if suffixes like KB or MB are present), or a sum +of two or more such specifications. If not specified, `buildah` guesses that +25% more space than the contents will be enough, but this option is provided in +case its guess is wrong. + +*type*: The type of trusted execution environment (TEE) which the image should +be marked for use with. Accepted values are "SEV" (AMD Secure Encrypted +Virtualization - Encrypted State) and "SNP" (AMD Secure Encrypted +Virtualization - Secure Nested Paging). If not specified, defaults to "SNP". + +*workload_id*: A workload identifier which will be recorded in the container +image, to be used at run-time for retrieving the passphrase which was used to +encrypt the disk image. If not specified, a semi-random value will be derived +from the base image's image ID. + +This option is not supported on the remote client, including Mac and Windows +(excluding WSL2) machines. + + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the container. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The container only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: if the user only has access rights via a group, accessing the device +from inside a rootless container fails. The **[crun(1)](https://github.com/containers/crun/tree/main/crun.1.md)** runtime offers a +workaround for this by adding the option +**--annotation run.oci.keep_original_groups=1**. + + +[//]: # (BEGIN included file options/disable-compression.md) +#### **--disable-compression**, **-D** + +Don't compress filesystem layers when building the image unless it is required +by the location where the image is being written. This is the default setting, +because image layers are compressed automatically when they are pushed to +registries, and images being written to local storage only need to be +decompressed again to be stored. Compression can be forced in all cases by +specifying **--disable-compression=false**. + +[//]: # (END included file options/disable-compression.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + + +[//]: # (BEGIN included file options/dns.md) +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. + +[//]: # (END included file options/dns.md) + +This option cannot be combined with **--network** that is set to **none**. + +Note: this option takes effect only during *RUN* instructions in the build. +It does not affect _/etc/resolv.conf_ in the final image. + + +[//]: # (BEGIN included file options/dns-option.image.md) +#### **--dns-option**=*option* + +Set custom DNS options to be used during the build. + +[//]: # (END included file options/dns-option.image.md) + + +[//]: # (BEGIN included file options/dns-search.image.md) +#### **--dns-search**=*domain* + +Set custom DNS search domains to be used during the build. + +[//]: # (END included file options/dns-search.image.md) + + +[//]: # (BEGIN included file options/env.image.md) +#### **--env**=*env[=value]* + +Add a value (e.g. env=*value*) to the built image. Can be used multiple times. +If neither `=` nor a *value* are specified, but *env* is set in the current +environment, the value from the current environment is added to the image. +To remove an environment variable from the built image, use the `--unsetenv` +option. + +[//]: # (END included file options/env.image.md) + + +[//]: # (BEGIN included file options/file.md) +#### **--file**, **-f**=*Containerfile* + +Specifies a Containerfile which contains instructions for building the image, +either a local file or an **http** or **https** URL. If more than one +Containerfile is specified, *FROM* instructions are only be accepted from the +last specified file. + +If a build context is not specified, and at least one Containerfile is a +local file, the directory in which it resides is used as the build +context. + +Specifying the option `-f -` causes the Containerfile contents to be read from stdin. + +[//]: # (END included file options/file.md) + + +[//]: # (BEGIN included file options/force-rm.md) +#### **--force-rm** + +Always remove intermediate containers after a build, even if the build fails (default true). + +[//]: # (END included file options/force-rm.md) + + +[//]: # (BEGIN included file options/format.md) +#### **--format** + +Control the format for the built image's manifest and configuration data. +Recognized formats include *oci* (OCI image-spec v1.0, the default) and +*docker* (version 2, using schema format 2 for the manifest). + +Note: You can also override the default format by setting the BUILDAH\_FORMAT +environment variable. `export BUILDAH_FORMAT=docker` + +[//]: # (END included file options/format.md) + + +[//]: # (BEGIN included file options/from.md) +#### **--from** + +Overrides the first `FROM` instruction within the Containerfile. If there are multiple +FROM instructions in a Containerfile, only the first is changed. + +With the remote podman client, not all container transports work as +expected. For example, oci-archive:/x.tar references /x.tar on the remote +machine instead of on the client. When using podman remote clients it is +best to restrict use to *containers-storage*, and *docker:// transports*. + +[//]: # (END included file options/from.md) + + +[//]: # (BEGIN included file options/group-add.md) +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/group-add.md) + + +[//]: # (BEGIN included file options/help.md) +#### **--help**, **-h** + +Print usage statement + +[//]: # (END included file options/help.md) + + +[//]: # (BEGIN included file options/hooks-dir.md) +#### **--hooks-dir**=*path* + +Each *.json file in the path configures a hook for buildah build containers. For more details on the syntax of the JSON files and the semantics of hook injection. Buildah currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. + +This option may be set multiple times; paths from later options have higher precedence. + +For the annotation conditions, buildah uses any annotations set in the generated OCI configuration. + +For the bind-mount conditions, only mounts explicitly requested by the caller via --volume are considered. Bind mounts that buildah inserts by default (e.g. /dev/shm) are not considered. + +If --hooks-dir is unset for root callers, Buildah currently defaults to /usr/share/containers/oci/hooks.d and /etc/containers/oci/hooks.d in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting --hooks-dir. + +[//]: # (END included file options/hooks-dir.md) + + +[//]: # (BEGIN included file options/http-proxy.md) +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. + +[//]: # (END included file options/http-proxy.md) + + +[//]: # (BEGIN included file options/identity-label.md) +#### **--identity-label** + +Adds default identity label `io.buildah.version` if set. (default true). + +[//]: # (END included file options/identity-label.md) + + +[//]: # (BEGIN included file options/ignorefile.md) +#### **--ignorefile** + +Path to an alternative .containerignore file. + +[//]: # (END included file options/ignorefile.md) + + +[//]: # (BEGIN included file options/iidfile.md) +#### **--iidfile**=*ImageIDfile* + +Write the built image's ID to the file. When `--platform` is specified more than once, attempting to use this option triggers an error. + +[//]: # (END included file options/iidfile.md) + + +[//]: # (BEGIN included file options/inherit-labels.md) +#### **--inherit-labels** + +Inherit the labels from the base image or base stages. (default true). + +[//]: # (END included file options/inherit-labels.md) + + +[//]: # (BEGIN included file options/ipc.image.md) +#### **--ipc**=*how* + +Sets the configuration for IPC namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate +that a new IPC namespace is created, or it can be "host" to indicate +that the IPC namespace in which `podman` itself is being run is reused, +or it can be the path to an IPC namespace which is already in use by +another process. + +[//]: # (END included file options/ipc.image.md) + + +[//]: # (BEGIN included file options/isolation.md) +#### **--isolation**=*type* + +Controls what type of isolation is used for running processes as part of `RUN` +instructions. Recognized types include *oci* (OCI-compatible runtime, the +default), *rootless* (OCI-compatible runtime invoked using a modified +configuration and its --rootless option enabled, with *--no-new-keyring +--no-pivot* added to its *create* invocation, with network and UTS namespaces +disabled, and IPC, PID, and user namespaces enabled; the default for +unprivileged users), and *chroot* (an internal wrapper that leans more toward +chroot(1) than container technology). + +Note: You can also override the default isolation type by setting the +BUILDAH\_ISOLATION environment variable. `export BUILDAH_ISOLATION=oci` + +[//]: # (END included file options/isolation.md) + + +[//]: # (BEGIN included file options/jobs.md) +#### **--jobs**=*number* + +Run up to N concurrent stages in parallel. If the number of jobs is greater +than 1, stdin is read from /dev/null. If 0 is specified, then there is +no limit in the number of jobs that run in parallel. + +[//]: # (END included file options/jobs.md) + + +[//]: # (BEGIN included file options/label.image.md) +#### **--label**=*label* + +Add an image *label* (e.g. label=*value*) to the image metadata. Can be used +multiple times. + +Users can set a special LABEL **io.containers.capabilities=CAP1,CAP2,CAP3** in +a Containerfile that specifies the list of Linux capabilities required for the +container to run properly. This label specified in a container image tells +Podman to run the container with just these capabilities. Podman launches the +container with just the specified capabilities, as long as this list of +capabilities is a subset of the default list. + +If the specified capabilities are not in the default set, Podman prints an error +message and runs the container with the default capabilities. + +[//]: # (END included file options/label.image.md) + + +[//]: # (BEGIN included file options/layer-label.md) +#### **--layer-label**=*label[=value]* + +Add an intermediate image *label* (e.g. label=*value*) to the intermediate +image metadata. It can be used multiple times. + +If *label* is named, but neither `=` nor a `value` is provided, then +the *label* is set to an empty value. + +[//]: # (END included file options/layer-label.md) + + +[//]: # (BEGIN included file options/layers.md) +#### **--layers** + +Cache intermediate images during the build process (Default is `true`). + +Note: You can also override the default value of layers by setting the +BUILDAH\_LAYERS environment variable. `export BUILDAH_LAYERS=true` + +[//]: # (END included file options/layers.md) + + +[//]: # (BEGIN included file options/logfile.md) +#### **--logfile**=*filename* + +Log output which is sent to standard output and standard error to the +specified file instead of to standard output and standard error. +This option is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. + +[//]: # (END included file options/logfile.md) + +#### **--logsplit**=*bool-value* + +If `--logfile` and `--platform` are specified, the `--logsplit` option allows +end-users to split the log file for each platform into different files in the +following format: `${logfile}_${platform-os}_${platform-arch}`. +This option is not supported on the remote client, including Mac and Windows +(excluding WSL2) machines. + + +[//]: # (BEGIN included file options/manifest.md) +#### **--manifest**=*manifest* + +Name of the manifest list to which the image is added. Creates the manifest list if it does not exist. This option is useful for building multi architecture images. + +[//]: # (END included file options/manifest.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/network.image.md) +#### **--network**=*mode*, **--net** + +Sets the configuration for network namespaces when handling `RUN` instructions. + +Valid _mode_ values are: + +- **none**: no networking. +- **host**: use the Podman host network stack. Note: the host mode gives the +container full access to local system services such as D-bus and is therefore +considered insecure. +- **ns:**_path_: path to a network namespace to join. +- **private**: create a new namespace for the container (default) +- **\**: Join the network with the given name or ID, e.g. use `--network mynet` to join the network with the name mynet. Only supported for rootful users. +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=MTU**: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=CIDR**: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=INTERFACE**: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=IPv4**: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=INTERFACE**: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=IPv6**: Specify the outbound ipv6 address slirp binds to. +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.image.md) + + +[//]: # (BEGIN included file options/no-cache.md) +#### **--no-cache** + +Do not use existing cached images for the container build. Build from the start with a new set of cached layers. + +[//]: # (END included file options/no-cache.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the container. + +Podman assumes control over the container's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/omit-history.md) +#### **--omit-history** + +Omit build history information in the built image. (default false). + +This option is useful for the cases where end users explicitly +want to set `--omit-history` to omit the optional `History` from +built images or when working with images built using build tools that +do not include `History` information in their images. + +[//]: # (END included file options/omit-history.md) + + +[//]: # (BEGIN included file options/os.md) +#### **--os**=*string* + +Set the OS of the image to be built, and that of the base image to be pulled, if the build uses one, instead of using the current operating system of the build host. Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. + +[//]: # (END included file options/os.md) + + +[//]: # (BEGIN included file options/os-feature.md) +#### **--os-feature**=*feature* + +Set the name of a required operating system *feature* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS feature list is kept, if the base image specified any. This option is typically only meaningful when the image's OS is Windows. + +If *feature* has a trailing `-`, then the *feature* is removed from the set of required features which is listed in the image. + +[//]: # (END included file options/os-feature.md) + + +[//]: # (BEGIN included file options/os-version.image.md) +#### **--os-version**=*version* + +Set the exact required operating system *version* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS version is kept, if the base image specified one. This option is typically only meaningful when the image's OS is Windows, and is typically set in Windows base images, so using this option is usually unnecessary. + +[//]: # (END included file options/os-version.image.md) + +#### **--output**, **-o**=*output-opts* + +Output destination (format: type=local,dest=path) + +The --output (or -o) option extends the default behavior of building a container image by allowing users to export the contents of the image as files on the local filesystem, which can be useful for generating local binaries, code generation, etc. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +The value for --output is a comma-separated sequence of key=value pairs, defining the output type and options. + +Supported _keys_ are: +- **dest**: Destination path for exported output. Valid value is absolute or relative path, `-` means the standard output. +- **type**: Defines the type of output to be used. Valid values is documented below. + +Valid _type_ values are: +- **local**: write the resulting build files to a directory on the client-side. +- **tar**: write the resulting files as a single tarball (.tar). + +If no type is specified, the value defaults to **local**. +Alternatively, instead of a comma-separated sequence, the value of **--output** can be just a destination (in the **dest** format) (e.g. `--output some-path`, `--output -`) where `--output some-path` is treated as if **type=local** and `--output -` is treated as if **type=tar**. + + +[//]: # (BEGIN included file options/pid.image.md) +#### **--pid**=*pid* + +Sets the configuration for PID namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new PID namespace is created, or it can be "host" to indicate that the PID namespace in which `podman` itself is being run is reused, or it can be the path to a PID namespace which is already in use by another +process. + +[//]: # (END included file options/pid.image.md) + +#### **--platform**=*os/arch[/variant][,...]* + +Set the *os/arch* of the built image (and its base image, when using one) +to the provided value instead of using the current operating system and +architecture of the host (for example `linux/arm`). Unless overridden, +subsequent lookups of the same image in the local storage matches this +platform, regardless of the host. + +If `--platform` is set, then the values of the `--arch`, `--os`, and +`--variant` options is overridden. + +The `--platform` option can be specified more than once, or given a +comma-separated list of values as its argument. When more than one platform is +specified, the `--manifest` option is used instead of the `--tag` +option. + +Os/arch pairs are those used by the Go Programming Language. In several cases +the *arch* value for a platform differs from one produced by other tools such as +the `arch` command. Valid OS and architecture name combinations are listed as +values for $GOOS and $GOARCH at https://golang.org/doc/install/source#environment, +and can also be found by running `go tool dist list`. + +While `podman build` is happy to use base images and build images for any +platform that exists, `RUN` instructions are unable to succeed without +the help of emulation provided by packages like `qemu-user-static`. + + +[//]: # (BEGIN included file options/pull.image.md) +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Only pull the image when it does not exist in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error when no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. + +[//]: # (END included file options/pull.image.md) + + +[//]: # (BEGIN included file options/quiet.md) +#### **--quiet**, **-q** + +Suppress output messages which indicate which instruction is being processed, and of progress when pulling images from a registry, and when writing the output image. + +[//]: # (END included file options/quiet.md) + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + + +[//]: # (BEGIN included file options/rm.md) +#### **--rm** + +Remove intermediate containers after a successful build (default true). + +[//]: # (END included file options/rm.md) + + +[//]: # (BEGIN included file options/runtime.md) +#### **--runtime**=*path* + +The *path* to an alternate OCI-compatible runtime, which is used to run +commands specified by the **RUN** instruction. + +Note: You can also override the default runtime by setting the BUILDAH\_RUNTIME environment variable. `export BUILDAH_RUNTIME=/usr/local/bin/runc` + +[//]: # (END included file options/runtime.md) + + +[//]: # (BEGIN included file options/runtime-flag.md) +#### **--runtime-flag**=*flag* + +Adds global flags for the container runtime. To list the supported flags, please consult the manpages of the selected container runtime. + +Note: Do not pass the leading -- to the flag. To pass the runc flag --log-format json to buildah build, the option given is --runtime-flag log-format=json. + +[//]: # (END included file options/runtime-flag.md) + +#### **--sbom**=*preset* + +Generate SBOMs (Software Bills Of Materials) for the output image by scanning +the working container and build contexts using the named combination of scanner +image, scanner commands, and merge strategy. Must be specified with one or +more of **--sbom-image-output**, **--sbom-image-purl-output**, **--sbom-output**, +and **--sbom-purl-output**. Recognized presets, and the set of options which +they equate to: + + - "syft", "syft-cyclonedx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output cyclonedx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output cyclonedx-json={OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "syft-spdx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output spdx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output spdx-json={OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + - "trivy", "trivy-cyclonedx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "trivy-spdx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + +#### **--sbom-image-output**=*path* + +When generating SBOMs, store the generated SBOM in the specified path in the +output image. There is no default. + +#### **--sbom-image-purl-output**=*path* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the specified path in the output +image. There is no default. + +#### **--sbom-merge-strategy**=*method* + +If more than one **--sbom-scanner-command** value is being used, use the +specified method to merge the output from later commands with output from +earlier commands. Recognized values include: + + - cat + Concatenate the files. + - merge-cyclonedx-by-component-name-and-version + Merge the "component" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "version" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + - merge-spdx-by-package-name-and-versioninfo + Merge the "package" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "versionInfo" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + +#### **--sbom-output**=*file* + +When generating SBOMs, store the generated SBOM in the named file on the local +filesystem. There is no default. + +#### **--sbom-purl-output**=*file* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the named file in the local +filesystem. There is no default. + +#### **--sbom-scanner-command**=*image* + +Generate SBOMs by running the specified command from the scanner image. If +multiple commands are specified, they are run in the order in which they are +specified. These text substitutions are performed: + - {ROOTFS} + The root of the built image's filesystem, bind mounted. + - {CONTEXT} + The build context and additional build contexts, bind mounted. + - {OUTPUT} + The name of a temporary output file, to be read and merged with others or copied elsewhere. + +#### **--sbom-scanner-image**=*image* + +Generate SBOMs using the specified scanner image. + + +[//]: # (BEGIN included file options/secret.image.md) +#### **--secret**=**id=id[,src=*envOrFile*][,env=*ENV*][,type=*file* | *env*]** + +Pass secret information to be used in the Containerfile for building images +in a safe way that will not end up stored in the final image, or be seen in other stages. +The value of the secret will be read from an environment variable or file named +by the "id" option, or named by the "src" option if it is specified, or from an +environment variable specified by the "env" option. See [EXAMPLES](#examples). +The secret will be mounted in the container at `/run/secrets/id` by default. + +To later use the secret, use the --mount flag in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret` + +The location of the secret in the container can be overridden using the +"target", "dst", or "destination" option of the `RUN --mount` flag. + +`RUN --mount=type=secret,id=mysecret,target=/run/secrets/myothersecret cat /run/secrets/myothersecret` + +Note: changing the contents of secret files will not trigger a rebuild of layers that use said secrets. + +[//]: # (END included file options/secret.image.md) + + +[//]: # (BEGIN included file options/security-opt.image.md) +#### **--security-opt**=*option* + +Security Options + +- `apparmor=unconfined` : Turn off apparmor confinement for the container +- `apparmor=alternate-profile` : Set the apparmor confinement profile for the +container + +- `label=user:USER` : Set the label user for the container processes +- `label=role:ROLE` : Set the label role for the container processes +- `label=type:TYPE` : Set the label process type for the container processes +- `label=level:LEVEL` : Set the label level for the container processes +- `label=filetype\:TYPE` : Set the label file type for the container files +- `label=disable` : Turn off label separation for the container +- `no-new-privileges` : Disable container processes from gaining additional privileges + +- `seccomp=unconfined` : Turn off seccomp confinement for the container +- `seccomp=profile.json` : JSON file to be used as the seccomp filter for the container. + +[//]: # (END included file options/security-opt.image.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the container. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + +#### **--sign-by**=*fingerprint* + +Sign the image using a GPG key with the specified FINGERPRINT. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines,) + + +[//]: # (BEGIN included file options/skip-unused-stages.md) +#### **--skip-unused-stages** + +Skip stages in multi-stage builds which don't affect the target stage. (Default: **true**). + +[//]: # (END included file options/skip-unused-stages.md) + + +[//]: # (BEGIN included file options/squash.md) +#### **--squash** + +Squash all of the image's new layers into a single new layer; any preexisting layers are not squashed. + +[//]: # (END included file options/squash.md) + + +[//]: # (BEGIN included file options/squash-all.md) +#### **--squash-all** + +Squash all of the new image's layers (including those inherited from a base image) into a single new layer. + +[//]: # (END included file options/squash-all.md) + + +[//]: # (BEGIN included file options/ssh.md) +#### **--ssh**=*default* | *id[=socket>* + +SSH agent socket or keys to expose to the build. +The socket path can be left empty to use the value of `default=$SSH_AUTH_SOCK` + +To later use the ssh agent, use the --mount option in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=ssh,id=id mycmd` + +[//]: # (END included file options/ssh.md) + +#### **--stdin** + +Pass stdin into the RUN containers. Sometime commands being RUN within a Containerfile +want to request information from the user. For example apt asking for a confirmation for install. +Use --stdin to be able to interact from the terminal during the build. + + +[//]: # (BEGIN included file options/tag.md) +#### **--tag**, **-t**=*imageName* + +Specifies the name which is assigned to the resulting image if the build process completes successfully. +If _imageName_ does not include a registry name, the registry name *localhost* is prepended to the image name. + +[//]: # (END included file options/tag.md) + + +[//]: # (BEGIN included file options/target.md) +#### **--target**=*stageName* + +Set the target build stage to build. When building a Containerfile with multiple build stages, --target can be used to specify an intermediate build stage by name as the final stage for the resulting image. Commands after the target stage is skipped. + +[//]: # (END included file options/target.md) + + +[//]: # (BEGIN included file options/timestamp.md) +#### **--timestamp**=*seconds* + +Set the create timestamp to seconds since epoch to allow for deterministic builds (defaults to current time). By default, the created timestamp is changed and written into the image manifest with every commit, causing the image's sha256 hash to be different even if the sources are exactly the same otherwise. +When --timestamp is set, the created timestamp is always set to the time specified and therefore not changed, allowing the image's sha256 hash to remain the same. All files committed to the layers of the image is created with the timestamp. + +If the only instruction in a Containerfile is `FROM`, this flag has no effect. + +[//]: # (END included file options/timestamp.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/ulimit.image.md) +#### **--ulimit**=*type=soft-limit[\:hard-limit]* + +Specifies resource limits to apply to processes launched when processing `RUN` instructions. This option can be specified multiple times. Recognized resource types include: + "core": maximum core dump size (ulimit -c) + "cpu": maximum CPU time (ulimit -t) + "data": maximum size of a process's data segment (ulimit -d) + "fsize": maximum size of new files (ulimit -f) + "locks": maximum number of file locks (ulimit -x) + "memlock": maximum amount of locked memory (ulimit -l) + "msgqueue": maximum amount of data in message queues (ulimit -q) + "nice": niceness adjustment (nice -n, ulimit -e) + "nofile": maximum number of open files (ulimit -n) + "nproc": maximum number of processes (ulimit -u) + "rss": maximum size of a process's (ulimit -m) + "rtprio": maximum real-time scheduling priority (ulimit -r) + "rttime": maximum amount of real-time execution between blocking syscalls + "sigpending": maximum number of pending signals (ulimit -i) + "stack": maximum stack size (ulimit -s) + +[//]: # (END included file options/ulimit.image.md) + + +[//]: # (BEGIN included file options/unsetenv.image.md) +#### **--unsetenv**=*env* + +Unset environment variables from the final image. + +[//]: # (END included file options/unsetenv.image.md) + + +[//]: # (BEGIN included file options/unsetlabel.md) +#### **--unsetlabel**=*label* + +Unset the image label, causing the label not to be inherited from the base image. + +[//]: # (END included file options/unsetlabel.md) + + +[//]: # (BEGIN included file options/userns.image.md) +#### **--userns**=*how* + +Sets the configuration for user namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new user namespace is created, it can be "host" to indicate that the user namespace in which `podman` itself is being run is reused, or it can be the path to a user namespace which is already in use by another process. + +[//]: # (END included file options/userns.image.md) + + +[//]: # (BEGIN included file options/userns-gid-map.md) +#### **--userns-gid-map**=*mapping* + +Directly specifies a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container GID, a corresponding starting host-level GID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-gids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-gid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-gid-map are specified, but --userns-uid-map is specified, the GID map is set to use the same numeric values as the UID map. + +[//]: # (END included file options/userns-gid-map.md) + + +[//]: # (BEGIN included file options/userns-gid-map-group.md) +#### **--userns-gid-map-group**=*group* + +Specifies that a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subgid` file which correspond to the specified group. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-uid-map-user is specified, but --userns-gid-map-group is not specified, `podman` assumes that the specified user name is also a +suitable group name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. + +[//]: # (END included file options/userns-gid-map-group.md) + + +[//]: # (BEGIN included file options/userns-uid-map.md) +#### **--userns-uid-map**=*mapping* + +Directly specifies a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions default to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container UID, a corresponding starting host-level UID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-uids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-uid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-uid-map are specified, but --userns-gid-map is specified, the UID map is set to use the same numeric values as the GID map. + +[//]: # (END included file options/userns-uid-map.md) + + +[//]: # (BEGIN included file options/userns-uid-map-user.md) +#### **--userns-uid-map-user**=*user* + +Specifies that a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subuid` file which correspond to the specified user. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-gid-map-group is specified, but --userns-uid-map-user is not specified, `podman` assumes that the specified group name is also a +suitable user name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. + +[//]: # (END included file options/userns-uid-map-user.md) + + +[//]: # (BEGIN included file options/uts.md) +#### **--uts**=*how* + +Sets the configuration for UTS namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new UTS namespace to be created, or it can be "host" to indicate that the UTS namespace in which `podman` itself is being run is reused, or it can be the path to a UTS namespace which is already in use by another process. + +[//]: # (END included file options/uts.md) + +#### **--variant**=*variant* + +Set the architecture variant of the image to be built, and that of the base +image to be pulled, if the build uses one, to the provided value instead of +using the architecture variant of the build host. + + +[//]: # (BEGIN included file options/volume.image.md) +#### **--volume**, **-v**=*[HOST-DIR\:CONTAINER-DIR[\:OPTIONS]]* + +Mount a host directory into containers when executing RUN instructions during +the build. + +The `OPTIONS` are a comma-separated list and can be one or more of: + + * [rw|ro] + * [z|Z|O] + * [U] + * [`[r]shared`|`[r]slave`|`[r]private`][[1]](#Footnote1) + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR` +must be an absolute path as well. Podman bind-mounts the `HOST-DIR` to the +specified path when processing RUN instructions. + +You can specify multiple **-v** options to mount one or more mounts. + +You can add the `:ro` or `:rw` suffix to a volume to mount it read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted. When running using user namespaces, the UID and GID inside +the namespace may correspond to another UID and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the namespace, to change recursively the owner and group of +the source volume. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add one of these two suffixes +`:z` or `:Z` to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The `z` option tells Podman that two containers +share the volume content. As a result, Podman labels the content with a shared +content label. Shared volume labels allow all containers to read/write content. +The `Z` option tells Podman to label the content with a private unshared label. +Only the current container can use a private volume. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the host machine to fail. For these types +of containers, disabling SELinux separation is recommended. The option +`--security-opt label=disable` disables SELinux separation for the container. +For example, if a user wanted to volume mount their entire home directory into the build containers, they need to disable SELinux separation. + + $ podman build --security-opt label=disable -v $HOME:/home/user . + +`Overlay Volume Mounts` + +The `:O` flag tells Podman to mount the directory from the host as a +temporary storage using the Overlay file system. The `RUN` command containers +are allowed to modify contents within the mountpoint and are stored in the +container storage in a separate directory. In Overlay FS terms the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the `RUN` command +finishes executing, similar to a tmpfs mount point. + +Any subsequent execution of `RUN` commands sees the original source directory +content, any changes from previous RUN commands no longer exists. + +One use case of the `overlay` mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: + +- Overlay mounts are not currently supported in rootless mode. +- The `O` flag is not allowed to be specified with the `Z` or `z` flags. + Content mounted into the container is labeled with the private label. + On SELinux systems, labels in the source directory needs to be readable + by the container label. If not, SELinux container separation must be disabled + for the container to work. +- Modification of the directory volume mounted into the container with an + overlay mount can cause unexpected failures. Do not modify the directory until + the container finishes running. + +By default bind mounted volumes are `private`. That means any mounts done +inside containers are not be visible on the host and vice versa. This behavior +can be changed by specifying a volume mount propagation property. + +When the mount propagation policy is set to `shared`, any mounts completed +inside the container on that volume is visible to both the host and +container. When the mount propagation policy is set to `slave`, one way mount +propagation is enabled and any mounts completed on the host for that volume is +visible only inside of the container. To control the mount propagation +property of volume use the `:[r]shared`, `:[r]slave` or `:[r]private` +propagation flag. For mount propagation to work on the source mount point (mount +point where source dir is mounted on) has to have the right propagation properties. +For shared volumes, the source mount point has to be shared. And for slave volumes, +the source mount has to be either shared or slave. [[1]](#Footnote1) + +Use `df ` to determine the source mount and then use +`findmnt -o TARGET,PROPAGATION ` to determine propagation +properties of source mount, if `findmnt` utility is not available, the source +mount point can be determined by looking at the mount entry in +`/proc/self/mountinfo`. Look at `optional fields` and see if any propagation +properties are specified. +`shared:X` means the mount is `shared`, `master:X` means the mount is `slave` +and if nothing is there that means the mount is `private`. [[1]](#Footnote1) + +To change propagation properties of a mount point use the `mount` command. For +example, to bind mount the source directory `/foo` do +`mount --bind /foo /foo` and `mount --make-private --make-shared /foo`. This +converts /foo into a `shared` mount point. The propagation properties of +the source mount can be changed directly. For instance if `/` is the source +mount for `/foo`, then use `mount --make-shared /` to convert `/` into a +`shared` mount. + +[//]: # (END included file options/volume.image.md) + +## EXAMPLES + +### Build an image using local Containerfiles + +Build image using Containerfile with content from current directory: +``` +$ podman build . +``` + +Build image using specified Containerfile with content from current directory: +``` +$ podman build -f Containerfile.simple . +``` + +Build image using Containerfile from stdin with content from current directory: +``` +$ cat $HOME/Containerfile | podman build -f - . +``` + +Build image using multiple Containerfiles with content from current directory: +``` +$ podman build -f Containerfile.simple -f Containerfile.notsosimple . +``` + +Build image with specified Containerfile with content from $HOME directory. Note `cpp` is applied to Containerfile.in before processing as Containerfile: +``` +$ podman build -f Containerfile.in $HOME +``` + +Build image with the specified tag with Containerfile and content from current directory: +``` +$ podman build -t imageName . +``` + +Build image ignoring registry verification for any images pulled via the Containerfile: +``` +$ podman build --tls-verify=false -t imageName . +``` + +Build image with the specified logging format: +``` +$ podman build --runtime-flag log-format=json . +``` + +Build image using debug mode for logging: +``` +$ podman build --runtime-flag debug . +``` + +Build image using specified registry attributes when pulling images from the selected Containerfile: +``` +$ podman build --authfile /tmp/auths/myauths.json --cert-dir $HOME/auth --tls-verify=true --creds=username:password -t imageName -f Containerfile.simple . +``` + +Build image using specified resource controls when running containers during the build: +``` +$ podman build --memory 40m --cpu-period 10000 --cpu-quota 50000 --ulimit nofile=1024:1028 -t imageName . +``` + +Build image using specified SELinux labels and cgroup config running containers during the build: +``` +$ podman build --security-opt label=level:s0:c100,c200 --cgroup-parent /path/to/cgroup/parent -t imageName . +``` + +Build image with read-only and SELinux relabeled volume mounted from the host into running containers during the build: +``` +$ podman build --volume /home/test:/myvol:ro,Z -t imageName . +``` + +Build image with overlay volume mounted from the host into running containers during the build: +``` +$ podman build -v /var/lib/yum:/var/lib/yum\:O -t imageName . +``` + +Build image using layers and then removing intermediate containers even if the build fails. +``` +$ podman build --layers --force-rm -t imageName . +``` + +Build image ignoring cache and not removing intermediate containers even if the build succeeds: +``` +$ podman build --no-cache --rm=false -t imageName . +``` + +Build image using the specified network when running containers during the build: +``` +$ podman build --network mynet . +``` + +Build an image using a secret stored in an environment variable or file named `mysecret` to be used with the instruction `RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret`: +``` +$ podman build --secret=id=mysecret . +``` + +Build an image using a secret stored in an environment variable named `MYSECRET` to be used with the instruction `RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret`: +``` +$ podman build --secret=id=mysecret,env=MYSECRET . +$ podman build --secret=id=mysecret,src=MYSECRET,type=env . +``` + +Build an image using a secret stored in a file named `.mysecret` to be used with the instruction `RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret`: +``` +$ podman build --secret=id=mysecret,src=.mysecret . +$ podman build --secret=id=mysecret,src=.mysecret,type=file . +``` + +### Building a multi-architecture image using the --manifest option (requires emulation software) + +Build image using the specified architectures and link to a single manifest on successful completion: +``` +$ podman build --arch arm --manifest myimage /tmp/mysrc +$ podman build --arch amd64 --manifest myimage /tmp/mysrc +$ podman build --arch s390x --manifest myimage /tmp/mysrc +``` + +Similarly build using a single command +``` +$ podman build --platform linux/s390x,linux/ppc64le,linux/amd64 --manifest myimage /tmp/mysrc +``` + +Build image using multiple specified architectures and link to single manifest on successful completion: +``` +$ podman build --platform linux/arm64 --platform linux/amd64 --manifest myimage /tmp/mysrc +``` + +### Building an image using a URL, Git repo, or archive + + The build context directory can be specified as a URL to a Containerfile, a +Git repository, or URL to an archive. If the URL is a Containerfile, it is +downloaded to a temporary location and used as the context. When a Git +repository is set as the URL, the repository is cloned locally to a temporary +location and then used as the context. Lastly, if the URL is an archive, it is +downloaded to a temporary location and extracted before being used as the +context. + +#### Building an image using a URL to a Containerfile + +Build image from Containerfile downloaded into temporary location used as the build context: +``` +$ podman build https://10.10.10.1/podman/Containerfile +``` + +#### Building an image using a Git repository + + Podman clones the specified GitHub repository to a temporary location and +uses it as the context. The Containerfile at the root of the repository is used +and it only works if the GitHub repository is a dedicated repository. + +Build image from specified git repository downloaded into temporary location used as the build context: +``` +$ podman build -t hello https://github.com/containers/PodmanHello.git +$ podman run hello +``` + + Note: GitHub does not support using `git://` for performing `clone` operation due to recent changes in their security guidance (https://github.blog/2021-09-01-improving-git-protocol-security-github/). Use an `https://` URL if the source repository is hosted on GitHub. + +#### Building an image using a URL to an archive + + Podman fetches the archive file, decompresses it, and uses its contents as the +build context. The Containerfile at the root of the archive and the rest of the +archive are used as the context of the build. Passing the +`-f PATH/Containerfile` option as well tells the system to look for that file +inside the contents of the archive. + +``` +$ podman build -f dev/Containerfile https://10.10.10.1/podman/context.tar.gz +``` + + Note: supported compression formats are 'xz', 'bzip2', 'gzip' and 'identity' +(no compression). + +## Files + +### .containerignore/.dockerignore + +If the file *.containerignore* or *.dockerignore* exists in the context directory, +`podman build` reads its contents. Use the `--ignorefile` option to override the +.containerignore path location. +Podman uses the content to exclude files and directories from the context +directory, when executing COPY and ADD directives in the +Containerfile/Dockerfile + +The .containerignore and .dockerignore files use the same syntax; if both +are in the context directory, podman build only uses .containerignore. + +Users can specify a series of Unix shell globs in a .containerignore file to +identify files/directories to exclude. + +Podman supports a special wildcard string `**` which matches any number of +directories (including zero). For example, **/*.go excludes all files that +end with .go that are found in all directories. + +Example .containerignore file: + +``` +# exclude this content for image +*/*.c +**/output* +src +``` + +`*/*.c` +Excludes files and directories whose names ends with .c in any top level +subdirectory. For example, the source file include/rootless.c. + +`**/output*` +Excludes files and directories starting with `output` from any directory. + +`src` +Excludes files named src and the directory src as well as any content in it. + +Lines starting with ! (exclamation mark) can be used to make exceptions to +exclusions. The following is an example .containerignore file that uses this +mechanism: +``` +*.doc +!Help.doc +``` + +Exclude all doc files except Help.doc from the image. + +This functionality is compatible with the handling of .containerignore files +described here: **[containerignore(5)](https://github.com/containers/common/blob/main/docs/containerignore.5.md)** + +### registries.conf (`/etc/containers/registries.conf`) + +registries.conf is the configuration file which specifies which container +registries is consulted when completing image names which do not include +a registry or domain portion. +See **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + + +## Troubleshooting + +### lastlog sparse file + +Using a useradd command within a Containerfile with a large UID/GID creates +a large sparse file `/var/log/lastlog`. This can cause the +build to hang forever. Go language does not support sparse files correctly, +which can lead to some huge files being created in the container image. + +When using the `useradd` command within the build script, pass the +`--no-log-init or -l` option to the `useradd` command. This option tells +useradd to stop creating the lastlog file. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/main/man/runc.8.md)**, **[useradd(8)](https://www.unix.com/man-page/redhat/8/useradd)**, **[podman-ps(1)](podman-ps.1.md)**, **[podman-rm(1)](podman-rm.1.md)**, **[Containerfile(5)](https://github.com/containers/common/blob/main/docs/Containerfile.5.md)**, **[containerignore(5)](https://github.com/containers/common/blob/main/docs/containerignore.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +See [podman-rootless(7)](https://github.com/containers/podman/blob/main/rootless.md) +for rootless issues. + +## HISTORY +Aug 2020, Additional options and .containerignore added by Dan Walsh `` + +May 2018, Minor revisions added by Joe Doss `` + +December 2017, Originally compiled by Tom Sweeney `` + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a +core value of open source. The `master` and `slave` mount propagation +terminology used here is problematic and divisive, and needs to be changed. +However, these terms are currently used within the Linux kernel and must be +used as-is at this time. When the kernel maintainers rectify this usage, +Podman will follow suit immediately. diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-commit.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-commit.1.md new file mode 100644 index 000000000..65ce66fcb --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-commit.1.md @@ -0,0 +1,139 @@ +--- +title: podman-commit +version: v5.5.2 +--- + +% podman-commit 1 + +## NAME +podman\-commit - Create new image based on the changed container + +## SYNOPSIS +**podman commit** [*options*] *container* [*image*] + +**podman container commit** [*options*] *container* [*image*] + +## DESCRIPTION +**podman commit** creates an image based on a changed *container*. The author of the image can be set using the **--author** OPTION. Various image instructions can be configured with the **--change** OPTION and a commit message can be set using the **--message** OPTION. The *container* and its processes aren't paused while the image is committed. If this is not desired, the **--pause** OPTION can be set to *true*. When the commit is complete, Podman prints out the ID of the new image. + +If `image` does not begin with a registry name component, `localhost` is added to the name. +If `image` is not provided, the values for the `REPOSITORY` and `TAG` values of the created image is set to ``. + +## OPTIONS +#### **--author**, **-a**=*author* + +Set the author for the committed image. + +#### **--change**, **-c**=*instruction* + +Apply the following possible instructions to the created image: + +- *CMD* +- *ENTRYPOINT* +- *ENV* +- *EXPOSE* +- *LABEL* +- *ONBUILD* +- *STOPSIGNAL* +- *USER* +- *VOLUME* +- *WORKDIR* + +Can be set multiple times. + +#### **--config**=*ConfigBlobFile* + +Merge the container configuration from the specified file into the configuration for the image +as it is being committed. The file contents should be a JSON-encoded version of +a Schema2Config structure, which is defined at +https://github.com/containers/image/blob/v5.29.0/manifest/docker_schema2.go#L67. + +#### **--format**, **-f**=**oci** | *docker* + +Set the format of the image manifest and metadata. The currently supported formats are **oci** and *docker*.\ +The default is **oci**. + +#### **--iidfile**=*ImageIDfile* + +Write the image ID to the file. + +#### **--include-volumes** + +Include in the committed image any volumes added to the container by the **--volume** or **--mount** OPTIONS to the **[podman create](podman-create.1.md)** and **[podman run](podman-run.1.md)** commands.\ +The default is **false**. + +#### **--message**, **-m**=*message* + +Set commit message for committed image.\ +*IMPORTANT: The message field is not supported in `oci` format.* + +#### **--pause**, **-p** + +Pause the container when creating an image.\ +The default is **false**. + +#### **--quiet**, **-q** + +Suppresses output.\ +The default is **false**. + +#### **--squash**, **-s** + +Squash newly built layers into a single new layer.\ +The default is **false**. + +## EXAMPLES +Create image from container with entrypoint and label: +``` +$ podman commit --change CMD=/bin/bash --change ENTRYPOINT=/bin/sh --change "LABEL blue=image" reverent_golick image-committed +Getting image source signatures +Copying blob sha256:b41deda5a2feb1f03a5c1bb38c598cbc12c9ccd675f438edc6acd815f7585b86 + 25.80 MB / 25.80 MB [======================================================] 0s +Copying config sha256\:c16a6d30f3782288ec4e7521c754acc29d37155629cb39149756f486dae2d4cd + 448 B / 448 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Create image from container with commit message: +``` +$ podman commit -q --message "committing container to image" +reverent_golick image-committed +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Create image from container with author: +``` +$ podman commit -q --author "firstName lastName" reverent_golick image-committed +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Pause running container while creating image: +``` +$ podman commit -q --pause=true containerID image-committed +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Create image from container with default image tag: +``` +$ podman commit containerID +e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 +``` + +Create image from container with default required capabilities: +``` +$ podman commit -q --change LABEL=io.containers.capabilities=setuid,setgid epic_nobel privimage +400d31a3f36dca751435e80a0e16da4859beb51ff84670ce6bdc5edb30b94066 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-create(1)](podman-create.1.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +December 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-completion.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-completion.1.md new file mode 100644 index 000000000..772a283f6 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-completion.1.md @@ -0,0 +1,83 @@ +--- +title: podman-completion +version: v5.5.2 +--- + +% podman-completion 1 + +## NAME +podman\-completion - Generate shell completion scripts + +## SYNOPSIS +**podman completion** [*options*] *bash* | *zsh* | *fish* | *powershell* + +## DESCRIPTION +**podman completion** generates shell completion scripts for a variety of shells. Supported shells are *bash*, *zsh*, *fish* and *powershell*. + +These script are used by the shell to provide suggestions and complete commands when the command is typed and `[TAB]` is pressed. + +Usually these scripts are automatically installed via the package manager. + +## OPTIONS +#### **--file**, **-f**=*file* + +Write the generated output to a file. + +#### **--no-desc** + +Do not provide description in the completions.\ +The default is **false**. + +## Installation + +### BASH +`bash-completion` has to be installed on the system. + +To load the completion script into the current session run: +``` +source <(podman completion bash) +``` + +To make it available for all bash sessions run: +``` +podman completion -f /etc/bash_completion.d/podman bash +``` + + +### ZSH +Shell completion needs to be already enabled in the environment. The following can be executed: +``` +echo "autoload -U compinit; compinit" >> ~/.zshrc +``` + +To make it available for all zsh sessions run: +``` +podman completion -f "${fpath[1]}/_podman" zsh +``` + +Once the shell is reloaded the auto-completion works. + + +### FISH +To load the completion script into the current session run: +``` +podman completion fish | source +``` + +To make it available for all fish sessions run: +``` +podman completion -f ~/.config/fish/completions/podman.fish fish +``` + +### POWERSHELL +To load the completion script into the current session run: +``` +podman.exe completion powershell | Out-String | Invoke-Expression +``` + +To make it available in all powershell sessions that a user has, write the +completion output to a file and source that to the user's powershell profile. +More information about profiles is available with **Get-Help about_Profiles**. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **zsh(1)**, **fish(1)**, **powershell(1)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-compose.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-compose.1.md new file mode 100644 index 000000000..7bbc2d5ca --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-compose.1.md @@ -0,0 +1,28 @@ +--- +title: podman-compose +version: v5.5.2 +--- + +% podman-compose 1 + +## NAME +podman\-compose - Run Compose workloads via an external compose provider + +## SYNOPSIS +**podman compose** [*options*] [*command* [*arg* ...]] + +## DESCRIPTION +**podman compose** is a thin wrapper around an external compose provider such as docker-compose or podman-compose. This means that `podman compose` is executing another tool that implements the compose functionality but sets up the environment in a way to let the compose provider communicate transparently with the local Podman socket. The specified options as well the command and argument are passed directly to the compose provider. + +The default compose providers are `docker-compose` and `podman-compose`. If installed, `docker-compose` takes precedence since it is the original implementation of the Compose specification and is widely used on the supported platforms (i.e., Linux, Mac OS, Windows). + +If you want to change the default behavior or have a custom installation path for your provider of choice, please change the `compose_providers` field in `containers.conf(5)` to `compose_providers = ["/path/to/provider"]`. You may also set the `PODMAN_COMPOSE_PROVIDER` environment variable. + +By default, `podman compose` will emit a warning saying that it executes an external command. This warning can be disabled by setting `compose_warning_logs` to false in `containers.conf(5)` or setting the `PODMAN_COMPOSE_WARNING_LOGS` environment variable to false. See the man page for `containers.conf(5)` for more information. + +## OPTIONS + +To see supported options of the installed compose provider, please run `podman compose --help`. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-container-checkpoint.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-container-checkpoint.1.md new file mode 100644 index 000000000..4773eed07 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-container-checkpoint.1.md @@ -0,0 +1,231 @@ +--- +title: podman-container-checkpoint +version: v5.5.2 +--- + +% podman-container-checkpoint 1 + +## NAME +podman\-container\-checkpoint - Checkpoint one or more running containers + +## SYNOPSIS +**podman container checkpoint** [*options*] *container* [*container* ...] + +## DESCRIPTION +**podman container checkpoint** checkpoints all the processes in one or more *containers*. A *container* can be restored from a checkpoint with **[podman-container-restore](podman-container-restore.1.md)**. The *container IDs* or *names* are used as input. + +*IMPORTANT: If the container is using __systemd__ as __entrypoint__ checkpointing the container might not be possible.* + +## OPTIONS +#### **--all**, **-a** + +Checkpoint all running *containers*.\ +The default is **false**.\ +*IMPORTANT: This OPTION does not need a container name or ID as input argument.* + +#### **--compress**, **-c**=**zstd** | *none* | *gzip* + +Specify the compression algorithm used for the checkpoint archive created +with the **--export, -e** OPTION. Possible algorithms are **zstd**, *none* +and *gzip*.\ +One possible reason to use *none* is to enable faster creation of checkpoint +archives. Not compressing the checkpoint archive can result in faster checkpoint +archive creation.\ +The default is **zstd**. + +#### **--create-image**=*image* + +Create a checkpoint image from a running container. This is a standard OCI image +created in the local image store. It consists of a single layer that contains +all of the checkpoint files. The content of this image layer is in the same format as a +checkpoint created with **--export**. A checkpoint image can be pushed to a +standard container registry and pulled on a different system to enable container +migration. In addition, the image can be exported with **podman image save** and +inspected with **podman inspect**. Inspecting a checkpoint image displays +additional information, stored as annotations, about the host environment used +to do the checkpoint: + +- **io.podman.annotations.checkpoint.name**: Human-readable name of the original + container. + +- **io.podman.annotations.checkpoint.rawImageName**: Unprocessed name of the + image used to create the original container (as specified by the user). + +- **io.podman.annotations.checkpoint.rootfsImageID**: ID of the image used to + create the original container. + +- **io.podman.annotations.checkpoint.rootfsImageName**: Image name used to + create the original container. + +- **io.podman.annotations.checkpoint.podman.version**: Version of Podman used to + create the checkpoint. + +- **io.podman.annotations.checkpoint.criu.version**: Version of CRIU used to + create the checkpoint. + +- **io.podman.annotations.checkpoint.runtime.name**: Container runtime (e.g., + runc, crun) used to create the checkpoint. + +- **io.podman.annotations.checkpoint.runtime.version**: Version of the container + runtime used to create the checkpoint. + +- **io.podman.annotations.checkpoint.conmon.version**: Version of conmon used + with the original container. + +- **io.podman.annotations.checkpoint.host.arch**: CPU architecture of the host + on which the checkpoint was created. + +- **io.podman.annotations.checkpoint.host.kernel**: Version of Linux kernel + of the host where the checkpoint was created. + +- **io.podman.annotations.checkpoint.cgroups.version**: cgroup version used by + the host where the checkpoint was created. + +- **io.podman.annotations.checkpoint.distribution.version**: Version of host + distribution on which the checkpoint was created. + +- **io.podman.annotations.checkpoint.distribution.name**: Name of host + distribution on which the checkpoint was created. + +#### **--export**, **-e**=*archive* + +Export the checkpoint to a tar.gz file. The exported checkpoint can be used +to import the *container* on another system and thus enabling container live +migration. This checkpoint archive also includes all changes to the *container's* +root file-system, if not explicitly disabled using **--ignore-rootfs**. + +#### **--file-locks** + +Checkpoint a *container* with file locks. If an application running in the container +is using file locks, this OPTION is required during checkpoint and restore. Otherwise +checkpointing *containers* with file locks is expected to fail. If file locks are not +used, this option is ignored.\ +The default is **false**. + +#### **--ignore-rootfs** + +If a checkpoint is exported to a tar.gz file it is possible with the help of **--ignore-rootfs** to explicitly disable including changes to the root file-system into the checkpoint archive file.\ +The default is **false**.\ +*IMPORTANT: This OPTION only works in combination with __--export, -e__.* + +#### **--ignore-volumes** + +This OPTION must be used in combination with the **--export, -e** OPTION. +When this OPTION is specified, the content of volumes associated with +the *container* is not included into the checkpoint tar.gz file.\ +The default is **false**. + +#### **--keep**, **-k** + +Keep all temporary log and statistics files created by CRIU during checkpointing. These files are not deleted if checkpointing fails for further debugging. If checkpointing succeeds these files are theoretically not needed, but if these files are needed Podman can keep the files for further analysis.\ +The default is **false**. + +#### **--latest**, **-l** + +Instead of providing the *container ID* or *name*, use the last created *container*. The default is **false**. +*IMPORTANT: This OPTION is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines. This OPTION does not need a container name or ID as input argument.* + +#### **--leave-running**, **-R** + +Leave the *container* running after checkpointing instead of stopping it.\ +The default is **false**. + +#### **--pre-checkpoint**, **-P** + +Dump the *container's* memory information only, leaving the *container* running. Later +operations supersedes prior dumps. It only works on `runc 1.0-rc3` or `higher`.\ +The default is **false**. + +The functionality to only checkpoint the memory of the container and in a second +checkpoint only write out the memory pages which have changed since the first +checkpoint relies on the Linux kernel's soft-dirty bit, which is not available +on all systems as it depends on the system architecture and the configuration +of the Linux kernel. Podman verifies if the current system supports this +functionality and return an error if the current system does not support it. + +#### **--print-stats** + +Print out statistics about checkpointing the container(s). The output is +rendered in a JSON array and contains information about how much time different +checkpoint operations required. Many of the checkpoint statistics are created +by CRIU and just passed through to Podman. The following information is provided +in the JSON array: + +- **podman_checkpoint_duration**: Overall time (in microseconds) needed to create + all checkpoints. + +- **runtime_checkpoint_duration**: Time (in microseconds) the container runtime + needed to create the checkpoint. + +- **freezing_time**: Time (in microseconds) CRIU needed to pause (freeze) all + processes in the container (measured by CRIU). + +- **frozen_time**: Time (in microseconds) all processes in the container were + paused (measured by CRIU). + +- **memdump_time**: Time (in microseconds) needed to extract all required memory + pages from all container processes (measured by CRIU). + +- **memwrite_time**: Time (in microseconds) needed to write all required memory + pages to the corresponding checkpoint image files (measured by CRIU). + +- **pages_scanned**: Number of memory pages scanned to determine if they need + to be checkpointed (measured by CRIU). + +- **pages_written**: Number of memory pages actually written to the checkpoint + image files (measured by CRIU). + +The default is **false**. + +#### **--tcp-established** + +Checkpoint a *container* with established TCP connections. If the checkpoint +image contains established TCP connections, this OPTION is required during +restore. Defaults to not checkpointing *containers* with established TCP +connections.\ +The default is **false**. + +#### **--with-previous** + +Check out the *container* with previous criu image files in pre-dump. It only works on `runc 1.0-rc3` or `higher`.\ +The default is **false**.\ +*IMPORTANT: This OPTION is not available with __--pre-checkpoint__*. + +This option requires that the option __--pre-checkpoint__ has been used before on the +same container. Without an existing pre-checkpoint, this option fails. + +Also see __--pre-checkpoint__ for additional information about __--pre-checkpoint__ +availability on different systems. + +## EXAMPLES +Make a checkpoint for the container "mywebserver". +``` +# podman container checkpoint mywebserver +``` + +Create a checkpoint image for the container "mywebserver". +``` +# podman container checkpoint --create-image mywebserver-checkpoint-1 mywebserver +``` + +Dumps the container's memory information of the latest container into an archive. +``` +# podman container checkpoint -P -e pre-checkpoint.tar.gz -l +``` + +Keep the container's memory information from an older dump and add the new container's memory information. +``` +# podman container checkpoint --with-previous -e checkpoint.tar.gz -l +``` + +Dump the container's memory information of the latest container into an archive with the specified compress method. +``` +# podman container checkpoint -l --compress=none --export=dump.tar +# podman container checkpoint -l --compress=gzip --export=dump.tar.gz +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container-restore(1)](podman-container-restore.1.md)**, **criu(8)** + +## HISTORY +September 2018, Originally compiled by Adrian Reber diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-container-cleanup.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-container-cleanup.1.md new file mode 100644 index 000000000..0039d11d5 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-container-cleanup.1.md @@ -0,0 +1,61 @@ +--- +title: podman-container-cleanup +version: v5.5.2 +--- + +% podman-container-cleanup 1 + +## NAME +podman\-container\-cleanup - Clean up the container's network and mountpoints + +## SYNOPSIS +**podman container cleanup** [*options*] *container* [*container* ...] + +## DESCRIPTION +**podman container cleanup** cleans up exited *containers* by removing all mountpoints and network configurations from the host. The *container name* or *ID* can be used. The cleanup command does not remove the *containers*. Running *containers* are not cleaned up.\ +Sometimes container mount points and network stacks can remain if the podman command was killed or the *container* ran in daemon mode. This command is automatically executed when *containers* are run in daemon mode by the `conmon process` when the *container* exits. + +## OPTIONS +#### **--all**, **-a** + +Clean up all *containers*.\ +The default is **false**.\ +*IMPORTANT: This OPTION does not need a container name or ID as input argument.* + +#### **--exec**=*session* + +Clean up an exec session for a single *container*. +It can only be specified if a single *container* is being cleaned up (conflicts with **--all** as such). If **--rm** is not specified, temporary files for the exec session are cleaned up; if it is, the exec session is removed from the *container*.\ +*IMPORTANT: Conflicts with **--rmi** as the container is not being cleaned up so the image cannot be removed.* + +#### **--latest**, **-l** + +Instead of providing the *container ID* or *name*, use the last created *container*. The default is **false**. +*IMPORTANT: This OPTION is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines. This OPTION does not need a container name or ID as input argument.* + +#### **--rm** + +After cleanup, remove the *container* entirely.\ +The default is **false**. + +#### **--rmi** + +After cleanup, remove the image entirely.\ +The default is **false**. + +## EXAMPLES +Clean up the container "mywebserver". +``` +$ podman container cleanup mywebserver +``` + +Clean up the containers with the names "mywebserver", "myflaskserver", "860a4b23". +``` +$ podman container cleanup mywebserver myflaskserver 860a4b23 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)** + +## HISTORY +Jun 2018, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-container-clone.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-container-clone.1.md new file mode 100644 index 000000000..929c37963 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-container-clone.1.md @@ -0,0 +1,362 @@ +--- +title: podman-container-clone +version: v5.5.2 +--- + +% podman-container-clone 1 + +## NAME +podman\-container\-clone - Create a copy of an existing container + +## SYNOPSIS +**podman container clone** [*options*] *container* *name* *image* + +## DESCRIPTION +**podman container clone** creates a copy of a container, recreating the original with an identical configuration. This command takes three arguments: the first being the container ID or name to clone, the second argument in this command can change the name of the clone from the default of $ORIGINAL_NAME-clone, and the third is a new image to use in the cloned container. + +## OPTIONS + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + +If none is specified, the original container's cpu period is used + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + +If none is specified, the original container's CPU quota are used. + + +[//]: # (BEGIN included file options/cpu-rt-period.md) +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-period.md) + +If none is specified, the original container's CPU runtime period is used. + + +[//]: # (BEGIN included file options/cpu-rt-runtime.md) +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-runtime.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + +If none are specified, the original container's CPU shares are used. + +#### **--cpus** + +Set a number of CPUs for the container that overrides the original containers CPU limits. If none are specified, the original container's Nano CPUs are used. + +This is shorthand +for **--cpu-period** and **--cpu-quota**, so only **--cpus** or either both the **--cpu-period** and **--cpu-quota** options can be set. + +This option is not supported on cgroups V1 rootless systems. + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + +If none are specified, the original container's CPUset is used. + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + +If none are specified, the original container's CPU memory nodes are used. + + +[//]: # (BEGIN included file options/destroy.md) +#### **--destroy** + +Remove the original container that we are cloning once used to mimic the configuration. + +[//]: # (END included file options/destroy.md) + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + +#### **--force**, **-f** + +Force removal of the original container that we are cloning. Can only be used in conjunction with **--destroy**. + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + +If no memory limits are specified, the original container's memory limits are used. + + +[//]: # (BEGIN included file options/memory-reservation.md) +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-reservation.md) + +If unspecified, memory reservation is the same as memory limit from the +container being cloned. + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + +If unspecified, the container being cloned is used to derive +the swap value. + + +[//]: # (BEGIN included file options/memory-swappiness.md) +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/memory-swappiness.md) + +#### **--name** + +Set a custom name for the cloned container. The default if not specified is of the syntax: **\-clone** + +#### **--pod**=*name* + +Clone the container in an existing pod. It is helpful to move a container to an +existing pod. The container joins the pod shared namespaces, losing its configuration +that conflicts with the shared namespaces. + +#### **--run** + +When set to true, this flag runs the newly created container after the +clone process has completed, this specifies a detached running mode. + +## EXAMPLES + +Clone specified container into a new container: +``` +# podman container clone d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone specified container into a newly named container: +``` +# podman container clone --name=clone d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Replace specified container with selected resource constraints into a new container, removing original container: +``` +# podman container clone --destroy --cpus=5 d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone specified container giving a new name and then replacing the image of the original container with the specified image name: +``` +# podman container clone 2d4d4fca7219b4437e0d74fcdc272c4f031426a6eacd207372691207079551de new_name fedora +Resolved "fedora" as an alias (/etc/containers/registries.conf.d/shortnames.conf) +Trying to pull registry.fedoraproject.org/fedora\:latest... +Getting image source signatures +Copying blob c6183d119aa8 done +Copying config e417cd49a8 done +Writing manifest to image destination +Storing signatures +5a9b7851013d326aa4ac4565726765901b3ecc01fcbc0f237bc7fd95588a24f9 +``` + +## SEE ALSO +**[podman-create(1)](podman-create.1.md)**, **[cgroups(7)](https://man7.org/linux/man-pages/man7/cgroups.7.html)** + +## HISTORY +January 2022, Originally written by Charlie Doern diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-container-diff.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-container-diff.1.md new file mode 100644 index 000000000..f291613eb --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-container-diff.1.md @@ -0,0 +1,65 @@ +--- +title: podman-container-diff +version: v5.5.2 +--- + +% podman-container-diff 1 + +## NAME +podman\-container\-diff - Inspect changes on a container's filesystem + +## SYNOPSIS +**podman container diff** [*options*] *container* [*container*] + +## DESCRIPTION +Displays changes on a container's filesystem. The container is compared to its parent layer or the second argument when given. + +The output is prefixed with the following symbols: + +| Symbol | Description | +|--------|-------------| +| A | A file or directory was added. | +| D | A file or directory was deleted. | +| C | A file or directory was changed. | + +## OPTIONS + +#### **--format** + +Alter the output into a different format. The only valid format for **podman container diff** is `json`. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +``` +# podman container diff container1 +C /usr +C /usr/local +C /usr/local/bin +A /usr/local/bin/docker-entrypoint.sh +``` + +``` +$ podman container diff --format json container1 container2 +{ + "added": [ + "/test" + ] +} +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)** + +## HISTORY +July 2021, Originally compiled by Paul Holzinger diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-container-exists.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-container-exists.1.md new file mode 100644 index 000000000..f7df0c626 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-container-exists.1.md @@ -0,0 +1,56 @@ +--- +title: podman-container-exists +version: v5.5.2 +--- + +% podman-container-exists 1 + +## NAME +podman\-container\-exists - Check if a container exists in local storage + +## SYNOPSIS +**podman container exists** [*options*] *container* + +## DESCRIPTION +**podman container exists** checks if a container exists in local storage. The *container ID* or *name* is used as input. Podman returns an exit code +of `0` when the container is found. A `1` is returned otherwise. An exit code of `125` indicates there was an issue accessing the local storage. + +## OPTIONS +#### **--external** + +Check for external *containers* as well as Podman *containers*. These external *containers* are generally created via other container technology such as `Buildah` or `CRI-O`.\ +The default is **false**. + +**-h**, **--help** + +Prints usage statement.\ +The default is **false**. + +## EXAMPLES + +Check if a container called "webclient" exists in local storage. Here, the container does exist. +``` +$ podman container exists webclient +$ echo $? +0 +``` + +Check if a container called "webbackend" exists in local storage. Here, the container does not exist. +``` +$ podman container exists webbackend +$ echo $? +1 +``` + +Check if a container called "ubi8-working-container" created via Buildah exists in local storage. Here, the container does not exist. +``` +$ podman container exists --external ubi8-working-container +$ echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +November 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-container-inspect.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-container-inspect.1.md new file mode 100644 index 000000000..1a3a92fdd --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-container-inspect.1.md @@ -0,0 +1,349 @@ +--- +title: podman-container-inspect +version: v5.5.2 +--- + +% podman-container-inspect 1 + +## NAME +podman\-container\-inspect - Display a container's configuration + +## SYNOPSIS +**podman container inspect** [*options*] *container* [*container* ...] + +## DESCRIPTION + +This displays the low-level information on containers identified by name or ID. By default, this renders +all results in a JSON array. If a format is specified, the given template is executed for each result. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Format the output using the given Go template. +The keys of the returned JSON can be used as the values for the --format flag (see examples below). + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------------ | -------------------------------------------------- | +| .AppArmorProfile | AppArmor profile (string) | +| .Args | Command-line arguments (array of strings) | +| .BoundingCaps | Bounding capability set (array of strings) | +| .Config ... | Structure with config info | +| .ConmonPidFile | Path to file containing conmon pid (string) | +| .Created ... | Container creation time (string, ISO3601) | +| .Dependencies | Dependencies (array of strings) | +| .Driver | Storage driver (string) | +| .EffectiveCaps | Effective capability set (array of strings) | +| .ExecIDs | Exec IDs (array of strings) | +| .GraphDriver ... | Further details of graph driver (struct) | +| .HostConfig ... | Host config details (struct) | +| .HostnamePath | Path to file containing hostname (string) | +| .HostsPath | Path to container /etc/hosts file (string) | +| .ID | Container ID (full 64-char hash) | +| .Image | Container image ID (64-char hash) | +| .ImageDigest | Container image digest (sha256:+64-char hash) | +| .ImageName | Container image name (string) | +| .IsInfra | Is this an infra container? (string: true/false) | +| .IsService | Is this a service container? (string: true/false) | +| .KubeExitCodePropagation | Kube exit-code propagation (string) | +| .LockNumber | Number of the container's Libpod lock | +| .MountLabel | SELinux label of mount (string) | +| .Mounts | Mounts (array of strings) | +| .Name | Container name (string) | +| .Namespace | Container namespace (string) | +| .NetworkSettings ... | Network settings (struct) | +| .OCIConfigPath | Path to OCI config file (string) | +| .OCIRuntime | OCI runtime name (string) | +| .Path | Path to container command (string) | +| .PidFile | Path to file containing container PID (string) | +| .Pod | Parent pod (string) | +| .ProcessLabel | SELinux label of process (string) | +| .ResolvConfPath | Path to container's resolv.conf file (string) | +| .RestartCount | Number of times container has been restarted (int) | +| .Rootfs | Container rootfs (string) | +| .SizeRootFs | Size of rootfs, in bytes [1] | +| .SizeRw | Size of upper (R/W) container layer, in bytes [1] | +| .State ... | Container state info (struct) | +| .StaticDir | Path to container metadata dir (string) | +| .UseImageHostname | Use /etc/hostname from the image if it exists? (string: true/false) +| +| .UseImageHosts | Use /etc/hosts from the image? (string: true/false) +| + +[1] This format specifier requires the **--size** option + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--size**, **-s** + +In addition to normal output, display the total file size if the type is a container. + + +## EXAMPLE + +Inspect the specified container and print its information in json format. +``` +$ podman container inspect foobar +[ + { + "Id": "99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6", + "Created": "2021-09-16T06:09:08.936623325-04:00", + "Path": "echo", + "Args": [ + "hi" + ], + "State": { + "OciVersion": "1.0.2-dev", + "Status": "exited", + "Running": false, + "Paused": false, + "Restarting": false, + "OOMKilled": false, + "Dead": false, + "Pid": 0, + "ExitCode": 0, + "Error": "", + "StartedAt": "2021-09-16T06:09:09.033564436-04:00", + "FinishedAt": "2021-09-16T06:09:09.036184314-04:00", + "Healthcheck": { + "Status": "", + "FailingStreak": 0, + "Log": null + } + }, + "Image": "14119a10abf4669e8cdbdff324a9f9605d99697215a0d21c360fe8dfa8471bab", + "ImageName": "docker.io/library/alpine:latest", + "Rootfs": "", + "Pod": "", + "ResolvConfPath": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/resolv.conf", + "HostnamePath": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/hostname", + "HostsPath": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/hosts", + "StaticDir": "/home/dwalsh/.local/share/containers/storage/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata", + "OCIConfigPath": "/home/dwalsh/.local/share/containers/storage/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/config.json", + "OCIRuntime": "crun", + "ConmonPidFile": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/conmon.pid", + "PidFile": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/pidfile", + "Name": "foobar", + "RestartCount": 0, + "Driver": "overlay", + "MountLabel": "system_u:object_r:container_file_t:s0:c25,c695", + "ProcessLabel": "system_u:system_r:container_t:s0:c25,c695", + "AppArmorProfile": "", + "EffectiveCaps": [ + "CAP_CHOWN", + "CAP_DAC_OVERRIDE", + "CAP_FOWNER", + "CAP_FSETID", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_SETFCAP", + "CAP_SETGID", + "CAP_SETPCAP", + "CAP_SETUID", + ], + "BoundingCaps": [ + "CAP_CHOWN", + "CAP_DAC_OVERRIDE", + "CAP_FOWNER", + "CAP_FSETID", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_SETFCAP", + "CAP_SETGID", + "CAP_SETPCAP", + "CAP_SETUID", + ], + "ExecIDs": [], + "GraphDriver": { + "Name": "overlay", + "Data": { + "LowerDir": "/home/dwalsh/.local/share/containers/storage/overlay/e2eb06d8af8218cfec8210147357a68b7e13f7c485b991c288c2d01dc228bb68/diff", + "UpperDir": "/home/dwalsh/.local/share/containers/storage/overlay/8f3d70434a3db17410ec4710caf4f251f3e4ed0a96a08124e4b3d4af0a0ea300/diff", + "WorkDir": "/home/dwalsh/.local/share/containers/storage/overlay/8f3d70434a3db17410ec4710caf4f251f3e4ed0a96a08124e4b3d4af0a0ea300/work" + } + }, + "Mounts": [], + "Dependencies": [], + "NetworkSettings": { + "EndpointID": "", + "Gateway": "", + "IPAddress": "", + "IPPrefixLen": 0, + "IPv6Gateway": "", + "GlobalIPv6Address": "", + "GlobalIPv6PrefixLen": 0, + "MacAddress": "", + "Bridge": "", + "SandboxID": "", + "HairpinMode": false, + "LinkLocalIPv6Address": "", + "LinkLocalIPv6PrefixLen": 0, + "Ports": {}, + "SandboxKey": "" + }, + "Namespace": "", + "IsInfra": false, + "Config": { + "Hostname": "99f66530fe9c", + "Domainname": "", + "User": "", + "AttachStdin": false, + "AttachStdout": false, + "AttachStderr": false, + "Tty": false, + "OpenStdin": false, + "StdinOnce": false, + "Env": [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "TERM=xterm", + "container=podman", + "HOME=/root", + "HOSTNAME=99f66530fe9c" + ], + "Cmd": [ + "echo", + "hi" + ], + "Image": "docker.io/library/alpine:latest", + "Volumes": null, + "WorkingDir": "/", + "Entrypoint": "", + "OnBuild": null, + "Labels": null, + "Annotations": { + "io.container.manager": "libpod", + "io.kubernetes.cri-o.Created": "2021-09-16T06:09:08.936623325-04:00", + "org.opencontainers.image.stopSignal": "15" + }, + "StopSignal": 15, + "CreateCommand": [ + "podman", + "run", + "--name", + "foobar", + "alpine", + "echo", + "hi" + ], + "Timezone": "local", + "Umask": "0022", + "Timeout": 0, + "StopTimeout": 10 + }, + "HostConfig": { + "Binds": [], + "CgroupManager": "systemd", + "CgroupMode": "private", + "ContainerIDFile": "", + "LogConfig": { + "Type": "journald", + "Config": null, + "Path": "", + "Tag": "", + "Size": "0B" + }, + "NetworkMode": "slirp4netns", + "PortBindings": {}, + "RestartPolicy": { + "Name": "", + "MaximumRetryCount": 0 + }, + "AutoRemove": false, + "VolumeDriver": "", + "VolumesFrom": null, + "CapAdd": [], + "CapDrop": [], + "Dns": [], + "DnsOptions": [], + "DnsSearch": [], + "ExtraHosts": [], + "GroupAdd": [], + "IpcMode": "shareable", + "Cgroup": "", + "Cgroups": "default", + "Links": null, + "OomScoreAdj": 0, + "PidMode": "private", + "Privileged": false, + "PublishAllPorts": false, + "ReadonlyRootfs": false, + "SecurityOpt": [], + "Tmpfs": {}, + "UTSMode": "private", + "UsernsMode": "", + "ShmSize": 65536000, + "Runtime": "oci", + "ConsoleSize": [ + 0, + 0 + ], + "Isolation": "", + "CpuShares": 0, + "Memory": 0, + "NanoCpus": 0, + "CgroupParent": "user.slice", + "BlkioWeight": 0, + "BlkioWeightDevice": null, + "BlkioDeviceReadBps": null, + "BlkioDeviceWriteBps": null, + "BlkioDeviceReadIOps": null, + "BlkioDeviceWriteIOps": null, + "CpuPeriod": 0, + "CpuQuota": 0, + "CpuRealtimePeriod": 0, + "CpuRealtimeRuntime": 0, + "CpusetCpus": "", + "CpusetMems": "", + "Devices": [], + "DiskQuota": 0, + "KernelMemory": 0, + "MemoryReservation": 0, + "MemorySwap": 0, + "MemorySwappiness": 0, + "OomKillDisable": false, + "PidsLimit": 2048, + "Ulimits": [], + "CpuCount": 0, + "CpuPercent": 0, + "IOMaximumIOps": 0, + "IOMaximumBandwidth": 0, + "CgroupConf": null + } + } +] +``` + +Inspect the specified container for the Image Name it is based on. +``` +$ podman container inspect nervous_fermi --format "{{.ImageName}}" +registry.access.redhat.com/ubi8:latest +``` + +Inspect the specified container for the GraphDriver Name it is running with. +``` +$ podman container inspect foobar --format "{{.GraphDriver.Name}}" +overlay +``` + +Inspect the latest container created for its EffectiveCaps field. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman container inspect --latest --format {{.EffectiveCaps}} +[CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_FSETID CAP_KILL CAP_NET_BIND_SERVICE CAP_SETFCAP CAP_SETGID CAP_SETPCAP CAP_SETUID] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +Sep 2021, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-container-prune.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-container-prune.1.md new file mode 100644 index 000000000..77a6d62fa --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-container-prune.1.md @@ -0,0 +1,83 @@ +--- +title: podman-container-prune +version: v5.5.2 +--- + +% podman-container-prune 1 + +## NAME +podman\-container\-prune - Remove all stopped containers from local storage + +## SYNOPSIS +**podman container prune** [*options*] + +## DESCRIPTION +**podman container prune** removes all stopped containers from local storage. + +## OPTIONS +#### **--filter**=*filters* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------:|------------------------------------------------------------------------------------------------------| +| label | Only remove containers, with (or without, in the case of label!=[...] is used) the specified labels. | +| until | Only remove containers created before given timestamp. | + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes containers with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes containers without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not provide an interactive prompt for container removal.\ +The default is **false**. + +**-h**, **--help** + +Print usage statement.\ +The default is **false**. + +## EXAMPLES +Remove all stopped containers from local storage: +``` +$ podman container prune +WARNING! This will remove all stopped containers. +Are you sure you want to continue? [y/N] y +878392adf2e6c5c9bb1fc19b69d37d2e98c8abf9d539c0bce4b15b46bbcce471 +37664467fbe3618bf9479c34393ac29c02696675addf1750f9e346581636cde7 +ed0c6468b8e1cb641b4621d1fe30cb477e1fefc5c0bceb66feaf2f7cb50e5962 +6ac6c8f0067b7a4682e6b8e18902665b57d1a0e07e885d9abcd382232a543ccd +fff1c5b6c3631746055ec40598ce8ecaa4b82aef122f9e3a85b03b55c0d06c23 +602d343cd47e7cb3dfc808282a9900a3e4555747787ec6723bb68cedab8384d5 +``` + +Remove all stopped containers from local storage without confirmation: +``` +$ podman container prune -f +878392adf2e6c5c9bb1fc19b69d37d2e98c8abf9d539c0bce4b15b46bbcce471 +37664467fbe3618bf9479c34393ac29c02696675addf1750f9e346581636cde7 +ed0c6468b8e1cb641b4621d1fe30cb477e1fefc5c0bceb66feaf2f7cb50e5962 +6ac6c8f0067b7a4682e6b8e18902665b57d1a0e07e885d9abcd382232a543ccd +fff1c5b6c3631746055ec40598ce8ecaa4b82aef122f9e3a85b03b55c0d06c23 +602d343cd47e7cb3dfc808282a9900a3e4555747787ec6723bb68cedab8384d5 +``` + +Remove all stopped containers from local storage created before the last 10 minutes: +``` +$ podman container prune --filter until="10m" +WARNING! This will remove all stopped containers. +Are you sure you want to continue? [y/N] y +3d366295e33d8cc612c4d873199bacadd55088d90d17dcafaa9a2d317ad50b4e +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-ps(1)](podman-ps.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude \ +December 2020, converted filter information from docs.docker.com documentation by Dan Walsh diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-container-restore.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-container-restore.1.md new file mode 100644 index 000000000..400ba6cb4 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-container-restore.1.md @@ -0,0 +1,198 @@ +--- +title: podman-container-restore +version: v5.5.2 +--- + +% podman-container-restore 1 + +## NAME +podman\-container\-restore - Restore one or more containers from a checkpoint + +## SYNOPSIS +**podman container restore** [*options*] *name* [...] + +## DESCRIPTION +**podman container restore** restores a container from a container checkpoint or +checkpoint image. The *container IDs*, *image IDs* or *names* are used as input. + +## OPTIONS +#### **--all**, **-a** + +Restore all checkpointed *containers*.\ +The default is **false**.\ +*IMPORTANT: This OPTION does not need a container name or ID as input argument.* + +#### **--file-locks** + +Restore a *container* with file locks. This option is required to +restore file locks from a checkpoint image. If the checkpoint image +does not contain file locks, this option is ignored. Defaults to not +restoring file locks.\ +The default is **false**. + +#### **--ignore-rootfs** + +If a *container* is restored from a checkpoint tar.gz file it is possible that it also contains all root file-system changes. With **--ignore-rootfs** it is possible to explicitly disable applying these root file-system changes to the restored *container*.\ +The default is **false**.\ +*IMPORTANT: This OPTION is only available in combination with __--import, -i__.* + +#### **--ignore-static-ip** + +If the *container* was started with **--ip** the restored *container* also tries to use that +IP address and restore fails if that IP address is already in use. This can happen, if +a *container* is restored multiple times from an exported checkpoint with **--name, -n**. + +Using **--ignore-static-ip** tells Podman to ignore the IP address if it was configured +with **--ip** during *container* creation. + +The default is **false**. + +#### **--ignore-static-mac** + +If the *container* was started with **--mac-address** the restored *container* also +tries to use that MAC address and restore fails if that MAC address is already +in use. This can happen, if a *container* is restored multiple times from an +exported checkpoint with **--name, -n**. + +Using **--ignore-static-mac** tells Podman to ignore the MAC address if it was +configured with **--mac-address** during *container* creation. + +The default is **false**. + +#### **--ignore-volumes** + +This option must be used in combination with the **--import, -i** option. +When restoring *containers* from a checkpoint tar.gz file with this option, +the content of associated volumes are not restored.\ +The default is **false**. + +#### **--import**, **-i**=*file* + +Import a checkpoint tar.gz file, which was exported by Podman. This can be used +to import a checkpointed *container* from another host.\ +*IMPORTANT: This OPTION does not need a container name or ID as input argument.* + +During the import of a checkpoint file Podman selects the same container runtime +which was used during checkpointing. This is especially important if a specific +(non-default) container runtime was specified during container creation. Podman +also aborts the restore if the container runtime specified during restore does +not much the container runtime used for container creation. + +#### **--import-previous**=*file* + +Import a pre-checkpoint tar.gz file which was exported by Podman. This option +must be used with **-i** or **--import**. It only works on `runc 1.0-rc3` or `higher`. +*IMPORTANT: This OPTION is not supported on the remote client, including Mac and Windows (excluding WSL2) machines.* + +#### **--keep**, **-k** + +Keep all temporary log and statistics files created by `CRIU` during +checkpointing as well as restoring. These files are not deleted if restoring +fails for further debugging. If restoring succeeds these files are +theoretically not needed, but if these files are needed Podman can keep the +files for further analysis. This includes the checkpoint directory with all +files created during checkpointing. The size required by the checkpoint +directory is roughly the same as the amount of memory required by the +processes in the checkpointed *container*.\ +Without the **--keep**, **-k** option, the checkpoint is consumed and cannot be used again.\ +The default is **false**. + +#### **--latest**, **-l** + +Instead of providing the *container ID* or *name*, use the last created *container*. The default is **false**. +*IMPORTANT: This OPTION is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines. This OPTION does not need a container name or ID as input argument.* + +#### **--name**, **-n**=*name* + +If a *container* is restored from a checkpoint tar.gz file it is possible to rename it with **--name, -n**. This way it is possible to restore a *container* from a checkpoint multiple times with different +names. + +If the **--name, -n** option is used, Podman does not attempt to assign the same IP +address to the *container* it was using before checkpointing as each IP address can only +be used once, and the restored *container* has another IP address. This also means +that **--name, -n** cannot be used in combination with **--tcp-established**.\ +*IMPORTANT: This OPTION is only available for a checkpoint image or in combination +with __--import, -i__.* + +#### **--pod**=*name* + +Restore a container into the pod *name*. The destination pod for this restore +has to have the same namespaces shared as the pod this container was checkpointed +from (see **[podman pod create --share](podman-pod-create.1.md#--share)**).\ +*IMPORTANT: This OPTION is only available for a checkpoint image or in combination +with __--import, -i__.* + +This option requires at least CRIU 3.16. + +#### **--print-stats** + +Print out statistics about restoring the container(s). The output is +rendered in a JSON array and contains information about how much time different +restore operations required. Many of the restore statistics are created +by CRIU and just passed through to Podman. The following information is provided +in the JSON array: + +- **podman_restore_duration**: Overall time (in microseconds) needed to restore + all checkpoints. + +- **runtime_restore_duration**: Time (in microseconds) the container runtime + needed to restore the checkpoint. + +- **forking_time**: Time (in microseconds) CRIU needed to create (fork) all + processes in the restored container (measured by CRIU). + +- **restore_time**: Time (in microseconds) CRIU needed to restore all processes + in the container (measured by CRIU). + +- **pages_restored**: Number of memory pages restored (measured by CRIU). + +The default is **false**. + +#### **--publish**, **-p**=*port* + +Replaces the ports that the *container* publishes, as configured during the +initial *container* start, with a new set of port forwarding rules. + +For more details, see **[podman run --publish](podman-run.1.md#--publish)**. + +#### **--tcp-established** + +Restore a *container* with established TCP connections. If the checkpoint image +contains established TCP connections, this option is required during restore. +If the checkpoint image does not contain established TCP connections this +option is ignored. Defaults to not restoring *containers* with established TCP +connections.\ +The default is **false**. + +## EXAMPLE +Restore the container "mywebserver". +``` +# podman container restore mywebserver +``` + +Import a checkpoint file and a pre-checkpoint file. +``` +# podman container restore --import-previous pre-checkpoint.tar.gz --import checkpoint.tar.gz +``` + +Start the container "mywebserver". Make a checkpoint of the container and export it. Restore the container with other port ranges from the exported file. +``` +$ podman run --rm -p 2345:80 -d webserver +# podman container checkpoint -l --export=dump.tar +# podman container restore -p 5432:8080 --import=dump.tar +``` + +Start a container with the name "foobar-1". Create a checkpoint image "foobar-checkpoint". Restore the container from the checkpoint image with a different name. +``` +# podman run --name foobar-1 -d webserver +# podman container checkpoint --create-image foobar-checkpoint foobar-1 +# podman inspect foobar-checkpoint +# podman container restore --name foobar-2 foobar-checkpoint +# podman container restore --name foobar-3 foobar-checkpoint +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container-checkpoint(1)](podman-container-checkpoint.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-pod-create(1)](podman-pod-create.1.md)**, **criu(8)** + +## HISTORY +September 2018, Originally compiled by Adrian Reber diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-container-runlabel.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-container-runlabel.1.md new file mode 100644 index 000000000..ccd450e31 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-container-runlabel.1.md @@ -0,0 +1,128 @@ +--- +title: podman-container-runlabel +version: v5.5.2 +--- + +% podman-container-runlabel 1 + +## NAME +podman-container-runlabel - Execute a command as described by a container-image label + +## SYNOPSIS +**podman container runlabel** [*options*] *label* *image* [*arg...*] + +## DESCRIPTION +**podman container runlabel** reads the specified `label` of the `image` and executes it as command on the host. If the label does not exist, Podman exits with an error. Additional arguments are appended to the command. + +Historically, container images describe the contents (e.g., layers) and how a container runtime (e.g., crun(1) or runc(1)) executes the container. For instance, an image may set the environment and the command in its configuration. However, a container image cannot directly specify how a container engine such as Podman executes it. For instance, an image configuration does not include information about log drivers, namespaces, or which capabilities it needs to run correctly. + +`podman container runlabel` addresses the limitation of container images in a simple yet efficient way. Podman reads the contents of the label and interpret it as a command that is executed on the host. This way an image can describe exactly how it is executed by Podman. For instance, a label with the content `/usr/bin/podman run -d --pid=host --privileged \${IMAGE}` instructs the image to be executed in a detached, privileged container that is using the PID namespace of the host. This lifts the self-description of a container image from "what" to "how". + +Note that the `runlabel` command is intended to be run in trusted environments exclusively. Using the command on untrusted images is not recommended. + +## VARIABLES + +The contents of a label may refer to the following variables which is substituted while processing the label. + +**IMAGE** +The name of the image. When executing `podman container runlabel label fedora` the `IMAGE` variable is replaced with `fedora`. Valid formats are `IMAGE`, `$IMAGE`, `${IMAGE}` and `=IMAGE`. + +**NAME** +As specified by the `--name` option. The format is identical to the one of the IMAGE attribute. + +**PWD** +Will be replaced with the current working directory. + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + +#### **--display** + +Display the label's value of the image having populated its environment variables. The runlabel command is not executed if --display is specified. + +#### **--help**, **-h** +Print usage statement + +#### **--name**, **-n**=*name* + +Use this name for creating content for the container. If not specified, name defaults to the name of the image. + +#### **--quiet**, **-q** + +Suppress output information when pulling images + +#### **--replace** + +If a container exists with the current name, it is stopped, deleted and a new container is created from this image. + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Execute the `run` label of an image called foobar. +``` +$ podman container runlabel run foobar +``` + +Execute the `install` label of an image called foobar with additional arguments. +``` +$ podman container runlabel install foobar apples oranges +``` + +Display the contents of the `run` label of image foobar. +``` +$ podman container runlabel --display run foobar +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/main/man/runc.8.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-auth.json(5)](https://github.com/containers/image/blob/main/docs/containers-auth.json.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +## HISTORY +August 2021, Refinements by Valentin Rothberg (rothberg at redhat dot com) + +September 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-container.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-container.1.md new file mode 100644 index 000000000..7ed7f2743 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-container.1.md @@ -0,0 +1,58 @@ +--- +title: podman-container +version: v5.5.2 +--- + +% podman-container 1 + +## NAME +podman\-container - Manage containers + +## SYNOPSIS +**podman container** *subcommand* + +## DESCRIPTION +The container command allows management of containers + +## COMMANDS + +| Command | Man Page | Description | +| --------- | --------------------------------------------------- | ---------------------------------------------------------------------------- | +| attach | [podman-attach(1)](podman-attach.1.md) | Attach to a running container. | +| checkpoint | [podman-container-checkpoint(1)](podman-container-checkpoint.1.md) | Checkpoint one or more running containers. | +| cleanup | [podman-container-cleanup(1)](podman-container-cleanup.1.md) | Clean up the container's network and mountpoints. | +| clone | [podman-container-clone(1)](podman-container-clone.1.md) | Create a copy of an existing container. | +| commit | [podman-commit(1)](podman-commit.1.md) | Create new image based on the changed container. | +| cp | [podman-cp(1)](podman-cp.1.md) | Copy files/folders between a container and the local filesystem. | +| create | [podman-create(1)](podman-create.1.md) | Create a new container. | +| diff | [podman-container-diff(1)](podman-container-diff.1.md) | Inspect changes on a container's filesystem | +| exec | [podman-exec(1)](podman-exec.1.md) | Execute a command in a running container. | +| exists | [podman-container-exists(1)](podman-container-exists.1.md) | Check if a container exists in local storage | +| export | [podman-export(1)](podman-export.1.md) | Export a container's filesystem contents as a tar archive. | +| init | [podman-init(1)](podman-init.1.md) | Initialize a container | +| inspect | [podman-container-inspect(1)](podman-container-inspect.1.md)| Display a container's configuration. | +| kill | [podman-kill(1)](podman-kill.1.md) | Kill the main process in one or more containers. | +| list | [podman-ps(1)](podman-ps.1.md) | List the containers on the system.(alias ls) | +| logs | [podman-logs(1)](podman-logs.1.md) | Display the logs of a container. | +| mount | [podman-mount(1)](podman-mount.1.md) | Mount a working container's root filesystem. | +| pause | [podman-pause(1)](podman-pause.1.md) | Pause one or more containers. | +| port | [podman-port(1)](podman-port.1.md) | List port mappings for the container. | +| prune | [podman-container-prune(1)](podman-container-prune.1.md)| Remove all stopped containers from local storage. | +| ps | [podman-ps(1)](podman-ps.1.md) | Print out information about containers. | +| rename | [podman-rename(1)](podman-rename.1.md) | Rename an existing container. | +| restart | [podman-restart(1)](podman-restart.1.md) | Restart one or more containers. | +| restore | [podman-container-restore(1)](podman-container-restore.1.md) | Restore one or more containers from a checkpoint. | +| rm | [podman-rm(1)](podman-rm.1.md) | Remove one or more containers. | +| run | [podman-run(1)](podman-run.1.md) | Run a command in a container. | +| runlabel | [podman-container-runlabel(1)](podman-container-runlabel.1.md) | Execute a command as described by a container-image label. | +| start | [podman-start(1)](podman-start.1.md) | Start one or more containers. | +| stats | [podman-stats(1)](podman-stats.1.md) | Display a live stream of one or more container's resource usage statistics. | +| stop | [podman-stop(1)](podman-stop.1.md) | Stop one or more running containers. | +| top | [podman-top(1)](podman-top.1.md) | Display the running processes of a container. | +| unmount | [podman-unmount(1)](podman-unmount.1.md) | Unmount a working container's root filesystem.(Alias unmount) | +| unpause | [podman-unpause(1)](podman-unpause.1.md) | Unpause one or more containers. | +| update | [podman-update(1)](podman-update.1.md) | Update the cgroup configuration of a given container. | +| wait | [podman-wait(1)](podman-wait.1.md) | Wait on one or more containers to stop and print their exit codes. | + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-exec(1)](podman-exec.1.md)**, **[podman-run(1)](podman-run.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-cp.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-cp.1.md new file mode 100644 index 000000000..e4ae727a5 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-cp.1.md @@ -0,0 +1,140 @@ +--- +title: podman-cp +version: v5.5.2 +--- + +% podman-cp 1 + +## NAME +podman\-cp - Copy files/folders between a container and the local filesystem + +## SYNOPSIS +**podman cp** [*options*] [*container*:]*src_path* [*container*:]*dest_path* + +**podman container cp** [*options*] [*container*:]*src_path* [*container*:]*dest_path* + +## DESCRIPTION +**podman cp** allows copying the contents of **src_path** to the **dest_path**. Files can be copied from a container to the local machine and vice versa or between two containers. +If `-` is specified for either the `SRC_PATH` or `DEST_PATH`, one can also stream a tar archive from `STDIN` or to `STDOUT`. + +The containers can be either running or stopped and the *src_path* or *dest_path* can be a file or directory. + +*IMPORTANT: The **podman cp** command assumes container paths are relative to the container's root directory (`/`), which means supplying the initial forward slash is optional and therefore sees `compassionate_darwin:/tmp/foo/myfile.txt` and `compassionate_darwin\:tmp/foo/myfile.txt` as identical.* + +Local machine paths can be an absolute or relative value. +The command interprets a local machine's relative paths as relative to the current working directory where **podman cp** is run. + +Assuming a path separator of `/`, a first argument of **src_path** and second argument of **dest_path**, the behavior is as follows: + +**src_path** specifies a file: + - **dest_path** does not exist + - the file is saved to a file created at **dest_path** (note that parent directory must exist). + - **dest_path** exists and is a file + - the destination is overwritten with the source file's contents. + - **dest_path** exists and is a directory + - the file is copied into this directory using the base name from **src_path**. + +**src_path** specifies a directory: + - **dest_path** does not exist + - **dest_path** is created as a directory and the contents of the source directory are copied into this directory. + - **dest_path** exists and is a file + - Error condition: cannot copy a directory to a file. + - **dest_path** exists and is a directory + - **src_path** ends with `/` + - the source directory is copied into this directory. + - **src_path** ends with `/.` (i.e., slash followed by dot) + - the content of the source directory is copied into this directory. + +The command requires **src_path** and **dest_path** to exist according to the above rules. + +If **src_path** is local and is a symbolic link, the symbolic target, is copied by default. + +A *colon* ( : ) is used as a delimiter between a container and its path, it can also be used when specifying paths to a **src_path** or **dest_path** on a local machine, for example, `file:name.txt`. + +*IMPORTANT: while using a *colon* ( : ) in a local machine path, one must be explicit with a relative or absolute path, for example: `/path/to/file:name.txt` or `./file:name.txt`* + +Using `-` as the **src_path** streams the contents of `STDIN` as a tar archive. The command extracts the content of the tar to the `DEST_PATH` in the container. In this case, **dest_path** must specify a directory. Using `-` as the **dest_path** streams the contents of the resource (can be a directory) as a tar archive to `STDOUT`. + +Note that `podman cp` ignores permission errors when copying from a running rootless container. The TTY devices inside a rootless container are owned by the host's root user and hence cannot be read inside the container's user namespace. + +Further note that `podman cp` does not support globbing (e.g., `cp dir/*.txt`). To copy multiple files from the host to the container use xargs(1) or find(1) (or similar tools for chaining commands) in conjunction with `podman cp`. To copy multiple files from the container to the host, use `podman mount CONTAINER` and operate on the returned mount point instead (see ALTERNATIVES below). + +## OPTIONS + +#### **--archive**, **-a** + +Archive mode (copy all UID/GID information). +When set to true, files copied to a container have changed ownership to the primary UID/GID of the container. +When set to false, maintain UID/GID from archive sources instead of changing them to the primary UID/GID of the destination container. +The default is **true**. + +#### **--overwrite** + +Allow directories to be overwritten with non-directories and vice versa. By default, `podman cp` errors out when attempting to overwrite, for instance, a regular file with a directory. + +## ALTERNATIVES + +Podman has much stronger capabilities than just `podman cp` to achieve copying files between the host and containers. + +Using standard **[podman-mount(1)](podman-mount.1.md)** and **[podman-unmount(1)](podman-unmount.1.md)** takes advantage of the entire Linux tool chain, rather than just `cp`. + +Copying contents out of a container or into a container can be achieved with a few simple commands. For example: + +To copy the `/etc/foobar` directory out of a container and onto `/tmp` on the host, the following commands can be executed: + + mnt=$(podman mount CONTAINERID) + cp -R ${mnt}/etc/foobar /tmp + podman umount CONTAINERID + +To untar a tar ball into a container, following commands can be executed: + + mnt=$(podman mount CONTAINERID) + tar xf content.tgz -C ${mnt} + podman umount CONTAINERID + +To install a package into a container that +does not have dnf installed, following commands can be executed: + + mnt=$(podman mount CONTAINERID) + dnf install --installroot=${mnt} httpd + chroot ${mnt} rm -rf /var/log/dnf /var/cache/dnf + podman umount CONTAINERID + +By using `podman mount` and `podman unmount`, one can use all of the +standard Linux tools for moving files into and out of containers, not just +the `cp` command. + +## EXAMPLES + +Copy a file from the host to a container: +``` +podman cp /myapp/app.conf containerID:/myapp/app.conf +``` + +Copy a file from a container to a directory on another container: +``` +podman cp containerID1:/myfile.txt containerID2:/tmp +``` + +Copy a directory on a container to a directory on the host: +``` +podman cp containerID:/myapp/ /myapp/ +``` + +Copy the contents of a directory on a container to a directory on the host: +``` +podman cp containerID:/home/myuser/. /home/myuser/ +``` + +Copy a directory on a container into a directory on another: +``` +podman cp containerA:/myapp containerB:/newapp +``` + +Stream a tar archive from `STDIN` to a container: +``` +podman cp - containerID:/myfiles.tar.gz < myfiles.tar.gz +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-mount(1)](podman-mount.1.md)**, **[podman-unmount(1)](podman-unmount.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-create.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-create.1.md new file mode 100644 index 000000000..0109555e9 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-create.1.md @@ -0,0 +1,2905 @@ +--- +title: podman-create +version: v5.5.2 +--- + +% podman-create 1 + +## NAME +podman\-create - Create a new container + +## SYNOPSIS +**podman create** [*options*] *image* [*command* [*arg* ...]] + +**podman container create** [*options*] *image* [*command* [*arg* ...]] + +## DESCRIPTION + +Creates a writable container layer over the specified image and prepares it for +running the specified command. The container ID is then printed to STDOUT. This +is similar to **podman run -d** except the container is never started. Use the +**podman start** *container* command to start the container at any point. + +The initial status of the container created with **podman create** is 'created'. + +Default settings for flags are defined in `containers.conf`. Most settings for +remote connections use the server's containers.conf, except when documented in +man pages. + +## IMAGE + + The image is specified using transport\:path format. If no transport is specified, the `docker` (container registry) +transport is used by default. For remote Podman, including Mac and Windows (excluding WSL2) machines, `docker` is the only allowed transport. + + **dir:**_path_ + An existing local directory _path_ storing the manifest, layer tarballs and signatures as individual files. This +is a non-standardized format, primarily useful for debugging or noninvasive container inspection. + + $ podman save --format docker-dir fedora -o /tmp/fedora + $ podman create dir:/tmp/fedora echo hello + + **docker://**_docker-reference_ (Default) + An image reference stored in a remote container image registry. Example: "quay.io/podman/stable:latest". +The reference can include a path to a specific registry; if it does not, the +registries listed in registries.conf is queried to find a matching image. +By default, credentials from `podman login` (stored at +$XDG_RUNTIME_DIR/containers/auth.json by default) is used to authenticate; +otherwise it falls back to using credentials in $HOME/.docker/config.json. + + $ podman create registry.fedoraproject.org/fedora\:latest echo hello + + **docker-archive:**_path_[**:**_docker-reference_] +An image stored in the `docker save` formatted file. _docker-reference_ is only used when creating such a +file, and it must not contain a digest. + + $ podman save --format docker-archive fedora -o /tmp/fedora + $ podman create docker-archive:/tmp/fedora echo hello + + **docker-daemon:**_docker-reference_ + An image in _docker-reference_ format stored in the docker daemon internal storage. The _docker-reference_ can also be an image ID (docker-daemon\:algo\:digest). + + $ sudo docker pull fedora + $ sudo podman create docker-daemon\:docker.io/library/fedora echo hello + + **oci-archive:**_path_**:**_tag_ + An image in a directory compliant with the "Open Container Image Layout Specification" at the specified _path_ +and specified with a _tag_. + + $ podman save --format oci-archive fedora -o /tmp/fedora + $ podman create oci-archive:/tmp/fedora echo hello + +## OPTIONS + + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the container's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + + +[//]: # (BEGIN included file options/annotation.container.md) +#### **--annotation**=*key=value* + +Add an annotation to the container. This option can be set multiple times. + +[//]: # (END included file options/annotation.container.md) + + +[//]: # (BEGIN included file options/arch.md) +#### **--arch**=*ARCH* +Override the architecture, defaults to hosts, of the image to be pulled. For example, `arm`. +Unless overridden, subsequent lookups of the same image in the local storage matches this architecture, regardless of the host. + +[//]: # (END included file options/arch.md) + + +[//]: # (BEGIN included file options/attach.md) +#### **--attach**, **-a**=*stdin* | *stdout* | *stderr* + +Attach to STDIN, STDOUT or STDERR. + +In foreground mode (the default when **-d** +is not specified), **podman run** can start the process in the container +and attach the console to the process's standard input, output, and +error. It can even pretend to be a TTY (this is what most command-line +executables expect) and pass along signals. The **-a** option can be set for +each of **stdin**, **stdout**, and **stderr**. + +[//]: # (END included file options/attach.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cap-add.md) +#### **--cap-add**=*capability* + +Add Linux capabilities. + +Granting additional capabilities increases the privileges of the +processes running inside the container and potentially allow it to +break out of confinement. Capabilities like `CAP_SYS_ADMIN`, +`CAP_SYS_PTRACE`, `CAP_MKNOD` and `CAP_SYS_MODULE` are particularly +dangerous when they are not used within a user namespace. Please +refer to **user_namespaces(7)** for a more detailed explanation of the +interaction between user namespaces and capabilities. + +Before adding any capability, review its security implications and +ensure it is really necessary for the container’s functionality. See +**capabilities(7)** for more information. + +[//]: # (END included file options/cap-add.md) + + +[//]: # (BEGIN included file options/cap-drop.md) +#### **--cap-drop**=*capability* + +Drop Linux capabilities. + +[//]: # (END included file options/cap-drop.md) + + +[//]: # (BEGIN included file options/cgroup-conf.md) +#### **--cgroup-conf**=*KEY=VALUE* + +When running on cgroup v2, specify the cgroup file to write to and its value. For example **--cgroup-conf=memory.high=1073741824** sets the memory.high limit to 1GB. + +[//]: # (END included file options/cgroup-conf.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the container is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cgroupns.md) +#### **--cgroupns**=*mode* + +Set the cgroup namespace mode for the container. + +- **host**: use the host's cgroup namespace inside the container. +- **container:**_id_: join the namespace of the specified container. +- **private**: create a new cgroup namespace. +- **ns:**_path_: join the namespace at the specified path. + +If the host uses cgroups v1, the default is set to **host**. On cgroups v2, the default is **private**. + +[//]: # (END included file options/cgroupns.md) + + +[//]: # (BEGIN included file options/cgroups.md) +#### **--cgroups**=*how* + +Determines whether the container creates CGroups. + +Default is **enabled**. + +The **enabled** option creates a new cgroup under the cgroup-parent. +The **disabled** option forces the container to not create CGroups, and thus conflicts with CGroup options (**--cgroupns** and **--cgroup-parent**). +The **no-conmon** option disables a new CGroup only for the **conmon** process. +The **split** option splits the current CGroup in two sub-cgroups: one for conmon and one for the container payload. It is not possible to set **--cgroup-parent** with **split**. + +[//]: # (END included file options/cgroups.md) + + +[//]: # (BEGIN included file options/chrootdirs.md) +#### **--chrootdirs**=*path* + +Path to a directory inside the container that is treated as a `chroot` directory. +Any Podman managed file (e.g., /etc/resolv.conf, /etc/hosts, etc/hostname) that is mounted into the root directory is mounted into that location as well. +Multiple directories are separated with a comma. + +[//]: # (END included file options/chrootdirs.md) + + +[//]: # (BEGIN included file options/cidfile.write.md) +#### **--cidfile**=*file* + +Write the container ID to *file*. The file is removed along with the container, except +when used with podman --remote run on detached containers. + +[//]: # (END included file options/cidfile.write.md) + + +[//]: # (BEGIN included file options/conmon-pidfile.md) +#### **--conmon-pidfile**=*file* + +Write the pid of the **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to restart Podman containers. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/conmon-pidfile.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-rt-period.md) +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-period.md) + + +[//]: # (BEGIN included file options/cpu-rt-runtime.md) +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-runtime.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpus.container.md) +#### **--cpus**=*number* + +Number of CPUs. The default is *0.0* which means no limit. This is shorthand +for **--cpu-period** and **--cpu-quota**, therefore the option cannot be specified with +**--cpu-period** or **--cpu-quota**. + +On some systems, changing the CPU limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpus.container.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the container. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The container only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: if the user only has access rights via a group, accessing the device +from inside a rootless container fails. Use the `--group-add keep-groups` +flag to pass the user's supplementary group access into the container. + + +[//]: # (BEGIN included file options/device-cgroup-rule.md) +#### **--device-cgroup-rule**=*"type major\:minor mode"* + +Add a rule to the cgroup allowed devices list. The rule is expected to be +in the format specified in the Linux kernel documentation +[admin-guide/cgroup-v1/devices](https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.html): +- *type*: `a` (all), `c` (char), or `b` (block); +- *major* and *minor*: either a number, or `*` for all; +- *mode*: a composition of `r` (read), `w` (write), and `m` (mknod(2)). + +[//]: # (END included file options/device-cgroup-rule.md) + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-read-iops.md) +#### **--device-read-iops**=*path:rate* + +Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-iops.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + + +[//]: # (BEGIN included file options/device-write-iops.md) +#### **--device-write-iops**=*path:rate* + +Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-iops.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + + +[//]: # (BEGIN included file options/dns.md) +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. + +[//]: # (END included file options/dns.md) + +This option cannot be combined with **--network** that is set to **none** or **container:**_id_. + + +[//]: # (BEGIN included file options/dns-option.container.md) +#### **--dns-option**=*option* + +Set custom DNS options. Invalid if using **--dns-option** with **--network** that is set to **none** or **container:**_id_. + +[//]: # (END included file options/dns-option.container.md) + + +[//]: # (BEGIN included file options/dns-search.container.md) +#### **--dns-search**=*domain* + +Set custom DNS search domains. Invalid if using **--dns-search** with **--network** that is set to **none** or **container:**_id_. +Use **--dns-search=.** to remove the search domain. + +[//]: # (END included file options/dns-search.container.md) + + +[//]: # (BEGIN included file options/entrypoint.md) +#### **--entrypoint**=*"command"* | *'["command", "arg1", ...]'* + +Override the default ENTRYPOINT from the image. + +The ENTRYPOINT of an image is similar to a COMMAND +because it specifies what executable to run when the container starts, but it is +(purposely) more difficult to override. The ENTRYPOINT gives a container its +default nature or behavior. When the ENTRYPOINT is set, the +container runs as if it were that binary, complete with default options. More options can be +passed in via the COMMAND. But, if a user wants to run +something else inside the container, the **--entrypoint** option allows a new +ENTRYPOINT to be specified. + +Specify multi option commands in the form of a JSON string. + +[//]: # (END included file options/entrypoint.md) + + +[//]: # (BEGIN included file options/env.md) +#### **--env**, **-e**=*env* + +Set environment variables. + +This option allows arbitrary environment variables that are available for the process to be launched inside of the container. If an environment variable is specified without a value, Podman checks the host environment for a value and set the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the container. + +[//]: # (END included file options/env.md) + +See [**Environment**](#environment) note below for precedence and examples. + + +[//]: # (BEGIN included file options/env-file.md) +#### **--env-file**=*file* + +Read in a line-delimited file of environment variables. + +[//]: # (END included file options/env-file.md) + +See [**Environment**](#environment) note below for precedence and examples. + + +[//]: # (BEGIN included file options/env-host.md) +#### **--env-host** + +Use host environment inside of the container. See **Environment** note below for precedence. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/env-host.md) + + +[//]: # (BEGIN included file options/env-merge.md) +#### **--env-merge**=*env* + +Preprocess default environment variables for the containers. For example +if image contains environment variable `hello=world` user can preprocess +it using `--env-merge hello=${hello}-some` so new value is `hello=world-some`. + +Please note that if the environment variable `hello` is not present in the image, +then it'll be replaced by an empty string and so using `--env-merge hello=${hello}-some` +would result in the new value of `hello=-some`, notice the leading `-` delimiter. + +[//]: # (END included file options/env-merge.md) + + +[//]: # (BEGIN included file options/expose.md) +#### **--expose**=*port[/protocol]* + +Expose a port or a range of ports (e.g. **--expose=3300-3310**). +The protocol can be `tcp`, `udp` or `sctp` and if not given `tcp` is assumed. +This option matches the EXPOSE instruction for image builds and has no effect on +the actual networking rules unless **-P/--publish-all** is used to forward to all +exposed ports from random host ports. To forward specific ports from the host +into the container use the **-p/--publish** option instead. + +[//]: # (END included file options/expose.md) + + +[//]: # (BEGIN included file options/gidmap.container.md) +#### **--gidmap**=*[flags]container_uid\:from_uid[\:amount]* + +Run the container in a new user namespace using the supplied GID mapping. This +option conflicts with the **--userns** and **--subgidname** options. This +option provides a way to map host GIDs to container GIDs in the same way as +__--uidmap__ maps host UIDs to container UIDs. For details see __--uidmap__. + +Note: the **--gidmap** option cannot be called in conjunction with the **--pod** option as a gidmap cannot be set on the container level when in a pod. + +[//]: # (END included file options/gidmap.container.md) + + +[//]: # (BEGIN included file options/gpus.md) +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. + +[//]: # (END included file options/gpus.md) + + +[//]: # (BEGIN included file options/group-add.md) +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/group-add.md) + + +[//]: # (BEGIN included file options/group-entry.md) +#### **--group-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/group` file within the container when `--user` is used. + +The variables $GROUPNAME, $GID, and $USERLIST are automatically replaced with their value at runtime if present. + +[//]: # (END included file options/group-entry.md) + + +[//]: # (BEGIN included file options/health-cmd.md) +#### **--health-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set or alter a healthcheck command for a container. The command is a command to be executed inside the +container that determines the container health. The command is required for other healthcheck options +to be applied. A value of **none** disables existing healthchecks. + +Multiple options can be passed in the form of a JSON array; otherwise, the command is interpreted +as an argument to **/bin/sh -c**. + +Note: The default values are used even if healthcheck is configured in the image. + +[//]: # (END included file options/health-cmd.md) + + +[//]: # (BEGIN included file options/health-interval.md) +#### **--health-interval**=*interval* + +Set an interval for the healthchecks. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-interval.md) + + +[//]: # (BEGIN included file options/health-log-destination.md) +#### **--health-log-destination**=*directory_path* + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) (Default: local) + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. + +[//]: # (END included file options/health-log-destination.md) + + +[//]: # (BEGIN included file options/health-max-log-count.md) +#### **--health-max-log-count**=*number of stored logs* + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) (Default: 5 attempts) + +[//]: # (END included file options/health-max-log-count.md) + + +[//]: # (BEGIN included file options/health-max-log-size.md) +#### **--health-max-log-size**=*size of stored logs* + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) (Default: 500 characters) + +[//]: # (END included file options/health-max-log-size.md) + + +[//]: # (BEGIN included file options/health-on-failure.md) +#### **--health-on-failure**=*action* + +Action to take once the container transitions to an unhealthy state. The default is **none**. + +- **none**: Take no action. +- **kill**: Kill the container. +- **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. +- **stop**: Stop the container. + +[//]: # (END included file options/health-on-failure.md) + + +[//]: # (BEGIN included file options/health-retries.md) +#### **--health-retries**=*retries* + +The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is **3**. + +Note: This parameter can overwrite the healthcheck configuration from the image. + +[//]: # (END included file options/health-retries.md) + + +[//]: # (BEGIN included file options/health-start-period.md) +#### **--health-start-period**=*period* + +The initialization time needed for a container to bootstrap. The value can be expressed in time format like +**2m3s**. The default value is **0s**. + +Note: The health check command is executed as soon as a container is started, if the health check is successful +the container's health state will be updated to `healthy`. However, if the health check fails, the health state will +stay as `starting` until either the health check is successful or until the `--health-start-period` time is over. If the +health check command fails after the `--health-start-period` time is over, the health state will be updated to `unhealthy`. +The health check command is executed periodically based on the value of `--health-interval`. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-start-period.md) + + +[//]: # (BEGIN included file options/health-startup-cmd.md) +#### **--health-startup-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set a startup healthcheck command for a container. This command is executed inside the container and is used to gate the regular +healthcheck. When the startup command succeeds, the regular healthcheck begins and the startup healthcheck ceases. Optionally, +if the command fails for a set number of attempts, the container is restarted. A startup healthcheck can be used to ensure that +containers with an extended startup period are not marked as unhealthy until they are fully started. Startup healthchecks can only be +used when a regular healthcheck (from the container's image or the **--health-cmd** option) is also set. + +[//]: # (END included file options/health-startup-cmd.md) + + +[//]: # (BEGIN included file options/health-startup-interval.md) +#### **--health-startup-interval**=*interval* + +Set an interval for the startup healthcheck. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-startup-interval.md) + + +[//]: # (BEGIN included file options/health-startup-retries.md) +#### **--health-startup-retries**=*retries* + +The number of attempts allowed before the startup healthcheck restarts the container. If set to **0**, the container is never restarted. The default is **0**. + +[//]: # (END included file options/health-startup-retries.md) + + +[//]: # (BEGIN included file options/health-startup-success.md) +#### **--health-startup-success**=*retries* + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value +of **0** means that any success begins the regular healthcheck. The default is **0**. + +[//]: # (END included file options/health-startup-success.md) + + +[//]: # (BEGIN included file options/health-startup-timeout.md) +#### **--health-startup-timeout**=*timeout* + +The maximum time a startup healthcheck command has to complete before it is marked as failed. The value can be expressed in a time +format like **2m3s**. The default value is **30s**. + +[//]: # (END included file options/health-startup-timeout.md) + + +[//]: # (BEGIN included file options/health-timeout.md) +#### **--health-timeout**=*timeout* + +The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the +value can be expressed in a time format such as **1m22s**. The default value is **30s**. + +Note: A timeout marks the healthcheck as failed but does not terminate the running process. +This ensures that a slow but eventually successful healthcheck does not disrupt the container +but is still accounted for in the health status. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-timeout.md) + +#### **--help** + +Print usage statement + + +[//]: # (BEGIN included file options/hostname.container.md) +#### **--hostname**, **-h**=*name* + +Set the container's hostname inside the container. + +This option can only be used with a private UTS namespace `--uts=private` +(default). If `--pod` is given and the pod shares the same UTS namespace +(default), the pod's hostname is used. The given hostname is also added to the +`/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). + +[//]: # (END included file options/hostname.container.md) + + +[//]: # (BEGIN included file options/hosts-file.md) +#### **--hosts-file**=*path* | *none* | *image* + +Base file to create the `/etc/hosts` file inside the container. This must either +be an absolute path to a file on the host system, or one of the following +special flags: + "" Follow the `base_hosts_file` configuration in _containers.conf_ (the default) + `none` Do not use a base file (i.e. start with an empty file) + `image` Use the container image's `/etc/hosts` file as base file + +[//]: # (END included file options/hosts-file.md) + + +[//]: # (BEGIN included file options/hostuser.md) +#### **--hostuser**=*name* + +Add a user account to /etc/passwd from the host to the container. The Username +or UID must exist on the host system. + +[//]: # (END included file options/hostuser.md) + + +[//]: # (BEGIN included file options/http-proxy.md) +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. + +[//]: # (END included file options/http-proxy.md) + + +[//]: # (BEGIN included file options/image-volume.md) +#### **--image-volume**=**bind** | *tmpfs* | *ignore* + +Tells Podman how to handle the builtin image volumes. Default is **bind**. + +- **bind**: An anonymous named volume is created and mounted into the container. +- **tmpfs**: The volume is mounted onto the container as a tmpfs, which allows the users to create +content that disappears when the container is stopped. +- **ignore**: All volumes are just ignored and no action is taken. + +[//]: # (END included file options/image-volume.md) + + +[//]: # (BEGIN included file options/init.md) +#### **--init** + +Run an init inside the container that forwards signals and reaps processes. +The container-init binary is mounted at `/run/podman-init`. +Mounting over `/run` breaks container execution. + +[//]: # (END included file options/init.md) + +#### **--init-ctr**=*type* + +(Pods only). +When using pods, create an init style container, which is run after the infra container is started +but before regular pod containers are started. Init containers are useful for running +setup operations for the pod's applications. + +Valid values for `init-ctr` type are *always* or *once*. The *always* value +means the container runs with each and every `pod start`, whereas the *once* +value means the container only runs once when the pod is started and then the container is removed. + +Init containers are only run on pod `start`. Restarting a pod does not execute +any init containers. Furthermore, init containers can only be created in a +pod when that pod is not running. + + +[//]: # (BEGIN included file options/init-path.md) +#### **--init-path**=*path* + +Path to the container-init binary. + +[//]: # (END included file options/init-path.md) + + +[//]: # (BEGIN included file options/interactive.md) +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. + +[//]: # (END included file options/interactive.md) + + +[//]: # (BEGIN included file options/ip.md) +#### **--ip**=*ipv4* + +Specify a static IPv4 address for the container, for example **10.88.64.128**. +This option can only be used if the container is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IP address pool (default **10.88.0.0/16**). + +To specify multiple static IP addresses per container, set multiple networks using the **--network** option with a static IP address specified for each using the `ip` mode for that option. + +[//]: # (END included file options/ip.md) + + +[//]: # (BEGIN included file options/ip6.md) +#### **--ip6**=*ipv6* + +Specify a static IPv6 address for the container, for example **fd46\:db93\:aa76\:ac37::10**. +This option can only be used if the container is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IPv6 address pool. + +To specify multiple static IPv6 addresses per container, set multiple networks using the **--network** option with a static IPv6 address specified for each using the `ip6` mode for that option. + +[//]: # (END included file options/ip6.md) + + +[//]: # (BEGIN included file options/ipc.md) +#### **--ipc**=*ipc* + +Set the IPC namespace mode for a container. The default is to create +a private IPC namespace. + +- "": Use Podman's default, defined in containers.conf. +- **container:**_id_: reuses another container's shared memory, semaphores, and message queues +- **host**: use the host's shared memory, semaphores, and message queues inside the container. Note: the host mode gives the container full access to local shared memory and is therefore considered insecure. +- **none**: private IPC namespace, with /dev/shm not mounted. +- **ns:**_path_: path to an IPC namespace to join. +- **private**: private IPC namespace. +- **shareable**: private IPC namespace with a possibility to share it with other containers. + +[//]: # (END included file options/ipc.md) + + +[//]: # (BEGIN included file options/label.md) +#### **--label**, **-l**=*key=value* + +Add metadata to a container. + +[//]: # (END included file options/label.md) + + +[//]: # (BEGIN included file options/label-file.md) +#### **--label-file**=*file* + +Read in a line-delimited file of labels. + +[//]: # (END included file options/label-file.md) + + +[//]: # (BEGIN included file options/link-local-ip.md) +#### **--link-local-ip**=*ip* + +Not implemented. + +[//]: # (END included file options/link-local-ip.md) + + +[//]: # (BEGIN included file options/log-driver.md) +#### **--log-driver**=*driver* + +Logging driver for the container. Currently available options are **k8s-file**, **journald**, **none**, **passthrough** and **passthrough-tty**, with **json-file** aliased to **k8s-file** for scripting compatibility. (Default **journald**). + +The podman info command below displays the default log-driver for the system. +``` +$ podman info --format '{{ .Host.LogDriver }}' +journald +``` +The **passthrough** driver passes down the standard streams (stdin, stdout, stderr) to the +container. It is not allowed with the remote Podman client, including Mac and Windows (excluding WSL2) machines, and on a tty, since it is +vulnerable to attacks via TIOCSTI. + +The **passthrough-tty** driver is the same as **passthrough** except that it also allows it to be used on a TTY if the user really wants it. + +[//]: # (END included file options/log-driver.md) + + +[//]: # (BEGIN included file options/log-opt.md) +#### **--log-opt**=*name=value* + +Logging driver specific options. + +Set custom logging configuration. The following *name*s are supported: + +**path**: specify a path to the log file + (e.g. **--log-opt path=/var/log/container/mycontainer.json**); + +**max-size**: specify a max size of the log file + (e.g. **--log-opt max-size=10mb**); + +**tag**: specify a custom log tag for the container + (e.g. **--log-opt tag="{{.ImageName}}"**. +It supports the same keys as **podman inspect --format**. +This option is currently supported only by the **journald** log driver. + +[//]: # (END included file options/log-opt.md) + + +[//]: # (BEGIN included file options/mac-address.md) +#### **--mac-address**=*address* + +Container network interface MAC address (e.g. 92\:d0\:c6:0a:29:33) +This option can only be used if the container is joined to only a single network - i.e., **--network=_network-name_** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. + +Remember that the MAC address in an Ethernet network must be unique. +The IPv6 link-local address is based on the device's MAC address +according to RFC4862. + +To specify multiple static MAC addresses per container, set multiple networks using the **--network** option with a static MAC address specified for each using the `mac` mode for that option. + +[//]: # (END included file options/mac-address.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-reservation.md) +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-reservation.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/memory-swappiness.md) +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/memory-swappiness.md) + + +[//]: # (BEGIN included file options/mount.md) +#### **--mount**=*type=TYPE,TYPE-SPECIFIC-OPTION[,...]* + +Attach a filesystem mount to the container. + +Current supported mount TYPEs are **artifact**, **bind**, **devpts**, **glob**, **image**, **ramfs**, **tmpfs** and **volume**. + +Options common to all mount types: + +- *src*, *source*: mount source spec for **bind**, **glob**, and **volume**. + Mandatory for **artifact**, **bind**, **glob**, **image** and **volume**. + +- *dst*, *destination*, *target*: mount destination spec. + +When source globs are specified without the destination directory, +the files and directories are mounted with their complete path +within the container. When the destination is specified, the +files and directories matching the glob on the base file name +on the destination directory are mounted. The option +`type=glob,src=/foo*,destination=/tmp/bar` tells container engines +to mount host files matching /foo* to the /tmp/bar/ +directory in the container. + +Options specific to type=**artifact**: + +- *digest*: If the artifact source contains multiple blobs a digest can be + specified to only mount the one specific blob with the digest. + +- *title*: If the artifact source contains multiple blobs a title can be set + which is compared against `org.opencontainers.image.title` annotation. + +The *src* argument contains the name of the artifact, which must already exist locally. +The *dst* argument contains the target path, if the path in the container is a +directory or does not exist the blob title (`org.opencontainers.image.title` +annotation) will be used as filename and joined to the path. If the annotation +does not exist the digest will be used as filename instead. This results in all blobs +of the artifact mounted into the container at the given path. + +However, if the *dst* path is an existing file in the container, then the blob will be +mounted directly on it. This only works when the artifact contains a single blob +or when either *digest* or *title* are specified. + +Options specific to type=**volume**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *idmap*: If specified, create an idmapped mount to the target user namespace in the container. + The idmap option is only supported by Podman in rootful mode. The Linux kernel does not allow the use of idmapped file systems for unprivileged users. + The idmap option supports a custom mapping that can be different than the user namespace used by the container. + The mapping can be specified after the idmap option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the first value is the + start of the backing file system IDs that are mapped to the second value on the host. The length of this mapping is given in the third value. + Multiple ranges are separated with #. If the specified mapping is prepended with a '@', then the mapping is considered relative to the container + user namespace. The host ID for the mapping is changed to account for the relative position of the container user in the container user namespace. + +Options specific to type=**image**: + +- *rw*, *readwrite*: *true* or *false* (default if unspecified: *false*). + +- *subpath*: Mount only a specific path within the image, instead of the whole image. + +Options specific to **bind** and **glob**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *bind-propagation*: *shared*, *slave*, *private*, *unbindable*, *rshared*, *rslave*, *runbindable*, or **rprivate** (default).[[1]](#Footnote1) See also mount(2). + +- *bind-nonrecursive*: do not set up a recursive bind mount. By default it is recursive. + +- *relabel*: *shared*, *private*. + +- *idmap*: *true* or *false* (default if unspecified: *false*). If true, create an idmapped mount to the target user namespace in the container. The idmap option is only supported by Podman in rootful mode. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *no-dereference*: do not dereference symlinks but copy the link source into the mount destination. + +Options specific to type=**tmpfs** and **ramfs**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *tmpfs-size*: Size of the tmpfs/ramfs mount, in bytes. Unlimited by default in Linux. + +- *tmpfs-mode*: Octal file mode of the tmpfs/ramfs (e.g. 700 or 0700.). + +- *tmpcopyup*: Enable copyup from the image directory at the same location to the tmpfs/ramfs. Used by default. + +- *notmpcopyup*: Disable copying files from the image to the tmpfs/ramfs. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +Options specific to type=**devpts**: + +- *uid*: numeric UID of the file owner (default: 0). + +- *gid*: numeric GID of the file owner (default: 0). + +- *mode*: octal permission mask for the file (default: 600). + +- *max*: maximum number of PTYs (default: 1048576). + +Examples: + +- `type=bind,source=/path/on/host,destination=/path/in/container` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared,U=true` + +- `type=devpts,destination=/dev/pts` + +- `type=glob,src=/usr/lib/libfoo*,destination=/usr/lib,ro=true` + +- `type=image,source=fedora,destination=/fedora-image,rw=true` + +- `type=ramfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,destination=/path/in/container,noswap` + +- `type=artifact,src=quay.io/libpod/testartifact:20250206-single,dst=/data` + +- `type=artifact,src=quay.io/libpod/testartifact:20250206-multi,dst=/data,title=test1` + +[//]: # (END included file options/mount.md) + + +[//]: # (BEGIN included file options/name.container.md) +#### **--name**=*name* + +Assign a name to the container. + +The operator can identify a container in three ways: + +- UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”); +- UUID short identifier (“f78375b1c487”); +- Name (“jonah”). + +Podman generates a UUID for each container, and if no name is assigned to the +container using **--name**, Podman generates a random string name. The name can +be useful as a more human-friendly way to identify containers. This works for +both background and foreground containers. The container's name is also added +to the `/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). + +[//]: # (END included file options/name.container.md) + + +[//]: # (BEGIN included file options/network.md) +#### **--network**=*mode*, **--net** + +Set the network mode for the container. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + For better integration with DNS handling, **--dns-forward 169.254.1.1** is passed, + and this address is added to resolv.conf(5) as first resolver. It is possible to pass + **--dns-forward** explicitly in case a different IP address should be used. + To make the `host.containers.internal` /etc/hosts entry work and allow connections + to the host, **--map-guest-addr 169.254.1.2** is passed. Again, it can be set + explicitly to choose a different IP address. \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured (via Podman's + **--publish** or by passing the pasta **-t**/**-u** options directly), + to disable automatic port forwarding based on bound ports. Similarly, **-T none** + and **-U none** are given to disable the same functionality from container to + host. \ + All options can also be set in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**; + see the `pasta_options` key under the network section in that file. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.md) + +Invalid if using **--dns**, **--dns-option**, or **--dns-search** with **--network** set to **none** or **container:**_id_. + +If used together with **--pod**, the container does not join the pod's network namespace. + + +[//]: # (BEGIN included file options/network-alias.md) +#### **--network-alias**=*alias* + +Add a network-scoped alias for the container, setting the alias for all networks that the container joins. To set a +name only for a specific network, use the alias option as described under the **--network** option. +If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. This option can be specified multiple times. +NOTE: When using CNI a container only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. + +[//]: # (END included file options/network-alias.md) + + +[//]: # (BEGIN included file options/no-healthcheck.md) +#### **--no-healthcheck** + +Disable any defined healthchecks for container. + +[//]: # (END included file options/no-healthcheck.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the container. + +Podman assumes control over the container's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/oom-kill-disable.md) +#### **--oom-kill-disable** + +Whether to disable OOM Killer for the container or not. + +This flag is not supported on cgroups V2 systems. + +[//]: # (END included file options/oom-kill-disable.md) + + +[//]: # (BEGIN included file options/oom-score-adj.md) +#### **--oom-score-adj**=*num* + +Tune the host's OOM preferences for containers (accepts values from **-1000** to **1000**). + +When running in rootless mode, the specified value can't be lower than +the oom_score_adj for the current process. In this case, the +oom-score-adj is clamped to the current process value. + +[//]: # (END included file options/oom-score-adj.md) + + +[//]: # (BEGIN included file options/os.pull.md) +#### **--os**=*OS* + +Override the OS, defaults to hosts, of the image to be pulled. For example, `windows`. +Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. + +[//]: # (END included file options/os.pull.md) + + +[//]: # (BEGIN included file options/passwd-entry.md) +#### **--passwd-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/passwd` file within the container when `--passwd` is used. + +The variables $USERNAME, $UID, $GID, $NAME, $HOME are automatically replaced with their value at runtime. + +[//]: # (END included file options/passwd-entry.md) + + +[//]: # (BEGIN included file options/personality.md) +#### **--personality**=*persona* + +Personality sets the execution domain via Linux personality(2). + +[//]: # (END included file options/personality.md) + + +[//]: # (BEGIN included file options/pid.container.md) +#### **--pid**=*mode* + +Set the PID namespace mode for the container. +The default is to create a private PID namespace for the container. + +- **container:**_id_: join another container's PID namespace; +- **host**: use the host's PID namespace for the container. Note the host mode gives the container full access to local PID and is therefore considered insecure; +- **ns:**_path_: join the specified PID namespace; +- **private**: create a new namespace for the container (default). + +[//]: # (END included file options/pid.container.md) + + +[//]: # (BEGIN included file options/pidfile.md) +#### **--pidfile**=*path* + +When the pidfile location is specified, the container process' PID is written to the pidfile. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +If the pidfile option is not specified, the container process' PID is written to /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile. + +After the container is started, the location for the pidfile can be discovered with the following `podman inspect` command: + + $ podman inspect --format '{{ .PidFile }}' $CID + /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile + +[//]: # (END included file options/pidfile.md) + + +[//]: # (BEGIN included file options/pids-limit.md) +#### **--pids-limit**=*limit* + +Tune the container's pids limit. Set to **-1** to have unlimited pids for the container. The default is **2048** on systems that support "pids" cgroup controller. + +[//]: # (END included file options/pids-limit.md) + + +[//]: # (BEGIN included file options/platform.md) +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with --arch and --os) +The `--platform` option can be used to override the current architecture and operating system. +Unless overridden, subsequent lookups of the same image in the local storage matches this platform, regardless of the host. + +[//]: # (END included file options/platform.md) + + +[//]: # (BEGIN included file options/pod.run.md) +#### **--pod**=*name* + +Run container in an existing pod. Podman makes the pod automatically if the pod name is prefixed with **new:**. +To make a pod with more granular options, use the **podman pod create** command before creating a container. +When a container is run with a pod with an infra-container, the infra-container is started first. + +[//]: # (END included file options/pod.run.md) + + +[//]: # (BEGIN included file options/pod-id-file.container.md) +#### **--pod-id-file**=*file* + +Run container in an existing pod and read the pod's ID from the specified *file*. +When a container is run within a pod which has an infra-container, the infra-container starts first. + +[//]: # (END included file options/pod-id-file.container.md) + + +[//]: # (BEGIN included file options/privileged.md) +#### **--privileged** + +Give extended privileges to this container. The default is **false**. + +By default, Podman containers are unprivileged (**=false**) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read-only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. +Due to the disabled security features, the privileged field should almost never +be set as containers can easily break out of confinement. + +Containers running in a user namespace (e.g., rootless containers) cannot have +more privileges than the user that launched them. + +[//]: # (END included file options/privileged.md) + + +[//]: # (BEGIN included file options/publish.md) +#### **--publish**, **-p**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Publish a container's port, or range of ports, to the host. + +Both *hostPort* and *containerPort* can be specified as a range of ports. +When specifying ranges for both, the number of container ports in the +range must match the number of host ports in the range. + +If host IP is set to 0.0.0.0 or not set at all, the port is bound on all IPs on the host. + +By default, Podman publishes TCP ports. To publish a UDP port instead, give +`udp` as protocol. To publish both TCP and UDP ports, set `--publish` twice, +with `tcp`, and `udp` as protocols respectively. Rootful containers can also +publish ports using the `sctp` protocol. + +Host port does not have to be specified (e.g. `podman run -p 127.0.0.1::80`). +If it is not, the container port is randomly assigned a port on the host. + +Use **podman port** to see the actual mapping: `podman port $CONTAINER $CONTAINERPORT`. + +Note that the network drivers `macvlan` and `ipvlan` do not support port forwarding, +therefore this option will have no effect on such networks. + +[//]: # (END included file options/publish.md) + +**Note:** If a container runs within a pod, it is not necessary to publish the port for +the containers in the pod. The port must only be published by the pod itself. Pod network +stacks act like the network stack on the host - when there are a variety of containers in the pod, +and programs in the container, all sharing a single interface and IP address, and +associated ports. If one container binds to a port, no other container can use that port +within the pod while it is in use. Containers in the pod can also communicate over localhost +by having one container bind to localhost in the pod, and another connect to that port. + + +[//]: # (BEGIN included file options/publish-all.md) +#### **--publish-all**, **-P** + +Publish all exposed ports to random ports on the host interfaces. The default is **false**. + +When set to **true**, publish all exposed ports to the host interfaces. +If the operator uses **-P** (or **-p**) then Podman makes the +exposed port accessible on the host and the ports are available to any +client that can reach the host. + +When using this option, Podman binds any exposed port to a random port on the host +within an ephemeral port range defined by */proc/sys/net/ipv4/ip_local_port_range*. +To find the mapping between the host ports and the exposed ports, use **podman port**. + +[//]: # (END included file options/publish-all.md) + + +[//]: # (BEGIN included file options/pull.md) +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Pull the image only when the image is not in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error if no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. + +[//]: # (END included file options/pull.md) + +#### **--quiet**, **-q** + +Suppress output information when pulling images + + +[//]: # (BEGIN included file options/rdt-class.md) +#### **--rdt-class**=*intel-rdt-class-of-service* + +Rdt-class sets the class of service (CLOS or COS) for the container to run in. Based on the Cache Allocation Technology (CAT) feature that is part of Intel's Resource Director Technology (RDT) feature set, all container processes will run within the pre-configured COS, representing a part of the cache. The COS has to be created and configured using a pseudo file system (usually mounted at `/sys/fs/resctrl`) that the resctrl kernel driver provides. Assigning the container to a COS requires root privileges and thus doesn't work in a rootless environment. Currently, the feature is only supported using `runc` as a runtime. See for more details on creating a COS before a container can be assigned to it. + +[//]: # (END included file options/rdt-class.md) + + +[//]: # (BEGIN included file options/read-only.md) +#### **--read-only** + +Mount the container's root filesystem as read-only. + +By default, container root filesystems are writable, allowing processes +to write files anywhere. By specifying the **--read-only** flag, the containers root filesystem are mounted read-only prohibiting any writes. + +[//]: # (END included file options/read-only.md) + + +[//]: # (BEGIN included file options/read-only-tmpfs.md) +#### **--read-only-tmpfs** + +When running --read-only containers, mount a read-write tmpfs on _/dev_, _/dev/shm_, _/run_, _/tmp_, and _/var/tmp_. The default is **true**. + +| --read-only | --read-only-tmpfs | / | /run, /tmp, /var/tmp| +| ----------- | ----------------- | ---- | ----------------------------------- | +| true | true | r/o | r/w | +| true | false | r/o | r/o | +| false | false | r/w | r/w | +| false | true | r/w | r/w | + +When **--read-only=true** and **--read-only-tmpfs=true** additional tmpfs are mounted on +the /tmp, /run, and /var/tmp directories. + +When **--read-only=true** and **--read-only-tmpfs=false** /dev and /dev/shm are marked +Read/Only and no tmpfs are mounted on /tmp, /run and /var/tmp. The directories +are exposed from the underlying image, meaning they are read-only by default. +This makes the container totally read-only. No writable directories exist within +the container. In this mode writable directories need to be added via external +volumes or mounts. + +By default, when **--read-only=false**, the /dev and /dev/shm are read/write, and the /tmp, /run, and /var/tmp are read/write directories from the container image. + +[//]: # (END included file options/read-only-tmpfs.md) + + +[//]: # (BEGIN included file options/replace.md) +#### **--replace** + +If another container with the same name already exists, replace and remove it. The default is **false**. + +[//]: # (END included file options/replace.md) + + +[//]: # (BEGIN included file options/requires.md) +#### **--requires**=*container* + +Specify one or more requirements. +A requirement is a dependency container that is started before this container. +Containers can be specified by name or ID, with multiple containers being separated by commas. + +[//]: # (END included file options/requires.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + +#### **--rm** + +Automatically remove the container and any anonymous unnamed volume associated with +the container when it exits. The default is **false**. + + +[//]: # (BEGIN included file options/rootfs.md) +#### **--rootfs** + +If specified, the first argument refers to an exploded container on the file system. + +This is useful to run a container without requiring any image management, the rootfs +of the container is assumed to be managed externally. + + `Overlay Rootfs Mounts` + + The `\:O` flag tells Podman to mount the directory from the rootfs path as +storage using the `overlay file system`. The container processes +can modify content within the mount point which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +Note: On **SELinux** systems, the rootfs needs the correct label, which is by default +**unconfined_u\:object_r\:container_file_t\:s0**. + + `idmap` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. +The idmap option supports a custom mapping that can be different than the user +namespace used by the container. The mapping can be specified after the idmap +option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the +first value is the start of the backing file system IDs that are mapped to the +second value on the host. The length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/rootfs.md) + + +[//]: # (BEGIN included file options/sdnotify.md) +#### **--sdnotify**=**container** | *conmon* | *healthy* | *ignore* + +Determines how to use the NOTIFY_SOCKET, as passed with systemd and Type=notify. + +Default is **container**, which means allow the OCI runtime to proxy the socket into the +container to receive ready notification. Podman sets the MAINPID to conmon's pid. +The **conmon** option sets MAINPID to conmon's pid, and sends READY when the container +has started. The socket is never passed to the runtime or the container. +The **healthy** option sets MAINPID to conmon's pid, and sends READY when the container +has turned healthy; requires a healthcheck to be set. The socket is never passed to the runtime or the container. +The **ignore** option removes NOTIFY_SOCKET from the environment for itself and child processes, +for the case where some other process above Podman uses NOTIFY_SOCKET and Podman does not use it. + +[//]: # (END included file options/sdnotify.md) + + +[//]: # (BEGIN included file options/seccomp-policy.md) +#### **--seccomp-policy**=*policy* + +Specify the policy to select the seccomp profile. If set to *image*, Podman looks for a "io.containers.seccomp.profile" label in the container-image config and use its value as a seccomp profile. Otherwise, Podman follows the *default* policy by applying the default profile unless specified otherwise via *--security-opt seccomp* as described below. + +Note that this feature is experimental and may change in the future. + +[//]: # (END included file options/seccomp-policy.md) + + +[//]: # (BEGIN included file options/secret.md) +#### **--secret**=*secret[,opt=opt ...]* + +Give the container access to a secret. Can be specified multiple times. + +A secret is a blob of sensitive data which a container needs at runtime but +is not stored in the image or in source control, such as usernames and passwords, +TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 512 kB in size). + +When secrets are specified as type `mount`, the secrets are copied and mounted into the container when a container is created. +When secrets are specified as type `env`, the secret is set as an environment variable within the container. +Secrets are written in the container at the time of container creation, and modifying the secret using `podman secret` commands +after the container is created affects the secret inside the container. + +Secrets and its storage are managed using the `podman secret` command. + +Secret Options + +- `type=mount|env` : How the secret is exposed to the container. + `mount` mounts the secret into the container as a file. + `env` exposes the secret as an environment variable. + Defaults to `mount`. +- `target=target` : Target of secret. + For mounted secrets, this is the path to the secret inside the container. + If a fully qualified path is provided, the secret is mounted at that location. + Otherwise, the secret is mounted to + `/run/secrets/target` for Linux containers or + `/var/run/secrets/target` for FreeBSD containers. + If the target is not set, the secret is mounted to `/run/secrets/secretname` by default. + For env secrets, this is the environment variable key. Defaults to `secretname`. +- `uid=0` : UID of secret. Defaults to 0. Mount secret type only. +- `gid=0` : GID of secret. Defaults to 0. Mount secret type only. +- `mode=0` : Mode of secret. Defaults to 0444. Mount secret type only. + + +Examples + +Mount at `/my/location/mysecret` with UID 1: +``` +--secret mysecret,target=/my/location/mysecret,uid=1 +``` + +Mount at `/run/secrets/customtarget` with mode 0777: +``` +--secret mysecret,target=customtarget,mode=0777 +``` + +Create a secret environment variable called `ENVSEC`: +``` +--secret mysecret,type=env,target=ENVSEC +``` + +[//]: # (END included file options/secret.md) + + +[//]: # (BEGIN included file options/security-opt.md) +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the container +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the container + +- **label=user:**_USER_: Set the label user for the container processes +- **label=role:**_ROLE_: Set the label role for the container processes +- **label=type:**_TYPE_: Set the label process type for the container processes +- **label=level:**_LEVEL_: Set the label level for the container processes +- **label=filetype:**_TYPE_: Set the label file type for the container files +- **label=disable**: Turn off label separation for the container + +Note: Labeling can be disabled for all containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the container. + +- **no-new-privileges**: Disable container processes from gaining additional privileges through the `execve(2)` system call (e.g. via setuid or setgid bits, or via file capabilities). Programs that rely on setuid/setgid bits set on their executable to change user id or group id are no longer able to do so, and any file capabilities added to the executable (e.g. via `setcap`) are not added to the permitted capability set. For more details, see: https://docs.kernel.org/userspace-api/no_new_privs.html. + +- **seccomp=unconfined**: Turn off seccomp confinement for the container. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. + +[//]: # (END included file options/security-opt.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the container. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/shm-size-systemd.md) +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. + +[//]: # (END included file options/shm-size-systemd.md) + + +[//]: # (BEGIN included file options/stop-signal.md) +#### **--stop-signal**=*signal* + +Signal to stop a container. Default is **SIGTERM**. + +[//]: # (END included file options/stop-signal.md) + + +[//]: # (BEGIN included file options/stop-timeout.md) +#### **--stop-timeout**=*seconds* + +Timeout to stop a container. Default is **10**. +Remote connections use local containers.conf for defaults. + +[//]: # (END included file options/stop-timeout.md) + + +[//]: # (BEGIN included file options/subgidname.md) +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. + +[//]: # (END included file options/subgidname.md) + + +[//]: # (BEGIN included file options/subuidname.md) +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. + +[//]: # (END included file options/subuidname.md) + + +[//]: # (BEGIN included file options/sysctl.md) +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters at runtime. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: if using the **--ipc=host** option, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: if using the **--network=host** option, the above sysctls are not allowed. + +[//]: # (END included file options/sysctl.md) + + +[//]: # (BEGIN included file options/systemd.md) +#### **--systemd**=*true* | *false* | *always* + +Run container in systemd mode. The default is **true**. + +- **true** enables systemd mode only when the command executed inside the container is *systemd*, */usr/sbin/init*, +*/sbin/init* or */usr/local/sbin/init*. + +- **false** disables systemd mode. + +- **always** enforces the systemd mode to be enabled. + +Running the container in systemd mode causes the following changes: + +* Podman mounts tmpfs file systems on the following directories + * _/run_ + * _/run/lock_ + * _/tmp_ + * _/sys/fs/cgroup/systemd_ (on a cgroup v1 system) + * _/var/lib/journal_ +* Podman sets the default stop signal to **SIGRTMIN+3**. +* Podman sets **container_uuid** environment variable in the container to the +first 32 characters of the container ID. +* Podman does not mount virtual consoles (_/dev/tty\d+_) when running with **--privileged**. +* On cgroup v2, */sys/fs/cgroup* is mounted writable. + +This allows systemd to run in a confined container without any modifications. + +Note that on **SELinux** systems, systemd attempts to write to the cgroup +file system. Containers writing to the cgroup file system are denied by default. +The **container_manage_cgroup** boolean must be enabled for this to be allowed on an SELinux separated system. +``` +setsebool -P container_manage_cgroup true +``` + +[//]: # (END included file options/systemd.md) + + +[//]: # (BEGIN included file options/timeout.md) +#### **--timeout**=*seconds* + +Maximum time a container is allowed to run before conmon sends it the kill +signal. By default containers run until they exit or are stopped by +`podman stop`. + +[//]: # (END included file options/timeout.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/tmpfs.md) +#### **--tmpfs**=*fs* + +Create a tmpfs mount. + +Mount a temporary filesystem (**tmpfs**) mount into a container, for example: + +``` +$ podman create -d --tmpfs /tmp\:rw,size=787448k,mode=1777 my_image +``` + +This command mounts a **tmpfs** at _/tmp_ within the container. The supported mount +options are the same as the Linux default mount flags. If no options are specified, +the system uses the following options: +**rw,noexec,nosuid,nodev**. + +[//]: # (END included file options/tmpfs.md) + + +[//]: # (BEGIN included file options/tty.md) +#### **--tty**, **-t** + +Allocate a pseudo-TTY. The default is **false**. + +When set to **true**, Podman allocates a pseudo-tty and attach to the standard +input of the container. This can be used, for example, to run a throwaway +interactive shell. + +**NOTE**: The --tty flag prevents redirection of standard output. It combines STDOUT and STDERR, it can insert control characters, and it can hang pipes. This option is only used when run interactively in a terminal. When feeding input to Podman, use -i only, not -it. + +[//]: # (END included file options/tty.md) + + +[//]: # (BEGIN included file options/tz.md) +#### **--tz**=*timezone* + +Set timezone in container. This flag takes area-based timezones, GMT time, as well as `local`, which sets the timezone in the container to match the host machine. See `/usr/share/zoneinfo/` for valid timezones. +Remote connections use local containers.conf for defaults + +[//]: # (END included file options/tz.md) + + +[//]: # (BEGIN included file options/uidmap.container.md) +#### **--uidmap**=*[flags]container_uid\:from_uid[\:amount]* + +Run the container in a new user namespace using the supplied UID mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +The possible values of the optional *flags* are discussed further down on this page. +The *amount* value is optional and assumed to be **1** if not given. + +The *from_uid* value is based upon the user running the command, either rootful or rootless users. + +* rootful user: [*flags*]*container_uid*:*host_uid*[:*amount*] +* rootless user: [*flags*]*container_uid*:*intermediate_uid*[:*amount*] + + `Rootful mappings` + + +When **podman create** is called by a privileged user, the option **--uidmap** +works as a direct mapping between host UIDs and container UIDs. + +host UID -> container UID + +The _amount_ specifies the number of consecutive UIDs that is mapped. +If for example _amount_ is **4** the mapping looks like: + +| host UID | container UID | +| ---------- | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | + + `Rootless mappings` + +When **podman create** is called by an unprivileged user (i.e. running rootless), +the value *from_uid* is interpreted as an "intermediate UID". In the rootless +case, host UIDs are not mapped directly to container UIDs. Instead the mapping +happens over two mapping steps: + +host UID -> intermediate UID -> container UID + +The **--uidmap** option only influences the second mapping step. + +The first mapping step is derived by Podman from the contents of the file +_/etc/subuid_ and the UID of the user calling Podman. + +First mapping step: + +| host UID | intermediate UID | +| -------- | ---------------- | +| UID for Podman user | 0 | +| 1st subordinate UID | 1 | +| 2nd subordinate UID | 2 | +| 3rd subordinate UID | 3 | +| nth subordinate UID | n | + +To be able to use intermediate UIDs greater than zero, the user needs to have +subordinate UIDs configured in _/etc/subuid_. See **subuid**(5). + +The second mapping step is configured with **--uidmap**. + +If for example _amount_ is **5** the second mapping step looks like: + +| intermediate UID | container UID | +| ------------------ | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | +| *from_uid* + 4 | *container_uid* + 4 | + +When running as rootless, Podman uses all the ranges configured in the _/etc/subuid_ file. + +The current user ID is mapped to UID=0 in the rootless user namespace. +Every additional range is added sequentially afterward: + +| host | rootless user namespace | length | +| ------ | ----------------------- | ------ | +| $UID | 0 | 1 | +| 1 | $FIRST_RANGE_ID | $FIRST_RANGE_LENGTH | +| 1+$FIRST_RANGE_LENGTH | $SECOND_RANGE_ID | $SECOND_RANGE_LENGTH| + + `Referencing a host ID from the parent namespace` + +As a rootless user, the given host ID in **--uidmap** or **--gidmap** +is mapped from the *intermediate namespace* generated by Podman. Sometimes +it is desirable to refer directly at the *host namespace*. It is possible +to manually do so, by running `podman unshare cat /proc/self/gid_map`, +finding the desired host id at the second column of the output, and getting +the corresponding intermediate id from the first column. + +Podman can perform all that by preceding the host id in the mapping +with the `@` symbol. For instance, by specifying `--gidmap 100000:@2000:1`, +podman will look up the intermediate id corresponding to host id `2000` and +it will map the found intermediate id to the container id `100000`. The +given host id must have been subordinated (otherwise it would not be mapped +into the intermediate space in the first place). + +If the length is greater than one, for instance with `--gidmap 100000:@2000:2`, +Podman will map host ids `2000` and `2001` to `100000` and `100001`, respectively, +regardless of how the intermediate mapping is defined. + + `Extending previous mappings` + +Some mapping modifications may be cumbersome. For instance, a user +starts with a mapping such as `--gidmap="0:0:65000"`, that needs to be +changed such as the parent id `1000` is mapped to container id `100000` +instead, leaving container id `1` unassigned. The corresponding `--gidmap` +becomes `--gidmap="0:0:1" --gidmap="2:2:65534" --gidmap="100000:1:1"`. + +This notation can be simplified using the `+` flag, that takes care of +breaking previous mappings removing any conflicting assignment with +the given mapping. The flag is given before the container id +as follows: `--gidmap="0:0:65000" --gidmap="+100000:1:1"` + + + Flag | Example | Description +-----------|---------------|------------- + `+` | `+100000:1:1` | Extend the previous mapping + +This notation leads to gaps in the assignment, so it may be convenient to +fill those gaps afterwards: `--gidmap="0:0:65000" --gidmap="+100000:1:1" --gidmap="1:65001:1"` + +One specific use case for this flag is in the context of rootless +users. A rootless user may specify mappings with the `+` flag as +in `--gidmap="+100000:1:1"`. Podman will then "fill the gaps" starting +from zero with all the remaining intermediate ids. This is convenient when +a user wants to map a specific intermediate id to a container id, leaving +the rest of subordinate ids to be mapped by Podman at will. + + `Passing only one of --uidmap or --gidmap` + +Usually, subordinated user and group ids are assigned simultaneously, and +for any user the subordinated user ids match the subordinated group ids. +For convenience, if only one of **--uidmap** or **--gidmap** is given, +podman assumes the mapping refers to both UIDs and GIDs and applies the +given mapping to both. If only one value of the two needs to be changed, +the mappings should include the `u` or the `g` flags to specify that +they only apply to UIDs or GIDs and should not be copied over. + + flag | Example | Description +---------|-----------------|----------------- + `u` | `u20000:2000:1` |The mapping only applies to UIDs + `g` | `g10000:1000:1` |The mapping only applies to GIDs + +For instance given the command + + podman create --gidmap "0:0:1000" --gidmap "g2000:2000:1" + +Since no **--uidmap** is given, the **--gidmap** is copied to **--uidmap**, +giving a command equivalent to + + podman create --gidmap "0:0:1000" --gidmap "2000:2000:1" --uidmap "0:0:1000" + +The `--gidmap "g2000:2000:1"` used the `g` flag and therefore it was +not copied to **--uidmap**. + + `Rootless mapping of additional host GIDs` + +A rootless user may desire to map a specific host group that has already been +subordinated within _/etc/subgid_ without specifying the rest of the mapping. + +This can be done with **--gidmap "+g*container_gid*:@*host_gid*"** + +Where: + +- The host GID is given through the `@` symbol +- The mapping of this GID is not copied over to **--usermap** thanks to the `g` flag. +- The rest of the container IDs will be mapped starting from 0 to n, + with all the remaining subordinated GIDs, thanks to the `+` flag. + +For instance, if a user belongs to the group `2000` and that group is +subordinated to that user (with `usermod --add-subgids 2000-2000 $USER`), +the user can map the group into the container with: **--gidmap=+g100000:@2000**. + +If this mapping is combined with the option, **--group-add=keep-groups**, the +process in the container will belong to group `100000`, and files belonging +to group `2000` in the host will appear as being owned by group `100000` +inside the container. + + podman run --group-add=keep-groups --gidmap="+g100000:@2000" ... + + `No subordinate UIDs` + +Even if a user does not have any subordinate UIDs in _/etc/subuid_, +**--uidmap** can be used to map the normal UID of the user to a +container UID by running `podman create --uidmap $container_uid:0:1 --user $container_uid ...`. + + `Pods` + +The **--uidmap** option cannot be called in conjunction with the **--pod** option as a uidmap cannot be set on the container level when in a pod. + +[//]: # (END included file options/uidmap.container.md) + + +[//]: # (BEGIN included file options/ulimit.md) +#### **--ulimit**=*option* + +Ulimit options. Sets the ulimits values inside of the container. + +--ulimit with a soft and hard limit in the format =[:]. For example: + +$ podman run --ulimit nofile=1024:1024 --rm ubi9 ulimit -n +1024 + +Set -1 for the soft or hard limit to set the limit to the maximum limit of the current +process. In rootful mode this is often unlimited. + + +If nofile and nproc are unset, a default value of 1048576 will be used, unless overridden +in containers.conf(5). However, if the default value exceeds the hard limit for the current +rootless user, the current hard limit will be applied instead. + +Use **host** to copy the current configuration from the host. + +Don't use nproc with the ulimit flag as Linux uses nproc to set the +maximum number of processes available to a user, not to a container. + +Use the --pids-limit option to modify the cgroup control to limit the number +of processes within a container. + +[//]: # (END included file options/ulimit.md) + + +[//]: # (BEGIN included file options/umask.md) +#### **--umask**=*umask* + +Set the umask inside the container. Defaults to `0022`. +Remote connections use the local `containers.conf` for defaults. + +[//]: # (END included file options/umask.md) + + +[//]: # (BEGIN included file options/unsetenv.md) +#### **--unsetenv**=*env* + +Unset default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. + +[//]: # (END included file options/unsetenv.md) + + +[//]: # (BEGIN included file options/unsetenv-all.md) +#### **--unsetenv-all** + +Unset all default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. + +[//]: # (END included file options/unsetenv-all.md) + + +[//]: # (BEGIN included file options/user.md) +#### **--user**, **-u**=*user[\:group]* + +Sets the username or UID used and, optionally, the groupname or GID for the specified command. Both *user* and *group* may be symbolic or numeric. + +Without this argument, the command runs as the user specified in the container image. Unless overridden by a `USER` command in the Containerfile or by a value passed to this option, this user generally defaults to root. + +When a user namespace is not in use, the UID and GID used within the container and on the host match. When user namespaces are in use, however, the UID and GID in the container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container by default corresponds to the UID and GID of the user invoking Podman. + +[//]: # (END included file options/user.md) + + +[//]: # (BEGIN included file options/userns.container.md) +#### **--userns**=*mode* + +Set the user namespace mode for the container. + +If `--userns` is not set, the default value is determined as follows. +- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used. +- If the environment variable **PODMAN_USERNS** is set its value is used. +- If `userns` is specified in `containers.conf` this value is used. +- Otherwise, `--userns=host` is assumed. + +`--userns=""` (i.e., an empty string) is an alias for `--userns=host`. + +This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +------------------------|-----------|--------------------- +auto | $UID | nil (Host User UID is not mapped into container.) +host | $UID | 0 (Default User account mapped to root user in container.) +keep-id | $UID | $UID (Map user account to same UID within container.) +keep-id\:uid=200,gid=210 | $UID | 200:210 (Map user account to specified UID, GID value within container.) +nomap | $UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + +**auto**[\:_OPTIONS,..._]: automatically create a unique user namespace. + +* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. + + Example: `containers:2147483647:2147483648`. + +* `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5). + +Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user IDs. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. + +The option `--userns=keep-id` uses all the subuids and subgids of the user. +The option `--userns=nomap` uses all the subuids and subgids of the user except the user's own ID. +Using `--userns=auto` when starting new containers does not work as long as any containers exist that were started with `--userns=nomap` or `--userns=keep-id` without limiting the user namespace size. + + Valid `auto` options: + + - *gidmapping*=_CONTAINER\_GID\:HOST\_GID\:SIZE_: to force a GID mapping to be present in the user namespace. + - *size*=_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates a size for the user namespace. + - *uidmapping*=_CONTAINER\_UID\:HOST\_UID\:SIZE_: to force a UID mapping to be present in the user namespace. + +The host UID and GID in *gidmapping* and *uidmapping* can optionally be prefixed with the `@` symbol. +In this case, podman will look up the intermediate ID corresponding to host ID and it will map the found intermediate ID to the container id. +For details see **--uidmap**. + +**container:**_id_: join the user namespace of the specified container. + +**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user. + +**keep-id**: creates a user namespace where the current user's UID\:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace. + + Valid `keep-id` options: + + - *uid*=UID: override the UID inside the container that is used to map the current user to. + - *gid*=GID: override the GID inside the container that is used to map the current user to. + - *size*=SIZE: override the size of the configured user namespace. It is useful to not saturate all the available IDs. Not supported when running as root. + +**nomap**: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +**ns:**_namespace_: run the container in the given existing user namespace. + +[//]: # (END included file options/userns.container.md) + + +[//]: # (BEGIN included file options/uts.container.md) +#### **--uts**=*mode* + +Set the UTS namespace mode for the container. The following values are supported: + +- **host**: use the host's UTS namespace inside the container. +- **private**: create a new namespace for the container (default). +- **ns:[path]**: run the container in the given existing UTS namespace. +- **container:[container]**: join the UTS namespace of the specified container. + +[//]: # (END included file options/uts.container.md) + + +[//]: # (BEGIN included file options/variant.container.md) +#### **--variant**=*VARIANT* + +Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. + +[//]: # (END included file options/variant.container.md) + + +[//]: # (BEGIN included file options/volume.md) +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the container is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +container. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a container is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the container, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the container. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system +might prevent the processes running inside the container from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the container context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +containers share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label. Only the current container can use a private +volume. + +Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any one of the containers. Relabeling walks +the file system under the volume and changes the label on each file; if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the container. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually changed with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the container. +For example if a user wanted to volume mount their entire home directory into a +container, they need to disable SELinux separation. + + $ podman create --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The container processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous container executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the container +to work. + +Do not modify the source directory mounted into the container with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the container are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the container +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +container, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +container. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the container. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the container. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless container fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/volume.md) + +Use the **--group-add keep-groups** option to pass the user's supplementary group access into the container. + + +[//]: # (BEGIN included file options/volumes-from.md) +#### **--volumes-from**=*CONTAINER[\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +container. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target container, then the volume hides +that data on the target. + +[//]: # (END included file options/volumes-from.md) + + +[//]: # (BEGIN included file options/workdir.md) +#### **--workdir**, **-w**=*dir* + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (**/**). +The image developer can set a different default with the WORKDIR instruction. The operator +can override the working directory by using the **-w** option. + +[//]: # (END included file options/workdir.md) + +## EXAMPLES + +Create a container using a local image: +``` +$ podman create alpine ls +``` + +Create a container using a local image and annotate it: +``` +$ podman create --annotation HELLO=WORLD alpine ls +``` + +Create a container using a local image, allocating a pseudo-TTY, keeping stdin open and name it myctr: +``` + podman create -t -i --name myctr alpine ls +``` + +Running a container in a new user namespace requires a mapping of +the UIDs and GIDs from the host: +``` +$ podman create --uidmap 0:30000:7000 --gidmap 0:30000:7000 fedora echo hello +``` + +Setting automatic user-namespace separated containers: +``` +# podman create --userns=auto\:size=65536 ubi8-init +``` + +Configure the timezone in a container: +``` +$ podman create --tz=local alpine date +$ podman create --tz=Asia/Shanghai alpine date +$ podman create --tz=US/Eastern alpine date +``` + +Ensure the first container (container1) is running before the second container (container2) is started: +``` +$ podman create --name container1 -t -i fedora bash +$ podman create --name container2 --requires container1 -t -i fedora bash +$ podman start --attach container2 +``` + +Create a container which requires multiple containers: +``` +$ podman create --name container1 -t -i fedora bash +$ podman create --name container2 -t -i fedora bash +$ podman create --name container3 --requires container1,container2 -t -i fedora bash +$ podman start --attach container3 +``` + +Expose shared libraries inside of container as read-only using a glob: +``` +$ podman create --mount type=glob,src=/usr/lib64/libnvidia\*,ro -i -t fedora /bin/bash +``` + +Create a container allowing supplemental groups to have access to the volume: +``` +$ podman create -v /var/lib/design:/var/lib/design --group-add keep-groups ubi8 +``` + +Configure execution domain for containers using the personality option: +``` +$ podman create --name container1 --personality=LINUX32 fedora bash +``` + +Create a container with external rootfs mounted as an overlay: +``` +$ podman create --name container1 --rootfs /path/to/rootfs:O bash +``` + +Create a container connected to two networks (called net1 and net2) with a static ip: +``` +$ podman create --network net1\:ip=10.89.1.5 --network net2:ip=10.89.10.10 alpine ip addr +``` + +### Rootless Containers + +Podman runs as a non-root user on most systems. This feature requires that a new enough version of shadow-utils +be installed. The shadow-utils package must include the newuidmap and newgidmap executables. + +In order for users to run rootless, there must be an entry for their username in /etc/subuid and /etc/subgid which lists the UIDs for their user namespace. + +Rootless Podman works better if the fuse-overlayfs and slirp4netns packages are installed. +The fuse-overlayfs package provides a userspace overlay storage driver, otherwise users need to use +the vfs storage driver, which can be disk space expensive and less performant +than other drivers. + +To enable VPN on the container, slirp4netns or pasta needs to be specified; +without either, containers need to be run with the --network=host flag. + +## ENVIRONMENT + +Environment variables within containers can be set using multiple different options: This section describes the precedence. + +Precedence order (later entries override earlier entries): + +- **--env-host** : Host environment of the process executing Podman is added. +- **--http-proxy**: By default, several environment variables are passed in from the host, such as **http_proxy** and **no_proxy**. See **--http-proxy** for details. +- Container image : Any environment variables specified in the container image. +- **--env-file** : Any environment variables specified via env-files. If multiple files specified, then they override each other in order of entry. +- **--env** : Any environment variables specified overrides previous settings. + +Create containers and set the environment ending with a __*__. +The trailing __*__ glob functionality is only active when no value is specified: + +``` +$ export ENV1=a +$ podman create --name ctr1 --env 'ENV*' alpine env +$ podman start --attach ctr1 | grep ENV +ENV1=a +$ podman create --name ctr2 --env 'ENV*=b' alpine env +$ podman start --attach ctr2 | grep ENV +ENV*=b +``` + +## CONMON + +When Podman starts a container it actually executes the conmon program, which +then executes the OCI Runtime. Conmon is the container monitor. It is a small +program whose job is to watch the primary process of the container, and if the +container dies, save the exit code. It also holds open the tty of the +container, so that it can be attached to later. This is what allows Podman to +run in detached mode (backgrounded), so Podman can exit but conmon continues to +run. Each container has their own instance of conmon. Conmon waits for the +container to exit, gathers and saves the exit code, and then launches a Podman +process to complete the container cleanup, by shutting down the network and +storage. For more information about conmon, see the conmon(8) man +page. + +## FILES + +**/etc/subuid** +**/etc/subgid** + +NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-save(1)](podman-save.1.md)**, **[podman-ps(1)](podman-ps.1.md)**, **[podman-attach(1)](podman-attach.1.md)**, **[podman-pod-create(1)](podman-pod-create.1.md)**, **[podman-port(1)](podman-port.1.md)**, **[podman-start(1)](podman-start.1.md)**, **[podman-kill(1)](podman-kill.1.md)**, **[podman-stop(1)](podman-stop.1.md)**, **[podman-generate-systemd(1)](podman-generate-systemd.1.md)**, **[podman-rm(1)](podman-rm.1.md)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)**, **[setsebool(8)](https://man7.org/linux/man-pages/man8/setsebool.8.html)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, **[pasta(1)](https://passt.top/builds/latest/web/passt.1.html)**, **[fuse-overlayfs(1)](https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md)**, **proc(5)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)**, **personality(2)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +See [podman-rootless(7)](https://github.com/containers/podman/blob/main/rootless.md) +for rootless issues. + +## HISTORY +October 2017, converted from Docker documentation to Podman by Dan Walsh for Podman `` + +November 2014, updated by Sven Dowideit `` + +September 2014, updated by Sven Dowideit `` + +August 2014, updated by Sven Dowideit `` + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a core value of open source. The `master` and `slave` mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately. diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-diff.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-diff.1.md new file mode 100644 index 000000000..9a323d1a9 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-diff.1.md @@ -0,0 +1,75 @@ +--- +title: podman-diff +version: v5.5.2 +--- + +% podman-diff 1 + +## NAME +podman\-diff - Inspect changes on a container or image's filesystem + +## SYNOPSIS +**podman diff** [*options*] *container|image* [*container|image*] + +## DESCRIPTION +Displays changes on a container or image's filesystem. The container or image is compared to its parent layer or the second argument when given. + +The output is prefixed with the following symbols: + +| Symbol | Description | +|--------|-------------| +| A | A file or directory was added. | +| D | A file or directory was deleted. | +| C | A file or directory was changed. | + +## OPTIONS + +#### **--format** + +Alter the output into a different format. The only valid format for **podman diff** is `json`. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Show container-modified files versus the container's image: +``` +$ podman diff container1 +A /myscript.sh +``` + +Show container-modified files versus the container's image in JSON format: +``` +$ podman diff --format json myimage +{ + "changed": [ + "/usr", + "/usr/local", + "/usr/local/bin" + ], + "added": [ + "/usr/local/bin/docker-entrypoint.sh" + ] +} +``` + +Show the difference between the specified container and the image: +``` +$ podman diff container1 image1 +A /test +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container-diff(1)](podman-container-diff.1.md)**, **[podman-image-diff(1)](podman-image-diff.1.md)** + +## HISTORY +August 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-events.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-events.1.md new file mode 100644 index 000000000..5bc6d4a97 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-events.1.md @@ -0,0 +1,226 @@ +--- +title: podman-events +version: v5.5.2 +--- + +% podman-events 1 + +## NAME +podman\-events - Monitor Podman events + +## SYNOPSIS +**podman events** [*options*] + +**podman system events** [*options*] + +## DESCRIPTION + +Monitor and print events that occur in Podman. Each event includes a timestamp, +a type, a status, name (if applicable), and image (if applicable). The default logging +mechanism is *journald*. This can be changed in containers.conf by changing the `events_logger` +value to `file`. Only `file` and `journald` are accepted. A `none` logger is also +available, but this logging mechanism completely disables events; nothing is reported by +`podman events`. + +By default, streaming mode is used, printing new events as they occur. Previous events can be listed via `--since` and `--until`. + +The *container* event type reports the follow statuses: + * attach + * checkpoint + * cleanup + * commit + * connect + * create + * died + * disconnect + * exec + * exec_died + * exited + * export + * import + * init + * kill + * mount + * pause + * prune + * remove + * rename + * restart + * restore + * start + * stop + * sync + * unmount + * unpause + * update + +The *pod* event type reports the follow statuses: + * create + * kill + * pause + * remove + * start + * stop + * unpause + +The *image* event type reports the following statuses: + * loadFromArchive, + * mount + * pull + * pull-error + * push + * remove + * save + * tag + * unmount + * untag + +The *system* type reports the following statuses: + * refresh + * renumber + +The *volume* type reports the following statuses: + * create + * prune + * remove + +The *secret* type reports the following statuses: + * create + * remove + +#### Verbose Create Events + +Setting `events_container_create_inspect_data=true` in containers.conf(5) instructs Podman to create more verbose container-create events which include a JSON payload with detailed information about the containers. The JSON payload is identical to the one of podman-container-inspect(1). The associated field in journald is named `PODMAN_CONTAINER_INSPECT_DATA`. + +## OPTIONS + +#### **--filter**, **-f**=*filter* + +Filter events that are displayed. They must be in the format of "filter=value". The following +filters are supported: + +| **Filter** | **Description** | +|------------|-------------------------------------| +| container | [Name or ID] Container's name or ID | +| event | event_status (described above) | +| image | [Name or ID] Image name or ID | +| label | [key=value] label | +| pod | [Name or ID] Pod name or ID | +| volume | [Name or ID] Volume name or ID | +| type | Event_type (described above) | + +In the case where an ID is used, the ID may be in its full or shortened form. The "die" event is mapped to "died" for Docker compatibility. + +#### **--format** + +Format the output to JSON Lines or using the given Go template. + +| **Placeholder** | **Description** | +| --------------------- | -------------------------------------------------------------------- | +| .Attributes ... | created_at, _by, labels, and more (map[]) | +| .ContainerExitCode | Exit code (int) | +| .ContainerInspectData | Payload of the container's inspect | +| .Error | Error message in case the event status is an error (e.g. pull-error) | +| .HealthStatus | Health Status (string) | +| .ID | Container ID (full 64-bit SHA) | +| .Image | Name of image being run (string) | +| .Name | Container name (string) | +| .Network | Name of network being used (string) | +| .PodID | ID of pod associated with container, if any | +| .Status | Event status (e.g., create, start, died, ...) | +| .Time | Event timestamp (string) | +| .TimeNano | Event timestamp with nanosecond precision (int64) | +| .Type | Event type (e.g., image, container, pod, ...) | + +#### **--help** + +Print usage statement. + +#### **--no-trunc** + +Do not truncate the output (default *true*). + +#### **--since**=*timestamp* + +Show all events created since the given timestamp + +#### **--stream** + +Stream events and do not exit after reading the last known event (default *true*). + +#### **--until**=*timestamp* + +Show all events created until the given timestamp + +The *since* and *until* values can be RFC3339Nano time stamps or a Go duration string such as 10m, 5h. If no +*since* or *until* values are provided, only new events are shown. + +## JOURNALD IDENTIFIERS + +The journald events-backend of Podman uses the following journald identifiers. You can use the identifiers to filter Podman events directly with `journalctl`. + +| **Identifier** | **Description** | +|-------------------------------|---------------------------------------------------------| +| SYSLOG_IDENTIFIER | Always set to "podman" | +| PODMAN_EVENT | The event status as described above | +| PODMAN_TYPE | The event type as described above | +| PODMAN_TIME | The time stamp when the event was written | +| PODMAN_NAME | Name of the event object (e.g., container, image) | +| PODMAN_ID | ID of the event object (e.g., container, image) | +| PODMAN_EXIT_CODE | Exit code of the container | +| PODMAN_POD_ID | Pod ID of the container | +| PODMAN_LABELS | Labels of the container | +| PODMAN_HEALTH_STATUS | Health status of the container | +| PODMAN_CONTAINER_INSPECT_DATA | The JSON payload of `podman-inspect` as described above | +| PODMAN_NETWORK_NAME | The name of the network | + +## EXAMPLES + +Show Podman events: +``` +$ podman events +2019-03-02 10:33:42.312377447 -0600 CST container create 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +2019-03-02 10:33:46.958768077 -0600 CST container init 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +2019-03-02 10:33:46.973661968 -0600 CST container start 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +2019-03-02 10:33:50.833761479 -0600 CST container stop 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +2019-03-02 10:33:51.047104966 -0600 CST container cleanup 34503c192940 (image=docker.io/library/alpine:latest, name=friendly_allen) +``` + +Show only Podman container create events: +``` +$ podman events -f event=create +2019-03-02 10:36:01.375685062 -0600 CST container create 20dc581f6fbf (image=docker.io/library/alpine:latest, name=sharp_morse) +2019-03-02 10:36:08.561188337 -0600 CST container create 58e7e002344c (image=registry.k8s.io/pause:3.1, name=3e701f270d54-infra) +2019-03-02 10:36:13.146899437 -0600 CST volume create cad6dc50e087 (image=, name=cad6dc50e0879568e7d656bd004bd343d6035e7fc4024e1711506fe2fd459e6f) +2019-03-02 10:36:29.978806894 -0600 CST container create d81e30f1310f (image=docker.io/library/busybox:latest, name=musing_newton) +``` + +Show only Podman pod create events: +``` +$ podman events --filter event=create --filter type=pod +2019-03-02 10:44:29.601746633 -0600 CST pod create 1df5ebca7b44 (image=, name=confident_hawking) +2019-03-02 10:44:42.374637304 -0600 CST pod create ca731231718e (image=, name=webapp) +2019-03-02 10:44:47.486759133 -0600 CST pod create 71e807fc3a8e (image=, name=reverent_swanson) +``` + +Show only Podman events created in the last five minutes: +``` +$ sudo podman events --since 5m +2019-03-02 10:44:29.598835409 -0600 CST container create b629d10d3831 (image=registry.k8s.io/pause:3.1, name=1df5ebca7b44-infra) +2019-03-02 10:44:29.601746633 -0600 CST pod create 1df5ebca7b44 (image=, name=confident_hawking) +2019-03-02 10:44:42.371100253 -0600 CST container create 170a0f457d00 (image=registry.k8s.io/pause:3.1, name=ca731231718e-infra) +2019-03-02 10:44:42.374637304 -0600 CST pod create ca731231718e (image=, name=webapp) +``` + +Show Podman events in JSON Lines format: +``` +$ podman events --format json +{"ID":"683b0909d556a9c02fa8cd2b61c3531a965db42158627622d1a67b391964d519","Image":"localhost/myshdemo:latest","Name":"agitated_diffie","Status":"cleanup","Time":"2019-04-27T22:47:00.849932843-04:00","Type":"container"} +{"ID":"a0f8ab051bfd43f9c5141a8a2502139707e4b38d98ac0872e57c5315381e88ad","Image":"docker.io/library/alpine:latest","Name":"friendly_tereshkova","Status":"unmount","Time":"2019-04-28T13:43:38.063017276-04:00","Type":"container"} +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +## HISTORY +March 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-exec.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-exec.1.md new file mode 100644 index 000000000..289d61cc3 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-exec.1.md @@ -0,0 +1,212 @@ +--- +title: podman-exec +version: v5.5.2 +--- + +% podman-exec 1 + +## NAME +podman\-exec - Execute a command in a running container + +## SYNOPSIS +**podman exec** [*options*] *container* *command* [*arg* ...] + +**podman container exec** [*options*] *container* *command* [*arg* ...] + +## DESCRIPTION +**podman exec** executes a command in a running container. + +## OPTIONS + +#### **--cidfile**=*file* + +Read the ID of the target container from the specified *file*. + +#### **--detach**, **-d** + +Start the exec session, but do not attach to it. The command runs in the background, and the exec session is automatically removed when it completes. The **podman exec** command prints the ID of the exec session and exits immediately after it starts. + + +[//]: # (BEGIN included file options/detach-keys.md) +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. + +[//]: # (END included file options/detach-keys.md) + + +[//]: # (BEGIN included file options/env.md) +#### **--env**, **-e**=*env* + +Set environment variables. + +This option allows arbitrary environment variables that are available for the process to be launched inside of the container. If an environment variable is specified without a value, Podman checks the host environment for a value and set the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the container. + +[//]: # (END included file options/env.md) + + +[//]: # (BEGIN included file options/env-file.md) +#### **--env-file**=*file* + +Read in a line-delimited file of environment variables. + +[//]: # (END included file options/env-file.md) + + +[//]: # (BEGIN included file options/interactive.md) +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. + +[//]: # (END included file options/interactive.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/preserve-fd.md) +#### **--preserve-fd**=*FD1[,FD2,...]* + +Pass down to the process the additional file descriptors specified in the comma separated list. It can be specified multiple times. +This option is only supported with the crun OCI runtime. It might be a security risk to use this option with other OCI runtimes. + +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/preserve-fd.md) + + +[//]: # (BEGIN included file options/preserve-fds.md) +#### **--preserve-fds**=*N* + +Pass down to the process N additional file descriptors (in addition to 0, 1, 2). +The total FDs are 3+N. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/preserve-fds.md) + + +[//]: # (BEGIN included file options/privileged.md) +#### **--privileged** + +Give extended privileges to this container. The default is **false**. + +By default, Podman containers are unprivileged (**=false**) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read-only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. +Due to the disabled security features, the privileged field should almost never +be set as containers can easily break out of confinement. + +Containers running in a user namespace (e.g., rootless containers) cannot have +more privileges than the user that launched them. + +[//]: # (END included file options/privileged.md) + + +[//]: # (BEGIN included file options/tty.md) +#### **--tty**, **-t** + +Allocate a pseudo-TTY. The default is **false**. + +When set to **true**, Podman allocates a pseudo-tty and attach to the standard +input of the container. This can be used, for example, to run a throwaway +interactive shell. + +**NOTE**: The --tty flag prevents redirection of standard output. It combines STDOUT and STDERR, it can insert control characters, and it can hang pipes. This option is only used when run interactively in a terminal. When feeding input to Podman, use -i only, not -it. + +[//]: # (END included file options/tty.md) + + +[//]: # (BEGIN included file options/user.md) +#### **--user**, **-u**=*user[:group]* + +Sets the username or UID used and, optionally, the groupname or GID for the specified command. Both *user* and *group* may be symbolic or numeric. + +Without this argument, the command runs as the user specified in the container image. Unless overridden by a `USER` command in the Containerfile or by a value passed to this option, this user generally defaults to root. + +When a user namespace is not in use, the UID and GID used within the container and on the host match. When user namespaces are in use, however, the UID and GID in the container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container by default corresponds to the UID and GID of the user invoking Podman. + +[//]: # (END included file options/user.md) + + +[//]: # (BEGIN included file options/workdir.md) +#### **--workdir**, **-w**=*dir* + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (**/**). +The image developer can set a different default with the WORKDIR instruction. The operator +can override the working directory by using the **-w** option. + +[//]: # (END included file options/workdir.md) + +## Exit Status + +The exit code from `podman exec` gives information about why the command within the container failed to run or why it exited. When `podman exec` exits with a +non-zero code, the exit codes follow the `chroot` standard, see below: + + **125** The error is with Podman itself + + $ podman exec --foo ctrID /bin/sh; echo $? + Error: unknown flag: --foo + 125 + + **126** The _contained command_ cannot be invoked + + $ podman exec ctrID /etc; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error + 126 + + **127** The _contained command_ cannot be found + + $ podman exec ctrID foo; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error + 127 + + **Exit code** The _contained command_ exit code + + $ podman exec ctrID /bin/sh -c 'exit 3'; echo $? + 3 + +## EXAMPLES + +Execute command in selected container with a stdin and a tty allocated: +``` +$ podman exec -it ctrID ls +``` + +Execute command with the overridden working directory in selected container with a stdin and a tty allocated: +``` +$ podman exec -it -w /tmp myCtr pwd +``` + +Execute command as the specified user in selected container: +``` +$ podman exec --user root ctrID ls +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)** + +## HISTORY +December 2017, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-export.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-export.1.md new file mode 100644 index 000000000..0652ac01c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-export.1.md @@ -0,0 +1,56 @@ +--- +title: podman-export +version: v5.5.2 +--- + +% podman-export 1 + +## NAME +podman\-export - Export a container's filesystem contents as a tar archive + +## SYNOPSIS +**podman export** [*options*] *container* + +**podman container export** [*options*] *container* + +## DESCRIPTION +**podman export** exports the filesystem of a container and saves it as a tarball +on the local machine. **podman export** writes to STDOUT by default and can be +redirected to a file using the `--output` flag. +The image of the container exported by **podman export** can be imported by **podman import**. +To export image(s) with parent layers, use **podman save**. +Note: `:` is a restricted character and cannot be part of the file name. + +**podman [GLOBAL OPTIONS]** + +**podman export [GLOBAL OPTIONS]** + +**podman export [OPTIONS] CONTAINER** + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--output**, **-o** + +Write to a file, default is STDOUT + +## EXAMPLES + +Export container into specified tar ball: +``` +$ podman export -o redis-container.tar 883504668ec465463bc0fe7e63d53154ac3b696ea8d7b233748918664ea90e57 +``` + +Export container to stdout: +``` +$ podman export 883504668ec465463bc0fe7e63d53154ac3b696ea8d7b233748918664ea90e57 > redis-container.tar +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-import(1)](podman-import.1.md)** + +## HISTORY +August 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-farm-build.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-farm-build.1.md new file mode 100644 index 000000000..654bdbe29 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-farm-build.1.md @@ -0,0 +1,1572 @@ +--- +title: podman-farm-build +version: v5.5.2 +--- + +% podman-farm-build 1 + +## NAME +podman\-farm\-build - Build images on farm nodes, then bundle them into a manifest list + +## SYNOPSIS +**podman farm build** [*options*] [*context*] + +## DESCRIPTION +**podman farm build** Builds an image on all nodes in a farm and bundles them up into a manifest list. +It executes the `podman build` command on the nodes in the farm with the given Containerfile. Once the +images are built on all the farm nodes, the images will be pushed to the registry given via the **--tag** +flag. Once all the images have been pushed, a manifest list will be created locally and pushed to the registry +as well. + +The manifest list will contain an image per native architecture type that is present in the farm. + +The primary function of this command is to create multi-architecture builds that will be faster than doing it +via emulation using `podman build --arch --platform`. + +If no farm is specified, the build will be sent out to all the nodes that `podman system connection` knows of. + +Note: Since the images built are directly pushed to a registry, the user must pass in a full image name using the +**--tag** option in the format _registry_**/**_repository_**/**_imageName_[**:**_tag_]`. + +## OPTIONS + + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the container's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + + +[//]: # (BEGIN included file options/annotation.image.md) +#### **--annotation**=*annotation=value* + +Add an image *annotation* (e.g. annotation=*value*) to the image metadata. Can +be used multiple times. + +Note: this information is not present in Docker image formats, so it is +discarded when writing images in Docker formats. + +[//]: # (END included file options/annotation.image.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/build-arg.md) +#### **--build-arg**=*arg=value* + +Specifies a build argument and its value, which is interpolated in +instructions read from the Containerfiles in the same way that environment variables are, but which are not added to environment variable list in the resulting image's configuration. + +[//]: # (END included file options/build-arg.md) + + +[//]: # (BEGIN included file options/build-arg-file.md) +#### **--build-arg-file**=*path* + +Specifies a file containing lines of build arguments of the form `arg=value`. +The suggested file name is `argfile.conf`. + +Comment lines beginning with `#` are ignored, along with blank lines. +All others must be of the `arg=value` format passed to `--build-arg`. + +If several arguments are provided via the `--build-arg-file` +and `--build-arg` options, the build arguments are merged across all +of the provided files and command line arguments. + +Any file provided in a `--build-arg-file` option is read before +the arguments supplied via the `--build-arg` option. + +When a given argument name is specified several times, the last instance +is the one that is passed to the resulting builds. This means `--build-arg` +values always override those in a `--build-arg-file`. + +[//]: # (END included file options/build-arg-file.md) + + +[//]: # (BEGIN included file options/build-context.md) +#### **--build-context**=*name=value* + +Specify an additional build context using its short name and its location. +Additional build contexts can be referenced in the same manner as we access +different stages in COPY instruction. + +Valid values are: + +* Local directory – e.g. --build-context project2=../path/to/project2/src (This option is not available with the remote Podman client. On Podman machine setup (i.e macOS and Windows) path must exists on the machine VM) +* HTTP URL to a tarball – e.g. --build-context src=https://example.org/releases/src.tar +* Container image – specified with a container-image:// prefix, e.g. --build-context alpine=container-image://alpine:3.15, (also accepts docker://, docker-image://) + +On the Containerfile side, reference the build context on all +commands that accept the “from” parameter. Here’s how that might look: + +```dockerfile +FROM [name] +COPY --from=[name] ... +RUN --mount=from=[name] … +``` + +The value of [name] is matched with the following priority order: + +* Named build context defined with --build-context [name]=.. +* Stage defined with AS [name] inside Containerfile +* Image [name], either local or in a remote registry + +[//]: # (END included file options/build-context.md) + + +[//]: # (BEGIN included file options/cache-from.md) +#### **--cache-from**=*image* + +Repository to utilize as a potential cache source. When specified, Buildah tries to look for +cache images in the specified repository and attempts to pull cache images instead of actually +executing the build steps locally. Buildah only attempts to pull previously cached images if they +are considered as valid cache hits. + +Use the `--cache-to` option to populate a remote repository with cache content. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-from` option is ignored unless `--layers` is specified. + +[//]: # (END included file options/cache-from.md) + + +[//]: # (BEGIN included file options/cache-to.md) +#### **--cache-to**=*image* + +Set this flag to specify a remote repository that is used to store cache images. Buildah attempts to +push newly built cache image to the remote repository. + +Note: Use the `--cache-from` option in order to use cache content in a remote repository. + +Example + +```bash +# populate a cache and also consult it +buildah build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . +``` + +Note: `--cache-to` option is ignored unless `--layers` is specified. + +[//]: # (END included file options/cache-to.md) + + +[//]: # (BEGIN included file options/cache-ttl.md) +#### **--cache-ttl** + +Limit the use of cached images to only consider images with created timestamps less than *duration* ago. +For example if `--cache-ttl=1h` is specified, Buildah considers intermediate cache images which are created +under the duration of one hour, and intermediate cache images outside this duration is ignored. + +Note: Setting `--cache-ttl=0` manually is equivalent to using `--no-cache` in the +implementation since this means that the user does not want to use cache at all. + +[//]: # (END included file options/cache-ttl.md) + + +[//]: # (BEGIN included file options/cap-add.image.md) +#### **--cap-add**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability added to its capability set. +Certain capabilities are granted by default; this option can be used to add +more. + +[//]: # (END included file options/cap-add.image.md) + + +[//]: # (BEGIN included file options/cap-drop.image.md) +#### **--cap-drop**=*CAP\_xxx* + +When executing RUN instructions, run the command specified in the instruction +with the specified capability removed from its capability set. +The CAP\_CHOWN, CAP\_DAC\_OVERRIDE, CAP\_FOWNER, +CAP\_FSETID, CAP\_KILL, CAP\_NET\_BIND\_SERVICE, CAP\_SETFCAP, +CAP\_SETGID, CAP\_SETPCAP, and CAP\_SETUID capabilities are +granted by default; this option can be used to remove them. + +If a capability is specified to both the **--cap-add** and **--cap-drop** +options, it is dropped, regardless of the order in which the options were +given. + +[//]: # (END included file options/cap-drop.image.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the container is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cgroupns.image.md) +#### **--cgroupns**=*how* + +Sets the configuration for cgroup namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "private" to indicate +that a new cgroup namespace is created, or it can be "host" to indicate +that the cgroup namespace in which `buildah` itself is being run is reused. + +[//]: # (END included file options/cgroupns.image.md) + +#### **--cleanup** + +Remove built images from farm nodes on success (Default: false). + + +[//]: # (BEGIN included file options/compat-volumes.md) +#### **--compat-volumes** + +Handle directories marked using the VOLUME instruction (both in this build, and +those inherited from base images) such that their contents can only be modified +by ADD and COPY instructions. Any changes made in those locations by RUN +instructions will be reverted. Before the introduction of this option, this +behavior was the default, but it is now disabled by default. + +[//]: # (END included file options/compat-volumes.md) + + +[//]: # (BEGIN included file options/cpp-flag.md) +#### **--cpp-flag**=*flags* + +Set additional flags to pass to the C Preprocessor cpp(1). Containerfiles ending with a ".in" suffix is preprocessed via cpp(1). This option can be used to pass additional flags to cpp.Note: You can also set default CPPFLAGS by setting the BUILDAH_CPPFLAGS environment variable (e.g., export BUILDAH_CPPFLAGS="-DDEBUG"). + +[//]: # (END included file options/cpp-flag.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the container. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The container only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: if the user only has access rights via a group, accessing the device +from inside a rootless container fails. The **[crun(1)](https://github.com/containers/crun/tree/main/crun.1.md)** runtime offers a +workaround for this by adding the option +**--annotation run.oci.keep_original_groups=1**. + + +[//]: # (BEGIN included file options/disable-compression.md) +#### **--disable-compression**, **-D** + +Don't compress filesystem layers when building the image unless it is required +by the location where the image is being written. This is the default setting, +because image layers are compressed automatically when they are pushed to +registries, and images being written to local storage only need to be +decompressed again to be stored. Compression can be forced in all cases by +specifying **--disable-compression=false**. + +[//]: # (END included file options/disable-compression.md) + + +[//]: # (BEGIN included file options/dns.md) +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. + +[//]: # (END included file options/dns.md) + +This option cannot be combined with **--network** that is set to **none**. + +Note: this option takes effect only during *RUN* instructions in the build. +It does not affect _/etc/resolv.conf_ in the final image. + + +[//]: # (BEGIN included file options/dns-option.image.md) +#### **--dns-option**=*option* + +Set custom DNS options to be used during the build. + +[//]: # (END included file options/dns-option.image.md) + + +[//]: # (BEGIN included file options/dns-search.image.md) +#### **--dns-search**=*domain* + +Set custom DNS search domains to be used during the build. + +[//]: # (END included file options/dns-search.image.md) + + +[//]: # (BEGIN included file options/env.image.md) +#### **--env**=*env[=value]* + +Add a value (e.g. env=*value*) to the built image. Can be used multiple times. +If neither `=` nor a *value* are specified, but *env* is set in the current +environment, the value from the current environment is added to the image. +To remove an environment variable from the built image, use the `--unsetenv` +option. + +[//]: # (END included file options/env.image.md) + + +[//]: # (BEGIN included file options/farm.md) +#### **--farm** + +This option specifies the name of the farm to be used in the build process. + +[//]: # (END included file options/farm.md) + +This option specifies the name of the farm to be used in the build process. + + +[//]: # (BEGIN included file options/file.md) +#### **--file**, **-f**=*Containerfile* + +Specifies a Containerfile which contains instructions for building the image, +either a local file or an **http** or **https** URL. If more than one +Containerfile is specified, *FROM* instructions are only be accepted from the +last specified file. + +If a build context is not specified, and at least one Containerfile is a +local file, the directory in which it resides is used as the build +context. + +Specifying the option `-f -` causes the Containerfile contents to be read from stdin. + +[//]: # (END included file options/file.md) + + +[//]: # (BEGIN included file options/force-rm.md) +#### **--force-rm** + +Always remove intermediate containers after a build, even if the build fails (default true). + +[//]: # (END included file options/force-rm.md) + + +[//]: # (BEGIN included file options/format.md) +#### **--format** + +Control the format for the built image's manifest and configuration data. +Recognized formats include *oci* (OCI image-spec v1.0, the default) and +*docker* (version 2, using schema format 2 for the manifest). + +Note: You can also override the default format by setting the BUILDAH\_FORMAT +environment variable. `export BUILDAH_FORMAT=docker` + +[//]: # (END included file options/format.md) + + +[//]: # (BEGIN included file options/from.md) +#### **--from** + +Overrides the first `FROM` instruction within the Containerfile. If there are multiple +FROM instructions in a Containerfile, only the first is changed. + +With the remote podman client, not all container transports work as +expected. For example, oci-archive:/x.tar references /x.tar on the remote +machine instead of on the client. When using podman remote clients it is +best to restrict use to *containers-storage*, and *docker:// transports*. + +[//]: # (END included file options/from.md) + + +[//]: # (BEGIN included file options/group-add.md) +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/group-add.md) + + +[//]: # (BEGIN included file options/help.md) +#### **--help**, **-h** + +Print usage statement + +[//]: # (END included file options/help.md) + + +[//]: # (BEGIN included file options/hooks-dir.md) +#### **--hooks-dir**=*path* + +Each *.json file in the path configures a hook for buildah build containers. For more details on the syntax of the JSON files and the semantics of hook injection. Buildah currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. + +This option may be set multiple times; paths from later options have higher precedence. + +For the annotation conditions, buildah uses any annotations set in the generated OCI configuration. + +For the bind-mount conditions, only mounts explicitly requested by the caller via --volume are considered. Bind mounts that buildah inserts by default (e.g. /dev/shm) are not considered. + +If --hooks-dir is unset for root callers, Buildah currently defaults to /usr/share/containers/oci/hooks.d and /etc/containers/oci/hooks.d in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting --hooks-dir. + +[//]: # (END included file options/hooks-dir.md) + + +[//]: # (BEGIN included file options/http-proxy.md) +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. + +[//]: # (END included file options/http-proxy.md) + + +[//]: # (BEGIN included file options/identity-label.md) +#### **--identity-label** + +Adds default identity label `io.buildah.version` if set. (default true). + +[//]: # (END included file options/identity-label.md) + + +[//]: # (BEGIN included file options/ignorefile.md) +#### **--ignorefile** + +Path to an alternative .containerignore file. + +[//]: # (END included file options/ignorefile.md) + + +[//]: # (BEGIN included file options/iidfile.md) +#### **--iidfile**=*ImageIDfile* + +Write the built image's ID to the file. When `--platform` is specified more than once, attempting to use this option triggers an error. + +[//]: # (END included file options/iidfile.md) + + +[//]: # (BEGIN included file options/inherit-labels.md) +#### **--inherit-labels** + +Inherit the labels from the base image or base stages. (default true). + +[//]: # (END included file options/inherit-labels.md) + + +[//]: # (BEGIN included file options/ipc.image.md) +#### **--ipc**=*how* + +Sets the configuration for IPC namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate +that a new IPC namespace is created, or it can be "host" to indicate +that the IPC namespace in which `podman` itself is being run is reused, +or it can be the path to an IPC namespace which is already in use by +another process. + +[//]: # (END included file options/ipc.image.md) + + +[//]: # (BEGIN included file options/isolation.md) +#### **--isolation**=*type* + +Controls what type of isolation is used for running processes as part of `RUN` +instructions. Recognized types include *oci* (OCI-compatible runtime, the +default), *rootless* (OCI-compatible runtime invoked using a modified +configuration and its --rootless option enabled, with *--no-new-keyring +--no-pivot* added to its *create* invocation, with network and UTS namespaces +disabled, and IPC, PID, and user namespaces enabled; the default for +unprivileged users), and *chroot* (an internal wrapper that leans more toward +chroot(1) than container technology). + +Note: You can also override the default isolation type by setting the +BUILDAH\_ISOLATION environment variable. `export BUILDAH_ISOLATION=oci` + +[//]: # (END included file options/isolation.md) + + +[//]: # (BEGIN included file options/jobs.md) +#### **--jobs**=*number* + +Run up to N concurrent stages in parallel. If the number of jobs is greater +than 1, stdin is read from /dev/null. If 0 is specified, then there is +no limit in the number of jobs that run in parallel. + +[//]: # (END included file options/jobs.md) + + +[//]: # (BEGIN included file options/label.image.md) +#### **--label**=*label* + +Add an image *label* (e.g. label=*value*) to the image metadata. Can be used +multiple times. + +Users can set a special LABEL **io.containers.capabilities=CAP1,CAP2,CAP3** in +a Containerfile that specifies the list of Linux capabilities required for the +container to run properly. This label specified in a container image tells +Podman to run the container with just these capabilities. Podman launches the +container with just the specified capabilities, as long as this list of +capabilities is a subset of the default list. + +If the specified capabilities are not in the default set, Podman prints an error +message and runs the container with the default capabilities. + +[//]: # (END included file options/label.image.md) + + +[//]: # (BEGIN included file options/layer-label.md) +#### **--layer-label**=*label[=value]* + +Add an intermediate image *label* (e.g. label=*value*) to the intermediate +image metadata. It can be used multiple times. + +If *label* is named, but neither `=` nor a `value` is provided, then +the *label* is set to an empty value. + +[//]: # (END included file options/layer-label.md) + + +[//]: # (BEGIN included file options/layers.md) +#### **--layers** + +Cache intermediate images during the build process (Default is `true`). + +Note: You can also override the default value of layers by setting the +BUILDAH\_LAYERS environment variable. `export BUILDAH_LAYERS=true` + +[//]: # (END included file options/layers.md) + +#### **--local**, **-l** + +Build image on local machine as well as on farm nodes. + + +[//]: # (BEGIN included file options/logfile.md) +#### **--logfile**=*filename* + +Log output which is sent to standard output and standard error to the +specified file instead of to standard output and standard error. +This option is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. + +[//]: # (END included file options/logfile.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/network.image.md) +#### **--network**=*mode*, **--net** + +Sets the configuration for network namespaces when handling `RUN` instructions. + +Valid _mode_ values are: + +- **none**: no networking. +- **host**: use the Podman host network stack. Note: the host mode gives the +container full access to local system services such as D-bus and is therefore +considered insecure. +- **ns:**_path_: path to a network namespace to join. +- **private**: create a new namespace for the container (default) +- **\**: Join the network with the given name or ID, e.g. use `--network mynet` to join the network with the name mynet. Only supported for rootful users. +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=MTU**: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=CIDR**: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=INTERFACE**: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=IPv4**: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=INTERFACE**: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=IPv6**: Specify the outbound ipv6 address slirp binds to. +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. If port forwarding isn't configured, ports + are forwarded dynamically as services are bound on either side (init + namespace or container namespace). Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + Also, **-t none** and **-u none** are passed to disable + automatic port forwarding based on bound ports. Similarly, **-T none** and + **-U none** are given to disable the same functionality from container to + host. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.image.md) + + +[//]: # (BEGIN included file options/no-cache.md) +#### **--no-cache** + +Do not use existing cached images for the container build. Build from the start with a new set of cached layers. + +[//]: # (END included file options/no-cache.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the container. + +Podman assumes control over the container's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/omit-history.md) +#### **--omit-history** + +Omit build history information in the built image. (default false). + +This option is useful for the cases where end users explicitly +want to set `--omit-history` to omit the optional `History` from +built images or when working with images built using build tools that +do not include `History` information in their images. + +[//]: # (END included file options/omit-history.md) + + +[//]: # (BEGIN included file options/os-feature.md) +#### **--os-feature**=*feature* + +Set the name of a required operating system *feature* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS feature list is kept, if the base image specified any. This option is typically only meaningful when the image's OS is Windows. + +If *feature* has a trailing `-`, then the *feature* is removed from the set of required features which is listed in the image. + +[//]: # (END included file options/os-feature.md) + + +[//]: # (BEGIN included file options/os-version.image.md) +#### **--os-version**=*version* + +Set the exact required operating system *version* for the image which is built. By default, if the image is not based on *scratch*, the base image's required OS version is kept, if the base image specified one. This option is typically only meaningful when the image's OS is Windows, and is typically set in Windows base images, so using this option is usually unnecessary. + +[//]: # (END included file options/os-version.image.md) + + +[//]: # (BEGIN included file options/pid.image.md) +#### **--pid**=*pid* + +Sets the configuration for PID namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new PID namespace is created, or it can be "host" to indicate that the PID namespace in which `podman` itself is being run is reused, or it can be the path to a PID namespace which is already in use by another +process. + +[//]: # (END included file options/pid.image.md) + +#### **--platforms**=*p1,p2,p3...* + +Build only on farm nodes that match the given platforms. + + +[//]: # (BEGIN included file options/pull.image.md) +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Only pull the image when it does not exist in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error when no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. + +[//]: # (END included file options/pull.image.md) + + +[//]: # (BEGIN included file options/quiet.md) +#### **--quiet**, **-q** + +Suppress output messages which indicate which instruction is being processed, and of progress when pulling images from a registry, and when writing the output image. + +[//]: # (END included file options/quiet.md) + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + + +[//]: # (BEGIN included file options/rm.md) +#### **--rm** + +Remove intermediate containers after a successful build (default true). + +[//]: # (END included file options/rm.md) + + +[//]: # (BEGIN included file options/runtime.md) +#### **--runtime**=*path* + +The *path* to an alternate OCI-compatible runtime, which is used to run +commands specified by the **RUN** instruction. + +Note: You can also override the default runtime by setting the BUILDAH\_RUNTIME environment variable. `export BUILDAH_RUNTIME=/usr/local/bin/runc` + +[//]: # (END included file options/runtime.md) + + +[//]: # (BEGIN included file options/runtime-flag.md) +#### **--runtime-flag**=*flag* + +Adds global flags for the container runtime. To list the supported flags, please consult the manpages of the selected container runtime. + +Note: Do not pass the leading -- to the flag. To pass the runc flag --log-format json to buildah build, the option given is --runtime-flag log-format=json. + +[//]: # (END included file options/runtime-flag.md) + + +[//]: # (BEGIN included file options/sbom.md) +#### **--sbom**=*preset* + +Generate SBOMs (Software Bills Of Materials) for the output image by scanning +the working container and build contexts using the named combination of scanner +image, scanner commands, and merge strategy. Must be specified with one or +more of **--sbom-image-output**, **--sbom-image-purl-output**, **--sbom-output**, +and **--sbom-purl-output**. Recognized presets, and the set of options which +they equate to: + + - "syft", "syft-cyclonedx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output cyclonedx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output cyclonedx-json={OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "syft-spdx": + --sbom-scanner-image=ghcr.io/anchore/syft + --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output spdx-json={OUTPUT}" + --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output spdx-json={OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + - "trivy", "trivy-cyclonedx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}" + --sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version + - "trivy-spdx": + --sbom-scanner-image=ghcr.io/aquasecurity/trivy + --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}" + --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}" + --sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo + +[//]: # (END included file options/sbom.md) + + +[//]: # (BEGIN included file options/sbom-image-output.md) +#### **--sbom-image-output**=*path* + +When generating SBOMs, store the generated SBOM in the specified path in the +output image. There is no default. + +[//]: # (END included file options/sbom-image-output.md) + + +[//]: # (BEGIN included file options/sbom-image-purl-output.md) +#### **--sbom-image-purl-output**=*path* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the specified path in the output +image. There is no default. + +[//]: # (END included file options/sbom-image-purl-output.md) + + +[//]: # (BEGIN included file options/sbom-merge-strategy.md) +#### **--sbom-merge-strategy**=*method* + +If more than one **--sbom-scanner-command** value is being used, use the +specified method to merge the output from later commands with output from +earlier commands. Recognized values include: + + - cat + Concatenate the files. + - merge-cyclonedx-by-component-name-and-version + Merge the "component" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "version" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + - merge-spdx-by-package-name-and-versioninfo + Merge the "package" fields of JSON documents, ignoring values from + documents when the combination of their "name" and "versionInfo" values is + already present. Documents are processed in the order in which they are + generated, which is the order in which the commands that generate them + were specified. + +[//]: # (END included file options/sbom-merge-strategy.md) + + +[//]: # (BEGIN included file options/sbom-output.md) +#### **--sbom-output**=*file* + +When generating SBOMs, store the generated SBOM in the named file on the local +filesystem. There is no default. + +[//]: # (END included file options/sbom-output.md) + + +[//]: # (BEGIN included file options/sbom-purl-output.md) +#### **--sbom-purl-output**=*file* + +When generating SBOMs, scan them for PURL ([package +URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) +information, and save a list of found PURLs to the named file in the local +filesystem. There is no default. + +[//]: # (END included file options/sbom-purl-output.md) + + +[//]: # (BEGIN included file options/sbom-scanner-command.md) +#### **--sbom-scanner-command**=*image* + +Generate SBOMs by running the specified command from the scanner image. If +multiple commands are specified, they are run in the order in which they are +specified. These text substitutions are performed: + - {ROOTFS} + The root of the built image's filesystem, bind mounted. + - {CONTEXT} + The build context and additional build contexts, bind mounted. + - {OUTPUT} + The name of a temporary output file, to be read and merged with others or copied elsewhere. + +[//]: # (END included file options/sbom-scanner-command.md) + + +[//]: # (BEGIN included file options/sbom-scanner-image.md) +#### **--sbom-scanner-image**=*image* + +Generate SBOMs using the specified scanner image. + +[//]: # (END included file options/sbom-scanner-image.md) + + +[//]: # (BEGIN included file options/secret.image.md) +#### **--secret**=**id=id[,src=*envOrFile*][,env=*ENV*][,type=*file* | *env*]** + +Pass secret information to be used in the Containerfile for building images +in a safe way that will not end up stored in the final image, or be seen in other stages. +The value of the secret will be read from an environment variable or file named +by the "id" option, or named by the "src" option if it is specified, or from an +environment variable specified by the "env" option. See [EXAMPLES](#examples). +The secret will be mounted in the container at `/run/secrets/id` by default. + +To later use the secret, use the --mount flag in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret` + +The location of the secret in the container can be overridden using the +"target", "dst", or "destination" option of the `RUN --mount` flag. + +`RUN --mount=type=secret,id=mysecret,target=/run/secrets/myothersecret cat /run/secrets/myothersecret` + +Note: changing the contents of secret files will not trigger a rebuild of layers that use said secrets. + +[//]: # (END included file options/secret.image.md) + + +[//]: # (BEGIN included file options/security-opt.image.md) +#### **--security-opt**=*option* + +Security Options + +- `apparmor=unconfined` : Turn off apparmor confinement for the container +- `apparmor=alternate-profile` : Set the apparmor confinement profile for the +container + +- `label=user:USER` : Set the label user for the container processes +- `label=role:ROLE` : Set the label role for the container processes +- `label=type:TYPE` : Set the label process type for the container processes +- `label=level:LEVEL` : Set the label level for the container processes +- `label=filetype\:TYPE` : Set the label file type for the container files +- `label=disable` : Turn off label separation for the container +- `no-new-privileges` : Disable container processes from gaining additional privileges + +- `seccomp=unconfined` : Turn off seccomp confinement for the container +- `seccomp=profile.json` : JSON file to be used as the seccomp filter for the container. + +[//]: # (END included file options/security-opt.image.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the container. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/skip-unused-stages.md) +#### **--skip-unused-stages** + +Skip stages in multi-stage builds which don't affect the target stage. (Default: **true**). + +[//]: # (END included file options/skip-unused-stages.md) + + +[//]: # (BEGIN included file options/squash.md) +#### **--squash** + +Squash all of the image's new layers into a single new layer; any preexisting layers are not squashed. + +[//]: # (END included file options/squash.md) + + +[//]: # (BEGIN included file options/squash-all.md) +#### **--squash-all** + +Squash all of the new image's layers (including those inherited from a base image) into a single new layer. + +[//]: # (END included file options/squash-all.md) + + +[//]: # (BEGIN included file options/ssh.md) +#### **--ssh**=*default* | *id[=socket>* + +SSH agent socket or keys to expose to the build. +The socket path can be left empty to use the value of `default=$SSH_AUTH_SOCK` + +To later use the ssh agent, use the --mount option in a `RUN` instruction within a `Containerfile`: + +`RUN --mount=type=ssh,id=id mycmd` + +[//]: # (END included file options/ssh.md) + + +[//]: # (BEGIN included file options/tag.md) +#### **--tag**, **-t**=*imageName* + +Specifies the name which is assigned to the resulting image if the build process completes successfully. +If _imageName_ does not include a registry name, the registry name *localhost* is prepended to the image name. + +[//]: # (END included file options/tag.md) + + +[//]: # (BEGIN included file options/target.md) +#### **--target**=*stageName* + +Set the target build stage to build. When building a Containerfile with multiple build stages, --target can be used to specify an intermediate build stage by name as the final stage for the resulting image. Commands after the target stage is skipped. + +[//]: # (END included file options/target.md) + + +[//]: # (BEGIN included file options/timestamp.md) +#### **--timestamp**=*seconds* + +Set the create timestamp to seconds since epoch to allow for deterministic builds (defaults to current time). By default, the created timestamp is changed and written into the image manifest with every commit, causing the image's sha256 hash to be different even if the sources are exactly the same otherwise. +When --timestamp is set, the created timestamp is always set to the time specified and therefore not changed, allowing the image's sha256 hash to remain the same. All files committed to the layers of the image is created with the timestamp. + +If the only instruction in a Containerfile is `FROM`, this flag has no effect. + +[//]: # (END included file options/timestamp.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/ulimit.image.md) +#### **--ulimit**=*type=soft-limit[\:hard-limit]* + +Specifies resource limits to apply to processes launched when processing `RUN` instructions. This option can be specified multiple times. Recognized resource types include: + "core": maximum core dump size (ulimit -c) + "cpu": maximum CPU time (ulimit -t) + "data": maximum size of a process's data segment (ulimit -d) + "fsize": maximum size of new files (ulimit -f) + "locks": maximum number of file locks (ulimit -x) + "memlock": maximum amount of locked memory (ulimit -l) + "msgqueue": maximum amount of data in message queues (ulimit -q) + "nice": niceness adjustment (nice -n, ulimit -e) + "nofile": maximum number of open files (ulimit -n) + "nproc": maximum number of processes (ulimit -u) + "rss": maximum size of a process's (ulimit -m) + "rtprio": maximum real-time scheduling priority (ulimit -r) + "rttime": maximum amount of real-time execution between blocking syscalls + "sigpending": maximum number of pending signals (ulimit -i) + "stack": maximum stack size (ulimit -s) + +[//]: # (END included file options/ulimit.image.md) + + +[//]: # (BEGIN included file options/unsetenv.image.md) +#### **--unsetenv**=*env* + +Unset environment variables from the final image. + +[//]: # (END included file options/unsetenv.image.md) + + +[//]: # (BEGIN included file options/unsetlabel.md) +#### **--unsetlabel**=*label* + +Unset the image label, causing the label not to be inherited from the base image. + +[//]: # (END included file options/unsetlabel.md) + + +[//]: # (BEGIN included file options/userns.image.md) +#### **--userns**=*how* + +Sets the configuration for user namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new user namespace is created, it can be "host" to indicate that the user namespace in which `podman` itself is being run is reused, or it can be the path to a user namespace which is already in use by another process. + +[//]: # (END included file options/userns.image.md) + + +[//]: # (BEGIN included file options/userns-gid-map.md) +#### **--userns-gid-map**=*mapping* + +Directly specifies a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container GID, a corresponding starting host-level GID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-gids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-gid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-gid-map are specified, but --userns-uid-map is specified, the GID map is set to use the same numeric values as the UID map. + +[//]: # (END included file options/userns-gid-map.md) + + +[//]: # (BEGIN included file options/userns-gid-map-group.md) +#### **--userns-gid-map-group**=*group* + +Specifies that a GID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subgid` file which correspond to the specified group. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-uid-map-user is specified, but --userns-gid-map-group is not specified, `podman` assumes that the specified user name is also a +suitable group name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. + +[//]: # (END included file options/userns-gid-map-group.md) + + +[//]: # (BEGIN included file options/userns-uid-map.md) +#### **--userns-uid-map**=*mapping* + +Directly specifies a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents. +Commands run when handling `RUN` instructions default to being run in +their own user namespaces, configured using the UID and GID maps. + +Entries in this map take the form of one or more triples of a starting +in-container UID, a corresponding starting host-level UID, and the number of consecutive IDs which the map entry represents. + +This option overrides the *remap-uids* setting in the *options* section of /etc/containers/storage.conf. + +If this option is not specified, but a global --userns-uid-map setting is supplied, settings from the global option is used. + +If none of --userns-uid-map-user, --userns-gid-map-group, or --userns-uid-map are specified, but --userns-gid-map is specified, the UID map is set to use the same numeric values as the GID map. + +[//]: # (END included file options/userns-uid-map.md) + + +[//]: # (BEGIN included file options/userns-uid-map-user.md) +#### **--userns-uid-map-user**=*user* + +Specifies that a UID mapping to be used to set ownership, at the +filesystem level, on the working container's contents, can be found in entries in the `/etc/subuid` file which correspond to the specified user. +Commands run when handling `RUN` instructions defaults to being run in +their own user namespaces, configured using the UID and GID maps. +If --userns-gid-map-group is specified, but --userns-uid-map-user is not specified, `podman` assumes that the specified group name is also a +suitable user name to use as the default setting for this option. + +**NOTE:** When this option is specified by a rootless user, the specified mappings are relative to the rootless user namespace in the container, rather than being relative to the host as it is when run rootful. + +[//]: # (END included file options/userns-uid-map-user.md) + + +[//]: # (BEGIN included file options/uts.md) +#### **--uts**=*how* + +Sets the configuration for UTS namespaces when handling `RUN` instructions. +The configured value can be "" (the empty string) or "container" to indicate that a new UTS namespace to be created, or it can be "host" to indicate that the UTS namespace in which `podman` itself is being run is reused, or it can be the path to a UTS namespace which is already in use by another process. + +[//]: # (END included file options/uts.md) + + +[//]: # (BEGIN included file options/volume.image.md) +#### **--volume**, **-v**=*[HOST-DIR\:CONTAINER-DIR[\:OPTIONS]]* + +Mount a host directory into containers when executing RUN instructions during +the build. + +The `OPTIONS` are a comma-separated list and can be one or more of: + + * [rw|ro] + * [z|Z|O] + * [U] + * [`[r]shared`|`[r]slave`|`[r]private`][[1]](#Footnote1) + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR` +must be an absolute path as well. Podman bind-mounts the `HOST-DIR` to the +specified path when processing RUN instructions. + +You can specify multiple **-v** options to mount one or more mounts. + +You can add the `:ro` or `:rw` suffix to a volume to mount it read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted. When running using user namespaces, the UID and GID inside +the namespace may correspond to another UID and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the namespace, to change recursively the owner and group of +the source volume. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add one of these two suffixes +`:z` or `:Z` to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The `z` option tells Podman that two containers +share the volume content. As a result, Podman labels the content with a shared +content label. Shared volume labels allow all containers to read/write content. +The `Z` option tells Podman to label the content with a private unshared label. +Only the current container can use a private volume. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the host machine to fail. For these types +of containers, disabling SELinux separation is recommended. The option +`--security-opt label=disable` disables SELinux separation for the container. +For example, if a user wanted to volume mount their entire home directory into the build containers, they need to disable SELinux separation. + + $ podman build --security-opt label=disable -v $HOME:/home/user . + +`Overlay Volume Mounts` + +The `:O` flag tells Podman to mount the directory from the host as a +temporary storage using the Overlay file system. The `RUN` command containers +are allowed to modify contents within the mountpoint and are stored in the +container storage in a separate directory. In Overlay FS terms the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the `RUN` command +finishes executing, similar to a tmpfs mount point. + +Any subsequent execution of `RUN` commands sees the original source directory +content, any changes from previous RUN commands no longer exists. + +One use case of the `overlay` mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: + +- Overlay mounts are not currently supported in rootless mode. +- The `O` flag is not allowed to be specified with the `Z` or `z` flags. + Content mounted into the container is labeled with the private label. + On SELinux systems, labels in the source directory needs to be readable + by the container label. If not, SELinux container separation must be disabled + for the container to work. +- Modification of the directory volume mounted into the container with an + overlay mount can cause unexpected failures. Do not modify the directory until + the container finishes running. + +By default bind mounted volumes are `private`. That means any mounts done +inside containers are not be visible on the host and vice versa. This behavior +can be changed by specifying a volume mount propagation property. + +When the mount propagation policy is set to `shared`, any mounts completed +inside the container on that volume is visible to both the host and +container. When the mount propagation policy is set to `slave`, one way mount +propagation is enabled and any mounts completed on the host for that volume is +visible only inside of the container. To control the mount propagation +property of volume use the `:[r]shared`, `:[r]slave` or `:[r]private` +propagation flag. For mount propagation to work on the source mount point (mount +point where source dir is mounted on) has to have the right propagation properties. +For shared volumes, the source mount point has to be shared. And for slave volumes, +the source mount has to be either shared or slave. [[1]](#Footnote1) + +Use `df ` to determine the source mount and then use +`findmnt -o TARGET,PROPAGATION ` to determine propagation +properties of source mount, if `findmnt` utility is not available, the source +mount point can be determined by looking at the mount entry in +`/proc/self/mountinfo`. Look at `optional fields` and see if any propagation +properties are specified. +`shared:X` means the mount is `shared`, `master\:X` means the mount is `slave` +and if nothing is there that means the mount is `private`. [[1]](#Footnote1) + +To change propagation properties of a mount point use the `mount` command. For +example, to bind mount the source directory `/foo` do +`mount --bind /foo /foo` and `mount --make-private --make-shared /foo`. This +converts /foo into a `shared` mount point. The propagation properties of +the source mount can be changed directly. For instance if `/` is the source +mount for `/foo`, then use `mount --make-shared /` to convert `/` into a +`shared` mount. + +[//]: # (END included file options/volume.image.md) + +## EXAMPLES + +Build named image and manifest list using specified Containerfile with default farm: +``` +$ podman farm build --local -t name -f /path/to/containerfile . +``` + +Build named image and manifest list using the specified farm: +``` +$ podman farm build --farm myfarm -t name . +``` + +Build named image and manifest list using the specified farm, removing all images from farm nodes, after they are pushed to registry: +``` +$ podman farm build --farm myfarm --cleanup -t name . +``` + +Build named images and manifest list for specified platforms using default farm: +``` +$ podman farm build --platforms arm64,amd64 -t name . +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/main/man/runc.8.md)**, **[useradd(8)](https://www.unix.com/man-page/redhat/8/useradd)**, **[Containerfile(5)](https://github.com/containers/common/blob/main/docs/Containerfile.5.md)**, **[containerignore(5)](https://github.com/containers/common/blob/main/docs/containerignore.5.md)** + +## HISTORY + +September 2023, Originally compiled by Urvashi Mohnani `` + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a +core value of open source. The `master` and `slave` mount propagation +terminology used here is problematic and divisive, and needs to be changed. +However, these terms are currently used within the Linux kernel and must be +used as-is at this time. When the kernel maintainers rectify this usage, +Podman will follow suit immediately. diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-farm-create.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-farm-create.1.md new file mode 100644 index 000000000..aceb1cc4b --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-farm-create.1.md @@ -0,0 +1,39 @@ +--- +title: podman-farm-create +version: v5.5.2 +--- + +% podman-farm-create 1 + +## NAME +podman\-farm\-create - Create a new farm + +## SYNOPSIS +**podman farm create** *name* [*connections*] + +## DESCRIPTION +Create a new farm with connections that Podman knows about which were added via the +*podman system connection add* command. + +An empty farm can be created without adding any connections to it. Add or remove +connections from a farm via the *podman farm update* command. + +## EXAMPLE + + + +Create the specified farm: +``` +$ podman farm create farm2 +``` + +Create multiple farms: +``` +$ podman farm create farm1 f37 f38 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)**, **[podman-system-connection-add(1)](podman-system-connection-add.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-farm-list.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-farm-list.1.md new file mode 100644 index 000000000..83f169a07 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-farm-list.1.md @@ -0,0 +1,47 @@ +--- +title: podman-farm-list +version: v5.5.2 +--- + +% podman-farm-list 1 + +## NAME +podman\-farm\-list - List the existing farms + +## SYNOPSIS +**podman farm list** [*options*] + +**podman farm ls** [*options*] + +## DESCRIPTION +List all the existing farms. + +## OPTIONS + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' or a Go template. +Valid placeholders for the Go template listed below: + +| **Placeholder** | **Description** | +| --------------- | --------------------------------------------------------------------- | +| .Connections | List of all system connections in the farm | +| .Default | Indicates whether farm is the default | +| .Name | Farm name | +| .ReadWrite | Indicates if this farm can be modified using the podman farm commands | + +## EXAMPLE + +List all farms: +``` +$ podman farm list +Name Connections Default ReadWrite +farm1 [f38 f37] false true +farm2 [f37] true true +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-farm-remove.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-farm-remove.1.md new file mode 100644 index 000000000..195845725 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-farm-remove.1.md @@ -0,0 +1,41 @@ +--- +title: podman-farm-remove +version: v5.5.2 +--- + +% podman-farm-remove 1 + +## NAME +podman\-farm\-remove - Delete one or more farms + +## SYNOPSIS +**podman farm remove** [*options*] *name* + +**podman farm rm** [*options*] *name* + +## DESCRIPTION +Delete one or more farms. + +## OPTIONS + +#### **--all**, **-a** + +Remove all farms. + +## EXAMPLE + +Remove specified farm: +``` +$ podman farm remove farm1 +``` + +Remove all farms: +``` +$ podman farm rm --all +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com)s diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-farm-update.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-farm-update.1.md new file mode 100644 index 000000000..26de68fff --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-farm-update.1.md @@ -0,0 +1,53 @@ +--- +title: podman-farm-update +version: v5.5.2 +--- + +% podman-farm-update 1 + +## NAME +podman\-farm\-update - Update an existing farm + +## SYNOPSIS +**podman farm update** [*options*] *name* + +## DESCRIPTION +Update a farm by either adding connections to it, removing connections from it, or setting it as the new +default farm. + +## OPTIONS + +#### **--add**, **-a** + +Add new connections to an existing farm. Multiple connections can be added at once. + +#### **--default**, **-d** + +Set the current farm as the default. + +#### **--remove**, **-r** + +Remove one or more connections from an existing farm. + +## EXAMPLE + +Add two connections to specified farm: +``` +$ podman farm update --add f35,f38 farm1 +``` + +Add connection to specified farm: +``` +$ podman farm update --remove f35 farm1 +``` + +Change specified farm to be default: +``` +$ podman farm update --default farm2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-farm(1)](podman-farm.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com)s diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-farm.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-farm.1.md new file mode 100644 index 000000000..f4bfd784d --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-farm.1.md @@ -0,0 +1,46 @@ +--- +title: podman-farm +version: v5.5.2 +--- + +% podman-farm 1 + +## NAME +podman\-farm - Farm out builds to machines running podman for different architectures + +## SYNOPSIS +**podman farm** *subcommand* + +## DESCRIPTION +Farm out builds to machines running Podman for different architectures. + +Manage farms by creating, updating, and removing them. + +Note: All farm machines must have a minimum podman version of v4.9.0. + +Podman manages the farms by writing and reading the `podman-connections.json` file located under +`$XDG_CONFIG_HOME/containers` or if the env is not set it defaults to `$HOME/.config/containers`. +Or the `PODMAN_CONNECTIONS_CONF` environment variable can be set to a full file path which podman +will use instead. +This file is managed by the podman commands and should never be edited by users directly. To manually +configure the farms use the `[farm]` section in containers.conf. + +If the ReadWrite column in the **podman farm list** output is set to true the farm is stored in the +`podman-connections.json` file otherwise it is stored in containers.conf and can therefore not be +edited with the **podman farm remove/update** commands. It can still be used with **podman farm build**. + +## COMMANDS + +| Command | Man Page | Description | +| -------- | ----------------------------------------------------| ----------------------------------------------------------------- | +| build | [podman-farm\-build(1)](podman-farm-build.1.md) | Build images on farm nodes, then bundle them into a manifest list | +| create | [podman-farm\-create(1)](podman-farm-create.1.md) | Create a new farm | +| list | [podman-farm\-list(1)](podman-farm-list.1.md) | List the existing farms | +| remove | [podman-farm\-remove(1)](podman-farm-remove.1.md) | Delete one or more farms | +| update | [podman-farm\-update(1)](podman-farm-update.1.md) | Update an existing farm | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-generate-spec.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-generate-spec.1.md new file mode 100644 index 000000000..9aea251f2 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-generate-spec.1.md @@ -0,0 +1,31 @@ +--- +title: podman-generate-spec +version: v5.5.2 +--- + +% podman-generate-spec 1 + +## NAME +podman\-generate\-spec - Generate Specgen JSON based on containers or pods + +## SYNOPSIS +**podman generate spec** [*options*] *container | *pod* + +## DESCRIPTION +**podman generate spec** generates SpecGen JSON from Podman Containers and Pods. This JSON can be printed to a file, directly to the command line, or both. + +This JSON can then be used as input for the Podman API, specifically for Podman container and pod creation. Specgen is Podman's internal structure for formulating new container-related entities. + +## OPTIONS + +#### **--compact**, **-c** + +Print the output in a compact, one line format. This is useful when piping the data to the Podman API + +#### **--filename**, **-f**=**filename** + +Output to the given file. + +#### **--name**, **-n** + +Rename the pod or container, so that it does not conflict with the existing entity. This is helpful when the JSON is to be used before the source pod or container is deleted. diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-generate-systemd.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-generate-systemd.1.md new file mode 100644 index 000000000..4db890069 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-generate-systemd.1.md @@ -0,0 +1,326 @@ +--- +title: podman-generate-systemd +version: v5.5.2 +--- + +% podman-generate-systemd 1 + +## NAME +podman\-generate\-systemd - [DEPRECATED] Generate systemd unit file(s) for a container or pod + +## SYNOPSIS +**podman generate systemd** [*options*] *container|pod* + +## DESCRIPTION +DEPRECATED: +Note: **podman generate systemd** is deprecated. We recommend using [Quadlet](podman-systemd.unit.5.md) +files when running Podman containers or pods under systemd. There are no plans to remove the command. +It will receive urgent bug fixes but no new features. + +**podman generate systemd** creates a systemd unit file that can be used to control a container or pod. +By default, the command prints the content of the unit files to stdout. + +Generating unit files for a pod requires the pod to be created with an infra container (see `--infra=true`). An infra container runs across the entire lifespan of a pod and is hence required for systemd to manage the life cycle of the pod's main unit. + +- Note: When using this command with the remote client, including Mac and Windows (excluding WSL2) machines, place the generated units on the remote system. Moreover, make sure that the `XDG_RUNTIME_DIR` environment variable is set. If unset, set it via `export XDG_RUNTIME_DIR=/run/user/$(id -u)`._ + +- Note: The generated `podman run` command contains an `--sdnotify` option with the value taken from the container. +If the container does not have any explicitly set value or the value is set to __ignore__, the value __conmon__ is used. +The reason for overriding the default value __container__ is that almost no container workloads send notify messages. +Systemd waits for a ready message that never comes, if the value __container__ is used for a container +that does not send notify messages. The use of the default value might have been unintentional by the user, +therefore the overridden default value._ + +### Kubernetes Integration + +A Kubernetes YAML can be executed in systemd via the `podman-kube@.service` systemd template. The template's argument is the path to the YAML file. Given a `workload.yaml` file in the home directory, it can be executed as follows: + +``` +$ escaped=$(systemd-escape ~/workload.yaml) +$ systemctl --user start podman-kube@$escaped.service +$ systemctl --user is-active podman-kube@$escaped.service +active +``` + +## OPTIONS + +#### **--after**=*dependency_name* + +Add the systemd unit after (`After=`) option, that ordering dependencies between the list of dependencies and this service. This option may be specified more than once. + +User-defined dependencies are appended to the generated unit file, but any existing options needed or defined by default (e.g., `online.target`) are **not** removed or overridden. + +#### **--container-prefix**=*prefix* + +Set the systemd unit name prefix for containers. The default is *container*. + +#### **--env**, **-e**=*env* + +Set environment variables to the systemd unit files. + +If an environment variable is specified without a value, Podman checks the host environment for a value and sets the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the systemd unit files. + +#### **--files**, **-f** + +Generate files instead of printing to stdout. The generated files are named {container,pod}-{ID,name}.service and are placed in the current working directory. + +Note: On a system with SELinux enabled, the generated files inherits contexts from the current working directory. Depending on the SELinux setup, changes to the generated files using `restorecon`, `chcon`, or `semanage` may be required to allow systemd to access these files. Alternatively, use the `-Z` option when running `mv` or `cp`. + +#### **--format**=*format* + +Print the created units in the specified format (json). If `--files` is specified, the paths to the created files are printed instead of the unit content. + +#### **--name**, **-n** + +Use the name of the container for the start, stop, and description in the unit file + +#### **--new** + +This option yields unit files that do not expect containers and pods to exist. Instead, new containers and pods are created based on their configuration files. The unit files are created best effort and may need further editing; please review the generated files carefully before using them in production. + +Note that `--new` only works on containers and pods created directly via Podman (i.e., `podman [container] {create,run}` or `podman pod create`). It does not work on containers or pods created via the REST API or via `podman kube play`. For `podman kube play`, use the `podman-kube@.service` systemd template instead. + +#### **--no-header** + +Do not generate the header including meta data such as the Podman version and the timestamp. + +#### **--pod-prefix**=*prefix* + +Set the systemd unit name prefix for pods. The default is *pod*. + +#### **--requires**=*dependency_name* + +Set the systemd unit requires (`Requires=`) option. Similar to wants, but declares a stronger requirement dependency. + +#### **--restart-policy**=*policy* + +Set the systemd restart policy. The restart-policy must be one of: "no", "on-success", "on-failure", "on-abnormal", +"on-watchdog", "on-abort", or "always". The default policy is *on-failure* unless the container was created with a custom restart policy. + +Note that generating a unit without `--new` on a container with a custom restart policy can lead to issues on shutdown; systemd attempts to stop the unit while Podman tries to restart it. Creating the container without `--restart` and using the `--restart-policy` option when generating the unit file is recommended. + +#### **--restart-sec**=*time* + +Set the systemd service restartsec value. Configures the time to sleep before restarting a service (as configured with restart-policy). +Takes a value in seconds. + +#### **--separator**=*separator* + +Set the systemd unit name separator between the name/id of a container/pod and the prefix. The default is *-*. + +#### **--start-timeout**=*value* + +Override the default start timeout for the container with the given value in seconds. + +#### **--stop-timeout**=*value* + +Override the default stop timeout for the container with the given value in seconds. + +#### **--template** + +Add template specifiers to run multiple services from the systemd unit file. + +Note that if `--new` was not set to true, it is set to true by default. However, the command fails if `--new` is set to `false` explicitly. + +#### **--wants**=*dependency_name* + +Add the systemd unit wants (`Wants=`) option, that this service is (weak) dependent on. This option may be specified more than once. This option does not influence the order in which services are started or stopped. + +User-defined dependencies are appended to the generated unit file, but any existing options needed or defined by default (e.g., `online.target`) are **not** removed or overridden. + +## EXAMPLES + +### Generate and print a systemd unit file for a container + +Generate a systemd unit file for a container running nginx with an *always* restart policy and 1-second timeout to stdout. Note that the **RequiresMountsFor** option in the **Unit** section ensures that the container storage for both the GraphRoot and the RunRoot are mounted prior to starting the service. For systems with container storage on disks like iSCSI or other remote block protocols, this ensures that Podman is not executed prior to any necessary storage operations coming online. + +``` +$ podman create --name nginx nginx:latest +$ podman generate systemd --restart-policy=always -t 1 nginx +# container-de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6.service +# autogenerated by Podman 1.8.0 +# Wed Mar 09 09:46:45 CEST 2020 + +[Unit] +Description=Podman container-de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6.service +Documentation=man:podman-generate-systemd(1) +Wants=network-online.target +After=network-online.target +RequiresMountsFor=/var/run/container/storage + +[Service] +Restart=always +ExecStart=/usr/bin/podman start de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6 +ExecStop=/usr/bin/podman stop \ + -t 1 de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6 +KillMode=none +Type=forking +PIDFile=/run/user/1000/overlay-containers/de1e3223b1b888bc02d0962dd6cb5855eb00734061013ffdd3479d225abacdc6/userdata/conmon.pid + +[Install] +WantedBy=default.target +``` + +### Generate systemd unit file for a container with `--new` flag + + The `--new` flag generates systemd unit files that create and remove containers at service start and stop commands (see ExecStartPre and ExecStopPost service actions). Such unit files are not tied to a single machine and can easily be shared and used on other machines. + +``` +$ sudo podman generate systemd --new --files --name bb310a0780ae +# container-busy_moser.service +# autogenerated by Podman 1.8.3 +# Fri Apr 3 09:40:47 EDT 2020 + +[Unit] +Description=Podman container-busy_moser.service +Documentation=man:podman-generate-systemd(1) +Wants=network-online.target +After=network-online.target +RequiresMountsFor=/var/run/container/storage + +[Service] +Environment=PODMAN_SYSTEMD_UNIT=%n +Restart=on-failure +ExecStartPre=/bin/rm -f %t/%n-pid %t/%n-cid +ExecStart=/usr/local/bin/podman run \ + --conmon-pidfile %t/%n-pid \ + --cidfile %t/%n-cid \ + --cgroups=no-conmon \ + -d \ + -dit alpine +ExecStop=/usr/local/bin/podman stop \ + --ignore \ + --cidfile %t/%n-cid -t 10 +ExecStopPost=/usr/local/bin/podman rm \ + --ignore \ + -f \ + --cidfile %t/%n-cid +PIDFile=%t/%n-pid +KillMode=none +Type=forking + +[Install] +WantedBy=default.target +``` + +### Generate systemd unit files for a pod with two simple alpine containers + +Note `systemctl` must only be used on the pod unit and not used to start or stop containers individually. The containers are managed by the pod service along with the internal infra-container. + +Use `systemctl status` or `journalctl` to examine container or pod unit files. +``` +$ podman pod create --name systemd-pod +$ podman create --pod systemd-pod alpine top +$ podman create --pod systemd-pod alpine top +$ podman generate systemd --files --name systemd-pod +/home/user/pod-systemd-pod.service +/home/user/container-amazing_chandrasekhar.service +/home/user/container-jolly_shtern.service +$ cat pod-systemd-pod.service +# pod-systemd-pod.service +# autogenerated by Podman 1.8.0 +# Wed Mar 09 09:52:37 CEST 2020 + +[Unit] +Description=Podman pod-systemd-pod.service +Documentation=man:podman-generate-systemd(1) +Requires=container-amazing_chandrasekhar.service container-jolly_shtern.service +Before=container-amazing_chandrasekhar.service container-jolly_shtern.service +Wants=network-online.target +After=network-online.target +RequiresMountsFor=/var/run/container/storage + +[Service] +Restart=on-failure +ExecStart=/usr/bin/podman start 77a818221650-infra +ExecStop=/usr/bin/podman stop \ + -t 10 77a818221650-infra +KillMode=none +Type=forking +PIDFile=/run/user/1000/overlay-containers/ccfd5c71a088768774ca7bd05888d55cc287698dde06f475c8b02f696a25adcd/userdata/conmon.pid + +[Install] +WantedBy=default.target +``` + +### Installation of generated systemd unit files. + +Podman-generated unit files include an `[Install]` section, which carries installation information for the unit. It is used by the enable and disable commands of systemctl(1) during installation. + +Once the systemd unit file is generated, install it to */etc/systemd/system* to be run by the root user or to *$HOME/.config/systemd/user* for installing it as a non-root user. Enable the copied unit file or files using `systemctl enable`. + +Note: Copying unit files to */etc/systemd/system* and enabling it marks the unit file to be automatically started at boot. And similarly, copying a unit file to *$HOME/.config/systemd/user* and enabling it marks the unit file to be automatically started on user login. + + +``` +# Generated systemd files. +$ podman pod create --name systemd-pod +$ podman create --pod systemd-pod alpine top +$ podman generate systemd --files --name systemd-pod + +# Copy all the generated files. + +$ sudo cp pod-systemd-pod.service container-great_payne.service /etc/systemd/system +$ systemctl enable pod-systemd-pod.service +Created symlink /etc/systemd/system/multi-user.target.wants/pod-systemd-pod.service → /etc/systemd/system/pod-systemd-pod.service. +Created symlink /etc/systemd/system/default.target.wants/pod-systemd-pod.service → /etc/systemd/system/pod-systemd-pod.service. +$ systemctl is-enabled pod-systemd-pod.service +enabled +``` +To run the user services placed in `$HOME/.config/systemd/user` on first login of that user, enable the service with --user flag. + +``` +$ systemctl --user enable <.service> +``` +The systemd user instance is killed after the last session for the user is closed. The systemd user instance can be started at boot and kept running even after the user logs out by enabling `lingering` using + +``` +$ loginctl enable-linger +``` +### Use `systemctl` to perform operations on generated installed unit files. + +Create and enable systemd unit files for a pod using the above examples as reference and use `systemctl` to perform operations. + +Since systemctl defaults to using the root user, all the changes using the systemctl can be seen by appending sudo to the podman cli commands. To perform `systemctl` actions as a non-root user use the `--user` flag when interacting with `systemctl`. + +Note: If the previously created containers or pods are using shared resources, such as ports, make sure to remove them before starting the generated systemd units. + +``` +$ systemctl --user start pod-systemd-pod.service +$ podman pod ps +POD ID NAME STATUS CREATED # OF CONTAINERS INFRA ID +0815c7b8e7f5 systemd-pod Running 29 minutes ago 2 6c5d116f4bbe +$ sudo podman ps # 0 Number of pods on root. +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +$ systemctl stop pod-systemd-pod.service +$ podman pod ps +POD ID NAME STATUS CREATED # OF CONTAINERS INFRA ID +272d2813c798 systemd-pod Exited 29 minutes ago 2 6c5d116f4bbe +``` + +Create a simple alpine container and generate the systemd unit file with `--new` flag. +Enable the service and control operations using the systemctl commands. + +Note: When starting the container using `systemctl start` rather than altering the already running container it spins up a "new" container with similar configuration. + +``` +# Enable the service. + +$ sudo podman ps -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +bb310a0780ae docker.io/library/alpine:latest /bin/sh 2 minutes ago Created busy_moser +$ sudo systemctl start container-busy_moser.service +$ sudo podman ps -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +772df2f8cf3b docker.io/library/alpine:latest /bin/sh 1 second ago Up 1 second distracted_albattani +bb310a0780ae docker.io/library/alpine\:latest /bin/sh 3 minutes ago Created busy_moser +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **systemctl(1)**, **systemd.unit(5)**, **systemd.service(5)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)**, **[podman-systemd.unit(5)](podman-systemd.unit.5.md)** + +## HISTORY +April 2020, Updated details and added use case to use generated .service files as root and non-root, by Sujil Shah (sushah at redhat dot com) + +August 2019, Updated with pod support by Valentin Rothberg (rothberg at redhat dot com) + +April 2019, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-generate.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-generate.1.md new file mode 100644 index 000000000..0742a4f76 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-generate.1.md @@ -0,0 +1,27 @@ +--- +title: podman-generate +version: v5.5.2 +--- + +% podman-generate 1 + +## NAME +podman\-generate - Generate structured data based on containers, pods or volumes + +## SYNOPSIS +**podman generate** *subcommand* + +## DESCRIPTION +The generate command creates structured output (like YAML) based on a container, pod or volume. + +## COMMANDS + +| Command | Man Page | Description | +|---------|------------------------------------------------------------|-------------------------------------------------------------------------------------| +| kube | [podman-kube-generate(1)](podman-kube-generate.1.md) | Generate Kubernetes YAML based on containers, pods or volumes. | +| spec | [podman-generate-spec(1)](podman-generate-spec.1.md) | Generate Specgen JSON based on containers or pods. | +| systemd | [podman-generate-systemd(1)](podman-generate-systemd.1.md) | [DEPRECATED] Generate systemd unit file(s) for a container or pod. | + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-container(1)](podman-container.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-healthcheck-run.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-healthcheck-run.1.md new file mode 100644 index 000000000..01dfac648 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-healthcheck-run.1.md @@ -0,0 +1,45 @@ +--- +title: podman-healthcheck-run +version: v5.5.2 +--- + +% podman-healthcheck-run 1 + +## NAME +podman\-healthcheck\-run - Run a container healthcheck + +## SYNOPSIS +**podman healthcheck run** *container* + +## DESCRIPTION + +Runs the healthcheck command defined in a running container manually. The resulting error codes are defined +as follows: + +* 0 = healthcheck command succeeded +* 1 = healthcheck command failed +* 125 = an error has occurred + +Possible errors that can occur during the healthcheck are: +* unable to find the container +* container has no defined healthcheck +* container is not running + +## OPTIONS +#### **--help** + +Print usage statement + + +## EXAMPLES + +Run healthchecks in specified container: +``` +$ podman healthcheck run mywebapp +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-healthcheck(1)](podman-healthcheck.1.md)** + +## HISTORY +Feb 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-healthcheck.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-healthcheck.1.md new file mode 100644 index 000000000..76aa97072 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-healthcheck.1.md @@ -0,0 +1,27 @@ +--- +title: podman-healthcheck +version: v5.5.2 +--- + +% podman-healthcheck 1 + +## NAME +podman\-healthcheck - Manage healthchecks for containers + +## SYNOPSIS +**podman healthcheck** *subcommand* + +## DESCRIPTION +podman healthcheck is a set of subcommands that manage container healthchecks + +## SUBCOMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------- | ------------------------------------------------------------------------------ | +| run | [podman-healthcheck-run(1)](podman-healthcheck-run.1.md) | Run a container healthcheck | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +Feb 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-history.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-history.1.md new file mode 100644 index 000000000..b4a206def --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-history.1.md @@ -0,0 +1,110 @@ +--- +title: podman-history +version: v5.5.2 +--- + +% podman-history 1 + +## NAME +podman\-history - Show the history of an image + +## SYNOPSIS +**podman history** [*options*] *image*[:*tag*|@*digest*] + +**podman image history** [*options*] *image*[:*tag*|@*digest*] + +## DESCRIPTION +**podman history** displays the history of an image by printing out information +about each layer used in the image. The information printed out for each layer +include Created (time and date), Created By, Size, and Comment. The output can +be truncated or not using the **--no-trunc** flag. If the **--human** flag is +set, the time of creation and size are printed out in a human readable format. +The **--quiet** flag displays the ID of the image only when set and the **--format** +flag is used to print the information using the Go template provided by the user. + +## OPTIONS + +#### **--format**=*format* + +Alter the output for a format like 'json' or a Go template. + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|------------------------|---------------------------------------------------------------------------| +| .Comment | Comment for the layer | +| .Created | if --human, time elapsed since creation, otherwise time stamp of creation | +| .CreatedAt | Time when the image layer was created | +| .CreatedBy | Command used to create the layer | +| .CreatedSince | Elapsed time since the image layer was created | +| .ID | Image ID | +| .Size | Size of layer on disk | +| .Tags | Image tags | + +#### **--help**, **-h** + +Print usage statement + +#### **--human**, **-H** + +Display sizes and dates in human readable format (default *true*). + +#### **--no-trunc** + +Do not truncate the output (default *false*). + +#### **--quiet**, **-q** + +Print the numeric IDs only (default *false*). + +## EXAMPLES + +Show the history of the specified image: +``` +$ podman history debian +ID CREATED CREATED BY SIZE COMMENT +b676ca55e4f2c 9 weeks ago /bin/sh -c #(nop) CMD ["bash"] 0 B + 9 weeks ago /bin/sh -c #(nop) ADD file:ebba725fb97cea4... 45.14 MB +``` + +Show the history of the specified image without truncating content and using raw data: +``` +$ podman history --no-trunc=true --human=false debian +ID CREATED CREATED BY SIZE COMMENT +b676ca55e4f2c 2017-07-24T16:52:55Z /bin/sh -c #(nop) CMD ["bash"] 0 + 2017-07-24T16:52:54Z /bin/sh -c #(nop) ADD file:ebba725fb97cea4... 45142935 +``` + +Show the formatted history of the specified image: +``` +$ podman history --format "{{.ID}} {{.Created}}" debian +b676ca55e4f2c 9 weeks ago + 9 weeks ago +``` + +Show the history in JSON format for the specified image: +``` +$ podman history --format json debian +[ + { + "id": "b676ca55e4f2c0ce53d0636438c5372d3efeb5ae99b676fa5a5d1581bad46060", + "created": "2017-07-24T16:52:55.195062314Z", + "createdBy": "/bin/sh -c #(nop) CMD [\"bash\"]", + "size": 0, + "comment": "" + }, + { + "id": "b676ca55e4f2c0ce53d0636438c5372d3efeb5ae99b676fa5a5d1581bad46060", + "created": "2017-07-24T16:52:54.898893387Z", + "createdBy": "/bin/sh -c #(nop) ADD file:ebba725fb97cea45d0b1b35ccc8144e766fcfc9a78530465c23b0c4674b14042 in / ", + "size": 45142935, + "comment": "" + } +] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-image-diff.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-image-diff.1.md new file mode 100644 index 000000000..437de718d --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-image-diff.1.md @@ -0,0 +1,61 @@ +--- +title: podman-image-diff +version: v5.5.2 +--- + +% podman-image-diff 1 + +## NAME +podman-image-diff - Inspect changes on an image's filesystem + +## SYNOPSIS +**podman image diff** [*options*] *image* [*image*] + +## DESCRIPTION +Displays changes on an image's filesystem. The image is compared to its parent layer or the second argument when given. + +The output is prefixed with the following symbols: + +| Symbol | Description | +|--------|-------------| +| A | A file or directory was added. | +| D | A file or directory was deleted. | +| C | A file or directory was changed. | + +## OPTIONS + +#### **--format** + +Alter the output into a different format. The only valid format for **podman image diff** is `json`. + +## EXAMPLE + +Display image differences from images parent layer: +``` +$ podman image diff redis:old +C /usr +C /usr/local +C /usr/local/bin +A /usr/local/bin/docker-entrypoint.sh +``` + +Display image differences between two different images in JSON format: +``` +$ podman image diff --format json redis:old redis\:alpine +{ + "changed": [ + "/usr", + "/usr/local", + "/usr/local/bin" + ], + "added": [ + "/usr/local/bin/docker-entrypoint.sh" + ] +} +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image(1)](podman-image.1.md)** + +## HISTORY +August 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-image-exists.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-image-exists.1.md new file mode 100644 index 000000000..28c32b998 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-image-exists.1.md @@ -0,0 +1,46 @@ +--- +title: podman-image-exists +version: v5.5.2 +--- + +% podman-image-exists 1 + +## NAME +podman-image-exists - Check if an image exists in local storage + +## SYNOPSIS +**podman image exists** *image* + +## DESCRIPTION +**podman image exists** checks if an image exists in local storage. The **ID** or **Name** +of the image may be used as input. Podman returns an exit code +of `0` when the image is found. A `1` is returned otherwise. An exit code of `125` indicates there +was an issue accessing the local storage. + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Check if an image called `webclient` exists in local storage (the image does actually exist): +``` +$ podman image exists webclient +$ echo $? +0 +``` + +Check if an image called `webbackend` exists in local storage (the image does not actually exist): +``` +$ podman image exists webbackend +$ echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image(1)](podman-image.1.md)** + +## HISTORY +November 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-image-inspect.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-image-inspect.1.md new file mode 100644 index 000000000..23f88ef75 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-image-inspect.1.md @@ -0,0 +1,139 @@ +--- +title: podman-image-inspect +version: v5.5.2 +--- + +% podman-image-inspect 1 + +## NAME +podman\-image\-inspect - Display an image's configuration + +## SYNOPSIS +**podman image inspect** [*options*] *image* [*image* ...] + +## DESCRIPTION + +This displays the low-level information on images identified by name or ID. By default, this renders all results in a JSON array. If a format is specified, the given template is executed for each result. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Format the output using the given Go template. +The keys of the returned JSON can be used as the values for the --format flag (see examples below). + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ----------------- | ------------------ | +| .Annotations ... | Annotation information included in the image | +| .Architecture | Architecture of software in the image | +| .Author | Image author | +| .Comment | Image comment | +| .Config ... | Structure with config info | +| .Created ... | Image creation time (string, ISO3601) | +| .Digest | Image digest (sha256:+64-char hash) | +| .GraphDriver ... | Structure for the graph driver info | +| .HealthCheck ... | Structure for the health check info | +| .History | History information stored in image | +| .ID | Image ID (full 64-char hash) | +| .Labels ... | Label information included in the image | +| .ManifestType | Manifest type of the image | +| .NamesHistory | Name history information stored in image | +| .Os | Operating system of software in the image | +| .Parent | Parent image of the specified image | +| .RepoDigests | Repository digests for the image | +| .RepoTags | Repository tags for the image | +| .RootFS ... | Structure for the root file system info | +| .Size | Size of image, in bytes | +| .User | Default user to execute the image as | +| .Version | Image Version | +| .VirtualSize | Virtual size of image, in bytes | + +## EXAMPLE + +Inspect information on the specified image: +``` +$ podman image inspect fedora +[ + { + "Id": "37e5619f4a8ca9dbc4d6c0ae7890625674a10dbcfb76201399e2aaddb40da17d", + "Digest": "sha256:1b0d4ddd99b1a8c8a80e885aafe6034c95f266da44ead992aab388e6aa91611a", + "RepoTags": [ + "registry.fedoraproject.org/fedora:latest" + ], + "RepoDigests": [ + "registry.fedoraproject.org/fedora@sha256:1b0d4ddd99b1a8c8a80e885aafe6034c95f266da44ead992aab388e6aa91611a", + "registry.fedoraproject.org/fedora@sha256:b5290db40008aae9272ad3a6bd8070ef7ecd547c3bef014b894c327960acc582" + ], + "Parent": "", + "Comment": "Created by Image Factory", + "Created": "2021-08-09T05:48:47Z", + "Config": { + "Env": [ + "DISTTAG=f34container", + "FGC=f34", + "container=oci" + ], + "Cmd": [ + "/bin/bash" + ], + "Labels": { + "license": "MIT", + "name": "fedora", + "vendor": "Fedora Project", + "version": "34" + } + }, + "Version": "1.10.1", + "Author": "", + "Architecture": "amd64", + "Os": "linux", + "Size": 183852302, + "VirtualSize": 183852302, + "GraphDriver": { + "Name": "overlay", + "Data": { + "UpperDir": "/home/dwalsh/.local/share/containers/storage/overlay/0203e243f1ca4b6bb49371ecd21363212467ec6d7d3fa9f324cd4e78cc6b5fa2/diff", + "WorkDir": "/home/dwalsh/.local/share/containers/storage/overlay/0203e243f1ca4b6bb49371ecd21363212467ec6d7d3fa9f324cd4e78cc6b5fa2/work" + } + }, + "RootFS": { + "Type": "layers", + "Layers": [ + "sha256:0203e243f1ca4b6bb49371ecd21363212467ec6d7d3fa9f324cd4e78cc6b5fa2" + ] + }, + "Labels": { + "license": "MIT", + "name": "fedora", + "vendor": "Fedora Project", + "version": "34" + }, + "Annotations": {}, + "ManifestType": "application/vnd.docker.distribution.manifest.v2+json", + "User": "", + "History": [ + { + "created": "2021-08-09T05:48:47Z", + "comment": "Created by Image Factory" + } + ], + "NamesHistory": [ + "registry.fedoraproject.org/fedora:latest" + ] + } +] +``` + +Inspect image ID for the specified image: +``` +$ podman image inspect --format '{{ .Id }}' fedora +37e5619f4a8ca9dbc4d6c0ae7890625674a10dbcfb76201399e2aaddb40da17d +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image(1)](podman-image.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +Sep 2021, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-image-mount.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-image-mount.1.md new file mode 100644 index 000000000..f20a63361 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-image-mount.1.md @@ -0,0 +1,82 @@ +--- +title: podman-image-mount +version: v5.5.2 +--- + +% podman-image-mount 1 + +## NAME +podman\-image\-mount - Mount an image's root filesystem + +## SYNOPSIS +**podman image mount** [*options*] [*image* ...] + +## DESCRIPTION +Mounts the specified images' root file system in a location which can be +accessed from the host, and returns its location. + +The `podman image mount` command without any arguments lists all of the +currently mounted images. + +Rootless mode only supports mounting VFS driver, unless podman is run in a user namespace. +Use the `podman unshare` command to enter the user namespace. All other storage drivers fail to mount. + +## RETURN VALUE +The location of the mounted file system. On error an empty string and errno is +returned. + +## OPTIONS + +#### **--all**, **-a** + +Mount all images. + +#### **--format**=*format* + +Print the mounted images in specified format (json). + +## EXAMPLE + +Mount multiple images. Note: In rootless mode, image mounting works only after executing the podman unshare command to enter the user namespace. +``` +podman image mount fedora ubi8-init +/var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +/var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged +``` + +List mounted images: +``` +podman image mount +registry.fedoraproject.org/fedora:latest /var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +registry.access.redhat.com/ubi8-init:latest /var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged +``` + +List mounted images in JSON format: +``` +podman image mount --format json +[ + { + "id": "00ff39a8bf19f810a7e641f7eb3ddc47635913a19c4996debd91fafb6b379069", + "Names": [ + "sha256:58de585a231aca14a511347bc85b912a6f000159b49bc2b0582032911e5d3a6c" + ], + "Repositories": [ + "registry.fedoraproject.org/fedora:latest" + ], + "mountpoint": "/var/lib/containers/storage/overlay/0ccfac04663bbe8813b5f24502ee0b7371ce5bf3c5adeb12e4258d191c2cf7bc/merged" + }, + { + "id": "bcc2dc9a261774ad25a15e07bb515f9b77424266abf2a1252ec7bcfed1dd0ac2", + "Names": [ + "sha256:d5f260b2e51b3ee9d05de1c31d261efc9af28e7d2d47cedf054c496d71424d63" + ], + "Repositories": [ + "registry.access.redhat.com/ubi8-init:latest" + ], + "mountpoint": "/var/lib/containers/storage/overlay/d66b58e3391ea8ce4c81316c72e22b332618f2a28b461a32ed673e8998cdaeb8/merged" + } +] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image(1)](podman-image.1.md)**, **[podman-image-unmount(1)](podman-image-unmount.1.md)**, **[podman-unshare(1)](podman-unshare.1.md)**, **mount(8)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-image-prune.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-image-prune.1.md new file mode 100644 index 000000000..21fc4a262 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-image-prune.1.md @@ -0,0 +1,121 @@ +--- +title: podman-image-prune +version: v5.5.2 +--- + +% podman-image-prune 1 + +## NAME +podman-image-prune - Remove all unused images from the local store + +## SYNOPSIS +**podman image prune** [*options*] + +## DESCRIPTION +**podman image prune** removes all dangling images from local storage. With the `all` option, +all unused images are deleted (i.e., images not in use by any container). + +The image prune command does not prune cache images that only use layers that are necessary for other images. + +## OPTIONS +#### **--all**, **-a** + +Remove dangling images and images that have no associated containers. + +#### **--build-cache** + +Remove persistent build cache created for `--mount=type=cache`. + +#### **--external** + +Remove images even when they are used by external containers (e.g., build containers). + +#### **--filter**=*filters* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------:|--------------------------------------------------------------------------------------------------| +| label | Only remove images, with (or without, in the case of label!=[...] is used) the specified labels. | +| until | Only remove images created before given timestamp. | + + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes containers with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes containers without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not provide an interactive prompt for container removal. + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Remove all dangling images from local storage: +``` +$ sudo podman image prune + +WARNING! This will remove all dangling images. +Are you sure you want to continue? [y/N] y +f3e20dc537fb04cb51672a5cb6fdf2292e61d411315549391a0d1f64e4e3097e +324a7a3b2e0135f4226ffdd473e4099fd9e477a74230cdc35de69e84c0f9d907 +``` + +Remove all unused images from local storage without confirming: +``` +$ sudo podman image prune -a -f +f3e20dc537fb04cb51672a5cb6fdf2292e61d411315549391a0d1f64e4e3097e +324a7a3b2e0135f4226ffdd473e4099fd9e477a74230cdc35de69e84c0f9d907 +6125002719feb1ddf3030acab1df6156da7ce0e78e571e9b6e9c250424d6220c +91e732da5657264c6f4641b8d0c4001c218ae6c1adb9dcef33ad00cafd37d8b6 +e4e5109420323221f170627c138817770fb64832da7d8fe2babd863148287fca +77a57fa8285e9656dbb7b23d9efa837a106957409ddd702f995605af27a45ebe + +``` + +Remove all unused images from local storage since given time/hours: +``` +$ sudo podman image prune -a --filter until=2019-11-14T06:15:42.937792374Z + +WARNING! This will remove all dangling images. +Are you sure you want to continue? [y/N] y +e813d2135f17fadeffeea8159a34cfdd4c30b98d8111364b913a91fd930643e9 +5e6572320437022e2746467ddf5b3561bf06e099e8e6361df27e0b2a7ed0b17b +58fda2abf5042b35dfe04e5f8ee458a3cc26375bf309efb42c078b551a2055c7 +6d2bd30fe924d3414b64bd3920760617e6ced872364bc3bc6959a623252da002 +33d1c829be64a1e1d379caf4feec1f05a892c3ef7aa82c0be53d3c08a96c59c5 +f9f0a8a58c9e02a2b3250b88cc5c95b1e10245ca2c4161d19376580aaa90f55c +1ef14d5ede80db78978b25ad677fd3e897a578c3af614e1fda608d40c8809707 +45e1482040e441a521953a6da2eca9bafc769e15667a07c23720d6e0cafc3ab2 + +$ sudo podman image prune -f --filter until=10h +f3e20dc537fb04cb51672a5cb6fdf2292e61d411315549391a0d1f64e4e3097e +324a7a3b2e0135f4226ffdd473e4099fd9e477a74230cdc35de69e84c0f9d907 +``` + +Remove all unused images from local storage with label version 1.0: +``` +$ sudo podman image prune -a -f --filter label=version=1.0 +e813d2135f17fadeffeea8159a34cfdd4c30b98d8111364b913a91fd930643e9 +5e6572320437022e2746467ddf5b3561bf06e099e8e6361df27e0b2a7ed0b17b +58fda2abf5042b35dfe04e5f8ee458a3cc26375bf309efb42c078b551a2055c7 +6d2bd30fe924d3414b64bd3920760617e6ced872364bc3bc6959a623252da002 +33d1c829be64a1e1d379caf4feec1f05a892c3ef7aa82c0be53d3c08a96c59c5 +f9f0a8a58c9e02a2b3250b88cc5c95b1e10245ca2c4161d19376580aaa90f55c +1ef14d5ede80db78978b25ad677fd3e897a578c3af614e1fda608d40c8809707 +45e1482040e441a521953a6da2eca9bafc769e15667a07c23720d6e0cafc3ab2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-images(1)](podman-images.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) +December 2020, converted filter information from docs.docker.com documentation by Dan Walsh (dwalsh at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-image-scp.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-image-scp.1.md new file mode 100644 index 000000000..3b7911db1 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-image-scp.1.md @@ -0,0 +1,107 @@ +--- +title: podman-image-scp +version: v5.5.2 +--- + +% podman-image-scp 1 + +## NAME +podman-image-scp - Securely copy an image from one host to another + +## SYNOPSIS +**podman image scp** [*options*] *name*[:*tag*] + +## DESCRIPTION +**podman image scp** copies container images between hosts on a network. This command can copy images to the remote host or from the remote host as well as between two remote hosts. +Note: `::` is used to specify the image name depending on Podman is saving or loading. Images can also be transferred from rootful to rootless storage on the same machine without using sshd. This feature is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. + +**podman image scp [GLOBAL OPTIONS]** + +**podman image** *scp [OPTIONS] NAME[:TAG] [HOSTNAME::]* + +**podman image** *scp [OPTIONS] [HOSTNAME::]IMAGENAME* + +**podman image** *scp [OPTIONS] [HOSTNAME::]IMAGENAME [HOSTNAME::]* + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--quiet**, **-q** + +Suppress the output + +## EXAMPLES + +Copy specified image to local storage: +``` +$ podman image scp alpine +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image from local storage to remote connection: +``` +$ podman image scp alpine Fedora::/home/charliedoern/Documents/alpine +Getting image source signatures +Copying blob 72e830a4dff5 done +Copying config 85f9dc67c7 done +Writing manifest to image destination +Storing signatures +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image from remote connection to remote connection: +``` +$ podman image scp Fedora::alpine RHEL:: +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image via ssh to local storage: +``` +$ podman image scp charliedoern@192.168.68.126:22/run/user/1000/podman/podman.sock::alpine +WARN[0000] Unknown connection name given. Please use system connection add to specify the default remote socket location +Getting image source signatures +Copying blob 9450ef9feb15 [--------------------------------------] 0.0b / 0.0b +Copying config 1f97f0559c done +Writing manifest to image destination +Storing signatures +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image from root account to user accounts local storage: +``` +$ sudo podman image scp root@localhost::alpine username@localhost:: +Copying blob e2eb06d8af82 done +Copying config 696d33ca15 done +Writing manifest to image destination +Storing signatures +Getting image source signatures +Copying blob 5eb901baf107 skipped: already exists +Copying config 696d33ca15 done +Writing manifest to image destination +Storing signatures +Loaded image: docker.io/library/alpine:latest +``` + +Copy specified image from root account to local storage: +``` +$ sudo podman image scp root@localhost::alpine +Copying blob e2eb06d8af82 done +Copying config 696d33ca15 done +Writing manifest to image destination +Storing signatures +Getting image source signatures +Copying blob 5eb901baf107 +Copying config 696d33ca15 done +Writing manifest to image destination +Storing signatures +Loaded image: docker.io/library/alpine:latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-load(1)](podman-load.1.md)**, **[podman-save(1)](podman-save.1.md)**, **[podman-remote(1)](podman-remote.1.md)**, **[podman-system-connection-add(1)](podman-system-connection-add.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** + +## HISTORY +July 2021, Originally written by Charlie Doern diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-image-sign.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-image-sign.1.md new file mode 100644 index 000000000..416024095 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-image-sign.1.md @@ -0,0 +1,94 @@ +--- +title: podman-image-sign +version: v5.5.2 +--- + +% podman-image-sign 1 + +## NAME +podman-image-sign - Create a signature for an image + +## SYNOPSIS +**podman image sign** [*options*] *image* [*image* ...] + +## DESCRIPTION +**podman image sign** creates a local signature for one or more local images that have +been pulled from a registry. The signature is written to a directory +derived from the registry configuration files in `$HOME/.config/containers/registries.d` if it exists, +otherwise `/etc/containers/registries.d` (unless overridden at compile-time), see **containers-registries.d(5)** for more information. +By default, the signature is written into `/var/lib/containers/sigstore` for root and `$HOME/.local/share/containers/sigstore` for non-root users + +## OPTIONS + +#### **--all**, **-a** + +Sign all the manifests of the multi-architecture image (default false). + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + +#### **--directory**, **-d**=*dir* + +Store the signatures in the specified directory. Default: /var/lib/containers/sigstore + +#### **--help**, **-h** + +Print usage statement. + +#### **--sign-by**=*identity* + +Override the default identity of the signature. + +## EXAMPLES +Sign the busybox image with the identity of foo@bar.com with a user's keyring and save the signature in /tmp/signatures/. + +```bash + $ sudo podman image sign --sign-by foo@bar.com --directory /tmp/signatures docker://privateregistry.example.com/foobar + + $ sudo podman image sign --authfile=/tmp/foobar.json --sign-by foo@bar.com --directory /tmp/signatures docker://privateregistry.example.com/foobar +``` + +## RELATED CONFIGURATION + +The write (and read) location for signatures is defined in YAML-based +configuration files in /etc/containers/registries.d/ for root, +or $HOME/.config/containers/registries.d for non-root users. When signing +an image, Podman uses those configuration files to determine +where to write the signature based on the name of the originating +registry or a default storage value unless overridden with the --directory +option. For example, consider the following configuration file. + +```yaml +docker: + privateregistry.example.com: + sigstore: file:///var/lib/containers/sigstore +``` + +When signing an image preceded with the registry name 'privateregistry.example.com', +the signature is written into sub-directories of +/var/lib/containers/sigstore/privateregistry.example.com. The use of 'sigstore' also means +the signature is 'read' from that same location on a pull-related function. + +## SEE ALSO +**[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.d(5)](https://github.com/containers/image/blob/main/docs/containers-registries.d.5.md)** + +## HISTORY +November 2018, Originally compiled by Qi Wang (qiwan at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-image-tree.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-image-tree.1.md new file mode 100644 index 000000000..75e516ab7 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-image-tree.1.md @@ -0,0 +1,91 @@ +--- +title: podman-image-tree +version: v5.5.2 +--- + +% podman-image-tree 1 + +## NAME +podman\-image\-tree - Print layer hierarchy of an image in a tree format + +## SYNOPSIS +**podman image tree** [*options*] *image:tag*|*image-id* + + +## DESCRIPTION +Prints layer hierarchy of an image in a tree format. +If no *tag* is provided, Podman defaults to `latest` for the *image*. +Layers are indicated with image tags as `Top Layer of`, when the tag is known locally. +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--whatrequires** + +Show all child images and layers of the specified image + +## EXAMPLES + +List image tree information on specified image: +``` +$ podman image tree docker.io/library/wordpress +Image ID: 6e880d17852f +Tags: [docker.io/library/wordpress:latest] +Size: 429.9MB +Image Layers +├── ID: 3c816b4ead84 Size: 58.47MB +├── ID: e39dad2af72e Size: 3.584kB +├── ID: b2d6a702383c Size: 213.6MB +├── ID: 94609408badd Size: 3.584kB +├── ID: f4dddbf86725 Size: 43.04MB +├── ID: 8f695df43a4c Size: 11.78kB +├── ID: c29d67bf8461 Size: 9.728kB +├── ID: 23f4315918f8 Size: 7.68kB +├── ID: d082f93a18b3 Size: 13.51MB +├── ID: 7ea8bedcac69 Size: 4.096kB +├── ID: dc3bbf7b3dc0 Size: 57.53MB +├── ID: fdbbc6404531 Size: 11.78kB +├── ID: 8d24785437c6 Size: 4.608kB +├── ID: 80715f9e8880 Size: 4.608kB Top Layer of: [docker.io/library/php:7.2-apache] +├── ID: c93cbcd6437e Size: 3.573MB +├── ID: dece674f3cd1 Size: 4.608kB +├── ID: 834f4497afda Size: 7.168kB +├── ID: bfe2ce1263f8 Size: 40.06MB +└── ID: 748e99b214cf Size: 11.78kB Top Layer of: [docker.io/library/wordpress:latest] +``` + +Show all child images and layers of the specified image: +``` +$ podman image tree ae96a4ad4f3f --whatrequires +Image ID: ae96a4ad4f3f +Tags: [docker.io/library/ruby:latest] +Size: 894.2MB +Image Layers +└── ID: 9c92106221c7 Size: 2.56kB Top Layer of: [docker.io/library/ruby\:latest] + ├── ID: 1b90f2b80ba0 Size: 3.584kB + │ ├── ID: 42b7d43ae61c Size: 169.5MB + │ ├── ID: 26dc8ba99ec3 Size: 2.048kB + │ ├── ID: b4f822db8d95 Size: 3.957MB + │ ├── ID: 044e9616ef8a Size: 164.7MB + │ ├── ID: bf94b940200d Size: 11.75MB + │ ├── ID: 4938e71bfb3b Size: 8.532MB + │ └── ID: f513034bf553 Size: 1.141MB + ├── ID: 1e55901c3ea9 Size: 3.584kB + ├── ID: b62835a63f51 Size: 169.5MB + ├── ID: 9f4e8857f3fd Size: 2.048kB + ├── ID: c3b392020e8f Size: 3.957MB + ├── ID: 880163026a0a Size: 164.8MB + ├── ID: 8c78b2b14643 Size: 11.75MB + ├── ID: 830370cfa182 Size: 8.532MB + └── ID: 567fd7b7bd38 Size: 1.141MB Top Layer of: [docker.io/circleci/ruby\\:latest] + +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +Feb 2019, Originally compiled by Kunal Kushwaha `` diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-image-trust.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-image-trust.1.md new file mode 100644 index 000000000..4e72d236a --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-image-trust.1.md @@ -0,0 +1,211 @@ +--- +title: podman-image-trust +version: v5.5.2 +--- + +% podman-image-trust 1 + +## NAME +podman\-image\-trust - Manage container registry image trust policy + + +## SYNOPSIS +**podman image trust** set|show [*options*] *registry[/repository]* + +## DESCRIPTION +Manages which registries to trust as a source of container images based on its location. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +The location is determined +by the transport and the registry host of the image. Using this container image `docker://docker.io/library/busybox` +as an example, `docker` is the transport and `docker.io` is the registry host. + +Trust is defined in **/etc/containers/policy.json** and is enforced when a user attempts to pull +a remote image from a registry. The trust policy in policy.json describes a registry scope (registry and/or repository) for the trust. This trust can use public keys for signed images. + +The scope of the trust is evaluated from most specific to the least specific. In other words, a policy may be: + + * Defined to an entire registry. + * Defined to a particular repository in that registry. + * Defined to a specific signed image inside of the registry. + +The following list are examples of valid scope values used in policy.json from most specific to the least specific: + +docker.io/library/busybox\:notlatest + +docker.io/library/busybox + +docker.io/library + +docker.io + +If no configuration is found for any of these scopes, the default value (specified by using "default" instead of REGISTRY[/REPOSITORY]) is used. + +Trust **type** provides a way to: + +Allowlist ("accept") or +Denylist ("reject") registries or +Require a simple signing signature (“signedBy”), +Require a sigstore signature ("sigstoreSigned"). + +Trust may be updated using the command **podman image trust set** for an existing trust scope. + +## OPTIONS +#### **--help**, **-h** + Print usage statement. + +### set OPTIONS + +#### **--pubkeysfile**, **-f**=*KEY1* + A path to an exported public key on the local system. Key paths + are referenced in policy.json. Any path to a file may be used but locating the file in **/etc/pki/containers** is recommended. Options may be used multiple times to + require an image be signed by multiple keys. The **--pubkeysfile** option is required for the **signedBy** and **sigstoreSigned** types. + +#### **--type**, **-t**=*value* + The trust type for this policy entry. + Accepted values: + **signedBy** (default): Require simple signing signatures with corresponding list of + public keys + **sigstoreSigned**: Require sigstore signatures with corresponding list of + public keys + **accept**: do not require any signatures for this + registry scope + **reject**: do not accept images for this registry scope + +### show OPTIONS + +#### **--json**, **-j** + Output trust as JSON for machine parsing + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--raw** + Output trust policy file as raw JSON + +## EXAMPLES + +Accept all unsigned images from a registry: +``` +sudo podman image trust set --type accept docker.io +``` + +Modify default trust policy: +``` +sudo podman image trust set -t reject default +``` + +Display system trust policy: +``` +podman image trust show +TRANSPORT NAME TYPE ID STORE +all default reject +repository docker.io/library accept +repository registry.access.redhat.com signed security@redhat.com https://access.redhat.com/webassets/docker/content/sigstore +repository registry.redhat.io signed security@redhat.com https://registry.redhat.io/containers/sigstore +repository docker.io reject +docker-daemon accept +``` + +Display trust policy file: +``` +podman image trust show --raw +{ + "default": [ + { + "type": "reject" + } + ], + "transports": { + "docker": { + "docker.io": [ + { + "type": "reject" + } + ], + "docker.io/library": [ + { + "type": "insecureAcceptAnything" + } + ], + "registry.access.redhat.com": [ + { + "type": "signedBy", + "keyType": "GPGKeys", + "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" + } + ], + "registry.redhat.io": [ + { + "type": "signedBy", + "keyType": "GPGKeys", + "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" + } + ] + }, + "docker-daemon": { + "": [ + { + "type": "insecureAcceptAnything" + } + ] + } + } +} +``` + +Display trust as JSON: +``` +podman image trust show --json +[ + { + "transport": "all", + "name": "* (default)", + "repo_name": "default", + "type": "reject" + }, + { + "transport": "repository", + "name": "docker.io", + "repo_name": "docker.io", + "type": "reject" + }, + { + "transport": "repository", + "name": "docker.io/library", + "repo_name": "docker.io/library", + "type": "accept" + }, + { + "transport": "repository", + "name": "registry.access.redhat.com", + "repo_name": "registry.access.redhat.com", + "sigstore": "https://access.redhat.com/webassets/docker/content/sigstore", + "type": "signed", + "gpg_id": "security@redhat.com" + }, + { + "transport": "repository", + "name": "registry.redhat.io", + "repo_name": "registry.redhat.io", + "sigstore": "https://registry.redhat.io/containers/sigstore", + "type": "signed", + "gpg_id": "security@redhat.com" + }, + { + "transport": "docker-daemon", + "type": "accept" + } +] +``` + +## SEE ALSO +**[containers-policy.json(5)](https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md)** + +## HISTORY +January 2019, updated by Tom Sweeney (tsweeney at redhat dot com) +December 2018, originally compiled by Qi Wang (qiwan at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-image-unmount.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-image-unmount.1.md new file mode 100644 index 000000000..432b205f2 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-image-unmount.1.md @@ -0,0 +1,55 @@ +--- +title: podman-image-unmount +version: v5.5.2 +--- + +% podman-image-unmount 1 + +## NAME +podman\-image\-unmount - Unmount an image's root filesystem + +## SYNOPSIS +**podman image unmount** [*options*] *image* [...] + +**podman image umount** [*options*] *image* [...] + +## DESCRIPTION +Unmounts the specified images' root file system, if no other processes +are using it. + +Image storage increments a mount counter each time an image is mounted. +When an image is unmounted, the mount counter is decremented, and the +image's root filesystem is physically unmounted only when the mount +counter reaches zero indicating no other processes are using the mount. +An unmount can be forced with the --force flag. + +## OPTIONS +#### **--all**, **-a** + +All of the currently mounted images are unmounted. + +#### **--force**, **-f** + +Force the unmounting of specified images' root file system, even if other +processes have mounted it. + +Note: Other processes using the file system can fail if the mount point is removed without their knowledge. + +## EXAMPLE + +Unmount image with a given ID: +``` +podman image unmount imageID +``` + +Unmount multiple images with given IDs: +``` +podman image unmount imageID1 imageID2 imageID3 +``` + +Unmount all images: +``` +podman image unmount --all +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-image-mount(1)](podman-image-mount.1.md)**, **[podman-mount(1)](podman-mount.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-image.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-image.1.md new file mode 100644 index 000000000..8ed9b1151 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-image.1.md @@ -0,0 +1,45 @@ +--- +title: podman-image +version: v5.5.2 +--- + +% podman-image 1 + +## NAME +podman\-image - Manage images + +## SYNOPSIS +**podman image** *subcommand* + +## DESCRIPTION +The image command allows the management of images + +## COMMANDS + +| Command | Man Page | Description | +| -------- | --------------------------------------------------- | ----------------------------------------------------------------------- | +| build | [podman-build(1)](podman-build.1.md) | Build a container using a Dockerfile. | +| diff | [podman-image-diff(1)](podman-image-diff.1.md) | Inspect changes on an image's filesystem. | +| exists | [podman-image-exists(1)](podman-image-exists.1.md) | Check if an image exists in local storage. | +| history | [podman-history(1)](podman-history.1.md) | Show the history of an image. | +| import | [podman-import(1)](podman-import.1.md) | Import a tarball and save it as a filesystem image. | +| inspect | [podman-image-inspect(1)](podman-image-inspect.1.md)| Display an image's configuration. | +| list | [podman-images(1)](podman-images.1.md) | List the container images on the system.(alias ls) | +| load | [podman-load(1)](podman-load.1.md) | Load an image from the docker archive. | +| mount | [podman-image-mount(1)](podman-image-mount.1.md) | Mount an image's root filesystem. | +| prune | [podman-image-prune(1)](podman-image-prune.1.md) | Remove all unused images from the local store. | +| pull | [podman-pull(1)](podman-pull.1.md) | Pull an image from a registry. | +| push | [podman-push(1)](podman-push.1.md) | Push an image from local storage to elsewhere. | +| rm | [podman-rmi(1)](podman-rmi.1.md) | Remove one or more locally stored images. | +| save | [podman-save(1)](podman-save.1.md) | Save an image to docker-archive or oci. | +| scp | [podman-image-scp(1)](podman-image-scp.1.md) | Securely copy an image from one host to another. | +| search | [podman-search(1)](podman-search.1.md) | Search a registry for an image. | +| sign | [podman-image-sign(1)](podman-image-sign.1.md) | Create a signature for an image. | +| tag | [podman-tag(1)](podman-tag.1.md) | Add an additional name to a local image. | +| tree | [podman-image-tree(1)](podman-image-tree.1.md) | Print layer hierarchy of an image in a tree format. | +| trust | [podman-image-trust(1)](podman-image-trust.1.md) | Manage container registry image trust policy. | +| unmount | [podman-image-unmount(1)](podman-image-unmount.1.md) | Unmount an image's root filesystem. | +| untag | [podman-untag(1)](podman-untag.1.md) | Remove one or more names from a locally-stored image. | + +## SEE ALSO +**[podman(1)](podman.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-images.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-images.1.md new file mode 100644 index 000000000..3fbb656d8 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-images.1.md @@ -0,0 +1,268 @@ +--- +title: podman-images +version: v5.5.2 +--- + +% podman-images 1 + +## NAME +podman\-images - List images in local storage + +## SYNOPSIS +**podman images** [*options*] [image] + +**podman image list** [*options*] [image] + +**podman image ls** [*options*] [image] + +## DESCRIPTION +Displays locally stored images, their names, and their IDs. + +## OPTIONS + +#### **--all**, **-a** + +Show all images (by default filter out the intermediate image layers). The default is false. + +#### **--digests** + +Show image digests + +#### **--filter**, **-f**=*filter* + +Provide filter values. + +The *filters* argument format is of `key=value` or `key!=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------------:|-----------------------------------------------------------------------------------------------| +| id | Filter by image ID. | +| before | Filter by images created before the given IMAGE (name or tag). | +| containers | Filter by images with a running container. | +| dangling | Filter by dangling (unused) images. | +| digest | Filter by digest. | +| intermediate | Filter by images that are dangling and have no children | +| label | Filter by images with (or without, in the case of label!=[...] is used) the specified labels. | +| manifest | Filter by images that are manifest lists. | +| readonly | Filter by read-only or read/write images. | +| reference | Filter by image name. | +| after/since | Filter by images created after the given IMAGE (name or tag). | +| until | Filter by images created until the given duration or time. | + +The `id` *filter* accepts the image ID string. + +The `before` *filter* accepts formats: `[:]`, `` or ``. + +The `containers` *filter* shows images that have a running container based on that image. + +The `dangling` *filter* shows images that are taking up disk space and serve no purpose. Dangling image is a file system layer that was used in a previous build of an image and is no longer referenced by any image. They are denoted with the `` tag, consume disk space and serve no active purpose. + +The `digest` *filter* accepts the image digest string. + +The `intermediate` *filter* shows images that are dangling and have no children. + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which shows images with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which shows images without the specified labels. + +The `manifest` *filter* shows images that are manifest lists. + +The `readonly` *filter* shows, as a default, both read-only and read/write images. Read-only images can be configured by modifying the `additionalimagestores` in the `/etc/containers/storage.conf` file. + +The `reference` *filter* accepts the pattern of an image reference `[:]`. + +The `after` or `since` *filter* accepts formats: `[:]`, `` or ``. + +The `until` *filter* accepts formats: golang duration, RFC3339 time, or a Unix timestamp and shows all images that are created until that time. + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|-----------------|------------------------------------------------------------| +| .Containers | Number of containers using this image | +| .Created | Elapsed time since the image was created | +| .CreatedAt | Time when the image was created, YYYY-MM-DD HH\:MM\:SS +nnnn | +| .CreatedSince | Same as .Created | +| .CreatedTime | Same as .CreatedAt | +| .Dangling | Same as .IsDangling | +| .Digest | Image digest | +| .History | History of the image layer | +| .ID | Image ID (truncated) | +| .Id | Image ID (full SHA) | +| .IsDangling | Is image dangling? (true/false) | +| .IsReadOnly | Is unage read-only? (true/false) | +| .Labels ... | map[] of labels | +| .Names | Image FQIN | +| .ParentId | Full SHA of parent image ID, or null (string) | +| .ReadOnly | Same as .IsReadOnly | +| .RepoDigests | map[] of zero or more repo/name@sha256\:SHA strings | +| .Repository | Image repository | +| .RepoTags | map[] of zero or more FQIN strings for this image | +| .SharedSize | Always seems to be 0 | +| .Size | Size of layer on disk (human-friendly string) | +| .Tag | Image tag | +| .VirtualSize | Size of layer on disk (bytes) | + +#### **--history** + +Display the history of image names. If an image gets re-tagged or untagged, then the image name history gets prepended (latest image first). This is especially useful when undoing a tag operation or an image does not contain any name because it has been untagged. + + +[//]: # (BEGIN included file options/no-trunc.md) +#### **--no-trunc** + +Do not truncate the output (default *false*). + +[//]: # (END included file options/no-trunc.md) + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Lists only the image IDs. + +#### **--sort**=*sort* + +Sort by *created*, *id*, *repository*, *size* or *tag* (default: **created**) +When sorting by *repository* it also sorts by the *tag* as second criteria to provide a stable output. + +## EXAMPLE + +List all non-dangling images in local storage: +``` +$ podman images +REPOSITORY TAG IMAGE ID CREATED SIZE +quay.io/podman/stable latest e0b7dabc3352 22 hours ago 331 MB +docker.io/library/alpine latest 9c6f07244728 5 days ago 5.83 MB +registry.fedoraproject.org/fedora latest 2ecb6df95994 3 weeks ago 169 MB +quay.io/libpod/testimage 20220615 f26aa69bb3f3 2 months ago 8.4 MB +``` + +List all images matching the specified name: +``` +$ podman images stable +REPOSITORY TAG IMAGE ID CREATED SIZE +quay.io/podman/stable latest e0b7dabc3352 22 hours ago 331 MB +``` + +List image ids of all images in containers storage: +``` +# podman image ls --quiet +e3d42bcaf643 +ebb91b73692b +4526339ae51c +``` + +List all images without showing the headers: +``` +# podman images --noheading +docker.io/kubernetes/pause latest e3d42bcaf643 3 years ago 251 kB + ebb91b73692b 4 weeks ago 27.2 MB +docker.io/library/ubuntu latest 4526339ae51c 6 weeks ago 126 MB +``` + +List all images without truncating output: +``` +# podman image list --no-trunc +REPOSITORY TAG IMAGE ID CREATED SIZE +docker.io/kubernetes/pause latest sha256:e3d42bcaf643097dd1bb0385658ae8cbe100a80f773555c44690d22c25d16b27 3 years ago 251 kB + sha256:ebb91b73692bd27890685846412ae338d13552165eacf7fcd5f139bfa9c2d6d9 4 weeks ago 27.2 MB +docker.io/library/ubuntu latest sha256:4526339ae51c3cdc97956a7a961c193c39dfc6bd9733b0d762a36c6881b5583a 6 weeks ago 126 MB +``` + +List all image content with the formatted content: +``` +# podman images --format "table {{.ID}} {{.Repository}} {{.Tag}}" +IMAGE ID REPOSITORY TAG +e3d42bcaf643 docker.io/kubernetes/pause latest +ebb91b73692b +4526339ae51c docker.io/library/ubuntu latest +``` + +List any image that is not tagged with a name (dangling): +``` +# podman images --filter dangling=true +REPOSITORY TAG IMAGE ID CREATED SIZE + ebb91b73692b 4 weeks ago 27.2 MB +``` + +List all images in JSON format: +``` +# podman images --format json +[ + { + "id": "e3d42bcaf643097dd1bb0385658ae8cbe100a80f773555c44690d22c25d16b27", + "names": [ + "docker.io/kubernetes/pause:latest" + ], + "digest": "sha256:0aecf73ff86844324847883f2e916d3f6984c5fae3c2f23e91d66f549fe7d423", + "created": "2014-07-19T07:02:32.267701596Z", + "size": 250665 + }, + { + "id": "ebb91b73692bd27890685846412ae338d13552165eacf7fcd5f139bfa9c2d6d9", + "names": [ + "\u003cnone\u003e" + ], + "digest": "sha256:ba7e4091d27e8114a205003ca6a768905c3395d961624a2c78873d9526461032", + "created": "2017-10-26T03:07:22.796184288Z", + "size": 27170520 + }, + { + "id": "4526339ae51c3cdc97956a7a961c193c39dfc6bd9733b0d762a36c6881b5583a", + "names": [ + "docker.io/library/ubuntu\:latest" + ], + "digest": "sha256:193f7734ddd68e0fb24ba9af8c2b673aecb0227b026871f8e932dab45add7753", + "created": "2017-10-10T20:59:05.10196344Z", + "size": 126085200 + } +] +``` + +List all images sorted by the specified column: +``` +# podman images --sort repository +REPOSITORY TAG IMAGE ID CREATED SIZE + 2460217d76fc About a minute ago 4.41 MB +docker.io/library/alpine latest 3fd9065eaf02 5 months ago 4.41 MB +localhost/myapp latest b2e0ad03474a About a minute ago 4.41 MB +registry.access.redhat.com/rhel7 latest 7a840db7f020 2 weeks ago 211 MB +registry.fedoraproject.org/fedora 27 801894bc0e43 6 weeks ago 246 MB +``` + +Show the difference between listed images in use versus all images, including dangling images: +``` +# podman images +REPOSITORY TAG IMAGE ID CREATED SIZE +localhost/test latest 18f0c080cd72 4 seconds ago 4.42 MB +docker.io/library/alpine latest 3fd9065eaf02 5 months ago 4.41 MB +# podman images -a +REPOSITORY TAG IMAGE ID CREATED SIZE +localhost/test latest 18f0c080cd72 6 seconds ago 4.42 MB + 270e70dc54c0 7 seconds ago 4.42 MB + 4ed6fbe43414 8 seconds ago 4.41 MB + 6b0df8e71508 8 seconds ago 4.41 MB +docker.io/library/alpine latest 3fd9065eaf02 5 months ago 4.41 MB +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +March 2017, Originally compiled by Dan Walsh `` diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-import.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-import.1.md new file mode 100644 index 000000000..fc1fde333 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-import.1.md @@ -0,0 +1,121 @@ +--- +title: podman-import +version: v5.5.2 +--- + +% podman-import 1 + +## NAME +podman\-import - Import a tarball and save it as a filesystem image + +## SYNOPSIS +**podman import** [*options*] *path* [*reference*] + +**podman image import** [*options*] *path* [*reference*] + +## DESCRIPTION +**podman import** imports a tarball (possibly compressed using Gzip, Bzip2, XZ or Zstd) +and saves it as a filesystem image. Remote tarballs can be specified using a URL. +Various image instructions can be configured with the **--change** flag and +a commit message can be set using the **--message** flag. +**reference**, if present, is a tag to assign to the image. +**podman import** is used for importing from the archive generated by **podman export**, that includes the container's filesystem. To import the archive of image layers created by **podman save**, use **podman load**. +Note: `:` is a restricted character and cannot be part of the file name. + +## OPTIONS + +#### **--arch** + +Set architecture of the imported image. + +#### **--change**, **-c**=*instruction* + +Apply the following possible instructions to the created image: +**CMD** | **ENTRYPOINT** | **ENV** | **EXPOSE** | **LABEL** | **STOPSIGNAL** | **USER** | **VOLUME** | **WORKDIR** + +Can be set multiple times + +#### **--help**, **-h** + +Print usage statement + +#### **--message**, **-m**=*message* + +Set commit message for imported image + +#### **--os** + +Set OS of the imported image. + +#### **--quiet**, **-q** + +Shows progress on the import + +#### **--variant** + +Set variant of the imported image. + +## EXAMPLES + +Import the selected tarball into new image, specifying the CMD, ENTRYPOINT and LABEL: +``` +$ podman import --change CMD=/bin/bash --change ENTRYPOINT=/bin/sh --change LABEL=blue=image ctr.tar image-imported +Getting image source signatures +Copying blob sha256:b41deda5a2feb1f03a5c1bb38c598cbc12c9ccd675f438edc6acd815f7585b86 + 25.80 MB / 25.80 MB [======================================================] 0s +Copying config sha256:c16a6d30f3782288ec4e7521c754acc29d37155629cb39149756f486dae2d4cd + 448 B / 448 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +db65d991f3bbf7f31ed1064db9a6ced7652e3f8166c4736aa9133dadd3c7acb3 +``` + +Import the selected tarball into new image, specifying the CMD, ENTRYPOINT and LABEL: +``` +$ podman import --change 'ENTRYPOINT ["/bin/sh","-c","test-image"]' --change LABEL=blue=image test-image.tar image-imported +Getting image source signatures +Copying blob e3b0c44298fc skipped: already exists +Copying config 1105523502 done +Writing manifest to image destination +Storing signatures +110552350206337183ceadc0bdd646dc356e06514c548b69a8917b4182414b +``` + +Import new tagged image from stdin in quiet mode: +``` +$ cat ctr.tar | podman -q import --message "importing the ctr.tar file" - image-imported +db65d991f3bbf7f31ed1064db9a6ced7652e3f8166c4736aa9133dadd3c7acb3 +``` + +Import an image from stdin: +``` +$ cat ctr.tar | podman import - +Getting image source signatures +Copying blob sha256:b41deda5a2feb1f03a5c1bb38c598cbc12c9ccd675f438edc6acd815f7585b86 + 25.80 MB / 25.80 MB [======================================================] 0s +Copying config sha256:d61387b4d5edf65edee5353e2340783703074ffeaaac529cde97a8357eea7645 + 378 B / 378 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +db65d991f3bbf7f31ed1064db9a6ced7652e3f8166c4736aa9133dadd3c7acb3 +``` + +Import named image from tarball via a URL: +``` +$ podman import http://example.com/ctr.tar url-image +Downloading from "http://example.com/ctr.tar" +Getting image source signatures +Copying blob sha256:b41deda5a2feb1f03a5c1bb38c598cbc12c9ccd675f438edc6acd815f7585b86 + 25.80 MB / 25.80 MB [======================================================] 0s +Copying config sha256:5813fe8a3b18696089fd09957a12e88bda43dc1745b5240879ffffe93240d29a + 419 B / 419 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +db65d991f3bbf7f31ed1064db9a6ced7652e3f8166c4736aa9133dadd3c7acb3 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-export(1)](podman-export.1.md)** + +## HISTORY +November 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-info.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-info.1.md new file mode 100644 index 000000000..d17bb89d9 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-info.1.md @@ -0,0 +1,409 @@ +--- +title: podman-info +version: v5.5.2 +--- + +% podman-info 1 + +## NAME +podman\-info - Display Podman related system information + +## SYNOPSIS +**podman info** [*options*] + +**podman system info** [*options*] + +## DESCRIPTION + +Displays information pertinent to the host, current storage stats, configured container registries, and build of podman. + + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change output format to "json" or a Go template. + +| **Placeholder** | **Info pertaining to ...** | +| ------------------- | --------------------------------------- | +| .Host ... | ...the host on which podman is running | +| .Plugins ... | ...external plugins | +| .Registries ... | ...configured registries | +| .Store ... | ...the storage driver and paths | +| .Version ... | ...podman version | + +Each of the above branch out into further subfields, more than can +reasonably be enumerated in this document. + +## EXAMPLES + +Run `podman info` for a YAML formatted response: +``` +$ podman info +host: + arch: amd64 + buildahVersion: 1.23.0 + cgroupControllers: [] + cgroupManager: systemd + cgroupVersion: v2 + conmon: + package: conmon-2.0.29-2.fc34.x86_64 + path: /usr/bin/conmon + version: 'conmon version 2.0.29, commit: ' + cpu_utilization: + idle_percent: 96.84 + system_percent: 0.71 + user_percent: 2.45 + cpus: 8 + distribution: + distribution: fedora + variant: workstation + version: "34" + eventLogger: journald + hostname: localhost.localdomain + idMappings: + gidmap: + - container_id: 0 + host_id: 3267 + size: 1 + - container_id: 1 + host_id: 100000 + size: 65536 + uidmap: + - container_id: 0 + host_id: 3267 + size: 1 + - container_id: 1 + host_id: 100000 + size: 65536 + kernel: 5.13.13-200.fc34.x86_64 + linkmode: dynamic + logDriver: journald + memFree: 1833385984 + memTotal: 16401895424 + networkBackend: cni + networkBackendInfo: + backend: cni + dns: + package: podman-plugins-3.4.4-1.fc34.x86_64 + path: /usr/libexec/cni/dnsname + version: |- + CNI dnsname plugin + version: 1.3.1 + commit: unknown + package: |- + containernetworking-plugins-1.0.1-1.fc34.x86_64 + podman-plugins-3.4.4-1.fc34.x86_64 + path: /usr/libexec/cni + ociRuntime: + name: crun + package: crun-1.0-1.fc34.x86_64 + path: /usr/bin/crun + version: |- + crun version 1.0 + commit: 139dc6971e2f1d931af520188763e984d6cdfbf8 + spec: 1.0.0 + +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL + os: linux + pasta: + executable: /usr/bin/passt + package: passt-0^20221116.gace074c-1.fc34.x86_64 + version: | + passt 0^20221116.gace074c-1.fc34.x86_64 + Copyright Red Hat + GNU Affero GPL version 3 or later + This is free software: you are free to change and redistribute it. + There is NO WARRANTY, to the extent permitted by law. + remoteSocket: + path: /run/user/3267/podman/podman.sock + security: + apparmorEnabled: false + capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID + rootless: true + seccompEnabled: true + seccompProfilePath: /usr/share/containers/seccomp.json + selinuxEnabled: true + serviceIsRemote: false + slirp4netns: + executable: /bin/slirp4netns + package: slirp4netns-1.1.12-2.fc34.x86_64 + version: |- + slirp4netns version 1.1.12 + commit: 7a104a101aa3278a2152351a082a6df71f57c9a3 + libslirp: 4.4.0 + SLIRP_CONFIG_VERSION_MAX: 3 + libseccomp: 2.5.0 + swapFree: 15687475200 + swapTotal: 16886259712 + uptime: 47h 15m 9.91s (Approximately 1.96 days) +plugins: + log: + - k8s-file + - none + - journald + network: + - bridge + - macvlan + volume: + - local +registries: + search: + - registry.fedoraproject.org + - registry.access.redhat.com + - docker.io + - quay.io +store: + configFile: /home/dwalsh/.config/containers/storage.conf + containerStore: + number: 9 + paused: 0 + running: 1 + stopped: 8 + graphDriverName: overlay + graphOptions: {} + graphRoot: /home/dwalsh/.local/share/containers/storage + graphRootAllocated: 510389125120 + graphRootUsed: 129170714624 + graphStatus: + Backing Filesystem: extfs + Native Overlay Diff: "true" + Supports d_type: "true" + Using metacopy: "false" + imageCopyTmpDir: /home/dwalsh/.local/share/containers/storage/tmp + imageStore: + number: 5 + runRoot: /run/user/3267/containers + transientStore: false + volumePath: /home/dwalsh/.local/share/containers/storage/volumes +version: + APIVersion: 4.0.0 + Built: 1631648722 + BuiltTime: Tue Sep 14 15:45:22 2021 + GitCommit: 23677f92dd83e96d2bc8f0acb611865fb8b1a56d + GoVersion: go1.16.6 + OsArch: linux/amd64 + Version: 4.0.0 +``` + +Run `podman info --format json` for a JSON formatted response: +``` +$ podman info --format json +{ + "host": { + "arch": "amd64", + "buildahVersion": "1.23.0", + "cgroupManager": "systemd", + "cgroupVersion": "v2", + "cgroupControllers": [], + "conmon": { + "package": "conmon-2.0.29-2.fc34.x86_64", + "path": "/usr/bin/conmon", + "version": "conmon version 2.0.29, commit: " + }, + "cpus": 8, + "distribution": { + "distribution": "fedora", + "version": "34" + }, + "eventLogger": "journald", + "hostname": "localhost.localdomain", + "idMappings": { + "gidmap": [ + { + "container_id": 0, + "host_id": 3267, + "size": 1 + }, + { + "container_id": 1, + "host_id": 100000, + "size": 65536 + } + ], + "uidmap": [ + { + "container_id": 0, + "host_id": 3267, + "size": 1 + }, + { + "container_id": 1, + "host_id": 100000, + "size": 65536 + } + ] + }, + "kernel": "5.13.13-200.fc34.x86_64", + "logDriver": "journald", + "memFree": 1785753600, + "memTotal": 16401895424, + "networkBackend": "cni", + "networkBackendInfo": { + "backend": "cni", + "package": "containernetworking-plugins-1.0.1-1.fc34.x86_64\npodman-plugins-3.4.4-1.fc34.x86_64", + "path": "/usr/libexec/cni", + "dns": { + "version": "CNI dnsname plugin\nversion: 1.3.1\ncommit: unknown", + "package": "podman-plugins-3.4.4-1.fc34.x86_64", + "path": "/usr/libexec/cni/dnsname" + } + }, + "ociRuntime": { + "name": "crun", + "package": "crun-1.0-1.fc34.x86_64", + "path": "/usr/bin/crun", + "version": "crun version 1.0\ncommit: 139dc6971e2f1d931af520188763e984d6cdfbf8\nspec: 1.0.0\n+SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL" + }, + "os": "linux", + "remoteSocket": { + "path": "/run/user/3267/podman/podman.sock" + }, + "serviceIsRemote": false, + "security": { + "apparmorEnabled": false, + "capabilities": "CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID", + "rootless": true, + "seccompEnabled": true, + "seccompProfilePath": "/usr/share/containers/seccomp.json", + "selinuxEnabled": true + }, + "slirp4netns": { + "executable": "/bin/slirp4netns", + "package": "slirp4netns-1.1.12-2.fc34.x86_64", + "version": "slirp4netns version 1.1.12\ncommit: 7a104a101aa3278a2152351a082a6df71f57c9a3\nlibslirp: 4.4.0\nSLIRP_CONFIG_VERSION_MAX: 3\nlibseccomp: 2.5.0" + }, + "pasta": { + "executable": "/usr/bin/passt", + "package": "passt-0^20221116.gace074c-1.fc34.x86_64", + "version": "passt 0^20221116.gace074c-1.fc34.x86_64\nCopyright Red Hat\nGNU Affero GPL version 3 or later \u003chttps://www.gnu.org/licenses/agpl-3.0.html\u003e\nThis is free software: you are free to change and redistribute it.\nThere is NO WARRANTY, to the extent permitted by law.\n" + }, + "swapFree": 15687475200, + "swapTotal": 16886259712, + "uptime": "47h 17m 29.75s (Approximately 1.96 days)", + "linkmode": "dynamic" + }, + "store": { + "configFile": "/home/dwalsh/.config/containers/storage.conf", + "containerStore": { + "number": 9, + "paused": 0, + "running": 1, + "stopped": 8 + }, + "graphDriverName": "overlay", + "graphOptions": { + + }, + "graphRoot": "/home/dwalsh/.local/share/containers/storage", + "graphStatus": { + "Backing Filesystem": "extfs", + "Native Overlay Diff": "true", + "Supports d_type": "true", + "Using metacopy": "false" + }, + "imageCopyTmpDir": "/home/dwalsh/.local/share/containers/storage/tmp", + "imageStore": { + "number": 5 + }, + "runRoot": "/run/user/3267/containers", + "volumePath": "/home/dwalsh/.local/share/containers/storage/volumes", + "transientStore": false + }, + "registries": { + "search": [ + "registry.fedoraproject.org", + "registry.access.redhat.com", + "docker.io", + "quay.io" +] + }, + "plugins": { + "volume": [ + "local" + ], + "network": [ + "bridge", + "macvlan" + ], + "log": [ + "k8s-file", + "none", + "journald" + ] + }, + "version": { + "APIVersion": "4.0.0", + "Version": "4.0.0", + "GoVersion": "go1.16.6", + "GitCommit": "23677f92dd83e96d2bc8f0acb611865fb8b1a56d", + "BuiltTime": "Tue Sep 14 15:45:22 2021", + "Built": 1631648722, + "OsArch": "linux/amd64" + } +} +``` + +#### Extracting the list of container registries with a Go template + +If shell completion is enabled, type `podman info --format={{.` and then press `[TAB]` twice. + +``` +$ podman info --format={{. +{{.Host. {{.Plugins. {{.Registries}} {{.Store. {{.Version. +``` + +Press `R` `[TAB]` `[ENTER]` to print the registries information. + +``` +$ podman info -f {{.Registries}} +map[search:[registry.fedoraproject.org registry.access.redhat.com docker.io quay.io]] +$ +``` + +The output still contains a map and an array. The map value can be extracted with + +``` +$ podman info -f '{{index .Registries "search"}}' +[registry.fedoraproject.org registry.access.redhat.com docker.io quay.io] +``` + +The array can be printed as one entry per line + +``` +$ podman info -f '{{range index .Registries "search"}}{{.}}\n{{end}}' +registry.fedoraproject.org +registry.access.redhat.com +docker.io +quay.io + +``` + +#### Extracting the list of container registries from JSON with jq + +The command-line JSON processor [__jq__](https://stedolan.github.io/jq/) can be used to extract the list +of container registries. + +``` +$ podman info -f json | jq '.registries["search"]' +[ + "registry.fedoraproject.org", + "registry.access.redhat.com", + "docker.io", + "quay.io" +] +``` + +The array can be printed as one entry per line + +``` +$ podman info -f json | jq -r '.registries["search"] | .[]' +registry.fedoraproject.org +registry.access.redhat.com +docker.io +quay.io +``` + +Note, the Go template struct fields start with upper case. When running `podman info` or `podman info --format=json`, the same names start with lower case. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-init.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-init.1.md new file mode 100644 index 000000000..edbc21bdb --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-init.1.md @@ -0,0 +1,61 @@ +--- +title: podman-init +version: v5.5.2 +--- + +% podman-init 1 + +## NAME +podman\-init - Initialize one or more containers + +## SYNOPSIS +**podman init** [*options*] *container* [*container*...] + +**podman container init** [*options*] *container* [*container*...] + +## DESCRIPTION +Initialize one or more containers. +You may use container IDs or names as input. +Initializing a container performs all tasks necessary for starting the container (mounting filesystems, creating an OCI spec, initializing the container network) but does not start the container. +If a container is not initialized, the `podman start` and `podman run` commands initialize it automatically prior to starting it. +This command is intended to be used for inspecting a container's filesystem or OCI spec prior to starting it. +This can be used to inspect the container before it runs, or debug why a container is failing to run. + +## OPTIONS + +#### **--all**, **-a** + +Initialize all containers. Containers that have already initialized (including containers that have been started and are running) are ignored. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Initialize specified container with a given ID. +``` +podman init 35480fc9d568 +``` + +Initialize specified container with a given name. +``` +podman init test1 +``` + +Initialize the latest container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +podman init --latest +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-start(1)](podman-start.1.md)** + +## HISTORY +April 2019, Originally compiled by Matthew Heon diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-inspect.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-inspect.1.md new file mode 100644 index 000000000..2a43747cd --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-inspect.1.md @@ -0,0 +1,185 @@ +--- +title: podman-inspect +version: v5.5.2 +--- + +% podman-inspect 1 + +## NAME +podman\-inspect - Display a container, image, volume, network, or pod's configuration + +## SYNOPSIS +**podman inspect** [*options*] *name* [...] + +## DESCRIPTION + +This displays the low-level information on containers and images identified by name or ID. By default, this renders +all results in a JSON array. If the inspect type is all, the order of inspection is: containers, images, volumes, network, pods. + If a container has the same name as an image, then the container JSON is returned, and so on. + If a format is specified, the given template is executed for each result. + +For more inspection options, see also +[podman-container-inspect(1)](podman-container-inspect.1.md), +[podman-image-inspect(1)](podman-image-inspect.1.md), +[podman-network-inspect(1)](podman-network-inspect.1.md), +[podman-pod-inspect(1)](podman-pod-inspect.1.md), and +[podman-volume-inspect(1)](podman-volume-inspect.1.md). + +## OPTIONS + +#### **--format**, **-f**=*format* + +Format the output using the given Go template. +The keys of the returned JSON can be used as the values for the --format flag (see examples below). + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--size**, **-s** + +In addition to normal output, display the total file size if the type is a container. + +#### **--type**, **-t**=*type* + +Return JSON for the specified type. Type can be 'container', 'image', 'volume', 'network', 'pod', or 'all' (default: all) +(Only meaningful when invoked as *podman inspect*) + +## EXAMPLE + +Inspect the fedora image: +``` +# podman inspect fedora +[ + { + "Id": "f0858ad3febdf45bb2e5501cb459affffacef081f79eaa436085c3b6d9bd46ca", + "Digest": "sha256:d4f7df6b691d61af6cee7328f82f1d8afdef63bc38f58516858ae3045083924a", + "RepoTags": [ + "docker.io/library/fedora:latest" + ], + "RepoDigests": [ + "docker.io/library/fedora@sha256:8fa60b88e2a7eac8460b9c0104b877f1aa0cea7fbc03c701b7e545dacccfb433", + "docker.io/library/fedora@sha256:d4f7df6b691d61af6cee7328f82f1d8afdef63bc38f58516858ae3045083924a" + ], + "Parent": "", + "Comment": "", + "Created": "2019-10-29T03:23:37.695123423Z", + "Config": { + "Env": [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "DISTTAG=f31-updates-candidatecontainer", + "FGC=f31-updates-candidate", + "FBR=f31-updates-candidate" + ], + "Cmd": [ + "/bin/bash" + ], + "Labels": { + "maintainer": "Clement Verna \u003ccverna@fedoraproject.org\u003e" + } + }, + "Version": "18.06.1-ce", + "Author": "", + "Architecture": "amd64", + "Os": "linux", + "Size": 201096840, + "VirtualSize": 201096840, + "GraphDriver": { + "Name": "overlay", + "Data": { + "UpperDir": "/home/user/.local/share/containers/storage/overlay/2ae3cee18c8ef9e0d448649747dab81c4f1ca2714a8c4550eff49574cab262c9/diff", + "WorkDir": "/home/user/.local/share/containers/storage/overlay/2ae3cee18c8ef9e0d448649747dab81c4f1ca2714a8c4550eff49574cab262c9/work" + } + }, + "RootFS": { + "Type": "layers", + "Layers": [ + "sha256:2ae3cee18c8ef9e0d448649747dab81c4f1ca2714a8c4550eff49574cab262c9" + ] + }, + "Labels": { + "maintainer": "Clement Verna \u003ccverna@fedoraproject.org\u003e" + }, + "Annotations": {}, + "ManifestType": "application/vnd.docker.distribution.manifest.v2+json", + "User": "", + "History": [ + { + "created": "2019-01-16T21:21:55.569693599Z", + "created_by": "/bin/sh -c #(nop) LABEL maintainer=Clement Verna \u003ccverna@fedoraproject.org\u003e", + "empty_layer": true + }, + { + "created": "2019-09-27T21:21:07.784469821Z", + "created_by": "/bin/sh -c #(nop) ENV DISTTAG=f31-updates-candidatecontainer FGC=f31-updates-candidate FBR=f31-updates-candidate", + "empty_layer": true + }, + { + "created": "2019-10-29T03:23:37.355187998Z", + "created_by": "/bin/sh -c #(nop) ADD file:298f828afc880ccde9205fc4418435d5e696ad165e283f0530d0b1a74326d6dc in / " + }, + { + "created": "2019-10-29T03:23:37.695123423Z", + "created_by": "/bin/sh -c #(nop) CMD [\"/bin/bash\"]", + "empty_layer": true + } + ], + "NamesHistory": [] + } +] +``` + +Inspect the specified image with the `ImageName` format specifier: +``` +# podman inspect a04 --format "{{.ImageName}}" +fedora +``` + +Inspect the specified image for `GraphDriver` format specifier: +``` +# podman inspect a04 --format "{{.GraphDriver.Name}}" +overlay +``` + +Inspect the specified image for its `Size` format specifier: +``` +# podman image inspect --format "size: {{.Size}}" alpine +size: 4405240 +``` + +Inspect the latest container created for `EffectiveCaps` format specifier. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman container inspect --latest --format {{.EffectiveCaps}} +[CAP_CHOWN CAP_DAC_OVERRIDE CAP_FSETID CAP_FOWNER CAP_SETGID CAP_SETUID CAP_SETFCAP CAP_SETPCAP CAP_NET_BIND_SERVICE CAP_KILL] +``` + +Inspect the specified pod for the `Name` format specifier: +``` +# podman inspect myPod --type pod --format "{{.Name}}" +myPod +``` + +Inspect the specified volume for the `Name` format specifier: +``` +# podman inspect myVolume --type volume --format "{{.Name}}" +myVolume +``` + +Inspect the specified network for the `Name` format specifier: +``` +# podman inspect nyNetwork --type network --format "{{.name}}" +myNetwork +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container-inspect(1)](podman-container-inspect.1.md)**, **[podman-image-inspect(1)](podman-image-inspect.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-pod-inspect(1)](podman-pod-inspect.1.md)**, **[podman-volume-inspect(1)](podman-volume-inspect.1.md)** + +## HISTORY +July 2017, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-kill.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-kill.1.md new file mode 100644 index 000000000..aea298bdd --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-kill.1.md @@ -0,0 +1,91 @@ +--- +title: podman-kill +version: v5.5.2 +--- + +% podman-kill 1 + +## NAME +podman\-kill - Kill the main process in one or more containers + +## SYNOPSIS +**podman kill** [*options*] [*container* ...] + +**podman container kill** [*options*] [*container* ...] + +## DESCRIPTION +The main process inside each container specified is sent SIGKILL or any signal specified with the `--signal` option. + +## OPTIONS +#### **--all**, **-a** + +Signal all running and paused containers. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and kill the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/signal.md) +#### **--signal**, **-s**=**signal** + +Signal to send to the container. For more information on Linux signals, refer to *signal(7)*. +The default is **SIGKILL**. + +[//]: # (END included file options/signal.md) + +## EXAMPLE + +Kill container with a given name: +``` +podman kill mywebserver +``` + +Kill container with a given ID: +``` +podman kill 860a4b23 +``` + +Terminate container by sending `TERM` signal: +``` +podman kill --signal TERM 860a4b23 +``` + +Kill the latest container. (This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines): +``` +podman kill --latest +``` + +Terminate all containers by sending `KILL` signal: +``` +podman kill --signal KILL -a +``` + +Kill containers using ID specified in a given files: +``` +podman kill --cidfile /home/user/cidfile-1 +podman kill --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-stop(1)](podman-stop.1.md)** + +## HISTORY +September 2017, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-kube-apply.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-kube-apply.1.md new file mode 100644 index 000000000..346ba477f --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-kube-apply.1.md @@ -0,0 +1,79 @@ +--- +title: podman-kube-apply +version: v5.5.2 +--- + +% podman-kube-apply 1 + +## NAME +podman-kube-apply - Apply Kubernetes YAML based on containers, pods, or volumes to a Kubernetes cluster + +## SYNOPSIS +**podman kube apply** [*options*] [*container...* | *pod...* | *volume...*] + +## DESCRIPTION +**podman kube apply** deploys a podman container, pod, or volume to a Kubernetes cluster. Use the `--file` option to deploy a Kubernetes YAML (v1 specification) to a Kubernetes cluster as well. + +Note that the Kubernetes YAML file can be used to run the deployment in Podman via podman-play-kube(1). + +## OPTIONS + +#### **--ca-cert-file**=*ca cert file path | "insecure"* + +The path to the CA cert file for the Kubernetes cluster. Usually the kubeconfig has the CA cert file data and `generate kube` automatically picks that up if it is available in the kubeconfig. If no CA cert file data is available, set this to `insecure` to bypass the certificate verification. + +#### **--file**, **-f**=*kube yaml filepath* + +Path to the kubernetes yaml file to deploy onto the kubernetes cluster. This file can be generated using the `podman kube generate` command. The input may be in the form of a yaml file, or stdin. For stdin, use `--file=-`. + +#### **--kubeconfig**, **-k**=*kubeconfig filepath* + +Path to the kubeconfig file to be used when deploying the generated kube yaml to the Kubernetes cluster. The environment variable `KUBECONFIG` can be used to set the path for the kubeconfig file as well. +Note: A kubeconfig can have multiple cluster configurations, but `kube generate` always picks the first cluster configuration in the given kubeconfig. + +#### **--ns**=*namespace* + +The namespace or project to deploy the workloads of the generated kube yaml to in the Kubernetes cluster. + +#### **--service**, **-s** + +Used to create a service for the corresponding container or pod being deployed to the cluster. In particular, if the container or pod has portmap bindings, the service specification includes a NodePort declaration to expose the service. A random port is assigned by Podman in the service specification that is deployed to the cluster. + +## EXAMPLES + +Apply a podman volume and container to the "default" namespace in a Kubernetes cluster. +``` +$ podman kube apply --kubeconfig /tmp/kubeconfig myvol vol-test-1 +Deploying to cluster... +Successfully deployed workloads to cluster! +$ kubectl get pods +NAME READY STATUS RESTARTS AGE +vol-test-1-pod 1/1 Running 0 9m +``` + +Apply a Kubernetes YAML file to the "default" namespace in a Kubernetes cluster. +``` +$ podman kube apply --kubeconfig /tmp/kubeconfig -f vol.yaml +Deploying to cluster... +Successfully deployed workloads to cluster! +$ kubectl get pods +NAME READY STATUS RESTARTS AGE +vol-test-2-pod 1/1 Running 0 9m +``` + +Apply a Kubernetes YAML file to the "test1" namespace in a Kubernetes cluster. +``` +$ podman kube apply --kubeconfig /tmp/kubeconfig --ns test1 vol-test-3 +Deploying to cluster... +Successfully deployed workloads to cluster! +$ kubectl get pods --namespace test1 +NAME READY STATUS RESTARTS AGE +vol-test-3-pod 1/1 Running 0 9m + +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)** + +## HISTORY +September 2022, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-kube-down.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-kube-down.1.md new file mode 100644 index 000000000..a804c8ec6 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-kube-down.1.md @@ -0,0 +1,76 @@ +--- +title: podman-kube-down +version: v5.5.2 +--- + +% podman-kube-down 1 + +## NAME +podman-kube-down - Remove containers and pods based on Kubernetes YAML + +## SYNOPSIS +**podman kube down** [*options*] *file.yml|-|https://website.io/file.yml* + +## DESCRIPTION +**podman kube down** reads a specified Kubernetes YAML file, tearing down pods that were created by the `podman kube play` command via the same Kubernetes YAML +file. Any volumes that were created by the previous `podman kube play` command remain intact unless the `--force` options is used. If the YAML file is +specified as `-`, `podman kube down` reads the YAML from stdin. The input can also be a URL that points to a YAML file such as https://podman.io/demo.yml. +`podman kube down` tears down the pods and containers created by `podman kube play` via the same Kubernetes YAML from the URL. However, +`podman kube down` does not work with a URL if the YAML file the URL points to has been changed or altered since the creation of the pods and containers using +`podman kube play`. + +## OPTIONS + +#### **--force** + +Tear down the volumes linked to the PersistentVolumeClaims as part --down + +## EXAMPLES + +Example YAML file `demo.yml`: +``` +apiVersion: v1 +kind: Pod +metadata: +... +spec: + containers: + - command: + - top + - name: container + value: podman + image: foobar +... +``` + +Remove the pod and containers as described in the `demo.yml` file +``` +$ podman kube down demo.yml +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Remove the pod and containers as described in the `demo.yml` file YAML sent to stdin +``` +$ cat demo.yml | podman kube play - +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Remove the pods and containers as described in the `demo.yml` file YAML read from a URL +``` +$ podman kube down https://podman.io/demo.yml +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` +`podman kube down` does not work with a URL if the YAML file the URL points to has been changed +or altered since it was used to create the pods and containers. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-kube(1)](podman-kube.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-kube-generate.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-kube-generate.1.md new file mode 100644 index 000000000..e593e7f33 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-kube-generate.1.md @@ -0,0 +1,254 @@ +--- +title: podman-kube-generate +version: v5.5.2 +--- + +% podman-kube-generate 1 + +## NAME +podman-kube-generate - Generate Kubernetes YAML based on containers, pods or volumes + +## SYNOPSIS +**podman kube generate** [*options*] *container...* | *pod...* | *volume...* + +## DESCRIPTION +**podman kube generate** generates Kubernetes YAML (v1 specification) from Podman containers, pods or volumes. Regardless of whether +the input is for containers or pods, Podman generates the specification as a Pod by default. The input may be in the form +of one or more containers, pods or volumes names or IDs. + +`Podman Containers or Pods` + +Volumes appear in the generated YAML according to two different volume types. Bind-mounted volumes become *hostPath* volume types and named volumes become *persistentVolumeClaim* volume types. Generated *hostPath* volume types are one of three subtypes depending on the state of the host path: *DirectoryOrCreate* when no file or directory exists at the host, *Directory* when host path is a directory, or *File* when host path is a file. The value for *claimName* for a *persistentVolumeClaim* is the name of the named volume registered in Podman. + +Potential name conflicts between volumes are avoided by using a standard naming scheme for each volume type. The *hostPath* volume types are named according to the path on the host machine, replacing forward slashes with hyphens less any leading and trailing forward slashes. The special case of the filesystem root, `/`, translates to the name `root`. Additionally, the name is suffixed with `-host` to avoid naming conflicts with *persistentVolumeClaim* volumes. Each *persistentVolumeClaim* volume type uses the name of its associated named volume suffixed with `-pvc`. + +Note that if an init container is created with type `once` and the pod has been started, it does not show up in the generated kube YAML as `once` type init containers are deleted after they are run. If the pod has only been created and not started, it is in the generated kube YAML. +Init containers created with type `always` are always generated in the kube YAML as they are never deleted, even after running to completion. + +*Note*: When using volumes and generating a Kubernetes YAML for an unprivileged and rootless podman container on an **SELinux enabled system**, one of the following options must be completed: + * Add the "privileged: true" option to the pod spec + * Add `type: spc_t` under the `securityContext` `seLinuxOptions` in the pod spec + * Relabel the volume via the CLI command `chcon -t container_file_t -R ` + +Once completed, the correct permissions are in place to access the volume when the pod/container is created in a Kubernetes cluster. + +Note that the generated Kubernetes YAML file can be used to re-run the deployment via podman-play-kube(1). + +Note that if the pod being generated was created with the **--infra-name** flag set, then the generated kube yaml will have the **io.podman.annotations.infra.name** set where the value is the name of the infra container set by the user. + +Note that both Deployment and DaemonSet can only have `restartPolicy` set to `Always`. + +Note that Job can only have `restartPolicy` set to `OnFailure` or `Never`. By default, podman sets it to `Never` when generating a kube yaml using `kube generate`. + +## OPTIONS + +#### **--filename**, **-f**=*filename* + +Output to the given file instead of STDOUT. If the file already exists, `kube generate` refuses to replace it and returns an error. + +#### **--podman-only** + +Add podman-only reserved annotations in generated YAML file (Cannot be used by Kubernetes) + +#### **--replicas**, **-r**=*replica count* + +The value to set `replicas` to when generating a **Deployment** kind. +Note: this can only be set with the option `--type=deployment`. + +#### **--service**, **-s** + +Generate a Kubernetes service object in addition to the Pods. Used to generate a Service specification for the corresponding Pod output. In particular, if the object has portmap bindings, the service specification includes a NodePort declaration to expose the service. A random port is assigned by Podman in the specification. + +#### **--type**, **-t**=*pod* | *deployment* | *daemonset* | *job* + +The Kubernetes kind to generate in the YAML file. Currently, the only supported Kubernetes specifications are `Pod`, `Deployment`, `Job`, and `DaemonSet`. By default, the `Pod` specification is generated. + +## EXAMPLES + +Create Kubernetes Pod YAML for the specified container. +``` +$ podman kube generate some-mariadb +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-4.8.2 + +# NOTE: If you generated this yaml from an unprivileged and rootless podman container on an SELinux +# enabled system, check the podman generate kube man page for steps to follow to ensure that your pod/container +# has the right permissions to access the volumes added. +--- +apiVersion: v1 +kind: Pod +metadata: + creationTimestamp: "2024-01-09T02:24:55Z" + labels: + app: some-mariadb-pod + name: some-mariadb-pod +spec: + containers: + - args: + - mariadbd + env: + - name: MARIADB_ROOT_PASSWORD + value: x + image: docker.io/library/mariadb:10.11 + name: some-mariadb + ports: + - containerPort: 3306 + hostPort: 34891 + volumeMounts: + - mountPath: /var/lib/mysql + name: mariadb_data-pvc + volumes: + - name: mariadb_data-pvc + persistentVolumeClaim: + claimName: mariadb_data +``` + +Create Kubernetes Deployment YAML with 3 replicas for the specified container. +``` +$ podman kube generate --type deployment --replicas 3 dep-ct +r +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-4.5.0-dev +apiVersion: apps/v1 +kind: Deployment +metadata: + creationTimestamp: "2023-03-27T20:45:08Z" + labels: + app: dep-ctr-pod + name: dep-ctr-pod-deployment +spec: + replicas: 3 + selector: + matchLabels: + app: dep-ctr-pod + template: + metadata: + annotations: + io.podman.annotations.ulimit: nofile=524288:524288,nproc=127332:127332 + creationTimestamp: "2023-03-27T20:45:08Z" + labels: + app: dep-ctr-pod + name: dep-ctr-pod + spec: + containers: + - command: + - top + image: docker.io/library/alpine:latest + name: dep-ctr +``` + + +Create Kubernetes Pod YAML for the specified container with the host directory `/home/user/my-data` bind-mounted onto the container path `/volume`. +``` +$ podman kube generate my-container-with-bind-mounted-data +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-3.1.0-dev +apiVersion: v1 +kind: Pod +metadata: + creationTimestamp: "2021-03-18T16:26:08Z" + labels: + app: my-container-with-bind-mounted-data + name: my-container-with-bind-mounted-data +spec: + containers: + - command: + - /bin/sh + image: docker.io/library/alpine:latest + name: test-bind-mount + volumeMounts: + - mountPath: /volume + name: home-user-my-data-host + restartPolicy: Never + volumes: + - hostPath: + path: /home/user/my-data + type: Directory + name: home-user-my-data-host +``` + +Create Kubernetes Pod YAML for the specified container with named volume `priceless-data` mounted onto the container path `/volume`. +``` +$ podman kube generate my-container-using-priceless-data +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-3.1.0-dev +apiVersion: v1 +kind: Pod +metadata: + creationTimestamp: "2021-03-18T16:26:08Z" + labels: + app: my-container-using-priceless-data + name: my-container-using-priceless-data +spec: + containers: + - command: + - /bin/sh + image: docker.io/library/alpine:latest + name: test-bind-mount + volumeMounts: + - mountPath: /volume + name: priceless-data-pvc + restartPolicy: Never + volumes: + - name: priceless-data-pvc + persistentVolumeClaim: + claimName: priceless-data +``` + +Create Kubernetes Pod YAML for the specified pod and include a service. +``` +$ sudo podman kube generate -s demoweb +# Save the output of this file and use kubectl create -f to import +# it into Kubernetes. +# +# Created with podman-0.12.2-dev +apiVersion: v1 +kind: Pod +metadata: + creationTimestamp: 2018-12-18T15:16:06Z + labels: + app: demoweb + name: demoweb-libpod +spec: + containers: + - command: + - python3 + - /root/code/graph.py + image: quay.io/baude/demoweb:latest + name: practicalarchimedes + tty: true + workingDir: /root/code +--- +apiVersion: v1 +kind: Service +metadata: + creationTimestamp: 2018-12-18T15:16:06Z + labels: + app: demoweb + name: demoweb-libpod +spec: + ports: + - name: "8050" + nodePort: 31269 + port: 8050 + targetPort: 0 + selector: + app: demoweb + type: NodePort +status: + loadBalancer: {} +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-down(1)](podman-kube-down.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-kube-play.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-kube-play.1.md new file mode 100644 index 000000000..7cdbe6a27 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-kube-play.1.md @@ -0,0 +1,823 @@ +--- +title: podman-kube-play +version: v5.5.2 +--- + +% podman-kube-play 1 + +## NAME +podman-kube-play - Create containers, pods and volumes based on Kubernetes YAML + +## SYNOPSIS +**podman kube play** [*options*] *file.yml|-|https://website.io/file.yml* + +## DESCRIPTION +**podman kube play** reads in a structured file of Kubernetes YAML. It recreates the containers, pods, or volumes described in the YAML. Containers within a pod are then started, and the ID of the new Pod or the name of the new Volume is output. If the YAML file is specified as "-", then `podman kube play` reads the YAML file from stdin. +The input can also be a URL that points to a YAML file such as https://podman.io/demo.yml. `podman kube play` reads the YAML from the URL and create pods and containers from it. + +Using the `--down` command line option, it is also capable of tearing down the pods created by a previous run of `podman kube play`. + +Using the `--replace` command line option, it tears down the pods(if any) created by a previous run of `podman kube play` and recreate the pods with the Kubernetes YAML file. + +Ideally the input file is created by the Podman command (see podman-kube-generate(1)). This guarantees a smooth import and expected results. + +Currently, the supported Kubernetes kinds are: + +- Pod +- Deployment +- PersistentVolumeClaim +- ConfigMap +- Secret +- DaemonSet +- Job + +`Kubernetes Pods or Deployments` + +Only five volume types are supported by kube play, the *hostPath*, *emptyDir*, *configMap*, *persistentVolumeClaim*, and *image* volume types. + +- When using the *hostPath* volume type, only the *default (empty)*, *DirectoryOrCreate*, *Directory*, *FileOrCreate*, *File*, *Socket*, *CharDevice* and *BlockDevice* subtypes are supported. Podman interprets the value of *hostPath* *path* as a file path when it contains at least one forward slash, otherwise Podman treats the value as the name of a named volume. +- When using a *persistentVolumeClaim*, the value for *claimName* is the name for the Podman named volume. +- When using an *emptyDir* volume, Podman creates an anonymous volume that is attached the containers running inside the pod and is deleted once the pod is removed. +- When using an *configMap* volume, Podman creates an anonymous volume that is attached the containers running inside the pod and is deleted once the pod is removed. +- When using an *image* volume, Podman creates a read-only image volume with an empty subpath (the whole image is mounted). The image must already exist locally. It is supported in rootful mode only. + +Note: The default restart policy for containers is `always`. You can change the default by setting the `restartPolicy` field in the spec. + +Note: When playing a kube YAML with init containers, the init container is created with init type value `once`. To change the default type, use the `io.podman.annotations.init.container.type` annotation to set the type to `always`. + +Note: *hostPath* volume types created by kube play is given an SELinux shared label (z), bind mounts are not relabeled (use `chcon -t container_file_t -R `). + +Note: To set userns of a pod, use the **io.podman.annotations.userns** annotation in the pod/deployment definition. For example, **io.podman.annotations.userns=keep-id** annotation tells Podman to create a user namespace where the current rootless user's UID\:GID are mapped to the same values in the container. This can be overridden with the `--userns` flag. + +Note: Use the **io.podman.annotations.volumes-from** annotation to bind mount volumes of one container to another. You can mount volumes from multiple source containers to a target container. The source containers that belong to the same pod must be defined before the source container in the kube YAML. The annotation format is `io.podman.annotations.volumes-from/targetContainer: "sourceContainer1\:mountOpts1;sourceContainer2:mountOpts2"`. + +Note: If the `:latest` tag is used, Podman attempts to pull the image from a registry. If the image was built locally with Podman or Buildah, it has `localhost` as the domain, in that case, Podman uses the image from the local store even if it has the `\:latest` tag. + +Note: The command `podman play kube` is an alias of `podman kube play`, and performs the same function. + +Note: The command `podman kube down` can be used to stop and remove pods or containers based on the same Kubernetes YAML used +by `podman kube play` to create them. + +Note: To customize the name of the infra container created during `podman kube play`, use the **io.podman.annotations.infra.name** annotation in the pod definition. This annotation is automatically set when generating a kube yaml from a pod that was created with the `--infra-name` flag set. + +Note: Use the **io.podman.annotations.pids-limit/$ctrname** annotation to configure the pod's pids limit. + +`Kubernetes PersistentVolumeClaims` + +A Kubernetes PersistentVolumeClaim represents a Podman named volume. Only the PersistentVolumeClaim name is required by Podman to create a volume. Kubernetes annotations can be used to make use of the available options for Podman volumes. + +- volume.podman.io/driver +- volume.podman.io/device +- volume.podman.io/type +- volume.podman.io/uid +- volume.podman.io/gid +- volume.podman.io/mount-options +- volume.podman.io/import-source +- volume.podman.io/image + +Use `volume.podman.io/import-source` to import the contents of the tarball (.tar, .tar.gz, .tgz, .bzip, .tar.xz, .txz) specified in the annotation's value into the created Podman volume + +Kube play is capable of building images on the fly given the correct directory layout and Containerfiles. This +option is not available for remote clients, including Mac and Windows (excluding WSL2) machines, yet. Consider the following excerpt from a YAML file: +``` +apiVersion: v1 +kind: Pod +metadata: +... +spec: + containers: + - name: container + image: foobar +... +``` + +If there is a directory named `foobar` in the current working directory with a file named `Containerfile` or `Dockerfile`, +Podman kube play builds that image and name it `foobar`. An example directory structure for this example looks +like: +``` +|- mykubefiles + |- myplayfile.yaml + |- foobar + |- Containerfile +``` + +The build considers `foobar` to be the context directory for the build. If there is an image in local storage +called `foobar`, the image is not built unless the `--build` flag is used. Use `--build=false` to completely +disable builds. + +Kube play supports CDI (Container Device Interface) device selectors to share +host devices (e.g. GPUs) with containers. The configuration format follows +Kubernetes extended resource management: +``` +apiVersion: v1 +kind: Pod +spec: + containers: + - name: container + resources: + limits: + nvidia.com/gpu=all: 1 +``` + +To enable sharing host devices, analogous to using the `--device` flag Podman +kube supports a custom CDI selector: `podman.io/device=`. + +`Kubernetes ConfigMap` + +Kubernetes ConfigMap can be referred as a source of environment variables or volumes in Pods or Deployments. +ConfigMaps aren't a standalone object in Podman; instead, when a container uses a ConfigMap, Podman creates environment variables or volumes as needed. + +For example, the following YAML document defines a ConfigMap and then uses it in a Pod: + +``` +apiVersion: v1 +kind: ConfigMap +metadata: + name: foo +data: + FOO: bar +--- +apiVersion: v1 +kind: Pod +metadata: + name: foobar +spec: + containers: + - name: container-1 + image: foobar + envFrom: + - configMapRef: + name: foo + optional: false +``` + +and as a result environment variable `FOO` is set to `bar` for container `container-1`. + +`Kubernetes Secret` + +Kubernetes Secret represents a Podman named secret. The Kubernetes Secret is saved as a whole and may be referred to as a source of environment variables or volumes in Pods or Deployments. + +For example, the following YAML document defines a Secret and then uses it in a Pod: + +``` +kind: Secret +apiVersion: v1 +metadata: + name: foo +data: + foo: YmFy # base64 for bar +--- +apiVersion: v1 +kind: Pod +metadata: + name: foobar +spec: + containers: + - name: container-1 + image: foobar + env: + - name: FOO + valueFrom: + secretKeyRef: + name: foo + key: foo +``` + +and as a result environment variable `FOO` is set to `bar` for container `container-1`. + +`Automounting Volumes (deprecated)` + +Note: The automounting annotation is deprecated. Kubernetes has [native support for image volumes](https://kubernetes.io/docs/tasks/configure-pod-container/image-volumes/) and that should be used rather than this podman-specific annotation. + +An image can be automatically mounted into a container if the annotation `io.podman.annotations.kube.image.automount/$ctrname` is given. The following rules apply: + +- The image must already exist locally. +- The image must have at least 1 volume directive. +- The path given by the volume directive will be mounted from the image into the container. For example, an image with a volume at `/test/test_dir` will have `/test/test_dir` in the image mounted to `/test/test_dir` in the container. +- Multiple images can be specified. If multiple images have a volume at a specific path, the last image specified trumps. +- The images are always mounted read-only. +- Images to mount are defined in the annotation "io.podman.annotations.kube.image.automount/$ctrname" as a semicolon-separated list. They are mounted into a single container in the pod, not the whole pod. The annotation can be specified for additional containers if additional mounts are required. + +## OPTIONS + + +[//]: # (BEGIN included file options/annotation.container.md) +#### **--annotation**=*key=value* + +Add an annotation to the container or pod. This option can be set multiple times. + +[//]: # (END included file options/annotation.container.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + +#### **--build** + +Build images even if they are found in the local storage. Use `--build=false` to completely disable builds. (This option is not available with the remote Podman client) + +Note: You can also override the default isolation type by setting the BUILDAH_ISOLATION environment variable. export BUILDAH_ISOLATION=oci. See podman-build.1.md for more information. + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + +#### **--configmap**=*path* + +Use Kubernetes configmap YAML at path to provide a source for environment variable values within the containers of the pod. (This option is not available with the remote Podman client) + +Note: The *--configmap* option can be used multiple times or a comma-separated list of paths can be used to pass multiple Kubernetes configmap YAMLs. +The YAML file may be in a multi-doc YAML format. But, it must container only configmaps + +#### **--context-dir**=*path* + +Use *path* as the build context directory for each image. Requires --build option be true. (This option is not available with the remote Podman client) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + +#### **--force** + +Tear down the volumes linked to the PersistentVolumeClaims as part of --down + +#### **--help**, **-h** + +Print usage statement + +#### **--ip**=*IP address* + +Assign a static ip address to the pod. This option can be specified several times when kube play creates more than one pod. +Note: When joining multiple networks use the **--network name\:ip=\** syntax. + +#### **--log-driver**=*driver* + +Set logging driver for all created containers. + + +[//]: # (BEGIN included file options/log-opt.md) +#### **--log-opt**=*name=value* + +Logging driver specific options. + +Set custom logging configuration. The following *name*s are supported: + +**path**: specify a path to the log file + (e.g. **--log-opt path=/var/log/container/mycontainer.json**); + +**max-size**: specify a max size of the log file + (e.g. **--log-opt max-size=10mb**); + +**tag**: specify a custom log tag for the container + (e.g. **--log-opt tag="{{.ImageName}}"**. +It supports the same keys as **podman inspect --format**. +This option is currently supported only by the **journald** log driver. + +[//]: # (END included file options/log-opt.md) + +#### **--mac-address**=*MAC address* + +Assign a static mac address to the pod. This option can be specified several times when kube play creates more than one pod. +Note: When joining multiple networks use the **--network name\:mac=\** syntax. + + +[//]: # (BEGIN included file options/network.md) +#### **--network**=*mode*, **--net** + +Set the network mode for the pod. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + For better integration with DNS handling, **--dns-forward 169.254.1.1** is passed, + and this address is added to resolv.conf(5) as first resolver. It is possible to pass + **--dns-forward** explicitly in case a different IP address should be used. + To make the `host.containers.internal` /etc/hosts entry work and allow connections + to the host, **--map-guest-addr 169.254.1.2** is passed. Again, it can be set + explicitly to choose a different IP address. \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured (via Podman's + **--publish** or by passing the pasta **-t**/**-u** options directly), + to disable automatic port forwarding based on bound ports. Similarly, **-T none** + and **-U none** are given to disable the same functionality from container to + host. \ + All options can also be set in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**; + see the `pasta_options` key under the network section in that file. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.md) + +When no network option is specified and *host* network mode is not configured in the YAML file, a new network stack is created and pods are attached to it making possible pod to pod communication. + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the pod. + +Podman assumes control over the pod's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with host added in the Kubernetes YAML. + +#### **--publish**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Define or override a port definition in the YAML file. + +The lists of ports in the YAML file and the command line are merged. Matching is done by using the **containerPort** field. +If **containerPort** exists in both the YAML file and the option, the latter takes precedence. + +#### **--publish-all** + +Setting this option to `true` will expose all ports to the host, +even if only specified via **containerPort** in the K8 YAML. +In terms of which port will be exposed, **--publish** has higher priority than **hostPort**, has higher priority than +**containerPort**. + +If set to `false` (which is the default), only ports defined via **hostPort** +or **--publish** are published on the host. + +#### **--quiet**, **-q** + +Suppress output information when pulling images + +#### **--replace** + +Tears down the pods created by a previous run of `kube play` and recreates the pods. This option is used to keep the existing pods up to date based upon the Kubernetes YAML. + +#### **--seccomp-profile-root**=*path* + +Directory path for seccomp profiles (default: "/var/lib/kubelet/seccomp"). (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +#### **--start** + +Start the pod after creating it, set to false to only create it. + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/userns.container.md) +#### **--userns**=*mode* + +Set the user namespace mode for the container. + +If `--userns` is not set, the default value is determined as follows. +- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used. +- If the environment variable **PODMAN_USERNS** is set its value is used. +- If `userns` is specified in `containers.conf` this value is used. +- Otherwise, `--userns=host` is assumed. + +`--userns=""` (i.e., an empty string) is an alias for `--userns=host`. + +This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +------------------------|-----------|--------------------- +auto | $UID | nil (Host User UID is not mapped into container.) +host | $UID | 0 (Default User account mapped to root user in container.) +keep-id | $UID | $UID (Map user account to same UID within container.) +keep-id\:uid=200,gid=210 | $UID | 200:210 (Map user account to specified UID, GID value within container.) +nomap | $UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + +**auto**[\:_OPTIONS,..._]: automatically create a unique user namespace. + +* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. + + Example: `containers:2147483647:2147483648`. + +* `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5). + +Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user IDs. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. + +The option `--userns=keep-id` uses all the subuids and subgids of the user. +The option `--userns=nomap` uses all the subuids and subgids of the user except the user's own ID. +Using `--userns=auto` when starting new containers does not work as long as any containers exist that were started with `--userns=nomap` or `--userns=keep-id` without limiting the user namespace size. + + Valid `auto` options: + + - *gidmapping*=_CONTAINER\_GID\:HOST\_GID\:SIZE_: to force a GID mapping to be present in the user namespace. + - *size*=_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates a size for the user namespace. + - *uidmapping*=_CONTAINER\_UID\:HOST\_UID\:SIZE_: to force a UID mapping to be present in the user namespace. + +The host UID and GID in *gidmapping* and *uidmapping* can optionally be prefixed with the `@` symbol. +In this case, podman will look up the intermediate ID corresponding to host ID and it will map the found intermediate ID to the container id. +For details see **--uidmap**. + +**container:**_id_: join the user namespace of the specified container. + +**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user. + +**keep-id**: creates a user namespace where the current user's UID\:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace. + + Valid `keep-id` options: + + - *uid*=UID: override the UID inside the container that is used to map the current user to. + - *gid*=GID: override the GID inside the container that is used to map the current user to. + - *size*=SIZE: override the size of the configured user namespace. It is useful to not saturate all the available IDs. Not supported when running as root. + +**nomap**: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +**ns:**_namespace_: run the pod in the given existing user namespace. + +[//]: # (END included file options/userns.container.md) + +#### **--wait**, **-w** + +Run pods and containers in the foreground. Default is false. + +At any time you can run `podman pod ps` in another shell to view a list of +the running pods and containers. + +When attached in the tty mode, you can kill the pods and containers by pressing +Ctrl-C or receiving any other interrupt signals. + +All pods, containers, and volumes created with `podman kube play` is removed +upon exit. + +## EXAMPLES + +Recreate the pod and containers described in the specified host YAML file. +``` +$ podman kube play demo.yml +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Recreate the pod and containers specified in a YAML file sent to stdin. +``` +$ cat demo.yml | podman kube play - +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Tear down the pod and containers as described in the specified YAML file. +``` +$ podman kube play --down demo.yml +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Provide multiple configmap files as sources for environment variables within the specified pods and containers. +``` +$ podman kube play demo.yml --configmap configmap-foo.yml,configmap-bar.yml +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 + +$ podman kube play demo.yml --configmap configmap-foo.yml --configmap configmap-bar.yml +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` + +Create a pod connected to two networks with a static ip on each. +``` +$ podman kube play demo.yml --network net1\:ip=10.89.1.5 --network net2\:ip=10.89.10.10 +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` +Please take into account that networks must be created first using podman-network-create(1). + +Create and teardown from a URL pointing to a YAML file. +``` +$ podman kube play https://podman.io/demo.yml +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 + +$ podman kube play --down https://podman.io/demo.yml +Pods stopped: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +Pods removed: +52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 +``` +`podman kube play --down` does not work with a URL if the YAML file the URL points to +has been changed or altered. + + +[//]: # (BEGIN included file ../../kubernetes_support.md) +# Podman Kube Play Support + +This document outlines the kube yaml fields that are currently supported by the **podman kube play** command. + +Note: **N/A** means that the option cannot be supported in a single-node Podman environment. + +## Pod Fields + +| Field | Support | +|-----------------------------------------------------|---------| +| containers | ✅ | +| initContainers | ✅ | +| imagePullSecrets | no | +| enableServiceLinks | no | +| os\.name | no | +| volumes | ✅ | +| nodeSelector | N/A | +| nodeName | N/A | +| affinity\.nodeAffinity | N/A | +| affinity\.podAffinity | N/A | +| affinity\.podAntiAffinity | N/A | +| tolerations\.key | N/A | +| tolerations\.operator | N/A | +| tolerations\.effect | N/A | +| tolerations\.tolerationSeconds | N/A | +| schedulerName | N/A | +| runtimeClassName | no | +| priorityClassName | no | +| priority | no | +| topologySpreadConstraints\.maxSkew | N/A | +| topologySpreadConstraints\.topologyKey | N/A | +| topologySpreadConstraints\.whenUnsatisfiable | N/A | +| topologySpreadConstraints\.labelSelector | N/A | +| topologySpreadConstraints\.minDomains | N/A | +| restartPolicy | ✅ | +| terminationGracePeriodSeconds | ✅ | +| activeDeadlineSeconds | no | +| readinessGates\.conditionType | no | +| hostname | ✅ | +| setHostnameAsFQDN | no | +| subdomain | no | +| hostAliases\.hostnames | ✅ | +| hostAliases\.ip | ✅ | +| dnsConfig\.nameservers | ✅ | +| dnsConfig\.options\.name | ✅ | +| dnsConfig\.options\.value | ✅ | +| dnsConfig\.searches | ✅ | +| dnsPolicy | no | +| hostNetwork | ✅ | +| hostPID | ✅ | +| hostIPC | ✅ | +| shareProcessNamespace | ✅ | +| serviceAccountName | no | +| automountServiceAccountToken | no | +| securityContext\.runAsUser | ✅ | +| securityContext\.runAsNonRoot | no | +| securityContext\.runAsGroup | ✅ | +| securityContext\.supplementalGroups | ✅ | +| securityContext\.fsGroup | no | +| securityContext\.fsGroupChangePolicy | no | +| securityContext\.seccompProfile\.type | no | +| securityContext\.seccompProfile\.localhostProfile | no | +| securityContext\.seLinuxOptions\.level | ✅ | +| securityContext\.seLinuxOptions\.role | ✅ | +| securityContext\.seLinuxOptions\.type | ✅ | +| securityContext\.seLinuxOptions\.user | ✅ | +| securityContext\.sysctls\.name | ✅ | +| securityContext\.sysctls\.value | ✅ | +| securityContext\.windowsOptions\.gmsaCredentialSpec | no | +| securityContext\.windowsOptions\.hostProcess | no | +| securityContext\.windowsOptions\.runAsUserName | no | + +## Container Fields + +| Field | Support | +|-----------------------------------------------------|---------| +| name | ✅ | +| image | ✅ | +| imagePullPolicy | ✅ | +| command | ✅ | +| args | ✅ | +| workingDir | ✅ | +| ports\.containerPort | ✅ | +| ports\.hostIP | ✅ | +| ports\.hostPort | ✅ | +| ports\.name | ✅ | +| ports\.protocol | ✅ | +| env\.name | ✅ | +| env\.value | ✅ | +| env\.valueFrom\.configMapKeyRef\.key | ✅ | +| env\.valueFrom\.configMapKeyRef\.name | ✅ | +| env\.valueFrom\.configMapKeyRef\.optional | ✅ | +| env\.valueFrom\.fieldRef | ✅ | +| env\.valueFrom\.resourceFieldRef | ✅ | +| env\.valueFrom\.secretKeyRef\.key | ✅ | +| env\.valueFrom\.secretKeyRef\.name | ✅ | +| env\.valueFrom\.secretKeyRef\.optional | ✅ | +| envFrom\.configMapRef\.name | ✅ | +| envFrom\.configMapRef\.optional | ✅ | +| envFrom\.prefix | no | +| envFrom\.secretRef\.name | ✅ | +| envFrom\.secretRef\.optional | ✅ | +| volumeMounts\.mountPath | ✅ | +| volumeMounts\.name | ✅ | +| volumeMounts\.mountPropagation | no | +| volumeMounts\.readOnly | ✅ | +| volumeMounts\.subPath | ✅ | +| volumeMounts\.subPathExpr | no | +| volumeDevices\.devicePath | no | +| volumeDevices\.name | no | +| resources\.limits | ✅ | +| resources\.requests | ✅ | +| lifecycle\.postStart | no | +| lifecycle\.preStop | no | +| terminationMessagePath | no | +| terminationMessagePolicy | no | +| livenessProbe | ✅ | +| readinessProbe | no | +| startupProbe | no | +| securityContext\.runAsUser | ✅ | +| securityContext\.runAsNonRoot | no | +| securityContext\.runAsGroup | ✅ | +| securityContext\.readOnlyRootFilesystem | ✅ | +| securityContext\.procMount | ✅ | +| securityContext\.privileged | ✅ | +| securityContext\.allowPrivilegeEscalation | ✅ | +| securityContext\.capabilities\.add | ✅ | +| securityContext\.capabilities\.drop | ✅ | +| securityContext\.seccompProfile\.type | no | +| securityContext\.seccompProfile\.localhostProfile | no | +| securityContext\.seLinuxOptions\.level | ✅ | +| securityContext\.seLinuxOptions\.role | ✅ | +| securityContext\.seLinuxOptions\.type | ✅ | +| securityContext\.seLinuxOptions\.user | ✅ | +| securityContext\.windowsOptions\.gmsaCredentialSpec | no | +| securityContext\.windowsOptions\.hostProcess | no | +| securityContext\.windowsOptions\.runAsUserName | no | +| stdin | no | +| stdinOnce | no | +| tty | no | + +## PersistentVolumeClaim Fields + +| Field | Support | +|---------------------|---------| +| volumeName | no | +| storageClassName | ✅ | +| volumeMode | no | +| accessModes | ✅ | +| selector | no | +| resources\.limits | no | +| resources\.requests | ✅ | + +## ConfigMap Fields + +| Field | Support | +|------------|---------| +| binaryData | ✅ | +| data | ✅ | +| immutable | no | + +## Deployment Fields + +| Field | Support | +|-----------------------------------------|-------------------------------------------------------| +| replicas | ✅ (the actual replica count is ignored and set to 1) | +| selector | ✅ | +| template | ✅ | +| minReadySeconds | no | +| strategy\.type | no | +| strategy\.rollingUpdate\.maxSurge | no | +| strategy\.rollingUpdate\.maxUnavailable | no | +| revisionHistoryLimit | no | +| progressDeadlineSeconds | no | +| paused | no | + +## DaemonSet Fields + +| Field | Support | +|-----------------------------------------|---------| +| selector | ✅ | +| template | ✅ | +| minReadySeconds | no | +| strategy\.type | no | +| strategy\.rollingUpdate\.maxSurge | no | +| strategy\.rollingUpdate\.maxUnavailable | no | +| revisionHistoryLimit | no | + +## Job Fields + +| Field | Support | +|-------------------------|----------------------------------| +| activeDeadlineSeconds | no | +| selector | no (automatically set by k8s) | +| template | ✅ | +| backoffLimit | no | +| completionMode | no | +| completions | no (set to 1 with kube generate) | +| manualSelector | no | +| parallelism | no (set to 1 with kube generate) | +| podFailurePolicy | no | +| suspend | no | +| ttlSecondsAfterFinished | no | + +[//]: # (END included file ../../kubernetes_support.md) + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-kube(1)](podman-kube.1.md)**, **[podman-kube-down(1)](podman-kube-down.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)**, **[podman-build(1)](podman-build.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-kube.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-kube.1.md new file mode 100644 index 000000000..0a88d00c2 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-kube.1.md @@ -0,0 +1,35 @@ +--- +title: podman-kube +version: v5.5.2 +--- + +% podman-kube 1 + +## NAME +podman\-kube - Play containers, pods or volumes based on a structured input file + +## SYNOPSIS +**podman kube** *subcommand* + +## DESCRIPTION +The kube command recreates containers, pods or volumes based on the input from a structured (like YAML) +file input. Containers are automatically started. + +Note: The kube commands in podman focus on simplifying the process of moving containers from podman to a Kubernetes +environment and from a Kubernetes environment back to podman. Podman is not replicating the kubectl CLI. Once containers +are deployed to a Kubernetes cluster from podman, please use `kubectl` to manage the workloads in the cluster. + +## COMMANDS + +| Command | Man Page | Description | +| ------- | ---------------------------------------------------- | ----------------------------------------------------------------------------- | +| apply | [podman-kube-apply(1)](podman-kube-apply.1.md) | Apply Kubernetes YAML based on containers, pods, or volumes to a Kubernetes cluster | +| down | [podman-kube-down(1)](podman-kube-down.1.md) | Remove containers and pods based on Kubernetes YAML. | +| generate | [podman-kube-generate(1)](podman-kube-generate.1.md) | Generate Kubernetes YAML based on containers, pods or volumes. | +| play | [podman-kube-play(1)](podman-kube-play.1.md) | Create containers, pods and volumes based on Kubernetes YAML. | + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-container(1)](podman-container.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-down(1)](podman-kube-down.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)**, **[podman-kube-apply(1)](podman-kube-apply.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-load.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-load.1.md new file mode 100644 index 000000000..702f6abd7 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-load.1.md @@ -0,0 +1,92 @@ +--- +title: podman-load +version: v5.5.2 +--- + +% podman-load 1 + +## NAME +podman\-load - Load image(s) from a tar archive into container storage + +## SYNOPSIS +**podman load** [*options*] + +**podman image load** [*options*] + +## DESCRIPTION +**podman load** loads an image from either an **oci-archive** or a **docker-archive** stored on the local machine into container storage. **podman load** reads from stdin by default or a file if the **input** option is set. +**podman load** is used for loading from the archive generated by **podman save**, that includes the image parent layers. To load the archive of container's filesystem created by **podman export**, use **podman import**. + +The local client further supports loading an **oci-dir** or a **docker-dir** as created with **podman save** (1). + +The **quiet** option suppresses the progress output when set. +Note: `:` is a restricted character and cannot be part of the file name. + + +**podman [GLOBAL OPTIONS]** + +**podman load [GLOBAL OPTIONS]** + +**podman load [OPTIONS]** + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--input**, **-i**=*input* + +Load the specified input file instead of from stdin. The file can be on the local file system or on a server (e.g., https://server.com/archive.tar). Also supports loading in compressed files. + +The remote client, including Mac and Windows (excluding WSL2) machines, requires the use of this option. + +NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of container images. Podman defaults to use `/var/tmp`. + +#### **--quiet**, **-q** + +Suppress the progress output + +## EXAMPLES + +Create an image from a compressed tar file, without showing progress. +``` +$ podman load --quiet -i fedora.tar.gz +``` + +Create an image from the archive.tar file pulled from a URL, without showing progress. +``` +$ podman load -q -i https://server.com/archive.tar +``` + +Create an image from stdin using bash redirection from a tar file. +``` +$ podman load < fedora.tar +Getting image source signatures +Copying blob sha256:5bef08742407efd622d243692b79ba0055383bbce12900324f75e56f589aedb0 + 0 B / 4.03 MB [---------------------------------------------------------------] +Copying config sha256:7328f6f8b41890597575cbaadc884e7386ae0acc53b747401ebce5cf0d624560 + 0 B / 1.48 KB [---------------------------------------------------------------] +Writing manifest to image destination +Storing signatures +Loaded image: registry.fedoraproject.org/fedora:latest +``` + +Create an image from stdin using a pipe. +``` +$ cat fedora.tar | podman load +Getting image source signatures +Copying blob sha256:5bef08742407efd622d243692b79ba0055383bbce12900324f75e56f589aedb0 + 0 B / 4.03 MB [---------------------------------------------------------------] +Copying config sha256:7328f6f8b41890597575cbaadc884e7386ae0acc53b747401ebce5cf0d624560 + 0 B / 1.48 KB [---------------------------------------------------------------] +Writing manifest to image destination +Storing signatures +Loaded image: registry.fedoraproject.org/fedora:latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-save(1)](podman-save.1.md)** + +## HISTORY +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-login.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-login.1.md new file mode 100644 index 000000000..0650cceda --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-login.1.md @@ -0,0 +1,188 @@ +--- +title: podman-login +version: v5.5.2 +--- + +% podman-login 1 + +## NAME +podman\-login - Log in to a container registry + +## SYNOPSIS +**podman login** [*options*] [*registry*] + +## DESCRIPTION +**podman login** logs into a specified registry server with the correct username +and password. If the registry is not specified, the first registry under [registries.search] +from registries.conf is used. **podman login** reads in the username and password from STDIN. +The username and password can also be set using the **username** and **password** flags. +The path of the authentication file can be specified by the user by setting the **authfile** +flag. The default path for reading and writing credentials is **${XDG\_RUNTIME\_DIR}/containers/auth.json**. +Podman uses existing credentials if the user does not pass in a username. +Podman first searches for the username and password in the **${XDG\_RUNTIME\_DIR}/containers/auth.json**, if they are not valid, +Podman then uses any existing credentials found in **$HOME/.docker/config.json**. +If those credentials are not present, Podman creates **${XDG\_RUNTIME\_DIR}/containers/auth.json** (if the file does not exist) and +then stores the username and password from STDIN as a base64 encoded string in it. +For more details about format and configurations of the auth.json file, see containers-auth.json(5) + +**podman [GLOBAL OPTIONS]** + +**podman login [GLOBAL OPTIONS]** + +**podman login [OPTIONS] [REGISTRY] [GLOBAL OPTIONS]** + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/compat-auth-file.md) +#### **--compat-auth-file**=*path* + +Instead of updating the default credentials file, update the one at *path*, and use a Docker-compatible format. + +[//]: # (END included file options/compat-auth-file.md) + +#### **--get-login** + +Return the logged-in user for the registry. Return error if no login is found. + +#### **--help**, **-h** + +Print usage statement + +#### **--password**, **-p**=*password* + +Password for registry + +#### **--password-stdin** + +Take the password from stdin + +#### **--secret**=*name* + +Read the password for the registry from the podman secret `name`. +If --username is not specified --username=`name` is used. + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +#### **--username**, **-u**=*username* + +Username for registry + +#### **--verbose**, **-v** + +print detailed information about credential store + +## EXAMPLES + +Add login credentials for specified registry to default authentication file; +note that unlike the `docker` default, the default credentials are under `$XDG_RUNTIME_DIR` +which is a subdirectory of `/run` (an emphemeral directory) and hence do not persist across reboot. + +``` +$ podman login quay.io +Username: umohnani +Password: +Login Succeeded! +``` + +To explicitly preserve credentials across reboot, you will need to specify +the default persistent path: + +``` +$ podman login --authfile ~/.config/containers/auth.json quay.io +Username: umohnani +Password: +Login Succeeded! +``` + +Add login credentials using specified username and password for local registry to default authentication file. +``` +$ podman login -u testuser -p testpassword localhost:5000 +Login Succeeded! +``` + +Add login credentials for alternate authfile path for the specified registry. +``` +$ podman login --authfile authdir/myauths.json quay.io +Username: umohnani +Password: +Login Succeeded! +``` + +Add login credentials using a Podman secret for the password. +``` +$ echo -n MySecret! | podman secret create secretname - +a0ad54df3c97cf89d5ca6193c +$ podman login --secret secretname -u testuser quay.io +Login Succeeded! +``` + +Add login credentials for user test with password test to localhost:5000 registry disabling tls verification requirement. +``` +$ podman login --tls-verify=false -u test -p test localhost:5000 +Login Succeeded! +``` + +Add login credentials for user foo with password bar to localhost:5000 registry using the certificate directory /etc/containers/certs.d. +``` +$ podman login --cert-dir /etc/containers/certs.d/ -u foo -p bar localhost:5000 +Login Succeeded! +``` + +Add login credentials for specified registries to default authentication file for given user with password information provided via stdin from a file on disk. +``` +$ podman login -u testuser --password-stdin < testpassword.txt docker.io +Login Succeeded! +``` + +Add login credentials for specified registry to default authentication file for given user with password information provided via stdin from a pipe. +``` +$ echo $testpassword | podman login -u testuser --password-stdin quay.io +Login Succeeded! +``` + +Add login credentials for specified registry to default authentication file in verbose mode. +``` +$ podman login quay.io --verbose +Username: myusername +Password: +Used: /run/user/1000/containers/auth.json +Login Succeeded! +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-logout(1)](podman-logout.1.md)**, **[containers-auth.json(5)](https://github.com/containers/image/blob/main/docs/containers-auth.json.5.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[podman-secret(1)](podman-secret.1.md)**, **[podman-secret-create(1)](podman-secret-create.1.md)** + +## HISTORY +August 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-logout.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-logout.1.md new file mode 100644 index 000000000..1b8f70294 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-logout.1.md @@ -0,0 +1,77 @@ +--- +title: podman-logout +version: v5.5.2 +--- + +% podman-logout 1 + +## NAME +podman\-logout - Log out of a container registry + +## SYNOPSIS +**podman logout** [*options*] *registry* + +## DESCRIPTION +**podman logout** logs out of a specified registry server by deleting the cached credentials +stored in the **auth.json** file. If the registry is not specified, the first registry under [registries.search] +from registries.conf is used. The path of the authentication file can be overridden by the user by setting the **authfile** flag. +The default path used is **${XDG\_RUNTIME\_DIR}/containers/auth.json**. For more details about format and configurations of the auth,json file, see containers-auth.json(5) +All the cached credentials can be removed by setting the **all** flag. + +**podman [GLOBAL OPTIONS]** + +**podman logout [GLOBAL OPTIONS]** + +**podman logout [OPTIONS] REGISTRY [GLOBAL OPTIONS]** + +## OPTIONS + +#### **--all**, **-a** + +Remove the cached credentials for all registries in the auth file + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/compat-auth-file.md) +#### **--compat-auth-file**=*path* + +Instead of updating the default credentials file, update the one at *path*, and use a Docker-compatible format. + +[//]: # (END included file options/compat-auth-file.md) + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Remove login credentials for the docker.io registry from the authentication file: +``` +$ podman logout docker.io +``` + +Remove login credentials for the docker.io registry from the authdir/myauths.json file: +``` +$ podman logout --authfile authdir/myauths.json docker.io +``` + +Remove login credentials for all registries: +``` +$ podman logout --all +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-auth.json(5)](https://github.com/containers/image/blob/main/docs/containers-auth.json.5.md)** + +## HISTORY +August 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-logs.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-logs.1.md new file mode 100644 index 000000000..991023f29 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-logs.1.md @@ -0,0 +1,173 @@ +--- +title: podman-logs +version: v5.5.2 +--- + +% podman-logs 1 + +## NAME +podman\-logs - Display the logs of one or more containers + +## SYNOPSIS +**podman logs** [*options*] *container* [*container...*] + +**podman container logs** [*options*] *container* [*container...*] + +## DESCRIPTION +The podman logs command batch-retrieves whatever logs are present for one or more containers at the time of execution. +This does not guarantee execution order when combined with podman run (i.e. the run may not have generated +any logs at the time podman logs was executed). + +## OPTIONS + + +[//]: # (BEGIN included file options/color.md) +#### **--color** + +Output the containers with different colors in the log. + +[//]: # (END included file options/color.md) + + +[//]: # (BEGIN included file options/follow.md) +#### **--follow**, **-f** + +Follow log output. Default is false. + +Note: When following a container which is removed by `podman container rm` +or removed on exit (`podman run --rm ...`), there is a chance that the log +file is removed before `podman logs` reads the final content. + +[//]: # (END included file options/follow.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/names.md) +#### **--names**, **-n** + +Output the container names instead of the container IDs in the log. + +[//]: # (END included file options/names.md) + + +[//]: # (BEGIN included file options/since.md) +#### **--since**=*TIMESTAMP* + +Show logs since TIMESTAMP. The --since option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. + +[//]: # (END included file options/since.md) + + +[//]: # (BEGIN included file options/tail.md) +#### **--tail**=*LINES* + +Output the specified number of LINES at the end of the logs. LINES must be an integer. Defaults to -1, +which prints all lines + +[//]: # (END included file options/tail.md) + + +[//]: # (BEGIN included file options/timestamps.md) +#### **--timestamps**, **-t** + +Show timestamps in the log outputs. The default is false + +[//]: # (END included file options/timestamps.md) + + +[//]: # (BEGIN included file options/until.md) +#### **--until**=*TIMESTAMP* + +Show logs until TIMESTAMP. The --until option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. + +[//]: # (END included file options/until.md) + +## EXAMPLE + +To view a container's logs: +``` +podman logs -t b3f2436bdb978c1d33b1387afb5d7ba7e3243ed2ce908db431ac0069da86cb45 + +2017/08/07 10:16:21 Seeked /var/log/crio/pods/eb296bd56fab164d4d3cc46e5776b54414af3bf543d138746b25832c816b933b/c49f49788da14f776b7aa93fb97a2a71f9912f4e5a3e30397fca7dfe0ee0367b.log - &{Offset:0 Whence:0} +1:C 07 Aug 14:10:09.055 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo +1:C 07 Aug 14:10:09.055 # Redis version=4.0.1, bits=64, commit=00000000, modified=0, pid=1, just started +1:C 07 Aug 14:10:09.055 # Warning: no config file specified, using the default config. In order to specify a config file use redis-server /path/to/redis.conf +1:M 07 Aug 14:10:09.055 # You requested maxclients of 10000 requiring at least 10032 max file descriptors. +1:M 07 Aug 14:10:09.055 # Server can't set maximum open files to 10032 because of OS error: Operation not permitted. +1:M 07 Aug 14:10:09.055 # Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit. If you need higher maxclients increase 'ulimit -n'. +1:M 07 Aug 14:10:09.056 * Running mode=standalone, port=6379. +1:M 07 Aug 14:10:09.056 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. +1:M 07 Aug 14:10:09.056 # Server initialized +``` + +To view only the last two lines in container's log: +``` +podman logs --tail 2 b3f2436bdb97 + +# WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. +# Server initialized +``` + +To view all containers logs: +``` +podman logs -t --since 0 myserver + +1:M 07 Aug 14:10:09.055 # Server can't set maximum open files to 10032 because of OS error: Operation not permitted. +1:M 07 Aug 14:10:09.055 # Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit. If you need higher maxclients increase 'ulimit -n'. +1:M 07 Aug 14:10:09.056 * Running mode=standalone, port=6379. +1:M 07 Aug 14:10:09.056 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. +1:M 07 Aug 14:10:09.056 # Server initialized +``` + +To view a container's logs since a certain time: +``` +podman logs -t --since 2017-08-07T10:10:09.055837383-04:00 myserver + +1:M 07 Aug 14:10:09.055 # Server can't set maximum open files to 10032 because of OS error: Operation not permitted. +1:M 07 Aug 14:10:09.055 # Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit. If you need higher maxclients increase 'ulimit -n'. +1:M 07 Aug 14:10:09.056 * Running mode=standalone, port=6379. +1:M 07 Aug 14:10:09.056 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. +1:M 07 Aug 14:10:09.056 # Server initialized +``` + +To view a container's logs generated in the last 10 minutes: +``` +podman logs --since 10m myserver + +# Server can't set maximum open files to 10032 because of OS error: Operation not permitted. +# Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit, Increase 'ulimit -n' when higher maxclients are required. +``` + +To view a container's logs until 30 minutes ago: +``` +podman logs --until 30m myserver + +AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.0.2.100. Set the 'ServerName' directive globally to suppress this message +AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.0.2.100. Set the 'ServerName' directive globally to suppress this message +[Tue Jul 20 13:18:14.223727 2021] [mpm_event:notice] [pid 1:tid 140021067187328] AH00489: Apache/2.4.48 (Unix) configured -- resuming normal operations +[Tue Jul 20 13:18:14.223819 2021] [core:notice] [pid 1:tid 140021067187328] AH00094: Command line: 'httpd -D FOREGROUND' +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)**, **[podman-rm(1)](podman-rm.1.md)** + +## HISTORY +February 2018, Updated by Brent Baude + +August 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-machine-cp.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-machine-cp.1.md new file mode 100644 index 000000000..b7f2314ed --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-machine-cp.1.md @@ -0,0 +1,68 @@ +--- +title: podman-machine-cp +version: v5.5.2 +--- + +% podman-machine-cp 1 + +## NAME +podman\-machine\-cp - Securely copy contents between the host and the virtual machine + +## SYNOPSIS +**podman machine cp** [*options*] *src_path* *dest_path* + +## DESCRIPTION + +Use secure copy (scp) to copy files or directories between the virtual machine +and your host machine. + +`podman machine cp` does not support copying between two virtual machines, +which would require two machines running simultaneously. + +Additionally, `podman machine cp` will automatically do a recursive copy of +files and directories. + +## OPTIONS + +#### **--help** + +Print usage statement. + +#### **--quiet**, **-q** + +Suppress copy status output. + +## EXAMPLES +Copy a file from your host to the running Podman Machine. +``` +$ podman machine cp ~/configuration.txt podman-machine-default:~/configuration.txt +... +Copy Successful +``` + +Copy a file from the running Podman Machine to your host. +``` +$ podman machine cp podman-machine-default:~/logs/log.txt ~/logs/podman-machine-default.txt +... +Copy Successful +``` + +Copy a directory from your host to the running Podman Machine. +``` +$ podman machine cp ~/.config podman-machine-default:~/.config +... +Copy Successful +``` + +Copy a directory from the running Podman Machine to your host. +``` +$ podman machine cp podman-machine-default:~/.config ~/podman-machine-default.config +... +Copy Successful +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +February 2025, Originally compiled by Jake Correnti diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-machine-info.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-machine-info.1.md new file mode 100644 index 000000000..eadd5a2cc --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-machine-info.1.md @@ -0,0 +1,107 @@ +--- +title: podman-machine-info +version: v5.5.2 +--- + +% podman-machine-info 1 + +## NAME +podman\-machine\-info - Display machine host info + +## SYNOPSIS +**podman machine info** + +## DESCRIPTION + +Display information pertaining to the machine host. +Rootless only, as all `podman machine` commands can be only be used with rootless Podman. + +*Note*: The `DefaultMachine` field in the `Host` output does not suggest that +one can set a default podman machine via system connections. This value represents +the current active system connection associated with a podman machine. Regardless +of the default system connection, the default podman machine will always be +`podman-machine-default`. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change output format to "json" or a Go template. + +| **Placeholder** | **Description** | +| ------------------- | --------------------------------- | +| .Host ... | Host information for local machine| +| .Version ... | Version of the machine | + +#### **--help** + +Print usage statement. + +## EXAMPLES + +Display default Podman machine info. +``` +$ podman machine info +Host: + Arch: amd64 + CurrentMachine: "" + DefaultMachine: "" + EventsDir: /run/user/3267/podman + MachineConfigDir: /home/myusername/.config/containers/podman/machine/qemu + MachineImageDir: /home/myusername/.local/share/containers/podman/machine/qemu + MachineState: "" + NumberOfMachines: 0 + OS: linux + VMType: qemu +Version: + APIVersion: 4.4.0 + Built: 1677097848 + BuiltTime: Wed Feb 22 15:30:48 2023 + GitCommit: aa196c0d5c9abd5800edf9e27587c60343a26c2b-dirty + GoVersion: go1.20 + Os: linux + OsArch: linux/amd64 + Version: 4.4.0 +``` + +Display default Podman machine info formatted as json. +``` +$ podman machine info --format json +{ + "Host": { + "Arch": "amd64", + "CurrentMachine": "", + "DefaultMachine": "", + "EventsDir": "/run/user/3267/podman", + "MachineConfigDir": "/home/myusername/.config/containers/podman/machine/qemu", + "MachineImageDir": "/home/myusername/.local/share/containers/podman/machine/qemu", + "MachineState": "", + "NumberOfMachines": 0, + "OS": "linux", + "VMType": "qemu" + }, + "Version": { + "APIVersion": "4.4.0", + "Version": "4.4.0", + "GoVersion": "go1.20", + "GitCommit": "aa196c0d5c9abd5800edf9e27587c60343a26c2b-dirty", + "BuiltTime": "Wed Feb 22 15:30:48 2023", + "Built": 1677097848, + "OsArch": "linux/amd64", + "Os": "linux" + } +} +``` + +Display default Podman machine Host.Arch field. +``` +$ podman machine info --format "{{ .Host.Arch }}" +amd64 + +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +June 2022, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-machine-init.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-machine-init.1.md new file mode 100644 index 000000000..8532ede94 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-machine-init.1.md @@ -0,0 +1,255 @@ +--- +title: podman-machine-init +version: v5.5.2 +--- + +% podman-machine-init 1 + +## NAME +podman\-machine\-init - Initialize a new virtual machine + +## SYNOPSIS +**podman machine init** [*options*] [*name*] + +## DESCRIPTION + +Initialize a new virtual machine for Podman. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then the new machine will be named `podman-machine-default`. + +Rootless only. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +**podman machine init** initializes a new Linux virtual machine where containers are run. +SSH keys are automatically generated to access the VM, and system connections to the root account +and a user account inside the VM are added. + +By default, the VM distribution is a custom [Fedora CoreOS](https://getfedora.org/en/coreos?stream=stable) +based image pushed to quay.io/podman/machine-os (build in https://github.com/containers/podman-machine-os). +WSL is an exception and is based on a custom Fedora image. + +To check if there is an upgrade available for your machine os, you can run the following command: + +``` +$ podman machine ssh 'sudo rpm-ostree upgrade --check' + +``` +If an update is available, you can rerun the above command and remove the `--check` and your operating system will +be updated. After updating, you must stop and start your machine with `podman machine stop && podman machine start` for +it to take effect. + +The above mechanism is only used to update patch (Z) versions of podman. For updates to new major and minor +version (X.Y) use the **[podman machine os apply](podman-machine-os-apply.1.md)** command, see the docs there for +more information. + +Note: Updating as described above can result in version mismatches between Podman on the host and Podman in the +machine. Executing `podman info` should reveal versions of both. A configuration where the Podman host and machine +mismatch are unsupported. + +To update the WSL image you must run dnf update inside, use the following command: +``` +$ podman machine ssh dnf update +``` + +Default Podman machine settings can be set via the [machine] section in the containers.conf(5) file. + +## OPTIONS + +#### **--cpus**=*number* + +Number of CPUs. + +#### **--disk-size**=*number* + +Size of the disk for the guest VM in GiB. + +#### **--help** + +Print usage statement. + +#### **--ignition-path** + +Fully qualified path of the ignition file. + +If an ignition file is provided, the file +is copied into the user's CONF_DIR and renamed. Additionally, no SSH keys are generated, nor are any system connections made. It is assumed that the user does these things manually or handled otherwise. + +#### **--image** + +Fully qualified registry, path, or URL to a VM image. +Registry target must be in the form of `docker://registry/repo/image:version`. + +Note: Only images provided by podman will be supported. + +#### **--memory**, **-m**=*number* + +Memory (in MiB). Note: 1024MiB = 1GiB. + +#### **--now** + +Start the virtual machine immediately after it has been initialized. + +#### **--playbook** + +Add the provided Ansible playbook to the machine and execute it after the first boot. + +Note: The playbook will be executed with the same privileges given to the user in the virtual machine. The playbook provided cannot include other files from the host system, as they will not be copied. +Use of the `--playbook` flag will require the image to include Ansible. The default image provided will have Ansible included. + +#### **--rootful** + +Whether this machine prefers rootful (`true`) or rootless (`false`) +container execution. This option determines the remote connection default +if there is no existing remote connection configurations. + +API forwarding, if available, follows this setting. + +#### **--timezone** + +Set the timezone for the machine and containers. Valid values are `local` or +a `timezone` such as `America/Chicago`. A value of `local`, which is the default, +means to use the timezone of the machine host. + +The timezone setting is not used with WSL. WSL automatically sets the timezone to the same +as the host Windows operating system. + +#### **--usb**=*bus=number,devnum=number* or *vendor=hexadecimal,product=hexadecimal* + +Assign a USB device from the host to the VM via USB passthrough. +Only supported for QEMU Machines. + +The device needs to have proper permissions in order to be passed to the machine. This +means the device needs to be under your user group. + +Note that using bus and device number are simpler but the values can change every boot +or when the device is unplugged. + +When specifying a USB using vendor and product ID's, if more than one device has the +same vendor and product ID, the first available device is assigned. + + +[//]: # (BEGIN included file options/user-mode-networking.md) +#### **--user-mode-networking** + +Indicates that this machine relays traffic from the guest through a user-space +process running on the host. In some VPN configurations the VPN may drop +traffic from alternate network interfaces, including VM network devices. By +enabling user-mode networking (a setting of `true`), VPNs observe all +podman machine traffic as coming from the host, bypassing the problem. + +When the qemu backend is used (Linux, Mac), user-mode networking is +mandatory and the only allowed value is `true`. In contrast, The Windows/WSL +backend defaults to `false`, and follows the standard WSL network setup. +Changing this setting to `true` on Windows/WSL informs Podman to replace +the WSL networking setup on start of this machine instance with a user-mode +networking distribution. Since WSL shares the same kernel across +distributions, all other running distributions reuses this network. +Likewise, when the last machine instance with a `true` setting stops, the +original networking setup is restored. + +[//]: # (END included file options/user-mode-networking.md) + +#### **--username** + +Username to use for executing commands in remote VM. Default value is `core` +for FCOS and `user` for Fedora (default on Windows hosts). Should match the one +used inside the resulting VM image. + +#### **--volume**, **-v**=*source:target[\\\:options]* + +Mounts a volume from source to target. + +Create a mount. If /host-dir:/machine-dir is specified as the `*source:target*`, +Podman mounts _host-dir_ in the host to _machine-dir_ in the Podman machine. + +Additional options may be specified as a comma-separated string. Recognized +options are: +* **ro**: mount volume read-only +* **rw**: mount volume read/write (default) +* **security_model=[model]**: specify 9p security model (see below) + +Note: The following destinations are forbidden for volumes: `/bin`, `/boot`, `/dev`, `/etc`, +`/home`, `/proc`, `/root`, `/run`, `/sbin`, `/sys`, `/tmp`, `/usr`, and `/var`. Subdirectories +of these destinations are allowed but users should be careful to not mount to important directories +as unexpected results may occur. + + +The 9p security model [determines] https://wiki.qemu.org/Documentation/9psetup#Starting_the_Guest_directly +if and how the 9p filesystem translates some filesystem operations before +actual storage on the host. + +In order to allow symlinks to work, on MacOS the default security model is + *none*. + +The value of *mapped-xattr* specifies that 9p store symlinks and some file +attributes as extended attributes on the host. This is suitable when the host +and the guest do not need to interoperate on the shared filesystem, but has +caveats for actual shared access; notably, symlinks on the host are not usable +on the guest and vice versa. If interoperability is required, then choose +*none* instead, but keep in mind that the guest is not able to do things +that the user running the virtual machine cannot do, e.g. create files owned by +another user. Using *none* is almost certainly the best choice for read-only +volumes. + +Example: `-v "$HOME/git:$HOME/git:ro,security_model=none"` + +Default volume mounts are defined in *containers.conf*. Unless changed, the default values +is `$HOME:$HOME`. + +**Note on Windows Subsystem for Linux (WSL)** +Since all drives are mounted at `/mnt` on startup by default in WSL, passing +`--volume` is redundant and has no effect. The host home directory for a `C:` +drive will be mounted at `/mnt/c/Users/`. + +## EXAMPLES + +Initialize the default Podman machine, pulling the content from the internet. +``` +$ podman machine init +``` + +Initialize a Podman machine for the specified name pulling the content from the internet. +``` +$ podman machine init myvm +``` + +Initialize the default Podman machine pulling the content from the internet defaulting to rootful mode. The default is rootless. +``` +$ podman machine init --rootful +``` + +Initialize the default Podman machine overriding its disk size override, pulling the content from the internet. +``` +$ podman machine init --disk-size 50 +``` + +Initialize the specified Podman machine overriding its memory size, pulling the content from the internet. +``` +$ podman machine init --memory=1024 myvm +``` + +Initialize the default Podman machine with the host directory `/Users` mounted into the VM at `/Users`. +``` +$ podman machine init -v /Users:/Users +``` + +Initialize the default Podman machine with a usb device passthrough specified with options. Only supported for QEMU Machines. +``` +$ podman machine init --usb vendor=13d3,product=5406 +``` + +Initialize the default Podman machine with a usb device passthrough with specified with options. Only supported for QEMU Machines. +``` +$ podman machine init --usb bus=1,devnum=3 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**, **containers.conf(5)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-machine-inspect.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-machine-inspect.1.md new file mode 100644 index 000000000..f3e1c4f27 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-machine-inspect.1.md @@ -0,0 +1,60 @@ +--- +title: podman-machine-inspect +version: v5.5.2 +--- + +% podman-machine-inspect 1 + +## NAME +podman\-machine\-inspect - Inspect one or more virtual machines + +## SYNOPSIS +**podman machine inspect** [*options*] [*name*] ... + +## DESCRIPTION + +Inspect one or more virtual machines + +Obtain greater detail about Podman virtual machines. More than one virtual machine can be +inspected at once. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be inspected. + +Rootless only. + +## OPTIONS +#### **--format** + +Print results with a Go template. + +| **Placeholder** | **Description** | +| ------------------- | --------------------------------------------------------------------- | +| .ConfigDir ... | Machine configuration directory location | +| .ConnectionInfo ... | Machine connection information | +| .Created ... | Machine creation time (string, ISO3601) | +| .LastUp ... | Time when machine was last booted | +| .Name | Name of the machine | +| .Resources ... | Resources used by the machine | +| .Rootful | Whether the machine prefers rootful or rootless container execution | +| .Rosetta | Whether this machine uses Rosetta | +| .SSHConfig ... | SSH configuration info for communicating with machine | +| .State | Machine state | +| .UserModeNetworking | Whether this machine uses user-mode networking | + +#### **--help** + +Print usage statement. + +## EXAMPLES + +Inspect the specified Podman machine. +``` +$ podman machine inspect podman-machine-default +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +April 2022, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-machine-list.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-machine-list.1.md new file mode 100644 index 000000000..4b6f7190e --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-machine-list.1.md @@ -0,0 +1,117 @@ +--- +title: podman-machine-list +version: v5.5.2 +--- + +% podman-machine-list 1 + +## NAME +podman\-machine\-list - List virtual machines + +## SYNOPSIS +**podman machine list** [*options*] + +**podman machine ls** [*options*] + +## DESCRIPTION + +List Podman managed virtual machines. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +Rootless only. + +NOTE: The podman-machine configuration file is managed under the +`$XDG_CONFIG_HOME/containers/podman/machine/` directory. Changing the `$XDG_CONFIG_HOME` +environment variable while the machines are running can lead to unexpected behavior. +(see [podman(1)](podman.1.md)) + +## OPTIONS + +#### **--all-providers** + +Show machines from all providers + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------- | ----------------------------------------- | +| .CPUs | Number of CPUs | +| .Created | Time since VM creation | +| .Default | Is default machine | +| .DiskSize | Disk size of machine | +| .IdentityPath | Path to ssh identity file | +| .LastUp | Time since the VM was last run | +| .Memory | Allocated memory for machine | +| .Name | VM name | +| .Port | SSH Port to use to connect to VM | +| .RemoteUsername | VM Username for rootless Podman | +| .Running | Is machine running | +| .Stream | Stream name | +| .UserModeNetworking | Whether machine uses user-mode networking | +| .VMType | VM type | + +#### **--help** + +Print usage statement. + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Only print the name of the machine. This also implies no table heading +is printed. + +## EXAMPLES + +List all Podman machines. +``` +$ podman machine list +NAME VM TYPE CREATED LAST UP CPUS MEMORY DISK SIZE +podman-machine-default qemu 2 weeks ago 2 weeks ago 1 2.147GB 10.74GB +``` + +List all Podman machines using the specified table format. +``` +$ podman machine ls --format "table {{.Name}}\t{{.VMType}}\t{{.Created}}\t{{.LastUp}}" +NAME VM TYPE CREATED LAST UP +podman-machine-default qemu 2 weeks ago 2 weeks ago +``` + +List all Podman machines in json format. +``` +$ podman machine ls --format json +[ + { + "Name": "podman-machine-default", + "Default": false, + "Created": "2021-12-27T10:36:14.373347492-05:00", + "Running": false, + "LastUp": "2021-12-27T11:22:50.17333371-05:00", + "Stream": "default", + "VMType": "qemu", + "CPUs": 1, + "Memory": "2147483648", + "DiskSize": "10737418240" + } +] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-machine-os-apply.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-machine-os-apply.1.md new file mode 100644 index 000000000..0fae2c051 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-machine-os-apply.1.md @@ -0,0 +1,70 @@ +--- +title: podman-machine-os-apply +version: v5.5.2 +--- + +% podman-machine-os-apply 1 + +## NAME +podman\-machine\-os\-apply - Apply an OCI image to a Podman Machine's OS + +## SYNOPSIS +**podman machine os apply** [*options*] *image* [vm] + +## DESCRIPTION + +Apply machine OS changes from an OCI image. + +VM's that use OS's that use rpm-ostreee have the capability to rebase itself from the content of an OCI image. +`podman machine image apply` takes an OCI image with container native ostree functionality and rebases itself on that image. + +By default, Podman machines on Mac, Linux, and Windows Hyper-V use a customized rpm-ostree based distribution (Fedora CoreOS). Machines based on Microsoft WSL use a +customized Fedora distribution and cannot be updated with this command. + +Note: WSL-based machines are upgradable by using the `podman machine ssh ` command followed by `sudo dnf update`. This can, however, result in unexpected results in +Podman client and server version differences. + +Podman machine images are stored as OCI images at `quay.io/podman/machine-os`. When applying an image using this +command, the fully qualified OCI reference name must be used including tag where the tag is the +version of Podman that is inside the VM. By default, Podman will attempt to pull only the statement +version as itself. + +For more information, see the [rpm-ostree documentation](https://coreos.github.io/rpm-ostree/container/). + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then the OS changes will be applied to `podman-machine-default`. + +## OPTIONS + +#### **--help** + +Print usage statement. + +#### **--restart** + +Restart VM after applying changes. + +## EXAMPLES + +Update the default Podman machine to the latest development version of the +bootable OCI image. + +Note: This may result in having a newer Podman version inside the machine +than the client. Unexpected results may occur. + +Update the default Podman machine to the most recent Podman 5.4 bootable +OCI image. +``` +$ podman machine os apply quay.io/podman/machine-os:5.4 +``` + +Update the specified Podman machine to latest Podman 5.3 bootable OCI image. +``` +$ podman machine os apply quay.io/podman/machine-os:5.3 mymachine +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**, **[podman-machine-os(1)](podman-machine-os.1.md)** + +## HISTORY +February 2023, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-machine-os.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-machine-os.1.md new file mode 100644 index 000000000..d4145762d --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-machine-os.1.md @@ -0,0 +1,27 @@ +--- +title: podman-machine-os +version: v5.5.2 +--- + +% podman-machine-os 1 + +## NAME +podman\-machine\-os - Manage a Podman virtual machine's OS + +## SYNOPSIS +**podman machine os** *subcommand* + +## DESCRIPTION +`podman machine os` is a set of subcommands that manage a Podman virtual machine's operating system. + +## SUBCOMMANDS + +| Command | Man Page | Description | +|---------|--------------------------------------------------------------|----------------------------------------------| +| apply | [podman-machine-os-apply(1)](podman-machine-os-apply.1.md) | Apply an OCI image to a Podman Machine's OS | + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**, **[podman-machine-os-apply(1)](podman-machine-os-apply.1.md)** + +## HISTORY +February 2023, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-machine-reset.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-machine-reset.1.md new file mode 100644 index 000000000..14af9bbce --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-machine-reset.1.md @@ -0,0 +1,52 @@ +--- +title: podman-machine-reset +version: v5.5.2 +--- + +% podman-machine-reset 1 + +## NAME +podman\-machine\-reset - Reset Podman machines and environment + +## SYNOPSIS +**podman machine reset** [*options*] + +## DESCRIPTION + +Reset your Podman machine environment. This command stops any running machines +and then removes them. Configuration and data files are then removed. Data files +would include machine disk images and any previously pulled cache images. When +this command is run, all of your Podman machines will have been deleted. + +## OPTIONS + +#### **--force**, **-f** + +Reset without confirmation. + +#### **--help** + +Print usage statement. + + +## EXAMPLES + +``` +$ podman machine reset +Warning: this command will delete all existing podman machines +and all of the configuration and data directories for Podman machines + +The following machine(s) will be deleted: + +dev +podman-machine-default + +Are you sure you want to continue? [y/N] y +$ +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +Feb 2024, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-machine-rm.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-machine-rm.1.md new file mode 100644 index 000000000..f7487c787 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-machine-rm.1.md @@ -0,0 +1,71 @@ +--- +title: podman-machine-rm +version: v5.5.2 +--- + +% podman-machine-rm 1 + +## NAME +podman\-machine\-rm - Remove a virtual machine + +## SYNOPSIS +**podman machine rm** [*options*] [*name*] + +## DESCRIPTION + +Remove a virtual machine and its related files. What is actually deleted +depends on the virtual machine type. For all virtual machines, the generated +podman system connections are deleted. The ignition files +generated for that VM are also removed as is its image file on the filesystem. + +Users get a display of what is deleted and are required to confirm unless the option `--force` +is used. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be removed. + +Rootless only. + +## OPTIONS + +#### **--force**, **-f** + +Stop and delete without confirmation. + +#### **--help** + +Print usage statement. + +#### **--save-ignition** + +Do not delete the generated ignition file. + +#### **--save-image** + +Do not delete the VM image. + +## EXAMPLES + +Remove the specified Podman machine. +``` +$ podman machine rm test1 + +The following files will be deleted: + +/home/user/.config/containers/podman/machine/qemu/test1.ign +/home/user/.local/share/containers/podman/machine/qemu/test1_fedora-coreos-33.20210315.1.0-qemu.x86_64.qcow2 +/home/user/.config/containers/podman/machine/qemu/test1.json + +Are you sure you want to continue? [y/N] y +``` + +Remove the specified Podman machine even if it is running. +``` +$ podman machine rm -f test1 +$ +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-machine-set.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-machine-set.1.md new file mode 100644 index 000000000..9f4b3e6cf --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-machine-set.1.md @@ -0,0 +1,126 @@ +--- +title: podman-machine-set +version: v5.5.2 +--- + +% podman-machine-set 1 + +## NAME +podman\-machine\-set - Set a virtual machine setting + +## SYNOPSIS +**podman machine set** [*options*] [*name*] + +## DESCRIPTION + +Change a machine setting. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then the settings will be applied to `podman-machine-default`. + +Rootless only. + +Default Podman machine settings can be set via the [machine] section in the containers.conf(5) file. + +## OPTIONS + +#### **--cpus**=*number* + +Number of CPUs. +Only supported for QEMU machines. + +#### **--disk-size**=*number* + +Size of the disk for the guest VM in GB. +Can only be increased. Only supported for QEMU machines. + +#### **--help** + +Print usage statement. + +#### **--memory**, **-m**=*number* + +Memory (in MB). +Only supported for QEMU machines. + +#### **--rootful** + +Whether this machine prefers rootful (`true`) or rootless (`false`) +container execution. This option updates the current podman +remote connection default if it is currently pointing at the specified +machine name (or `podman-machine-default` if no name is specified). + +Unlike [**podman system connection default**](podman-system-connection-default.1.md) +this option makes the API socket, if available, forward to the rootful/rootless +socket in the VM. + +Note that changing this option means that all the existing containers/images/volumes, etc... +are no longer visible with the default connection/socket. This is because the root and rootless +users in the VM are completely separated and do not share any storage. The data however is not +lost and you can always change this option back or use the other connection to access it. + +#### **--usb**=*bus=number,devnum=number* or *vendor=hexadecimal,product=hexadecimal* or *""* + +Assign a USB device from the host to the VM. +Only supported for QEMU Machines. + +The device needs to be present when the VM starts. +The device needs to have proper permissions in order to be assign to podman machine. + +Use an empty string to remove all previously set USB devices. + +Note that using bus and device number are simpler but the values can change every boot or when the +device is unplugged. Using vendor and product might lead to collision in the case of multiple +devices with the same vendor product value, the first available device is assigned. + + +[//]: # (BEGIN included file options/user-mode-networking.md) +#### **--user-mode-networking** + +Indicates that this machine relays traffic from the guest through a user-space +process running on the host. In some VPN configurations the VPN may drop +traffic from alternate network interfaces, including VM network devices. By +enabling user-mode networking (a setting of `true`), VPNs observe all +podman machine traffic as coming from the host, bypassing the problem. + +When the qemu backend is used (Linux, Mac), user-mode networking is +mandatory and the only allowed value is `true`. In contrast, The Windows/WSL +backend defaults to `false`, and follows the standard WSL network setup. +Changing this setting to `true` on Windows/WSL informs Podman to replace +the WSL networking setup on start of this machine instance with a user-mode +networking distribution. Since WSL shares the same kernel across +distributions, all other running distributions reuses this network. +Likewise, when the last machine instance with a `true` setting stops, the +original networking setup is restored. + +[//]: # (END included file options/user-mode-networking.md) + +## EXAMPLES + +To switch the default Podman machine from rootless to rootful: + +``` +$ podman machine set --rootful +``` + +or more explicitly set with value true. + +``` +$ podman machine set --rootful=true +``` + +Switch the default Podman machine from rootful to rootless. +``` +$ podman machine set --rootful=false +``` + +Switch the specified Podman machine from rootless to rootful. +``` +$ podman machine set --rootful myvm +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**, **containers.conf(5)** + +## HISTORY +February 2022, Originally compiled by Jason Greene diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-machine-ssh.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-machine-ssh.1.md new file mode 100644 index 000000000..9dc7deef5 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-machine-ssh.1.md @@ -0,0 +1,91 @@ +--- +title: podman-machine-ssh +version: v5.5.2 +--- + +% podman-machine-ssh 1 + +## NAME +podman\-machine\-ssh - SSH into a virtual machine + +## SYNOPSIS +**podman machine ssh** [*options*] [*name*] [*command* [*arg* ...]] + +## DESCRIPTION + +SSH into a Podman-managed virtual machine and optionally execute a command +on the virtual machine. Unless using the default virtual machine, the +first argument must be the virtual machine name. The optional command to +execute can then follow. If no command is provided, an interactive session +with the virtual machine is established. + +The exit code from ssh command is forwarded to the podman machine ssh caller, see [Exit Codes](#Exit-Codes). + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be SSH'd into. + +Rootless only. + +## OPTIONS + +#### **--help** + +Print usage statement. + +#### **--username**=*name* + +Username to use when SSH-ing into the VM. + +## Exit Codes + +The exit code from `podman machine ssh` gives information about why the command failed. +When `podman machine ssh` commands exit with a non-zero code, +the exit codes follow the `chroot` standard, see below: + + **125** The error is with podman **_itself_** + + $ podman machine ssh --foo; echo $? + Error: unknown flag: --foo + 125 + + **126** Executing a _contained command_ and the _command_ cannot be invoked + + $ podman machine ssh /etc; echo $? + Error: fork/exec /etc: permission denied + 126 + + **127** Executing a _contained command_ and the _command_ cannot be found + + $ podman machine ssh foo; echo $? + Error: fork/exec /usr/bin/bogus: no such file or directory + 127 + + **Exit code** _contained command_ exit code + + $ podman machine ssh /bin/sh -c 'exit 3'; echo $? + 3 + +## EXAMPLES + +To get an interactive session with the default Podman machine: + +SSH into the default Podman machine. +``` +$ podman machine ssh +``` + +Run command inside the default Podman machine via ssh. +``` +$ podman machine ssh myvm +``` + +Run command inside the specified Podman machine via ssh. +``` +$ podman machine ssh myvm rpm -q podman +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-machine-start.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-machine-start.1.md new file mode 100644 index 000000000..39369b575 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-machine-start.1.md @@ -0,0 +1,58 @@ +--- +title: podman-machine-start +version: v5.5.2 +--- + +% podman-machine-start 1 + +## NAME +podman\-machine\-start - Start a virtual machine + +## SYNOPSIS +**podman machine start** [*name*] + +## DESCRIPTION + +Starts a virtual machine for Podman. + +Rootless only. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be started. + +Only one Podman managed VM can be active at a time. If a VM is already running, +`podman machine start` returns an error. + +**podman machine start** starts a Linux virtual machine where containers are run. + +## OPTIONS + +#### **--help** + +Print usage statement. + +#### **--no-info** + +Suppress informational tips. + +#### **--quiet**, **-q** + +Suppress machine starting status output. + +## EXAMPLES + +Start the specified podman machine. +``` +$ podman machine start myvm +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-machine-stop.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-machine-stop.1.md new file mode 100644 index 000000000..a0922f841 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-machine-stop.1.md @@ -0,0 +1,47 @@ +--- +title: podman-machine-stop +version: v5.5.2 +--- + +% podman-machine-stop 1 + +## NAME +podman\-machine\-stop - Stop a virtual machine + +## SYNOPSIS +**podman machine stop** [*name*] + +## DESCRIPTION + +Stops a virtual machine. + +The default machine name is `podman-machine-default`. If a machine name is not specified as an argument, +then `podman-machine-default` will be stopped. + +Rootless only. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +**podman machine stop** stops a Linux virtual machine where containers are run. + +## OPTIONS + +#### **--help** + +Print usage statement. + +## EXAMPLES + +Stop a podman machine named myvm. +``` +$ podman machine stop myvm +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)** + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-machine.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-machine.1.md new file mode 100644 index 000000000..88d427ed1 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-machine.1.md @@ -0,0 +1,56 @@ +--- +title: podman-machine +version: v5.5.2 +--- + +% podman-machine 1 + +## NAME +podman\-machine - Manage Podman's virtual machine + +## SYNOPSIS +**podman machine** *subcommand* + +## DESCRIPTION +`podman machine` is a set of subcommands that manage Podman's virtual machine. + +Podman on MacOS and Windows requires a virtual machine. This is because containers are Linux - +containers do not run on any other OS because containers' core functionality are +tied to the Linux kernel. Podman machine must be used to manage MacOS and Windows machines, +but can be optionally used on Linux. + +All `podman machine` commands are rootless only. + +NOTE: The podman-machine configuration file is managed under the +`$XDG_CONFIG_HOME/containers/podman/machine/` directory. Changing the `$XDG_CONFIG_HOME` +environment variable while the machines are running can lead to unexpected behavior. + +Podman machine behaviour can be modified via the [machine] section in the containers.conf(5) file. + +## SUBCOMMANDS + +| Command | Man Page | Description | +|---------|----------------------------------------------------------|-----------------------------------------------------------------| +| cp | [podman-machine-cp(1)](podman-machine-cp.1.md) | Securely copy contents between the host and the virtual machine | +| info | [podman-machine-info(1)](podman-machine-info.1.md) | Display machine host info | +| init | [podman-machine-init(1)](podman-machine-init.1.md) | Initialize a new virtual machine | +| inspect | [podman-machine-inspect(1)](podman-machine-inspect.1.md) | Inspect one or more virtual machines | +| list | [podman-machine-list(1)](podman-machine-list.1.md) | List virtual machines | +| os | [podman-machine-os(1)](podman-machine-os.1.md) | Manage a Podman virtual machine's OS | +| reset | [podman-machine-reset(1)](podman-machine-reset.1.md) | Reset Podman machines and environment | +| rm | [podman-machine-rm(1)](podman-machine-rm.1.md) | Remove a virtual machine | +| set | [podman-machine-set(1)](podman-machine-set.1.md) | Set a virtual machine setting | +| ssh | [podman-machine-ssh(1)](podman-machine-ssh.1.md) | SSH into a virtual machine | +| start | [podman-machine-start(1)](podman-machine-start.1.md) | Start a virtual machine | +| stop | [podman-machine-stop(1)](podman-machine-stop.1.md) | Stop a virtual machine | + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-machine-cp(1)](podman-machine-cp.1.md)**, **[podman-machine-info(1)](podman-machine-info.1.md)**, **[podman-machine-init(1)](podman-machine-init.1.md)**, **[podman-machine-list(1)](podman-machine-list.1.md)**, **[podman-machine-os(1)](podman-machine-os.1.md)**, **[podman-machine-rm(1)](podman-machine-rm.1.md)**, **[podman-machine-ssh(1)](podman-machine-ssh.1.md)**, **[podman-machine-start(1)](podman-machine-start.1.md)**, **[podman-machine-stop(1)](podman-machine-stop.1.md)**, **[podman-machine-inspect(1)](podman-machine-inspect.1.md)**, **[podman-machine-reset(1)](podman-machine-reset.1.md)**, **containers.conf(5)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +March 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-manifest-add.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-manifest-add.1.md new file mode 100644 index 000000000..fd8a6e9b3 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-manifest-add.1.md @@ -0,0 +1,235 @@ +--- +title: podman-manifest-add +version: v5.5.2 +--- + +% podman-manifest-add 1 + +## NAME +podman\-manifest\-add - Add an image or artifact to a manifest list or image index + +## SYNOPSIS +**podman manifest add** [*options*] *listnameorindexname* [*transport*]:*imagename* *imageorartifactname* [...] + +## DESCRIPTION + +Adds the specified image to the specified manifest list or image index, or +creates an artifact manifest and adds it to the specified image index. + +## RETURN VALUE + +The list image's ID. + +## OPTIONS + +#### **--all** + +If the image which is added to the list or index is itself a list or +index, add all of the contents to the local list. By default, only one image +from such a list or index is added to the list or index. Combining +*--all* with any of the other options described below is NOT recommended. + + +[//]: # (BEGIN included file options/annotation.manifest.md) +#### **--annotation**=*annotation=value* + +Set an annotation on the entry for the specified image or artifact. + +[//]: # (END included file options/annotation.manifest.md) + +#### **--arch**=*architecture* + +Override the architecture which the list or index records as a requirement for +the image. If *imageName* refers to a manifest list or image index, the +architecture information is retrieved from it. Otherwise, it is +retrieved from the image's configuration information. + +#### **--artifact** + +Create an artifact manifest and add it to the image index. Arguments after the +index name will be interpreted as file names rather than as image references. +In most scenarios, the **--artifact-type** option should also be specified. + +#### **--artifact-config**=*path* + +When creating an artifact manifest and adding it to the image index, use the +specified file's contents as the configuration blob in the artifact manifest. +In most scenarios, leaving the default value, which signifies an empty +configuration, unchanged, is the preferred option. + +#### **--artifact-config-type**=*type* + +When creating an artifact manifest and adding it to the image index, use the +specified MIME type as the `mediaType` associated with the configuration blob +in the artifact manifest. In most scenarios, leaving the default value, which +signifies either an empty configuration or the standard OCI configuration type, +unchanged, is the preferred option. + +#### **--artifact-exclude-titles** + +When creating an artifact manifest and adding it to the image index, do not +set "org.opencontainers.image.title" annotations equal to the file's basename +for each file added to the artifact manifest. Tools which retrieve artifacts +from a registry may use these values to choose names for files when saving +artifacts to disk, so this option is not recommended unless it is required +for interoperability with a particular registry. + +#### **--artifact-layer-type**=*type* + +When creating an artifact manifest and adding it to the image index, use the +specified MIME type as the `mediaType` associated with the files' contents. If +not specified, guesses based on either the files names or their contents will +be made and used, but the option should be specified if certainty is needed. + +#### **--artifact-subject**=*imageName* + +When creating an artifact manifest and adding it to the image index, set the +*subject* field in the artifact manifest to mark the artifact manifest as being +associated with the specified image in some way. An artifact manifest can only +be associated with, at most, one subject. + +#### **--artifact-type**=*type* + +When creating an artifact manifest, use the specified MIME type as the +manifest's `artifactType` value instead of the less informative default value. + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/features.md) +#### **--features**=*feature* + +Specify the features list which the list or index records as requirements for +the image. This option is rarely used. + +[//]: # (END included file options/features.md) + +#### **--os**=*OS* + +Override the OS which the list or index records as a requirement for the image. +If *imagename* refers to a manifest list or image index, the OS information +is retrieved from it. Otherwise, it is retrieved from the image's +configuration information. + + +[//]: # (BEGIN included file options/os-version.md) +#### **--os-version**=*version* + +Specify the OS version which the list or index records as a requirement for the +image. This option is rarely used. + +[//]: # (END included file options/os-version.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/variant.manifest.md) +#### **--variant** + +Specify the variant which the list or index records for the image. This option +is typically used to distinguish between multiple entries which share the same +architecture value, but which expect different versions of its instruction set. + +[//]: # (END included file options/variant.manifest.md) + +## Transport + + Multiple transports are supported: + + **docker://**_docker-reference_ _(default)_ + An image in a registry implementing the "Docker Registry HTTP API V2". By default, uses the authorization state in `$XDG_RUNTIME_DIR/containers/auth.json`, which is set using `(podman login)`. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using `(docker login)`. + + $ podman manifest add mylist\:v1.11 docker://quay.io/username/myimage + + **containers-storage:**_oci-reference_ + An image in _oci-reference_ format stored in the local container storage. _oci-reference_ must contain a tag. + + $ podman manifest add mylist\:v1.11 containers-storage\:quay.io/username/myimage + + **dir:**_path_ + An existing local directory _path_ storing the manifest, layer tarballs, and signatures as individual files. This + is a non-standardized format, primarily useful for debugging or noninvasive container inspection. + + $ podman manifest add dir:/tmp/myimage + + **docker-archive:**_path_[**:**_docker-reference_] + An image is stored in the `docker save` formatted file. _docker-reference_ is only used when creating such a + file, and it must not contain a digest. + + $ podman manifest add docker-archive:/tmp/myimage + + **docker-daemon:**_docker-reference_ + An image in _docker-reference_ format stored in the docker daemon internal storage. The _docker-reference_ can also be an image ID (docker-daemon\:algo\:digest). + + $ sudo podman manifest add docker-daemon\:docker.io/library/myimage:33 + + **oci-archive:**_path_**:**_tag_ + An image _tag_ in a directory compliant with "Open Container Image Layout Specification" at _path_. + + $ podman manifest add oci-archive:/tmp/myimage + +## EXAMPLE + +Add specified default image from source manifest list to destination manifest list: +``` +podman manifest add mylist:v1.11 docker://fedora +71c201d10fffdcac52968a000d85a0a016ca1c7d5473948000d3131c1773d965 +``` + +Add all images from source manifest list to destination manifest list: +``` +podman manifest add --all mylist:v1.11 docker://fedora +71c201d10fffdcac52968a000d85a0a016ca1c7d5473948000d3131c1773d965 +``` + +Add selected image matching arch and variant from source manifest list to destination manifest list: +``` +podman manifest add --arch arm64 --variant v8 mylist\:v1.11 docker://71c201d10fffdcac52968a000d85a0a016ca1c7d5473948000d3131c1773d965 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-manifest-annotate.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-manifest-annotate.1.md new file mode 100644 index 000000000..6ab44e684 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-manifest-annotate.1.md @@ -0,0 +1,95 @@ +--- +title: podman-manifest-annotate +version: v5.5.2 +--- + +% podman-manifest-annotate 1 + +## NAME +podman\-manifest\-annotate - Add and update information about an image or artifact in a manifest list or image index + +## SYNOPSIS +**podman manifest annotate** [*options*] *listnameorindexname* *imagemanifestdigestorimageorartifactname* + +## DESCRIPTION + +Adds or updates information about an image or artifact included in a manifest list or image index. + +## OPTIONS + + +[//]: # (BEGIN included file options/annotation.manifest.md) +#### **--annotation**=*annotation=value* + +Set an annotation on the entry for the specified image or artifact. + +[//]: # (END included file options/annotation.manifest.md) +If **--index** is also specified, sets the annotation on the entire image index. + +#### **--arch**=*architecture* + +Override the architecture which the list or index records as a requirement for +the image. This is usually automatically retrieved from the image's +configuration information, so it is rarely necessary to use this option. + + +[//]: # (BEGIN included file options/features.md) +#### **--features**=*feature* + +Specify the features list which the list or index records as requirements for +the image. This option is rarely used. + +[//]: # (END included file options/features.md) + +#### **--index** + +Treats arguments to the **--annotation** option as annotation values to be set +on the image index itself rather than on an entry in the image index. Implied +for **--subject**. + +#### **--os**=*OS* + +Override the OS which the list or index records as a requirement for the image. +This is usually automatically retrieved from the image's configuration +information, so it is rarely necessary to use this option. + +#### **--os-features**=*feature* + +Specify the OS features list which the list or index records as requirements +for the image. This option is rarely used. + + +[//]: # (BEGIN included file options/os-version.md) +#### **--os-version**=*version* + +Specify the OS version which the list or index records as a requirement for the +image. This option is rarely used. + +[//]: # (END included file options/os-version.md) + +#### **--subject**=*imageName* + +Set the *subject* field in the image index to mark the image index as being +associated with the specified image in some way. An image index can only be +associated with, at most, one subject. + + +[//]: # (BEGIN included file options/variant.manifest.md) +#### **--variant** + +Specify the variant which the list or index records for the image. This option +is typically used to distinguish between multiple entries which share the same +architecture value, but which expect different versions of its instruction set. + +[//]: # (END included file options/variant.manifest.md) + +## EXAMPLE + +Update arch and variant information to specified manifest list for image: +``` +podman manifest annotate --arch arm64 --variant v8 mylist:v1.11 sha256:59eec8837a4d942cc19a52b8c09ea75121acc38114a2c68b98983ce9356b8610 +07ec8dc22b5dba3a33c60b68bce28bbd2b905e383fdb32a90708fa5eeac13a07: sha256:59eec8837a4d942cc19a52b8c09ea75121acc38114a2c68b98983ce9356b8610 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-manifest-create.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-manifest-create.1.md new file mode 100644 index 000000000..a9699f617 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-manifest-create.1.md @@ -0,0 +1,79 @@ +--- +title: podman-manifest-create +version: v5.5.2 +--- + +% podman-manifest-create 1 + +## NAME +podman\-manifest\-create - Create a manifest list or image index + +## SYNOPSIS +**podman manifest create** [*options*] *listnameorindexname* [*imagename* ...] + +## DESCRIPTION + +Creates a new manifest list and stores it as an image in local storage using +the specified name. + +If additional images are specified, they are added to the newly-created list or +index. + +## OPTIONS + +#### **--all** + +If any of the images added to the new list or index are +themselves lists or indexes, add all of their contents. By default, only one +image from such a list is added to the newly-created list or index. + +#### **--amend**, **-a** + +If a manifest list named *listnameorindexname* already exists, modify the +preexisting list instead of exiting with an error. The contents of +*listnameorindexname* are not modified if no *imagename*s are given. + +#### **--annotation**=*value* + +Set an annotation on the newly-created image index. + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Create the specified manifest. +``` +podman manifest create mylist:v1.11 +9cfd24048d5fc80903f088f1531a21bff01172abe66effa8941a4c2308dc745f +``` + +Create the specified manifest manifest or modify it if it previously exist. +``` +podman manifest create --amend mylist:v1.11 +9cfd24048d5fc80903f088f1531a21bff01172abe66effa8941a4c2308dc745f +``` + +Create the named manifest including the specified image matching the current platform. +``` +podman manifest create mylist:v1.11 docker://fedora +5c2bc76bfb4ba6665a7973f7e1c05ee0536b4580637f27adc9fa5a4b2bc03cf1 +``` + +Create the named manifest including all images referred to with the specified image reference. +``` +podman manifest create --all mylist\:v1.11 docker://fedora +30330571e79c65288a4fca421d9aed29b0210d57294d9c2056743fdcf6e3967b +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-manifest-exists.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-manifest-exists.1.md new file mode 100644 index 000000000..a3facffb0 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-manifest-exists.1.md @@ -0,0 +1,47 @@ +--- +title: podman-manifest-exists +version: v5.5.2 +--- + +% podman-manifest-exists 1 + +## NAME +podman\-manifest\-exists - Check if the given manifest list exists in local storage + +## SYNOPSIS +**podman manifest exists** *manifest* + +## DESCRIPTION +**podman manifest exists** checks if a manifest list exists on local storage. +Podman returns an exit code of `0` when the manifest is found. A `1` is +returned otherwise. +An exit code of `125` indicates there was another issue. + + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement. + +## EXAMPLE + +Check if a manifest list called `list1` exists (the manifest list does actually exist): +``` +$ podman manifest exists list1 +$ echo $? +0 +``` + +Check if a manifest called `mylist` exists (the manifest list does not actually exist): +``` +$ podman manifest exists mylist +$ echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** + +## HISTORY +January 2021, Originally compiled by Paul Holzinger `` diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-manifest-inspect.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-manifest-inspect.1.md new file mode 100644 index 000000000..4ffe95ae8 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-manifest-inspect.1.md @@ -0,0 +1,54 @@ +--- +title: podman-manifest-inspect +version: v5.5.2 +--- + +% podman-manifest-inspect 1 + +## NAME +podman\-manifest\-inspect - Display a manifest list or image index + +## SYNOPSIS +**podman manifest inspect** [*options*] *listnameorindexname* + +## DESCRIPTION + +Displays the manifest list or image index stored using the specified image name. +## RETURN VALUE + +A formatted JSON representation of the manifest list or image index. + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Inspect the manifest of mylist:v1.11. +``` +podman manifest inspect mylist\:v1.11 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-manifest-push.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-manifest-push.1.md new file mode 100644 index 000000000..c3130ca87 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-manifest-push.1.md @@ -0,0 +1,173 @@ +--- +title: podman-manifest-push +version: v5.5.2 +--- + +% podman-manifest-push 1 + +## NAME +podman\-manifest\-push - Push a manifest list or image index to a registry + +## SYNOPSIS +**podman manifest push** [*options*] *listnameorindexname* [*destination*] + +## DESCRIPTION +Pushes a manifest list or image index to a registry. + +## RETURN VALUE +The list image's ID and the digest of the image's manifest. + +## OPTIONS + +#### **--add-compression**=*compression* + +Makes sure that requested compression variant for each platform is added to the manifest list keeping original instance +intact in the same manifest list. Supported values are (`gzip`, `zstd` and `zstd:chunked`). Following flag can be used +multiple times. + +Note that `--compression-format` controls the compression format of each instance in the manifest list. `--add-compression` +will add another variant for each instance in the list with the specified compressions. `--compression-format` gzip `--add-compression` +zstd will push a manifest list with each instance being compressed with gzip plus an additional variant of each instance +being compressed with zstd. + +#### **--all** + +Push the images mentioned in the manifest list or image index, in addition to +the list or index itself. (Default true) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/compression-format.md) +#### **--compression-format**=**gzip** | *zstd* | *zstd:chunked* + +Specifies the compression format to use. Supported values are: `gzip`, `zstd` and `zstd:chunked`. The default is `gzip` unless overridden in the containers.conf file. +`zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning in that case. + +[//]: # (END included file options/compression-format.md) + + +[//]: # (BEGIN included file options/compression-level.md) +#### **--compression-level**=*level* + +Specifies the compression level to use. The value is specific to the compression algorithm used, e.g. for zstd the accepted values are in the range 1-20 (inclusive) with a default of 3, while for gzip it is 1-9 (inclusive) and has a default of 5. + +[//]: # (END included file options/compression-level.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/digestfile.md) +#### **--digestfile**=*Digestfile* + +After copying the image, write the digest of the resulting image to the file. + +[//]: # (END included file options/digestfile.md) + + +[//]: # (BEGIN included file options/force-compression.md) +#### **--force-compression** + +If set, push uses the specified compression algorithm even if the destination contains a differently-compressed variant already. +Defaults to `true` if `--compression-format` is explicitly specified on the command-line, `false` otherwise. + +[//]: # (END included file options/force-compression.md) + +#### **--format**, **-f**=*format* + +Manifest list type (oci or v2s2) to use when pushing the list (default is oci). + +#### **--quiet**, **-q** + +When writing the manifest, suppress progress output + +#### **--remove-signatures** + +Don't copy signatures when pushing images. + +#### **--rm** + +Delete the manifest list or image index from local storage if pushing succeeds. + +#### **--sign-by**=*fingerprint* + +Sign the pushed images with a “simple signing” signature using the specified key. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-by-sigstore.md) +#### **--sign-by-sigstore**=*param-file* + +Add a sigstore signature based on further options specified in a container's sigstore signing parameter file *param-file*. +See containers-sigstore-signing-params.yaml(5) for details about the file format. + +[//]: # (END included file options/sign-by-sigstore.md) + +#### **--sign-by-sigstore-private-key**=*path* + +Sign the pushed images with a sigstore signature using a private key at the specified path. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-passphrase-file.md) +#### **--sign-passphrase-file**=*path* + +If signing the image (using either **--sign-by** or **--sign-by-sigstore-private-key**), read the passphrase to use from the specified path. + +[//]: # (END included file options/sign-passphrase-file.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## DESTINATION + + DESTINATION is the location the container image is pushed to. It supports all transports from `containers-transports(5)`. If no transport is specified, the `docker` (i.e., container registry) transport is used. For remote clients, including Mac and Windows (excluding WSL2) machines, `docker` is the only supported transport. + +## EXAMPLE + +Push manifest list to container registry: +``` +podman manifest push mylist:v1.11 docker://registry.example.org/mylist:v1.11 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-manifest-remove.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-manifest-remove.1.md new file mode 100644 index 000000000..fbb538b5f --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-manifest-remove.1.md @@ -0,0 +1,29 @@ +--- +title: podman-manifest-remove +version: v5.5.2 +--- + +% podman-manifest-remove 1 + +## NAME +podman\-manifest\-remove - Remove an item from a manifest list or image index + +## SYNOPSIS +**podman manifest remove** *listnameorindexname* *digest* + +## DESCRIPTION +Removes the item with the specified digest from the specified manifest list or image index. + +## RETURN VALUE +The list image's ID and the digest of the removed image's manifest. + +## EXAMPLE + +Remove specified digest from the manifest list: +``` +podman manifest remove mylist:v1.11 sha256:cb8a924afdf0229ef7515d9e5b3024e23b3eb03ddbba287f4a19c6ac90b8d221 +podman manifest remove e604eabaaee4858232761b4fef84e2316ed8f93e15eceafce845966ee3400036 sha256\:cb8a924afdf0229ef7515d9e5b3024e23b3eb03ddbba287f4a19c6ac90b8d221 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-manifest-rm.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-manifest-rm.1.md new file mode 100644 index 000000000..9ae0c9661 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-manifest-rm.1.md @@ -0,0 +1,36 @@ +--- +title: podman-manifest-rm +version: v5.5.2 +--- + +% podman-manifest-rm 1 + +## NAME +podman\-manifest\-rm - Remove manifest list or image index from local storage + +## SYNOPSIS +**podman manifest rm** [*options*] *list-or-index* [...] + +## DESCRIPTION +Removes one or more locally stored manifest lists. + +## OPTIONS + +#### **--ignore**, **-i** + +If a specified manifest does not exist in the local storage, ignore it and do not throw an error. + +## EXAMPLE + +podman manifest rm `` + +podman manifest rm listid1 listid2 + +**storage.conf** (`/etc/containers/storage.conf`) + +storage.conf is the storage configuration file for all tools using containers/storage + +The storage configuration file specifies all of the available container storage options for tools using shared container storage. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest(1)](podman-manifest.1.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-manifest.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-manifest.1.md new file mode 100644 index 000000000..de1c42ebd --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-manifest.1.md @@ -0,0 +1,76 @@ +--- +title: podman-manifest +version: v5.5.2 +--- + +% podman-manifest 1 + +## NAME +podman\-manifest - Create and manipulate manifest lists and image indexes + +## SYNOPSIS +**podman manifest** *subcommand* + +## DESCRIPTION +The `podman manifest` command provides subcommands which can be used to: + + * Create a working Docker manifest list or OCI image index. + +## SUBCOMMANDS + +| Command | Man Page | Description | +| -------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------------------- | +| add | [podman-manifest-add(1)](podman-manifest-add.1.md) | Add an image or artifact to a manifest list or image index. | +| annotate | [podman-manifest-annotate(1)](podman-manifest-annotate.1.md) | Add and update information about an image or artifact in a manifest list or image index. | +| create | [podman-manifest-create(1)](podman-manifest-create.1.md) | Create a manifest list or image index. | +| exists | [podman-manifest-exists(1)](podman-manifest-exists.1.md) | Check if the given manifest list exists in local storage | +| inspect | [podman-manifest-inspect(1)](podman-manifest-inspect.1.md) | Display a manifest list or image index. | +| push | [podman-manifest-push(1)](podman-manifest-push.1.md) | Push a manifest list or image index to a registry. | +| remove | [podman-manifest-remove(1)](podman-manifest-remove.1.md) | Remove an item from a manifest list or image index. | +| rm | [podman-manifest-rm(1)](podman-manifest-rm.1.md) | Remove manifest list or image index from local storage. | + +## EXAMPLES + +### Building a multi-arch manifest list from a Containerfile + +Assuming the `Containerfile` uses `RUN` instructions, the host needs +a way to execute non-native binaries. Configuring this is beyond +the scope of this example. Building a multi-arch manifest list +`shazam` in parallel across 4-threads can be done like this: + + $ platarch=linux/amd64,linux/ppc64le,linux/arm64,linux/s390x + $ podman build --jobs=4 --platform=$platarch --manifest shazam . + +**Note:** The `--jobs` argument is optional. Do not use the `podman build` command's `--tag` (or `-t`) option when building a multi-arch manifest list. + +### Assembling a multi-arch manifest from separately built images + +Assuming `example.com/example/shazam:$arch` images are built separately +on other hosts and pushed to the `example.com` registry. They may +be combined into a manifest list, and pushed using a simple loop: + + $ REPO=example.com/example/shazam + $ podman manifest create $REPO:latest + $ for IMGTAG in amd64 s390x ppc64le arm64; do \ + podman manifest add $REPO:latest docker://$REPO\:IMGTAG; \ + done + $ podman manifest push --all $REPO\:latest + +**Note:** The `add` instruction argument order is `` then ``. +Also, the `--all` push option is required to ensure all contents are +pushed, not just the native platform/arch. + +### Removing and tagging a manifest list before pushing + +Special care is needed when removing and pushing manifest lists, as opposed +to the contents. You almost always want to use the `manifest rm` and +`manifest push --all` subcommands. For example, a rename and push can +be performed like this: + + $ podman tag localhost/shazam example.com/example/shazam + $ podman manifest rm localhost/shazam + $ podman manifest push --all example.com/example/shazam + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-manifest-add(1)](podman-manifest-add.1.md)**, **[podman-manifest-annotate(1)](podman-manifest-annotate.1.md)**, **[podman-manifest-create(1)](podman-manifest-create.1.md)**, **[podman-manifest-inspect(1)](podman-manifest-inspect.1.md)**, **[podman-manifest-push(1)](podman-manifest-push.1.md)**, **[podman-manifest-remove(1)](podman-manifest-remove.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-mount.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-mount.1.md new file mode 100644 index 000000000..9739f6e85 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-mount.1.md @@ -0,0 +1,86 @@ +--- +title: podman-mount +version: v5.5.2 +--- + +% podman-mount 1 + +## NAME +podman\-mount - Mount a working container's root filesystem + +## SYNOPSIS +**podman mount** [*options*] [*container* ...] + +**podman container mount** [*options*] [*container* ...] + +## DESCRIPTION +Mounts the specified containers' root file system in a location which can be +accessed from the host, and returns its location. + +Podman lists all of the currently mounted containers, including external containers, when the command is executed +without any arguments. External containers are containers in container/storage by tools other than Podman. +For example Buildah and CRI-O. + +Rootless mode only supports mounting VFS driver, unless Podman is run within the user namespace +via the `podman unshare` command. All other storage drivers fails to mount. + +## RETURN VALUE +The location of the mounted file system. On error an empty string and errno is +returned. + +## OPTIONS + +#### **--all**, **-a** + +Mount all podman containers. (External containers are not mounted) + +#### **--format**=*format* + +Print the mounted containers in specified format (json). + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--no-trunc** + +Do not truncate the output (default *false*). + +## EXAMPLE + +In rootful mode, Mount specified container. +``` +# podman mount c831414b10a3 +/var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +``` + +In rootless mode, container mounting only works from inside the user namespace. +``` +$ podman unshare +# podman mount affectionate_mcnulty +/home/dwalsh/.local/share/containers/storage/overlay/4218326b9a80619aef005ff95067f76687ad975ce101c176598fb416f6186906/merged +``` + +List the currently mounted containers: +``` +podman mount +c831414b10a3 /var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +a7060253093b /var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged +``` + +Mount multiple containers: +``` +podman mount c831414b10a3 a7060253093b +/var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged +/var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-unmount(1)](podman-unmount.1.md)**, **[podman-unshare(1)](podman-unshare.1.md)**, **mount(8)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-network-connect.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-network-connect.1.md new file mode 100644 index 000000000..4ada1db06 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-network-connect.1.md @@ -0,0 +1,55 @@ +--- +title: podman-network-connect +version: v5.5.2 +--- + +% podman-network-connect 1 + +## NAME +podman\-network\-connect - Connect a container to a network + +## SYNOPSIS +**podman network connect** [*options*] network container + +## DESCRIPTION +Connects a container to a network. A container can be connected to a network by name or by ID. +Once connected, the container can communicate with other containers in the same network. + +## OPTIONS +#### **--alias**=*name* +Add network-scoped alias for the container. If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. Multiple *--alias* options may be specified as input. +NOTE: When using CNI, a container only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. + +#### **--ip**=*address* +Set a static ipv4 address for this container on this network. + +#### **--ip6**=*address* +Set a static ipv6 address for this container on this network. + +#### **--mac-address**=*address* +Set a static mac address for this container on this network. + +## EXAMPLE + +Connect specified container to a named network: +``` +podman network connect test web +``` + +Connect specified container to named network with two aliases: +``` +podman network connect --alias web1 --alias web2 test web +``` + +Connect specified container to named network with a static ip: +``` +podman network connect --ip 10.89.1.13 test web +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-network-disconnect(1)](podman-network-disconnect.1.md)** + +## HISTORY +November 2020, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-network-create.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-network-create.1.md new file mode 100644 index 000000000..31676e066 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-network-create.1.md @@ -0,0 +1,220 @@ +--- +title: podman-network-create +version: v5.5.2 +--- + +% podman-network-create 1 + +## NAME +podman\-network-create - Create a Podman network + +## SYNOPSIS +**podman network create** [*options*] [*name*] + +## DESCRIPTION +Create a network configuration for use with Podman. By default, Podman creates a bridge connection. +A *Macvlan* connection can be created with the *-d macvlan* option. A parent device for macvlan or +ipvlan can be designated with the *-o parent=``* or *--network-interface=``* option. + +If no options are provided, Podman assigns a free subnet and name for the network. + +Upon completion of creating the network, Podman displays the name of the newly added network. + +## OPTIONS +#### **--disable-dns** + +Disables the DNS plugin for this network which if enabled, can perform container to container name +resolution. It is only supported with the `bridge` driver, for other drivers it is always disabled. + +#### **--dns**=*ip* + +Set network-scoped DNS resolver/nameserver for containers in this network. If not set, the host servers from `/etc/resolv.conf` is used. It can be overwritten on the container level with the `podman run/create --dns` option. This option can be specified multiple times to set more than one IP. + +#### **--driver**, **-d**=*driver* + +Driver to manage the network. Currently `bridge`, `macvlan` and `ipvlan` are supported. Defaults to `bridge`. +As rootless the `macvlan` and `ipvlan` driver have no access to the host network interfaces because rootless networking requires a separate network namespace. + +The netavark backend allows the use of so called *netavark plugins*, see the +[plugin-API.md](https://github.com/containers/netavark/blob/main/plugin-API.md) +documentation in netavark. The binary must be placed in a specified directory +so podman can discover it, this list is set in `netavark_plugin_dirs` in +**[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** +under the `[network]` section. + +The name of the plugin can then be used as driver to create a network for your plugin. +The list of all supported drivers and plugins can be seen with `podman info --format {{.Plugins.Network}}`. + +Note that the `macvlan` and `ipvlan` drivers do not support port forwarding. Support for port forwarding +with a plugin depends on the implementation of the plugin. + +#### **--gateway**=*ip* + +Define a gateway for the subnet. To provide a gateway address, a +*subnet* option is required. Can be specified multiple times. +The argument order of the **--subnet**, **--gateway** and **--ip-range** options must match. + +#### **--ignore** + +Ignore the create request if a network with the same name already exists instead of failing. +Note, trying to create a network with an existing name and different parameters does not change the configuration of the existing one. + +#### **--interface-name**=*name* + +This option maps the *network_interface* option in the network config, see **podman network inspect**. +Depending on the driver, this can have different effects; for `bridge`, it uses the bridge interface name. +For `macvlan` and `ipvlan`, it is the parent device on the host. It is the same as `--opt parent=...`. + +#### **--internal** + +Restrict external access of this network when using a `bridge` network. Note when using the CNI backend +DNS will be automatically disabled, see **--disable-dns**. + +When using the `macvlan` or `ipvlan` driver with this option no default route will be added to the container. +Because it bypasses the host network stack no additional restrictions can be set by podman and if a +privileged container is run it can set a default route themselves. If this is a concern then the +container connections should be blocked on your actual network gateway. + +Using the `bridge` driver with this option has the following effects: + - Global IP forwarding sysctls will not be changed in the host network namespace. + - IP forwarding is disabled on the bridge interface instead of setting up a firewall. + - No default route will be added to the container. + +In all cases, aardvark-dns will only resolve container names with this option enabled. +Other queries will be answered with `NXDOMAIN`. + +#### **--ip-range**=*range* + +Allocate container IP from a range. The range must be a either a complete subnet in CIDR notation or be in +the `-` syntax which allows for a more flexible range compared to the CIDR subnet. +The *ip-range* option must be used with a *subnet* option. Can be specified multiple times. +The argument order of the **--subnet**, **--gateway** and **--ip-range** options must match. + +#### **--ipam-driver**=*driver* + +Set the ipam driver (IP Address Management Driver) for the network. When unset podman chooses an +ipam driver automatically based on the network driver. + +Valid values are: + + - `dhcp`: IP addresses are assigned from a dhcp server on the network. When using the netavark backend + the `netavark-dhcp-proxy.socket` must be enabled in order to start the dhcp-proxy when a container is + started, for CNI use the `cni-dhcp.socket` unit instead. + - `host-local`: IP addresses are assigned locally. + - `none`: No ip addresses are assigned to the interfaces. + +View the driver in the **podman network inspect** output under the `ipam_options` field. + +#### **--ipv6** + +Enable IPv6 (Dual Stack) networking. If no subnets are given, it allocates an ipv4 and an ipv6 subnet. + +#### **--label**=*label* + +Set metadata for a network (e.g., --label mykey=value). + +#### **--opt**, **-o**=*option* + +Set driver specific options. + +All drivers accept the `mtu`, `metric`, `no_default_route` and options. + +- `mtu`: Sets the Maximum Transmission Unit (MTU) and takes an integer value. +- `metric` Sets the Route Metric for the default route created in every container joined to this network. Accepts a positive integer value. Can only be used with the Netavark network backend. +- `no_default_route`: If set to 1, Podman will not automatically add a default route to subnets. Routes can still be added +manually by creating a custom route using `--route`. + +Additionally the `bridge` driver supports the following options: + +- `vlan`: This option assign VLAN tag and enables vlan\_filtering. Defaults to none. +- `isolate`: This option isolates networks by blocking traffic between those that have this option enabled. +- `com.docker.network.bridge.name`: This option assigns the given name to the created Linux Bridge +- `com.docker.network.driver.mtu`: Sets the Maximum Transmission Unit (MTU) and takes an integer value. +- `vrf`: This option assigns a VRF to the bridge interface. It accepts the name of the VRF and defaults to none. Can only be used with the Netavark network backend. +- `mode`: This option sets the specified bridge mode on the interface. Defaults to `managed`. Supported values: + - `managed`: Podman creates and deletes the bridge and changes sysctls of it. It adds firewall rules to masquerade outgoing traffic, as well as setup port forwarding for incoming traffic using DNAT. + - `unmanaged`: Podman uses an existing bridge. It must exist by the time you want to start a container which uses the network. There will be no NAT or port forwarding, even if such options were passed while creating the container. + +The `macvlan` and `ipvlan` driver support the following options: + +- `parent`: The host device which is used for the macvlan interface. Defaults to the default route interface. +- `mode`: This option sets the specified ip/macvlan mode on the interface. + - Supported values for `macvlan` are `bridge`, `private`, `vepa`, `passthru`. Defaults to `bridge`. + - Supported values for `ipvlan` are `l2`, `l3`, `l3s`. Defaults to `l2`. + +Additionally the `macvlan` driver supports the `bclim` option: + +- `bclim`: Set the threshold for broadcast queueing. Must be a 32 bit integer. Setting this value to `-1` disables broadcast queueing altogether. + +#### **--route**=*route* + +A static route in the format `,,`. This route will be added to every container in this network. Only available with the netavark backend. It can be specified multiple times if more than one static route is desired. + +#### **--subnet**=*subnet* + +The subnet in CIDR notation. Can be specified multiple times to allocate more than one subnet for this network. +The argument order of the **--subnet**, **--gateway** and **--ip-range** options must match. +This is useful to set a static ipv4 and ipv6 subnet. + +## EXAMPLE + +Create a network with no options. +``` +$ podman network create +podman2 +``` + +Create a network named *newnet* that uses *192.5.0.0/16* for its subnet. +``` +$ podman network create --subnet 192.5.0.0/16 newnet +newnet +``` + +Create an IPv6 network named *newnetv6* with a subnet of *2001\:db8::/64*. +``` +$ podman network create --subnet 2001:db8::/64 --ipv6 newnetv6 +newnetv6 +``` + +Create a network named *newnet* that uses *192.168.33.0/24* and defines a gateway as *192.168.33.3*. +``` +$ podman network create --subnet 192.168.33.0/24 --gateway 192.168.33.3 newnet +newnet +``` + +Create a network that uses a *192.168.55.0/24* subnet and has an IP address range of *192.168.55.129 - 192.168.55.254*. +``` +$ podman network create --subnet 192.168.55.0/24 --ip-range 192.168.55.128/25 +podman5 +``` + +Create a network with a static ipv4 and ipv6 subnet and set a gateway. +``` +$ podman network create --subnet 192.168.55.0/24 --gateway 192.168.55.3 --subnet fd52:2a5a:747e:3acd::/64 --gateway fd52:2a5a:747e:3acd::10 +podman4 +``` + +Create a network with a static subnet and a static route. +``` +$ podman network create --subnet 192.168.33.0/24 --route 10.1.0.0/24,192.168.33.10 newnet +``` + +Create a network with a static subnet and a static route without a default +route. +``` +$ podman network create --subnet 192.168.33.0/24 --route 10.1.0.0/24,192.168.33.10 --opt no_default_route=1 newnet +``` + +Create a Macvlan based network using the host interface eth0. Macvlan networks can only be used as root. +``` +$ sudo podman network create -d macvlan -o parent=eth0 --subnet 192.5.0.0/16 newnet +newnet +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-network-ls(1)](podman-network-ls.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +## HISTORY +August 2021, Updated with the new network format by Paul Holzinger + +August 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-network-disconnect.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-network-disconnect.1.md new file mode 100644 index 000000000..cf521117f --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-network-disconnect.1.md @@ -0,0 +1,37 @@ +--- +title: podman-network-disconnect +version: v5.5.2 +--- + +% podman-network-disconnect 1 + +## NAME +podman\-network\-disconnect - Disconnect a container from a network + +## SYNOPSIS +**podman network disconnect** [*options*] network container + +## DESCRIPTION +Disconnects a container from a network. A container can be disconnected from a network by name or by ID. +If all networks are disconnected from the container, it behaves like a container created with `--network=none` +and it does not have network connectivity until a network is connected again. + + +## OPTIONS +#### **--force**, **-f** + +Force the container to disconnect from a network + +## EXAMPLE + +Disconnect container from specified network: +``` +podman network disconnect test web +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-connect(1)](podman-network-connect.1.md)** + +## HISTORY +November 2020, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-network-exists.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-network-exists.1.md new file mode 100644 index 000000000..132bdc3dc --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-network-exists.1.md @@ -0,0 +1,47 @@ +--- +title: podman-network-exists +version: v5.5.2 +--- + +% podman-network-exists 1 + +## NAME +podman\-network\-exists - Check if the given network exists + +## SYNOPSIS +**podman network exists** *network* + +## DESCRIPTION +**podman network exists** checks if a network exists. The **Name** or **ID** +of the network may be used as input. Podman returns an exit code +of `0` when the network is found. A `1` is returned otherwise. An exit code of +`125` indicates there was another issue. + + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLE + +Check if specified network exists (the network does actually exist): +``` +$ podman network exists net1 +$ echo $? +0 +``` + +Check if nonexistent network exists: +``` +$ podman network exists webbackend +$ echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)** + +## HISTORY +January 2021, Originally compiled by Paul Holzinger `` diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-network-inspect.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-network-inspect.1.md new file mode 100644 index 000000000..88c31b157 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-network-inspect.1.md @@ -0,0 +1,83 @@ +--- +title: podman-network-inspect +version: v5.5.2 +--- + +% podman-network-inspect 1 + +## NAME +podman\-network\-inspect - Display the network configuration for one or more networks + +## SYNOPSIS +**podman network inspect** [*options*] *network* [*network* ...] + +## DESCRIPTION +Display the (JSON format) network configuration. + +## OPTIONS +#### **--format**, **-f**=*format* + +Pretty-print networks to JSON or using a Go template. + +| **Placeholder** | **Description** | +|--------------------|-------------------------------------------| +| .Containers ... | Running containers on this network. | +| .Created ... | Timestamp when the network was created | +| .DNSEnabled | Network has dns enabled (boolean) | +| .Driver | Network driver | +| .ID | Network ID | +| .Internal | Network is internal (boolean) | +| .IPAMOptions ... | Network ipam options | +| .IPv6Enabled | Network has ipv6 subnet (boolean) | +| .Labels ... | Network labels | +| .Name | Network name | +| .Network ... | Nested Network type | +| .NetworkDNSServers | Array of DNS servers used in this network | +| .NetworkInterface | Name of the network interface on the host | +| .Options ... | Network options | +| .Routes | List of static routes for this network | +| .Subnets | List of subnets on this network | + +## EXAMPLE + +Inspect the default podman network. + +``` +$ podman network inspect podman +[ + { + "name": "podman", + "id": "2f259bab93aaaaa2542ba43ef33eb990d0999ee1b9924b557b7be53c0b7a1bb9", + "driver": "bridge", + "network_interface": "podman0", + "created": "2021-06-03T12:04:33.088567413+02:00", + "subnets": [ + { + "subnet": "10.88.0.0/16", + "gateway": "10.88.0.1" + } + ], + "ipv6_enabled": false, + "internal": false, + "dns_enabled": false, + "ipam_options": { + "driver": "host-local" + } + } +] +``` + +Show the subnet and gateway for a network. + +``` +$ podman network inspect podman --format "{{range .Subnets}}Subnet: {{.Subnet}} Gateway: {{.Gateway}}{{end}}" +Subnet: 10.88.0.0/16 Gateway: 10.88.0.1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-ls(1)](podman-network-ls.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)** + +## HISTORY +August 2021, Updated with the new network format by Paul Holzinger + +August 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-network-ls.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-network-ls.1.md new file mode 100644 index 000000000..25de92cd4 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-network-ls.1.md @@ -0,0 +1,124 @@ +--- +title: podman-network-ls +version: v5.5.2 +--- + +% podman-network-ls 1 + +## NAME +podman\-network\-ls - Display a summary of networks + +## SYNOPSIS +**podman network ls** [*options*] + +## DESCRIPTION +Displays a list of existing podman networks. + +## OPTIONS +#### **--filter**, **-f**=*filter=value* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| **Filter** | **Description** | +| ---------- | ------------------------------------------------------------------------------------------------ | +| driver | Filter by driver type. | +| id | Filter by full or partial network ID. | +| label | Filter by network with (or without, in the case of label!=[...] is used) the specified labels. | +| name | Filter by network name (accepts `regex`). | +| until | Filter by networks created before given timestamp. | +| dangling | Filter by networks with no containers attached. | + + +The `driver` filter accepts values: `bridge`, `macvlan`, `ipvlan`. + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which shows images with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which shows images without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +The `dangling` *filter* accepts values `true` or `false`. + +#### **--format**=*format* + +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|--------------------|-------------------------------------------| +| .Created ... | Timestamp when the network was created | +| .DNSEnabled | Network has dns enabled (boolean) | +| .Driver | Network driver | +| .ID | Network ID | +| .Internal | Network is internal (boolean) | +| .IPAMOptions ... | Network ipam options | +| .IPv6Enabled | Network has ipv6 subnet (boolean) | +| .Labels | Network labels | +| .Name | Network name | +| .NetworkDNSServers | Array of DNS servers used in this network | +| .NetworkInterface | Name of the network interface on the host | +| .Options ... | Network options | +| .Routes | List of static routes for this network | +| .Subnets | List of subnets on this network | + +#### **--no-trunc** + +Do not truncate the network ID. + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +The `quiet` option restricts the output to only the network names. + +## EXAMPLE + +Display networks: +``` +$ podman network ls +NETWORK ID NAME DRIVER +88a7120ee19d podman bridge +6dd508dbf8cd podman6 bridge +8e35c2cd3bf6 podman5 macvlan +``` + +Display only network names: +``` +$ podman network ls -q +podman +podman2 +outside +podman9 +``` + +Display name of network which support bridge plugin: +``` +$ podman network ls --filter driver=bridge --format {{.Name}} +podman +podman2 +podman9 +``` +List networks with their subnets: +``` +$ podman network ls --format "{{.Name}}: {{range .Subnets}}{{.Subnet}} {{end}}" +podman: 10.88.0.0/16 +podman3: 10.89.30.0/24 fde4:f86f:4aab\:e68f::/64 +macvlan: +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)** + +## HISTORY +August 2021, Updated with the new network format by Paul Holzinger + +August 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-network-prune.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-network-prune.1.md new file mode 100644 index 000000000..ad6d0c877 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-network-prune.1.md @@ -0,0 +1,58 @@ +--- +title: podman-network-prune +version: v5.5.2 +--- + +% podman-network-prune 1 + +## NAME +podman\-network\-prune - Remove all unused networks + +## SYNOPSIS +**podman network prune** [*options*] + +## DESCRIPTION +Remove all unused networks. An unused network is defined by a network which +has no containers connected or configured to connect to it. It does not remove +the so-called default network which goes by the name of *podman*. + +## OPTIONS + +#### **--filter** + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------:|----------------------------------------------------------------------------------------------------| +| label | Only remove networks, with (or without, in the case of label!=[...] is used) the specified labels. | +| until | Only remove networks created before given timestamp. | + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes networks with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes networks without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not prompt for confirmation + +## EXAMPLE + +Prune networks: +``` +podman network prune +``` + +Prune all networks created not created in the last two hours: +``` +podman network prune --filter until=2h +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-rm(1)](podman-network-rm.1.md)** + +## HISTORY +February 2021, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-network-reload.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-network-reload.1.md new file mode 100644 index 000000000..93780c553 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-network-reload.1.md @@ -0,0 +1,67 @@ +--- +title: podman-network-reload +version: v5.5.2 +--- + +% podman-network-reload 1 + +## NAME +podman\-network\-reload - Reload network configuration for containers + +## SYNOPSIS +**podman network reload** [*options*] [*container...*] + +## DESCRIPTION +Reload one or more container network configurations. + +Rootful Podman relies on iptables rules in order to provide network connectivity. If the iptables rules are deleted, +this happens for example with `firewall-cmd --reload`, the container loses network connectivity. This command restores +the network connectivity. + +## OPTIONS +#### **--all**, **-a** + +Reload network configuration of all containers. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Reload the network configuration after a firewall reload: +``` +# podman run -p 80:80 -d nginx +b1b538e8bc4078fc3ee1c95b666ebc7449b9a97bacd15bcbe464a29e1be59c1c +# curl 127.0.0.1 +works +# sudo firewall-cmd --reload +success +# curl 127.0.0.1 +hangs +# podman network reload b1b538e8bc40 +b1b538e8bc4078fc3ee1c95b666ebc7449b9a97bacd15bcbe464a29e1be59c1c +# curl 127.0.0.1 +works +``` + +Reload the network configuration for all containers: +``` +# podman network reload --all +b1b538e8bc4078fc3ee1c95b666ebc7449b9a97bacd15bcbe464a29e1be59c1c +fe7e8eca56f844ec33af10f0aa3b31b44a172776e3277b9550a623ed5d96e72b +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)** + +## HISTORY +December 2020, Originally compiled by Paul Holzinger diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-network-rm.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-network-rm.1.md new file mode 100644 index 000000000..8d15410c8 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-network-rm.1.md @@ -0,0 +1,54 @@ +--- +title: podman-network-rm +version: v5.5.2 +--- + +% podman-network-rm 1 + +## NAME +podman\-network\-rm - Remove one or more networks + +## SYNOPSIS +**podman network rm** [*options*] [*network...*] + +## DESCRIPTION +Delete one or more Podman networks. + +## OPTIONS +#### **--force**, **-f** + +The `force` option removes all containers that use the named network. If the container is +running, the container is stopped and removed. + +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping the running containers that are using the specified network. The --force option must be specified to use the --time option. Use -1 for infinite wait. + +## EXAMPLE + +Delete specified network: +``` +# podman network rm podman9 +Deleted: podman9 +``` + +Delete specified network and all containers associated with the network: +``` +# podman network rm -f fred +Deleted: fred +``` + +## Exit Status + **0** All specified networks removed + + **1** One of the specified networks did not exist, and no other failures + + **2** The network is in use by a container or a Pod + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)** + +## HISTORY +August 2019, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-network-update.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-network-update.1.md new file mode 100644 index 000000000..67dba75e7 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-network-update.1.md @@ -0,0 +1,41 @@ +--- +title: podman-network-update +version: v5.5.2 +--- + +% podman-network-update 1 + +## NAME +podman\-network\-update - Update an existing Podman network + +## SYNOPSIS +**podman network update** [*options*] *network* + +## DESCRIPTION +Allow changes to existing container networks. At present, only changes to the DNS servers in use by a network is supported. + +NOTE: Only supported with the netavark network backend. + + +## OPTIONS +#### **--dns-add** + +Accepts array of DNS resolvers and add it to the existing list of resolvers configured for a network. + +#### **--dns-drop** + +Accepts array of DNS resolvers and removes them from the existing list of resolvers configured for a network. + +## EXAMPLE + +Update a network: +``` +$ podman network update network1 --dns-add 8.8.8.8,1.1.1.1 +``` + +Update a network and add/remove dns servers: +``` +$ podman network update network1 --dns-drop 8.8.8.8 --dns-add 3.3.3.3 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network(1)](podman-network.1.md)**, **[podman-network-inspect(1)](podman-network-inspect.1.md)**, **[podman-network-ls(1)](podman-network-ls.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-network.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-network.1.md new file mode 100644 index 000000000..f769cb19c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-network.1.md @@ -0,0 +1,61 @@ +--- +title: podman-network +version: v5.5.2 +--- + +% podman-network 1 + +## NAME +podman\-network - Manage Podman networks + +## SYNOPSIS +**podman network** *subcommand* + +## DESCRIPTION +The network command manages networks for Podman. + +Podman supports two network backends [Netavark](https://github.com/containers/netavark) +and [CNI](https://www.cni.dev/). Netavark is the default network backend and was added in Podman version 4.0. +CNI is deprecated and will be removed in the next major Podman version 5.0, in preference of Netavark. +To configure the network backend use the `network_backend` key under the `[Network]` in +**[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**. +New systems use netavark by default, to check what backend is used run +`podman info --format {{.Host.NetworkBackend}}`. + +All network commands work for both backends but CNI and Netavark use different config files +so networks have to be created again after a backend change. + +## COMMANDS + +| Command | Man Page | Description | +| ---------- | -------------------------------------------------------------- | --------------------------------------------------------------- | +| connect | [podman-network-connect(1)](podman-network-connect.1.md) | Connect a container to a network | +| create | [podman-network-create(1)](podman-network-create.1.md) | Create a Podman network | +| disconnect | [podman-network-disconnect(1)](podman-network-disconnect.1.md) | Disconnect a container from a network | +| exists | [podman-network-exists(1)](podman-network-exists.1.md) | Check if the given network exists | +| inspect | [podman-network-inspect(1)](podman-network-inspect.1.md) | Display the network configuration for one or more networks | +| ls | [podman-network-ls(1)](podman-network-ls.1.md) | Display a summary of networks | +| prune | [podman-network-prune(1)](podman-network-prune.1.md) | Remove all unused networks | +| reload | [podman-network-reload(1)](podman-network-reload.1.md) | Reload network configuration for containers | +| rm | [podman-network-rm(1)](podman-network-rm.1.md) | Remove one or more networks | +| update | [podman-network-update(1)](podman-network-update.1.md) | Update an existing Podman network | + +## SUBNET NOTES +Podman requires specific default IPs and, thus, network subnets. The default values used by Podman can be modified in the **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** file. + +### Podman network +The default bridge network (called `podman`) uses 10.88.0.0/16 as a subnet. When Podman runs as root, the `podman` network is used as default. It is the same as adding the option `--network bridge` or `--network podman`. This subnet can be changed in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** under the [network] section. Set the `default_subnet` to any subnet that is free in the environment. The name of the default network can also be changed from `podman` to another name using the default network key. Note that this is only done when no containers are running. + +### Pasta +Pasta by default performs no Network Address Translation (NAT) and copies the IPs from your main interface into the container namespace. If pasta cannot find an interface with the default route, it will select an interface if there is only one interface with a valid route. If you do not have a default route and several interfaces have defined routes, pasta will be unable to figure out the correct interface and it will fail to start. To specify the interface, use `-i` option to pasta. A default set of pasta options can be set in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** under the `[network]` section with the `pasta_options` key. + +The default rootless networking tool can be selected in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** under the `[network]` section with `default_rootless_network_cmd`, which can be set to `pasta` (default) or `slirp4netns`. + +### Slirp4netns +Slirp4netns uses 10.0.2.0/24 for its default network. This can also be changed in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** but under the `[engine]` section. Use the `network_cmd_options` key and add `["cidr=X.X.X.X/24"]` as a value. Note that slirp4netns needs a network prefix size between 1 and 25. This option accepts an array, so more options can be added in a comma-separated string as described on the **[podman-network-create(1)](podman-network-create.1.md)** man page. To change the CIDR for just one container, specify it on the cli using the `--network` option like this: `--network slirp4netns\:cidr=192.168.1.0/24`. + +### Podman network create +When a new network is created with a `podman network create` command, and no subnet is given with the --subnet option, Podman starts picking a free subnet from 10.89.0.0/24 to 10.255.255.0/24. Use the `default_subnet_pools` option under the `[network]` section in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** to change the range and/or size that is assigned by default. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-pause.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-pause.1.md new file mode 100644 index 000000000..3a40d1a33 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-pause.1.md @@ -0,0 +1,103 @@ +--- +title: podman-pause +version: v5.5.2 +--- + +% podman-pause 1 + +## NAME +podman\-pause - Pause one or more containers + +## SYNOPSIS +**podman pause** [*options*] [*container*...] + +**podman container pause** [*options*] [*container*...] + +## DESCRIPTION +Pauses all the processes in one or more containers. You may use container IDs or names as input. + +## OPTIONS + +#### **--all**, **-a** + +Pause all running containers. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and pause the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + +#### **--filter**, **-f**=*filter* + +Filter what containers pause. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Pause specified container: +``` +podman pause mywebserver +``` + +Pause container by partial container ID: +``` +podman pause 860a4b23 +``` + +Pause all **running** containers: +``` +podman pause --all +``` + +Pause container using ID specified in given files: +``` +podman pause --cidfile /home/user/cidfile-1 +podman pause --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +Pause the latest container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman pause --latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-unpause(1)](podman-unpause.1.md)** + +## HISTORY +September 2017, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-pod-clone.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-pod-clone.1.md new file mode 100644 index 000000000..db58d8de6 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-pod-clone.1.md @@ -0,0 +1,796 @@ +--- +title: podman-pod-clone +version: v5.5.2 +--- + +% podman-pod-clone 1 + +## NAME +podman\-pod\-clone - Create a copy of an existing pod + +## SYNOPSIS +**podman pod clone** [*options*] *pod* *name* + +## DESCRIPTION +**podman pod clone** creates a copy of a pod, recreating the identical config for the pod and for all of its containers. Users can modify the pods new name and select pod details within the infra container + +## OPTIONS + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the pod is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + +#### **--cpus** + +Set a number of CPUs for the pod that overrides the original pods CPU limits. If none are specified, the original pod's Nano CPUs are used. + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + +If none are specified, the original pod's CPUset is used. + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/destroy.md) +#### **--destroy** + +Remove the original pod that we are cloning once used to mimic the configuration. + +[//]: # (END included file options/destroy.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the pod. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The pod only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: the pod implements devices by storing the initial configuration passed by the user and recreating the device on each container added to the pod. + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + + +[//]: # (BEGIN included file options/gidmap.pod.md) +#### **--gidmap**=*pod_gid\:host_gid\:amount* + +GID map for the user namespace. Using this flag runs all containers in the pod with user namespace enabled. +It conflicts with the **--userns** and **--subgidname** flags. + +[//]: # (END included file options/gidmap.pod.md) + + +[//]: # (BEGIN included file options/gpus.md) +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. + +[//]: # (END included file options/gpus.md) + +#### **--help**, **-h** + +Print usage statement. + + +[//]: # (BEGIN included file options/hostname.pod.md) +#### **--hostname**=*name* + +Set the pod's hostname inside all containers. + +The given hostname is also added to the `/etc/hosts` file using the container's +primary IP address (also see the **--add-host** option). + +[//]: # (END included file options/hostname.pod.md) + + +[//]: # (BEGIN included file options/infra-command.md) +#### **--infra-command**=*command* + +The command that is run to start the infra container. Default: "/pause". + +[//]: # (END included file options/infra-command.md) + + +[//]: # (BEGIN included file options/infra-conmon-pidfile.md) +#### **--infra-conmon-pidfile**=*file* + +Write the pid of the infra container's **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to manage Podman containers and pods. + +[//]: # (END included file options/infra-conmon-pidfile.md) + + +[//]: # (BEGIN included file options/infra-name.md) +#### **--infra-name**=*name* + +The name that is used for the pod's infra container. + +[//]: # (END included file options/infra-name.md) + + +[//]: # (BEGIN included file options/label.md) +#### **--label**, **-l**=*key=value* + +Add metadata to a pod. + +[//]: # (END included file options/label.md) + + +[//]: # (BEGIN included file options/label-file.md) +#### **--label-file**=*file* + +Read in a line-delimited file of labels. + +[//]: # (END included file options/label-file.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + +#### **--name**, **-n** + +Set a custom name for the cloned pod. The default if not specified is of the syntax: **\-clone** + + +[//]: # (BEGIN included file options/pid.pod.md) +#### **--pid**=*pid* + +Set the PID mode for the pod. The default is to create a private PID namespace for the pod. Requires the PID namespace to be shared via --share. + + host: use the host’s PID namespace for the pod + ns: join the specified PID namespace + private: create a new namespace for the pod (default) + +[//]: # (END included file options/pid.pod.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + +Default restart policy for all the containers in a pod. + + +[//]: # (BEGIN included file options/security-opt.md) +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the pod +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the pod + +- **label=user:**_USER_: Set the label user for the pod processes +- **label=role:**_ROLE_: Set the label role for the pod processes +- **label=type:**_TYPE_: Set the label process type for the pod processes +- **label=level:**_LEVEL_: Set the label level for the pod processes +- **label=filetype:**_TYPE_: Set the label file type for the pod files +- **label=disable**: Turn off label separation for the pod + +Note: Labeling can be disabled for all pods/containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the containers within the pod. + +- **no-new-privileges**: Disable container processes from gaining additional privileges through the `execve(2)` system call (e.g. via setuid or setgid bits, or via file capabilities). Programs that rely on setuid/setgid bits set on their executable to change user id or group id are no longer able to do so, and any file capabilities added to the executable (e.g. via `setcap`) are not added to the permitted capability set. For more details, see: https://docs.kernel.org/userspace-api/no_new_privs.html. + +- **seccomp=unconfined**: Turn off seccomp confinement for the pod. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. + +[//]: # (END included file options/security-opt.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the pod. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/shm-size-systemd.md) +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. + +[//]: # (END included file options/shm-size-systemd.md) + +#### **--start** + +When set to true, this flag starts the newly created pod after the +clone process has completed. All containers within the pod are started. + + +[//]: # (BEGIN included file options/subgidname.md) +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. + +[//]: # (END included file options/subgidname.md) + + +[//]: # (BEGIN included file options/subuidname.md) +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. + +[//]: # (END included file options/subuidname.md) + + +[//]: # (BEGIN included file options/sysctl.md) +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters for all containers in the pod. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: if the ipc namespace is not shared within the pod, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: if the network namespace is not shared within the pod, the above sysctls are not allowed. + +[//]: # (END included file options/sysctl.md) + + +[//]: # (BEGIN included file options/uidmap.pod.md) +#### **--uidmap**=*container_uid\:from_uid\:amount* + +Run all containers in the pod in a new user namespace using the supplied mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +[//]: # (END included file options/uidmap.pod.md) + + +[//]: # (BEGIN included file options/userns.pod.md) +#### **--userns**=*mode* + +Set the user namespace mode for all the containers in a pod. It defaults to the `PODMAN_USERNS` environment variable. An empty value ("") means user namespaces are disabled. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +----------|---------------|--------------------- +"" |$UID |0 (Default User account mapped to root user in container.) +host |$UID |0 (Default User account mapped to root user in container.) +keep-id |$UID |$UID (Map user account to same UID within container.) +auto |$UID | nil (Host User UID is not mapped into container.) +nomap |$UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + + - *auto[:*_OPTIONS,..._*]*: automatically create a namespace. It is possible to specify these options to `auto`: + + - *gidmapping=*_CONTAINER\_GID\:HOST\_GID\:SIZE_ to force a GID mapping to be present in the user namespace. + + - *size=*_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates the size for the user namespace. + + - *uidmapping=*_CONTAINER\_UID\:HOST\_UID\:SIZE_ to force a UID mapping to be present in the user namespace. + + - *host*: run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user (default). + + - *keep-id*: creates a user namespace where the current rootless user's UID\:GID are mapped to the same values in the container. This option is not allowed for containers created by the root user. + + - *nomap*: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +[//]: # (END included file options/userns.pod.md) + + +[//]: # (BEGIN included file options/uts.pod.md) +#### **--uts**=*mode* + +Set the UTS namespace mode for the pod. The following values are supported: + +- **host**: use the host's UTS namespace inside the pod. +- **private**: create a new namespace for the pod (default). +- **ns:[path]**: run the pod in the given existing UTS namespace. + +[//]: # (END included file options/uts.pod.md) + + +[//]: # (BEGIN included file options/volume.md) +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the pod is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +pod. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a pod is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the pod, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the pod. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a pod. Without a label, the security system +might prevent the processes running inside the pod from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the pod context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +pods share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label. Only the current pod can use a private +volume. + +Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any one of the containers. Relabeling walks +the file system under the volume and changes the label on each file; if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the pod. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually changed with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the pod. +For example if a user wanted to volume mount their entire home directory into a +pod, they need to disable SELinux separation. + + $ podman pod clone --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The pod processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the pod +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous pod executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the pod infra container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the pod or infra container +to work. + +Do not modify the source directory mounted into the pod with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the pod are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the pod +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +pod, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +pod. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the pod. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the pod. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless pod fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/volume.md) + + +[//]: # (BEGIN included file options/volumes-from.md) +#### **--volumes-from**=*CONTAINER[\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers and pods. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +pod. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a pod. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the pod context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target pod, then the volume hides +that data on the target. + +[//]: # (END included file options/volumes-from.md) + +## EXAMPLES + +Clone the specified pod to a new pod. +``` +# podman pod clone pod-name +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone the specified pod to a new pod with a new name. +``` +# podman pod clone pod-name --name=cloned-pod +d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone and remove the specified pod to a new pod, modifying its cpus. +``` +# podman pod clone --destroy --cpus=5 d0cf1 +6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584 +``` + +Clone the specified pod to a new named pod. +``` +# podman pod clone 2d4d4fca7219b4437e0d74fcdc272c4f031426a6eacd207372691207079551de new_name +5a9b7851013d326aa4ac4565726765901b3ecc01fcbc0f237bc7fd95588a24f9 +``` +## SEE ALSO +**[podman-pod-create(1)](podman-pod-create.1.md)** + +## HISTORY +May 2022, Originally written by Charlie Doern + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a core value of open source. The `master` and `slave` mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately. diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-pod-create.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-pod-create.1.md new file mode 100644 index 000000000..9c832db7a --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-pod-create.1.md @@ -0,0 +1,1139 @@ +--- +title: podman-pod-create +version: v5.5.2 +--- + +% podman-pod-create 1 + +## NAME +podman\-pod\-create - Create a new pod + +## SYNOPSIS +**podman pod create** [*options*] [*name*] + +## DESCRIPTION + +Creates an empty pod, or unit of multiple containers, and prepares it to have +containers added to it. The pod can be created with a specific name. If a name +is not given a random name is generated. The pod ID is printed to STDOUT. You +can then use **podman create --pod `` ...** to add containers +to the pod, and **podman pod start ``** to start the pod. + +The operator can identify a pod in three ways: +UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”) +UUID short identifier (“f78375b1c487”) +Name (“jonah”) + +podman generates a UUID for each pod, and if a name is not assigned +to the container with **--name** then a random string name is generated +for it. This name is useful to identify a pod. + +Note: resource limit related flags work by setting the limits explicitly in the pod's cgroup parent +for all containers joining the pod. A container can override the resource limits when joining a pod. +For example, if a pod was created via **podman pod create --cpus=5**, specifying **podman container create --pod=`` --cpus=4** causes the container to use the smaller limit. Also, containers which specify their own cgroup, such as **--cgroupns=host**, do NOT get the assigned pod level cgroup resources. + +## OPTIONS + + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the pod's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + +The /etc/hosts file is shared between all containers in the pod. + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the pod is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + +#### **--cpus**=*amount* + +Set the total number of CPUs delegated to the pod. Default is 0.000 which indicates that there is no limit on computation power. + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the pod. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The pod only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: the pod implements devices by storing the initial configuration passed by the user and recreating the device on each container added to the pod. + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + +#### **--dns**=*ipaddr* + +Set custom DNS servers in the /etc/resolv.conf file that is shared between all containers in the pod. A special option, "none" is allowed which disables creation of /etc/resolv.conf for the pod. + +#### **--dns-option**=*option* + +Set custom DNS options in the /etc/resolv.conf file that is shared between all containers in the pod. + +#### **--dns-search**=*domain* + +Set custom DNS search domains in the /etc/resolv.conf file that is shared between all containers in the pod. + +#### **--exit-policy**=**continue** | *stop* + +Set the exit policy of the pod when the last container exits. Supported policies are: + +| Exit Policy | Description | +| ------------------ | -------------------------------------------------------------------------------------------------------------------------- | +| *continue* | The pod continues running, by keeping its infra container alive, when the last container exits. Used by default. | +| *stop* | The pod (including its infra container) is stopped when the last container exits. Used in `kube play`. | + + +[//]: # (BEGIN included file options/gidmap.pod.md) +#### **--gidmap**=*pod_gid\:host_gid\:amount* + +GID map for the user namespace. Using this flag runs all containers in the pod with user namespace enabled. +It conflicts with the **--userns** and **--subgidname** flags. + +[//]: # (END included file options/gidmap.pod.md) + + +[//]: # (BEGIN included file options/gpus.md) +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. + +[//]: # (END included file options/gpus.md) + +#### **--help**, **-h** + +Print usage statement. + + +[//]: # (BEGIN included file options/hostname.pod.md) +#### **--hostname**=*name* + +Set the pod's hostname inside all containers. + +The given hostname is also added to the `/etc/hosts` file using the container's +primary IP address (also see the **--add-host** option). + +[//]: # (END included file options/hostname.pod.md) + + +[//]: # (BEGIN included file options/hosts-file.md) +#### **--hosts-file**=*path* | *none* | *image* + +Base file to create the `/etc/hosts` file inside the container. This must either +be an absolute path to a file on the host system, or one of the following +special flags: + "" Follow the `base_hosts_file` configuration in _containers.conf_ (the default) + `none` Do not use a base file (i.e. start with an empty file) + `image` Use the container image's `/etc/hosts` file as base file + +[//]: # (END included file options/hosts-file.md) + +#### **--infra** + +Create an infra container and associate it with the pod. An infra container is a lightweight container used to coordinate the shared kernel namespace of a pod. Default: true. + + +[//]: # (BEGIN included file options/infra-command.md) +#### **--infra-command**=*command* + +The command that is run to start the infra container. Default: "/pause". + +[//]: # (END included file options/infra-command.md) + + +[//]: # (BEGIN included file options/infra-conmon-pidfile.md) +#### **--infra-conmon-pidfile**=*file* + +Write the pid of the infra container's **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to manage Podman containers and pods. + +[//]: # (END included file options/infra-conmon-pidfile.md) + +#### **--infra-image**=*image* + +The custom image that is used for the infra container. Unless specified, Podman builds a custom local image which does not require pulling down an image. + + +[//]: # (BEGIN included file options/infra-name.md) +#### **--infra-name**=*name* + +The name that is used for the pod's infra container. + +[//]: # (END included file options/infra-name.md) + + +[//]: # (BEGIN included file options/ip.md) +#### **--ip**=*ipv4* + +Specify a static IPv4 address for the pod, for example **10.88.64.128**. +This option can only be used if the pod is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the pod is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IP address pool (default **10.88.0.0/16**). + +To specify multiple static IP addresses per pod, set multiple networks using the **--network** option with a static IP address specified for each using the `ip` mode for that option. + +[//]: # (END included file options/ip.md) + + +[//]: # (BEGIN included file options/ip6.md) +#### **--ip6**=*ipv6* + +Specify a static IPv6 address for the pod, for example **fd46\:db93\:aa76\:ac37::10**. +This option can only be used if the pod is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the pod is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IPv6 address pool. + +To specify multiple static IPv6 addresses per pod, set multiple networks using the **--network** option with a static IPv6 address specified for each using the `ip6` mode for that option. + +[//]: # (END included file options/ip6.md) + + +[//]: # (BEGIN included file options/label.md) +#### **--label**, **-l**=*key=value* + +Add metadata to a pod. + +[//]: # (END included file options/label.md) + + +[//]: # (BEGIN included file options/label-file.md) +#### **--label-file**=*file* + +Read in a line-delimited file of labels. + +[//]: # (END included file options/label-file.md) + + +[//]: # (BEGIN included file options/mac-address.md) +#### **--mac-address**=*address* + +Pod network interface MAC address (e.g. 92\:d0\:c6:0a:29:33) +This option can only be used if the pod is joined to only a single network - i.e., **--network=_network-name_** is used at most once - +and if the pod is not joining another container's network namespace via **--network=container\:_id_**. + +Remember that the MAC address in an Ethernet network must be unique. +The IPv6 link-local address is based on the device's MAC address +according to RFC4862. + +To specify multiple static MAC addresses per pod, set multiple networks using the **--network** option with a static MAC address specified for each using the `mac` mode for that option. + +[//]: # (END included file options/mac-address.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + +#### **--name**, **-n**=*name* + +Assign a name to the pod. + + +[//]: # (BEGIN included file options/network.md) +#### **--network**=*mode*, **--net** + +Set the network mode for the pod. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + For better integration with DNS handling, **--dns-forward 169.254.1.1** is passed, + and this address is added to resolv.conf(5) as first resolver. It is possible to pass + **--dns-forward** explicitly in case a different IP address should be used. + To make the `host.containers.internal` /etc/hosts entry work and allow connections + to the host, **--map-guest-addr 169.254.1.2** is passed. Again, it can be set + explicitly to choose a different IP address. \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured (via Podman's + **--publish** or by passing the pasta **-t**/**-u** options directly), + to disable automatic port forwarding based on bound ports. Similarly, **-T none** + and **-U none** are given to disable the same functionality from container to + host. \ + All options can also be set in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**; + see the `pasta_options` key under the network section in that file. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.md) + +Invalid if using **--dns**, **--dns-option**, or **--dns-search** with **--network** set to **none** or **container:**_id_. + + +[//]: # (BEGIN included file options/network-alias.md) +#### **--network-alias**=*alias* + +Add a network-scoped alias for the pod, setting the alias for all networks that the container joins. To set a +name only for a specific network, use the alias option as described under the **--network** option. +If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. This option can be specified multiple times. +NOTE: When using CNI a pod only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. + +[//]: # (END included file options/network-alias.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the pod. + +Podman assumes control over the pod's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/pid.pod.md) +#### **--pid**=*pid* + +Set the PID mode for the pod. The default is to create a private PID namespace for the pod. Requires the PID namespace to be shared via --share. + + host: use the host’s PID namespace for the pod + ns: join the specified PID namespace + private: create a new namespace for the pod (default) + +[//]: # (END included file options/pid.pod.md) + +#### **--pod-id-file**=*path* + +Write the pod ID to the file. + + +[//]: # (BEGIN included file options/publish.md) +#### **--publish**, **-p**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Publish a container's port, or range of ports, within this pod to the host. + +Both *hostPort* and *containerPort* can be specified as a range of ports. +When specifying ranges for both, the number of container ports in the +range must match the number of host ports in the range. + +If host IP is set to 0.0.0.0 or not set at all, the port is bound on all IPs on the host. + +By default, Podman publishes TCP ports. To publish a UDP port instead, give +`udp` as protocol. To publish both TCP and UDP ports, set `--publish` twice, +with `tcp`, and `udp` as protocols respectively. Rootful containers can also +publish ports using the `sctp` protocol. + +Host port does not have to be specified (e.g. `podman run -p 127.0.0.1::80`). +If it is not, the container port is randomly assigned a port on the host. + +Use **podman port** to see the actual mapping: `podman port $CONTAINER $CONTAINERPORT`. + +Note that the network drivers `macvlan` and `ipvlan` do not support port forwarding, +therefore this option will have no effect on such networks. + +[//]: # (END included file options/publish.md) + +**Note:** You must not publish ports of containers in the pod individually, +but only by the pod itself. + +**Note:** This cannot be modified once the pod is created. + + +[//]: # (BEGIN included file options/replace.md) +#### **--replace** + +If another pod with the same name already exists, replace and remove it. The default is **false**. + +[//]: # (END included file options/replace.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + +Default restart policy for all the containers in a pod. + + +[//]: # (BEGIN included file options/security-opt.md) +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the pod +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the pod + +- **label=user:**_USER_: Set the label user for the pod processes +- **label=role:**_ROLE_: Set the label role for the pod processes +- **label=type:**_TYPE_: Set the label process type for the pod processes +- **label=level:**_LEVEL_: Set the label level for the pod processes +- **label=filetype:**_TYPE_: Set the label file type for the pod files +- **label=disable**: Turn off label separation for the pod + +Note: Labeling can be disabled for all pods/containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the containers within the pod. + +- **no-new-privileges**: Disable container processes from gaining additional privileges through the `execve(2)` system call (e.g. via setuid or setgid bits, or via file capabilities). Programs that rely on setuid/setgid bits set on their executable to change user id or group id are no longer able to do so, and any file capabilities added to the executable (e.g. via `setcap`) are not added to the permitted capability set. For more details, see: https://docs.kernel.org/userspace-api/no_new_privs.html. + +- **seccomp=unconfined**: Turn off seccomp confinement for the pod. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. + +[//]: # (END included file options/security-opt.md) + +#### **--share**=*namespace* + +A comma-separated list of kernel namespaces to share. If none or "" is specified, no namespaces are shared, and the infra container is not created unless explicitly specified via **--infra=true**. The namespaces to choose from are cgroup, ipc, net, pid, uts. If the option is prefixed with a "+", the namespace is appended to the default list. Otherwise, it replaces the default list. Defaults match Kubernetes default (ipc, net, uts) + +#### **--share-parent** + +This boolean determines whether or not all containers entering the pod use the pod as their cgroup parent. The default value of this option is true. Use the **--share** option to share the cgroup namespace rather than a cgroup parent in a pod. + +Note: This option conflicts with the **--share=cgroup** option since that option sets the pod as the cgroup parent but enters the container into the same cgroupNS as the infra container. + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the pod. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/shm-size-systemd.md) +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. + +[//]: # (END included file options/shm-size-systemd.md) + + +[//]: # (BEGIN included file options/subgidname.md) +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. + +[//]: # (END included file options/subgidname.md) + + +[//]: # (BEGIN included file options/subuidname.md) +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. + +[//]: # (END included file options/subuidname.md) + + +[//]: # (BEGIN included file options/sysctl.md) +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters for all containers in the pod. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: if the ipc namespace is not shared within the pod, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: if the network namespace is not shared within the pod, the above sysctls are not allowed. + +[//]: # (END included file options/sysctl.md) + + +[//]: # (BEGIN included file options/uidmap.pod.md) +#### **--uidmap**=*container_uid\:from_uid\:amount* + +Run all containers in the pod in a new user namespace using the supplied mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +[//]: # (END included file options/uidmap.pod.md) + + +[//]: # (BEGIN included file options/userns.pod.md) +#### **--userns**=*mode* + +Set the user namespace mode for all the containers in a pod. It defaults to the `PODMAN_USERNS` environment variable. An empty value ("") means user namespaces are disabled. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +----------|---------------|--------------------- +"" |$UID |0 (Default User account mapped to root user in container.) +host |$UID |0 (Default User account mapped to root user in container.) +keep-id |$UID |$UID (Map user account to same UID within container.) +auto |$UID | nil (Host User UID is not mapped into container.) +nomap |$UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + + - *auto[:*_OPTIONS,..._*]*: automatically create a namespace. It is possible to specify these options to `auto`: + + - *gidmapping=*_CONTAINER\_GID\:HOST\_GID\:SIZE_ to force a GID mapping to be present in the user namespace. + + - *size=*_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates the size for the user namespace. + + - *uidmapping=*_CONTAINER\_UID\:HOST\_UID\:SIZE_ to force a UID mapping to be present in the user namespace. + + - *host*: run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user (default). + + - *keep-id*: creates a user namespace where the current rootless user's UID\:GID are mapped to the same values in the container. This option is not allowed for containers created by the root user. + + - *nomap*: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +[//]: # (END included file options/userns.pod.md) + + +[//]: # (BEGIN included file options/uts.pod.md) +#### **--uts**=*mode* + +Set the UTS namespace mode for the pod. The following values are supported: + +- **host**: use the host's UTS namespace inside the pod. +- **private**: create a new namespace for the pod (default). +- **ns:[path]**: run the pod in the given existing UTS namespace. + +[//]: # (END included file options/uts.pod.md) + + +[//]: # (BEGIN included file options/volume.md) +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the pod is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +pod. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a pod is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the pod, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the pod. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a pod. Without a label, the security system +might prevent the processes running inside the pod from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the pod context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +pods share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label. Only the current pod can use a private +volume. + +Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any one of the containers. Relabeling walks +the file system under the volume and changes the label on each file; if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the pod. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually changed with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the pod. +For example if a user wanted to volume mount their entire home directory into a +pod, they need to disable SELinux separation. + + $ podman pod create --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The pod processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the pod +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous pod executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the pod infra container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the pod or infra container +to work. + +Do not modify the source directory mounted into the pod with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the pod are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the pod +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +pod, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +pod. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the pod. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the pod. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless pod fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/volume.md) + + +[//]: # (BEGIN included file options/volumes-from.md) +#### **--volumes-from**=*CONTAINER[\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers and pods. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +pod. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a pod. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the pod context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target pod, then the volume hides +that data on the target. + +[//]: # (END included file options/volumes-from.md) + +## EXAMPLES + +Create a named pod. +``` +$ podman pod create --name test +``` + +Create a named pod. +``` +$ podman pod create mypod +``` + +Create a pod without an infra container. +``` +$ podman pod create --infra=false +``` + +Create a named pod with infra container command to run. +``` +$ podman pod create --infra-command /top toppod +``` + +Create a pod with published ports on the host. +``` +$ podman pod create --publish 8443:443 +``` + +Create a pod with the specified network configuration. +``` +$ podman pod create --network slirp4netns:outbound_addr=127.0.0.1,allow_host_loopback=true +``` + +Create a pod with the specified network. +``` +$ podman pod create --network pasta +``` + +Create a pod on two networks. +``` +$ podman pod create --network net1\:ip=10.89.1.5 --network net2\:ip=10.89.10.10 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **containers.conf(1)**, **[cgroups(7)](https://man7.org/linux/man-pages/man7/cgroups.7.html)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +July 2018, Originally compiled by Peter Hunt + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a core value of open source. The `master` and `slave` mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately. diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-pod-exists.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-pod-exists.1.md new file mode 100644 index 000000000..f5ef55a1e --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-pod-exists.1.md @@ -0,0 +1,38 @@ +--- +title: podman-pod-exists +version: v5.5.2 +--- + +% podman-pod-exists 1 + +## NAME +podman-pod-exists - Check if a pod exists in local storage + +## SYNOPSIS +**podman pod exists** *pod* + +## DESCRIPTION +**podman pod exists** checks if a pod exists in local storage. The **ID** or **Name** +of the pod may be used as input. Podman returns an exit code +of `0` when the pod is found. A `1` is returned otherwise. An exit code of `125` indicates there +was an issue accessing the local storage. + +## EXAMPLES + +Check if specified pod exists in local storage (the pod does actually exist): +``` +$ sudo podman pod exists web; echo $? +0 +``` + +Check if specified pod exists in local storage (the pod does not actually exist): +``` +$ sudo podman pod exists backend; echo $? +1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +December 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-pod-inspect.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-pod-inspect.1.md new file mode 100644 index 000000000..4e0b7656d --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-pod-inspect.1.md @@ -0,0 +1,113 @@ +--- +title: podman-pod-inspect +version: v5.5.2 +--- + +% podman-pod-inspect 1 + +## NAME +podman\-pod\-inspect - Display information describing a pod + +## SYNOPSIS +**podman pod inspect** [*options*] *pod* ... + +## DESCRIPTION +Displays configuration and state information about a given pod. It also displays information about containers +that belong to the pod. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|----------------------|---------------------------------------------| +| .BlkioDeviceReadBps | Block I/O Device Read, in bytes/sec | +| .BlkioDeviceWriteBps | Block I/O Device Read, in bytes/sec | +| .BlkioWeight | Block I/O Weight | +| .BlkioWeightDevice | Block I/O Device Weight | +| .CgroupParent | Pod cgroup parent | +| .CgroupPath | Pod cgroup path | +| .Containers | Pod containers | +| .CPUPeriod | CPU period | +| .CPUQuota | CPU quota | +| .CPUSetCPUs | CPU Set CPUs | +| .CPUSetMems | CPU Set Mems | +| .CPUShares | CPU Shares | +| .CreateCgroup | Whether cgroup was created | +| .CreateCommand | Create command | +| .Created ... | Time when the pod was created | +| .CreateInfra | Whether infrastructure created | +| .Devices | Devices | +| .ExitPolicy | Exit policy | +| .Hostname | Pod hostname | +| .ID | Pod ID | +| .InfraConfig ... | Infra config (contains further fields) | +| .InfraContainerID | Pod infrastructure ID | +| .InspectPodData ... | Nested structure, for experts only | +| .Labels ... | Pod labels | +| .LockNumber | Number of the pod's Libpod lock | +| .MemoryLimit | Memory limit, bytes | +| .MemorySwap | Memory swap limit, in bytes | +| .Mounts | Mounts | +| .Name | Pod name | +| .Namespace | Namespace | +| .NumContainers | Number of containers in the pod | +| .RestartPolicy | Restart policy of the pod | +| .SecurityOpts | Security options | +| .SharedNamespaces | Pod shared namespaces | +| .State | Pod state | +| .VolumesFrom | Volumes from | + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Inspect specified pod: +``` +# podman pod inspect foobar +[ + { + "Id": "3513ca70583dd7ef2bac83331350f6b6c47d7b4e526c908e49d89ebf720e4693", + "Name": "foobar", + "Labels": {}, + "CgroupParent": "/libpod_parent", + "CreateCgroup": true, + "Created": "2018-08-08T11:15:18.823115347-05:00" + "State": "created", + "Hostname": "", + "SharedNamespaces": [ + "uts", + "ipc", + "net" + ] + "CreateInfra": false, + "InfraContainerID": "1020dd70583dd7ff2bac83331350f6b6e007de0d026c908e49d89ebf891d4699" + "CgroupPath": "" + "Containers": [ + { + "id": "d53f8bf1e9730281264aac6e6586e327429f62c704abea4b6afb5d8a2b2c9f2c", + "state": "configured" + } + ] + } +] +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +August 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-pod-kill.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-pod-kill.1.md new file mode 100644 index 000000000..654dd0f16 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-pod-kill.1.md @@ -0,0 +1,73 @@ +--- +title: podman-pod-kill +version: v5.5.2 +--- + +% podman-pod-kill 1 + +## NAME +podman\-pod\-kill - Kill the main process of each container in one or more pods + +## SYNOPSIS +**podman pod kill** [*options*] *pod* ... + +## DESCRIPTION +The main process of each container inside the pods specified is sent SIGKILL, or any signal specified with option --signal. + +## OPTIONS +#### **--all**, **-a** + +Sends signal to all containers associated with a pod. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/signal.md) +#### **--signal**, **-s**=**signal** + +Signal to send to the containers in the pod. For more information on Linux signals, refer to *signal(7)*. +The default is **SIGKILL**. + +[//]: # (END included file options/signal.md) + +## EXAMPLE + +Kill pod with a given name: +``` +podman pod kill mywebserver +``` + +Kill pod with a given ID: +``` +podman pod kill 860a4b23 +``` + +Terminate pod by sending `TERM` signal: +``` +podman pod kill --signal TERM 860a4b23 +``` + +Kill the latest pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman pod kill --latest +``` + +Terminate all pods by sending `KILL` signal: +``` +podman pod kill --all +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-stop(1)](podman-pod-stop.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-pod-logs.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-pod-logs.1.md new file mode 100644 index 000000000..badb55746 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-pod-logs.1.md @@ -0,0 +1,136 @@ +--- +title: podman-pod-logs +version: v5.5.2 +--- + +% podman-pod-logs 1 + +## NAME +podman\-pod\-logs - Display logs for pod with one or more containers + +## SYNOPSIS +**podman pod logs** [*options*] *pod* + +## DESCRIPTION +The podman pod logs command batch-retrieves whatever logs are present with all the containers of a pod. Pod logs can be filtered by container name or ID using flag **-c** or **--container** if needed. + +Note: A long-running `podman pod log` command with a `-f` or `--follow` option needs to be reinvoked if a new container is added to the pod dynamically; otherwise, logs of newly added containers are not visible in the log stream. + +## OPTIONS + + +[//]: # (BEGIN included file options/color.md) +#### **--color** + +Output the containers with different colors in the log. + +[//]: # (END included file options/color.md) + +#### **--container**, **-c** + +By default, `podman pod logs` retrieves logs for all the containers available within the pod, differentiated by the field `container`. However, there are use cases where the user wants to limit the log stream only to a particular container of a pod. For such cases, `-c` can be used like `podman pod logs -c ctrNameorID podname`. + + +[//]: # (BEGIN included file options/follow.md) +#### **--follow**, **-f** + +Follow log output. Default is false. + +Note: When following a pod which is removed by `podman pod rm` +or removed on exit (`podman run --rm ...`), there is a chance that the log +file is removed before `podman pod logs` reads the final content. + +[//]: # (END included file options/follow.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/names.md) +#### **--names**, **-n** + +Output the container names instead of the container IDs in the log. + +[//]: # (END included file options/names.md) + + +[//]: # (BEGIN included file options/since.md) +#### **--since**=*TIMESTAMP* + +Show logs since TIMESTAMP. The --since option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. + +[//]: # (END included file options/since.md) + + +[//]: # (BEGIN included file options/tail.md) +#### **--tail**=*LINES* + +Output the specified number of LINES at the end of the logs. LINES must be an integer. Defaults to -1, +which prints all lines + +[//]: # (END included file options/tail.md) + + +[//]: # (BEGIN included file options/timestamps.md) +#### **--timestamps**, **-t** + +Show timestamps in the log outputs. The default is false + +[//]: # (END included file options/timestamps.md) + + +[//]: # (BEGIN included file options/until.md) +#### **--until**=*TIMESTAMP* + +Show logs until TIMESTAMP. The --until option can be Unix timestamps, date formatted timestamps, or Go duration +strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted +time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, +and 2006-01-02. + +[//]: # (END included file options/until.md) + +## EXAMPLE + +To view a pod's logs: +``` +podman pod logs -t podIdorName +``` + +To view logs of a specific container on the pod: +``` +podman pod logs -c ctrIdOrName podIdOrName +``` + +To view all pod logs: +``` +podman pod logs -t --since 0 myserver-pod-1 +``` + +To view a pod's logs since a certain time: +``` +podman pod logs -t --since 2017-08-07T10:10:09.055837383-04:00 myserver-pod-1 +``` + +To view a pod's logs generated in the last 10 minutes: +``` +podman pod logs --since 10m myserver-pod-1 +``` + +To view a pod's logs until 30 minutes ago: +``` +podman pod logs --until 30m myserver-pod-1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-rm(1)](podman-pod-rm.1.md)**, **[podman-logs(1)](podman-logs.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-pod-pause.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-pod-pause.1.md new file mode 100644 index 000000000..94df36208 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-pod-pause.1.md @@ -0,0 +1,43 @@ +--- +title: podman-pod-pause +version: v5.5.2 +--- + +% podman-pod-pause 1 + +## NAME +podman\-pod\-pause - Pause one or more pods + +## SYNOPSIS +**podman pod pause** [*options*] *pod* ... + +## DESCRIPTION +Pauses all the running processes in the containers of one or more pods. You may use pod IDs or names as input. + +## OPTIONS + +#### **--all**, **-a** + +Pause all pods. + +#### **--latest**, **-l** + +Instead of providing the pod name or ID, pause the last created pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +## EXAMPLE + +Pause a pod with a given name: +``` +podman pod pause mywebserverpod +``` + +Pause a pod with a given ID: +``` +podman pod pause 860a4b23 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-unpause(1)](podman-pod-unpause.1.md)**, **[podman-pause(1)](podman-pause.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-pod-prune.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-pod-prune.1.md new file mode 100644 index 000000000..0ae1f845b --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-pod-prune.1.md @@ -0,0 +1,38 @@ +--- +title: podman-pod-prune +version: v5.5.2 +--- + +% podman-pod-prune 1 + +## NAME +podman-pod-prune - Remove all stopped pods and their containers + +## SYNOPSIS +**podman pod prune** [*options*] + +## DESCRIPTION +**podman pod prune** removes all stopped pods and their containers from local storage. + +## OPTIONS + +#### **--force**, **-f** +Force removal of all running pods and their containers. The default is false. + +## EXAMPLES + +Remove all stopped pods and their containers from local storage. +``` +$ sudo podman pod prune +22b8813332948064b6566370088c5e0230eeaf15a58b1c5646859fd9fc364fe7 +2afb26869fe5beab979c234afb75c7506063cd4655b1a73557c9d583ff1aebe9 +49161ad2a722cf18722f0e17199a9e840703a17d1158cdeda502b6d54080f674 +5ca429f37fb83a9f54eea89e3a9102b7780a6e6ae5f132db0672da551d862c4a +6bb06573787efb8b0675bc88ebf8361f1a56d3ac7922d1a6436d8f59ffd955f1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +April 2019, Originally compiled by Peter Hunt (pehunt at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-pod-ps.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-pod-ps.1.md new file mode 100644 index 000000000..d16924e09 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-pod-ps.1.md @@ -0,0 +1,206 @@ +--- +title: podman-pod-ps +version: v5.5.2 +--- + +% podman-pod-ps 1 + +## NAME +podman\-pod\-ps - Print out information about pods + +## SYNOPSIS +**podman pod ps** [*options*] + +## DESCRIPTION +**podman pod ps** lists the pods on the system. +By default it lists: + + * pod ID + * pod name + * the time the pod was created + * number of containers attached to pod + * container ID of the pod infra container + * status of pod as defined by the following table + +| **Status** | **Description** | +| ------------ | ------------------------------------------------| +| Created | No containers running nor stopped | +| Running | at least one container is running | +| Stopped | At least one container stopped and none running | +| Exited | All containers stopped in pod | +| Dead | Error retrieving state | + + +## OPTIONS + +#### **--ctr-ids** + +Display the container IDs + +#### **--ctr-names** + +Display the container names + +#### **--ctr-status** + +Display the container statuses + +#### **--filter**, **-f**=*filter* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|------------|--------------------------------------------------------------------------------------------------| +| ctr-ids | Filter by container ID within the pod. (CID prefix match by default; accepts regex) | +| ctr-names | Filter by container name within the pod. | +| ctr-number | Filter by number of containers in the pod. | +| ctr-status | Filter by container status within the pod. | +| id | Filter by pod ID. (Prefix match by default; accepts regex) | +| label | Filter by container with (or without, in the case of label!=[...] is used) the specified labels. | +| name | Filter by pod name. | +| network | Filter by network name or full ID of network. | +| status | Filter by pod status. | +| until | Filter by pods created before given timestamp. | + +The `ctr-ids`, `ctr-names`, `id`, `name` filters accept `regex` format. + +The `ctr-status` filter accepts values: `created`, `running`, `paused`, `stopped`, `exited`, `unknown`. + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes containers with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes containers without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +The `status` filter accepts values: `stopped`, `running`, `paused`, `exited`, `dead`, `created`, `degraded`. + +#### **--format**=*format* + +Pretty-print containers to JSON or using a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|---------------------|------------------------------------------------------| +| .Cgroup | Cgroup path of pod | +| .ContainerIds | Comma-separated list of container IDs in the pod | +| .ContainerNames | Comma-separated list of container names in the pod | +| .ContainerStatuses | Comma-separated list of container statuses | +| .Created | Creation time of pod | +| .ID | Container ID | +| .InfraID | Pod infra container ID | +| .Label *string* | Specified label of the pod | +| .Labels ... | All the labels assigned to the pod | +| .Name | Name of pod | +| .Networks | Show all networks connected to the infra container | +| .NumberOfContainers | Show the number of containers attached to pod | +| .Restarts | Show the total number of container restarts in a pod | +| .Status | Status of pod | + +#### **--help**, **-h** + +Print usage statement + +#### **--latest**, **-l** + +Show the latest pod created (all states) (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +#### **--namespace**, **--ns** + +Display namespace information of the pod + +#### **--no-trunc** + +Do not truncate the output (default *false*). + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Print the numeric IDs of the pods only + +#### **--sort** + +Sort by created, ID, name, status, or number of containers + +Default: created + +## EXAMPLES + +List all running pods. +``` +$ podman pod ps +POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS +00dfd6fa02c0 jolly_goldstine Running 31 hours ago ba465ab0a3a4 1 +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a 2 +``` + +List all running pods along with container names within the pods. +``` +$ podman pod ps --ctr-names +POD ID NAME STATUS CREATED INFRA ID NAMES +00dfd6fa02c0 jolly_goldstine Running 31 hours ago ba465ab0a3a4 loving_archimedes +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a thirsty_hawking,wizardly_golick +``` + +List all running pods along with status, names and ids. +``` +$ podman pod ps --ctr-status --ctr-names --ctr-ids +POD ID NAME STATUS CREATED INFRA ID IDS NAMES STATUS +00dfd6fa02c0 jolly_goldstine Running 31 hours ago ba465ab0a3a4 ba465ab0a3a4 loving_archimedes running +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a 331693bff40a,8e428daeb89e thirsty_hawking,wizardly_golick configured,configured +``` + +List all running pods and print ID, Container Names, and cgroups. +``` +$ podman pod ps --format "{{.ID}} {{.ContainerNames}} {{.Cgroup}}" +00dfd6fa02c0 loving_archimedes /libpod_parent +f4df8692e116 thirsty_hawking,wizardly_golick /libpod_parent +``` + +List all running pods with two containers sorted by pod ID. +``` +$ podman pod ps --sort id --filter ctr-number=2 +POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a 2 +``` + +List all running pods with their container ids. +``` +$ podman pod ps --ctr-ids +POD ID NAME STATUS CREATED INFRA ID IDS +00dfd6fa02c0 jolly_goldstine Running 31 hours ago ba465ab0a3a4 ba465ab0a3a4 +f4df8692e116 nifty_torvalds Created 10 minutes ago 331693bff40a 331693bff40a,8e428daeb89e +``` + +List all running pods with container ids without truncating IDs. +``` +$ podman pod ps --no-trunc --ctr-ids +POD ID NAME STATUS CREATED INFRA ID IDS +00dfd6fa02c0a2daaedfdf8fcecd06f22ad114d46d167d71777224735f701866 jolly_goldstine Running 31 hours ago ba465ab0a3a4e15e3539a1e79c32d1213a02b0989371e274f98e0f1ae9de7050 ba465ab0a3a4e15e3539a1e79c32d1213a02b0989371e274f98e0f1ae9de7050 +f4df8692e116a3e6d1d62572644ed36ca475d933808cc3c93435c45aa139314b nifty_torvalds Created 10 minutes ago 331693bff40a926b6d52b184e116afd15497610c378d5d4c42945dd6e33b75b0 331693bff40a926b6d52b184e116afd15497610c378d5d4c42945dd6e33b75b0,8e428daeb89e69b71e7916a13accfb87d122889442b5c05c2d99cf94a3230e9d +``` + +List all running pods with container names. +``` +$ podman pod ps --ctr-names +POD ID NAME STATUS CREATED INFRA ID NAMES +314f4da82d74 hi Created 17 hours ago a9f2d2165675 jovial_jackson,hopeful_archimedes,vibrant_ptolemy,heuristic_jennings,keen_raman,hopeful_newton,mystifying_bose,silly_lalande,serene_lichterman ... +``` + +## pod ps +Print a list of pods + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-pod-restart.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-pod-restart.1.md new file mode 100644 index 000000000..a362ebfae --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-pod-restart.1.md @@ -0,0 +1,64 @@ +--- +title: podman-pod-restart +version: v5.5.2 +--- + +% podman-pod-restart 1 + +## NAME +podman\-pod\-restart - Restart one or more pods + +## SYNOPSIS +**podman pod restart** [*options*] *pod* ... + +## DESCRIPTION +Restart containers in one or more pods. Running containers are stopped and restarted. +Stopped containers are started. You may use pod IDs or names as input. +The pod ID is printed upon successful restart. +When restarting multiple pods, an error from restarting one pod does not effect restarting other pods. + +## OPTIONS + +#### **--all**, **-a** + +Restarts all pods + +#### **--latest**, **-l** + +Instead of providing the pod name or ID, restart the last created pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +## EXAMPLE + +Restart pod with a given name: +``` +podman pod restart mywebserverpod +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` + +Restart multiple pods with given IDs: +``` +podman pod restart 490eb 3557fb +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +``` + +Restart the last created pod: +``` +podman pod restart --latest +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +``` + +Restart all pods: +``` +podman pod restart --all +19456b4cd557eaf9629825113a552681a6013f8c8cad258e36ab825ef536e818 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +70c358daecf71ef9be8f62404f926080ca0133277ef7ce4f6aa2d5af6bb2d3e9 +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-restart(1)](podman-restart.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-pod-rm.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-pod-rm.1.md new file mode 100644 index 000000000..1a5e23299 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-pod-rm.1.md @@ -0,0 +1,109 @@ +--- +title: podman-pod-rm +version: v5.5.2 +--- + +% podman-pod-rm 1 + +## NAME +podman\-pod\-rm - Remove one or more stopped pods and containers + +## SYNOPSIS +**podman pod rm** [*options*] *pod* + +## DESCRIPTION +**podman pod rm** removes one or more stopped pods and their containers from the host. The pod name or ID can be used. The \-f option stops all containers and then removes them before removing the pod. If all containers added by the user are in an exited state, the pod is removed. + +## OPTIONS + +#### **--all**, **-a** + +Remove all pods. Can be used in conjunction with \-f as well. + +#### **--force**, **-f** + +Stop running containers and delete all stopped containers before removal of pod. + + +[//]: # (BEGIN included file options/ignore.md) +#### **--ignore**, **-i** + +Ignore errors when specified pods are not in the container store. A user +might have decided to manually remove a pod which leads to a failure +during the ExecStop directive of a systemd service referencing that pod. + +[//]: # (END included file options/ignore.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/pod-id-file.pod.md) +#### **--pod-id-file**=*file* + +Read pod ID from the specified *file* and rm the pod. Can be specified multiple times. + +[//]: # (END included file options/pod-id-file.pod.md) +If specified, the pod-id-file is removed along with the pod. + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping running containers within the pod. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +The --force option must be specified to use the --time option. + +## EXAMPLE + +Remove pod with a given name: +``` +podman pod rm mywebserverpod +``` + +Remove multiple pods with given names and/or IDs: +``` +podman pod rm mywebserverpod myflaskserverpod 860a4b23 +``` + +Forcefully remove pod with a given ID: +``` +podman pod rm -f 860a4b23 +``` + +Forcefully remove all pods: +``` +podman pod rm -f -a +podman pod rm -fa +``` + +Remove pod using ID specified in a given file: +``` +podman pod rm --pod-id-file /path/to/id/file +``` + +## Exit Status + **0** All specified pods removed + + **1** One of the specified pods did not exist, and no other failures + + **2** One of the specified pods is attached to a container + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-pod-start.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-pod-start.1.md new file mode 100644 index 000000000..0a5ec06f7 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-pod-start.1.md @@ -0,0 +1,74 @@ +--- +title: podman-pod-start +version: v5.5.2 +--- + +% podman-pod-start 1 + +## NAME +podman\-pod\-start - Start one or more pods + +## SYNOPSIS +**podman pod start** [*options*] *pod* ... + +## DESCRIPTION +Start containers in one or more pods. You may use pod IDs or names as input. The pod must have a container attached +to be started. + +## OPTIONS + +#### **--all**, **-a** + +Starts all pods + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/pod-id-file.pod.md) +#### **--pod-id-file**=*file* + +Read pod ID from the specified *file* and start the pod. Can be specified multiple times. + +[//]: # (END included file options/pod-id-file.pod.md) + +## EXAMPLE + +Start pod with a given name: +``` +podman pod start mywebserverpod +``` + +Start pods with given IDs: +``` +podman pod start 860a4b23 5421ab4 +``` + +Start the latest pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman pod start --latest +``` + +Start all pods: +``` +podman pod start --all +``` + +Start pod using ID specified in a given file: +``` +podman pod start --pod-id-file /path/to/id/file +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-stop(1)](podman-pod-stop.1.md)** + +## HISTORY +July 2018, Adapted from podman start man page by Peter Hunt diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-pod-stats.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-pod-stats.1.md new file mode 100644 index 000000000..0346624b2 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-pod-stats.1.md @@ -0,0 +1,116 @@ +--- +title: podman-pod-stats +version: v5.5.2 +--- + +% podman-pod-stats 1 + +## NAME +podman\-pod\-stats - Display a live stream of resource usage stats for containers in one or more pods + +## SYNOPSIS +**podman pod stats** [*options*] [*pod*] + +## DESCRIPTION +Display a live stream of containers in one or more pods resource usage statistics. Running rootless is only supported on cgroups v2. + +## OPTIONS + +#### **--all**, **-a** + +Show all containers. Only running containers are shown by default + +#### **--format**=*template* + +Pretty-print container statistics to JSON or using a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| --------------- | ------------------ | +| .BlockIO | Block IO | +| .CID | Container ID | +| .CPU | CPU percentage | +| .Mem | Memory percentage | +| .MemUsage | Memory usage | +| .MemUsageBytes | Memory usage (IEC) | +| .Name | Container Name | +| .NetIO | Network IO | +| .PIDS | Number of PIDs | +| .Pod | Pod ID | + +When using a Go template, precede the format with `table` to print headers. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/no-reset.md) +#### **--no-reset** + +Do not clear the terminal/screen in between reporting intervals + +[//]: # (END included file options/no-reset.md) + + +[//]: # (BEGIN included file options/no-stream.md) +#### **--no-stream** + +Disable streaming pod stats and only pull the first result, default setting is false + +[//]: # (END included file options/no-stream.md) + +## EXAMPLE + +List statistics about all pods without streaming: +``` +# podman pod stats -a --no-stream +ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS +a9f807ffaacd frosty_hodgkin -- 3.092MB / 16.7GB 0.02% -- / -- -- / -- 2 +3b33001239ee sleepy_stallman -- -- / -- -- -- / -- -- / -- -- +``` + +List statistics about specified pod without streaming: +``` +# podman pod stats --no-stream a9f80 +ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS +a9f807ffaacd frosty_hodgkin -- 3.092MB / 16.7GB 0.02% -- / -- -- / -- 2 +``` + +List statistics about specified pod in JSON format without streaming: +``` +# podman pod stats --no-stream --format=json a9f80 +[ + { + "id": "a9f807ffaacd", + "name": "frosty_hodgkin", + "cpu_percent": "--", + "mem_usage": "3.092MB / 16.7GB", + "mem_percent": "0.02%", + "netio": "-- / --", + "blocki": "-- / --", + "pids": "2" + } +] +``` + +List selected statistics formatted in a table about specified pod: +``` +# podman pod stats --no-stream --format "table {{.ID}} {{.Name}} {{.MemUsage}}" 6eae +ID NAME MEM USAGE / LIMIT +6eae9e25a564 clever_bassi 3.031MB / 16.7GB +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)** + +## HISTORY +February 2019, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-pod-stop.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-pod-stop.1.md new file mode 100644 index 000000000..a79a8227b --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-pod-stop.1.md @@ -0,0 +1,111 @@ +--- +title: podman-pod-stop +version: v5.5.2 +--- + +% podman-pod-stop 1 + +## NAME +podman\-pod\-stop - Stop one or more pods + +## SYNOPSIS +**podman pod stop** [*options*] *pod* ... + +## DESCRIPTION +Stop containers in one or more pods. You may use pod IDs or names as input. + +## OPTIONS + +#### **--all**, **-a** + +Stops all pods + + +[//]: # (BEGIN included file options/ignore.md) +#### **--ignore**, **-i** + +Ignore errors when specified pods are not in the container store. A user +might have decided to manually remove a pod which leads to a failure +during the ExecStop directive of a systemd service referencing that pod. + +[//]: # (END included file options/ignore.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/pod-id-file.pod.md) +#### **--pod-id-file**=*file* + +Read pod ID from the specified *file* and stop the pod. Can be specified multiple times. + +[//]: # (END included file options/pod-id-file.pod.md) + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping running containers within the pod. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +## EXAMPLE + +Stop pod with a given name. +``` +$ podman pod stop mywebserverpod +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` + +Stop multiple pods with given IDs. +``` +$ podman pod stop 490eb 3557fb +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +``` + +Stop the last created pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman pod stop --latest +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +``` + +Stop all pods. +``` +$ podman pod stop --all +19456b4cd557eaf9629825113a552681a6013f8c8cad258e36ab825ef536e818 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +70c358daecf71ef9be8f62404f926080ca0133277ef7ce4f6aa2d5af6bb2d3e9 +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` + +Stop two pods via --pod-id-file. +``` +$ podman pod stop --pod-id-file file1 --pod-id-file file2 +19456b4cd557eaf9629825113a552681a6013f8c8cad258e36ab825ef536e818 +cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` + +Stop all pods with a timeout of 1 second. +``` +$ podman pod stop -a -t 1 +3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab +490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 +70c358daecf71ef9be8f62404f926080ca0133277ef7ce4f6aa2d5af6bb2d3e9 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-start(1)](podman-pod-start.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-pod-top.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-pod-top.1.md new file mode 100644 index 000000000..2cdcb6def --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-pod-top.1.md @@ -0,0 +1,65 @@ +--- +title: podman-pod-top +version: v5.5.2 +--- + +% podman-pod-top 1 + +## NAME +podman\-pod\-top - Display the running processes of containers in a pod + +## SYNOPSIS +**podman pod top** [*options*] *pod* [*format-descriptors*] + +## DESCRIPTION +Display the running processes of containers in a pod. The *format-descriptors* are ps (1) compatible AIX format +descriptors but extended to print additional information, such as the seccomp mode or the effective capabilities +of a given process. The descriptors can either be passed as separate arguments or as a single comma-separated argument. + +## OPTIONS + +#### **--help**, **-h** + + Print usage statement + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the pod name or ID, use the last created pod. +Note: the last started pod can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## FORMAT DESCRIPTORS + +For a full list of available descriptors, see podman-top(1) + +## EXAMPLES + +Print top data for the specified pod. +By default, `podman-pod-top` prints data similar to `ps -ef`: +``` +$ podman pod top b031293491cc +USER PID PPID %CPU ELAPSED TTY TIME COMMAND +root 1 0 0.000 2h5m38.737137571s ? 0s top +root 8 0 0.000 2h5m15.737228361s ? 0s top +``` + +The output can be controlled by specifying format descriptors as arguments after the pod. + +Print the pod top data fields pid,seccomp, args and %C on the latest pod created. (This -l option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman pod top -l pid seccomp args %C +PID SECCOMP COMMAND %CPU +1 filter top 0.000 +1 filter /bin/sh 0.000 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **ps(1)**, **seccomp(2)**, **proc(5)**, **capabilities(7)** + +## HISTORY +August 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-pod-unpause.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-pod-unpause.1.md new file mode 100644 index 000000000..6b867ed9f --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-pod-unpause.1.md @@ -0,0 +1,43 @@ +--- +title: podman-pod-unpause +version: v5.5.2 +--- + +% podman-pod-unpause 1 + +## NAME +podman\-pod\-unpause - Unpause one or more pods + +## SYNOPSIS +**podman pod unpause** [*options*] *pod* ... + +## DESCRIPTION +Unpauses all the paused processes in the containers of one or more pods. You may use pod IDs or names as input. + +## OPTIONS + +#### **--all**, **-a** + +Unpause all pods. + +#### **--latest**, **-l** + +Instead of providing the pod name or ID, unpause the last created pod. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +## EXAMPLE + +Unpause pod with a given name: +``` +podman pod unpause mywebserverpod +``` + +Unpause pod with a given ID: +``` +podman pod unpause 860a4b23 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pod(1)](podman-pod.1.md)**, **[podman-pod-pause(1)](podman-pod-pause.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-pod.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-pod.1.md new file mode 100644 index 000000000..44d3763fe --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-pod.1.md @@ -0,0 +1,42 @@ +--- +title: podman-pod +version: v5.5.2 +--- + +% podman-pod 1 + +## NAME +podman\-pod - Management tool for groups of containers, called pods + +## SYNOPSIS +**podman pod** *subcommand* + +## DESCRIPTION +podman pod is a set of subcommands that manage pods, or groups of containers. + +## SUBCOMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------- | --------------------------------------------------------------------------------- | +| clone | [podman-pod-clone(1)](podman-pod-clone.1.md) | Create a copy of an existing pod. | +| create | [podman-pod-create(1)](podman-pod-create.1.md) | Create a new pod. | +| exists | [podman-pod-exists(1)](podman-pod-exists.1.md) | Check if a pod exists in local storage. | +| inspect | [podman-pod-inspect(1)](podman-pod-inspect.1.md) | Display information describing a pod. | +| kill | [podman-pod-kill(1)](podman-pod-kill.1.md) | Kill the main process of each container in one or more pods. | +| logs | [podman-pod-logs(1)](podman-pod-logs.1.md) | Display logs for pod with one or more containers. | +| pause | [podman-pod-pause(1)](podman-pod-pause.1.md) | Pause one or more pods. | +| prune | [podman-pod-prune(1)](podman-pod-prune.1.md) | Remove all stopped pods and their containers. | +| ps | [podman-pod-ps(1)](podman-pod-ps.1.md) | Print out information about pods. | +| restart | [podman-pod-restart(1)](podman-pod-restart.1.md) | Restart one or more pods. | +| rm | [podman-pod-rm(1)](podman-pod-rm.1.md) | Remove one or more stopped pods and containers. | +| start | [podman-pod-start(1)](podman-pod-start.1.md) | Start one or more pods. | +| stats | [podman-pod-stats(1)](podman-pod-stats.1.md) | Display a live stream of resource usage stats for containers in one or more pods. | +| stop | [podman-pod-stop(1)](podman-pod-stop.1.md) | Stop one or more pods. | +| top | [podman-pod-top(1)](podman-pod-top.1.md) | Display the running processes of containers in a pod. | +| unpause | [podman-pod-unpause(1)](podman-pod-unpause.1.md) | Unpause one or more pods. | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +July 2018, Originally compiled by Peter Hunt diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-port.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-port.1.md new file mode 100644 index 000000000..ab60f9e28 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-port.1.md @@ -0,0 +1,71 @@ +--- +title: podman-port +version: v5.5.2 +--- + +% podman-port 1 + +## NAME +podman\-port - List port mappings for a container + +## SYNOPSIS +**podman port** [*options*] *container* [*private-port*[/*proto*]] + +**podman container port** [*options*] *container* [*private-port*[/*proto*]] + +## DESCRIPTION +List port mappings for the *container* or look up the public-facing port that is NAT-ed to the *private-port*. + +## OPTIONS + +#### **--all**, **-a** + +List all known port mappings for running containers; when using this option, container names or private ports/protocols filters cannot be used. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +List all port mappings: +``` +# podman port -a +b4d2f05432e482e017b1a4b2eae15fa7b4f6fb7e9f65c1bde46294fdef285906 +80/udp -> 0.0.0.0:44327 +80/tcp -> 0.0.0.0:44327 +# +``` + +List port mappings for a specific container: +``` +# podman port b4d2f054 +80/udp -> 0.0.0.0:44327 +80/tcp -> 0.0.0.0:44327 +# +``` +List the specified port mappings for a specific container: +``` +# podman port b4d2f054 80 + 0.0.0.0:44327 +# +``` + +List the port mappings for a specific container for port 80 and the tcp protocol: +``` +# podman port b4d2f054 80/tcp +0.0.0.0:44327 +# +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +January 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-ps.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-ps.1.md new file mode 100644 index 000000000..88909a1d4 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-ps.1.md @@ -0,0 +1,228 @@ +--- +title: podman-ps +version: v5.5.2 +--- + +% podman-ps 1 + +## NAME +podman\-ps - Print out information about containers + +## SYNOPSIS +**podman ps** [*options*] + +**podman container ps** [*options*] + +**podman container list** [*options*] + +**podman container ls** [*options*] + +## DESCRIPTION +**podman ps** lists the running containers on the system. Use the **--all** flag to view +all the containers information. By default it lists: + + * container id + * the name of the image the container is using + * the COMMAND the container is executing + * the time the container was created + * the status of the container + * port mappings the container is using + * alternative names for the container + +## OPTIONS + +#### **--all**, **-a** + +Show all the containers, default is only running containers. + +Note: Podman shares containers storage with other tools such as Buildah and CRI-O. In some cases these `external` containers might also exist in the same storage. Use the `--external` option to see these external containers. External containers show the 'storage' status. + +#### **--external** + +Display external containers that are not controlled by Podman but are stored in containers storage. These external containers are generally created via other container technology such as Buildah or CRI-O and may depend on the same container images that Podman is also using. External containers are denoted with either a 'buildah' or 'storage' in the COMMAND and STATUS column of the ps output. + +#### **--filter**, **-f** + +Filter what containers are shown in the output. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| label! | [Key] or [Key=Value] Label NOT assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container (accepts regex) | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] container created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + +#### **--format**=*format* + +Pretty-print containers to JSON or using a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|--------------------|----------------------------------------------| +| .AutoRemove | If true, containers are removed on exit | +| .CIDFile | Container ID File | +| .Command | Quoted command used | +| .Created ... | Creation time for container, Y-M-D H:M\:S | +| .CreatedAt | Creation time for container (same as above) | +| .CreatedHuman | Creation time, relative | +| .ExitCode | Container exit code | +| .Exited | "true" if container has exited | +| .ExitedAt | Time (epoch seconds) that container exited | +| .ExposedPorts ... | Map of exposed ports on this container | +| .ID | Container ID | +| .Image | Image Name/ID | +| .ImageID | Image ID | +| .IsInfra | "true" if infra container | +| .Label *string* | Specified label of the container | +| .Labels ... | All the labels assigned to the container | +| .Mounts | Volumes mounted in the container | +| .Names | Name of container | +| .Networks | Show all networks connected to the container | +| .Pid | Process ID on host system | +| .Pod | Pod the container is associated with (SHA) | +| .PodName | PodName of the container | +| .Ports | Forwarded and exposed ports | +| .Restarts | Display the container restart count | +| .RunningFor | Time elapsed since container was started | +| .Size | Size of container | +| .StartedAt | Time (epoch seconds) the container started | +| .State | Human-friendly description of ctr state | +| .Status | Status of container | + +#### **--help**, **-h** + +Print usage statement + +#### **--last**, **-n** + +Print the n last created containers (all states) + +#### **--latest**, **-l** + +Show the latest container created (all states) (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +#### **--namespace**, **--ns** + +Display namespace information + +#### **--no-trunc** + +Do not truncate the output (default *false*). + +#### **--noheading** + +Omit the table headings from the listing of containers. + +#### **--pod**, **-p** + +Display the pods the containers are associated with + +#### **--quiet**, **-q** + +Print the numeric IDs of the containers only + +#### **--size**, **-s** + +Display the total file size + +#### **--sort**=*created* + +Sort by command, created, id, image, names, runningfor, size, or status", +Note: Choosing size sorts by size of rootFs, not alphabetically like the rest of the options + +#### **--sync** + +Force a sync of container state with the OCI runtime. +In some cases, a container's state in the runtime can become out of sync with Podman's state. +This updates Podman's state based on what the OCI runtime reports. +Forcibly syncing is much slower, but can resolve inconsistent state issues. + +#### **--watch**, **-w** + +Refresh the output with current containers on an interval in seconds. + +## EXAMPLES + +List running containers. +``` +$ podman ps +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +4089df24d4f3 docker.io/library/centos:latest /bin/bash 2 minutes ago Up 2 minutes 0.0.0.0:80->8080/tcp, 0.0.0.0:2000-2006->2000-2006/tcp manyports +92f58933c28c docker.io/library/centos:latest /bin/bash 3 minutes ago Up 3 minutes 192.168.99.100:1000-1006->1000-1006/tcp zen_sanderson +``` + +List all containers. +``` +$ podman ps -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +02f65160e14ca redis:alpine "redis-server" 19 hours ago Exited (-1) 19 hours ago 6379/tcp k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0 +69ed779d8ef9f redis:alpine "redis-server" 25 hours ago Created 6379/tcp k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 +``` + +List all containers including their size. Note: this can take longer since Podman needs to calculate the size from the file system. +``` +$ podman ps -a -s +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES SIZE +02f65160e14ca redis:alpine "redis-server" 20 hours ago Exited (-1) 20 hours ago 6379/tcp k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0 27.49 MB +69ed779d8ef9f redis:alpine "redis-server" 25 hours ago Created 6379/tcp k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 27.49 MB +``` + +List all containers, running or not, using a custom Go format. +``` +$ podman ps -a --format "{{.ID}} {{.Image}} {{.Labels}} {{.Mounts}}" +02f65160e14ca redis:alpine tier=backend proc,tmpfs,devpts,shm,mqueue,sysfs,cgroup,/var/run/,/var/run/ +69ed779d8ef9f redis:alpine batch=no,type=small proc,tmpfs,devpts,shm,mqueue,sysfs,cgroup,/var/run/,/var/run/ +``` + +List all containers and display their namespaces. +``` +$ podman ps --ns -a +CONTAINER ID NAMES PID CGROUP IPC MNT NET PIDNS USER UTS +3557d882a82e3 k8s_container2_podsandbox1_redhat.test.crio_redhat-test-crio_1 29910 4026531835 4026532585 4026532593 4026532508 4026532595 4026531837 4026532594 +09564cdae0bec k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 29851 4026531835 4026532585 4026532590 4026532508 4026532592 4026531837 4026532591 +a31ebbee9cee7 k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0 29717 4026531835 4026532585 4026532587 4026532508 4026532589 4026531837 4026532588 +``` + +List all containers including size sorted by names. +``` +$ podman ps -a --size --sort names +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +69ed779d8ef9f redis:alpine "redis-server" 25 hours ago Created 6379/tcp k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 +02f65160e14ca redis:alpine "redis-server" 19 hours ago Exited (-1) 19 hours ago 6379/tcp k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0 +``` + +List all external containers created by tools other than Podman. +``` +$ podman ps --external -a +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +69ed779d8ef9f redis:alpine "redis-server" 25 hours ago Created 6379/tcp k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1 +38a8a78596f9 docker.io/library/busybox:latest buildah 2 hours ago storage busybox-working-container +fd7b786b5c32 docker.io/library/alpine\:latest buildah 2 hours ago storage alpine-working-container +f78620804e00 scratch buildah 2 hours ago storage working-container +``` + +## ps +Print a list of containers + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **[crio(8)](https://github.com/cri-o/cri-o/blob/main/docs/crio.8.md)** + +## HISTORY +August 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-pull.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-pull.1.md new file mode 100644 index 000000000..ec19cc96a --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-pull.1.md @@ -0,0 +1,327 @@ +--- +title: podman-pull +version: v5.5.2 +--- + +% podman-pull 1 + +## NAME +podman\-pull - Pull an image from a registry + +## SYNOPSIS +**podman pull** [*options*] *source* [*source*...] + +**podman image pull** [*options*] *source* [*source*...] + +**podman pull** [*options*] [*transport*]*name*[:*tag*|@*digest*] + +**podman image pull** [*options*] [*transport*]*name*[:*tag*|@*digest*] + +## DESCRIPTION +podman pull copies an image from a registry onto the local machine. The command can pull one or more images. If the image reference in the command line argument does not contain a registry, it is referred to as a `short-name` reference. If the image is a 'short-name' reference, Podman prompts the user for the specific container registry to pull the image from, if an alias for the short-name has not been specified in the `short-name-aliases.conf`. If an image tag is not specified, **podman pull** defaults to the image with the **latest** tag (if it exists) and pulls it. After the image is pulled, podman prints the full image ID. **podman pull** can also pull images using a digest **podman pull** *image*@*digest* and can also be used to pull images from archives and local storage using different transports. +*IMPORTANT: Images are stored in local image storage.* + +## SOURCE +SOURCE is the location from which the container image is pulled from. It supports all transports from **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)**. If no transport is specified, the input is subject to short-name resolution and the `docker` (i.e., container registry) transport is used. For remote clients, including Mac and Windows (excluding WSL2) machines, `docker` is the only supported transport. + +``` +# Pull from a container registry +$ podman pull quay.io/username/myimage + +# Pull from a container registry with short-name resolution +$ podman pull fedora + +# Pull from a container registry via the docker transport +$ podman pull docker://quay.io/username/myimage + +# Pull from a local directory +$ podman pull dir:/tmp/myimage + +# Pull from a tarball in the docker-archive format +$ podman pull docker-archive:/tmp/myimage + +# Pull from a local docker daemon +$ sudo podman pull docker-daemon\:docker.io/library/myimage:33 + +# Pull from a tarball in the OCI-archive format +$ podman pull oci-archive:/tmp/myimage +``` + +## OPTIONS +#### **--all-tags**, **-a** + +All tagged images in the repository are pulled. + +*IMPORTANT: When using the all-tags flag, Podman does not iterate over the search registries in the **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** but always uses docker.io for unqualified image names.* + + +[//]: # (BEGIN included file options/arch.md) +#### **--arch**=*ARCH* +Override the architecture, defaults to hosts, of the image to be pulled. For example, `arm`. +Unless overridden, subsequent lookups of the same image in the local storage matches this architecture, regardless of the host. + +[//]: # (END included file options/arch.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + +#### **--help**, **-h** + +Print the usage statement. + + +[//]: # (BEGIN included file options/os.pull.md) +#### **--os**=*OS* + +Override the OS, defaults to hosts, of the image to be pulled. For example, `windows`. +Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. + +[//]: # (END included file options/os.pull.md) + + +[//]: # (BEGIN included file options/platform.md) +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with --arch and --os) +The `--platform` option can be used to override the current architecture and operating system. +Unless overridden, subsequent lookups of the same image in the local storage matches this platform, regardless of the host. + +[//]: # (END included file options/platform.md) + +#### **--quiet**, **-q** + +Suppress output information when pulling images + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/variant.container.md) +#### **--variant**=*VARIANT* + +Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. + +[//]: # (END included file options/variant.container.md) + +## FILES + +**short-name-aliases.conf** (`/var/cache/containers/short-name-aliases.conf`, `$HOME/.cache/containers/short-name-aliases.conf`) + +When users specify images that do not include the container registry where the +image is stored, this is called a short name. The use of unqualified-search registries entails an ambiguity as it is unclear from which registry a given image, referenced by a short name, may be pulled from. + +Using short names is subject to the risk of hitting squatted registry namespaces. If the unqualified-search registries are set to ["public-registry.com", "my-private-registry.com"] an attacker may take over a namespace of `public-registry.com` such that an image may be pulled from `public-registry.com` instead of the intended source `my-private-registry.com`. + +While it is highly recommended to always use fully-qualified image references, existing deployments using short names may not be easily changed. To circumvent the aforementioned ambiguity, so called short-name aliases can be configured that point to a fully-qualified image reference. Distributions often ship a default shortnames.conf expansion file in /etc/containers/registries.conf.d/ directory. Administrators can use this directory to add their own local short-name expansion files. + +When pulling an image, if the user does not specify the complete registry, container engines attempt to expand the short-name into a full name. If the command is executed with a tty, the user is prompted to select a registry from the +default list unqualified registries defined in registries.conf. The user's selection is then stored in a cache file to be used in all future short-name expansions. Rootful short-names are stored in /var/cache/containers/short-name-aliases.conf. Rootless short-names are stored in the $HOME/.cache/containers/short-name-aliases.conf file. + +For more information on short-names, see `containers-registries.conf(5)` + +**registries.conf** (`/etc/containers/registries.conf`) + +registries.conf is the configuration file which specifies which container registries is consulted when completing image names which do not include a registry or domain portion. + +NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + + +## EXAMPLES +Pull a single image with short name resolution. +``` +$ podman pull alpine:latest +Resolved "alpine" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf) +Trying to pull docker.io/library/alpine:latest... +Getting image source signatures +Copying blob 5843afab3874 done +Copying config d4ff818577 done +Writing manifest to image destination +Storing signatures +d4ff818577bc193b309b355b02ebc9220427090057b54a59e73b79bdfe139b83 +``` + +Pull multiple images with/without short name resolution. +``` +podman pull busybox:musl alpine quay.io/libpod/cirros +Trying to pull docker.io/library/busybox:musl... +Getting image source signatures +Copying blob 0c52b060233b [--------------------------------------] 0.0b / 0.0b +Copying config 9ad2c435a8 done +Writing manifest to image destination +Storing signatures +9ad2c435a887e3f723654e09b48563de44aa3c7950246b2e9305ec85dd3422db +Trying to pull docker.io/library/alpine:latest... +Getting image source signatures +Copying blob 5843afab3874 [--------------------------------------] 0.0b / 0.0b +Copying config d4ff818577 done +Writing manifest to image destination +Storing signatures +d4ff818577bc193b309b355b02ebc9220427090057b54a59e73b79bdfe139b83 +Trying to pull quay.io/libpod/cirros:latest... +Getting image source signatures +Copying blob 8da581cc9286 done +Copying blob 856628d95d17 done +Copying blob f513001ba4ab done +Copying config 3c82e4d066 done +Writing manifest to image destination +Storing signatures +3c82e4d066cf6f9e50efaead6e3ff7fddddf5527826afd68e5a969579fc4db4a +``` + +Pull an image using its digest. +``` +$ podman pull alpine@sha256:d7342993700f8cd7aba8496c2d0e57be0666e80b4c441925fc6f9361fa81d10e +Trying to pull docker.io/library/alpine@sha256:d7342993700f8cd7aba8496c2d0e57be0666e80b4c441925fc6f9361fa81d10e... +Getting image source signatures +Copying blob 188c0c94c7c5 done +Copying config d6e46aa247 done +Writing manifest to image destination +Storing signatures +d6e46aa2470df1d32034c6707c8041158b652f38d2a9ae3d7ad7e7532d22ebe0 +``` + +Pull an image by specifying an authentication file. +``` +$ podman pull --authfile temp-auths/myauths.json docker://docker.io/umohnani/finaltest +Trying to pull docker.io/umohnani/finaltest:latest...Getting image source signatures +Copying blob sha256:6d987f6f42797d81a318c40d442369ba3dc124883a0964d40b0c8f4f7561d913 + 1.90 MB / 1.90 MB [========================================================] 0s +Copying config sha256:ad4686094d8f0186ec8249fc4917b71faa2c1030d7b5a025c29f26e19d95c156 + 1.41 KB / 1.41 KB [========================================================] 0s +Writing manifest to image destination +Storing signatures +03290064078cb797f3e0a530e78c20c13dd22a3dd3adf84a5da2127b48df0438 +``` + +Pull an image by authenticating to a registry. +``` +$ podman pull --creds testuser:testpassword docker.io/umohnani/finaltest +Trying to pull docker.io/umohnani/finaltest:latest...Getting image source signatures +Copying blob sha256:6d987f6f42797d81a318c40d442369ba3dc124883a0964d40b0c8f4f7561d913 + 1.90 MB / 1.90 MB [========================================================] 0s +Copying config sha256:ad4686094d8f0186ec8249fc4917b71faa2c1030d7b5a025c29f26e19d95c156 + 1.41 KB / 1.41 KB [========================================================] 0s +Writing manifest to image destination +Storing signatures +03290064078cb797f3e0a530e78c20c13dd22a3dd3adf84a5da2127b48df0438 +``` + +Pull an image using tls verification. +``` +$ podman pull --tls-verify=false --cert-dir image/certs docker.io/umohnani/finaltest +Trying to pull docker.io/umohnani/finaltest:latest...Getting image source signatures +Copying blob sha256:6d987f6f42797d81a318c40d442369ba3dc124883a0964d40b0c8f4f7561d913 + 1.90 MB / 1.90 MB [========================================================] 0s +Copying config sha256:ad4686094d8f0186ec8249fc4917b71faa2c1030d7b5a025c29f26e19d95c156 + 1.41 KB / 1.41 KB [========================================================] 0s +Writing manifest to image destination +Storing signatures +03290064078cb797f3e0a530e78c20c13dd22a3dd3adf84a5da2127b48df0438 +``` + +Pull an image by overriding the host architecture. +``` +$ podman pull --arch=arm arm32v7/debian:stretch +Trying to pull docker.io/arm32v7/debian\:stretch... +Getting image source signatures +Copying blob b531ae4a3925 done +Copying config 3cba58dad5 done +Writing manifest to image destination +Storing signatures +3cba58dad5d9b35e755b48b634acb3fdd185ab1c996ac11510cc72c17780e13c +``` + +Pull an image with up to 6 retries, delaying 10 seconds between retries in quet mode. +``` +$ podman --remote pull -q --retry 6 --retry-delay 10s ubi9 +4d6addf62a90e392ff6d3f470259eb5667eab5b9a8e03d20b41d0ab910f92170 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-push(1)](podman-push.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +## HISTORY +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-push.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-push.1.md new file mode 100644 index 000000000..5ae944254 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-push.1.md @@ -0,0 +1,276 @@ +--- +title: podman-push +version: v5.5.2 +--- + +% podman-push 1 + +## NAME +podman\-push - Push an image, manifest list or image index from local storage to elsewhere + +## SYNOPSIS +**podman push** [*options*] *image* [*destination*] + +**podman image push** [*options*] *image* [*destination*] + +## DESCRIPTION +Pushes an image, manifest list or image index from local storage to a specified +destination. + +## Image storage +Images are pushed from those stored in local image storage. + +## DESTINATION + + DESTINATION is the location the container image is pushed to. It supports all transports from `containers-transports(5)`. If no transport is specified, the `docker` (i.e., container registry) transport is used. For remote clients, including Mac and Windows (excluding WSL2) machines, `docker` is the only supported transport. + +``` +# Push to a container registry +$ podman push quay.io/podman/stable + +# Push to a container registry via the docker transport +$ podman push docker://quay.io/podman/stable + +# Push to a container registry with another tag +$ podman push myimage quay.io/username/myimage + +# Push to a local directory +$ podman push myimage dir:/tmp/myimage + +# Push to a tarball in the docker-archive format +$ podman push myimage docker-archive:/tmp/myimage + +# Push to a local docker daemon +$ sudo podman push myimage docker-daemon\:docker.io/library/myimage:33 + +# Push to a tarball in the OCI format +$ podman push myimage oci-archive:/tmp/myimage +``` + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + + +[//]: # (BEGIN included file options/dir-compress.md) +#### **--compress** + +Compress tarball image layers when pushing to a directory using the 'dir' transport. (default is same compression type, compressed or uncompressed, as source) + +[//]: # (END included file options/dir-compress.md) + +Note: This flag can only be set when using the **dir** transport + + +[//]: # (BEGIN included file options/compression-format.md) +#### **--compression-format**=**gzip** | *zstd* | *zstd:chunked* + +Specifies the compression format to use. Supported values are: `gzip`, `zstd` and `zstd:chunked`. The default is `gzip` unless overridden in the containers.conf file. +`zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning in that case. + +[//]: # (END included file options/compression-format.md) + + +[//]: # (BEGIN included file options/compression-level.md) +#### **--compression-level**=*level* + +Specifies the compression level to use. The value is specific to the compression algorithm used, e.g. for zstd the accepted values are in the range 1-20 (inclusive) with a default of 3, while for gzip it is 1-9 (inclusive) and has a default of 5. + +[//]: # (END included file options/compression-level.md) + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + + +[//]: # (BEGIN included file options/digestfile.md) +#### **--digestfile**=*Digestfile* + +After copying the image, write the digest of the resulting image to the file. + +[//]: # (END included file options/digestfile.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + +#### **--encrypt-layer**=*layer(s)* + +Layer(s) to encrypt: 0-indexed layer indices with support for negative indexing (e.g. 0 is the first layer, -1 is the last layer). If not defined, encrypts all layers if encryption-key flag is specified. + +#### **--encryption-key**=*key* + +The [protocol\:keyfile] specifies the encryption protocol, which can be JWE (RFC7516), PGP (RFC4880), and PKCS7 (RFC2315) and the key material required for image encryption. For instance, jwe:/path/to/key.pem or pgp\:admin@example.com or pkcs7:/path/to/x509-file. + + +[//]: # (BEGIN included file options/force-compression.md) +#### **--force-compression** + +If set, push uses the specified compression algorithm even if the destination contains a differently-compressed variant already. +Defaults to `true` if `--compression-format` is explicitly specified on the command-line, `false` otherwise. + +[//]: # (END included file options/force-compression.md) + +#### **--format**, **-f**=*format* + +Manifest Type (oci, v2s2, or v2s1) to use when pushing an image. + +#### **--quiet**, **-q** + +When writing the output image, suppress progress output + +#### **--remove-signatures** + +Discard any pre-existing signatures in the image. + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + +#### **--sign-by**=*key* + +Add a “simple signing” signature at the destination using the specified key. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-by-sigstore.md) +#### **--sign-by-sigstore**=*param-file* + +Add a sigstore signature based on further options specified in a container's sigstore signing parameter file *param-file*. +See containers-sigstore-signing-params.yaml(5) for details about the file format. + +[//]: # (END included file options/sign-by-sigstore.md) + +#### **--sign-by-sigstore-private-key**=*path* + +Add a sigstore signature at the destination using a private key at the specified path. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + + +[//]: # (BEGIN included file options/sign-passphrase-file.md) +#### **--sign-passphrase-file**=*path* + +If signing the image (using either **--sign-by** or **--sign-by-sigstore-private-key**), read the passphrase to use from the specified path. + +[//]: # (END included file options/sign-passphrase-file.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLE + +Push the specified image to a local directory: +``` +# podman push imageID dir:/path/to/image +``` + +Push the specified image to a local directory in OCI format: +``` +# podman push imageID oci-archive:/path/to/layout:image:tag +``` + +Push the specified image to a container registry: +``` +# podman push imageID docker://registry.example.com/repository:tag +``` + +Push the specified image to a container registry and save the digest in the specified file: +``` +# podman push --digestfile=/tmp/mydigest imageID docker://registry.example.com/repository:tag +``` + +Push the specified image into the local Docker daemon container store: +``` +# podman push imageID docker-daemon:image:tag +``` + +Push the specified image with a different image name using credentials from an alternate authfile path: +``` +# podman push --authfile temp-auths/myauths.json alpine docker://docker.io/umohnani/alpine +Getting image source signatures +Copying blob sha256:5bef08742407efd622d243692b79ba0055383bbce12900324f75e56f589aedb0 + 4.03 MB / 4.03 MB [========================================================] 1s +Copying config sha256:ad4686094d8f0186ec8249fc4917b71faa2c1030d7b5a025c29f26e19d95c156 + 1.41 KB / 1.41 KB [========================================================] 1s +Writing manifest to image destination +Storing signatures +``` + +Push the specified image to a local directory as an OCI image: +``` +# podman push --format oci registry.access.redhat.com/rhel7 dir\:rhel7-dir +Getting image source signatures +Copying blob sha256:9cadd93b16ff2a0c51ac967ea2abfadfac50cfa3af8b5bf983d89b8f8647f3e4 + 71.41 MB / 71.41 MB [======================================================] 9s +Copying blob sha256:4aa565ad8b7a87248163ce7dba1dd3894821aac97e846b932ff6b8ef9a8a508a + 1.21 KB / 1.21 KB [========================================================] 0s +Copying config sha256\:f1b09a81455c351eaa484b61aacd048ab613c08e4c5d1da80c4c46301b03cf3b + 3.01 KB / 3.01 KB [========================================================] 0s +Writing manifest to image destination +Storing signatures +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pull(1)](podman-pull.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-remote.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-remote.1.md new file mode 100644 index 000000000..b14acd877 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-remote.1.md @@ -0,0 +1,206 @@ +--- +title: podman-remote +version: v5.5.2 +--- + +% podman-remote 1 + +## NAME +podman-remote - A remote CLI for Podman: A Simple management tool for pods, containers and images. + +## SYNOPSIS +**podman-remote** [*options*] *command* + +## DESCRIPTION +Podman (Pod Manager) is a fully featured container engine that is a simple daemonless tool. +Podman provides a Docker-CLI comparable command line that eases the transition from other +container engines and allows the management of pods, containers and images. Simply put: `alias docker=podman`. +Most Podman commands can be run as a regular user, without requiring additional +privileges. + +Podman uses Buildah(1) internally to create container images. Both tools share image +(not container) storage, hence each can use or manipulate images (but not containers) +created by the other. + +Podman-remote provides a local client interacting with a Podman backend node through a RESTful API tunneled through a ssh connection. In this context, a Podman node is a Linux system with Podman installed on it and the API service activated. Credentials for this session can be passed in using flags, environment variables, or in `containers.conf`. + +The `containers.conf` file is placed under `$HOME/.config/containers/containers.conf` on Linux and Mac and `%APPDATA%\containers\containers.conf` on Windows. + +**podman [GLOBAL OPTIONS]** + +## GLOBAL OPTIONS + +#### **--connection**=*name*, **-c** + +Remote connection name + +Overrides environment variable `CONTAINER_CONNECTION` if set. + +#### **--help**, **-h** + +Print usage statement + +#### **--identity**=*path* + +Path to ssh identity file. If the identity file has been encrypted, Podman prompts the user for the passphrase. +If no identity file is provided and no user is given, Podman defaults to the user running the podman command. +Podman prompts for the login password on the remote server. + +Identity value resolution precedence: + - command line value + - environment variable `CONTAINER_SSHKEY`, if `CONTAINER_HOST` is found + - `containers.conf` + +#### **--log-level**=*level* + +Log messages above specified level: debug, info, warn, error (default), fatal or panic + +#### **--url**=*value* + +URL to access Podman service (default from `containers.conf`, rootless "unix:///run/user/$UID/podman/podman.sock" or as root "unix:///run/podman/podman.sock). + + - `CONTAINER_HOST` is of the format `://[]@][:][]` + - `CONTAINER_PROXY` is of the format `://[]@][:]` + +Details: + - `schema` is one of: + * `ssh` (default): a local unix(7) socket on the named `host` and `port`, reachable via SSH + * `tcp`: an unencrypted, unauthenticated TCP connection to the named `host` and `port`, can work with proxy if `CONTAINER_PROXY` is set + * `unix`: a local unix(7) socket at the specified `path`, or the default for the user + - `user` defaults to either `root` or the current running user (`ssh` only) + - `password` has no default (`ssh` only) + - `host` must be provided and is either the IP or name of the machine hosting the Podman service (`ssh` and `tcp`) + - `port` defaults to 22 (`ssh` and `tcp`) + - `path` defaults to either `/run/podman/podman.sock`, or `/run/user/$UID/podman/podman.sock` if running rootless (`unix`), or must be explicitly specified (`ssh`) + - `CONTAINER_PROXY`: use proxy (`socks5` or `socks5h`) to access Podman service (`tcp` only) + +URL value resolution precedence: + - command line value + - environment variable `CONTAINER_HOST` + - `engine.service_destinations` table in containers.conf, excluding the /usr/share/containers directory + - `unix:///run/podman/podman.sock` + +Remote connections use local containers.conf for default. + +Some example URL values in valid formats: + - unix:///run/podman/podman.sock + - unix:///run/user/$UID/podman/podman.sock + - ssh://notroot@localhost:22/run/user/$UID/podman/podman.sock + - ssh://root@localhost:22/run/podman/podman.sock + - tcp://localhost:34451 + - tcp://127.0.0.1:34451 + +#### **--version** + +Print the version + +## Environment Variables + +Podman can set up environment variables from env of [engine] table in containers.conf. These variables can be overridden by passing environment variables before the `podman` commands. + +#### **CONTAINERS_CONF** + +Set default locations of containers.conf file + +#### **CONTAINER_CONNECTION** + +Set default `--connection` value to access Podman service. + +#### **CONTAINER_HOST** + +Set default `--url` value to access Podman service. + +#### **CONTAINER_SSHKEY** + +Set default `--identity` path to ssh key file value used to access Podman service. + +## Exit Status + +The exit code from `podman` gives information about why the container +failed to run or why it exited. When `podman` commands exit with a non-zero code, +the exit codes follow the `chroot` standard, see below: + + **125** The error is with podman itself + + $ podman run --foo busybox; echo $? + Error: unknown flag: --foo + 125 + + **126** Executing a _contained command_ and the _command_ cannot be invoked + + $ podman run busybox /etc; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error + 126 + + **127** Executing a _contained command_ and the _command_ cannot be found + $ podman run busybox foo; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error + 127 + + **Exit code** _contained command_ exit code + + $ podman run busybox /bin/sh -c 'exit 3'; echo $? + 3 + + +## COMMANDS + +| Command | Description | +| ------------------------------------------------ | --------------------------------------------------------------------------- | +| [podman-attach(1)](podman-attach.1.md) | Attach to a running container. | +| [podman-build(1)](podman-build.1.md) | Build a container image using a Dockerfile. | +| [podman-commit(1)](podman-commit.1.md) | Create new image based on the changed container. | +| [podman-container(1)](podman-container.1.md) | Manage containers. | +| [podman-cp(1)](podman-cp.1.md) | Copy files/folders between a container and the local filesystem. | +| [podman-create(1)](podman-create.1.md) | Create a new container. | +| [podman-diff(1)](podman-diff.1.md) | Inspect changes on a container or image's filesystem. | +| [podman-events(1)](podman-events.1.md) | Monitor Podman events | +| [podman-export(1)](podman-export.1.md) | Export a container's filesystem contents as a tar archive. | +| [podman-generate(1)](podman-generate.1.md) | Generate structured data based on containers and pods. | +| [podman-healthcheck(1)](podman-healthcheck.1.md) | Manage healthchecks for containers | +| [podman-history(1)](podman-history.1.md) | Show the history of an image. | +| [podman-image(1)](podman-image.1.md) | Manage images. | +| [podman-images(1)](podman-images.1.md) | List images in local storage. | +| [podman-import(1)](podman-import.1.md) | Import a tarball and save it as a filesystem image. | +| [podman-info(1)](podman-info.1.md) | Display Podman related system information. | +| [podman-init(1)](podman-init.1.md) | Initialize a container | +| [podman-inspect(1)](podman-inspect.1.md) | Display a container or image's configuration. | +| [podman-kill(1)](podman-kill.1.md) | Kill the main process in one or more containers. | +| [podman-load(1)](podman-load.1.md) | Load an image from a container image archive into container storage. | +| [podman-logs(1)](podman-logs.1.md) | Display the logs of a container. | +| [podman-pause(1)](podman-pause.1.md) | Pause one or more containers. | +| [podman-pod(1)](podman-pod.1.md) | Management tool for groups of containers, called pods. | +| [podman-port(1)](podman-port.1.md) | List port mappings for a container. | +| [podman-ps(1)](podman-ps.1.md) | Print out information about containers. | +| [podman-pull(1)](podman-pull.1.md) | Pull an image from a registry. | +| [podman-push(1)](podman-push.1.md) | Push an image from local storage to elsewhere. | +| [podman-restart(1)](podman-restart.1.md) | Restart one or more containers. | +| [podman-rm(1)](podman-rm.1.md) | Remove one or more containers. | +| [podman-rmi(1)](podman-rmi.1.md) | Remove one or more locally stored images. | +| [podman-run(1)](podman-run.1.md) | Run a command in a new container. | +| [podman-save(1)](podman-save.1.md) | Save an image to a container archive. | +| [podman-start(1)](podman-start.1.md) | Start one or more containers. | +| [podman-stop(1)](podman-stop.1.md) | Stop one or more running containers. | +| [podman-system(1)](podman-system.1.md) | Manage podman. | +| [podman-tag(1)](podman-tag.1.md) | Add an additional name to a local image. | +| [podman-top(1)](podman-top.1.md) | Display the running processes of a container. | +| [podman-unpause(1)](podman-unpause.1.md) | Unpause one or more containers. | +| [podman-version(1)](podman-version.1.md) | Display the Podman version information. | +| [podman-volume(1)](podman-volume.1.md) | Manage Volumes. | +## FILES + +**containers.conf** (`$HOME/.config/containers/containers.conf`) + +Podman has builtin defaults for command line options. These defaults can be overridden using the containers.conf configuration files. + +Users can modify defaults by creating the `$HOME/.config/containers/containers.conf` file. Podman merges its builtin defaults with the specified fields from this file, if it exists. Fields specified in the users file override the built-in defaults. + +Podman uses builtin defaults if no containers.conf file is found. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system-service(1)](podman-system-service.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-rename.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-rename.1.md new file mode 100644 index 000000000..53cd7382c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-rename.1.md @@ -0,0 +1,43 @@ +--- +title: podman-rename +version: v5.5.2 +--- + +% podman-rename 1 + +## NAME +podman\-rename - Rename an existing container + +## SYNOPSIS +**podman rename** *container* *newname* + +**podman container rename** *container* *newname* + +## DESCRIPTION +Rename changes the name of an existing container. +The old name is freed, and is available for use. +This command can be run on containers in any state. +However, running containers may not fully receive the effects until they are restarted - for example, a running container may still use the old name in its logs. +At present, only containers are supported; pods and volumes cannot be renamed. + +## OPTIONS + +## EXAMPLES + +Rename container with a given name. +``` +$ podman rename oldContainer aNewName +``` + +Rename container with a given ID. +``` +$ podman rename 717716c00a6b testcontainer +``` + +Create an alias for container with a given ID. +``` +$ podman container rename 6e7514b47180 databaseCtr +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-restart.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-restart.1.md new file mode 100644 index 000000000..a85347d01 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-restart.1.md @@ -0,0 +1,121 @@ +--- +title: podman-restart +version: v5.5.2 +--- + +% podman-restart 1 + +## NAME +podman\-restart - Restart one or more containers + +## SYNOPSIS +**podman restart** [*options*] *container* ... + +**podman container restart** [*options*] *container* ... + +## DESCRIPTION +The restart command allows containers to be restarted using their ID or name. +Running containers are stopped and restarted. Stopped containers are started. + +## OPTIONS + +#### **--all**, **-a** + +Restart all containers regardless of their current state. + +#### **--cidfile** + +Read container ID from the specified file and restart the container. Can be specified multiple times. + +#### **--filter**, **-f**=*filter* + +Filter what containers restart. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +#### **--running** + +Restart all containers that are already in the *running* state. + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping the container. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +## EXAMPLES + +Restart the latest container. +``` +$ podman restart -l +ec588fc80b05e19d3006bf2e8aa325f0a2e2ff1f609b7afb39176ca8e3e13467 +``` + +Restart a specific container by partial container ID. +``` +$ podman restart ff6cf1 +ff6cf1e5e77e6dba1efc7f3fcdb20e8b89ad8947bc0518be1fcb2c78681f226f +``` + +Restart two containers by name with a timeout of 4 seconds. +``` +$ podman restart --time 4 test1 test2 +c3bb026838c30e5097f079fa365c9a4769d52e1017588278fa00d5c68ebc1502 +17e13a63081a995136f907024bcfe50ff532917988a152da229db9d894c5a9ec +``` + +Restart all running containers. +``` +$ podman restart --running +``` + +Restart all containers. +``` +$ podman restart --all +``` + +Restart container using ID specified in a given files. +``` +$ podman restart --cidfile /home/user/cidfile-1 +$ podman restart --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +March 2018, Originally compiled by Matt Heon diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-rm.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-rm.1.md new file mode 100644 index 000000000..0ce8dd80d --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-rm.1.md @@ -0,0 +1,163 @@ +--- +title: podman-rm +version: v5.5.2 +--- + +% podman-rm 1 + +## NAME +podman\-rm - Remove one or more containers + +## SYNOPSIS +**podman rm** [*options*] *container* + +**podman container rm** [*options*] *container* + +## DESCRIPTION +**podman rm** removes one or more containers from the host. The container name or ID can be used. This does not remove images. +Running or unusable containers are not removed without the **-f** option. + +## OPTIONS + +#### **--all**, **-a** + +Remove all containers. Can be used in conjunction with **-f** as well. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and rm the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + +Command does not fail when *file* is missing and user specified --ignore. + +#### **--depend** + +Remove selected container and recursively remove all containers that depend on it. + +#### **--filter**=*filter* + +Filter what containers remove. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + +#### **--force**, **-f** + +Force the removal of running and paused containers. Forcing a container removal also +removes containers from container storage even if the container is not known to Podman. +For example, containers that are created by different container engines like Buildah. +In addition, forcing can be used to remove unusable containers, e.g. containers +whose OCI runtime has become unavailable. + + +[//]: # (BEGIN included file options/ignore.md) +#### **--ignore**, **-i** + +Ignore errors when specified containers are not in the container store. A user +might have decided to manually remove a container which leads to a failure +during the ExecStop directive of a systemd service referencing that container. + +[//]: # (END included file options/ignore.md) +Further ignore when the specified `--cidfile` does not exist as it may have +already been removed along with the container. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping the container. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +The --force option must be specified to use the --time option. + +#### **--volumes**, **-v** + +Remove anonymous volumes associated with the container. This does not include named volumes +created with **podman volume create**, or the **--volume** option of **podman run** and **podman create**. + +## EXAMPLE +Remove container with a given name: +``` +$ podman rm mywebserver +``` + +Remove container with a given name and all of the containers that depend on it: +``` +$ podman rm --depend mywebserver +``` + +Remove multiple containers with given names or IDs: +``` +$ podman rm mywebserver myflaskserver 860a4b23 +``` + +Remove multiple containers with IDs read from files: +``` +$ podman rm --cidfile ./cidfile-1 --cidfile /home/user/cidfile-2 +``` + +Forcibly remove container with a given ID: +``` +$ podman rm -f 860a4b23 +``` + +Remove all containers regardless of the run state: +``` +$ podman rm -f -a +``` + +Forcibly remove the last created container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +$ podman rm -f --latest +``` + +## Exit Status + **0** All specified containers removed + + **1** One of the specified containers did not exist, and no other failures + + **2** One of the specified containers is paused or running + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +August 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-rmi.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-rmi.1.md new file mode 100644 index 000000000..2c559e315 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-rmi.1.md @@ -0,0 +1,81 @@ +--- +title: podman-rmi +version: v5.5.2 +--- + +% podman-rmi 1 + +## NAME +podman\-rmi - Remove one or more locally stored images + +## SYNOPSIS +**podman rmi** [*options*] *image* [...] + +**podman image rm** [*options*] *image* [...] + +## DESCRIPTION +Removes one or more locally stored images. +Passing an argument _image_ deletes it, along with any of its dangling parent images. A dangling image is an image without a tag and without being referenced by another image. + +Note: To delete an image from a remote registry, use the [**skopeo delete**](https://github.com/containers/skopeo/blob/main/docs/skopeo-delete.1.md) command. Some registries do not allow users to delete an image via a CLI remotely. + +## OPTIONS + +#### **--all**, **-a** + +Remove all images in the local storage. + +#### **--force**, **-f** + +This option causes Podman to remove all containers that are using the image before removing the image from the system. + +#### **--ignore**, **-i** + +If a specified image does not exist in the local storage, ignore it and do not throw an error. + +#### **--no-prune** + +This option does not remove dangling parents of the specified image. + +Remove an image by its short ID +``` +$ podman rmi c0ed59d05ff7 +``` +Remove an image and its associated containers. +``` +$ podman rmi --force imageID +``` + +Remove multiple images by their shortened IDs. +``` +$ podman rmi c4dfb1609ee2 93fd78260bd1 c0ed59d05ff7 +``` + +Remove all images and containers. +``` +$ podman rmi -a -f +``` + +Remove an absent image with and without the `--ignore` flag. +``` +$ podman rmi --ignore nothing +$ podman rmi nothing +Error: nothing: image not known + +``` + + +## Exit Status + **0** All specified images removed + + **1** One of the specified images did not exist, and no other failures + + **2** One of the specified images has child images or is being used by a container + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[skopeo-delete(1)](https://github.com/containers/skopeo/blob/main/docs/skopeo-delete.1.md)** + +## HISTORY +March 2017, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-rootless.7.md b/versioned_docs/version-5.5.2/source/markdown/podman-rootless.7.md new file mode 100644 index 000000000..addc8342d --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-rootless.7.md @@ -0,0 +1,54 @@ +--- +title: Shortcomings of Rootless Podman +version: v5.5.2 +--- + +% podman-rootless 7 + +# Shortcomings of Rootless Podman + +The following list categorizes the known issues and irregularities with running Podman as a non-root user. Although currently functional, there is still a number of work items that are under consideration to be added. These proposed changes are in varying degrees of design and development. + +Contributors are more than welcomed to help with this work. If you decide to carve off a piece and work on it, please create an issue in [GitHub](https://github.com/containers/podman/issues), and assign it to yourself. If you find other unexpected behavior with rootless Podman and feel it’s warranted, please feel free to update this document. + +* Podman can not create containers that bind to ports < 1024. + * The kernel does not allow processes without CAP_NET_BIND_SERVICE to bind to low ports. + * You can modify the `net.ipv4.ip_unprivileged_port_start` sysctl to change the lowest port. For example `sysctl net.ipv4.ip_unprivileged_port_start=443` allows rootless Podman containers to bind to ports >= 443. + * A proxy server, kernel firewall rule, or redirection tool such as [redir](https://github.com/troglobit/redir) may be used to redirect traffic from a privileged port to an unprivileged one (where a podman pod is bound) in a server scenario - where a user has access to the root account (or setuid on the binary would be an acceptable risk), but wants to run the containers as an unprivileged user for enhanced security and for a limited number of pre-known ports. +* As of Podman 5.0, pasta is the default networking tool. Since pasta copies the IP address of the main interface, connections to that IP from containers do not work. This means that unless you have more than one interface, inter-container connections cannot be made without explicitly passing a pasta network configuration, either in `containers.conf` or at runtime. + * If you previously had port forwards (ex. via -p 80:80) that other containers could access, you can either revert back to slirp4netns or use the solution (setting pasta options with 10.0.2.x IPs) posted [here](https://blog.podman.io/2024/03/podman-5-0-breaking-changes-in-detail/). +* “How To” documentation is patchy at best. +* If /etc/subuid and /etc/subgid are not set up for a user, then podman commands +can easily fail + * This can be a big issue on machines using Network Based Password information (FreeIPA, Active Directory, LDAP) + * We are working to get support for NSSWITCH on the /etc/subuid and /etc/subgid files. +* No cgroup V1 Support + * cgroup V1 does not safely support cgroup delegation. + * As of Fedora 31 defaults to cgroup V2, which has full support of rootless cgroup management. Note this requires the --cgroup-manager within rootless containers to use systemd, which new containers will get by default. +* Some system unit configuration options do not work in the rootless container + * systemd fails to apply several options and failures are silently ignored (e.g. CPUShares, MemoryLimit). Should work on cgroup V2. + * Use of certain options will cause service startup failures (e.g. PrivateNetwork). The systemd services requiring `PrivateNetwork` can be made to work by passing `--cap-add SYS_ADMIN`, but the security implications should be carefully evaluated. In most cases, it's better to create an override.conf drop-in that sets `PrivateNetwork=no`. This also applies to containers run by root. +* Can not share container images with CRI-O or other rootful users +* Difficult to use additional stores for sharing content +* Does not work on NFS or parallel filesystem homedirs (e.g. [GPFS](https://www.ibm.com/support/knowledgecenter/en/SSFKCN/gpfs_welcome.html)) + * NFS and parallel filesystems enforce file creation on different UIDs on the server side and does not understand User Namespace. + * When a container root process like YUM attempts to create a file owned by a different UID, NFS Server/GPFS denies the creation. +* Does not work with homedirs mounted with noexec/nodev + * User can set up storage to point to other directories they can write to that are not mounted noexec/nodev +* Support for using native overlayfs as an unprivileged user is only available for Podman version >= 3.1 on a Linux kernel version >= 5.12, otherwise the slower _fuse-overlayfs_ may be used. + * A few Linux distributions (e.g. Ubuntu) have supported even older Podman and Linux kernel versions by modifying the normal Linux kernel behaviour. +* Only other supported driver is VFS. +* Cannot use ping out of the box. + * [(Can be fixed by setting sysctl on host)](https://github.com/containers/podman/blob/main/troubleshooting.md#5-rootless-containers-cannot-ping-hosts) +* Requires new shadow-utils (not found in older (RHEL7/Centos7 distros) Should be fixed in RHEL7.7 release) +* A few commands do not work. + * mount/unmount (on fuse-overlay) + * Only works if you enter the mount namespace with podman unshare + * podman stats (Works with cgroup V2 support) + * Checkpoint and Restore (CRIU requires root) + * Pause and Unpause (Works with cgroup V2 support) +* Issues with higher UIDs can cause builds to fail + * If a build is attempting to use a UID that is not mapped into the user namespace mapping for a container, then builds will not be able to put the UID in an image. +* Making device nodes within a container fails, even when running --privileged. + * The kernel does not allow non root user processes (processes without CAP_MKNOD) to create device nodes. If a container needs to create device nodes, it must be run as root. +* When using --net=host with rootless containers, subsequent podman execs to that container will not join the host network namespace because it is owned by root. diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-run.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-run.1.md new file mode 100644 index 000000000..f0265c29c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-run.1.md @@ -0,0 +1,3314 @@ +--- +title: podman-run +version: v5.5.2 +--- + +% podman-run 1 + +## NAME +podman\-run - Run a command in a new container + +## SYNOPSIS +**podman run** [*options*] *image* [*command* [*arg* ...]] + +**podman container run** [*options*] *image* [*command* [*arg* ...]] + +## DESCRIPTION + +Run a process in a new container. **podman run** starts a process with its own +file system, its own networking, and its own isolated process tree. The _image_ +which starts the process may define defaults related to the process that will be +run in the container, the networking to expose, and more, but **podman run** +gives final control to the operator or administrator who starts the container +from the image. For that reason **podman run** has more options than any other +Podman command. + +If the _image_ is not already loaded then **podman run** will pull the _image_, and +all image dependencies, from the repository in the same way running **podman +pull** _image_, before it starts the container from that image. + +Several files will be automatically created within the container. These include +_/etc/hosts_, _/etc/hostname_, and _/etc/resolv.conf_ to manage networking. +These will be based on the host's version of the files, though they can be +customized with options (for example, **--dns** will override the host's DNS +servers in the created _resolv.conf_). Additionally, a container environment +file is created in each container to indicate to programs they are running in a +container. This file is located at _/run/.containerenv_ (or +_/var/run/.containerenv_ for FreeBSD containers). When using the +--privileged flag the .containerenv contains name/value pairs indicating the +container engine version, whether the engine is running in rootless mode, the +container name and ID, as well as the image name and ID that the container is based on. Note: _/run/.containerenv_ will not be created when a volume is mounted on /run. + +When running from a user defined network namespace, the _/etc/netns/NSNAME/resolv.conf_ +will be used if it exists, otherwise _/etc/resolv.conf_ will be used. + +Default settings are defined in `containers.conf`. Most settings for remote +connections use the servers containers.conf, except when documented in man +pages. + +## IMAGE + + The image is specified using transport\:path format. If no transport is specified, the `docker` (container registry) +transport is used by default. For remote Podman, including Mac and Windows (excluding WSL2) machines, `docker` is the only allowed transport. + + **dir:**_path_ + An existing local directory _path_ storing the manifest, layer tarballs and signatures as individual files. This +is a non-standardized format, primarily useful for debugging or noninvasive container inspection. + + $ podman save --format docker-dir fedora -o /tmp/fedora + $ podman run dir:/tmp/fedora echo hello + + **docker://**_docker-reference_ (Default) + An image reference stored in a remote container image registry. Example: "quay.io/podman/stable:latest". +The reference can include a path to a specific registry; if it does not, the +registries listed in registries.conf are queried to find a matching image. +By default, credentials from `podman login` (stored at +$XDG_RUNTIME_DIR/containers/auth.json by default) are used to authenticate; +otherwise it falls back to using credentials in $HOME/.docker/config.json. + + $ podman run registry.fedoraproject.org/fedora\:latest echo hello + + **docker-archive:**_path_[**:**_docker-reference_] +An image stored in the `docker save` formatted file. _docker-reference_ is only used when creating such a +file, and it must not contain a digest. + + $ podman save --format docker-archive fedora -o /tmp/fedora + $ podman run docker-archive:/tmp/fedora echo hello + + **docker-daemon:**_docker-reference_ + An image in _docker-reference_ format stored in the docker daemon internal storage. The _docker-reference_ can also be an image ID (docker-daemon\:algo\:digest). + + $ sudo docker pull fedora + $ sudo podman run docker-daemon\:docker.io/library/fedora echo hello + + **oci-archive:**_path_**:**_tag_ + An image in a directory compliant with the "Open Container Image Layout Specification" at the specified _path_ +and specified with a _tag_. + + $ podman save --format oci-archive fedora -o /tmp/fedora + $ podman run oci-archive:/tmp/fedora echo hello + +## OPTIONS + +[//]: # (BEGIN included file options/add-host.md) +#### **--add-host**=*hostname[;hostname[;...]]*:*ip* + +Add a custom host-to-IP mapping to the container's `/etc/hosts` file. + +The option takes one or multiple semicolon-separated hostnames to be mapped to +a single IPv4 or IPv6 address, separated by a colon. It can also be used to +overwrite the IP addresses of hostnames Podman adds to `/etc/hosts` by default +(also see the **--name** and **--hostname** options). This option can be +specified multiple times to add additional mappings to `/etc/hosts`. It +conflicts with the **--no-hosts** option and conflicts with *no_hosts=true* in +`containers.conf`. + +Instead of an IP address, the special flag *host-gateway* can be given. This +resolves to an IP address the container can use to connect to the host. The +IP address chosen depends on your network setup, thus there's no guarantee that +Podman can determine the *host-gateway* address automatically, which will then +cause Podman to fail with an error message. You can overwrite this IP address +using the *host_containers_internal_ip* option in *containers.conf*. + +The *host-gateway* address is also used by Podman to automatically add the +`host.containers.internal` and `host.docker.internal` hostnames to `/etc/hosts`. +You can prevent that by either giving the **--no-hosts** option, or by setting +*host_containers_internal_ip="none"* in *containers.conf*. If no *host-gateway* +address was configured manually and Podman fails to determine the IP address +automatically, Podman will silently skip adding these internal hostnames to +`/etc/hosts`. If Podman is running in a virtual machine using `podman machine` +(this includes Mac and Windows hosts), Podman will silently skip adding the +internal hostnames to `/etc/hosts`, unless an IP address was configured +manually; the internal hostnames are resolved by the gvproxy DNS resolver +instead. + +Podman will use the `/etc/hosts` file of the host as a basis by default, i.e. +any hostname present in this file will also be present in the `/etc/hosts` file +of the container. A different base file can be configured using the +*base_hosts_file* config in `containers.conf`. + +[//]: # (END included file options/add-host.md) + + +[//]: # (BEGIN included file options/annotation.container.md) +#### **--annotation**=*key=value* + +Add an annotation to the container. This option can be set multiple times. + +[//]: # (END included file options/annotation.container.md) + + +[//]: # (BEGIN included file options/arch.md) +#### **--arch**=*ARCH* +Override the architecture, defaults to hosts, of the image to be pulled. For example, `arm`. +Unless overridden, subsequent lookups of the same image in the local storage matches this architecture, regardless of the host. + +[//]: # (END included file options/arch.md) + + +[//]: # (BEGIN included file options/attach.md) +#### **--attach**, **-a**=*stdin* | *stdout* | *stderr* + +Attach to STDIN, STDOUT or STDERR. + +In foreground mode (the default when **-d** +is not specified), **podman run** can start the process in the container +and attach the console to the process's standard input, output, and +error. It can even pretend to be a TTY (this is what most command-line +executables expect) and pass along signals. The **-a** option can be set for +each of **stdin**, **stdout**, and **stderr**. + +[//]: # (END included file options/attach.md) + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cap-add.md) +#### **--cap-add**=*capability* + +Add Linux capabilities. + +Granting additional capabilities increases the privileges of the +processes running inside the container and potentially allow it to +break out of confinement. Capabilities like `CAP_SYS_ADMIN`, +`CAP_SYS_PTRACE`, `CAP_MKNOD` and `CAP_SYS_MODULE` are particularly +dangerous when they are not used within a user namespace. Please +refer to **user_namespaces(7)** for a more detailed explanation of the +interaction between user namespaces and capabilities. + +Before adding any capability, review its security implications and +ensure it is really necessary for the container’s functionality. See +**capabilities(7)** for more information. + +[//]: # (END included file options/cap-add.md) + + +[//]: # (BEGIN included file options/cap-drop.md) +#### **--cap-drop**=*capability* + +Drop Linux capabilities. + +[//]: # (END included file options/cap-drop.md) + + +[//]: # (BEGIN included file options/cgroup-conf.md) +#### **--cgroup-conf**=*KEY=VALUE* + +When running on cgroup v2, specify the cgroup file to write to and its value. For example **--cgroup-conf=memory.high=1073741824** sets the memory.high limit to 1GB. + +[//]: # (END included file options/cgroup-conf.md) + + +[//]: # (BEGIN included file options/cgroup-parent.md) +#### **--cgroup-parent**=*path* + +Path to cgroups under which the cgroup for the container is created. If the +path is not absolute, the path is considered to be relative to the cgroups path +of the init process. Cgroups are created if they do not already exist. + +[//]: # (END included file options/cgroup-parent.md) + + +[//]: # (BEGIN included file options/cgroupns.md) +#### **--cgroupns**=*mode* + +Set the cgroup namespace mode for the container. + +- **host**: use the host's cgroup namespace inside the container. +- **container:**_id_: join the namespace of the specified container. +- **private**: create a new cgroup namespace. +- **ns:**_path_: join the namespace at the specified path. + +If the host uses cgroups v1, the default is set to **host**. On cgroups v2, the default is **private**. + +[//]: # (END included file options/cgroupns.md) + + +[//]: # (BEGIN included file options/cgroups.md) +#### **--cgroups**=*how* + +Determines whether the container creates CGroups. + +Default is **enabled**. + +The **enabled** option creates a new cgroup under the cgroup-parent. +The **disabled** option forces the container to not create CGroups, and thus conflicts with CGroup options (**--cgroupns** and **--cgroup-parent**). +The **no-conmon** option disables a new CGroup only for the **conmon** process. +The **split** option splits the current CGroup in two sub-cgroups: one for conmon and one for the container payload. It is not possible to set **--cgroup-parent** with **split**. + +[//]: # (END included file options/cgroups.md) + + +[//]: # (BEGIN included file options/chrootdirs.md) +#### **--chrootdirs**=*path* + +Path to a directory inside the container that is treated as a `chroot` directory. +Any Podman managed file (e.g., /etc/resolv.conf, /etc/hosts, etc/hostname) that is mounted into the root directory is mounted into that location as well. +Multiple directories are separated with a comma. + +[//]: # (END included file options/chrootdirs.md) + + +[//]: # (BEGIN included file options/cidfile.write.md) +#### **--cidfile**=*file* + +Write the container ID to *file*. The file is removed along with the container, except +when used with podman --remote run on detached containers. + +[//]: # (END included file options/cidfile.write.md) + + +[//]: # (BEGIN included file options/conmon-pidfile.md) +#### **--conmon-pidfile**=*file* + +Write the pid of the **conmon** process to a file. As **conmon** runs in a separate process than Podman, this is necessary when using systemd to restart Podman containers. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/conmon-pidfile.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-rt-period.md) +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-period.md) + + +[//]: # (BEGIN included file options/cpu-rt-runtime.md) +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-runtime.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpus.container.md) +#### **--cpus**=*number* + +Number of CPUs. The default is *0.0* which means no limit. This is shorthand +for **--cpu-period** and **--cpu-quota**, therefore the option cannot be specified with +**--cpu-period** or **--cpu-quota**. + +On some systems, changing the CPU limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpus.container.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/decryption-key.md) +#### **--decryption-key**=*key[\:passphrase]* + +The [key[:passphrase]] to be used for decryption of images. Key can point to keys and/or certificates. Decryption is tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise. + +[//]: # (END included file options/decryption-key.md) + +#### **--detach**, **-d** + +Detached mode: run the container in the background and print the new container ID. The default is *false*. + +At any time run **podman ps** in +the other shell to view a list of the running containers. Reattach to a +detached container with **podman attach** command. + +When attached via tty mode, detach from the container (and leave it +running) using a configurable key sequence. The default sequence is `ctrl-p,ctrl-q`. +Specify the key sequence using the **--detach-keys** option, or configure +it in the **containers.conf** file: see **containers.conf(5)** for more information. + + +[//]: # (BEGIN included file options/detach-keys.md) +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. + +[//]: # (END included file options/detach-keys.md) + + +[//]: # (BEGIN included file options/device.md) +#### **--device**=*host-device[:container-device][\:permissions]* + +Add a host device to the container. Optional *permissions* parameter +can be used to specify device permissions by combining +**r** for read, **w** for write, and **m** for **mknod**(2). + +Example: **--device=/dev/sdc:/dev/xvdc\:rwm**. + +Note: if *host-device* is a symbolic link then it is resolved first. +The container only stores the major and minor numbers of the host device. + +Podman may load kernel modules required for using the specified +device. The devices that Podman loads modules for when necessary are: +/dev/fuse. + +In rootless mode, the new device is bind mounted in the container from the host +rather than Podman creating it within the container space. Because the bind +mount retains its SELinux label on SELinux systems, the container can get +permission denied when accessing the mounted device. Modify SELinux settings to +allow containers to use all device labels via the following command: + +$ sudo setsebool -P container_use_devices=true + +[//]: # (END included file options/device.md) + +Note: if the user only has access rights via a group, accessing the device +from inside a rootless container fails. Use the `--group-add keep-groups` +flag to pass the user's supplementary group access into the container. + + +[//]: # (BEGIN included file options/device-cgroup-rule.md) +#### **--device-cgroup-rule**=*"type major\:minor mode"* + +Add a rule to the cgroup allowed devices list. The rule is expected to be +in the format specified in the Linux kernel documentation +[admin-guide/cgroup-v1/devices](https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.html): +- *type*: `a` (all), `c` (char), or `b` (block); +- *major* and *minor*: either a number, or `*` for all; +- *mode*: a composition of `r` (read), `w` (write), and `m` (mknod(2)). + +[//]: # (END included file options/device-cgroup-rule.md) + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-read-iops.md) +#### **--device-read-iops**=*path:rate* + +Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-iops.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + + +[//]: # (BEGIN included file options/device-write-iops.md) +#### **--device-write-iops**=*path:rate* + +Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-iops.md) + + +[//]: # (BEGIN included file options/disable-content-trust.md) +#### **--disable-content-trust** + +This is a Docker-specific option to disable image verification to a container +registry and is not supported by Podman. This option is a NOOP and provided +solely for scripting compatibility. + +[//]: # (END included file options/disable-content-trust.md) + + +[//]: # (BEGIN included file options/dns.md) +#### **--dns**=*ipaddr* + +Set custom DNS servers. + +This option can be used to override the DNS +configuration passed to the container. Typically this is necessary when the +host DNS configuration is invalid for the container (e.g., **127.0.0.1**). When this +is the case the **--dns** flag is necessary for every run. + +The special value **none** can be specified to disable creation of _/etc/resolv.conf_ in the container by Podman. +The _/etc/resolv.conf_ file in the image is used without changes. + +[//]: # (END included file options/dns.md) + +This option cannot be combined with **--network** that is set to **none** or **container:**_id_. + + +[//]: # (BEGIN included file options/dns-option.container.md) +#### **--dns-option**=*option* + +Set custom DNS options. Invalid if using **--dns-option** with **--network** that is set to **none** or **container:**_id_. + +[//]: # (END included file options/dns-option.container.md) + + +[//]: # (BEGIN included file options/dns-search.container.md) +#### **--dns-search**=*domain* + +Set custom DNS search domains. Invalid if using **--dns-search** with **--network** that is set to **none** or **container:**_id_. +Use **--dns-search=.** to remove the search domain. + +[//]: # (END included file options/dns-search.container.md) + + +[//]: # (BEGIN included file options/entrypoint.md) +#### **--entrypoint**=*"command"* | *'["command", "arg1", ...]'* + +Override the default ENTRYPOINT from the image. + +The ENTRYPOINT of an image is similar to a COMMAND +because it specifies what executable to run when the container starts, but it is +(purposely) more difficult to override. The ENTRYPOINT gives a container its +default nature or behavior. When the ENTRYPOINT is set, the +container runs as if it were that binary, complete with default options. More options can be +passed in via the COMMAND. But, if a user wants to run +something else inside the container, the **--entrypoint** option allows a new +ENTRYPOINT to be specified. + +Specify multi option commands in the form of a JSON string. + +[//]: # (END included file options/entrypoint.md) + + +[//]: # (BEGIN included file options/env.md) +#### **--env**, **-e**=*env* + +Set environment variables. + +This option allows arbitrary environment variables that are available for the process to be launched inside of the container. If an environment variable is specified without a value, Podman checks the host environment for a value and set the variable only if it is set on the host. As a special case, if an environment variable ending in __*__ is specified without a value, Podman searches the host environment for variables starting with the prefix and adds those variables to the container. + +[//]: # (END included file options/env.md) + +See [**Environment**](#environment) note below for precedence and examples. + + +[//]: # (BEGIN included file options/env-file.md) +#### **--env-file**=*file* + +Read in a line-delimited file of environment variables. + +[//]: # (END included file options/env-file.md) + +See [**Environment**](#environment) note below for precedence and examples. + + +[//]: # (BEGIN included file options/env-host.md) +#### **--env-host** + +Use host environment inside of the container. See **Environment** note below for precedence. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/env-host.md) + + +[//]: # (BEGIN included file options/env-merge.md) +#### **--env-merge**=*env* + +Preprocess default environment variables for the containers. For example +if image contains environment variable `hello=world` user can preprocess +it using `--env-merge hello=${hello}-some` so new value is `hello=world-some`. + +Please note that if the environment variable `hello` is not present in the image, +then it'll be replaced by an empty string and so using `--env-merge hello=${hello}-some` +would result in the new value of `hello=-some`, notice the leading `-` delimiter. + +[//]: # (END included file options/env-merge.md) + + +[//]: # (BEGIN included file options/expose.md) +#### **--expose**=*port[/protocol]* + +Expose a port or a range of ports (e.g. **--expose=3300-3310**). +The protocol can be `tcp`, `udp` or `sctp` and if not given `tcp` is assumed. +This option matches the EXPOSE instruction for image builds and has no effect on +the actual networking rules unless **-P/--publish-all** is used to forward to all +exposed ports from random host ports. To forward specific ports from the host +into the container use the **-p/--publish** option instead. + +[//]: # (END included file options/expose.md) + + +[//]: # (BEGIN included file options/gidmap.container.md) +#### **--gidmap**=*[flags]container_uid\:from_uid[\:amount]* + +Run the container in a new user namespace using the supplied GID mapping. This +option conflicts with the **--userns** and **--subgidname** options. This +option provides a way to map host GIDs to container GIDs in the same way as +__--uidmap__ maps host UIDs to container UIDs. For details see __--uidmap__. + +Note: the **--gidmap** option cannot be called in conjunction with the **--pod** option as a gidmap cannot be set on the container level when in a pod. + +[//]: # (END included file options/gidmap.container.md) + + +[//]: # (BEGIN included file options/gpus.md) +#### **--gpus**=*ENTRY* + +GPU devices to add to the container ('all' to pass all GPUs) Currently only +Nvidia devices are supported. + +[//]: # (END included file options/gpus.md) + + +[//]: # (BEGIN included file options/group-add.md) +#### **--group-add**=*group* | *keep-groups* + +Assign additional groups to the primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, other groups cannot be specified +with this flag. (Not available for remote commands, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/group-add.md) + + +[//]: # (BEGIN included file options/group-entry.md) +#### **--group-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/group` file within the container when `--user` is used. + +The variables $GROUPNAME, $GID, and $USERLIST are automatically replaced with their value at runtime if present. + +[//]: # (END included file options/group-entry.md) + + +[//]: # (BEGIN included file options/health-cmd.md) +#### **--health-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set or alter a healthcheck command for a container. The command is a command to be executed inside the +container that determines the container health. The command is required for other healthcheck options +to be applied. A value of **none** disables existing healthchecks. + +Multiple options can be passed in the form of a JSON array; otherwise, the command is interpreted +as an argument to **/bin/sh -c**. + +Note: The default values are used even if healthcheck is configured in the image. + +[//]: # (END included file options/health-cmd.md) + + +[//]: # (BEGIN included file options/health-interval.md) +#### **--health-interval**=*interval* + +Set an interval for the healthchecks. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-interval.md) + + +[//]: # (BEGIN included file options/health-log-destination.md) +#### **--health-log-destination**=*directory_path* + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) (Default: local) + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. + +[//]: # (END included file options/health-log-destination.md) + + +[//]: # (BEGIN included file options/health-max-log-count.md) +#### **--health-max-log-count**=*number of stored logs* + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) (Default: 5 attempts) + +[//]: # (END included file options/health-max-log-count.md) + + +[//]: # (BEGIN included file options/health-max-log-size.md) +#### **--health-max-log-size**=*size of stored logs* + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) (Default: 500 characters) + +[//]: # (END included file options/health-max-log-size.md) + + +[//]: # (BEGIN included file options/health-on-failure.md) +#### **--health-on-failure**=*action* + +Action to take once the container transitions to an unhealthy state. The default is **none**. + +- **none**: Take no action. +- **kill**: Kill the container. +- **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. +- **stop**: Stop the container. + +[//]: # (END included file options/health-on-failure.md) + + +[//]: # (BEGIN included file options/health-retries.md) +#### **--health-retries**=*retries* + +The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is **3**. + +Note: This parameter can overwrite the healthcheck configuration from the image. + +[//]: # (END included file options/health-retries.md) + + +[//]: # (BEGIN included file options/health-start-period.md) +#### **--health-start-period**=*period* + +The initialization time needed for a container to bootstrap. The value can be expressed in time format like +**2m3s**. The default value is **0s**. + +Note: The health check command is executed as soon as a container is started, if the health check is successful +the container's health state will be updated to `healthy`. However, if the health check fails, the health state will +stay as `starting` until either the health check is successful or until the `--health-start-period` time is over. If the +health check command fails after the `--health-start-period` time is over, the health state will be updated to `unhealthy`. +The health check command is executed periodically based on the value of `--health-interval`. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-start-period.md) + + +[//]: # (BEGIN included file options/health-startup-cmd.md) +#### **--health-startup-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set a startup healthcheck command for a container. This command is executed inside the container and is used to gate the regular +healthcheck. When the startup command succeeds, the regular healthcheck begins and the startup healthcheck ceases. Optionally, +if the command fails for a set number of attempts, the container is restarted. A startup healthcheck can be used to ensure that +containers with an extended startup period are not marked as unhealthy until they are fully started. Startup healthchecks can only be +used when a regular healthcheck (from the container's image or the **--health-cmd** option) is also set. + +[//]: # (END included file options/health-startup-cmd.md) + + +[//]: # (BEGIN included file options/health-startup-interval.md) +#### **--health-startup-interval**=*interval* + +Set an interval for the startup healthcheck. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-startup-interval.md) + + +[//]: # (BEGIN included file options/health-startup-retries.md) +#### **--health-startup-retries**=*retries* + +The number of attempts allowed before the startup healthcheck restarts the container. If set to **0**, the container is never restarted. The default is **0**. + +[//]: # (END included file options/health-startup-retries.md) + + +[//]: # (BEGIN included file options/health-startup-success.md) +#### **--health-startup-success**=*retries* + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value +of **0** means that any success begins the regular healthcheck. The default is **0**. + +[//]: # (END included file options/health-startup-success.md) + + +[//]: # (BEGIN included file options/health-startup-timeout.md) +#### **--health-startup-timeout**=*timeout* + +The maximum time a startup healthcheck command has to complete before it is marked as failed. The value can be expressed in a time +format like **2m3s**. The default value is **30s**. + +[//]: # (END included file options/health-startup-timeout.md) + + +[//]: # (BEGIN included file options/health-timeout.md) +#### **--health-timeout**=*timeout* + +The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the +value can be expressed in a time format such as **1m22s**. The default value is **30s**. + +Note: A timeout marks the healthcheck as failed but does not terminate the running process. +This ensures that a slow but eventually successful healthcheck does not disrupt the container +but is still accounted for in the health status. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-timeout.md) + +#### **--help** + +Print usage statement + + +[//]: # (BEGIN included file options/hostname.container.md) +#### **--hostname**, **-h**=*name* + +Set the container's hostname inside the container. + +This option can only be used with a private UTS namespace `--uts=private` +(default). If `--pod` is given and the pod shares the same UTS namespace +(default), the pod's hostname is used. The given hostname is also added to the +`/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). + +[//]: # (END included file options/hostname.container.md) + + +[//]: # (BEGIN included file options/hosts-file.md) +#### **--hosts-file**=*path* | *none* | *image* + +Base file to create the `/etc/hosts` file inside the container. This must either +be an absolute path to a file on the host system, or one of the following +special flags: + "" Follow the `base_hosts_file` configuration in _containers.conf_ (the default) + `none` Do not use a base file (i.e. start with an empty file) + `image` Use the container image's `/etc/hosts` file as base file + +[//]: # (END included file options/hosts-file.md) + + +[//]: # (BEGIN included file options/hostuser.md) +#### **--hostuser**=*name* + +Add a user account to /etc/passwd from the host to the container. The Username +or UID must exist on the host system. + +[//]: # (END included file options/hostuser.md) + + +[//]: # (BEGIN included file options/http-proxy.md) +#### **--http-proxy** + +By default proxy environment variables are passed into the container if set +for the Podman process. This can be disabled by setting the value to **false**. +The environment variables passed in include **http_proxy**, +**https_proxy**, **ftp_proxy**, **no_proxy**, and also the upper case versions of +those. This option is only needed when the host system must use a proxy but +the container does not use any proxy. Proxy environment variables specified +for the container in any other way overrides the values that have +been passed through from the host. (Other ways to specify the proxy for the +container include passing the values with the **--env** flag, or hard coding the +proxy environment at container build time.) +When used with the remote client it uses the proxy environment variables +that are set on the server process. + +Defaults to **true**. + +[//]: # (END included file options/http-proxy.md) + + +[//]: # (BEGIN included file options/image-volume.md) +#### **--image-volume**=**bind** | *tmpfs* | *ignore* + +Tells Podman how to handle the builtin image volumes. Default is **bind**. + +- **bind**: An anonymous named volume is created and mounted into the container. +- **tmpfs**: The volume is mounted onto the container as a tmpfs, which allows the users to create +content that disappears when the container is stopped. +- **ignore**: All volumes are just ignored and no action is taken. + +[//]: # (END included file options/image-volume.md) + + +[//]: # (BEGIN included file options/init.md) +#### **--init** + +Run an init inside the container that forwards signals and reaps processes. +The container-init binary is mounted at `/run/podman-init`. +Mounting over `/run` breaks container execution. + +[//]: # (END included file options/init.md) + + +[//]: # (BEGIN included file options/init-path.md) +#### **--init-path**=*path* + +Path to the container-init binary. + +[//]: # (END included file options/init-path.md) + + +[//]: # (BEGIN included file options/interactive.md) +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. + +[//]: # (END included file options/interactive.md) + + +[//]: # (BEGIN included file options/ip.md) +#### **--ip**=*ipv4* + +Specify a static IPv4 address for the container, for example **10.88.64.128**. +This option can only be used if the container is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IP address pool (default **10.88.0.0/16**). + +To specify multiple static IP addresses per container, set multiple networks using the **--network** option with a static IP address specified for each using the `ip` mode for that option. + +[//]: # (END included file options/ip.md) + + +[//]: # (BEGIN included file options/ip6.md) +#### **--ip6**=*ipv6* + +Specify a static IPv6 address for the container, for example **fd46\:db93\:aa76\:ac37::10**. +This option can only be used if the container is joined to only a single network - i.e., **--network=network-name** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. +The address must be within the network's IPv6 address pool. + +To specify multiple static IPv6 addresses per container, set multiple networks using the **--network** option with a static IPv6 address specified for each using the `ip6` mode for that option. + +[//]: # (END included file options/ip6.md) + + +[//]: # (BEGIN included file options/ipc.md) +#### **--ipc**=*ipc* + +Set the IPC namespace mode for a container. The default is to create +a private IPC namespace. + +- "": Use Podman's default, defined in containers.conf. +- **container:**_id_: reuses another container's shared memory, semaphores, and message queues +- **host**: use the host's shared memory, semaphores, and message queues inside the container. Note: the host mode gives the container full access to local shared memory and is therefore considered insecure. +- **none**: private IPC namespace, with /dev/shm not mounted. +- **ns:**_path_: path to an IPC namespace to join. +- **private**: private IPC namespace. +- **shareable**: private IPC namespace with a possibility to share it with other containers. + +[//]: # (END included file options/ipc.md) + + +[//]: # (BEGIN included file options/label.md) +#### **--label**, **-l**=*key=value* + +Add metadata to a container. + +[//]: # (END included file options/label.md) + + +[//]: # (BEGIN included file options/label-file.md) +#### **--label-file**=*file* + +Read in a line-delimited file of labels. + +[//]: # (END included file options/label-file.md) + + +[//]: # (BEGIN included file options/link-local-ip.md) +#### **--link-local-ip**=*ip* + +Not implemented. + +[//]: # (END included file options/link-local-ip.md) + + +[//]: # (BEGIN included file options/log-driver.md) +#### **--log-driver**=*driver* + +Logging driver for the container. Currently available options are **k8s-file**, **journald**, **none**, **passthrough** and **passthrough-tty**, with **json-file** aliased to **k8s-file** for scripting compatibility. (Default **journald**). + +The podman info command below displays the default log-driver for the system. +``` +$ podman info --format '{{ .Host.LogDriver }}' +journald +``` +The **passthrough** driver passes down the standard streams (stdin, stdout, stderr) to the +container. It is not allowed with the remote Podman client, including Mac and Windows (excluding WSL2) machines, and on a tty, since it is +vulnerable to attacks via TIOCSTI. + +The **passthrough-tty** driver is the same as **passthrough** except that it also allows it to be used on a TTY if the user really wants it. + +[//]: # (END included file options/log-driver.md) + + +[//]: # (BEGIN included file options/log-opt.md) +#### **--log-opt**=*name=value* + +Logging driver specific options. + +Set custom logging configuration. The following *name*s are supported: + +**path**: specify a path to the log file + (e.g. **--log-opt path=/var/log/container/mycontainer.json**); + +**max-size**: specify a max size of the log file + (e.g. **--log-opt max-size=10mb**); + +**tag**: specify a custom log tag for the container + (e.g. **--log-opt tag="{{.ImageName}}"**. +It supports the same keys as **podman inspect --format**. +This option is currently supported only by the **journald** log driver. + +[//]: # (END included file options/log-opt.md) + + +[//]: # (BEGIN included file options/mac-address.md) +#### **--mac-address**=*address* + +Container network interface MAC address (e.g. 92\:d0\:c6:0a:29:33) +This option can only be used if the container is joined to only a single network - i.e., **--network=_network-name_** is used at most once - +and if the container is not joining another container's network namespace via **--network=container\:_id_**. + +Remember that the MAC address in an Ethernet network must be unique. +The IPv6 link-local address is based on the device's MAC address +according to RFC4862. + +To specify multiple static MAC addresses per container, set multiple networks using the **--network** option with a static MAC address specified for each using the `mac` mode for that option. + +[//]: # (END included file options/mac-address.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-reservation.md) +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-reservation.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/memory-swappiness.md) +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/memory-swappiness.md) + + +[//]: # (BEGIN included file options/mount.md) +#### **--mount**=*type=TYPE,TYPE-SPECIFIC-OPTION[,...]* + +Attach a filesystem mount to the container. + +Current supported mount TYPEs are **artifact**, **bind**, **devpts**, **glob**, **image**, **ramfs**, **tmpfs** and **volume**. + +Options common to all mount types: + +- *src*, *source*: mount source spec for **bind**, **glob**, and **volume**. + Mandatory for **artifact**, **bind**, **glob**, **image** and **volume**. + +- *dst*, *destination*, *target*: mount destination spec. + +When source globs are specified without the destination directory, +the files and directories are mounted with their complete path +within the container. When the destination is specified, the +files and directories matching the glob on the base file name +on the destination directory are mounted. The option +`type=glob,src=/foo*,destination=/tmp/bar` tells container engines +to mount host files matching /foo* to the /tmp/bar/ +directory in the container. + +Options specific to type=**artifact**: + +- *digest*: If the artifact source contains multiple blobs a digest can be + specified to only mount the one specific blob with the digest. + +- *title*: If the artifact source contains multiple blobs a title can be set + which is compared against `org.opencontainers.image.title` annotation. + +The *src* argument contains the name of the artifact, which must already exist locally. +The *dst* argument contains the target path, if the path in the container is a +directory or does not exist the blob title (`org.opencontainers.image.title` +annotation) will be used as filename and joined to the path. If the annotation +does not exist the digest will be used as filename instead. This results in all blobs +of the artifact mounted into the container at the given path. + +However, if the *dst* path is an existing file in the container, then the blob will be +mounted directly on it. This only works when the artifact contains a single blob +or when either *digest* or *title* are specified. + +Options specific to type=**volume**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *idmap*: If specified, create an idmapped mount to the target user namespace in the container. + The idmap option is only supported by Podman in rootful mode. The Linux kernel does not allow the use of idmapped file systems for unprivileged users. + The idmap option supports a custom mapping that can be different than the user namespace used by the container. + The mapping can be specified after the idmap option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the first value is the + start of the backing file system IDs that are mapped to the second value on the host. The length of this mapping is given in the third value. + Multiple ranges are separated with #. If the specified mapping is prepended with a '@', then the mapping is considered relative to the container + user namespace. The host ID for the mapping is changed to account for the relative position of the container user in the container user namespace. + +Options specific to type=**image**: + +- *rw*, *readwrite*: *true* or *false* (default if unspecified: *false*). + +- *subpath*: Mount only a specific path within the image, instead of the whole image. + +Options specific to **bind** and **glob**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *bind-propagation*: *shared*, *slave*, *private*, *unbindable*, *rshared*, *rslave*, *runbindable*, or **rprivate** (default).[[1]](#Footnote1) See also mount(2). + +- *bind-nonrecursive*: do not set up a recursive bind mount. By default it is recursive. + +- *relabel*: *shared*, *private*. + +- *idmap*: *true* or *false* (default if unspecified: *false*). If true, create an idmapped mount to the target user namespace in the container. The idmap option is only supported by Podman in rootful mode. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +- *no-dereference*: do not dereference symlinks but copy the link source into the mount destination. + +Options specific to type=**tmpfs** and **ramfs**: + +- *ro*, *readonly*: *true* or *false* (default if unspecified: *false*). + +- *tmpfs-size*: Size of the tmpfs/ramfs mount, in bytes. Unlimited by default in Linux. + +- *tmpfs-mode*: Octal file mode of the tmpfs/ramfs (e.g. 700 or 0700.). + +- *tmpcopyup*: Enable copyup from the image directory at the same location to the tmpfs/ramfs. Used by default. + +- *notmpcopyup*: Disable copying files from the image to the tmpfs/ramfs. + +- *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container. + +Options specific to type=**devpts**: + +- *uid*: numeric UID of the file owner (default: 0). + +- *gid*: numeric GID of the file owner (default: 0). + +- *mode*: octal permission mask for the file (default: 600). + +- *max*: maximum number of PTYs (default: 1048576). + +Examples: + +- `type=bind,source=/path/on/host,destination=/path/in/container` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared` + +- `type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared,U=true` + +- `type=devpts,destination=/dev/pts` + +- `type=glob,src=/usr/lib/libfoo*,destination=/usr/lib,ro=true` + +- `type=image,source=fedora,destination=/fedora-image,rw=true` + +- `type=ramfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,tmpfs-size=512M,destination=/path/in/container` + +- `type=tmpfs,destination=/path/in/container,noswap` + +- `type=artifact,src=quay.io/libpod/testartifact:20250206-single,dst=/data` + +- `type=artifact,src=quay.io/libpod/testartifact:20250206-multi,dst=/data,title=test1` + +[//]: # (END included file options/mount.md) + + +[//]: # (BEGIN included file options/name.container.md) +#### **--name**=*name* + +Assign a name to the container. + +The operator can identify a container in three ways: + +- UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”); +- UUID short identifier (“f78375b1c487”); +- Name (“jonah”). + +Podman generates a UUID for each container, and if no name is assigned to the +container using **--name**, Podman generates a random string name. The name can +be useful as a more human-friendly way to identify containers. This works for +both background and foreground containers. The container's name is also added +to the `/etc/hosts` file using the container's primary IP address (also see the +**--add-host** option). + +[//]: # (END included file options/name.container.md) + + +[//]: # (BEGIN included file options/network.md) +#### **--network**=*mode*, **--net** + +Set the network mode for the container. + +Valid _mode_ values are: + +- **bridge[\:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options: + - **alias=**_name_: Add network-scoped alias for the container. + - **ip=**_IPv4_: Specify a static IPv4 address for this container. + - **ip6=**_IPv6_: Specify a static IPv6 address for this container. + - **mac=**_MAC_: Specify a static MAC address for this container. + - **interface_name=**_name_: Specify a name for the created network interface inside the container. + - **host_interface_name=**_name_: Specify a name for the created network interface outside the container. + + Any other options will be passed through to netavark without validation. This can be useful to pass arguments to netavark plugins. + + For example, to set a static ipv4 address and a static mac address, use `--network bridge\:ip=10.88.0.10,mac=44:33:22:11:00:99`. + +- _\_**[\:OPTIONS,...]**: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. It is possible to specify the same options described under the bridge mode above. Use the **--network** option multiple times to specify additional networks. \ + For backwards compatibility it is also possible to specify comma-separated networks on the first **--network** argument, however this prevents you from using the options described under the bridge section above. + +- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. + +- **container:**_id_: Reuse another container's network stack. + +- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. + +- **ns:**_path_: Path to a network namespace to join. + +- **private**: Create a new namespace for the container. This uses the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. + +- **slirp4netns[\:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: + + - **allow_host_loopback=true|false**: Allow slirp4netns to reach the host loopback IP (default is 10.0.2.2 or the second IP from slirp4netns cidr subnet when changed, see the cidr option below). The default is false. + - **mtu=**_MTU_: Specify the MTU to use for this network. (Default is `65520`). + - **cidr=**_CIDR_: Specify ip range to use for this network. (Default is `10.0.2.0/24`). + - **enable_ipv6=true|false**: Enable IPv6. Default is true. (Required for `outbound_addr6`). + - **outbound_addr=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv4 traffic only). + - **outbound_addr=**_IPv4_: Specify the outbound ipv4 address slirp binds to. + - **outbound_addr6=**_INTERFACE_: Specify the outbound interface slirp binds to (ipv6 traffic only). + - **outbound_addr6=**_IPv6_: Specify the outbound ipv6 address slirp binds to. + - **port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default. \ + Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. + - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. + +- **pasta[\:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking + stack. \ + This is the default for rootless containers and only supported in rootless mode. \ + By default, IPv4 and IPv6 addresses and routes, as well as the pod interface + name, are copied from the host. Port forwarding preserves the original + source IP address. Options described in pasta(1) can be specified as + comma-separated arguments. \ + In terms of pasta(1) options, **--config-net** is given by default, in + order to configure networking when the container is started, and + **--no-map-gw** is also assumed by default, to avoid direct access from + container to host using the gateway address. The latter can be overridden + by passing **--map-gw** in the pasta-specific options (despite not being an + actual pasta(1) option). \ + For better integration with DNS handling, **--dns-forward 169.254.1.1** is passed, + and this address is added to resolv.conf(5) as first resolver. It is possible to pass + **--dns-forward** explicitly in case a different IP address should be used. + To make the `host.containers.internal` /etc/hosts entry work and allow connections + to the host, **--map-guest-addr 169.254.1.2** is passed. Again, it can be set + explicitly to choose a different IP address. \ + Also, **-t none** and **-u none** are passed if, respectively, no TCP or + UDP port forwarding from host to container is configured (via Podman's + **--publish** or by passing the pasta **-t**/**-u** options directly), + to disable automatic port forwarding based on bound ports. Similarly, **-T none** + and **-U none** are given to disable the same functionality from container to + host. \ + All options can also be set in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**; + see the `pasta_options` key under the network section in that file. \ + Some examples: + - **pasta:--map-gw**: Allow the container to directly reach the host using the + gateway address. + - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in + the container. + - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options: disable IPv6, assign + `10.0.2.0/24` to the `tap0` interface in the container, with gateway + `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 + bytes, disable NDP, DHCPv6 and DHCP support. + - **pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, + equivalent to default slirp4netns(1) options with Podman overrides: same as + above, but leave the MTU to 65520 bytes + - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding + based on observed bound ports from both host and container sides + - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to + host, using the loopback interface instead of the tap interface for improved + performance + +[//]: # (END included file options/network.md) + +Invalid if using **--dns**, **--dns-option**, or **--dns-search** with **--network** set to **none** or **container:**_id_. + +If used together with **--pod**, the container joins the pod's network namespace. + + +[//]: # (BEGIN included file options/network-alias.md) +#### **--network-alias**=*alias* + +Add a network-scoped alias for the container, setting the alias for all networks that the container joins. To set a +name only for a specific network, use the alias option as described under the **--network** option. +If the network has DNS enabled (`podman network inspect -f {{.DNSEnabled}} `), +these aliases can be used for name resolution on the given network. This option can be specified multiple times. +NOTE: When using CNI a container only has access to aliases on the first network that it joins. This limitation does +not exist with netavark/aardvark-dns. + +[//]: # (END included file options/network-alias.md) + + +[//]: # (BEGIN included file options/no-healthcheck.md) +#### **--no-healthcheck** + +Disable any defined healthchecks for container. + +[//]: # (END included file options/no-healthcheck.md) + + +[//]: # (BEGIN included file options/no-hostname.md) +#### **--no-hostname** + +Do not create the _/etc/hostname_ file in the containers. + +By default, Podman manages the _/etc/hostname_ file, adding the container's own hostname. When the **--no-hostname** option is set, the image's _/etc/hostname_ will be preserved unmodified if it exists. + +[//]: # (END included file options/no-hostname.md) + + +[//]: # (BEGIN included file options/no-hosts.md) +#### **--no-hosts** + +Do not modify the `/etc/hosts` file in the container. + +Podman assumes control over the container's `/etc/hosts` file by +default and adds entries for the container's name (see **--name** option) and +hostname (see **--hostname** option), the internal `host.containers.internal` +and `host.docker.internal` hosts, as well as any hostname added using the +**--add-host** option. Refer to the **--add-host** option for details. Passing +**--no-hosts** disables this, so that the image's `/etc/hosts` file is kept +unmodified. The same can be achieved globally by setting *no_hosts=true* in +`containers.conf`. + +[//]: # (END included file options/no-hosts.md) + +This option conflicts with **--add-host**. + + +[//]: # (BEGIN included file options/oom-kill-disable.md) +#### **--oom-kill-disable** + +Whether to disable OOM Killer for the container or not. + +This flag is not supported on cgroups V2 systems. + +[//]: # (END included file options/oom-kill-disable.md) + + +[//]: # (BEGIN included file options/oom-score-adj.md) +#### **--oom-score-adj**=*num* + +Tune the host's OOM preferences for containers (accepts values from **-1000** to **1000**). + +When running in rootless mode, the specified value can't be lower than +the oom_score_adj for the current process. In this case, the +oom-score-adj is clamped to the current process value. + +[//]: # (END included file options/oom-score-adj.md) + + +[//]: # (BEGIN included file options/os.pull.md) +#### **--os**=*OS* + +Override the OS, defaults to hosts, of the image to be pulled. For example, `windows`. +Unless overridden, subsequent lookups of the same image in the local storage matches this OS, regardless of the host. + +[//]: # (END included file options/os.pull.md) + +#### **--passwd** + +Allow Podman to add entries to /etc/passwd and /etc/group when used in conjunction with the --user option. +This is used to override the Podman provided user setup in favor of entrypoint configurations such as libnss-extrausers. + + +[//]: # (BEGIN included file options/passwd-entry.md) +#### **--passwd-entry**=*ENTRY* + +Customize the entry that is written to the `/etc/passwd` file within the container when `--passwd` is used. + +The variables $USERNAME, $UID, $GID, $NAME, $HOME are automatically replaced with their value at runtime. + +[//]: # (END included file options/passwd-entry.md) + + +[//]: # (BEGIN included file options/personality.md) +#### **--personality**=*persona* + +Personality sets the execution domain via Linux personality(2). + +[//]: # (END included file options/personality.md) + + +[//]: # (BEGIN included file options/pid.container.md) +#### **--pid**=*mode* + +Set the PID namespace mode for the container. +The default is to create a private PID namespace for the container. + +- **container:**_id_: join another container's PID namespace; +- **host**: use the host's PID namespace for the container. Note the host mode gives the container full access to local PID and is therefore considered insecure; +- **ns:**_path_: join the specified PID namespace; +- **private**: create a new namespace for the container (default). + +[//]: # (END included file options/pid.container.md) + + +[//]: # (BEGIN included file options/pidfile.md) +#### **--pidfile**=*path* + +When the pidfile location is specified, the container process' PID is written to the pidfile. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +If the pidfile option is not specified, the container process' PID is written to /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile. + +After the container is started, the location for the pidfile can be discovered with the following `podman inspect` command: + + $ podman inspect --format '{{ .PidFile }}' $CID + /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile + +[//]: # (END included file options/pidfile.md) + + +[//]: # (BEGIN included file options/pids-limit.md) +#### **--pids-limit**=*limit* + +Tune the container's pids limit. Set to **-1** to have unlimited pids for the container. The default is **2048** on systems that support "pids" cgroup controller. + +[//]: # (END included file options/pids-limit.md) + + +[//]: # (BEGIN included file options/platform.md) +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with --arch and --os) +The `--platform` option can be used to override the current architecture and operating system. +Unless overridden, subsequent lookups of the same image in the local storage matches this platform, regardless of the host. + +[//]: # (END included file options/platform.md) + + +[//]: # (BEGIN included file options/pod.run.md) +#### **--pod**=*name* + +Run container in an existing pod. Podman makes the pod automatically if the pod name is prefixed with **new:**. +To make a pod with more granular options, use the **podman pod create** command before creating a container. +When a container is run with a pod with an infra-container, the infra-container is started first. + +[//]: # (END included file options/pod.run.md) + + +[//]: # (BEGIN included file options/pod-id-file.container.md) +#### **--pod-id-file**=*file* + +Run container in an existing pod and read the pod's ID from the specified *file*. +When a container is run within a pod which has an infra-container, the infra-container starts first. + +[//]: # (END included file options/pod-id-file.container.md) + + +[//]: # (BEGIN included file options/preserve-fd.md) +#### **--preserve-fd**=*FD1[,FD2,...]* + +Pass down to the process the additional file descriptors specified in the comma separated list. It can be specified multiple times. +This option is only supported with the crun OCI runtime. It might be a security risk to use this option with other OCI runtimes. + +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/preserve-fd.md) + + +[//]: # (BEGIN included file options/preserve-fds.md) +#### **--preserve-fds**=*N* + +Pass down to the process N additional file descriptors (in addition to 0, 1, 2). +The total FDs are 3+N. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/preserve-fds.md) + + +[//]: # (BEGIN included file options/privileged.md) +#### **--privileged** + +Give extended privileges to this container. The default is **false**. + +By default, Podman containers are unprivileged (**=false**) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read-only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. +Due to the disabled security features, the privileged field should almost never +be set as containers can easily break out of confinement. + +Containers running in a user namespace (e.g., rootless containers) cannot have +more privileges than the user that launched them. + +[//]: # (END included file options/privileged.md) + + +[//]: # (BEGIN included file options/publish.md) +#### **--publish**, **-p**=*[[ip:][hostPort]:]containerPort[/protocol]* + +Publish a container's port, or range of ports, to the host. + +Both *hostPort* and *containerPort* can be specified as a range of ports. +When specifying ranges for both, the number of container ports in the +range must match the number of host ports in the range. + +If host IP is set to 0.0.0.0 or not set at all, the port is bound on all IPs on the host. + +By default, Podman publishes TCP ports. To publish a UDP port instead, give +`udp` as protocol. To publish both TCP and UDP ports, set `--publish` twice, +with `tcp`, and `udp` as protocols respectively. Rootful containers can also +publish ports using the `sctp` protocol. + +Host port does not have to be specified (e.g. `podman run -p 127.0.0.1::80`). +If it is not, the container port is randomly assigned a port on the host. + +Use **podman port** to see the actual mapping: `podman port $CONTAINER $CONTAINERPORT`. + +Note that the network drivers `macvlan` and `ipvlan` do not support port forwarding, +therefore this option will have no effect on such networks. + +[//]: # (END included file options/publish.md) + +**Note:** If a container runs within a pod, it is not necessary to publish the port for +the containers in the pod. The port must only be published by the pod itself. Pod network +stacks act like the network stack on the host - meaning a variety of containers in the pod +and programs in the container all share a single interface, IP address, and +associated ports. If one container binds to a port, no other container can use that port +within the pod while it is in use. Containers in the pod can also communicate over localhost +by having one container bind to localhost in the pod, and another connect to that port. + + +[//]: # (BEGIN included file options/publish-all.md) +#### **--publish-all**, **-P** + +Publish all exposed ports to random ports on the host interfaces. The default is **false**. + +When set to **true**, publish all exposed ports to the host interfaces. +If the operator uses **-P** (or **-p**) then Podman makes the +exposed port accessible on the host and the ports are available to any +client that can reach the host. + +When using this option, Podman binds any exposed port to a random port on the host +within an ephemeral port range defined by */proc/sys/net/ipv4/ip_local_port_range*. +To find the mapping between the host ports and the exposed ports, use **podman port**. + +[//]: # (END included file options/publish-all.md) + + +[//]: # (BEGIN included file options/pull.md) +#### **--pull**=*policy* + +Pull image policy. The default is **missing**. + +- **always**: Always pull the image and throw an error if the pull fails. +- **missing**: Pull the image only when the image is not in the local containers storage. Throw an error if no image is found and the pull fails. +- **never**: Never pull the image but use the one from the local containers storage. Throw an error if no image is found. +- **newer**: Pull if the image on the registry is newer than the one in the local containers storage. An image is considered to be newer when the digests are different. Comparing the time stamps is prone to errors. Pull errors are suppressed if a local image was found. + +[//]: # (END included file options/pull.md) + +#### **--quiet**, **-q** + +Suppress output information when pulling images + + +[//]: # (BEGIN included file options/rdt-class.md) +#### **--rdt-class**=*intel-rdt-class-of-service* + +Rdt-class sets the class of service (CLOS or COS) for the container to run in. Based on the Cache Allocation Technology (CAT) feature that is part of Intel's Resource Director Technology (RDT) feature set, all container processes will run within the pre-configured COS, representing a part of the cache. The COS has to be created and configured using a pseudo file system (usually mounted at `/sys/fs/resctrl`) that the resctrl kernel driver provides. Assigning the container to a COS requires root privileges and thus doesn't work in a rootless environment. Currently, the feature is only supported using `runc` as a runtime. See for more details on creating a COS before a container can be assigned to it. + +[//]: # (END included file options/rdt-class.md) + + +[//]: # (BEGIN included file options/read-only.md) +#### **--read-only** + +Mount the container's root filesystem as read-only. + +By default, container root filesystems are writable, allowing processes +to write files anywhere. By specifying the **--read-only** flag, the containers root filesystem are mounted read-only prohibiting any writes. + +[//]: # (END included file options/read-only.md) + + +[//]: # (BEGIN included file options/read-only-tmpfs.md) +#### **--read-only-tmpfs** + +When running --read-only containers, mount a read-write tmpfs on _/dev_, _/dev/shm_, _/run_, _/tmp_, and _/var/tmp_. The default is **true**. + +| --read-only | --read-only-tmpfs | / | /run, /tmp, /var/tmp| +| ----------- | ----------------- | ---- | ----------------------------------- | +| true | true | r/o | r/w | +| true | false | r/o | r/o | +| false | false | r/w | r/w | +| false | true | r/w | r/w | + +When **--read-only=true** and **--read-only-tmpfs=true** additional tmpfs are mounted on +the /tmp, /run, and /var/tmp directories. + +When **--read-only=true** and **--read-only-tmpfs=false** /dev and /dev/shm are marked +Read/Only and no tmpfs are mounted on /tmp, /run and /var/tmp. The directories +are exposed from the underlying image, meaning they are read-only by default. +This makes the container totally read-only. No writable directories exist within +the container. In this mode writable directories need to be added via external +volumes or mounts. + +By default, when **--read-only=false**, the /dev and /dev/shm are read/write, and the /tmp, /run, and /var/tmp are read/write directories from the container image. + +[//]: # (END included file options/read-only-tmpfs.md) + + +[//]: # (BEGIN included file options/replace.md) +#### **--replace** + +If another container with the same name already exists, replace and remove it. The default is **false**. + +[//]: # (END included file options/replace.md) + + +[//]: # (BEGIN included file options/requires.md) +#### **--requires**=*container* + +Specify one or more requirements. +A requirement is a dependency container that is started before this container. +Containers can be specified by name or ID, with multiple containers being separated by commas. + +[//]: # (END included file options/requires.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + + +[//]: # (BEGIN included file options/retry.md) +#### **--retry**=*attempts* + +Number of times to retry pulling or pushing images between the registry and +local storage in case of failure. Default is **3**. + +[//]: # (END included file options/retry.md) + + +[//]: # (BEGIN included file options/retry-delay.md) +#### **--retry-delay**=*duration* + +Duration of delay between retry attempts when pulling or pushing images between +the registry and local storage in case of failure. The default is to start at two seconds and then exponentially back off. The delay is used when this value is set, and no exponential back off occurs. + +[//]: # (END included file options/retry-delay.md) + +#### **--rm** + +Automatically remove the container and any anonymous unnamed volume associated with +the container when it exits. The default is **false**. + +#### **--rmi** + +After exit of the container, remove the image unless another +container is using it. Implies --rm on the new container. The default is *false*. + + +[//]: # (BEGIN included file options/rootfs.md) +#### **--rootfs** + +If specified, the first argument refers to an exploded container on the file system. + +This is useful to run a container without requiring any image management, the rootfs +of the container is assumed to be managed externally. + + `Overlay Rootfs Mounts` + + The `\:O` flag tells Podman to mount the directory from the rootfs path as +storage using the `overlay file system`. The container processes +can modify content within the mount point which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +Note: On **SELinux** systems, the rootfs needs the correct label, which is by default +**unconfined_u\:object_r\:container_file_t\:s0**. + + `idmap` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. +The idmap option supports a custom mapping that can be different than the user +namespace used by the container. The mapping can be specified after the idmap +option like: `idmap=uids=0-1-10#10-11-10;gids=0-100-10`. For each triplet, the +first value is the start of the backing file system IDs that are mapped to the +second value on the host. The length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/rootfs.md) + + +[//]: # (BEGIN included file options/sdnotify.md) +#### **--sdnotify**=**container** | *conmon* | *healthy* | *ignore* + +Determines how to use the NOTIFY_SOCKET, as passed with systemd and Type=notify. + +Default is **container**, which means allow the OCI runtime to proxy the socket into the +container to receive ready notification. Podman sets the MAINPID to conmon's pid. +The **conmon** option sets MAINPID to conmon's pid, and sends READY when the container +has started. The socket is never passed to the runtime or the container. +The **healthy** option sets MAINPID to conmon's pid, and sends READY when the container +has turned healthy; requires a healthcheck to be set. The socket is never passed to the runtime or the container. +The **ignore** option removes NOTIFY_SOCKET from the environment for itself and child processes, +for the case where some other process above Podman uses NOTIFY_SOCKET and Podman does not use it. + +[//]: # (END included file options/sdnotify.md) + + +[//]: # (BEGIN included file options/seccomp-policy.md) +#### **--seccomp-policy**=*policy* + +Specify the policy to select the seccomp profile. If set to *image*, Podman looks for a "io.containers.seccomp.profile" label in the container-image config and use its value as a seccomp profile. Otherwise, Podman follows the *default* policy by applying the default profile unless specified otherwise via *--security-opt seccomp* as described below. + +Note that this feature is experimental and may change in the future. + +[//]: # (END included file options/seccomp-policy.md) + + +[//]: # (BEGIN included file options/secret.md) +#### **--secret**=*secret[,opt=opt ...]* + +Give the container access to a secret. Can be specified multiple times. + +A secret is a blob of sensitive data which a container needs at runtime but +is not stored in the image or in source control, such as usernames and passwords, +TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 512 kB in size). + +When secrets are specified as type `mount`, the secrets are copied and mounted into the container when a container is created. +When secrets are specified as type `env`, the secret is set as an environment variable within the container. +Secrets are written in the container at the time of container creation, and modifying the secret using `podman secret` commands +after the container is created affects the secret inside the container. + +Secrets and its storage are managed using the `podman secret` command. + +Secret Options + +- `type=mount|env` : How the secret is exposed to the container. + `mount` mounts the secret into the container as a file. + `env` exposes the secret as an environment variable. + Defaults to `mount`. +- `target=target` : Target of secret. + For mounted secrets, this is the path to the secret inside the container. + If a fully qualified path is provided, the secret is mounted at that location. + Otherwise, the secret is mounted to + `/run/secrets/target` for Linux containers or + `/var/run/secrets/target` for FreeBSD containers. + If the target is not set, the secret is mounted to `/run/secrets/secretname` by default. + For env secrets, this is the environment variable key. Defaults to `secretname`. +- `uid=0` : UID of secret. Defaults to 0. Mount secret type only. +- `gid=0` : GID of secret. Defaults to 0. Mount secret type only. +- `mode=0` : Mode of secret. Defaults to 0444. Mount secret type only. + + +Examples + +Mount at `/my/location/mysecret` with UID 1: +``` +--secret mysecret,target=/my/location/mysecret,uid=1 +``` + +Mount at `/run/secrets/customtarget` with mode 0777: +``` +--secret mysecret,target=customtarget,mode=0777 +``` + +Create a secret environment variable called `ENVSEC`: +``` +--secret mysecret,type=env,target=ENVSEC +``` + +[//]: # (END included file options/secret.md) + + +[//]: # (BEGIN included file options/security-opt.md) +#### **--security-opt**=*option* + +Security Options + +- **apparmor=unconfined** : Turn off apparmor confinement for the container +- **apparmor**=_alternate-profile_ : Set the apparmor confinement profile for the container + +- **label=user:**_USER_: Set the label user for the container processes +- **label=role:**_ROLE_: Set the label role for the container processes +- **label=type:**_TYPE_: Set the label process type for the container processes +- **label=level:**_LEVEL_: Set the label level for the container processes +- **label=filetype:**_TYPE_: Set the label file type for the container files +- **label=disable**: Turn off label separation for the container + +Note: Labeling can be disabled for all containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + +- **label=nested**: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without **nested**, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. + +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the container. + +- **no-new-privileges**: Disable container processes from gaining additional privileges through the `execve(2)` system call (e.g. via setuid or setgid bits, or via file capabilities). Programs that rely on setuid/setgid bits set on their executable to change user id or group id are no longer able to do so, and any file capabilities added to the executable (e.g. via `setcap`) are not added to the permitted capability set. For more details, see: https://docs.kernel.org/userspace-api/no_new_privs.html. + +- **seccomp=unconfined**: Turn off seccomp confinement for the container. +- **seccomp=profile.json**: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + +Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. + +[//]: # (END included file options/security-opt.md) + + +[//]: # (BEGIN included file options/shm-size.md) +#### **--shm-size**=*number[unit]* + +Size of _/dev/shm_. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, there is no limit on the amount of memory used for IPC by the container. +This option conflicts with **--ipc=host**. + +[//]: # (END included file options/shm-size.md) + + +[//]: # (BEGIN included file options/shm-size-systemd.md) +#### **--shm-size-systemd**=*number[unit]* + +Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). +If the unit is omitted, the system uses bytes. If the size is omitted, the default is **64m**. +When _size_ is **0**, the usage is limited to 50% of the host's available memory. + +[//]: # (END included file options/shm-size-systemd.md) + + +[//]: # (BEGIN included file options/sig-proxy.md) +#### **--sig-proxy** + +Proxy received signals to the container process. SIGCHLD, SIGURG, SIGSTOP, and SIGKILL are not proxied. + +[//]: # (END included file options/sig-proxy.md) + +The default is **true**. + + +[//]: # (BEGIN included file options/stop-signal.md) +#### **--stop-signal**=*signal* + +Signal to stop a container. Default is **SIGTERM**. + +[//]: # (END included file options/stop-signal.md) + + +[//]: # (BEGIN included file options/stop-timeout.md) +#### **--stop-timeout**=*seconds* + +Timeout to stop a container. Default is **10**. +Remote connections use local containers.conf for defaults. + +[//]: # (END included file options/stop-timeout.md) + + +[//]: # (BEGIN included file options/subgidname.md) +#### **--subgidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subgid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subgid**(5). +This flag conflicts with **--userns** and **--gidmap**. + +[//]: # (END included file options/subgidname.md) + + +[//]: # (BEGIN included file options/subuidname.md) +#### **--subuidname**=*name* + +Run the container in a new user namespace using the map with _name_ in the _/etc/subuid_ file. +If running rootless, the user needs to have the right to use the mapping. See **subuid**(5). +This flag conflicts with **--userns** and **--uidmap**. + +[//]: # (END included file options/subuidname.md) + + +[//]: # (BEGIN included file options/sysctl.md) +#### **--sysctl**=*name=value* + +Configure namespaced kernel parameters at runtime. + +For the IPC namespace, the following sysctls are allowed: + +- kernel.msgmax +- kernel.msgmnb +- kernel.msgmni +- kernel.sem +- kernel.shmall +- kernel.shmmax +- kernel.shmmni +- kernel.shm_rmid_forced +- Sysctls beginning with fs.mqueue.\* + +Note: if using the **--ipc=host** option, the above sysctls are not allowed. + +For the network namespace, only sysctls beginning with net.\* are allowed. + +Note: if using the **--network=host** option, the above sysctls are not allowed. + +[//]: # (END included file options/sysctl.md) + + +[//]: # (BEGIN included file options/systemd.md) +#### **--systemd**=*true* | *false* | *always* + +Run container in systemd mode. The default is **true**. + +- **true** enables systemd mode only when the command executed inside the container is *systemd*, */usr/sbin/init*, +*/sbin/init* or */usr/local/sbin/init*. + +- **false** disables systemd mode. + +- **always** enforces the systemd mode to be enabled. + +Running the container in systemd mode causes the following changes: + +* Podman mounts tmpfs file systems on the following directories + * _/run_ + * _/run/lock_ + * _/tmp_ + * _/sys/fs/cgroup/systemd_ (on a cgroup v1 system) + * _/var/lib/journal_ +* Podman sets the default stop signal to **SIGRTMIN+3**. +* Podman sets **container_uuid** environment variable in the container to the +first 32 characters of the container ID. +* Podman does not mount virtual consoles (_/dev/tty\d+_) when running with **--privileged**. +* On cgroup v2, */sys/fs/cgroup* is mounted writable. + +This allows systemd to run in a confined container without any modifications. + +Note that on **SELinux** systems, systemd attempts to write to the cgroup +file system. Containers writing to the cgroup file system are denied by default. +The **container_manage_cgroup** boolean must be enabled for this to be allowed on an SELinux separated system. +``` +setsebool -P container_manage_cgroup true +``` + +[//]: # (END included file options/systemd.md) + + +[//]: # (BEGIN included file options/timeout.md) +#### **--timeout**=*seconds* + +Maximum time a container is allowed to run before conmon sends it the kill +signal. By default containers run until they exit or are stopped by +`podman stop`. + +[//]: # (END included file options/timeout.md) + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + + +[//]: # (BEGIN included file options/tmpfs.md) +#### **--tmpfs**=*fs* + +Create a tmpfs mount. + +Mount a temporary filesystem (**tmpfs**) mount into a container, for example: + +``` +$ podman run -d --tmpfs /tmp\:rw,size=787448k,mode=1777 my_image +``` + +This command mounts a **tmpfs** at _/tmp_ within the container. The supported mount +options are the same as the Linux default mount flags. If no options are specified, +the system uses the following options: +**rw,noexec,nosuid,nodev**. + +[//]: # (END included file options/tmpfs.md) + + +[//]: # (BEGIN included file options/tty.md) +#### **--tty**, **-t** + +Allocate a pseudo-TTY. The default is **false**. + +When set to **true**, Podman allocates a pseudo-tty and attach to the standard +input of the container. This can be used, for example, to run a throwaway +interactive shell. + +**NOTE**: The --tty flag prevents redirection of standard output. It combines STDOUT and STDERR, it can insert control characters, and it can hang pipes. This option is only used when run interactively in a terminal. When feeding input to Podman, use -i only, not -it. + +[//]: # (END included file options/tty.md) + +``` +echo "asdf" | podman run --rm -i someimage /bin/cat +``` + + +[//]: # (BEGIN included file options/tz.md) +#### **--tz**=*timezone* + +Set timezone in container. This flag takes area-based timezones, GMT time, as well as `local`, which sets the timezone in the container to match the host machine. See `/usr/share/zoneinfo/` for valid timezones. +Remote connections use local containers.conf for defaults + +[//]: # (END included file options/tz.md) + + +[//]: # (BEGIN included file options/uidmap.container.md) +#### **--uidmap**=*[flags]container_uid\:from_uid[\:amount]* + +Run the container in a new user namespace using the supplied UID mapping. This +option conflicts with the **--userns** and **--subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +The possible values of the optional *flags* are discussed further down on this page. +The *amount* value is optional and assumed to be **1** if not given. + +The *from_uid* value is based upon the user running the command, either rootful or rootless users. + +* rootful user: [*flags*]*container_uid*:*host_uid*[:*amount*] +* rootless user: [*flags*]*container_uid*:*intermediate_uid*[:*amount*] + + `Rootful mappings` + + +When **podman run** is called by a privileged user, the option **--uidmap** +works as a direct mapping between host UIDs and container UIDs. + +host UID -> container UID + +The _amount_ specifies the number of consecutive UIDs that is mapped. +If for example _amount_ is **4** the mapping looks like: + +| host UID | container UID | +| ---------- | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | + + `Rootless mappings` + +When **podman run** is called by an unprivileged user (i.e. running rootless), +the value *from_uid* is interpreted as an "intermediate UID". In the rootless +case, host UIDs are not mapped directly to container UIDs. Instead the mapping +happens over two mapping steps: + +host UID -> intermediate UID -> container UID + +The **--uidmap** option only influences the second mapping step. + +The first mapping step is derived by Podman from the contents of the file +_/etc/subuid_ and the UID of the user calling Podman. + +First mapping step: + +| host UID | intermediate UID | +| -------- | ---------------- | +| UID for Podman user | 0 | +| 1st subordinate UID | 1 | +| 2nd subordinate UID | 2 | +| 3rd subordinate UID | 3 | +| nth subordinate UID | n | + +To be able to use intermediate UIDs greater than zero, the user needs to have +subordinate UIDs configured in _/etc/subuid_. See **subuid**(5). + +The second mapping step is configured with **--uidmap**. + +If for example _amount_ is **5** the second mapping step looks like: + +| intermediate UID | container UID | +| ------------------ | ---------------- | +| *from_uid* | *container_uid* | +| *from_uid* + 1 | *container_uid* + 1 | +| *from_uid* + 2 | *container_uid* + 2 | +| *from_uid* + 3 | *container_uid* + 3 | +| *from_uid* + 4 | *container_uid* + 4 | + +When running as rootless, Podman uses all the ranges configured in the _/etc/subuid_ file. + +The current user ID is mapped to UID=0 in the rootless user namespace. +Every additional range is added sequentially afterward: + +| host | rootless user namespace | length | +| ------ | ----------------------- | ------ | +| $UID | 0 | 1 | +| 1 | $FIRST_RANGE_ID | $FIRST_RANGE_LENGTH | +| 1+$FIRST_RANGE_LENGTH | $SECOND_RANGE_ID | $SECOND_RANGE_LENGTH| + + `Referencing a host ID from the parent namespace` + +As a rootless user, the given host ID in **--uidmap** or **--gidmap** +is mapped from the *intermediate namespace* generated by Podman. Sometimes +it is desirable to refer directly at the *host namespace*. It is possible +to manually do so, by running `podman unshare cat /proc/self/gid_map`, +finding the desired host id at the second column of the output, and getting +the corresponding intermediate id from the first column. + +Podman can perform all that by preceding the host id in the mapping +with the `@` symbol. For instance, by specifying `--gidmap 100000:@2000:1`, +podman will look up the intermediate id corresponding to host id `2000` and +it will map the found intermediate id to the container id `100000`. The +given host id must have been subordinated (otherwise it would not be mapped +into the intermediate space in the first place). + +If the length is greater than one, for instance with `--gidmap 100000:@2000:2`, +Podman will map host ids `2000` and `2001` to `100000` and `100001`, respectively, +regardless of how the intermediate mapping is defined. + + `Extending previous mappings` + +Some mapping modifications may be cumbersome. For instance, a user +starts with a mapping such as `--gidmap="0:0:65000"`, that needs to be +changed such as the parent id `1000` is mapped to container id `100000` +instead, leaving container id `1` unassigned. The corresponding `--gidmap` +becomes `--gidmap="0:0:1" --gidmap="2:2:65534" --gidmap="100000:1:1"`. + +This notation can be simplified using the `+` flag, that takes care of +breaking previous mappings removing any conflicting assignment with +the given mapping. The flag is given before the container id +as follows: `--gidmap="0:0:65000" --gidmap="+100000:1:1"` + + + Flag | Example | Description +-----------|---------------|------------- + `+` | `+100000:1:1` | Extend the previous mapping + +This notation leads to gaps in the assignment, so it may be convenient to +fill those gaps afterwards: `--gidmap="0:0:65000" --gidmap="+100000:1:1" --gidmap="1:65001:1"` + +One specific use case for this flag is in the context of rootless +users. A rootless user may specify mappings with the `+` flag as +in `--gidmap="+100000:1:1"`. Podman will then "fill the gaps" starting +from zero with all the remaining intermediate ids. This is convenient when +a user wants to map a specific intermediate id to a container id, leaving +the rest of subordinate ids to be mapped by Podman at will. + + `Passing only one of --uidmap or --gidmap` + +Usually, subordinated user and group ids are assigned simultaneously, and +for any user the subordinated user ids match the subordinated group ids. +For convenience, if only one of **--uidmap** or **--gidmap** is given, +podman assumes the mapping refers to both UIDs and GIDs and applies the +given mapping to both. If only one value of the two needs to be changed, +the mappings should include the `u` or the `g` flags to specify that +they only apply to UIDs or GIDs and should not be copied over. + + flag | Example | Description +---------|-----------------|----------------- + `u` | `u20000:2000:1` |The mapping only applies to UIDs + `g` | `g10000:1000:1` |The mapping only applies to GIDs + +For instance given the command + + podman run --gidmap "0:0:1000" --gidmap "g2000:2000:1" + +Since no **--uidmap** is given, the **--gidmap** is copied to **--uidmap**, +giving a command equivalent to + + podman run --gidmap "0:0:1000" --gidmap "2000:2000:1" --uidmap "0:0:1000" + +The `--gidmap "g2000:2000:1"` used the `g` flag and therefore it was +not copied to **--uidmap**. + + `Rootless mapping of additional host GIDs` + +A rootless user may desire to map a specific host group that has already been +subordinated within _/etc/subgid_ without specifying the rest of the mapping. + +This can be done with **--gidmap "+g*container_gid*:@*host_gid*"** + +Where: + +- The host GID is given through the `@` symbol +- The mapping of this GID is not copied over to **--usermap** thanks to the `g` flag. +- The rest of the container IDs will be mapped starting from 0 to n, + with all the remaining subordinated GIDs, thanks to the `+` flag. + +For instance, if a user belongs to the group `2000` and that group is +subordinated to that user (with `usermod --add-subgids 2000-2000 $USER`), +the user can map the group into the container with: **--gidmap=+g100000:@2000**. + +If this mapping is combined with the option, **--group-add=keep-groups**, the +process in the container will belong to group `100000`, and files belonging +to group `2000` in the host will appear as being owned by group `100000` +inside the container. + + podman run --group-add=keep-groups --gidmap="+g100000:@2000" ... + + `No subordinate UIDs` + +Even if a user does not have any subordinate UIDs in _/etc/subuid_, +**--uidmap** can be used to map the normal UID of the user to a +container UID by running `podman run --uidmap $container_uid:0:1 --user $container_uid ...`. + + `Pods` + +The **--uidmap** option cannot be called in conjunction with the **--pod** option as a uidmap cannot be set on the container level when in a pod. + +[//]: # (END included file options/uidmap.container.md) + + +[//]: # (BEGIN included file options/ulimit.md) +#### **--ulimit**=*option* + +Ulimit options. Sets the ulimits values inside of the container. + +--ulimit with a soft and hard limit in the format =[:]. For example: + +$ podman run --ulimit nofile=1024:1024 --rm ubi9 ulimit -n +1024 + +Set -1 for the soft or hard limit to set the limit to the maximum limit of the current +process. In rootful mode this is often unlimited. + + +If nofile and nproc are unset, a default value of 1048576 will be used, unless overridden +in containers.conf(5). However, if the default value exceeds the hard limit for the current +rootless user, the current hard limit will be applied instead. + +Use **host** to copy the current configuration from the host. + +Don't use nproc with the ulimit flag as Linux uses nproc to set the +maximum number of processes available to a user, not to a container. + +Use the --pids-limit option to modify the cgroup control to limit the number +of processes within a container. + +[//]: # (END included file options/ulimit.md) + + +[//]: # (BEGIN included file options/umask.md) +#### **--umask**=*umask* + +Set the umask inside the container. Defaults to `0022`. +Remote connections use the local `containers.conf` for defaults. + +[//]: # (END included file options/umask.md) + + +[//]: # (BEGIN included file options/unsetenv.md) +#### **--unsetenv**=*env* + +Unset default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. + +[//]: # (END included file options/unsetenv.md) + + +[//]: # (BEGIN included file options/unsetenv-all.md) +#### **--unsetenv-all** + +Unset all default environment variables for the container. Default environment +variables include variables provided natively by Podman, environment variables +configured by the image, and environment variables from containers.conf. + +[//]: # (END included file options/unsetenv-all.md) + + +[//]: # (BEGIN included file options/user.md) +#### **--user**, **-u**=*user[\:group]* + +Sets the username or UID used and, optionally, the groupname or GID for the specified command. Both *user* and *group* may be symbolic or numeric. + +Without this argument, the command runs as the user specified in the container image. Unless overridden by a `USER` command in the Containerfile or by a value passed to this option, this user generally defaults to root. + +When a user namespace is not in use, the UID and GID used within the container and on the host match. When user namespaces are in use, however, the UID and GID in the container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container by default corresponds to the UID and GID of the user invoking Podman. + +[//]: # (END included file options/user.md) + + +[//]: # (BEGIN included file options/userns.container.md) +#### **--userns**=*mode* + +Set the user namespace mode for the container. + +If `--userns` is not set, the default value is determined as follows. +- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used. +- If the environment variable **PODMAN_USERNS** is set its value is used. +- If `userns` is specified in `containers.conf` this value is used. +- Otherwise, `--userns=host` is assumed. + +`--userns=""` (i.e., an empty string) is an alias for `--userns=host`. + +This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. + +Rootless user --userns=Key mappings: + +Key | Host User | Container User +------------------------|-----------|--------------------- +auto | $UID | nil (Host User UID is not mapped into container.) +host | $UID | 0 (Default User account mapped to root user in container.) +keep-id | $UID | $UID (Map user account to same UID within container.) +keep-id\:uid=200,gid=210 | $UID | 200:210 (Map user account to specified UID, GID value within container.) +nomap | $UID | nil (Host User UID is not mapped into container.) + +Valid _mode_ values are: + +**auto**[\:_OPTIONS,..._]: automatically create a unique user namespace. + +* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. + + Example: `containers:2147483647:2147483648`. + +* `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5). + +Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user IDs. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. + +The option `--userns=keep-id` uses all the subuids and subgids of the user. +The option `--userns=nomap` uses all the subuids and subgids of the user except the user's own ID. +Using `--userns=auto` when starting new containers does not work as long as any containers exist that were started with `--userns=nomap` or `--userns=keep-id` without limiting the user namespace size. + + Valid `auto` options: + + - *gidmapping*=_CONTAINER\_GID\:HOST\_GID\:SIZE_: to force a GID mapping to be present in the user namespace. + - *size*=_SIZE_: to specify an explicit size for the automatic user namespace. e.g. `--userns=auto\:size=8192`. If `size` is not specified, `auto` estimates a size for the user namespace. + - *uidmapping*=_CONTAINER\_UID\:HOST\_UID\:SIZE_: to force a UID mapping to be present in the user namespace. + +The host UID and GID in *gidmapping* and *uidmapping* can optionally be prefixed with the `@` symbol. +In this case, podman will look up the intermediate ID corresponding to host ID and it will map the found intermediate ID to the container id. +For details see **--uidmap**. + +**container:**_id_: join the user namespace of the specified container. + +**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user. + +**keep-id**: creates a user namespace where the current user's UID\:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace. + + Valid `keep-id` options: + + - *uid*=UID: override the UID inside the container that is used to map the current user to. + - *gid*=GID: override the GID inside the container that is used to map the current user to. + - *size*=SIZE: override the size of the configured user namespace. It is useful to not saturate all the available IDs. Not supported when running as root. + +**nomap**: creates a user namespace where the current rootless user's UID\:GID are not mapped into the container. This option is not allowed for containers created by the root user. + +**ns:**_namespace_: run the container in the given existing user namespace. + +[//]: # (END included file options/userns.container.md) + + +[//]: # (BEGIN included file options/uts.container.md) +#### **--uts**=*mode* + +Set the UTS namespace mode for the container. The following values are supported: + +- **host**: use the host's UTS namespace inside the container. +- **private**: create a new namespace for the container (default). +- **ns:[path]**: run the container in the given existing UTS namespace. +- **container:[container]**: join the UTS namespace of the specified container. + +[//]: # (END included file options/uts.container.md) + + +[//]: # (BEGIN included file options/variant.container.md) +#### **--variant**=*VARIANT* + +Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. + +[//]: # (END included file options/variant.container.md) + + +[//]: # (BEGIN included file options/volume.md) +#### **--volume**, **-v**=*[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]* + +Create a bind mount. If `-v /HOST-DIR:/CONTAINER-DIR` is specified, Podman +bind mounts `/HOST-DIR` from the host into `/CONTAINER-DIR` in the Podman +container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` mounts the named +volume from the host into the container. If no such named volume exists, +Podman creates one. If no source is given, the volume is created +as an anonymously named volume with a randomly generated name, and is +removed when the container is removed via the `--rm` flag or +the `podman rm --volumes` command. + +(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.) + +The _OPTIONS_ is a comma-separated list and can be one or more of: + +* **rw**|**ro** +* **z**|**Z** +* [**O**] +* [**U**] +* [**no**]**copy** +* [**no**]**dev** +* [**no**]**exec** +* [**no**]**suid** +* [**r**]**bind** +* [**r**]**shared**|[**r**]**slave**|[**r**]**private**[**r**]**unbindable** [[1]](#Footnote1) +* **idmap**[=**options**] + +The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The volume +is mounted into the container at this directory. + +If a volume source is specified, it must be a path on the host or the name of a +named volume. Host paths are allowed to be absolute or relative; relative paths +are resolved relative to the directory Podman is run in. If the source does not +exist, Podman returns an error. Users must pre-create the source files or +directories. + +Any source that does not begin with a `.` or `/` is treated as the name of +a named volume. If a volume with that name does not exist, it is created. +Volumes created with names are not anonymous, and they are not removed by the `--rm` +option and the `podman rm --volumes` command. + +Specify multiple **-v** options to mount one or more volumes into a +container. + +`Write Protected Volume Mounts` + +Add **\:ro** or **\:rw** option to mount a volume in read-only or +read-write mode, respectively. By default, the volumes are mounted read-write. +See examples. + +`Chowning Volume Mounts` + +By default, Podman does not change the owner and group of source volume +directories mounted into containers. If a container is created in a new +user namespace, the UID and GID in the container may correspond to another UID +and GID on the host. + +The `\:U` suffix tells Podman to use the correct host UID and GID based on the +UID and GID within the container, to change recursively the owner and +group of the source volume. Chowning walks the file system under the volume and +changes the UID/GID on each file. If the volume has thousands of inodes, this +process takes a long time, delaying the start of the container. + +**Warning** use with caution since this modifies the host filesystem. + +`Labeling Volume Mounts` + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system +might prevent the processes running inside the container from using the +content. By default, Podman does not change the labels set by the OS. + +To change a label in the container context, add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two or more +containers share the volume content. As a result, Podman labels the +content with a shared content label. Shared volume labels allow all containers +to read/write content. The **Z** option tells Podman to label the content with +a private unshared label. Only the current container can use a private +volume. + +Note: all containers within a `pod` share the same SELinux label. This +means all containers within said pod can read/write volumes shared into the +container created with the `\:Z` on any one of the containers. Relabeling walks +the file system under the volume and changes the label on each file; if the +volume has thousands of inodes, this process takes a long time, delaying the +start of the container. If the volume was previously relabeled with the +`z` option, Podman is optimized to not relabel a second time. If files are +moved into the volume, then the labels can be manually changed with the +`chcon -Rt container_file_t PATH` command. + +Note: Do not relabel system files and directories. Relabeling system content +might cause other confined services on the machine to fail. For these types +of containers we recommend disabling SELinux separation. The option +**--security-opt label=disable** disables SELinux separation for the container. +For example if a user wanted to volume mount their entire home directory into a +container, they need to disable SELinux separation. + + $ podman run --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file + +`Overlay Volume Mounts` + +The `\:O` flag tells Podman to mount the directory from the host as a +temporary storage using the `overlay file system`. The container processes +can modify content within the mountpoint which is stored in the +container storage in a separate directory. In overlay terms, the source +directory is the lower, and the container storage directory is the +upper. Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +For advanced users, the **overlay** option also supports custom non-volatile +**upperdir** and **workdir** for the overlay mount. Custom **upperdir** and +**workdir** can be fully managed by the users themselves, and Podman does not +remove it on lifecycle completion. +Example **\:O,upperdir=/some/upper,workdir=/some/work** + +Subsequent executions of the container sees the original source directory +content, any changes from previous container executions no longer exist. + +One use case of the overlay mount is sharing the package cache from the +host into the container to allow speeding up builds. + +Note: The `O` flag conflicts with other options listed above. + +Content mounted into the container is labeled with the private label. +On SELinux systems, labels in the source directory must be readable +by the container label. Usually containers can read/execute `container_share_t` +and can read/write `container_file_t`. If unable to change the labels on a +source volume, SELinux container separation must be disabled for the container +to work. + +Do not modify the source directory mounted into the container with an overlay mount, +it can cause unexpected failures. Only modify the directory after the container finishes running. + +`Mounts propagation` + +By default, bind-mounted volumes are `private`. That means any mounts done +inside the container are not visible on the host and vice versa. +One can change this behavior by specifying a volume mount propagation property. +When a volume is `shared`, mounts done under that volume inside the container +are visible on host and vice versa. Making a volume **slave**[[1]](#Footnote1) +enables only one-way mount propagation: mounts done on the host under that volume +are visible inside the container but not the other way around. + +To control mount propagation property of a volume one can use the [**r**]**shared**, +[**r**]**slave**, [**r**]**private** or the [**r**]**unbindable** propagation flag. +Propagation property can be specified only for bind mounted volumes and not for +internal volumes or named volumes. For mount propagation to work the source mount +point (the mount point where source dir is mounted on) has to have the right propagation +properties. For shared volumes, the source mount point has to be shared. And for +slave volumes, the source mount point has to be either shared or slave. +[[1]](#Footnote1) + +To recursively mount a volume and all of its submounts into a +container, use the **rbind** option. By default the bind option is +used, and submounts of the source directory is not mounted into the +container. + +Mounting the volume with a **copy** option tells podman to copy content from +the underlying destination directory onto newly created internal volumes. The +**copy** only happens on the initial creation of the volume. Content is not +copied up when the volume is subsequently used on different containers. The +**copy** option is ignored on bind mounts and has no effect. + +Mounting volumes with the **nosuid** options means that SUID executables on the +volume can not be used by applications to change their privilege. By default +volumes are mounted with **nosuid**. + +Mounting the volume with the **noexec** option means that no executables on the +volume can be executed within the container. + +Mounting the volume with the **nodev** option means that no devices on the volume +can be used by processes within the container. By default volumes +are mounted with **nodev**. + +If the _HOST-DIR_ is a mount point, then **dev**, **suid**, and **exec** options are +ignored by the kernel. + +Use **df HOST-DIR** to figure out the source mount, then use +**findmnt -o TARGET,PROPAGATION _source-mount-dir_** to figure out propagation +properties of source mount. If **findmnt**(1) utility is not available, then one +can look at the mount entry for the source mount point in _/proc/self/mountinfo_. Look +at the "optional fields" and see if any propagation properties are specified. +In there, **shared:N** means the mount is shared, **master:N** means mount +is slave, and if nothing is there, the mount is private. [[1]](#Footnote1) + +To change propagation properties of a mount point, use **mount**(8) command. For +example, if one wants to bind mount source directory _/foo_, one can do +**mount --bind /foo /foo** and **mount --make-private --make-shared /foo**. This +converts /foo into a shared mount point. Alternatively, one can directly +change propagation properties of source mount. Say _/_ is source mount for +_/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. + +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless container fails. + +`Idmapped mount` + +If `idmap` is specified, create an idmapped mount to the target user +namespace in the container. The idmap option supports a custom mapping +that can be different than the user namespace used by the +container. The mapping can be specified after the idmap option like: +`idmap=uids=0-1-10#10-11-10;gids=0-100-10`. +For each triplet, the first value is the start of the backing file +system IDs that are mapped to the second value on the host. The +length of this mapping is given in the third value. +Multiple ranges are separated with #. + +[//]: # (END included file options/volume.md) + +Use the **--group-add keep-groups** option to pass the user's supplementary group access into the container. + + +[//]: # (BEGIN included file options/volumes-from.md) +#### **--volumes-from**=*CONTAINER[\:OPTIONS]* + +Mount volumes from the specified container(s). Used to share volumes between +containers. The *options* is a comma-separated list with the following available elements: + +* **rw**|**ro** +* **z** + +Mounts already mounted volumes from a source container onto another +container. _CONTAINER_ may be a name or ID. +To share a volume, use the --volumes-from option when running +the target container. Volumes can be shared even if the source container +is not running. + +By default, Podman mounts the volumes in the same mode (read-write or +read-only) as it is mounted in the source container. +This can be changed by adding a `ro` or `rw` _option_. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, add `z` to the volume mount. +This suffix tells Podman to relabel file objects on the shared volumes. The `z` +option tells Podman that two entities share the volume content. As a result, +Podman labels the content with a shared content label. Shared volume labels allow +all containers to read/write content. + +If the location of the volume from the source container overlaps with +data residing on a target container, then the volume hides +that data on the target. + +[//]: # (END included file options/volumes-from.md) + + +[//]: # (BEGIN included file options/workdir.md) +#### **--workdir**, **-w**=*dir* + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (**/**). +The image developer can set a different default with the WORKDIR instruction. The operator +can override the working directory by using the **-w** option. + +[//]: # (END included file options/workdir.md) + +## Exit Status + +The exit code from **podman run** gives information about why the container +failed to run or why it exited. When **podman run** exits with a non-zero code, +the exit codes follow the **chroot**(1) standard, see below: + + **125** The error is with Podman itself + + $ podman run --foo busybox; echo $? + Error: unknown flag: --foo + 125 + + **126** The _contained command_ cannot be invoked + + $ podman run busybox /etc; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error + 126 + + **127** The _contained command_ cannot be found + + $ podman run busybox foo; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error + 127 + + **Exit code** _contained command_ exit code + + $ podman run busybox /bin/sh -c 'exit 3'; echo $? + 3 + +## EXAMPLES + +### Running container in read-only mode + +During container image development, containers often need to write to the image +content. Installing packages into _/usr_, for example. In production, +applications seldom need to write to the image. Container applications write +to volumes if they need to write to file systems at all. Applications can be +made more secure by running them in read-only mode using the **--read-only** switch. +This protects the container's image from modification. By default read-only +containers can write to temporary data. Podman mounts a tmpfs on _/run_ and +_/tmp_ within the container. + +``` +$ podman run --read-only -i -t fedora /bin/bash +``` + +If the container does not write to any file +system within the container, including tmpfs, set --read-only-tmpfs=false. +``` +$ podman run --read-only --read-only-tmpfs=false --tmpfs /run -i -t fedora /bin/bash +``` + +### Exposing shared libraries inside of container as read-only using a glob + +``` +$ podman run --mount type=glob,src=/usr/lib64/libnvidia\*,ro=true -i -t fedora /bin/bash +``` + +### Exposing log messages from the container to the host's log + +Bind mount the _/dev/log_ directory to have messages that are logged in the container show up in the host's +syslog/journal. + +``` +$ podman run -v /dev/log:/dev/log -i -t fedora /bin/bash +``` + +From inside the container test this by sending a message to the log. + +``` +(bash)# logger "Hello from my container" +``` + +Then exit and check the journal. + +``` +(bash)# exit + +$ journalctl -b | grep Hello +``` + +This lists the message sent to the logger. + +### Attaching to one or more from STDIN, STDOUT, STDERR + +Without specifying the **-a** option, Podman attaches everything (stdin, stdout, stderr). +Override the default by specifying -a (stdin, stdout, stderr), as in: + +``` +$ podman run -a stdin -a stdout -i -t fedora /bin/bash +``` + +### Sharing IPC between containers + +Using **shm_server.c** available here: https://www.cs.cf.ac.uk/Dave/C/node27.html + +Testing **--ipc=host** mode: + +Host shows a shared memory segment with 7 pids attached, happens to be from httpd: + +``` +$ sudo ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +0x01128e25 0 root 600 1000 7 +``` + +Now run a regular container, and it correctly does NOT see the shared memory segment from the host: + +``` +$ podman run -it shm ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +``` + +Run a container with the new **--ipc=host** option, and it now sees the shared memory segment from the host httpd: + +``` +$ podman run -it --ipc=host shm ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +0x01128e25 0 root 600 1000 7 +``` +Testing **--ipc=container:**_id_ mode: + +Start a container with a program to create a shared memory segment: +``` +$ podman run -it shm bash +$ sudo shm/shm_server & +$ sudo ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +0x0000162e 0 root 666 27 1 +``` +Create a 2nd container correctly shows no shared memory segment from 1st container: +``` +$ podman run shm ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +``` + +Create a 3rd container using the **--ipc=container:**_id_ option, now it shows the shared memory segment from the first: + +``` +$ podman run -it --ipc=container\:ed735b2264ac shm ipcs -m +$ sudo ipcs -m + +------ Shared Memory Segments -------- +key shmid owner perms bytes nattch status +0x0000162e 0 root 666 27 1 +``` + +### Mapping Ports for External Usage + +The exposed port of an application can be mapped to a host port using the **-p** +flag. For example, an httpd port 80 can be mapped to the host port 8080 using the +following: + +``` +$ podman run -p 8080:80 -d -i -t fedora/httpd +``` + +### Mounting External Volumes + +To mount a host directory as a container volume, specify the absolute path to +the directory and the absolute path for the container directory separated by a +colon. If the source is a named volume maintained by Podman, it is recommended to +use its name rather than the path to the volume. Otherwise the volume is +considered an orphan and wiped by the **podman volume prune** command: + +``` +$ podman run -v /var/db:/data1 -i -t fedora bash + +$ podman run -v data:/data2 -i -t fedora bash + +$ podman run -v /var/cache/dnf:/var/cache/dnf\:O -ti fedora dnf -y update +``` + +If the container needs a writable mounted volume by a non root user inside the container, use the **U** option. This option tells Podman to chown the source volume to match the default UID and GID used within the container. +``` +$ podman run -d -e MARIADB_ROOT_PASSWORD=root --user mysql --userns=keep-id -v ~/data:/var/lib/mysql:Z,U mariadb +``` + +Alternatively if the container needs a writable volume by a non root +user inside of the container, the --userns=keep-id option allows users to +specify the UID and GID of the user executing Podman to specific UIDs and GIDs +within the container. Since the processes running in the container run as the user's UID, they can read/write files owned by the user. +``` +$ podman run -d -e MARIADB_ROOT_PASSWORD=root --user mysql --userns=keep-id\:uid=999,gid=999 -v ~/data:/var/lib/mysql\:Z mariadb +``` + +Using **--mount** flags to mount a host directory as a container folder, specify +the absolute path to the directory or the volume name, and the absolute path +within the container directory: + +```` +$ podman run --mount type=bind,src=/var/db,target=/data1 busybox sh + +$ podman run --mount type=bind,src=volume-name,target=/data1 busybox sh +```` + +When using SELinux, be aware that the host has no knowledge of container SELinux +policy. Therefore, in the above example, if SELinux policy is enforced, the +_/var/db_ directory is not writable to the container. A "Permission Denied" +message occurs, and an **avc:** message is added to the host's syslog. + +To work around this, at time of writing this man page, the following command +needs to be run in order for the proper SELinux policy type label to be attached +to the host directory: + +``` +$ chcon -Rt svirt_sandbox_file_t /var/db +``` + +Now, writing to the _/data1_ volume in the container is allowed and the +changes are reflected on the host in _/var/db_. + +### Using alternative security labeling + +Override the default labeling scheme for each container by specifying +the **--security-opt** flag. For example, specify the MCS/MLS level, a +requirement for MLS systems. Specifying the level in the following command +allows the same content to be shared between containers. + +``` +podman run --security-opt label=level\:s0:c100,c200 -i -t fedora bash +``` + +An MLS example might be: + +``` +$ podman run --security-opt label=level\:TopSecret -i -t rhel7 bash +``` + +To disable the security labeling for this container versus running with the +#### **--permissive** flag, use the following command: + +``` +$ podman run --security-opt label=disable -i -t fedora bash +``` + +Tighten the security policy on the processes within a container by specifying an +alternate type for the container. For example, run a container +that is only allowed to listen on Apache ports by executing the following +command: + +``` +$ podman run --security-opt label=type\:svirt_apache_t -i -t centos bash +``` + +Note that an SELinux policy defining a **svirt_apache_t** type must be written. + +To mask additional specific paths in the container, specify the paths +separated by a colon using the **mask** option with the **--security-opt** +flag. + +``` +$ podman run --security-opt mask=/foo/bar:/second/path fedora bash +``` + +To unmask all the paths that are masked by default, set the **unmask** option to +**ALL**. Or to only unmask specific paths, specify the paths as shown above with +the **mask** option. + +``` +$ podman run --security-opt unmask=ALL fedora bash +``` + +To unmask all the paths that start with /proc, set the **unmask** option to +**/proc/***. + +``` +$ podman run --security-opt unmask=/proc/* fedora bash +``` + +``` +$ podman run --security-opt unmask=/foo/bar:/sys/firmware fedora bash +``` + +### Setting device weight via **--blkio-weight-device** flag. + +``` +$ podman run -it --blkio-weight-device "/dev/sda:200" ubuntu +``` + +### Using a podman container with input from a pipe + +``` +$ echo "asdf" | podman run --rm -i --entrypoint /bin/cat someimage +asdf +``` + +### Setting automatic user namespace separated containers + +``` +# podman run --userns=auto\:size=65536 ubi8-micro cat /proc/self/uid_map +0 2147483647 65536 +# podman run --userns=auto\:size=65536 ubi8-micro cat /proc/self/uid_map +0 2147549183 65536 +``` + +### Setting Namespaced Kernel Parameters (Sysctls) + +The **--sysctl** sets namespaced kernel parameters (sysctls) in the +container. For example, to turn on IP forwarding in the containers +network namespace, run this command: + +``` +$ podman run --sysctl net.ipv4.ip_forward=1 someimage +``` + +Note that not all sysctls are namespaced. Podman does not support changing sysctls +inside of a container that also modify the host system. As the kernel +evolves we expect to see more sysctls become namespaced. + +See the definition of the **--sysctl** option above for the current list of +supported sysctls. + +### Set UID/GID mapping in a new user namespace + +Running a container in a new user namespace requires a mapping of +the UIDs and GIDs from the host. + +``` +$ podman run --uidmap 0:30000:7000 --gidmap 0:30000:7000 fedora echo hello +``` + +### Configuring Storage Options from the command line + +Podman allows for the configuration of storage by changing the values +in the _/etc/container/storage.conf_ or by using global options. This +shows how to set up and use fuse-overlayfs for a one-time run of busybox +using global options. + +``` +podman --log-level=debug --storage-driver overlay --storage-opt "overlay.mount_program=/usr/bin/fuse-overlayfs" run busybox /bin/sh +``` + +### Configure timezone in a container + +``` +$ podman run --tz=local alpine date +$ podman run --tz=Asia/Shanghai alpine date +$ podman run --tz=US/Eastern alpine date +``` + +### Adding dependency containers + +The first container, container1, is not started initially, but must be running before container2 starts. +The `podman run` command starts the container automatically before starting container2. + +``` +$ podman create --name container1 -t -i fedora bash +$ podman run --name container2 --requires container1 -t -i fedora bash +``` + +Multiple containers can be required. + +``` +$ podman create --name container1 -t -i fedora bash +$ podman create --name container2 -t -i fedora bash +$ podman run --name container3 --requires container1,container2 -t -i fedora bash +``` + +### Configure keep supplemental groups for access to volume + +``` +$ podman run -v /var/lib/design:/var/lib/design --group-add keep-groups ubi8 +``` + +### Configure execution domain for containers using personality flag + +``` +$ podman run --name container1 --personality=LINUX32 fedora bash +``` + +### Run a container with external rootfs mounted as an overlay + +``` +$ podman run --name container1 --rootfs /path/to/rootfs:O bash +``` + +### Handling Timezones in java applications in a container. + +In order to use a timezone other than UTC when running a +Java application within a container, the `TZ` environment variable must be +set within the container. Java applications ignores the value set with the +`--tz` option. + +``` +# Example run +podman run -ti --rm -e TZ=EST mytzimage +lrwxrwxrwx. 1 root root 29 Nov 3 08:51 /etc/localtime -> ../usr/share/zoneinfo/Etc/UTC +Now with default timezone: +Fri Nov 19 18:10:55 EST 2021 +Java default sees the following timezone: +2021-11-19T18:10:55.651130-05:00 +Forcing UTC: +Fri Nov 19 23:10:55 UTC 2021 +``` + +### Run a container connected to two networks (called net1 and net2) with a static ip + +``` +$ podman run --network net1\:ip=10.89.1.5 --network net2\:ip=10.89.10.10 alpine ip addr +``` + +### Rootless Containers + +Podman runs as a non-root user on most systems. This feature requires that a new enough version of **shadow-utils** +be installed. The **shadow-utils** package must include the **newuidmap**(1) and **newgidmap**(1) executables. + +In order for users to run rootless, there must be an entry for their username in _/etc/subuid_ and _/etc/subgid_ which lists the UIDs for their user namespace. + +Rootless Podman works better if the fuse-overlayfs and slirp4netns packages are installed. +The **fuse-overlayfs** package provides a userspace overlay storage driver, otherwise users need to use +the **vfs** storage driver, which can be disk space expensive and less +performant than other drivers. + +To enable VPN on the container, slirp4netns or pasta needs to be specified; +without either, containers need to be run with the --network=host flag. + +## ENVIRONMENT + +Environment variables within containers can be set using multiple different options, +in the following order of precedence (later entries override earlier entries): + +- Container image: Any environment variables specified in the container image. +- **--http-proxy**: By default, several environment variables are passed in from the host, such as **http_proxy** and **no_proxy**. See **--http-proxy** for details. +- **--env-host**: Host environment of the process executing Podman is added. +- **--env-file**: Any environment variables specified via env-files. If multiple files are specified, then they override each other in order of entry. +- **--env**: Any environment variables specified overrides previous settings. + +Run containers and set the environment ending with a __*__. +The trailing __*__ glob functionality is only active when no value is specified: + +``` +$ export ENV1=a +$ podman run --env 'ENV*' alpine env | grep ENV +ENV1=a +$ podman run --env 'ENV*=b' alpine env | grep ENV +ENV*=b +``` + +## CONMON + +When Podman starts a container it actually executes the conmon program, which +then executes the OCI Runtime. Conmon is the container monitor. It is a small +program whose job is to watch the primary process of the container, and if the +container dies, save the exit code. It also holds open the tty of the +container, so that it can be attached to later. This is what allows Podman to +run in detached mode (backgrounded), so Podman can exit but conmon continues to +run. Each container has their own instance of conmon. Conmon waits for the +container to exit, gathers and saves the exit code, and then launches a Podman +process to complete the container cleanup, by shutting down the network and +storage. For more information about conmon, see the conmon(8) man +page. + +## FILES + +**/etc/subuid** + +**/etc/subgid** + +NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-save(1)](podman-save.1.md)**, **[podman-ps(1)](podman-ps.1.md)**, **[podman-attach(1)](podman-attach.1.md)**, **[podman-pod-create(1)](podman-pod-create.1.md)**, **[podman-port(1)](podman-port.1.md)**, **[podman-start(1)](podman-start.1.md)**, **[podman-kill(1)](podman-kill.1.md)**, **[podman-stop(1)](podman-stop.1.md)**, **[podman-generate-systemd(1)](podman-generate-systemd.1.md)**, **[podman-rm(1)](podman-rm.1.md)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)**, **[setsebool(8)](https://man7.org/linux/man-pages/man8/setsebool.8.html)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, **[pasta(1)](https://passt.top/builds/latest/web/passt.1.html)**, **[fuse-overlayfs(1)](https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md)**, **proc(5)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)**, **personality(2)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +See [podman-rootless(7)](https://github.com/containers/podman/blob/main/rootless.md) +for rootless issues. + +## HISTORY +September 2018, updated by Kunal Kushwaha `` + +October 2017, converted from Docker documentation to Podman by Dan Walsh for Podman `` + +November 2015, updated by Sally O'Malley `` + +June 2014, updated by Sven Dowideit `` + +April 2014, Originally compiled by William Henry `` based on docker.com source material and internal work. + +## FOOTNOTES +1: The Podman project is committed to inclusivity, a core value of open source. The `master` and `slave` mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately. diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-save.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-save.1.md new file mode 100644 index 000000000..e47d115eb --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-save.1.md @@ -0,0 +1,107 @@ +--- +title: podman-save +version: v5.5.2 +--- + +% podman-save 1 + +## NAME +podman\-save - Save image(s) to an archive + +## SYNOPSIS +**podman save** [*options*] *name*[:*tag*] + +**podman image save** [*options*] *name*[:*tag*] + +## DESCRIPTION +**podman save** saves an image to a local file or directory. +**podman save** writes to STDOUT by default and can be redirected to a +file using the **output** flag. The **quiet** flag suppresses the output when set. +**podman save** saves parent layers of the image(s) and the image(s) can be loaded using **podman load**. +To export the containers, use the **podman export**. +Note: `:` is a restricted character and cannot be part of the file name. + +**podman [GLOBAL OPTIONS]** + +**podman save [GLOBAL OPTIONS]** + +**podman save [OPTIONS] NAME[\:TAG]** + +## OPTIONS + + +[//]: # (BEGIN included file options/dir-compress.md) +#### **--compress** + +Compress tarball image layers when pushing to a directory using the 'dir' transport. (default is same compression type, compressed or uncompressed, as source) + +[//]: # (END included file options/dir-compress.md) + +Note: This flag can only be set with **--format=docker-dir**. + +#### **--format**=*format* + +An image format to produce, one of: + +| Format | Description | +| ------------------ | ---------------------------------------------------------------------------- | +| **docker-archive** | A tar archive interoperable with **docker load(1)** (the default) | +| **oci-archive** | A tar archive using the OCI Image Format | +| **oci-dir** | A directory using the OCI Image Format | +| **docker-dir** | **dir** transport (see **containers-transports(5)**) with v2s2 manifest type | + +#### **--help**, **-h** + +Print usage statement + +#### **--multi-image-archive**, **-m** + +Allow for creating archives with more than one image. Additional names are interpreted as images instead of tags. Only supported for **--format=docker-archive**. +The default for this option can be modified via the `multi_image_archive="true"|"false"` flag in containers.conf. + +#### **--output**, **-o**=*file* + +Write to a file, default is STDOUT + +#### **--quiet**, **-q** + +Suppress the output + +#### **--uncompressed** + +Accept uncompressed layers when using one of the OCI formats. + +## EXAMPLES + +Save image to a local file without displaying progress. +``` +$ podman save --quiet -o alpine.tar alpine:2.6 +``` + +Save image to stdout and redirect content via shell. +``` +$ podman save alpine > alpine-all.tar +``` + +Save image in oci-archive format to the local file. +``` +$ podman save -o oci-alpine.tar --format oci-archive alpine +``` + +Save image compressed in docker-dir format. +``` +$ podman save --compress --format docker-dir -o alp-dir alpine +Getting image source signatures +Copying blob sha256:2fdfe1cd78c20d05774f0919be19bc1a3e4729bce219968e4188e7e0f1af679d + 1.97 MB / 1.97 MB [========================================================] 0s +Copying config sha256:501d1a8f0487e93128df34ea349795bc324d5e0c0d5112e08386a9dfaff620be + 584 B / 584 B [============================================================] 0s +Writing manifest to image destination +Storing signatures +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-load(1)](podman-load.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)** + +## HISTORY +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-search.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-search.1.md new file mode 100644 index 000000000..8c7d536ad --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-search.1.md @@ -0,0 +1,191 @@ +--- +title: podman-search +version: v5.5.2 +--- + +% podman-search 1 + +## NAME +podman\-search - Search a registry for an image + +## SYNOPSIS +**podman search** [*options*] *term* + +## DESCRIPTION +**podman search** searches a registry or a list of registries for a matching image. +The user can specify which registry to search by prefixing the registry in the search term +(e.g., **registry.fedoraproject.org/fedora**). By default, all +unqualified-search registries in `containers-registries.conf(5)` are used. + +The default number of results is 25. The number of results can be limited using the **--limit** flag. +If more than one registry is being searched, the limit is applied to each registry. The output can be filtered +using the **--filter** flag. To get all available images in a registry without a specific +search term, the user can just enter the registry name with a trailing "/" (example **registry.fedoraproject.org/**). + +Note that **podman search** is not a reliable way to determine the presence or existence of an image. +The search behavior of the v1 and v2 Docker distribution API is specific to the implementation of each registry. +Some registries may not support searching at all. +Further note that searching without a search term only works for registries that implement the v2 API. + +**podman [GLOBAL OPTIONS]** + +**podman search [GLOBAL OPTIONS]** + +**podman search [OPTIONS] TERM** + +## OPTIONS + + +[//]: # (BEGIN included file options/authfile.md) +#### **--authfile**=*path* + +Path of the authentication file. Default is `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux, and `$HOME/.config/containers/auth.json` on Windows/macOS. +The file is created by **[podman login](podman-login.1.md)**. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using **docker login**. + +Note: There is also the option to override the default path of the authentication file by setting the `REGISTRY_AUTH_FILE` environment variable. This can be done with **export REGISTRY_AUTH_FILE=_path_**. + +[//]: # (END included file options/authfile.md) + + +[//]: # (BEGIN included file options/cert-dir.md) +#### **--cert-dir**=*path* + +Use certificates at *path* (\*.crt, \*.cert, \*.key) to connect to the registry. (Default: /etc/containers/certs.d) +For details, see **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**. +(This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) + +[//]: # (END included file options/cert-dir.md) + +#### **--compatible** + +After the name and the description, also show the stars, official and automated descriptors as Docker does. +Podman does not show these descriptors by default since they are not supported by most public container registries. + + +[//]: # (BEGIN included file options/creds.md) +#### **--creds**=*[username[\:password]]* + +The [username[:password]] to use to authenticate with the registry, if required. +If one or both values are not supplied, a command line prompt appears and the +value can be entered. The password is entered without echo. + +Note that the specified credentials are only used to authenticate against +target registries. They are not used for mirrors or when the registry gets +rewritten (see `containers-registries.conf(5)`); to authenticate against those +consider using a `containers-auth.json(5)` file. + +[//]: # (END included file options/creds.md) + +#### **--filter**, **-f**=*filter* + +Filter output based on conditions provided (default []) + +Supported filters are: + +* stars (int) - minimum number of stars required for images to show +* is-automated (boolean - true | false) - is the image automated or not +* is-official (boolean - true | false) - is the image official or not + +#### **--format**=*format* + +Change the output format to a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| --------------- | ---------------------------- | +| .Automated | "[OK]" if image is automated | +| .Description | Image description | +| .Index | Registry | +| .Name | Image name | +| .Official | "[OK]" if image is official | +| .Stars | Star count of image | +| .Tag | Repository tag | + +Note: use .Tag only if the --list-tags is set. + +#### **--help**, **-h** + +Print usage statement + +#### **--limit**=*limit* + +Limit the number of results (default 25). +Note: The results from each registry is limited to this value. +Example if limit is 10 and two registries are being searched, the total +number of results is 20, 10 from each (if there are at least 10 matches in each). +The order of the search results is the order in which the API endpoint returns the results. + +#### **--list-tags** + +List the available tags in the repository for the specified image. +**Note:** --list-tags requires the search term to be a fully specified image name. +The result contains the Image name and its tag, one line for every tag associated with the image. + +#### **--no-trunc** + +Do not truncate the output (default *false*). + + +[//]: # (BEGIN included file options/tls-verify.md) +#### **--tls-verify** + +Require HTTPS and verify certificates when contacting registries (default: **true**). +If explicitly set to **true**, TLS verification is used. +If set to **false**, TLS verification is not used. +If not specified, TLS verification is used unless the target registry +is listed as an insecure registry in **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)** + +[//]: # (END included file options/tls-verify.md) + +## EXAMPLES + +Search for images containing the specified name, returning the first three images from each defined registry. +``` +$ podman search --limit 3 fedora +NAME DESCRIPTION +NAME DESCRIPTION +registry.fedoraproject.org/f29/fedora-toolbox +registry.fedoraproject.org/f30/fedora-toolbox +registry.fedoraproject.org/f31/fedora-toolbox +docker.io/library/fedora Official Docker builds of Fedora +docker.io/kasmweb/fedora-37-desktop Fedora 37 desktop for Kasm Workspaces +docker.io/kasmweb/fedora-38-desktop Fedora 38 desktop for Kasm Workspaces +quay.io/fedora/fedora +quay.io/containerdisks/fedora # Fedora Containerdisk Images diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-secret-create.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-secret-create.1.md new file mode 100644 index 000000000..5e4d02361 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-secret-create.1.md @@ -0,0 +1,112 @@ +--- +title: podman-secret-create +version: v5.5.2 +--- + +% podman-secret-create 1 + +## NAME +podman\-secret\-create - Create a new secret + +## SYNOPSIS +**podman secret create** [*options*] *name* *file|-* + +## DESCRIPTION + +Creates a secret using standard input or from a file for the secret content. + +Create accepts a path to a file, or `-`, which tells podman to read the secret from stdin + +A secret is a blob of sensitive data which a container needs at runtime but +is not stored in the image or in source control, such as usernames and passwords, +TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 512 kB in size). + +Secrets are not committed to an image with `podman commit`, and do not get committed in the archive created by a `podman export` command. + +Secrets can also be used to store passwords for `podman login` to authenticate against container registries. + +## OPTIONS + +#### **--driver**, **-d**=*driver* + +Specify the secret driver (default **file**). + +#### **--driver-opts**=*key1=val1,key2=val2* + +Specify driver specific options. + +#### **--env**=*false* + +Read secret data from environment variable. + +#### **--help** + +Print usage statement. + +#### **--label**, **-l**=*key=val1,key2=val2* + +Add label to secret. These labels can be viewed in podman secrete inspect or ls. + +#### **--replace**=*false* + +If existing secret with the same name already exists, update the secret. +The `--replace` option does not change secrets within existing containers, only newly created containers. + The default is **false**. + +## SECRET DRIVERS + +#### file + +Secret resides in a read-protected file. + +#### pass + +Secret resides in a GPG-encrypted file. + +#### shell + +Secret is managed by custom scripts. An environment variable **SECRET_ID** +is passed to the scripts (except for **list**), and secrets are communicated +via stdin/stdout (where applicable). Driver options **list**, **lookup**, +**store**, and **delete** serve to install the scripts: + +``` +[secrets] +driver = "shell" + +[secrets.opts] +list = +lookup = +store = +delete = +``` + +## EXAMPLES + +Create the specified secret based on local file. +``` +echo -n mysecret > ./secret.txt +$ podman secret create my_secret ./secret.txt +``` + +Create the specified secret via stdin. +``` +$ printf | podman secret create my_secret - +``` + +Create gpg encrypted secret based on local file using the pass driver. +``` +$ podman secret create --driver=pass my_secret ./secret.txt.gpg +``` + +Create a secret from an environment variable called 'MYSECRET'. +``` +$ podman secret create --env=true my_secret MYSECRET +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)**, **[podman-login(1)](podman-login.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui +February 2024, Added example showing secret creation from an environment variable by Brett Calliss diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-secret-exists.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-secret-exists.1.md new file mode 100644 index 000000000..431e13ad0 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-secret-exists.1.md @@ -0,0 +1,48 @@ +--- +title: podman-secret-exists +version: v5.5.2 +--- + +% podman-secret-exists 1 + +## NAME +podman\-secret\-exists - Check if the given secret exists + +## SYNOPSIS +**podman secret exists** *secret* + +## DESCRIPTION +**podman secret exists** checks if a secret exists. Podman returns an exit code +of `0` when the secret is found. A `1` is returned otherwise. An exit code of +`125` indicates there was another issue. + + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLE + +Check if a secret called `mysecret` exists (the secret does actually exist). +``` +$ podman secret exists mysecret +$ echo $? +0 +$ +``` + +Check if a secret called `mypassword` exists (the secret does not actually exist). +``` +$ podman secret exists mypassword +$ echo $? +1 +$ +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)** + +## HISTORY +April 2023, Originally compiled by Ygal Blum `` diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-secret-inspect.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-secret-inspect.1.md new file mode 100644 index 000000000..68c742518 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-secret-inspect.1.md @@ -0,0 +1,73 @@ +--- +title: podman-secret-inspect +version: v5.5.2 +--- + +% podman-secret-inspect 1 + +## NAME +podman\-secret\-inspect - Display detailed information on one or more secrets + +## SYNOPSIS +**podman secret inspect** [*options*] *secret* [...] + +## DESCRIPTION + +Inspects the specified secret. + +By default, this renders all results in a JSON array. If a format is specified, the given template is executed for each result. +Secrets can be queried individually by providing their full name or a unique partial name. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Format secret output using Go template. + +| **Placeholder** | **Description** | +|--------------------------|-------------------------------------------------------------------| +| .CreatedAt ... | When secret was created (relative timestamp, human-readable) | +| .ID | ID of secret | +| .SecretData | Secret Data (Displayed only with --showsecret option) | +| .Spec ... | Details of secret | +| .Spec.Driver ... | Driver info | +| .Spec.Driver.Name | Driver name (string) | +| .Spec.Driver.Options ... | Driver options (map of driver-specific options) | +| .Spec.Labels ... | Labels for this secret | +| .Spec.Name | Name of secret | +| .UpdatedAt ... | When secret was last updated (relative timestamp, human-readable) | + +#### **--help** + +Print usage statement. + +#### **--pretty** + +Print inspect output in human-readable format + +#### **--showsecret** + +Display secret data + +## EXAMPLES + +Inspect the secret mysecret. +``` +$ podman secret inspect mysecret +``` + +Inspect the secret mysecret and display the Name and Labels field. +``` +$ podman secret inspect --format "{{.Spec.Name}} {{.Spec.Labels}}" mysecret +``` + +Inspect the secret mysecret and display the Name and SecretData fields. Note this will display the secret data to the screen. +``` +$ podman secret inspect --showsecret --format "{{.Spec.Name}} {{.SecretData}}" mysecret +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-secret-ls.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-secret-ls.1.md new file mode 100644 index 000000000..8f383e46e --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-secret-ls.1.md @@ -0,0 +1,84 @@ +--- +title: podman-secret-ls +version: v5.5.2 +--- + +% podman-secret-ls 1 + +## NAME +podman\-secret\-ls - List all available secrets + +## SYNOPSIS +**podman secret ls** [*options*] + +## DESCRIPTION + +Lists all the secrets that exist. The output can be formatted to a Go template using the **--format** option. + +## OPTIONS + +#### **--filter**, **-f**=*filter=value* + +Filter output based on conditions given. +Multiple filters can be given with multiple uses of the --filter option. + +Valid filters are listed below: + +| **Filter** | **Description** | +| ---------- | ----------------------------------------------------------------- | +| name | [Name] Secret name (accepts regex) | +| id | [ID] Full or partial secret ID | + +#### **--format**=*format* + +Format secret output using Go template. + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------------ | ----------------------------------------------------------------- | +| .CreatedAt ... | When secret was created (relative timestamp, human-readable) | +| .ID | ID of secret | +| .SecretData | Secret Data (Displayed only with --showsecret option) | +| .Spec ... | Details of secret | +| .Spec.Driver ... | Driver info | +| .Spec.Driver.Name | Driver name (string) | +| .Spec.Driver.Options ... | Driver options (map of driver-specific options) | +| .Spec.Labels ... | Labels for this secret | +| .Spec.Name | Name of secret | +| .UpdatedAt ... | When secret was last updated (relative timestamp, human-readable) | + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Print secret IDs only. + +## EXAMPLES + +List all secrets. +``` +$ podman secret ls +``` + +List the name field of all secrets. +``` +$ podman secret ls --format "{{.Name}}" +``` + +List all secrets whose name includes the specified string. +``` +$ podman secret ls --filter name=confidential +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-secret-rm.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-secret-rm.1.md new file mode 100644 index 000000000..38a68ef6c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-secret-rm.1.md @@ -0,0 +1,48 @@ +--- +title: podman-secret-rm +version: v5.5.2 +--- + +% podman-secret-rm 1 + +## NAME +podman\-secret\-rm - Remove one or more secrets + +## SYNOPSIS +**podman secret rm** [*options*] *secret* [...] + +## DESCRIPTION + +Removes one or more secrets. + +`podman secret rm` is safe to use on secrets that are in use by a container. +The created container has access to the secret data because secrets are +copied and mounted into the container when a container is created. If a secret is deleted and +another secret is created with the same name, the secret inside the container does not change; +the old secret value still remains. + +## OPTIONS + +#### **--all**, **-a** + +Remove all existing secrets. + +#### **--help** + +Print usage statement. + +#### **--ignore**, **-i** +Ignore errors when specified secrets are not present. + +## EXAMPLES + +Remove secrets mysecret1 and mysecret2. +``` +$ podman secret rm mysecret1 mysecret2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-secret(1)](podman-secret.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-secret.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-secret.1.md new file mode 100644 index 000000000..348fc959b --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-secret.1.md @@ -0,0 +1,31 @@ +--- +title: podman-secret +version: v5.5.2 +--- + +% podman-secret 1 + +## NAME +podman\-secret - Manage podman secrets + +## SYNOPSIS +**podman secret** *subcommand* + +## DESCRIPTION +podman secret is a set of subcommands that manage secrets. + +## SUBCOMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------------ | ------------------------------------------------------ | +| create | [podman-secret-create(1)](podman-secret-create.1.md) | Create a new secret | +| exists | [podman-secret-exists(1)](podman-secret-exists.1.md) | Check if the given secret exists | +| inspect | [podman-secret-inspect(1)](podman-secret-inspect.1.md) | Display detailed information on one or more secrets | +| ls | [podman-secret-ls(1)](podman-secret-ls.1.md) | List all available secrets | +| rm | [podman-secret-rm(1)](podman-secret-rm.1.md) | Remove one or more secrets | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +January 2021, Originally compiled by Ashley Cui diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-start.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-start.1.md new file mode 100644 index 000000000..31c6bb08b --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-start.1.md @@ -0,0 +1,128 @@ +--- +title: podman-start +version: v5.5.2 +--- + +% podman-start 1 + +## NAME +podman\-start - Start one or more containers + +## SYNOPSIS +**podman start** [*options*] *container* ... + +**podman container start** [*options*] *container* ... + +## DESCRIPTION +Start one or more containers using container IDs or names as input. The *attach* and *interactive* +options cannot be used to override the *--tty* and *--interactive* options from when the container +was created. Starting an already running container with the *--attach* option, Podman simply +attaches to the container. + +## OPTIONS + +#### **--all** + +Start all the containers, default is only running containers. + +#### **--attach**, **-a** + +Attach container's STDOUT and STDERR. The default is false. This option cannot be used when +starting multiple containers. + + +[//]: # (BEGIN included file options/detach-keys.md) +#### **--detach-keys**=*sequence* + +Specify the key sequence for detaching a container. Format is a single character `[a-Z]` or one or more `ctrl-` characters where `` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`. Specifying "" disables this feature. The default is *ctrl-p,ctrl-q*. + +This option can also be set in **containers.conf**(5) file. + +[//]: # (END included file options/detach-keys.md) + +#### **--filter**, **-f** + +Filter what containers are going to be started from the given arguments. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + + +[//]: # (BEGIN included file options/interactive.md) +#### **--interactive**, **-i** + +When set to **true**, make stdin available to the contained process. If **false**, the stdin of the contained process is empty and immediately closed. + +If attached, stdin is piped to the contained process. If detached, reading stdin will block until later attached. + +**Caveat:** Podman will consume input from stdin as soon as it becomes available, even if the contained process doesn't request it. + +[//]: # (END included file options/interactive.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/sig-proxy.md) +#### **--sig-proxy** + +Proxy received signals to the container process. SIGCHLD, SIGURG, SIGSTOP, and SIGKILL are not proxied. + +[//]: # (END included file options/sig-proxy.md) + +The default is **true** when attaching, **false** otherwise. + +## EXAMPLE + +Start specified container: +``` +podman start mywebserver +``` + +Start multiple containers: +``` +podman start 860a4b231279 5421ab43b45 +``` + +Start specified container in interactive mode with terminal attached: +``` +podman start --interactive --attach 860a4b231279 +``` + +Start last created container in interactive mode (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman start -i -l +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +November 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-stats.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-stats.1.md new file mode 100644 index 000000000..b4b7cf70d --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-stats.1.md @@ -0,0 +1,164 @@ +--- +title: podman-stats +version: v5.5.2 +--- + +% podman-stats 1 + +## NAME +podman\-stats - Display a live stream of one or more container's resource usage statistics + +## SYNOPSIS +**podman stats** [*options*] [*container*] + +**podman container stats** [*options*] [*container*] + +## DESCRIPTION +Display a live stream of one or more containers' resource usage statistics + +Note: Podman stats does not work in rootless environments that use CGroups V1. +Podman stats relies on CGroup information for statistics, and CGroup v1 is not +supported for rootless use cases. + +Note: Rootless environments that use CGroups V2 are not able to report statistics +about their networking usage. + +## OPTIONS + +#### **--all**, **-a** + +Show all containers. Only running containers are shown by default + +#### **--format**=*template* + +Pretty-print container statistics to JSON or using a Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +|---------------------|--------------------------------------------------| +| .AvgCPU | Average CPU, full precision float | +| .AVGCPU | Average CPU, formatted as a percent | +| .BlockInput | Total data read from block device | +| .BlockIO | Total data read/total data written to block device| +| .BlockOutput | Total data written to block device | +| .ContainerID | Container ID, full (untruncated) hash | +| .ContainerStats ... | Nested structure, for experts only | +| .CPU | Percent CPU, full precision float | +| .CPUNano | CPU Usage, total, in nanoseconds | +| .CPUPerc | Percentage of CPU used | +| .CPUSystemNano | CPU Usage, kernel, in nanoseconds | +| .Duration | Same as CPUNano | +| .ID | Container ID, truncated | +| .MemLimit | Memory limit, in bytes | +| .MemPerc | Memory percentage used | +| .MemUsage | Memory usage | +| .MemUsageBytes | Memory usage (IEC) | +| .Name | Container Name | +| .NetIO | Network IO | +| .Network ... | Network I/O, separated by network interface | +| .PerCPU | CPU time consumed by all tasks [1] | +| .PIDs | Number of PIDs | +| .PIDS | Number of PIDs (yes, we know this is a dup) | +| .SystemNano | Current system datetime, nanoseconds since epoch | +| .Up | Duration (CPUNano), in human-readable form | +| .UpTime | Same as Up | + +[1] Cgroups V1 only + +When using a Go template, precede the format with `table` to print headers. + +#### **--interval**, **-i**=*seconds* + +Time in seconds between stats reports, defaults to 5 seconds. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/no-reset.md) +#### **--no-reset** + +Do not clear the terminal/screen in between reporting intervals + +[//]: # (END included file options/no-reset.md) + + +[//]: # (BEGIN included file options/no-stream.md) +#### **--no-stream** + +Disable streaming stats and only pull the first result, default setting is false + +[//]: # (END included file options/no-stream.md) + +#### **--no-trunc** + +Do not truncate output + +## EXAMPLE + +List statistics about all running containers without streaming mode: +``` +# podman stats -a --no-stream +ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS +a9f807ffaacd frosty_hodgkin -- 3.092MB / 16.7GB 0.02% -- / -- -- / -- 2 +3b33001239ee sleepy_stallman -- -- / -- -- -- / -- -- / -- -- +``` + +List the specified container's statistics in streaming mode: +``` +# podman stats a9f80 +ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS +a9f807ffaacd frosty_hodgkin -- 3.092MB / 16.7GB 0.02% -- / -- -- / -- 2 +``` + +List the specified statistics about the specified container in table format: +``` +$ podman stats --no-trunc 3667 --format 'table {{ .ID }} {{ .MemUsage }}' +ID MEM USAGE / LIMIT +3667c6aacb06aac2eaffce914c01736420023d56ef9b0f4cfe58b6d6a78b7503 49.15kB / 67.17GB +``` + +List the specified container statistics in JSON format: +``` +# podman stats --no-stream --format=json a9f80 +[ + { + "id": "a9f807ffaacd", + "name": "frosty_hodgkin", + "cpu_percent": "--", + "mem_usage": "3.092MB / 16.7GB", + "mem_percent": "0.02%", + "netio": "-- / --", + "blocki": "-- / --", + "pids": "2" + } +] +``` + +List the specified container statistics in table format: +``` +# podman stats --no-stream --format "table {{.ID}} {{.Name}} {{.MemUsage}}" 6eae +ID NAME MEM USAGE / LIMIT +6eae9e25a564 clever_bassi 3.031MB / 16.7GB +``` + +Note: When using a slirp4netns network with the rootlesskit port +handler, the traffic sent via the port forwarding is accounted to +the `lo` device. Traffic accounted to `lo` is not accounted in the +stats output. + + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +July 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-stop.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-stop.1.md new file mode 100644 index 000000000..ac411a5e2 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-stop.1.md @@ -0,0 +1,142 @@ +--- +title: podman-stop +version: v5.5.2 +--- + +% podman-stop 1 + +## NAME +podman\-stop - Stop one or more running containers + +## SYNOPSIS +**podman stop** [*options*] *container* ... + +**podman container stop** [*options*] *container* ... + +## DESCRIPTION +Stops one or more containers using container IDs or names as input. The **--time** option +specifies the number of seconds to wait before forcibly stopping the container after the stop command +is issued to the container. The default is 10 seconds. By default, containers are stopped with SIGTERM +and then SIGKILL after the timeout. The SIGTERM default can be overridden by the image used to create the +container and also via command line when creating the container. + +## OPTIONS + +#### **--all**, **-a** + +Stop all running containers. This does not include paused containers. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and stop the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + +Command does not fail when *file* is missing and user specified --ignore. + +#### **--filter**, **-f**=*filter* + +Filter what containers are going to be stopped. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + + +[//]: # (BEGIN included file options/ignore.md) +#### **--ignore**, **-i** + +Ignore errors when specified containers are not in the container store. A user +might have decided to manually remove a container which leads to a failure +during the ExecStop directive of a systemd service referencing that container. + +[//]: # (END included file options/ignore.md) + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + + +[//]: # (BEGIN included file options/time.md) +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping the container. +Use -1 for infinite wait. + +[//]: # (END included file options/time.md) + +## EXAMPLES + +Stop the specified container via its name. +``` +$ podman stop mywebserver +``` + +Stop the container via its id. +``` +$ podman stop 860a4b235279 +``` + +Stop multiple containers. +``` +$ podman stop mywebserver 860a4b235279 +``` + +Stop the container identified in the cidfile. +``` +$ podman stop --cidfile /home/user/cidfile-1 +``` + +Stop the containers identified in the cidfiles. +``` +$ podman stop --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +Stop the specified container in 2 seconds. +``` +$ podman stop --time 2 860a4b235279 +``` + +Stop all running containers. +``` +$ podman stop -a +``` + +Stop the last created container (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman stop --latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-rm(1)](podman-rm.1.md)** + +## HISTORY +September 2018, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-system-check.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-system-check.1.md new file mode 100644 index 000000000..d5e018f18 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-system-check.1.md @@ -0,0 +1,64 @@ +--- +title: podman-system-check +version: v5.5.2 +--- + +% podman-system-check 1 + +## NAME +podman\-system\-check - Perform consistency checks on image and container storage + +## SYNOPSIS +**podman system check** [*options*] + +## DESCRIPTION +Perform consistency checks on image and container storage, reporting images and +containers which have identified issues. + +## OPTIONS + +#### **--force**, **-f** + +When attempting to remove damaged images, also remove containers which depend +on those images. By default, damaged images which are being used by containers +are left alone. + +Containers which depend on damaged images do so regardless of which engine +created them, but because podman only "knows" how to shut down containers that +it started, the effect on still-running containers which were started by other +engines is difficult to predict. + +#### **--max**, **-m**=*duration* + +When considering layers which are not used by any images or containers, assume +that any layers which are more than *duration* old are the results of canceled +attempts to pull images, and should be treated as though they are damaged. + +#### **--quick**, **-q** + +Skip checks which are known to be time-consuming. This will prevent some types +of errors from being detected. + +#### **--repair**, **-r** + +Remove any images which are determined to have been damaged in some way, unless +they are in use by containers. Use **--force** to remove containers which +depend on damaged images, and those damaged images, as well. + +## EXAMPLE + +A reasonably quick check: +``` +podman system check --quick --repair --force +``` + +A more thorough check: +``` +podman system check --repair --max=1h --force +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)** + +## HISTORY +April 2024 diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-system-connection-add.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-system-connection-add.1.md new file mode 100644 index 000000000..927c0b48e --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-system-connection-add.1.md @@ -0,0 +1,69 @@ +--- +title: podman-system-connection-add +version: v5.5.2 +--- + +% podman-system-connection-add 1 + +## NAME +podman\-system\-connection\-add - Record destination for the Podman service + +## SYNOPSIS +**podman system connection add** [*options*] *name* *destination* + +## DESCRIPTION +Record ssh destination for remote podman service(s). The ssh destination is given as one of: + - [user@]hostname[:port] + - ssh://[user@]hostname[:port] + - unix://path + - tcp://hostname\\:port + +The user is prompted for the remote ssh login password or key file passphrase as required. The `ssh-agent` is supported if it is running. + +## OPTIONS + +#### **--default**, **-d** + +Make the new destination the default for this user. The default is **false**. + +#### **--identity**=*path* + +Path to ssh identity file. If the identity file has been encrypted, Podman prompts the user for the passphrase. +If no identity file is provided and no user is given, Podman defaults to the user running the podman command. +Podman prompts for the login password on the remote server. + +#### **--port**, **-p**=*port* + +Port for ssh destination. The default value is `22`. + +#### **--socket-path**=*path* + +Path to the Podman service unix domain socket on the ssh destination host + +## EXAMPLE + +Add a named system connection: +``` +$ podman system connection add QA podman.example.com +``` + +Add a system connection using SSH data: +``` +$ podman system connection add --identity ~/.ssh/dev_rsa production ssh://root@server.example.com:2222 +``` + +Add a named system connection to local Unix domain socket: +``` +$ podman system connection add testing unix:///run/podman/podman.sock +``` + +Add a named system connection to local tcp socket: +``` +$ podman system connection add debug tcp://localhost:8080 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + + +## HISTORY +June 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-system-connection-default.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-system-connection-default.1.md new file mode 100644 index 000000000..bb773e38a --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-system-connection-default.1.md @@ -0,0 +1,27 @@ +--- +title: podman-system-connection-default +version: v5.5.2 +--- + +% podman-system-connection-default 1 + +## NAME +podman\-system\-connection\-default - Set named destination as default for the Podman service + +## SYNOPSIS +**podman system connection default** *name* + +## DESCRIPTION +Set named ssh destination as default destination for the Podman service. + +## EXAMPLE + +Set the specified connection as default: +``` +$ podman system connection default production +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + +## HISTORY +July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-system-connection-list.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-system-connection-list.1.md new file mode 100644 index 000000000..306e186b7 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-system-connection-list.1.md @@ -0,0 +1,51 @@ +--- +title: podman-system-connection-list +version: v5.5.2 +--- + +% podman-system-connection-list 1 + +## NAME +podman\-system\-connection\-list - List the destination for the Podman service(s) + +## SYNOPSIS +**podman system connection list** [*options*] + +**podman system connection ls** [*options*] + +## DESCRIPTION +List ssh destination(s) for podman service(s). + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change the default output format. This can be of a supported type like 'json' or a Go template. +Valid placeholders for the Go template listed below: + +| **Placeholder** | **Description** | +| --------------- | ----------------------------------------------------------------------------- | +| .Default | Indicates whether connection is the default | +| .Identity | Path to file containing SSH identity | +| .Name | Connection Name/Identifier | +| .ReadWrite | Indicates if this connection can be modified using the system connection commands | +| .URI | URI to podman service. Valid schemes are ssh://[user@]*host*[\:port]*Unix domain socket*[?secure=True], unix://*Unix domain socket*, and tcp://localhost[:*port*] | + +#### **--quiet**, **-q** + +Only show connection names + +## EXAMPLE + +List system connections: +``` +$ podman system connection list +Name URI Identity Default ReadWrite +deva ssh://root@example.com:/run/podman/podman.sock ~/.ssh/id_rsa true true +devb ssh://user@example.com:/run/user/1000/podman/podman.sock ~/.ssh/id_rsa false true +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + +## HISTORY +July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-system-connection-remove.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-system-connection-remove.1.md new file mode 100644 index 000000000..c63098607 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-system-connection-remove.1.md @@ -0,0 +1,33 @@ +--- +title: podman-system-connection-remove +version: v5.5.2 +--- + +% podman-system-connection-remove 1 + +## NAME +podman\-system\-connection\-remove - Delete named destination + +## SYNOPSIS +**podman system connection remove** [*options*] *name* + +## DESCRIPTION +Delete named ssh destination. + +## OPTIONS + +#### **--all**, **-a** + +Remove all connections. + +## EXAMPLE + +Remove the specified system connection: +``` +$ podman system connection remove production +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + +## HISTORY +July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-system-connection-rename.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-system-connection-rename.1.md new file mode 100644 index 000000000..89777ebfc --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-system-connection-rename.1.md @@ -0,0 +1,27 @@ +--- +title: podman-system-connection-rename +version: v5.5.2 +--- + +% podman-system-connection-rename 1 + +## NAME +podman\-system\-connection\-rename - Rename the destination for Podman service + +## SYNOPSIS +**podman system connection rename** *old* *new* + +## DESCRIPTION +Rename ssh destination from *old* to *new*. + +## EXAMPLE + +Rename the specified connection: +``` +$ podman system connection rename laptop devel +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)** + +## HISTORY +July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-system-connection.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-system-connection.1.md new file mode 100644 index 000000000..a5ce17bc9 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-system-connection.1.md @@ -0,0 +1,52 @@ +--- +title: podman-system-connection +version: v5.5.2 +--- + +% podman-system-connection 1 + +## NAME +podman\-system\-connection - Manage the destination(s) for Podman service(s) + +## SYNOPSIS +**podman system connection** *subcommand* + +## DESCRIPTION +Manage the destination(s) for Podman service(s). + +The user is prompted for the ssh login password or key file passphrase as required. The `ssh-agent` is supported if it is running. + +Podman manages the system connection by writing and reading the `podman-connections.json` file located under +`$XDG_CONFIG_HOME/containers` or if the env is not set it defaults to `$HOME/.config/containers`. +Or the `PODMAN_CONNECTIONS_CONF` environment variable can be set to a full file path which podman +will use instead. +This file is managed by the podman commands and should never be edited by users directly. To manually +configure the connections use `service_destinations` in containers.conf. + +If the ReadWrite column in the **podman system connection list** output is set to true the connection is +stored in the `podman-connections.json` file otherwise it is stored in containers.conf and can therefore +not be edited with the **podman system connection** commands. + +## COMMANDS + +| Command | Man Page | Description | +| -------- | ----------------------------------------------------------------------------- | ---------------------------------------------------------- | +| add | [podman-system-connection\-add(1)](podman-system-connection-add.1.md) | Record destination for the Podman service | +| default | [podman-system-connection\-default(1)](podman-system-connection-default.1.md) | Set named destination as default for the Podman service | +| list | [podman-system-connection\-list(1)](podman-system-connection-list.1.md) | List the destination for the Podman service(s) | +| remove | [podman-system-connection\-remove(1)](podman-system-connection-remove.1.md) | Delete named destination | +| rename | [podman-system-connection\-rename(1)](podman-system-connection-rename.1.md) | Rename the destination for Podman service | + +## EXAMPLE + +List system connections: +``` +$ podman system connection list +Name URI Identity Default ReadWrite +devl ssh://root@example.com/run/podman/podman.sock ~/.ssh/id_rsa true true +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)** + +## HISTORY +June 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-system-df.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-system-df.1.md new file mode 100644 index 000000000..31d068adb --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-system-df.1.md @@ -0,0 +1,84 @@ +--- +title: podman-system-df +version: v5.5.2 +--- + +% podman-system-df 1 + +## NAME +podman\-system\-df - Show podman disk usage + +## SYNOPSIS +**podman system df** [*options*] + +## DESCRIPTION +Show podman disk usage for images, containers and volumes. + +Note: The RECLAIMABLE size that is reported for images can be incorrect. It might +report that it can reclaim more than a prune would actually free. This will happen +if you are using different images that share some layers. + +## OPTIONS +#### **--format**=*format* + +Pretty-print images using a Go template or JSON. This flag is not allowed in combination with **--verbose** + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------------- | ------------------------------------------------ | +| .Active | Indicates whether volume is in use | +| .RawReclaimable | Raw reclaimable size of each Type | +| .RawSize | Raw size of each type | +| .Reclaimable | Reclaimable size or each type (human-readable) | +| .Size | Size of each type (human-readable) | +| .Total | Total items for each type | +| .Type | Type of data | + + +#### **--verbose**, **-v** +Show detailed information on space usage + +## EXAMPLE + +Show disk usage: +``` +$ podman system df +TYPE TOTAL ACTIVE SIZE RECLAIMABLE +Images 6 2 281MB 168MB (59%) +Containers 3 1 0B 0B (0%) +Local Volumes 1 1 22B 0B (0%) +``` + +Show disk usage in verbose mode: +``` +$ podman system df -v +Images space usage: + +REPOSITORY TAG IMAGE ID CREATED SIZE SHARED SIZE UNIQUE SIZE CONTAINERS +docker.io/library/alpine latest 5cb3aa00f899 2 weeks ago 5.79MB 0B 5.79MB 5 + +Containers space usage: + +CONTAINER ID IMAGE COMMAND LOCAL VOLUMES SIZE CREATED STATUS NAMES +073f7e62812d 5cb3 sleep 100 1 0B 20 hours ago exited zen_joliot +3f19f5bba242 5cb3 sleep 100 0 5.52kB 22 hours ago exited pedantic_archimedes +8cd89bf645cc 5cb3 ls foodir 0 58B 21 hours ago configured agitated_hamilton +a1d948a4b61d 5cb3 ls foodir 0 12B 21 hours ago exited laughing_wing +eafe3e3c5bb3 5cb3 sleep 10000 0 72B 21 hours ago exited priceless_liskov + +Local Volumes space usage: + +VOLUME NAME LINKS SIZE +data 1 0B + +$ podman system df --format "{{.Type}}\t{{.Total}}" +Images 1 +Containers 5 +Local Volumes 1 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)** + +## HISTORY +March 2019, Originally compiled by Qi Wang (qiwan at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-system-migrate.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-system-migrate.1.md new file mode 100644 index 000000000..eaef65f04 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-system-migrate.1.md @@ -0,0 +1,44 @@ +--- +title: podman-system-migrate +version: v5.5.2 +--- + +% podman-system-migrate 1 + +## NAME +podman\-system\-migrate - Migrate existing containers to a new podman version + +## SYNOPSIS +**podman system migrate** [*options*] + +## DESCRIPTION +**podman system migrate** migrates containers to the latest podman version. + +**podman system migrate** takes care of migrating existing containers to the latest version of podman if any change is necessary. + +"Rootless Podman uses a pause process to keep the unprivileged +namespaces alive. This prevents any change to the `/etc/subuid` and +`/etc/subgid` files from being propagated to the rootless containers +while the pause process is running. + +For these changes to be propagated, it is necessary to first stop all +running containers associated with the user and to also stop the pause +process and delete its pid file. Instead of doing it manually, `podman +system migrate` can be used to stop both the running containers and the +pause process. The `/etc/subuid` and `/etc/subgid` files can then be +edited or changed with usermod to recreate the user namespace with the +newly configured mappings. + +## OPTIONS + +#### **--new-runtime**=*runtime* + +Set a new OCI runtime for all containers. +This can be used after a system upgrade which changes the default OCI runtime to move all containers to the new runtime. +There are no guarantees that the containers continue to work under the new runtime, as some runtimes support differing options and configurations. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **usermod(8)** + +## HISTORY +April 2019, Originally compiled by Giuseppe Scrivano (gscrivan at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-system-prune.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-system-prune.1.md new file mode 100644 index 000000000..1d68f2bd1 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-system-prune.1.md @@ -0,0 +1,76 @@ +--- +title: podman-system-prune +version: v5.5.2 +--- + +% podman-system-prune 1 + +## NAME +podman\-system\-prune - Remove all unused pods, containers, images, networks, and volume data + +## SYNOPSIS +**podman system prune** [*options*] + +## DESCRIPTION +**podman system prune** removes all unused containers (both dangling and unreferenced), build containers, pods, networks, and optionally, volumes from local storage. + +Use the **--all** option to delete all unused images. Unused images are dangling images as well as any image that does not have any containers based on it. + +By default, volumes are not removed to prevent important data from being deleted if there is currently no container using the volume. Use the **--volumes** flag when running the command to prune volumes as well. + +By default, build containers are not removed to prevent interference with builds in progress. Use the **--build** flag when running the command to remove build containers as well. + +## OPTIONS +#### **--all**, **-a** + +Recursively remove all unused pods, containers, images, networks, and volume data. (Maximum 50 iterations.) + +#### **--build** + +Removes any build containers that were created during the build, but were not removed because the build was unexpectedly terminated. + +Note: **This is not safe operation and should be executed only when no builds are in progress. It can interfere with builds in progress.** + +#### **--external** + +Tries to clean up remainders of previous containers or layers that are not references in the storage json files. These can happen in the case of unclean shutdowns or regular restarts in transient storage mode. + +However, when using transient storage mode, the Podman database does not persist. This means containers leave the writable layers on disk after a reboot. When using a transient store, it is recommended that the **podman system prune --external** command is run during boot. + +This option is incompatible with **--all** and **--filter** and drops the default behaviour of removing unused resources. + +#### **--filter**=*filters* + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:------:|-----------------------------------------------------------------------------------------------------------------| +| label | Only remove containers and images, with (or without, in the case of label!=[...] is used) the specified labels. | +| until | Only remove containers and images created before given timestamp. | + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes containers and images with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes containers and images without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not prompt for confirmation + +#### **--help**, **-h** + +Print usage statement + +#### **--volumes** + +Prune volumes currently unused by any container + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)** + +## HISTORY +February 2019, Originally compiled by Dan Walsh (dwalsh at redhat dot com) +December 2020, converted filter information from docs.docker.com documentation by Dan Walsh (dwalsh at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-system-renumber.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-system-renumber.1.md new file mode 100644 index 000000000..32b373af0 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-system-renumber.1.md @@ -0,0 +1,31 @@ +--- +title: podman-system-renumber +version: v5.5.2 +--- + +% podman-system-renumber 1 + +## NAME +podman\-system\-renumber - Migrate lock numbers to handle a change in maximum number of locks + +## SYNOPSIS +**podman system renumber** + +## DESCRIPTION +**podman system renumber** renumbers locks used by containers and pods. + +Each Podman container and pod is allocated a lock at creation time, up to a maximum number controlled by the **num_locks** parameter in **containers.conf**. + +When all available locks are exhausted, no further containers and pods can be created until some existing containers and pods are removed. This can be avoided by increasing the number of locks available via modifying **containers.conf** and subsequently running **podman system renumber** to prepare the new locks (and reallocate lock numbers to fit the new struct). + +**podman system renumber** must be called after any changes to **num_locks** - failure to do so results in errors starting Podman as the number of locks available conflicts with the configured number of locks. + +**podman system renumber** can also be used to migrate 1.0 and earlier versions of Podman, which used a different locking scheme, to the new locking model. It is not strictly required to do this, but it is highly recommended to do so as deadlocks can occur otherwise. + +If possible, avoid calling **podman system renumber** while there are other Podman processes running. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +## HISTORY +February 2019, Originally compiled by Matt Heon (mheon at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-system-reset.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-system-reset.1.md new file mode 100644 index 000000000..795e3d6bf --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-system-reset.1.md @@ -0,0 +1,74 @@ +--- +title: podman-system-reset +version: v5.5.2 +--- + +% podman-system-reset 1 + +## NAME +podman\-system\-reset - Reset storage back to initial state + +## SYNOPSIS +**podman system reset** [*options*] + +## DESCRIPTION +**podman system reset** removes all pods, containers, images, networks and volumes, and machines. +It also removes the configured graphRoot and runRoot directories. Make sure these are not set to +some important directory. + +This command must be run **before** changing any of the following fields in the +`containers.conf` or `storage.conf` files: `driver`, `static_dir`, `tmp_dir` +or `volume_path`. + +`podman system reset` reads the current configuration and attempts to remove all +of the relevant configurations. If the administrator modified the configuration files first, +`podman system reset` might not be able to clean up the previous storage. + +`podman system reset` does not restart podman.service and podman.socket systemd units. You may need to manually restart it after running this command. + +## OPTIONS +#### **--force**, **-f** + +Do not prompt for confirmation + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Reset all storage back to a clean initialized state. +``` +$ podman system reset +WARNING! This will remove: + - all containers + - all pods + - all images + - all networks + - all build cache + - all machines + - all volumes + - the graphRoot directory: /var/lib/containers/storage + - the runRoot directory: /run/containers/storage +Are you sure you want to continue? [y/N] y +``` + +### Switching rootless user from VFS driver to overlay with fuse-overlayfs + +If the user ran rootless containers without having the `fuse-overlayfs` program +installed, podman defaults to the `vfs` storage in their home directory. If they +want to switch to use fuse-overlay, they must install the fuse-overlayfs +package. The user needs to reset the storage to use overlayfs by default. +Execute `podman system reset` as the user first to remove the VFS storage. Now +the user can edit the `/etc/containers/storage.conf` to make any changes if +necessary. If the system's default was already `overlay`, then no changes are +necessary to switch to fuse-overlayfs. Podman looks for the existence of +fuse-overlayfs to use it when set in the `overlay` driver, only falling back to vfs +if the program does not exist. Users can run `podman info` to ensure Podman is +using fuse-overlayfs and the overlay driver. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system(1)](podman-system.1.md)**, **[fuse-overlayfs(1)](https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)** + +## HISTORY +November 2019, Originally compiled by Dan Walsh (dwalsh at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-system-service.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-system-service.1.md new file mode 100644 index 000000000..a0f963615 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-system-service.1.md @@ -0,0 +1,146 @@ +--- +title: podman-system-service +version: v5.5.2 +--- + +% podman-system-service 1 + +## NAME +podman\-system\-service - Run an API service + +## SYNOPSIS +**podman system service** [*options*] + +## DESCRIPTION +The **podman system service** command creates a listening service that answers API calls for Podman. +The command is available on Linux systems and is usually executed in systemd services. +The command is not available when the Podman command is executed directly on a Windows or macOS +host or in other situations where the Podman command is accessing a remote Podman API service. + +The REST API provided by **podman system service** is split into two parts: a compatibility layer offering support for the Docker v1.40 API, and a Podman-native Libpod layer. +Documentation for the latter is available at *https://docs.podman.io/en/latest/_static/api.html*. +Both APIs are versioned, but the server does not reject requests with an unsupported version set. + +### Run the command in a systemd service + +The command **podman system service** supports systemd socket activation. +When the command is run in a systemd service, the API service can therefore be provided on demand. +If the systemd service is not already running, it will be activated as soon as +a client connects to the listening socket. Systemd then executes the +**podman system service** command. +After some time of inactivity, as defined by the __--time__ option, the command terminates. +Systemd sets the _podman.service_ state as inactive. At this point there is no +**podman system service** process running. No unnecessary compute resources are wasted. +As soon as another client connects, systemd activates the systemd service again. + +The systemd unit files that declares the Podman API service for users are + +* _/usr/lib/systemd/user/podman.service_ +* _/usr/lib/systemd/user/podman.socket_ + +In the file _podman.socket_ the path of the listening Unix socket is defined by + +``` +ListenStream=%t/podman/podman.sock +``` + +The path contains the systemd specifier `%t` which systemd expands to the value of the environment variable +`XDG_RUNTIME_DIR` (see systemd specifiers in the **systemd.unit(5)** man page). + +In addition to the systemd user services, there is also a systemd system service _podman.service_. +It runs rootful Podman and is accessed from the Unix socket _/run/podman/podman.sock_. See the systemd unit files + +* _/usr/lib/systemd/system/podman.service_ +* _/usr/lib/systemd/system/podman.socket_ + +The **podman system service** command does not support more than one listening socket for the API service. + +Note: The default systemd unit files (system and user) change the log-level option to *info* from *error*. This change provides additional information on each API call. + +### Run the command directly + +To support running an API service without using a systemd service, the command also takes an +optional endpoint argument for the API in URI form. For example, *unix:///tmp/foobar.sock* or *tcp://localhost:8080*. +If no endpoint is provided, defaults is used. The default endpoint for a rootful +service is *unix:///run/podman/podman.sock* and rootless is *unix://$XDG_RUNTIME_DIR/podman/podman.sock* (for +example *unix:///run/user/1000/podman/podman.sock*) + +### Access the Unix socket from inside a container + +To access the API service inside a container: +- mount the socket as a volume +- run the container with `--security-opt label=disable` + +### Security + +Please note that the API grants full access to all Podman functionality, and thus allows arbitrary code execution as the user running the API, with no ability to limit or audit this access. +The API's security model is built upon access via a Unix socket with access restricted via standard file permissions, ensuring that only the user running the service will be able to access it. +We *strongly* recommend against making the API socket available via the network (IE, bindings the service to a *tcp* URL). +Even access via Localhost carries risks - anyone with access to the system will be able to access the API. +If remote access is required, we instead recommend forwarding the API socket via SSH, and limiting access on the remote machine to the greatest extent possible. +If a *tcp* URL must be used, using the *--cors* option is recommended to improve security. + +## OPTIONS + +#### **--cors** + +CORS headers to inject to the HTTP response. The default value is empty string which disables CORS headers. + +#### **--help**, **-h** + +Print usage statement. + +#### **--time**, **-t** + +The time until the session expires in _seconds_. The default is 5 +seconds. A value of `0` means no timeout, therefore the session does not expire. + +The default timeout can be changed via the `service_timeout=VALUE` field in containers.conf. +See **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** for more information. + +## EXAMPLES + +Start the user systemd socket for a rootless service. +``` +systemctl --user start podman.socket +``` + +Configure DOCKER_HOST environment variable to point to the Podman socket so that +it can be used via Docker API tools like docker-compose. +``` +$ export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock +$ docker-compose up +``` + +Configure the systemd socket to be automatically started after reboots, and run as the specified user. +``` +systemctl --user enable podman.socket +loginctl enable-linger +``` + +Start the systemd socket for the rootful service. +``` +sudo systemctl start podman.socket +``` + +Configure the socket to be automatically started after reboots. +``` +sudo systemctl enable podman.socket +``` + +It is possible to run the API without using systemd socket activation. +In this case the API will not be available on demand because the command will +stay terminated after the inactivity timeout has passed. +Run an API with an inactivity timeout of 5 seconds without using socket activation. +``` +podman system service --time 5 +``` + +The default socket was used as no URI argument was provided. + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-system-connection(1)](podman-system-connection.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** + +## HISTORY +January 2020, Originally compiled by Brent Baude `` +November 2020, Updated by Jhon Honce (jhonce at redhat dot com) diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-system.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-system.1.md new file mode 100644 index 000000000..6d4cc95b8 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-system.1.md @@ -0,0 +1,33 @@ +--- +title: podman-system +version: v5.5.2 +--- + +% podman-system 1 + +## NAME +podman\-system - Manage podman + +## SYNOPSIS +**podman system** *subcommand* + +## DESCRIPTION +The system command allows management of the podman systems + +## COMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------------------ | ------------------------------------------------------------------------ | +| check | [podman-system-check(1)](podman-system-check.1.md) | Perform consistency checks on image and container storage. +| connection | [podman-system-connection(1)](podman-system-connection.1.md) | Manage the destination(s) for Podman service(s) | +| df | [podman-system-df(1)](podman-system-df.1.md) | Show podman disk usage. | +| events | [podman-events(1)](podman-events.1.md) | Monitor Podman events | +| info | [podman-info(1)](podman-info.1.md) | Display Podman related system information. | +| migrate | [podman-system-migrate(1)](podman-system-migrate.1.md) | Migrate existing containers to a new podman version. | +| prune | [podman-system-prune(1)](podman-system-prune.1.md) | Remove all unused pods, containers, images, networks, and volume data. | +| renumber | [podman-system-renumber(1)](podman-system-renumber.1.md) | Migrate lock numbers to handle a change in maximum number of locks. | +| reset | [podman-system-reset(1)](podman-system-reset.1.md) | Reset storage back to initial state. | +| service | [podman-system-service(1)](podman-system-service.1.md) | Run an API service | + +## SEE ALSO +**[podman(1)](podman.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-systemd.unit.5.md b/versioned_docs/version-5.5.2/source/markdown/podman-systemd.unit.5.md new file mode 100644 index 000000000..3e0616317 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-systemd.unit.5.md @@ -0,0 +1,2188 @@ +--- +title: Restart service when sleep finishes +version: v5.5.2 +--- + +% podman-systemd.unit 5 + +## NAME + +podman\-systemd.unit - systemd units using Podman Quadlet + +## SYNOPSIS + +*name*.container, *name*.volume, *name*.network, *name*.kube *name*.image, *name*.build *name*.pod + +### Podman rootful unit search path + +Quadlet files for the root user can be placed in the following directories ordered in precedence. Meaning duplicate named quadlets found under /run take precedence over ones in /etc, as well as those in /usr: + +Temporary quadlets, usually used for testing: + +* /run/containers/systemd/ + +System administrator's defined quadlets: + +* /etc/containers/systemd/ + +Distribution defined quadlets: + +* /usr/share/containers/systemd/ + +### Podman rootless unit search path + +Quadlet files for non-root users can be placed in the following directories: + + * $XDG_RUNTIME_DIR/containers/systemd/ + * $XDG_CONFIG_HOME/containers/systemd/ or ~/.config/containers/systemd/ + * /etc/containers/systemd/users/$(UID) + * /etc/containers/systemd/users/ + +### Using symbolic links + +Quadlet supports using symbolic links for the base of the search paths and inside them. + +## DESCRIPTION + +Podman supports building and starting containers (and creating volumes) via systemd by using a +[systemd generator](https://www.freedesktop.org/software/systemd/man/systemd.generator.html). +These files are read during boot (and when `systemctl daemon-reload` is run) and generate +corresponding regular systemd service unit files. Both system and user systemd units are supported. +All options and tables available in standard systemd unit files are supported. For example, options defined in +the [Service] table and [Install] tables pass directly to systemd and are handled by it. +See systemd.unit(5) man page for more information. + +The Podman generator reads the search paths above and reads files with the extensions `.container` +`.volume`, `.network`, `.build`, `.pod` and `.kube`, and for each file generates a similarly named `.service` file. Be aware that +existing vendor services (i.e., in `/usr/`) are replaced if they have the same name. The generated unit files can +be started and managed with `systemctl` like any other systemd service. `systemctl {--user} list-unit-files` +lists existing unit files on the system. + +The Podman files use the same format as [regular systemd unit files](https://www.freedesktop.org/software/systemd/man/systemd.syntax.html). +Each file type has a custom section (for example, `[Container]`) that is handled by Podman, and all +other sections are passed on untouched, allowing the use of any normal systemd configuration options +like dependencies or cgroup limits. + +The source files also support drop-ins in the same [way systemd does](https://www.freedesktop.org/software/systemd/man/latest/systemd.unit.html). +For a given source file (`foo.container`), the corresponding `.d` directory (`foo.container.d`) will +be scanned for files with a `.conf` extension, which are then merged into the base file in alphabetical +order. Top-level type drop-ins (`container.d`) will also be included. If the unit contains dashes ("-") +in the name (`foo-bar-baz.container`), then the drop-in directories generated by truncating the name after +the dash are searched as well (`foo-.container.d` and `foo-bar-.container.d`). Drop-in files with the same name +further down the hierarchy override those further up (`foo-bar-baz.container.d/10-override.conf` overrides +`foo-bar-.container.d/10-override.conf`, which overrides `foo-.service.d/10-override.conf`, which overrides +`container.d/10-override.conf`). The format of these drop-in files is the same as the base file. This is useful +to alter or add configuration settings for a unit, without having to modify unit files. + +For rootless containers, when administrators place Quadlet files in the +/etc/containers/systemd/users directory, all users' sessions execute the +Quadlet when the login session begins. If the administrator places a Quadlet +file in the /etc/containers/systemd/users/${UID}/ directory, then only the +user with the matching UID executes the Quadlet when the login +session gets started. For unit files placed in subdirectories within +/etc/containers/systemd/user/${UID}/ and the other user unit search paths, +Quadlet will recursively search and run the unit files present in these subdirectories. + +Note: When a Quadlet is starting, Podman often pulls or builds one more container images which may take a considerable amount of time. +Systemd defaults service start time to 90 seconds, or fails the service. Pre-pulling the image or extending +the systemd timeout time for the service using the *TimeoutStartSec* Service option can fix the problem. +A word of caution: *TimeoutStartSec* is not available for `Type=oneshot` units. Refer to `systemd.service(5)` +for more information on how to handle long startup times for units which do not need to stay active +once their main process has finished. + +Adding the following snippet to a Quadlet file extends the systemd timeout to 15 minutes. + +``` +[Service] +TimeoutStartSec=900 +``` + +Quadlet requires the use of cgroup v2, use `podman info --format {{.Host.CgroupsVersion}}` to check on the system. + +### Service Type + +By default, the `Type` field of the `Service` section of the Quadlet file does not need to be set. +Quadlet will set it to `notify` for `.container` and `.kube` files, +`forking` for `.pod` files, and `oneshot` for `.volume`, `.network`, `.build`, and `.image` files. + +However, `Type` may be explicitly set to `oneshot` for `.container` and `.kube` files when no containers are expected +to run once `podman` exits. + +When setting `Type=oneshot`, it is recommended to also set `RemainAfterExit=yes` to prevent the service state +from becoming `inactive (dead)`. However, when activating a service via a timer unit, having `RemainAfterExit=yes` +leaves the job in a "started" state which prevents subsequent activations by the timer. For more information, see the +`systemd.service(5)` man page. + +Examples for such cases: +- `.container` file with an image that exits after their entrypoint has finished + +- `.kube` file pointing to a Kubernetes Yaml file that does not define any containers. E.g. PVCs only + +### Enabling unit files + +The services created by Podman are considered transient by systemd, which means they don't have the same +persistence rules as regular units. In particular, it is not possible to `systemctl enable` them +in order for them to become automatically enabled on the next boot. + +To compensate for this, the generator manually applies the `[Install]` section of the container definition +unit files during generation, in the same way `systemctl enable` does when run later. + +For example, to start a container on boot, add something like this to the file: + +``` +[Install] +WantedBy=default.target +``` + +Currently, only the `Alias`, `WantedBy`, `RequiredBy`, and `UpheldBy` keys are supported. + +The Install section can be part of the main file, or it can be in a +separate drop-in file as described above. The latter allows you to +install an non-enabled unit and then later enabling it by installing +the drop-in. + +### Template files + +Systemd supports a concept of [template files](https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html#Service%20Templates). +They are units with names of the form "basename@instancename.service" +when they are running, but that can be instantiated multiple times +from a single "basename@.service" file. The individual instances can +also be different by using drop-in files with the full instance name. + +Quadlets support these in two ways. First of all, a quadlet unit with +a template form will generate a systemd service with a template form, +and the template systemd service can be used as a regular template. +For example, "foo@.container" will generate "foo@.service" and you can +then "systemctl start foo@bar.service". + +Secondly, if you make a symlink like "foo@instance.container", that +will generate an instantiated template file. When generating this file +quadlet will read drop-in files both from the instanced directory +(foo@instance.container.d) and the template directory +(foo@.container.d). This allows customization of individual instances. + +Instanced template files (like `foo@bar.container`) can be enabled +just like non-templated ones. However, templated ones +(`foo@.container`) are different, because they need to be +instantiated. If the `[Install]` section contains a `DefaultInstance=` +key, then that instance will be enabled, but if not, nothing will +happen and the options will only be used as the default for units +that are instantiated using symlinks. + +An example template file `sleep@.container` might look like this: + +``` +[Unit] +Description=A templated sleepy container + +[Container] +Image=quay.io/fedora/fedora +Exec=sleep %i + +[Service] +# Restart service when sleep finishes +Restart=always + +[Install] +WantedBy=multi-user.target +DefaultInstance=100 +``` + +If this is installed, then on boot there will be a `sleep@100.service` +running that sleeps for 100 seconds. You can then do something like +`systemctl start sleep@50.service` to start another instance that +sleeps 50 seconds, or alternatively another service can start it via a +dependency like `Wants=sleep@50.service`. + +In addition, if you do `ln -s sleep@.container sleep@10.container` you +will also have a 10 second sleep running at boot. And, if you want +that particular instance to be running with another image, you can +create a drop-in file like `sleep@10.container.d/10-image.conf`: +``` +[Container] +Image=quay.io/centos/centos +``` + +### Relative paths + +In order to support Systemd specifiers, Quadlet does not resolve relative paths that start with `%`. +To resolve such a path, prepend it with `./`. + +For example, instead of `EnvironmentFile=%n/env` use `EnvironmentFile=./%n/env` + +### Debugging unit files + +After placing the unit file in one of the unit search paths (mentioned +above), you can start it with `systemctl start {--user}`. If it fails +with "Failed to start example.service: Unit example.service not +found.", then it is possible that you used incorrect syntax or you +used an option from a newer version of Podman Quadlet and the +generator failed to create a service file. + +View the generated files and/or error messages with: +``` +/usr/lib/systemd/system-generators/podman-system-generator {--user} --dryrun +``` + +Alternatively, show only the errors with: +``` +systemd-analyze {--user} --generators=true verify example.service +``` + +That command also performs additional checks on the generated service unit. +For details, see systemd-analyze(1) man page. + +#### Debugging a limited set of unit files + +If you would like to debug a limited set of unit files, you can copy them to a separate directory and set the +`QUADLET_UNIT_DIRS` environment variable to this directory when running the command below: + +``` +QUADLET_UNIT_DIRS= /usr/lib/systemd/system-generators/podman-system-generator {--user} --dryrun +``` + +This will instruct Quadlet to look for units in this directory instead of the common ones and by +that limit the output to only the units you are debugging. + +### Implicit network dependencies + +Quadlet will add dependencies on `network-online.target` (as root) or `podman-user-wait-network-online.service` +(as user) by adding `After=` and `Wants=` properties to the unit. This is to ensure that the network is reachable +if an image needs to be pulled and by the time the container is started. + +The special case `podman-user-wait-network-online.service` unit is needed as user because user units are unable to wait +for system (root) units so `network-online.target` doesn't do anything there and is instead ignored. As this caused +a significant amount of issues we decided to work around this with our own special purpose unit that simply checks if +the `network-online.target` unit is active with `systemctl is-active network-online.target`. + +This behavior can be disabled by adding `DefaultDependencies=false` in the `Quadlet` section. +Note, the _systemd_ `[Unit]` section has an option with the same name but a different meaning. + +### Dependency between Quadlet units + +Quadlet will automatically translate dependencies, specified in the keys +`Wants`, `Requires`, `Requisite`, `BindsTo`, `PartOf`, `Upholds`, `Conflicts`, `Before` and `After` +of the `[Unit]` section, between different Quadlet units. + +For example the `fedora.container` unit below specifies a dependency on the `basic.container` unit. +``` +[Unit] +After=basic.container +Requires=basic.container + +[Container] +Image=registry.fedoraproject.org/fedora:41 +``` + +## Container units [Container] + +Container units are named with a `.container` extension and contain a `[Container]` section describing +the container that is run as a service. The resulting service file contains a line like +`ExecStart=podman run … image-name`, and most of the keys in this section control the command-line +options passed to Podman. However, some options also affect the details of how systemd is set up to run and +interact with the container. + +By default, the Podman container has the same name as the unit, but with a `systemd-` prefix, i.e. +a `$name.container` file creates a `$name.service` unit and a `systemd-$name` Podman container. The +`ContainerName` option allows for overriding this default name with a user-provided one. + +There is only one required key, `Image`, which defines the container image the service runs. + +Valid options for `[Container]` are listed below: + +| **[Container] options** | **podman run equivalent** | +|--------------------------------------|------------------------------------------------------| +| AddCapability=CAP | --cap-add CAP | +| AddDevice=/dev/foo | --device /dev/foo | +| AddHost=example\.com:192.168.10.11 | --add-host example.com:192.168.10.11 | +| Annotation="XYZ" | --annotation "XYZ" | +| AutoUpdate=registry | --label "io.containers.autoupdate=registry" | +| CgroupsMode=no-conmon | --cgroups=no-conmon | +| ContainerName=name | --name name | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| DNS=192.168.55.1 | --dns=192.168.55.1 | +| DNSOption=ndots:1 | --dns-option=ndots:1 | +| DNSSearch=example.com | --dns-search example.com | +| DropCapability=CAP | --cap-drop=CAP | +| Entrypoint=/foo.sh | --entrypoint=/foo.sh | +| Environment=foo=bar | --env foo=bar | +| EnvironmentFile=/tmp/env | --env-file /tmp/env | +| EnvironmentHost=true | --env-host | +| Exec=/usr/bin/command | Command after image specification - /usr/bin/command | +| ExposeHostPort=50-59 | --expose 50-59 | +| GIDMap=0:10000:10 | --gidmap=0:10000:10 | +| GlobalArgs=--log-level=debug | --log-level=debug | +| Group=1234 | --user UID:1234 | +| GroupAdd=keep-groups | --group-add=keep-groups | +| HealthCmd=/usr/bin/command | --health-cmd=/usr/bin/command | +| HealthInterval=2m | --health-interval=2m | +| HealthLogDestination=/foo/log | --health-log-destination=/foo/log | +| HealthMaxLogCount=5 | --health-max-log-count=5 | +| HealthMaxLogSize=500 | --health-max-log-size=500 | +| HealthOnFailure=kill | --health-on-failure=kill | +| HealthRetries=5 | --health-retries=5 | +| HealthStartPeriod=1m | --health-start-period=period=1m | +| HealthStartupCmd=command | --health-startup-cmd=command | +| HealthStartupInterval=1m | --health-startup-interval=1m | +| HealthStartupRetries=8 | --health-startup-retries=8 | +| HealthStartupSuccess=2 | --health-startup-success=2 | +| HealthStartupTimeout=1m33s | --health-startup-timeout=1m33s | +| HealthTimeout=20s | --health-timeout=20s | +| HostName=example.com | --hostname example.com | +| Image=ubi8 | Image specification - ubi8 | +| IP=192.5.0.1 | --ip 192.5.0.1 | +| IP6=2001:db8::1 | --ip6 2001:db8::1 | +| Label="XYZ" | --label "XYZ" | +| LogDriver=journald | --log-driver journald | +| LogOpt=path=/var/log/mykube\.json | --log-opt path=/var/log/mykube\.json | +| Mask=/proc/sys/foo\:/proc/sys/bar | --security-opt mask=/proc/sys/foo:/proc/sys/bar | +| Memory=20g | --memory 20g | +| Mount=type=... | --mount type=... | +| Network=host | --network host | +| NetworkAlias=name | --network-alias name | +| NoNewPrivileges=true | --security-opt no-new-privileges | +| Notify=true | --sdnotify container | +| PidsLimit=10000 | --pids-limit 10000 | +| Pod=pod-name | --pod=pod-name | +| PodmanArgs=--publish 8080:80 | --publish 8080:80 | +| PublishPort=8080:80 | --publish 8080:80 | +| Pull=never | --pull never | +| ReadOnly=true | --read-only | +| ReadOnlyTmpfs=true | --read-only-tmpfs | +| ReloadCmd=/usr/bin/command | Add ExecReload and run exec with the value | +| ReloadSignal=SIGHUP | Add ExecReload and run kill with the signal | +| Retry=5 | --retry=5 | +| RetryDelay=5s | --retry-delay=5s | +| Rootfs=/var/lib/rootfs | --rootfs /var/lib/rootfs | +| RunInit=true | --init | +| SeccompProfile=/tmp/s.json | --security-opt seccomp=/tmp/s.json | +| Secret=secret | --secret=secret[,opt=opt ...] | +| SecurityLabelDisable=true | --security-opt label=disable | +| SecurityLabelFileType=usr_t | --security-opt label=filetype:usr_t | +| SecurityLabelLevel=s0:c1,c2 | --security-opt label=level\:s0\:c1,c2 | +| SecurityLabelNested=true | --security-opt label=nested | +| SecurityLabelType=spc_t | --security-opt label=type\:spc_t | +| ShmSize=100m | --shm-size=100m | +| StartWithPod=true | If Pod= is defined, container is started by pod | +| StopSignal=SIGINT | --stop-signal=SIGINT | +| StopTimeout=20 | --stop-timeout=20 | +| SubGIDMap=gtest | --subgidname=gtest | +| SubUIDMap=utest | --subuidname=utest | +| Sysctl=name=value | --sysctl=name=value | +| Timezone=local | --tz local | +| Tmpfs=/work | --tmpfs /work | +| UIDMap=0:10000:10 | --uidmap=0:10000:10 | +| Ulimit=nofile=1000:10000 | --ulimit nofile=1000:10000 | +| Unmask=ALL | --security-opt unmask=ALL | +| User=bin | --user bin | +| UserNS=keep-id\:uid=200,gid=210 | --userns keep-id:uid=200,gid=210 | +| Volume=/source:/dest | --volume /source:/dest | +| WorkingDir=$HOME | --workdir $HOME | + +Description of `[Container]` section are: + +### `AddCapability=` + +Add these capabilities, in addition to the default Podman capability set, to the container. + +This is a space separated list of capabilities. This key can be listed multiple times. + +For example: +``` +AddCapability=CAP_DAC_OVERRIDE CAP_IPC_OWNER +``` + +### `AddDevice=` + +Adds a device node from the host into the container. The format of this is +`HOST-DEVICE[\:CONTAINER-DEVICE][:PERMISSIONS]`, where `HOST-DEVICE` is the path of +the device node on the host, `CONTAINER-DEVICE` is the path of the device node in +the container, and `PERMISSIONS` is a list of permissions combining 'r' for read, +'w' for write, and 'm' for mknod(2). The `-` prefix tells Quadlet to add the device +only if it exists on the host. + +This key can be listed multiple times. + +### `AddHost=` + +Add host-to-IP mapping to /etc/hosts. +The format is `hostname\:ip`. + +Equivalent to the Podman `--add-host` option. +This key can be listed multiple times. + +### `Annotation=` + +Set one or more OCI annotations on the container. The format is a list of `key=value` items, +similar to `Environment`. + +This key can be listed multiple times. + +### `AutoUpdate=` + +Indicates whether the container will be auto-updated ([podman-auto-update(1)](podman-auto-update.1.md)). The following values are supported: + +* `registry`: Requires a fully-qualified image reference (e.g., quay.io/podman/stable:latest) to be used to create the container. This enforcement is necessary to know which image to actually check and pull. If an image ID was used, Podman does not know which image to check/pull anymore. + +* `local`: Tells Podman to compare the image a container is using to the image with its raw name in local storage. If an image is updated locally, Podman simply restarts the systemd unit executing the container. + +### `CgroupsMode=` + +The cgroups mode of the Podman container. Equivalent to the Podman `--cgroups` option. + +By default, the cgroups mode of the container created by Quadlet is `split`, +which differs from the default (`enabled`) used by the Podman CLI. + +If the container joins a pod (i.e. `Pod=` is specified), you may want to change this to +`no-conmon` or `enabled` so that pod level cgroup resource limits can take effect. + +### `ContainerName=` + +The (optional) name of the Podman container. If this is not specified, the default value +of `systemd-%N` is used, which is the same as the service name but with a `systemd-` +prefix to avoid conflicts with user-managed containers. + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `DNS=` + +Set network-scoped DNS resolver/nameserver for containers in this network. + +This key can be listed multiple times. + +### `DNSOption=` + +Set custom DNS options. + +This key can be listed multiple times. + +### `DNSSearch=` + +Set custom DNS search domains. Use **DNSSearch=.** to remove the search domain. + +This key can be listed multiple times. + +### `DropCapability=` + +Drop these capabilities from the default podman capability set, or `all` to drop all capabilities. + +This is a space separated list of capabilities. This key can be listed multiple times. + +For example: +``` +DropCapability=CAP_DAC_OVERRIDE CAP_IPC_OWNER +``` + +### `Entrypoint=` + +Override the default ENTRYPOINT from the image. +Equivalent to the Podman `--entrypoint` option. +Specify multi option commands in the form of a JSON string. + +### `Environment=` + +Set an environment variable in the container. This uses the same format as +[services in systemd](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Environment=) +and can be listed multiple times. + +### `EnvironmentFile=` + +Use a line-delimited file to set environment variables in the container. +The path may be absolute or relative to the location of the unit file. +This key may be used multiple times, and the order persists when passed to `podman run`. + +### `EnvironmentHost=` + +Use the host environment inside of the container. + +### `Exec=` + +Additional arguments for the container; this has exactly the same effect as passing +more arguments after a `podman run ` invocation. + +The format is the same as for [systemd command lines](https://www.freedesktop.org/software/systemd/man/systemd.service.html#Command%20lines), +However, unlike the usage scenario for similarly-named systemd `ExecStart=` verb +which operates on the ambient root filesystem, it is very common for container +images to have their own `ENTRYPOINT` or `CMD` metadata which this interacts with. + +The default expectation for many images is that the image will include an `ENTRYPOINT` +with a default binary, and this field will add arguments to that entrypoint. + +Another way to describe this is that it works the same way as the [args field in a Kubernetes pod](https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell). + +### `ExposeHostPort=` + +Exposes a port, or a range of ports (e.g. `50-59`), from the host to the container. Equivalent +to the Podman `--expose` option. + +This key can be listed multiple times. + +### `GIDMap=` + +Run the container in a new user namespace using the supplied GID mapping. +Equivalent to the Podman `--gidmap` option. + +This key can be listed multiple times. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `run` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Group=` + +The (numeric) GID to run as inside the container. This does not need to match the GID on the host, +which can be modified with `UserNS`, but if that is not specified, this GID is also used on the host. + +### `GroupAdd=` + +Assign additional groups to the primary user running within the container process. Also supports the `keep-groups` special flag. +Equivalent to the Podman `--group-add` option. + +### `HealthCmd=` + +Set or alter a healthcheck command for a container. A value of none disables existing healthchecks. +Equivalent to the Podman `--health-cmd` option. + +### `HealthInterval=` + +Set an interval for the healthchecks. An interval of disable results in no automatic timer setup. +Equivalent to the Podman `--health-interval` option. + +### `HealthLogDestination=` + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) +(Default: local) +Equivalent to the Podman `--health-log-destination` option. + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. + +### `HealthMaxLogCount=` + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) +(Default: 5 attempts) +Equivalent to the Podman `--Health-max-log-count` option. + +### `HealthMaxLogSize=` + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) +(Default: 500 characters) +Equivalent to the Podman `--Health-max-log-size` option. + +### `HealthOnFailure=` + +Action to take once the container transitions to an unhealthy state. +The "kill" action in combination integrates best with systemd. Once +the container turns unhealthy, it gets killed, and systemd restarts the +service. +Equivalent to the Podman `--health-on-failure` option. + +### `HealthRetries=` + +The number of retries allowed before a healthcheck is considered to be unhealthy. +Equivalent to the Podman `--health-retries` option. + +### `HealthStartPeriod=` + +The initialization time needed for a container to bootstrap. +Equivalent to the Podman `--health-start-period` option. + +### `HealthStartupCmd=` + +Set a startup healthcheck command for a container. +Equivalent to the Podman `--health-startup-cmd` option. + +### `HealthStartupInterval=` + +Set an interval for the startup healthcheck. An interval of disable results in no automatic timer setup. +Equivalent to the Podman `--health-startup-interval` option. + +### `HealthStartupRetries=` + +The number of attempts allowed before the startup healthcheck restarts the container. +Equivalent to the Podman `--health-startup-retries` option. + +### `HealthStartupSuccess=` + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. +Equivalent to the Podman `--health-startup-success` option. + +### `HealthStartupTimeout=` + +The maximum time a startup healthcheck command has to complete before it is marked as failed. +Equivalent to the Podman `--health-startup-timeout` option. + +### `HealthTimeout=` + +The maximum time allowed to complete the healthcheck before an interval is considered failed. +Equivalent to the Podman `--health-timeout` option. + +### `HostName=` + +Sets the host name that is available inside the container. +Equivalent to the Podman `--hostname` option. + +### `Image=` + +The image to run in the container. +It is recommended to use a fully qualified image name rather than a short name, both for +performance and robustness reasons. + +The format of the name is the same as when passed to `podman pull`. So, it supports using +`\:tag` or digests to guarantee the specific image version. + +Special Cases: + +* If the `name` of the image ends with `.image`, Quadlet will use the image pulled by the corresponding `.image` file, and the generated systemd service contains a dependency on the `$name-image.service` (or the service name set in the .image file). Note that the corresponding `.image` file must exist. +* If the `name` of the image ends with `.build`, Quadlet will use the image built by the corresponding `.build` file, and the generated systemd service contains a dependency on the `$name-build.service`. Note: the corresponding `.build` file must exist. + +### `IP=` + +Specify a static IPv4 address for the container, for example **10.88.64.128**. +Equivalent to the Podman `--ip` option. + +### `IP6=` + +Specify a static IPv6 address for the container, for example **fd46\:db93\:aa76\:ac37::10**. +Equivalent to the Podman `--ip6` option. + +### `Label=` + +Set one or more OCI labels on the container. The format is a list of `key=value` items, +similar to `Environment`. + +This key can be listed multiple times. + +### `LogDriver=` + +Set the log-driver used by Podman when running the container. +Equivalent to the Podman `--log-driver` option. + +### `LogOpt=` + +Set the log-opt (logging options) used by Podman when running the container. +Equivalent to the Podman `--log-opt` option. +This key can be listed multiple times. + +### `Mask=` + +Specify the paths to mask separated by a colon. `Mask=/path/1:/path/2`. A masked path cannot be accessed inside the container. + +### `Memory=` + +Specify the amount of memory for the container. + +### `Mount=` + +Attach a filesystem mount to the container. +This is equivalent to the Podman `--mount` option, and +generally has the form `type=TYPE,TYPE-SPECIFIC-OPTION[,...]`. + +Special cases: + +* For `type=volume`, if `source` ends with `.volume`, the Podman named volume generated by the corresponding `.volume` file is used. +* For `type=image`, if `source` ends with `.image`, the image generated by the corresponding `.image` file is used. + +In both cases, the generated systemd service will contain a dependency on the service generated for the corresponding unit. Note: the corresponding `.volume` or `.image` file must exist. + +This key can be listed multiple times. + +### `Network=` + +Specify a custom network for the container. This has the same format as the `--network` option +to `podman run`. For example, use `host` to use the host network in the container, or `none` to +not set up networking in the container. + +Special cases: + +* If the `name` of the network ends with `.network`, a Podman network called +`systemd-$name` is used, and the generated systemd service contains +a dependency on the `$name-network.service`. Such a network can be automatically +created by using a `$name.network` Quadlet file. Note: the corresponding `.network` file must exist. + +* If the `name` ends with `.container`, +the container will reuse the network stack of another container created by `$name.container`. +The generated systemd service contains a dependency on `$name.service`. Note: the corresponding `.container` file must exist. + +This key can be listed multiple times. + +### `NetworkAlias=` + +Add a network-scoped alias for the container. This has the same format as the `--network-alias` +option to `podman run`. Aliases can be used to group containers together in DNS resolution: for +example, setting `NetworkAlias=web` on multiple containers will make a DNS query for `web` resolve +to all the containers with that alias. + +This key can be listed multiple times. + +### `NoNewPrivileges=` (defaults to `false`) + +If enabled, this disables the container processes from gaining additional privileges via things like +setuid and file capabilities. + +### `Notify=` (defaults to `false`) + +By default, Podman is run in such a way that the systemd startup notify command is handled by +the container runtime. In other words, the service is deemed started when the container runtime +starts the child in the container. However, if the container application supports +[sd_notify](https://www.freedesktop.org/software/systemd/man/sd_notify.html), then setting +`Notify` to true passes the notification details to the container allowing it to notify +of startup on its own. + +In addition, setting `Notify` to `healthy` will postpone startup notifications until such time as +the container is marked healthy, as determined by Podman healthchecks. Note that this requires +setting up a container healthcheck, see the `HealthCmd` option for more. + +### `PidsLimit=` + +Tune the container's pids limit. +This is equivalent to the Podman `--pids-limit` option. + +### `Pod=` + +Specify a Quadlet `.pod` unit to link the container to. +The value must take the form of `.pod` and the `.pod` unit must exist. + +Quadlet will add all the necessary parameters to link between the container and the pod and between their corresponding services. + + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman run` command +in the generated file (right before the image name in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `PublishPort=` + +Exposes a port, or a range of ports (e.g. `50-59`), from the container to the host. Equivalent +to the Podman `--publish` option. The format is similar to the Podman options, which is of +the form `ip\:hostPort:containerPort`, `ip::containerPort`, `hostPort:containerPort` or +`containerPort`, where the number of host and container ports must be the same (in the case +of a range). + +If the IP is set to 0.0.0.0 or not set at all, the port is bound on all IPv4 addresses on +the host; use [::] for IPv6. + +Note that not listing a host port means that Podman automatically selects one, and it +may be different for each invocation of service. This makes that a less useful option. The +allocated port can be found with the `podman port` command. + +This key can be listed multiple times. + +### `Pull=` + +Set the image pull policy. +This is equivalent to the Podman `--pull` option + +### `ReadOnly=` (defaults to `false`) + +If enabled, makes the image read-only. + +### `ReadOnlyTmpfs=` (defaults to `true`) + +If ReadOnly is set to `true`, mount a read-write tmpfs on /dev, /dev/shm, /run, /tmp, and /var/tmp. + +### `ReloadCmd=` + +Add `ExecReload` line to the `Service` that runs ` podman exec` with this command in this container. + +In order to execute the reload run `systemctl reload ` + +Mutually exclusive with `ReloadSignal` + +### `ReloadSignal=` + +Add `ExecReload` line to the `Service` that runs `podman kill` with this signal which sends the signal to the main container process. + +In order to execute the reload run `systemctl reload ` + +Mutually exclusive with `ReloadCmd` + +### `Retry=` + +Number of times to retry the image pull when a HTTP error occurs. Equivalent to the Podman `--retry` option. + +### `RetryDelay=` + +Delay between retries. Equivalent to the Podman `--retry-delay` option. + +### `Rootfs=` + +The rootfs to use for the container. Rootfs points to a directory on the system that contains the content to be run within the container. This option conflicts with the `Image` option. + +The format of the rootfs is the same as when passed to `podman run --rootfs`, so it supports overlay mounts as well. + +Note: On SELinux systems, the rootfs needs the correct label, which is by default unconfined_u\:object_r\:container_file_t\:s0. + +### `RunInit=` (defaults to `false`) + +If enabled, the container has a minimal init process inside the +container that forwards signals and reaps processes. + +### `SeccompProfile=` + +Set the seccomp profile to use in the container. If unset, the default podman profile is used. +Set to either the pathname of a JSON file, or `unconfined` to disable the seccomp filters. + +### `Secret=` + +Use a Podman secret in the container either as a file or an environment variable. +This is equivalent to the Podman `--secret` option and generally has the form `secret[,opt=opt ...]` + +### `SecurityLabelDisable=` + +Turn off label separation for the container. + +### `SecurityLabelFileType=` + +Set the label file type for the container files. + +### `SecurityLabelLevel=` + +Set the label process level for the container processes. + +### `SecurityLabelNested=` + +Allow SecurityLabels to function within the container. This allows separation of containers created within the container. + +### `SecurityLabelType=` + +Set the label process type for the container processes. + +### `ShmSize=` + +Size of /dev/shm. + +This is equivalent to the Podman `--shm-size` option and generally has the form `number[unit]` + +### `StartWithPod=` + +Start the container after the associated pod is created. Default to **true**. + +If `true`, container will be started/stopped/restarted alongside the pod. + +If `false`, the container will not be started when the pod starts. The container will be stopped with the pod. Restarting the pod will also restart the container as long as the container was also running before. + +Note, the container can still be started manually or through a target by configuring the `[Install]` section. The pod will be started as needed in any case. + +### `StopSignal=` + +Signal to stop a container. Default is **SIGTERM**. + +This is equivalent to the Podman `--stop-signal` option + +### `StopTimeout=` + +Seconds to wait before forcibly stopping the container. + +Note, this value should be lower than the actual systemd unit timeout to make sure the podman rm command is not killed by systemd. + +This is equivalent to the Podman `--stop-timeout` option + +### `SubGIDMap=` + +Run the container in a new user namespace using the map with name in the /etc/subgid file. +Equivalent to the Podman `--subgidname` option. + +### `SubUIDMap=` + +Run the container in a new user namespace using the map with name in the /etc/subuid file. +Equivalent to the Podman `--subuidname` option. + +### `Sysctl=` + +Configures namespaced kernel parameters for the container. The format is `Sysctl=name=value`. + +This is a space separated list of kernel parameters. This key can be listed multiple times. + +For example: +``` +Sysctl=net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.all.use_tempaddr=1 +``` + +### `Timezone=` (if unset uses system-configured default) + +The timezone to run the container in. + +### `Tmpfs=` + +Mount a tmpfs in the container. This is equivalent to the Podman `--tmpfs` option, and +generally has the form `CONTAINER-DIR[\:OPTIONS]`. + +This key can be listed multiple times. + +### `UIDMap=` + +Run the container in a new user namespace using the supplied UID mapping. +Equivalent to the Podman `--uidmap` option. + +This key can be listed multiple times. + +### `Ulimit=` + +Ulimit options. Sets the ulimits values inside of the container. + +This key can be listed multiple times. + +### `Unmask=` + +Specify the paths to unmask separated by a colon. unmask=ALL or /path/1:/path/2, or shell expanded paths (/proc/*): + +If set to `ALL`, Podman will unmask all the paths that are masked or made read-only by default. + +The default masked paths are /proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux. + +The default paths that are read-only are /proc/asound, /proc/bus, /proc/fs, /proc/irq, /proc/sys, /proc/sysrq-trigger, /sys/fs/cgroup. + +### `User=` + +The (numeric) UID to run as inside the container. This does not need to match the UID on the host, +which can be modified with `UserNS`, but if that is not specified, this UID is also used on the host. + +### `UserNS=` + +Set the user namespace mode for the container. This is equivalent to the Podman `--userns` option and +generally has the form `MODE[:OPTIONS,...]`. + +### `Volume=` + +Mount a volume in the container. This is equivalent to the Podman `--volume` option, and +generally has the form `[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[:OPTIONS]]`. + +If `SOURCE-VOLUME` starts with `.`, Quadlet resolves the path relative to the location of the unit file. + +Special case: + +* If `SOURCE-VOLUME` ends with `.volume`, a Podman named volume called `systemd-$name` is used as the source, and the generated systemd service contains a dependency on the `$name-volume.service`. Note that the corresponding `.volume` file must exist. + +This key can be listed multiple times. + +### `WorkingDir=` + +Working directory inside the container. + +The default working directory for running binaries within a container is the root directory (/). The image developer can set a different default with the WORKDIR instruction. This option overrides the working directory by using the -w option. + +## Pod units [Pod] + +Pod units are named with a `.pod` extension and contain a `[Pod]` section describing +the pod that is created and run as a service. The resulting service file contains a line like +`ExecStartPre=podman pod create …`, and most of the keys in this section control the command-line +options passed to Podman. + +By default, the Podman pod has the same name as the unit, but with a `systemd-` prefix, i.e. +a `$name.pod` file creates a `$name-pod.service` unit and a `systemd-$name` Podman pod. The +`PodName` option allows for overriding this default name with a user-provided one. + +Valid options for `[Pod]` are listed below: + +| **[Pod] options** | **podman pod create equivalent** | +|-------------------------------------|----------------------------------------| +| AddHost=example\.com:192.168.10.11 | --add-host example.com:192.168.10.11 | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| DNS=192.168.55.1 | --dns=192.168.55.1 | +| DNSOption=ndots:1 | --dns-option=ndots:1 | +| DNSSearch=example.com | --dns-search example.com | +| GIDMap=0:10000:10 | --gidmap=0:10000:10 | +| GlobalArgs=--log-level=debug | --log-level=debug | +| HostName=name | --hostname=name | +| IP=192.5.0.1 | --ip 192.5.0.1 | +| IP6=2001\:db8::1 | --ip6 2001:db8::1 | +| Network=host | --network host | +| NetworkAlias=name | --network-alias name | +| PodmanArgs=\-\-cpus=2 | --cpus=2 | +| PodName=name | --name=name | +| PublishPort=8080:80 | --publish 8080:80 | +| ServiceName=name | Name the systemd unit `name.service` | +| ShmSize=100m | --shm-size=100m | +| SubGIDMap=gtest | --subgidname=gtest | +| SubUIDMap=utest | --subuidname=utest | +| UIDMap=0:10000:10 | --uidmap=0:10000:10 | +| UserNS=keep-id\:uid=200,gid=210 | --userns keep-id:uid=200,gid=210 | +| Volume=/source:/dest | --volume /source:/dest | + +Supported keys in the `[Pod]` section are: + +### `AddHost=` + +Add host-to-IP mapping to /etc/hosts. +The format is `hostname\:ip`. + +Equivalent to the Podman `--add-host` option. +This key can be listed multiple times. + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `DNS=` + +Set network-scoped DNS resolver/nameserver for containers in this pod. + +This key can be listed multiple times. + +### `DNSOption=` + +Set custom DNS options. + +This key can be listed multiple times. + +### `DNSSearch=` + +Set custom DNS search domains. Use **DNSSearch=.** to remove the search domain. + +This key can be listed multiple times. + +### `GIDMap=` + +Create the pod in a new user namespace using the supplied GID mapping. +Equivalent to the Podman `--gidmap` option. + +This key can be listed multiple times. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `pod` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `HostName=` + +Set the pod’s hostname inside all containers. + +The given hostname is also added to the /etc/hosts file using the container’s primary IP address (also see the `--add-host` option). + +Equivalent to the Podman `--hostname` option. +This key can be listed multiple times. + +### `IP=` + +Specify a static IPv4 address for the pod, for example **10.88.64.128**. +Equivalent to the Podman `--ip` option. + +### `IP6=` + +Specify a static IPv6 address for the pod, for example **fd46\:db93\:aa76\:ac37::10**. +Equivalent to the Podman `--ip6` option. + +### `Network=` + +Specify a custom network for the pod. +This has the same format as the `--network` option to `podman pod create`. +For example, use `host` to use the host network in the pod, or `none` to not set up networking in the pod. + +Special case: + +* If the `name` of the network ends with `.network`, Quadlet will look for the corresponding `.network` Quadlet unit. If found, Quadlet will use the name of the Network set in the Unit, otherwise, `systemd-$name` is used. + +The generated systemd service contains a dependency on the service unit generated for that `.network` unit. Note: the corresponding `.network` file must exist. + +This key can be listed multiple times. + +### `NetworkAlias=` + +Add a network-scoped alias for the pod. This has the same format as the `--network-alias` option to +`podman pod create`. Aliases can be used to group containers together in DNS resolution: for +example, setting `NetworkAlias=web` on multiple containers will make a DNS query for `web` resolve +to all the containers with that alias. + +This key can be listed multiple times. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman pod create` command +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `PodName=` + +The (optional) name of the Podman pod. If this is not specified, the default value +of `systemd-%N` is used, which is the same as the service name but with a `systemd-` +prefix to avoid conflicts with user-managed containers. + +Please note that pods and containers cannot have the same name. +So, if PodName is set, it must not conflict with any container. + +### `PublishPort=` + +Exposes a port, or a range of ports (e.g. `50-59`), from the pod to the host. Equivalent +to the Podman `--publish` option. The format is similar to the Podman options, which is of +the form `ip\:hostPort:containerPort`, `ip::containerPort`, `hostPort:containerPort` or +`containerPort`, where the number of host and container ports must be the same (in the case +of a range). + +If the IP is set to 0.0.0.0 or not set at all, the port is bound on all IPv4 addresses on +the host; use [::] for IPv6. + +Note that not listing a host port means that Podman automatically selects one, and it +may be different for each invocation of service. This makes that a less useful option. The +allocated port can be found with the `podman port` command. + +When using `host` networking via `Network=host`, the `PublishPort=` option cannot be used. + +This key can be listed multiple times. + + +### `ServiceName=` + +By default, Quadlet will name the systemd service unit by appending `-pod` to the name of the Quadlet. +Setting this key overrides this behavior by instructing Quadlet to use the provided name. + +Note, the name should not include the `.service` file extension + +### `ShmSize=` + +Size of /dev/shm. + +This is equivalent to the Podman `--shm-size` option and generally has the form `number[unit]` + +### `SubGIDMap=` + +Create the pod in a new user namespace using the map with name in the /etc/subgid file. +Equivalent to the Podman `--subgidname` option. + +### `SubUIDMap=` + +Create the pod in a new user namespace using the map with name in the /etc/subuid file. +Equivalent to the Podman `--subuidname` option. + +### `UIDMap=` + +Create the pod in a new user namespace using the supplied UID mapping. +Equivalent to the Podman `--uidmap` option. + +This key can be listed multiple times. + +### `UserNS=` + +Set the user namespace mode for the pod. This is equivalent to the Podman `--userns` option and +generally has the form `MODE[:OPTIONS,...]`. + +### `Volume=` + +Mount a volume in the pod. This is equivalent to the Podman `--volume` option, and +generally has the form `[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]`. + +If `SOURCE-VOLUME` starts with `.`, Quadlet resolves the path relative to the location of the unit file. + +Special case: + +* If `SOURCE-VOLUME` ends with `.volume`, Quadlet will look for the corresponding `.volume` Quadlet unit. If found, Quadlet will use the name of the Volume set in the Unit, otherwise, `systemd-$name` is used. Note: the corresponding `.volume` file must exist. + +The generated systemd service contains a dependency on the service unit generated for that `.volume` unit, +or on `$name-volume.service` if the `.volume` unit is not found. + +This key can be listed multiple times. + +## Kube units [Kube] + +Kube units are named with a `.kube` extension and contain a `[Kube]` section describing +how `podman kube play` runs as a service. The resulting service file contains a line like +`ExecStart=podman kube play … file.yml`, and most of the keys in this section control the command-line +options passed to Podman. However, some options also affect the details of how systemd is set up to run and +interact with the container. + +There is only one required key, `Yaml`, which defines the path to the Kubernetes YAML file. + +Valid options for `[Kube]` are listed below: + +| **[Kube] options** | **podman kube play equivalent** | +| ------------------------------------| -----------------------------------------------------------------| +| AutoUpdate=registry | --annotation "io.containers.autoupdate=registry" | +| ConfigMap=/tmp/config.map | --config-map /tmp/config.map | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| ExitCodePropagation=how | How to propagate container error status | +| GlobalArgs=--log-level=debug | --log-level=debug | +| KubeDownForce=true | --force (for `podman kube down`) | +| LogDriver=journald | --log-driver journald | +| Network=host | --network host | +| PodmanArgs=\-\-annotation=key=value | --annotation=key=value | +| PublishPort=8080:80 | --publish 8080:80 | +| SetWorkingDirectory=yaml | Set `WorkingDirectory` of unit file to location of the YAML file | +| UserNS=keep-id\:uid=200,gid=210 | --userns keep-id\:uid=200,gid=210 | +| Yaml=/tmp/kube.yaml | podman kube play /tmp/kube.yaml | + +Supported keys in the `[Kube]` section are: + +### `AutoUpdate=` + +Indicates whether containers will be auto-updated ([podman-auto-update(1)](podman-auto-update.1.md)). AutoUpdate can be specified multiple times. The following values are supported: + +* `registry`: Requires a fully-qualified image reference (e.g., quay.io/podman/stable:latest) to be used to create the container. This enforcement is necessary to know which images to actually check and pull. If an image ID was used, Podman does not know which image to check/pull anymore. + +* `local`: Tells Podman to compare the image a container is using to the image with its raw name in local storage. If an image is updated locally, Podman simply restarts the systemd unit executing the Kubernetes Quadlet. + +* `name/(local|registry)`: Tells Podman to perform the `local` or `registry` autoupdate on the specified container name. + +### `ConfigMap=` + +Pass the Kubernetes ConfigMap YAML path to `podman kube play` via the `--configmap` argument. +Unlike the `configmap` argument, the value may contain only one path but +it may be absolute or relative to the location of the unit file. + +This key may be used multiple times + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `ExitCodePropagation=` + +Control how the main PID of the systemd service should exit. The following values are supported: +- `all`: exit non-zero if all containers have failed (i.e., exited non-zero) +- `any`: exit non-zero if any container has failed +- `none`: exit zero and ignore failed containers + +The current default value is `none`. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `kube` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `KubeDownForce=` + +Remove all resources, including volumes, when calling `podman kube down`. +Equivalent to the Podman `--force` option. + +### `LogDriver=` + +Set the log-driver Podman uses when running the container. +Equivalent to the Podman `--log-driver` option. + +### `Network=` + +Specify a custom network for the container. This has the same format as the `--network` option +to `podman kube play`. For example, use `host` to use the host network in the container, or `none` to +not set up networking in the container. + +Special case: + +* If the `name` of the network ends with `.network`, a Podman network called `systemd-$name` is used, and the generated systemd service contains a dependency on the `$name-network.service`. Such a network can be automatically created by using a `$name.network` Quadlet file. Note: the corresponding `.network` file must exist. + +This key can be listed multiple times. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman kube play` command +in the generated file (right before the path to the yaml file in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `PublishPort=` + +Exposes a port, or a range of ports (e.g. `50-59`), from the container to the host. Equivalent +to the `podman kube play`'s `--publish` option. The format is similar to the Podman options, which is of +the form `ip\:hostPort:containerPort`, `ip::containerPort`, `hostPort:containerPort` or +`containerPort`, where the number of host and container ports must be the same (in the case +of a range). + +If the IP is set to 0.0.0.0 or not set at all, the port is bound on all IPv4 addresses on +the host; use [::] for IPv6. + +The list of published ports specified in the unit file is merged with the list of ports specified +in the Kubernetes YAML file. If the same container port and protocol is specified in both, the +entry from the unit file takes precedence + +This key can be listed multiple times. + +### `SetWorkingDirectory=` + +Set the `WorkingDirectory` field of the `Service` group of the Systemd service unit file. +Used to allow `podman kube play` to correctly resolve relative paths. +Supported values are `yaml` and `unit` to set the working directory to that of the YAML or Quadlet Unit file respectively. + +Alternatively, users can explicitly set the `WorkingDirectory` field of the `Service` group in the `.kube` file. +Please note that if the `WorkingDirectory` field of the `Service` group is set, +Quadlet will not set it even if `SetWorkingDirectory` is set + +### `UserNS=` + +Set the user namespace mode for the container. This is equivalent to the Podman `--userns` option and +generally has the form `MODE[\:OPTIONS,...]`. + +### `Yaml=` + +The path, absolute or relative to the location of the unit file, to the Kubernetes YAML file to use. + +## Network units [Network] + +Network files are named with a `.network` extension and contain a section `[Network]` describing the +named Podman network. The generated service is a one-time command that ensures that the network +exists on the host, creating it if needed. + +By default, the Podman network has the same name as the unit, but with a `systemd-` prefix, i.e. for +a network file named `$NAME.network`, the generated Podman network is called `systemd-$NAME`, and +the generated service file is `$NAME-network.service`. The `NetworkName` option allows for +overriding this default name with a user-provided one. + +Please note that stopping the corresponding service will not remove the podman network. +In addition, updating an existing network is not supported. +In order to update the network parameters you will first need to manually remove the podman network and then restart the service. + +Using network units allows containers to depend on networks being automatically pre-created. This is +particularly interesting when using special options to control network creation, as Podman otherwise creates networks with the default options. + +Valid options for `[Network]` are listed below: + +| **[Network] options** | **podman network create equivalent** | +|-------------------------------------|-----------------------------------------------------------------| +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| DisableDNS=true | --disable-dns | +| DNS=192.168.55.1 | --dns=192.168.55.1 | +| Driver=bridge | --driver bridge | +| Gateway=192.168.55.3 | --gateway 192.168.55.3 | +| GlobalArgs=--log-level=debug | --log-level=debug | +| Internal=true | --internal | +| IPAMDriver=dhcp | --ipam-driver dhcp | +| IPRange=192.168.55.128/25 | --ip-range 192.168.55.128/25 | +| IPv6=true | --ipv6 | +| Label="XYZ" | --label "XYZ" | +| NetworkDeleteOnStop=true | Add ExecStopPost to delete the network when the unit is stopped | +| NetworkName=foo | podman network create foo | +| Options=isolate=true | --opt isolate=true | +| PodmanArgs=--dns=192.168.55.1 | --dns=192.168.55.1 | +| Subnet=192.5.0.0/16 | --subnet 192.5.0.0/16 | + +Supported keys in `[Network]` section are: + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `DisableDNS=` (defaults to `false`) + +If enabled, disables the DNS plugin for this network. + +This is equivalent to the Podman `--disable-dns` option + +### `DNS=` + +Set network-scoped DNS resolver/nameserver for containers in this network. + +This key can be listed multiple times. + +### `Driver=` (defaults to `bridge`) + +Driver to manage the network. Currently `bridge`, `macvlan` and `ipvlan` are supported. + +This is equivalent to the Podman `--driver` option + +### `Gateway=` + +Define a gateway for the subnet. If you want to provide a gateway address, you must also provide a subnet option. + +This is equivalent to the Podman `--gateway` option + +This key can be listed multiple times. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `network` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Internal=` (defaults to `false`) + +Restrict external access of this network. + +This is equivalent to the Podman `--internal` option + +### `IPAMDriver=` + +Set the ipam driver (IP Address Management Driver) for the network. Currently `host-local`, `dhcp` and `none` are supported. + +This is equivalent to the Podman `--ipam-driver` option + +### `IPRange=` + +Allocate container IP from a range. The range must be a either a complete subnet in CIDR notation or be +in the `-` syntax which allows for a more flexible range compared to the CIDR subnet. +The ip-range option must be used with a subnet option. + +This is equivalent to the Podman `--ip-range` option + +This key can be listed multiple times. + +### `IPv6=` + +Enable IPv6 (Dual Stack) networking. + +This is equivalent to the Podman `--ipv6` option + +### `Label=` + +Set one or more OCI labels on the network. The format is a list of +`key=value` items, similar to `Environment`. + +This key can be listed multiple times. + +### `NetworkDeleteOnStop=` (defaults to `false`) + +When set to `true` the network is deleted when the service is stopped + +### `NetworkName=` + +The (optional) name of the Podman network. If this is not specified, the default value of +`systemd-%N` is used, which is the same as the unit name but with a `systemd-` prefix to avoid +conflicts with user-managed networks. + +### `Options=` + +Set driver specific options. + +This is equivalent to the Podman `--opt` option + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman network create` command +in the generated file (right before the name of the network in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Subnet=` + +The subnet in CIDR notation. + +This is equivalent to the Podman `--subnet` option + +This key can be listed multiple times. + +## Volume units [Volume] + +Volume files are named with a `.volume` extension and contain a section `[Volume]` describing the +named Podman volume. The generated service is a one-time command that ensures that the volume +exists on the host, creating it if needed. + +By default, the Podman volume has the same name as the unit, but with a `systemd-` prefix, i.e. for +a volume file named `$NAME.volume`, the generated Podman volume is called `systemd-$NAME`, and the +generated service file is `$NAME-volume.service`. The `VolumeName` option allows for overriding this +default name with a user-provided one. + +Using volume units allows containers to depend on volumes being automatically pre-created. This is +particularly interesting when using special options to control volume creation, +as Podman otherwise creates volumes with the default options. + +Valid options for `[Volume]` are listed below: + +| **[Volume] options** | **podman volume create equivalent** | +|-------------------------------------|-------------------------------------------| +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| Copy=true | --opt copy | +| Device=tmpfs | --opt device=tmpfs | +| Driver=image | --driver=image | +| GlobalArgs=--log-level=debug | --log-level=debug | +| Group=192 | --opt group=192 | +| Image=quay.io/centos/centos\:latest | --opt image=quay.io/centos/centos:latest | +| Label="foo=bar" | --label "foo=bar" | +| Options=XYZ | --opt "o=XYZ" | +| PodmanArgs=--driver=image | --driver=image | +| Type=type | Filesystem type of Device | +| User=123 | --opt uid=123 | +| VolumeName=foo | podman volume create foo | + +Supported keys in `[Volume]` section are: + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `Copy=` (default to `true`) + +If enabled, the content of the image located at the mountpoint of the volume is copied into the +volume on the first run. + +### `Device=` + +The path of a device which is mounted for the volume. + +### `Driver=` + +Specify the volume driver name. When set to `image`, the `Image` key must also be set. + +This is equivalent to the Podman `--driver` option. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `volume` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Group=` + +The host (numeric) GID, or group name to use as the group for the volume + +### `Image=` + +Specifies the image the volume is based on when `Driver` is set to the `image`. +It is recommended to use a fully qualified image name rather than a short name, both for +performance and robustness reasons. + +The format of the name is the same as when passed to `podman pull`. So, it supports using +`\:tag` or digests to guarantee the specific image version. + +Special case: + +* If the `name` of the image ends with `.image`, Quadlet will use the image +pulled by the corresponding `.image` file, and the generated systemd service contains a dependency on the `$name-image.service` (or the service name set in the .image file). Note: the corresponding `.image` file must exist. + +### `Label=` + +Set one or more OCI labels on the volume. The format is a list of +`key=value` items, similar to `Environment`. + +This key can be listed multiple times. + +### `Options=` + +The mount options to use for a filesystem as used by the **mount(8)** command `-o` option. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman volume create` command +in the generated file (right before the name of the volume in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Type=` + +The filesystem type of `Device` as used by the **mount(8)** commands `-t` option. + +### `User=` + +The host (numeric) UID, or user name to use as the owner for the volume + +### `VolumeName=` + +The (optional) name of the Podman volume. If this is not specified, the default value of +`systemd-%N` is used, which is the same as the unit name but with a `systemd-` prefix to avoid +conflicts with user-managed volumes. + +## Build units [Build] + +Build files are named with a `.build` extension and contain a section `[Build]` describing the image +build command. The generated service is a one-time command that ensures that the image is built on +the host from a supplied Containerfile and context directory. Subsequent (re-)starts of the +generated built service will usually finish quickly, as image layer caching will skip unchanged +build steps. + +A minimal `.build` unit needs at least the `ImageTag=` key, and either of `File=` or +`SetWorkingDirectory=` keys. + +Using build units allows containers and volumes to depend on images being built locally. This can be +interesting for creating container images not available on container registries, or for local +testing and development. + +Valid options for `[Build]` are listed below: + +| **[Build] options** | **podman build equivalent** | +|-------------------------------------|---------------------------------------------| +| Annotation=annotation=value | --annotation=annotation=value | +| Arch=aarch64 | --arch=aarch64 | +| AuthFile=/etc/registry/auth\.json | --authfile=/etc/registry/auth\.json | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| DNS=192.168.55.1 | --dns=192.168.55.1 | +| DNSOption=ndots:1 | --dns-option=ndots:1 | +| DNSSearch=example.com | --dns-search example.com | +| Environment=foo=bar | --env foo=bar | +| File=/path/to/Containerfile | --file=/path/to/Containerfile | +| ForceRM=false | --force-rm=false | +| GlobalArgs=--log-level=debug | --log-level=debug | +| GroupAdd=keep-groups | --group-add=keep-groups | +| ImageTag=localhost/imagename | --tag=localhost/imagename | +| Label=label | --label=label | +| Network=host | --network=host | +| PodmanArgs=--pull never | --pull never | +| Pull=never | --pull never | +| Retry=5 | --retry=5 | +| RetryDelay=10s | --retry-delay=10s | +| Secret=secret | --secret=id=mysecret,src=path | +| SetWorkingDirectory=unit | Set `WorkingDirectory` of systemd unit file | +| Target=my-app | --target=my-app | +| TLSVerify=false | --tls-verify=false | +| Variant=arm/v7 | --variant=arm/v7 | +| Volume=/source:/dest | --volume /source:/dest | + +### `Annotation=` + +Add an image *annotation* (e.g. annotation=*value*) to the image metadata. Can be used multiple +times. + +This is equivalent to the `--annotation` option of `podman build`. + +### `Arch=` + +Override the architecture, defaults to hosts', of the image to be built. + +This is equivalent to the `--arch` option of `podman build`. + +### `AuthFile=` + +Path of the authentication file. + +This is equivalent to the `--authfile` option of `podman build`. + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `DNS=` + +Set network-scoped DNS resolver/nameserver for the build container. + +This key can be listed multiple times. + +This is equivalent to the `--dns` option of `podman build`. + +### `DNSOption=` + +Set custom DNS options. + +This key can be listed multiple times. + +This is equivalent to the `--dns-option` option of `podman build`. + +### `DNSSearch=` + +Set custom DNS search domains. Use **DNSSearch=.** to remove the search domain. + +This key can be listed multiple times. + +This is equivalent to the `--dns-search` option of `podman build`. + +### `Environment=` + +Add a value (e.g. env=*value*) to the built image. This uses the same format as [services in +systemd](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Environment=) and can be +listed multiple times. + +### `File=` + +Specifies a Containerfile which contains instructions for building the image. A URL starting with +`http(s)://` allows you to specify a remote Containerfile to be downloaded. Note that for a given +relative path to a Containerfile, or when using a `http(s)://` URL, you also must set +`SetWorkingDirectory=` in order for `podman build` to find a valid context directory for the +resources specified in the Containerfile. + +Note that setting a `File=` field is mandatory for a `.build` file, unless `SetWorkingDirectory` (or +a `WorkingDirectory` in the `Service` group) has also been set. + +This is equivalent to the `--file` option of `podman build`. + +### `ForceRM=` + +Always remove intermediate containers after a build, even if the build fails (default true). + +This is equivalent to the `--force-rm` option of `podman build`. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `build` in the generated +file. It can be used to access Podman features otherwise unsupported by the generator. Since the +generator is unaware of what unexpected interactions can be caused by these arguments, it is not +recommended to use this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `GroupAdd=` + +Assign additional groups to the primary user running within the container process. Also supports the +`keep-groups` special flag. + +This is equivalent to the `--group-add` option of `podman build`. + +### `ImageTag=` + +Specifies the name which is assigned to the resulting image if the build process completes +successfully. + +This is equivalent to the `--tag` option of `podman build`. + +This key can be listed multiple times. The first instance will be used as the name of the created artifact when the `.build` file is referenced by another Quadlet unit. + +### `Label=` + +Add an image *label* (e.g. label=*value*) to the image metadata. Can be used multiple times. + +This is equivalent to the `--label` option of `podman build`. + +### `Network=` + +Sets the configuration for network namespaces when handling RUN instructions. This has the same +format as the `--network` option to `podman build`. For example, use `host` to use the host network, +or `none` to not set up networking. + +Special case: + +* If the `name` of the network ends with `.network`, Quadlet will look for the corresponding `.network` Quadlet unit. If found, Quadlet will use the name of the Network set in the Unit, otherwise, `systemd-$name` is used. The generated systemd service contains a dependency on the service unit generated for that `.network` unit, or on `$name-network.service` if the `.network` unit is not found. Note: the corresponding `.network` file must exist. + +This key can be listed multiple times. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman build` command +in the generated file (right before the image name in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Pull=` + +Set the image pull policy. + +This is equivalent to the `--pull` option of `podman build`. + +### `Retry=` + +Number of times to retry the image pull when a HTTP error occurs. Equivalent to the Podman `--retry` option. + +### `RetryDelay=` + +Delay between retries. Equivalent to the Podman `--retry-delay` option. + +### `Secret=` + +Pass secret information used in Containerfile build stages in a safe way. + +This is equivalent to the `--secret` option of `podman build` and generally has the form +`secret[,opt=opt ...]`. + +### `SetWorkingDirectory=` + +Provide context (a working directory) to `podman build`. Supported values are a path, a URL, or the +special keys `file` or `unit` to set the context directory to the parent directory of the file from +the `File=` key or to that of the Quadlet `.build` unit file, respectively. This allows Quadlet to +resolve relative paths. + +When using one of the special keys (`file` or `unit`), the `WorkingDirectory` field of the `Service` +group of the Systemd service unit will also be set to accordingly. Alternatively, users can +explicitly set the `WorkingDirectory` field of the `Service` group in the `.build` file. Please note +that if the `WorkingDirectory` field of the `Service` group is set by the user, Quadlet will not +overwrite it even if `SetWorkingDirectory` is set to `file` or `unit`. + +By providing a URL to `SetWorkingDirectory=` you can instruct `podman build` to clone a Git +repository or download an archive file extracted to a temporary location by `podman build` as build +context. Note that in this case, the `WorkingDirectory` of the Systemd service unit is left +untouched by Quadlet. + +Note that providing context directory is mandatory for a `.build` file, unless a `File=` key has +also been provided. + +### `Target=` + +Set the target build stage to build. Commands in the Containerfile after the target stage are +skipped. + +This is equivalent to the `--target` option of `podman build`. + +### `TLSVerify=` + +Require HTTPS and verification of certificates when contacting registries. + +This is equivalent to the `--tls-verify` option of `podman build`. + +### `Variant=` + +Override the default architecture variant of the container image to be built. + +This is equivalent to the `--variant` option of `podman build`. + +### `Volume=` + +Mount a volume to containers when executing RUN instructions during the build. This is equivalent to +the `--volume` option of `podman build`, and generally has the form +`[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[\:OPTIONS]]`. + +If `SOURCE-VOLUME` starts with `.`, Quadlet resolves the path relative to the location of the unit file. + +Special case: + +* If `SOURCE-VOLUME` ends with `.volume`, Quadlet will look for the corresponding `.volume` Quadlet unit. If found, Quadlet will use the name of the Volume set in the Unit, otherwise, `systemd-$name` is used. The generated systemd service contains a dependency on the service unit generated for that `.volume` unit, or on `$name-volume.service` if the `.volume` unit is not found. Note: the corresponding `.volume` file must exist. + +This key can be listed multiple times. + +## Image units [Image] + +Image files are named with a `.image` extension and contain a section `[Image]` describing the +container image pull command. The generated service is a one-time command that ensures that the image +exists on the host, pulling it if needed. + +Using image units allows containers and volumes to depend on images being automatically pulled. This is +particularly interesting when using special options to control image pulls. + +Valid options for `[Image]` are listed below: + +| **[Image] options** | **podman image pull equivalent** | +|----------------------------------------|--------------------------------------------------| +| AllTags=true | --all-tags | +| Arch=aarch64 | --arch=aarch64 | +| AuthFile=/etc/registry/auth\.json | --authfile=/etc/registry/auth\.json | +| CertDir=/etc/registry/certs | --cert-dir=/etc/registry/certs | +| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf | +| Creds=myname\:mypassword | --creds=myname\:mypassword | +| DecryptionKey=/etc/registry\.key | --decryption-key=/etc/registry\.key | +| GlobalArgs=--log-level=debug | --log-level=debug | +| Image=quay\.io/centos/centos\:latest | podman image pull quay.io/centos/centos\:latest | +| ImageTag=quay\.io/centos/centos\:latest | Use this name when resolving `.image` references | +| OS=windows | --os=windows | +| PodmanArgs=--os=linux | --os=linux | +| Retry=5 | --retry=5 | +| RetryDelay=10s | --retry-delay=10s | +| TLSVerify=false | --tls-verify=false | +| Variant=arm/v7 | --variant=arm/v7 | + +### `AllTags=` + +All tagged images in the repository are pulled. + +This is equivalent to the Podman `--all-tags` option. + +### `Arch=` + +Override the architecture, defaults to hosts, of the image to be pulled. + +This is equivalent to the Podman `--arch` option. + +### `AuthFile=` + +Path of the authentication file. + +This is equivalent to the Podman `--authfile` option. + +### `CertDir=` + +Use certificates at path (*.crt, *.cert, *.key) to connect to the registry. + +This is equivalent to the Podman `--cert-dir` option. + +### `ContainersConfModule=` + +Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option. + +This key can be listed multiple times. + +### `Creds=` + +The `[username[:password]]` to use to authenticate with the registry, if required. + +This is equivalent to the Podman `--creds` option. + +### `DecryptionKey=` + +The `[key[:passphrase]]` to be used for decryption of images. + +This is equivalent to the Podman `--decryption-key` option. + +### `GlobalArgs=` + +This key contains a list of arguments passed directly between `podman` and `image` +in the generated file. It can be used to access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Image=` + +The image to pull. +It is recommended to use a fully qualified image name rather than a short name, both for +performance and robustness reasons. + +The format of the name is the same as when passed to `podman pull`. So, it supports using +`:tag` or digests to guarantee the specific image version. + +### `ImageTag=` + +Actual FQIN of the referenced `Image`. +Only meaningful when source is a file or directory archive. + +For example, an image saved into a `docker-archive` with the following Podman command: + +`podman image save --format docker-archive --output /tmp/archive-file.tar quay.io/podman/stable:latest` + +requires setting +- `Image=docker-archive:/tmp/archive-file.tar` +- `ImageTag=quay.io/podman/stable\:latest` + +### `OS=` + +Override the OS, defaults to hosts, of the image to be pulled. + +This is equivalent to the Podman `--os` option. + +### `PodmanArgs=` + +This key contains a list of arguments passed directly to the end of the `podman image pull` command +in the generated file (right before the image name in the command line). It can be used to +access Podman features otherwise unsupported by the generator. Since the generator is unaware +of what unexpected interactions can be caused by these arguments, it is not recommended to use +this option. + +The format of this is a space separated list of arguments, which can optionally be individually +escaped to allow inclusion of whitespace and other control characters. + +This key can be listed multiple times. + +### `Retry=` + +Number of times to retry the image pull when a HTTP error occurs. Equivalent to the Podman `--retry` option. + +### `RetryDelay=` + +Delay between retries. Equivalent to the Podman `--retry-delay` option. + +### `TLSVerify=` + +Require HTTPS and verification of certificates when contacting registries. + +This is equivalent to the Podman `--tls-verify` option. + +### `Variant=` + +Override the default architecture variant of the container image. + +This is equivalent to the Podman `--variant` option. + +## Quadlet section [Quadlet] +Some quadlet specific configuration is shared between different unit types. Those settings +can be configured in the `[Quadlet]` section. + +Valid options for `[Quadlet]` are listed below: + +| **[Quadlet] options** | **Description** | +|----------------------------|---------------------------------------------------| +| DefaultDependencies=false | Disable implicit network dependencies to the unit | + +### `DefaultDependencies=` + +Add Quadlet's default network dependencies to the unit (default is `true`). + +When set to false, Quadlet will **not** add a dependency (After=, Wants=) to +`network-online.target`/`podman-user-wait-network-online.service` to the generated unit. + +Note, this option is set in the `[Quadlet]` section. The _systemd_ `[Unit]` section +has an option with the same name but a different meaning. + +## EXAMPLES + +Example `test.container`: + +``` +[Unit] +Description=A minimal container + +[Container] +# Use the centos image +Image=quay.io/centos/centos:latest + +# Use volume and network defined below +Volume=test.volume:/data +Network=test.network + +# In the container we just run sleep +Exec=sleep 60 + +[Service] +# Restart service when sleep finishes +Restart=always +# Extend Timeout to allow time to pull the image +TimeoutStartSec=900 +# ExecStartPre flag and other systemd commands can go here, see systemd.unit(5) man page. +ExecStartPre=/usr/share/mincontainer/setup.sh + +[Install] +# Start by default on boot +WantedBy=multi-user.target default.target +``` + +Example `test.kube`: +``` +[Unit] +Description=A kubernetes yaml based service +Before=local-fs.target + +[Kube] +Yaml=/opt/k8s/deployment.yml + +[Install] +# Start by default on boot +WantedBy=multi-user.target default.target +``` + +Example for locally built image to be used in a container: + +`test.build` +``` +[Build] +# Tag the image to be built +ImageTag=localhost/imagename + +# Set the working directory to the path of the unit file, +# expecting to find a Containerfile/Dockerfile +# + other files needed to build the image +SetWorkingDirectory=unit +``` + +`test.container` +``` +[Container] +Image=test.build +``` + +Example `test.volume`: + +``` +[Volume] +User=root +Group=root +Label=org.test.Key=value +``` + +Example `test.network`: +``` +[Network] +Subnet=172.16.0.0/24 +Gateway=172.16.0.1 +IPRange=172.16.0.0/28 +Label=org.test.Key=value +``` + +Example for Container in a Pod: + +`test.pod` +``` +[Pod] +PodName=test +``` + +`centos.container` +``` +[Container] +Image=quay.io/centos/centos\:latest +Exec=sh -c "sleep inf" +Pod=test.pod +``` + +Example `s3fs.volume`: + +For further details, please see the [s3fs-fuse](https://github.com/s3fs-fuse/s3fs-fuse) project. +Remember to read the [FAQ](https://github.com/s3fs-fuse/s3fs-fuse/wiki/FAQ) + +> NOTE: Enabling the cache massively speeds up access and write times on static files/objects. + +> However, `use_cache` is [UNBOUNDED](https://github.com/s3fs-fuse/s3fs-fuse/wiki/FAQ#q-how-does-the-local-file-cache-work)! + +> Be careful, it will fill up with any files accessed on the s3 bucket through the file system. + +Please remember to set `S3_BUCKET`, `PATH`, `AWS_REGION`. `CACHE_DIRECTORY` should be set up by [systemd](https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#RuntimeDirectory=) + +``` +[Service] +CacheDirectory=s3fs +ExecStartPre=/usr/local/bin/aws s3api put-object --bucket ${S3_BUCKET} --key ${PATH}/ + +[Volume] +Device=${S3_BUCKET}:/${PATH} +Type=fuse.s3fs +VolumeName=s3fs-volume +Options=iam_role,endpoint=${AWS_REGION},use_xattr,listobjectsv2,del_cache,use_cache=${CACHE_DIRECTORY} +# `iam_role` assumes inside EC2, if not, Use `profile=` instead +``` + +## SEE ALSO +**[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)**, +**[systemd.service(5)](https://www.freedesktop.org/software/systemd/man/systemd.service.html)**, +**[systemd-analyze(1)](https://www.freedesktop.org/software/systemd/man/latest/systemd-analyze.html)**, +**[podman-run(1)](podman-run.1.md)**, +**[podman-network-create(1)](podman-network-create.1.md)**, +**[podman-auto-update(1)](podman-auto-update.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-tag.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-tag.1.md new file mode 100644 index 000000000..2c096cbfa --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-tag.1.md @@ -0,0 +1,51 @@ +--- +title: podman-tag +version: v5.5.2 +--- + +% podman-tag 1 + +## NAME +podman\-tag - Add an additional name to a local image + +## SYNOPSIS +**podman tag** *image*[:*tag*] [*target-name*[:*tag*]...] [*options*] + +**podman image tag** *image*[:*tag*] [*target-name*[:*tag*]...] [*options*] + +## DESCRIPTION +Assigns a new image name to an existing image. A full name refers to the entire +image name, including the optional *tag* after the `:`. If there is no *tag* +provided, then Podman defaults to `latest` for both the *image* and the +*target-name*. + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Tag specified image with an image name defaulting to :latest. +``` +$ podman tag 0e3bbc2 fedora:latest +``` + +Tag specified image with fully specified image name. +``` +$ podman tag httpd myregistryhost:5000/fedora/httpd\:v2 +``` + +Tag specified image with multiple tags. +``` +$ podman tag mymariadb mycontainerregistry.io/namespace/mariadb:10 mycontainerregistry.io/namespace/mariadb:10.11 mycontainerregistry.io/namespace/mariadb:10.11.12 +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +December 2019, Update description to refer to 'name' instead of 'alias' by Sascha Grunert +July 2017, Originally compiled by Ryan Cole diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-top.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-top.1.md new file mode 100644 index 000000000..6bc9e86e0 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-top.1.md @@ -0,0 +1,125 @@ +--- +title: podman-top +version: v5.5.2 +--- + +% podman-top 1 + +## NAME +podman\-top - Display the running processes of a container + +## SYNOPSIS +**podman top** [*options*] *container* [*format-descriptors*] + +**podman container top** [*options*] *container* [*format-descriptors*] + +## DESCRIPTION +Display the running processes of the container. The *format-descriptors* are ps (1) compatible AIX format +descriptors but extended to print additional information, such as the seccomp mode or the effective capabilities +of a given process. The descriptors can either be passed as separated arguments or as a single comma-separated +argument. Note that options and or flags of ps(1) can also be specified; in this case, Podman falls back to +executing ps(1) from the host with the specified arguments and flags in the container namespace. If the container +has the `CAP_SYS_PTRACE` capability then we will execute ps(1) in the container so it must be installed there. +To extract host-related information, use the "h*" descriptors. For instance, `podman top $name hpid huser` +to display the PID and user of the processes in the host context. + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## FORMAT DESCRIPTORS + +The following descriptors are supported in addition to the AIX format descriptors mentioned in ps (1): + +**args, capbnd, capeff, capinh, capprm, comm, etime, group, hgroup, hpid, huser, label, nice, pcpu, pgid, pid, ppid, rgroup, ruser, seccomp, state, time, tty, user, vsz** + +**capbnd** + + Set of bounding capabilities. See capabilities (7) for more information. + +**capeff** + + Set of effective capabilities. See capabilities (7) for more information. + +**capinh** + + Set of inheritable capabilities. See capabilities (7) for more information. + +**capprm** + + Set of permitted capabilities. See capabilities (7) for more information. + +**hgroup** + + The corresponding effective group of a container process on the host. + +**hpid** + + The corresponding host PID of a container process. + +**huser** + + The corresponding effective user of a container process on the host. + +**label** + + Current security attributes of the process. + +**seccomp** + + Seccomp mode of the process (i.e., disabled, strict or filter). See seccomp (2) for more information. + +**state** + + Process state codes (e.g, **R** for *running*, **S** for *sleeping*). See proc(5) for more information. + +**stime** + + Process start time (e.g, "2019-12-09 10:50:36 +0100 CET). + +## EXAMPLES + +By default, `podman-top` prints data similar to `ps -ef`. +``` +$ podman top f5a62a71b07 +USER PID PPID %CPU ELAPSED TTY TIME COMMAND +root 1 0 0.000 20.386825206s pts/0 0s sh +root 7 1 0.000 16.386882887s pts/0 0s sleep +root 8 1 0.000 11.386886562s pts/0 0s vi +``` + +The output can be controlled by specifying format descriptors as arguments after the container. +``` +$ podman top -l pid seccomp args %C +PID SECCOMP COMMAND %CPU +1 filter sh 0.000 +8 filter vi /etc/ 0.000 +``` + +Podman falls back to executing ps(1) from the host in the container namespace if an unknown descriptor is specified. +``` +$ podman top -l -- aux +USER PID PPID %CPU ELAPSED TTY TIME COMMAND +root 1 0 0.000 1h2m12.497061672s ? 0s sleep 100000 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **ps(1)**, **seccomp(2)**, **proc(5)**, **capabilities(7)** + +## HISTORY +July 2018, Introduce format descriptors by Valentin Rothberg + +December 2017, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-troubleshooting.7.md b/versioned_docs/version-5.5.2/source/markdown/podman-troubleshooting.7.md new file mode 100644 index 000000000..c85ed02c7 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-troubleshooting.7.md @@ -0,0 +1,1552 @@ +--- +title: Troubleshooting +version: v5.5.2 +--- + +% podman-troubleshooting 7 + + +# Troubleshooting + +## A list of common issues and solutions for Podman + +--- +### 1) Variety of issues - Validate Version + +A large number of issues reported against Podman are often found to already be fixed +in more current versions of the project. Before reporting an issue, please verify the +version you are running with `podman version` and compare it to the latest release +documented on the top of Podman's [README.md](README.md). + +If they differ, please update your version of PODMAN to the latest possible +and retry your command before reporting the issue. + +--- +### 2) Can't use volume mount, get permission denied + +```console +$ podman run -v ~/mycontent:/content fedora touch /content/file +touch: cannot touch '/content/file': Permission denied +``` + +#### Solution + +This is sometimes caused by SELinux, and sometimes by user namespaces. + +Labeling systems like SELinux require that proper labels are placed on volume +content mounted into a container. Without a label, the security system might +prevent the processes running inside the container from using the content. By +default, Podman does not change the labels set by the OS. + +To change a label in the container context, you can add either of two suffixes +**\:z** or **\:Z** to the volume mount. These suffixes tell Podman to relabel file +objects on the shared volumes. The **z** option tells Podman that two containers +share the volume content. As a result, Podman labels the content with a shared +content label. Shared volume labels allow all containers to read/write content. +The **Z** option tells Podman to label the content with a private unshared label. +Only the current container can use a private volume. + +```console +$ podman run -v ~/mycontent:/content\:Z fedora touch /content/file +``` + +Make sure the content is private for the container. Do not relabel system directories and content. +Relabeling system content might cause other confined services on your machine to fail. For these +types of containers we recommend having SELinux separation disabled. The option `--security-opt label=disable` +will disable SELinux separation for the container. + +```console +$ podman run --security-opt label=disable -v ~:/home/user fedora touch /home/user/file +``` + +In cases where the container image runs as a specific, non-root user, though, the +solution is to fix the user namespace. This would include container images such as +the Jupyter Notebook image (which runs as "jovyan") and the Postgres image (which runs +as "postgres"). In either case, use the `--userns` switch to map user namespaces, +most of the time by using the **keep-id** option. + +```console +$ podman run -v "$PWD":/home/jovyan/work --userns=keep-id jupyter/scipy-notebook +``` + +--- +### 3) No such image or Bare keys cannot contain ':' + +When doing a `podman pull` or `podman build` command and a "common" image cannot be pulled, +it is likely that the `/etc/containers/registries.conf` file is either not installed or possibly +misconfigured. + +#### Symptom + +```console +$ sudo podman build -f Dockerfile +STEP 1: FROM alpine +error building: error creating build container: no such image "alpine" in registry: image not known +``` + +or + +```console +$ sudo podman pull fedora +error pulling image "fedora": unable to pull fedora: error getting default registries to try: Near line 9 (last key parsed ''): Bare keys cannot contain ':'. +``` + +#### Solution + + * Verify that the `/etc/containers/registries.conf` file exists. If not, verify that the containers-common package is installed. + * Verify that the entries in the `unqualified-search-registries` list of the `/etc/containers/registries.conf` file are valid and reachable. + * i.e. `unqualified-search-registries = ["registry.fedoraproject.org", "quay.io", "registry.access.redhat.com"]` + +--- +### 4) http: server gave HTTP response to HTTPS client + +When doing a Podman command such as `build`, `commit`, `pull`, or `push` to a registry, +TLS verification is turned on by default. If encryption is not used with +those commands, this error can occur. + +#### Symptom + +```console +$ sudo podman push alpine docker://localhost:5000/myalpine\:latest +Getting image source signatures +Get https://localhost:5000/v2/: http: server gave HTTP response to HTTPS client +``` + +#### Solution + +By default TLS verification is turned on when communicating to registries from +Podman. If the registry does not require encryption the Podman commands +such as `build`, `commit`, `pull` and `push` will fail unless TLS verification is turned +off using the `--tls-verify` option. **NOTE:** It is not at all recommended to +communicate with a registry and not use TLS verification. + + * Turn off TLS verification by passing false to the tls-verify option. + * I.e. `podman push --tls-verify=false alpine docker://localhost:5000/myalpine\:latest` + + +For a global workaround, users[1] can create the file `/etc/containers/registries.conf.d/registry-NAME.conf` +(replacing NAME with the name of this registry) with the following content (replacing FULLY.QUALIFIED.NAME.OF.REGISTRY with the address of this registry): + +``` +[[registry]] +location = "FULLY.QUALIFIED.NAME.OF.REGISTRY" +insecure = true +``` + +[1] If you are using a Mac / Windows, you should execute `podman machine ssh` to login into podman machine before adding the insecure entry to the registry—conf file. + +**This is an insecure method and should be used cautiously.** + +--- +### 5) rootless containers cannot ping hosts + +When using the ping command from a non-root container, the command may +fail because of a lack of privileges. + +#### Symptom + +```console +$ podman run --rm fedora ping -W10 -c1 redhat.com +PING redhat.com (209.132.183.105): 56 data bytes + +--- redhat.com ping statistics --- +1 packets transmitted, 0 packets received, 100% packet loss +``` + +#### Solution + +It is most likely necessary to enable unprivileged pings on the host. +Be sure the UID of the user is part of the range in the +`/proc/sys/net/ipv4/ping_group_range` file. + +To change its value you can use something like: + +```console +# sysctl -w "net.ipv4.ping_group_range=0 2000000" +``` + +To make the change persistent, you'll need to add a file in +`/etc/sysctl.d` that contains `net.ipv4.ping_group_range=0 $MAX_UID`. + +--- +### 6) Build hangs when the Dockerfile contains the useradd command + +When the Dockerfile contains a command like `RUN useradd -u 99999000 -g users newuser` the build can hang. + +#### Symptom + +If you are using a useradd command within a Dockerfile with a large UID/GID, it will create a large sparse file `/var/log/lastlog`. This can cause the build to hang forever. Go language does not support sparse files correctly, which can lead to some huge files being created in your container image. + +#### Solution + +If the entry in the Dockerfile looked like: RUN useradd -u 99999000 -g users newuser then add the `--no-log-init` parameter to change it to: `RUN useradd --no-log-init -u 99999000 -g users newuser`. This option tells useradd to stop creating the lastlog file. + +### 7) Permission denied when running Podman commands + +When rootless Podman attempts to execute a container on a non exec home directory a permission error will be raised. + +#### Symptom + +If you are running Podman or Buildah on a home directory that is mounted noexec, +then they will fail with a message like: + +```console +$ podman run centos:7 +standard_init_linux.go:203: exec user process caused "permission denied" +``` + +#### Solution + +Since the administrator of the system set up your home directory to be noexec, you will not be allowed to execute containers from storage in your home directory. It is possible to work around this by manually specifying a container storage path that is not on a noexec mount. Simply copy the file /etc/containers/storage.conf to ~/.config/containers/ (creating the directory if necessary). Specify a graphroot directory which is not on a noexec mount point and to which you have read/write privileges. You will need to modify other fields to writable directories as well. + +For example + +```console +$ cat ~/.config/containers/storage.conf +[storage] + driver = "overlay" + runroot = "/run/user/1000" + graphroot = "/execdir/myuser/storage" + [storage.options] + mount_program = "/bin/fuse-overlayfs" +``` + +### 8) Permission denied when running systemd within a Podman container + +When running systemd as PID 1 inside of a container on an SELinux +separated machine, it needs to write to the cgroup file system. + +#### Symptom + +Systemd gets permission denied when attempting to write to the cgroup file +system, and AVC messages start to show up in the audit.log file or journal on +the system. + +#### Solution + +Newer versions of Podman (2.0 or greater) support running init based containers +with a different SELinux labels, which allow the container process access to the +cgroup file system. This feature requires container-selinux-2.132 or newer +versions. + +Prior to Podman 2.0, the SELinux boolean `container_manage_cgroup` allows +container processes to write to the cgroup file system. Turn on this boolean, +on SELinux separated systems, to allow systemd to run properly in the container. +Only do this on systems running older versions of Podman. + +```console +# setsebool -P container_manage_cgroup true +``` + +### 9) Newuidmap missing when running rootless Podman commands + +Rootless Podman requires the newuidmap and newgidmap programs to be installed. + +#### Symptom + +If you are running Podman or Buildah as a rootless user, you get an error complaining about +a missing newuidmap executable. + +```console +$ podman run -ti fedora sh +command required for rootless mode with multiple IDs: exec: "newuidmap": executable file not found in $PATH +``` + +#### Solution + +Install a version of shadow-utils that includes these executables. Note that for RHEL and CentOS 7, at least the 7.7 release must be installed for support to be available. + +### 10) rootless setup user: invalid argument + +Rootless Podman requires the user running it to have a range of UIDs listed in /etc/subuid and /etc/subgid. + +#### Symptom + +A user, either via --user or through the default configured for the image, is not mapped inside the namespace. + +```console +$ podman run --rm -ti --user 1000000 alpine echo hi +Error: container create failed: container_linux.go:344: starting container process caused "setup user: invalid argument" +``` + +#### Solution + +Update the /etc/subuid and /etc/subgid with fields for users that look like: + +```console +$ cat /etc/subuid +johndoe:100000:65536 +test:165536:65536 +``` + +The format of this file is `USERNAME\:UID\:RANGE` + +* username as listed in `/etc/passwd` or `getpwent`. +* The initial uid allocated for the user. +* The size of the range of UIDs allocated for the user. + +This means johndoe is allocated UIDs 100000-165535 as well as his standard UID in the +`/etc/passwd` file. + +You should ensure that each user has a unique range of UIDs, because overlapping UIDs, +would potentially allow one user to attack another user. In addition, make sure +that the range of UIDs you allocate can cover all UIDs that the container +requires. For example, if the container has a user with UID 10000, ensure you +have at least 10000 subuids, and if the container needs to be run as a user with +UID 1000000, ensure you have at least 1000000 subuids. + +You could also use the `usermod` program to assign UIDs to a user. + +If you update either the `/etc/subuid` or `/etc/subgid` file, you need to +stop all running containers and kill the pause process. This is done +automatically by the `system migrate` command, which can also be used +to stop all the containers and kill the pause process. + +```console +# usermod --add-subuids 200000-201000 --add-subgids 200000-201000 johndoe +# grep johndoe /etc/subuid /etc/subgid +/etc/subuid:johndoe:200000:1001 +/etc/subgid:johndoe:200000:1001 +``` + +### 11) Changing the location of the Graphroot leads to permission denied + +When I change the graphroot storage location in storage.conf, the next time I +run Podman, I get an error like: + +```console +# podman run -p 5000:5000 -it centos bash + +bash: error while loading shared libraries: /lib64/libc.so.6: cannot apply additional memory protection after relocation: Permission denied +``` + +For example, the admin sets up a spare disk to be mounted at `/src/containers`, +and points storage.conf at this directory. + + +#### Symptom + +SELinux blocks containers from using arbitrary locations for overlay storage. +These directories need to be labeled with the same labels as if the content was +under `/var/lib/containers/storage`. + +#### Solution + +Tell SELinux about the new containers storage by setting up an equivalence record. +This tells SELinux to label content under the new path, as if it was stored +under `/var/lib/containers/storage`. + +```console +# semanage fcontext -a -e /var/lib/containers /srv/containers +# restorecon -R -v /srv/containers +``` + +The semanage command above tells SELinux to set up the default labeling of +`/srv/containers` to match `/var/lib/containers`. The `restorecon` command +tells SELinux to apply the labels to the actual content. + +Now all new content created in these directories will automatically be created +with the correct label. + +### 12) Anonymous image pull fails with 'invalid username/password' + +Pulling an anonymous image that doesn't require authentication can result in an +`invalid username/password` error. + +#### Symptom + +If you pull an anonymous image, one that should not require credentials, you can receive +an `invalid username/password` error if you have credentials established in the +authentication file for the target container registry that are no longer valid. + +```console +$ podman run -it --rm docker://docker.io/library/alpine:latest ls +Trying to pull docker://docker.io/library/alpine:latest...ERRO[0000] Error pulling image ref //alpine:latest: Error determining manifest MIME type for docker://alpine:latest: unable to retrieve auth token: invalid username/password +Failed +Error: unable to pull docker://docker.io/library/alpine:latest: unable to pull image: Error determining manifest MIME type for docker://alpine:latest: unable to retrieve auth token: invalid username/password +``` + +This can happen if the authentication file is modified 'by hand' or if the credentials +are established locally and then the password is updated later in the container registry. + +#### Solution + +Depending upon which container tool was used to establish the credentials, use `podman logout` +or `docker logout` to remove the credentials from the authentication file. + +### 13) Running Podman inside a container causes container crashes and inconsistent states + +Running Podman in a container and forwarding some, but not all, of the required host directories can cause inconsistent container behavior. + +#### Symptom + +After creating a container with Podman's storage directories mounted in from the host and running Podman inside a container, all containers show their state as "configured" or "created", even if they were running or stopped. + +#### Solution + +When running Podman inside a container, it is recommended to mount at a minimum `/var/lib/containers/storage/` as a volume. +Typically, you will not mount in the host version of the directory, but if you wish to share containers with the host, you can do so. +If you do mount in the host's `/var/lib/containers/storage`, however, you must also mount in the host's `/run/libpod` and `/run/containers/storage` directories. +Not doing this will cause Podman in the container to detect that temporary files have been cleared, leading it to assume a system restart has taken place. +This can cause Podman to reset container states and lose track of running containers. + +For running containers on the host from inside a container, we also recommend the [Podman remote client](docs/tutorials/remote_client.md), which only requires a single socket to be mounted into the container. + +### 14) Rootless 'podman build' fails EPERM on NFS: + +NFS enforces file creation on different UIDs on the server side and does not understand user namespace, which rootless Podman requires. +When a container root process like YUM attempts to create a file owned by a different UID, NFS Server denies the creation. +NFS is also a problem for the file locks when the storage is on it. Other distributed file systems (for example: Lustre, Spectrum Scale, the General Parallel File System (GPFS)) are also not supported when running in rootless mode as these file systems do not understand user namespace. + +#### Symptom +```console +$ podman build . +ERRO[0014] Error while applying layer: ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied +error creating build container: Error committing the finished image: error adding layer with blob "sha256\:a02a4930cb5d36f3290eb84f4bfa30668ef2e9fe3a1fb73ec015fc58b9958b17": ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied +``` + +#### Solution +Choose one of the following: + * Set up containers/storage in a different directory, not on an NFS share. + * Create a directory on a local file system. + * Edit `~/.config/containers/containers.conf` and point the `volume_path` option to that local directory. (Copy `/usr/share/containers/containers.conf` if `~/.config/containers/containers.conf` does not exist) + * Otherwise just run Podman as root, via `sudo podman` + +### 15) Rootless 'podman build' fails when using OverlayFS: + +The Overlay file system (OverlayFS) requires the ability to call the `mknod` command when creating whiteout files +when extracting an image. However, a rootless user does not have the privileges to use `mknod` in this capacity. + +#### Symptom +```console +$ podman build --storage-driver overlay . +STEP 1: FROM docker.io/ubuntu\:xenial +Getting image source signatures +Copying blob edf72af6d627 done +Copying blob 3e4f86211d23 done +Copying blob 8d3eac894db4 done +Copying blob f7277927d38a done +Copying config 5e13f8dd4c done +Writing manifest to image destination +Storing signatures +Error: creating build container: Error committing the finished image: error adding layer with blob "sha256:8d3eac894db4dc4154377ad28643dfe6625ff0e54bcfa63e0d04921f1a8ef7f8": Error processing tar file(exit status 1): operation not permitted +$ podman build . +ERRO[0014] Error while applying layer: ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied +error creating build container: Error committing the finished image: error adding layer with blob "sha256\:a02a4930cb5d36f3290eb84f4bfa30668ef2e9fe3a1fb73ec015fc58b9958b17": ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied +``` + +#### Solution +Choose one of the following: + * Complete the build operation as a privileged user. + * Install and configure fuse-overlayfs. + * Install the fuse-overlayfs package for your Linux Distribution. + * Add `mount_program = "/usr/bin/fuse-overlayfs"` under `[storage.options]` in your `~/.config/containers/storage.conf` file. + +### 16) RHEL 7 and CentOS 7 based `init` images don't work with cgroup v2 + +The systemd version shipped in RHEL 7 and CentOS 7 doesn't have support for cgroup v2. Support for cgroup v2 requires version 230 of systemd or newer, which +was never shipped or supported on RHEL 7 or CentOS 7. + +#### Symptom +```console +# podman run --name test -d registry.access.redhat.com/rhel7-init\:latest && sleep 10 && podman exec test systemctl status +c8567461948439bce72fad3076a91ececfb7b14d469bfa5fbc32c6403185beff +Failed to get D-Bus connection: Operation not permitted +Error: non zero exit code: 1: OCI runtime error +``` + +#### Solution +You'll need to either: + +* configure the host to use cgroup v1. On Fedora you can do: + +```console +# dnf install -y grubby +# grubby --update-kernel=ALL --args=”systemd.unified_cgroup_hierarchy=0" +# reboot +``` + +* update the image to use an updated version of systemd. + +### 17) rootless containers exit once the user session exits + +You need to set lingering mode through loginctl to prevent user processes to be killed once +the user session completed. + +#### Symptom + +Once the user logs out all the containers exit. + +#### Solution + +```console +# loginctl enable-linger $UID +``` + +### 18) `podman run` fails with "bpf create: permission denied error" + +The Kernel Lockdown patches deny eBPF programs when Secure Boot is enabled in the BIOS. [Matthew Garrett's post](https://mjg59.dreamwidth.org/50577.html) describes the relationship between Lockdown and Secure Boot and [Jan-Philip Gehrcke's](https://gehrcke.de/2019/09/running-an-ebpf-program-may-require-lifting-the-kernel-lockdown/) connects this with eBPF. [RH bug 1768125](https://bugzilla.redhat.com/show_bug.cgi?id=1768125) contains some additional details. + +#### Symptom + +Attempts to run podman result in + +```Error: bpf create : Operation not permitted: OCI runtime permission denied error``` + +#### Solution + +One workaround is to disable Secure Boot in your BIOS. + +### 19) error creating libpod runtime: there might not be enough IDs available in the namespace + +Unable to pull images + +#### Symptom + +```console +$ podman unshare cat /proc/self/uid_map + 0 1000 1 +``` + +#### Solution + +```console +$ podman system migrate +``` + +Original command now returns + +```console +$ podman unshare cat /proc/self/uid_map + 0 1000 1 + 1 100000 65536 +``` + +Reference [subuid](https://man7.org/linux/man-pages/man5/subuid.5.html) and [subgid](https://man7.org/linux/man-pages/man5/subgid.5.html) man pages for more detail. + +### 20) Passed-in devices or files can't be accessed in rootless container + +As a non-root user you have group access rights to a device or files that you +want to pass into a rootless container with `--device=...` or `--volume=...` + +#### Symptom + +Any access inside the container is rejected with "Permission denied". + +#### Solution + +The runtime uses `setgroups(2)` hence the process loses all additional groups +the non-root user has. Use the `--group-add keep-groups` flag to pass the +user's supplementary group access into the container. Currently only available +with the `crun` OCI runtime. + +### 21) A rootless container running in detached mode is closed at logout + + +When running a container with a command like `podman run --detach httpd` as +a rootless user, the container is closed upon logout and is not kept running. + +#### Symptom + +When logging out of a rootless user session, all containers that were started +in detached mode are stopped and are not kept running. As the root user, these +same containers would survive the logout and continue running. + +#### Solution + +When systemd notes that a session that started a Podman container has exited, +it will also stop any containers that have been associated with it. To avoid +this, use the following command before logging out: `loginctl enable-linger`. +To later revert the linger functionality, use `loginctl disable-linger`. + +LOGINCTL(1), SYSTEMD(1) + +### 22) Containers default detach keys conflict with shell history navigation + +Podman defaults to `ctrl-p,ctrl-q` to detach from a running containers. The +bash and zsh shells default to `ctrl-p` for the displaying of the previous +command. This causes issues when running a shell inside of a container. + +#### Symptom + +With the default detach key combo ctrl-p,ctrl-q, shell history navigation +(tested in bash and zsh) using ctrl-p to access the previous command will not +display this previous command, or anything else. Conmon is waiting for an +additional character to see if the user wants to detach from the container. +Adding additional characters to the command will cause it to be displayed along +with the additional character. If the user types ctrl-p a second time the shell +display the 2nd to last command. + +#### Solution + +The solution to this is to change the default detach_keys. For example in order +to change the defaults to `ctrl-q,ctrl-q` use the `--detach-keys` option. + +```console +$ podman run -ti --detach-keys ctrl-q,ctrl-q fedora sh +``` + +To make this change the default for all containers, users can modify the +containers.conf file. This can be done simply in your home directory, but adding the +following lines to users containers.conf + +```console +$ cat >> ~/.config/containers/containers.conf << _eof +[engine] +detach_keys="ctrl-q,ctrl-q" +_eof +``` + +In order to effect root running containers and all users, modify the system +wide defaults in `/etc/containers/containers.conf`. + + +### 23) Container with exposed ports won't run in a pod + +A container with ports that have been published with the `--publish` or `-p` option +can not be run within a pod. + +#### Symptom + +```console +$ podman pod create --name srcview -p 127.0.0.1:3434:3434 -p 127.0.0.1:7080:7080 -p 127.0.0.1:3370:3370 4b2f4611fa2cbd60b3899b936368c2b3f4f0f68bc8e6593416e0ab8ecb0a3f1d + +$ podman run --pod srcview --name src-expose -p 3434:3434 -v "${PWD}:/var/opt/localrepo":Z,ro sourcegraph/src-expose:latest serve /var/opt/localrepo +Error: cannot set port bindings on an existing container network namespace +``` + +#### Solution + +This is a known limitation. If a container will be run within a pod, it is not necessary +to publish the port for the containers in the pod. The port must only be published by the +pod itself. Pod network stacks act like the network stack on the host - you have a +variety of containers in the pod, and programs in the container, all sharing a single +interface and IP address, and associated ports. If one container binds to a port, no other +container can use that port within the pod while it is in use. Containers in the pod can +also communicate over localhost by having one container bind to localhost in the pod, and +another connect to that port. + +In the example from the symptom section, dropping the `-p 3434:3434` would allow the +`podman run` command to complete, and the container as part of the pod would still have +access to that port. For example: + +```console +$ podman run --pod srcview --name src-expose -v "${PWD}:/var/opt/localrepo":Z,ro sourcegraph/src-expose:latest serve /var/opt/localrepo +``` + +### 24) Podman container images fail with `fuse: device not found` when run + +Some container images require that the fuse kernel module is loaded in the kernel +before they will run with the fuse filesystem in play. + +#### Symptom + +When trying to run the container images found at quay.io/podman, quay.io/containers +registry.access.redhat.com/ubi8 or other locations, an error will sometimes be returned: + + +``` +ERRO error unmounting /var/lib/containers/storage/overlay/30c058cdadc888177361dd14a7ed7edab441c58525b341df321f07bc11440e68/merged: invalid argument +error mounting container "1ae176ca72b3da7c70af31db7434bcf6f94b07dbc0328bc7e4e8fc9579d0dc2e": error mounting build container "1ae176ca72b3da7c70af31db7434bcf6f94b07dbc0328bc7e4e8fc9579d0dc2e": error creating overlay mount to /var/lib/containers/storage/overlay/30c058cdadc888177361dd14a7ed7edab441c58525b341df321f07bc11440e68/merged: using mount program /usr/bin/fuse-overlayfs: fuse: device not found, try 'modprobe fuse' first +fuse-overlayfs: cannot mount: No such device +: exit status 1 +ERRO exit status 1 +``` + +#### Solution + +If you encounter a `fuse: device not found` error when running the container image, it is likely that +the fuse kernel module has not been loaded on your host system. Use the command `modprobe fuse` to load the +module and then run the container image afterwards. To enable this automatically at boot time, you can add a configuration +file to `/etc/modules.load.d`. See `man modules-load.d` for more details. + +### 25) podman run --rootfs link/to//read/only/dir does not work + +An error such as "OCI runtime error" on a read-only filesystem or the error "{image} is not an absolute path or is a symlink" are often times indicators for this issue. For more details, review this [issue]( +https://github.com/containers/podman/issues/5895). + +#### Symptom + +Rootless Podman requires certain files to exist in a file system in order to run. +Podman will create /etc/resolv.conf, /etc/hosts and other file descriptors on the rootfs in order +to mount volumes on them. + +#### Solution + +Run the container once in read/write mode, Podman will generate all of the FDs on the rootfs, and +from that point forward you can run with a read-only rootfs. + +```console +$ podman run --rm --rootfs /path/to/rootfs true +``` + +The command above will create all the missing directories needed to run the container. + +After that, it can be used in read-only mode, by multiple containers at the same time: + +```console +$ podman run --read-only --rootfs /path/to/rootfs .... +``` + +Another option is to use an Overlay Rootfs Mount: + +```console +$ podman run --rootfs /path/to/rootfs\:O .... +``` + +Modifications to the mount point are destroyed when the container +finishes executing, similar to a tmpfs mount point being unmounted. + +### 26) Running containers with resource limits fails with a permissions error + +On some systemd-based systems, non-root users do not have resource limit delegation +permissions. This causes setting resource limits to fail. + +#### Symptom + +Running a container with a resource limit options will fail with an error similar to the following: + +`--cpus`, `--cpu-period`, `--cpu-quota`, `--cpu-shares`: + + Error: OCI runtime error: crun: the requested cgroup controller `cpu` is not available + +`--cpuset-cpus`, `--cpuset-mems`: + + Error: OCI runtime error: crun: the requested cgroup controller `cpuset` is not available + +This means that resource limit delegation is not enabled for the current user. + +#### Solution + +You can verify whether resource limit delegation is enabled by running the following command: + +```console +$ cat "/sys/fs/cgroup/user.slice/user-$(id -u).slice/user@$(id -u).service/cgroup.controllers" +``` + +Example output might be: + + memory pids + +In the above example, `cpu` and `cpuset` are not listed, which means the current user does +not have permission to set CPU or CPUSET limits. + +If you want to enable CPU or CPUSET limit delegation for all users, you can create the +file `/etc/systemd/system/user@.service.d/delegate.conf` with the contents: + +```ini +[Service] +Delegate=memory pids cpu cpuset +``` + +After logging out and logging back in, you should have permission to set +CPU and CPUSET limits. + +### 27) `exec container process '/bin/sh': Exec format error` (or another binary than `bin/sh`) + +This can happen when running a container from an image for another architecture than the one you are running on. + +For example, if a remote repository only has, and thus send you, a `linux/arm64` _OS/ARCH_ but you run on `linux/amd64` (as happened in https://github.com/openMF/community-app/issues/3323 due to https://github.com/timbru31/docker-ruby-node/issues/564). + +### 28) `Error: failed to create sshClient: Connection to bastion host (ssh://user@host:22/run/user/.../podman/podman.sock) failed.: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain` + +In some situations where the client is not on the same machine as where the podman daemon is running the client key could be using a cipher not supported by the host. This indicates an issue with one's SSH config. Until remedied using podman over ssh +with a pre-shared key will be impossible. + +#### Symptom + +The accepted ciphers per `/etc/crypto-policies/back-ends/openssh.config` are not one that was used to create the public/private key pair that was transferred over to the host for ssh authentication. + +You can confirm this is the case by attempting to connect to the host via `podman-remote info` from the client and simultaneously on the host running `journalctl -f` and watching for the error `userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]`. + +#### Solution + +Create a new key using a supported algorithm e.g. ecdsa: + +```console +$ ssh-keygen -t ecdsa -f ~/.ssh/podman +``` + +Then copy the new id over: + +```console +$ ssh-copy-id -i ~/.ssh/podman.pub user@host +``` + +And then re-add the connection (removing the old one if necessary): + +```console +$ podman-remote system connection add myuser --identity ~/.ssh/podman ssh://user@host/run/user/1000/podman/podman.sock +``` + +And now this should work: + +```console +$ podman-remote info +``` + +### 29) Rootless CNI networking fails in RHEL with Podman v2.2.1 to v3.0.1. + +A failure is encountered when trying to use networking on a rootless +container in Podman v2.2.1 through v3.0.1 on RHEL. This error does not +occur on other Linux distributions. + +#### Symptom + +A rootless container is created using a CNI network, but the `podman run` command +returns an error that an image must be built. + +#### Solution + +In order to use a CNI network in a rootless container on RHEL, +an Infra container image for CNI-in-slirp4netns must be created. The +instructions for building the Infra container image can be found for +v2.2.1 [here](https://github.com/containers/podman/tree/v2.2.1-rhel/contrib/rootless-cni-infra), +and for v3.0.1 [here](https://github.com/containers/podman/tree/v3.0.1-rhel/contrib/rootless-cni-infra). + +### 30) Container related firewall rules are lost after reloading firewalld +Container network can't be reached after `firewall-cmd --reload` and `systemctl restart firewalld` Running `podman network reload` will fix it but it has to be done manually. + +#### Symptom +The firewall rules created by podman are lost when the firewall is reloaded. + +#### Solution +[@ranjithrajaram](https://github.com/containers/podman/issues/5431#issuecomment-847758377) has created a systemd-hook to fix this issue + +1) For "firewall-cmd --reload", create a systemd unit file with the following +```ini +[Unit] +Description=firewalld reload hook - run a hook script on firewalld reload +Wants=dbus.service +After=dbus.service + +[Service] +Type=simple +ExecStart=/bin/bash -c '/bin/busctl monitor --system --match "interface=org.fedoraproject.FirewallD1,member=Reloaded" --match "interface=org.fedoraproject.FirewallD1,member=PropertiesChanged" | while read -r line ; do podman network reload --all ; done' + +[Install] +WantedBy=default.target +``` + +2) For "systemctl restart firewalld", create a systemd unit file with the following +```ini +[Unit] +Description=podman network reload +Wants=firewalld.service +After=firewalld.service +PartOf=firewalld.service + +[Service] +Type=simple +RemainAfterExit=yes +ExecStart=/usr/bin/podman network reload --all + +[Install] +WantedBy=default.target +``` + +However, If you use busctl monitor then you can't get machine-readable output on RHEL 8. +Since it doesn't have `busctl -j` as mentioned here by [@yrro](https://github.com/containers/podman/issues/5431#issuecomment-896943018). + +For RHEL 8, you can use the following one-liner bash script. +```ini +[Unit] +Description=Redo podman NAT rules after firewalld starts or reloads +Wants=dbus.service +After=dbus.service +Requires=firewalld.service + +[Service] +Type=simple +ExecStart=/bin/bash -c "dbus-monitor --profile --system 'type=signal,sender=org.freedesktop.DBus,path=/org/freedesktop/DBus,interface=org.freedesktop.DBus,member=NameAcquired,arg0=org.fedoraproject.FirewallD1' 'type=signal,path=/org/fedoraproject/FirewallD1,interface=org.fedoraproject.FirewallD1,member=Reloaded' | sed -u '/^#/d' | while read -r type timestamp serial sender destination path interface member _junk; do if [[ $type = '#'* ]]; then continue; elif [[ $interface = org.freedesktop.DBus && $member = NameAcquired ]]; then echo 'firewalld started'; podman network reload --all; elif [[ $interface = org.fedoraproject.FirewallD1 && $member = Reloaded ]]; then echo 'firewalld reloaded'; podman network reload --all; fi; done" +Restart=Always + +[Install] +WantedBy=default.target +``` +`busctl-monitor` is almost usable in RHEL 8, except that it always outputs two bogus events when it starts up, +one of which is (in its only machine-readable format) indistinguishable from the `NameOwnerChanged` that you get when firewalld starts up. +This means you would get an extra `podman network reload --all` when this unit starts. + +Apart from this, you can use the following systemd service with the python3 code. + +```ini +[Unit] +Description=Redo podman NAT rules after firewalld starts or reloads +Wants=dbus.service +Requires=firewalld.service +After=dbus.service + +[Service] +Type=simple +ExecStart=/usr/bin/python /path/to/python/code/podman-redo-nat.py +Restart=always + +[Install] +WantedBy=default.target +``` +The code reloads podman network twice when you use `systemctl restart firewalld`. +```python3 +import dbus +from gi.repository import GLib +from dbus.mainloop.glib import DBusGMainLoop +import subprocess +import sys + +# I'm a bit confused on the return values in the code +# Not sure if they are needed. + +def reload_podman_network(): + try: + subprocess.run(["podman","network","reload","--all"],timeout=90) + # I'm not sure about this part + sys.stdout.write("podman network reload done\n") + sys.stdout.flush() + except subprocess.TimeoutExpired as t: + sys.stderr.write(f"Podman reload failed due to Timeout {t}") + except subprocess.CalledProcessError as e: + sys.stderr.write(f"Podman reload failed due to {e}") + except Exception as e: + sys.stderr.write(f"Podman reload failed with an Unhandled Exception {e}") + + return False + +def signal_handler(*args, **kwargs): + if kwargs.get('member') == "Reloaded": + reload_podman_network() + elif kwargs.get('member') == "NameOwnerChanged": + reload_podman_network() + else: + return None + return None + +def signal_listener(): + try: + DBusGMainLoop(set_as_default=True)# Define the loop. + loop = GLib.MainLoop() + system_bus = dbus.SystemBus() + # Listens to systemctl restart firewalld with a filter added, will cause podman network to be reloaded twice + system_bus.add_signal_receiver(signal_handler,dbus_interface='org.freedesktop.DBus',arg0='org.fedoraproject.FirewallD1',member_keyword='member') + # Listens to firewall-cmd --reload + system_bus.add_signal_receiver(signal_handler,dbus_interface='org.fedoraproject.FirewallD1',signal_name='Reloaded',member_keyword='member') + loop.run() + except KeyboardInterrupt: + loop.quit() + sys.exit(0) + except Exception as e: + loop.quit() + sys.stderr.write(f"Error occurred {e}") + sys.exit(1) + +if __name__ == "__main__": + signal_listener() +``` + +### 31) Podman run fails with `ERRO[0000] XDG_RUNTIME_DIR directory "/run/user/0" is not owned by the current user` or `Error: creating tmpdir: mkdir /run/user/1000: permission denied`. + +A failure is encountered when performing `podman run` with a warning `XDG_RUNTIME_DIR is pointing to a path which is not writable. Most likely podman will fail.` + +#### Symptom + +A rootless container is being invoked with cgroup configuration as `cgroupv2` for user with missing or invalid **systemd session**. + +Example cases +```console +# su user1 -c 'podman images' +ERRO[0000] XDG_RUNTIME_DIR directory "/run/user/0" is not owned by the current user +``` +```console +# su - user1 -c 'podman images' +Error: creating tmpdir: mkdir /run/user/1000: permission denied +``` + +#### Solution + +Podman expects a valid login session for the `rootless+cgroupv2` use-case. Podman execution is expected to fail if the login session is not present. In most cases, podman will figure out a solution on its own but if `XDG_RUNTIME_DIR` is pointing to a path that is not writable execution will most likely fail. Typical scenarios of such cases are seen when users are trying to use Podman with `su - -c ''`, or `sudo -l` and badly configured systemd session. + +Alternatives: + +* Execute Podman via __systemd-run__ that will first start a systemd login session: + + ```console + $ sudo systemd-run --machine=username@ --quiet --user --collect --pipe --wait podman run --rm docker.io/library/alpine echo hello + ``` +* Start an interactive shell in a systemd login session with the command `machinectl shell @` + and then run Podman + + ```console + $ sudo -i + # machinectl shell username@ + Connected to the local host. Press ^] three times within 1s to exit session. + $ podman run --rm docker.io/library/alpine echo hello + ``` +* Start a new systemd login session by logging in with `ssh` i.e. `ssh @localhost` and then run Podman. + +* Before invoking Podman command create a valid login session for your rootless user using `loginctl enable-linger ` + +### 32) 127.0.0.1:7777 port already bound + +After deleting a VM on macOS, the initialization of subsequent VMs fails. + +#### Symptom + +After deleting a client VM on macOS via `podman machine stop` && `podman machine rm`, attempting to `podman machine init` a new client VM leads to an error with the 127.0.0.1:7777 port already bound. + +#### Solution + +You will need to remove the hanging gv-proxy process bound to the port in question. For example, if the port mentioned in the error message is 127.0.0.1:7777, you can use the command `kill -9 $(lsof -i:7777)` in order to identify and remove the hanging process which prevents you from starting a new VM on that default port. + +### 33) The sshd process fails to run inside of the container. + +#### Symptom + +The sshd process running inside the container fails with the error +"Error writing /proc/self/loginuid". + +### Solution + +If the `/proc/self/loginuid` file is already initialized then the +`CAP_AUDIT_CONTROL` capability is required to override it. + +This happens when running Podman from a user session since the +`/proc/self/loginuid` file is already initialized. The solution is to +run Podman from a system service, either using the Podman service, and +then using podman -remote to start the container or simply by running +something like `systemd-run podman run ...`. In this case the +container will only need `CAP_AUDIT_WRITE`. + +### 34) Container creates a file that is not owned by the user's regular UID + +After running a container with rootless Podman, the non-root user sees a numerical UID and GID instead of a username and groupname. + +#### Symptom + +When listing file permissions with `ls -l` on the host in a directory that was passed as `--volume /some/dir` to `podman run`, +the UID and GID are displayed rather than the corresponding username and groupname. The UID and GID numbers displayed are +from the user's subordinate UID and GID ranges on the host system. + +An example + +```console +$ mkdir dir1 +$ chmod 777 dir1 +$ podman run --rm -v ./dir1:/dir1\:Z \ + --user 2003:2003 \ + docker.io/library/ubuntu bash -c "touch /dir1/a; chmod 600 /dir1/a" +$ ls -l dir1/a +-rw-------. 1 102002 102002 0 Jan 19 19:35 dir1/a +$ less dir1/a +less: dir1/a: Permission denied +``` + +#### Solution + +If you want to read, chown, or remove such a file, enter a user +namespace. Instead of running commands such as `less dir1/a` or `rm dir1/a`, you +need to prepend the command-line with `podman unshare`, i.e., +`podman unshare less dir1/a` or `podman unshare rm dir1/a`. To change the ownership +of the file `dir1/a` to your regular user's UID and GID, run `podman unshare chown 0:0 dir1/a`. +A file having the ownership `0:0` in the user namespace is owned by the regular +user on the host. To use Bash features, such as variable expansion and +globbing, you need to wrap the command with `bash -c`, e.g. +`podman unshare bash -c 'ls $HOME/dir1/a*'`. + +Would it have been possible to run Podman in another way so that your regular +user would have become the owner of the file? Yes, you can use the option +`--userns keep-id:uid=$uid,gid=$gid` to change how UIDs and GIDs are mapped +between the container and the host. Let's try it out. + +In the example above `ls -l` shows the UID 102002 and GID 102002. Set shell variables + +```console +$ uid_from_ls=102002 +$ gid_from_ls=102002 +``` + +Set shell variables to the lowest subordinate UID and GID + +```console +$ lowest_subuid=$(podman info --format "{{ (index .Host.IDMappings.UIDMap 1).HostID }}") +$ lowest_subgid=$(podman info --format "{{ (index .Host.IDMappings.GIDMap 1).HostID }}") +``` + +Compute the UID and GID inside the container that map to the owner of the created file on the host. + +```console +$ uid=$(( $uid_from_ls - $lowest_subuid + 1)) +$ gid=$(( $gid_from_ls - $lowest_subgid + 1)) +``` +(In the computation it was assumed that there is only one subuid range and one subgid range) + +```console +$ echo $uid +2003 +$ echo $gid +2003 +``` + +The computation shows that the UID is `2003` and the GID is `2003` inside the container. +This comes as no surprise as this is what was specified before with `--user=2003:2003`, +but the same computation could be used whenever a username is specified +or the `--user` option is not used. + +Run the container again but now with UIDs and GIDs mapped + +```console +$ mkdir dir1 +$ chmod 777 dir1 +$ podman run --rm + -v ./dir1:/dir1:Z \ + --user $uid:$gid \ + --userns keep-id:uid=$uid,gid=$gid \ + docker.io/library/ubuntu bash -c "touch /dir1/a; chmod 600 /dir1/a" +$ id -u +tester +$ id -g +tester +$ ls -l dir1/a +-rw-------. 1 tester tester 0 Jan 19 20:31 dir1/a +$ +``` + +In this example the `--user` option specified a rootless user in the container. +As the rootless user could also have been specified in the container image, e.g. + +```console +$ podman image inspect --format "user: {{.User}}" IMAGE +user: hpc +``` +the same problem could also occur even without specifying `--user`. + +Another variant of the same problem could occur when using +`--user=root:root` (the default), but where the root user creates non-root owned files +in some way (e.g by creating them themselves, or switching the effective UID to +a rootless user and then creates files). + +See also the troubleshooting tip: + +[_Podman run fails with "Error: unrecognized namespace mode keep-id\:uid=1000,gid=1000 passed"_](#39-podman-run-fails-with-error-unrecognized-namespace-mode-keep-iduid1000gid1000-passed) + +### 35) Passed-in devices or files can't be accessed in rootless container (UID/GID mapping problem) + +As a non-root user you have access rights to devices, files and directories that you +want to pass into a rootless container with `--device=...`, `--volume=...` or `--mount=..`. + +Podman by default maps a non-root user inside a container to one of the user's +subordinate UIDs and subordinate GIDs on the host. When the container user tries to access a +file, a "Permission denied" error could occur because the container user does not have the +permissions of the regular user of the host. + +#### Symptom + +* Any access inside the container is rejected with "Permission denied" +for files, directories or devices passed in to the container +with `--device=..`,`--volume=..` or `--mount=..`, e.g. + +```console +$ mkdir dir1 +$ chmod 700 dir1 +$ podman run --rm -v ./dir1:/dir1:Z \ + --user 2003:2003 \ + docker.io/library/ubuntu ls /dir1 +ls: cannot open directory '/dir1': Permission denied +``` + +#### Solution + +We follow essentially the same solution as in the previous +troubleshooting tip: + +[_Container creates a file that is not owned by the user's regular UID_](#34-container-creates-a-file-that-is-not-owned-by-the-users-regular-uid) + +but for this problem the container UID and GID can't be as +easily computed by mere addition and subtraction. + +In other words, it might be more challenging to find out the UID and +the GID inside the container that we want to map to the regular +user on the host. + +If the `--user` option is used together with a numerical UID and GID +to specify a rootless user, we already know the answer. + +If the `--user` option is used together with a username and groupname, +we could look up the UID and GID in the file `/etc/passwd` of the container. + +If the container user is not set via `--user` but instead from the +container image, we could inspect the container image + +```console +$ podman image inspect --format "user: {{.User}}" IMAGE +user: hpc +``` + +and then look it up in `/etc/passwd` of the container. + +If the problem occurs in a container that is started to run as root but later +switches to an effictive UID of a rootless user, it might be less +straightforward to find out the UID and the GID. Reading the +`Containerfile`, `Dockerfile` or the `/etc/passwd` could give a clue. + +To run the container with the rootless container UID and GID mapped to the +user's regular UID and GID on the host follow these steps: + +Set the `uid` and `gid` shell variables in a Bash shell to the UID and GID +of the user that will be running inside the container, e.g. + +```console +$ uid=2003 +$ gid=2003 +``` + +and run + +```console +$ mkdir dir1 +$ echo hello > dir1/file.txt +$ chmod 700 dir1/file.txt +$ podman run --rm \ + -v ./dir1:/dir1:Z \ + --user $uid:$gid \ + --userns keep-id:uid=$uid,gid=$gid \ + docker.io/library/alpine cat /dir1/file.txt +hello +``` + +See also the troubleshooting tip: + +[_Podman run fails with "Error: unrecognized namespace mode keep-id:uid=1000,gid=1000 passed"_](#39-podman-run-fails-with-error-unrecognized-namespace-mode-keep-iduid1000gid1000-passed) + +### 36) Images in the additional stores can be deleted even if there are containers using them + +When an image in an additional store is used, it is not locked thus it +can be deleted even if there are containers using it. + +#### Symptom + +WARN[0000] Can't stat lower layer "/var/lib/containers/storage/overlay/l/7HS76F2P5N73FDUKUQAOJA3WI5" because it does not exist. Going through storage to recreate the missing symlinks. + +#### Solution + +It is the user responsibility to make sure images in an additional +store are not deleted while being used by containers in another +store. + +### 37) Syncing bugfixes for podman-remote or setups using Podman API + +After upgrading Podman to a newer version an issue with the earlier version of Podman still presents itself while using podman-remote. + +#### Symptom + +While running podman remote commands with the most updated Podman, issues that were fixed in a prior version of Podman can arise either on the Podman client side or the Podman server side. + +#### Solution + +When upgrading Podman to a particular version for the required fixes, users often make the mistake of only upgrading the Podman client. However, suppose a setup uses `podman-remote` or uses a client that communicates with the Podman server on a remote machine via the REST API. In that case, it is required to upgrade both the Podman client and the Podman server running on the remote machine. Both the Podman client and server must be upgraded to the same version. + +Example: If a particular bug was fixed in `v4.1.0` then the Podman client must have version `v4.1.0` as well the Podman server must have version `v4.1.0`. + +### 38) Unexpected carriage returns are outputted on the terminal + +When using the __--tty__ (__-t__) flag, unexpected carriage returns are outputted on the terminal. + +#### Symptom + +The container program prints a newline (`\n`) but the terminal outputs a carriage return and a newline (`\r\n`). + +``` +$ podman run --rm -t fedora echo abc | od -c +0000000 a b c \r \n +0000005 +``` + +When run directly on the host, the result is as expected. + +``` +$ echo abc | od -c +0000000 a b c \n +0000004 +``` + +Extra carriage returns can also shift the prompt to the right. + +``` +$ podman run --rm -t fedora sh -c "echo 1; echo 2; echo 3" | cat -A +1^M$ + 2^M$ + 3^M$ + $ +``` + +#### Solution + +Run Podman without the __--tty__ (__-t__) flag. + +``` +$ podman run --rm fedora echo abc | od -c +0000000 a b c \n +0000004 +``` + +The __--tty__ (__-t__) flag should only be used when the program requires user interaction in the termainal, for instance expecting +the user to type an answer to a question. + +Where does the extra carriage return `\r` come from? + +The extra `\r` is not outputted by Podman but by the terminal. In fact, a reconfiguration of the terminal can make the extra `\r` go away. + +``` +$ podman run --rm -t fedora /bin/sh -c "stty -onlcr && echo abc" | od -c +0000000 a b c \n +0000004 +``` + +### 39) Podman run fails with "Error: unrecognized namespace mode keep-id:uid=1000,gid=1000 passed" + +Podman 4.3.0 introduced the options _uid_ and _gid_ that can be given to `--userns keep-id` which are not recognized by older versions of Podman. + +#### Symptom + +When using a Podman version older than 4.3.0, the options _uid_ and _gid_ are not recognized, and an "unrecognized namespace mode" error is raised. + +``` +$ uid=1000 +$ gid=1000 +$ podman run --rm + --user $uid:$gid \ + --userns keep-id:uid=$uid,gid=$gid \ + docker.io/library/ubuntu /bin/cat /proc/self/uid_map +Error: unrecognized namespace mode keep-id:uid=1000,gid=1000 passed +$ +``` + +#### Solution + +Use __--uidmap__ and __--gidmap__ options to describe the same UID and GID mapping. + +Run + +``` +$ uid=1000 +$ gid=1000 +$ subuidSize=$(( $(podman info --format "{{ range \ + .Host.IDMappings.UIDMap }}+{{.Size }}{{end }}" ) - 1 )) +$ subgidSize=$(( $(podman info --format "{{ range \ + .Host.IDMappings.GIDMap }}+{{.Size }}{{end }}" ) - 1 )) +$ podman run --rm \ + --user $uid:$gid \ + --uidmap 0:1:$uid \ + --uidmap $uid:0:1 \ + --uidmap $(($uid+1)):$(($uid+1)):$(($subuidSize-$uid)) \ + --gidmap 0:1:$gid \ + --gidmap $gid:0:1 \ + --gidmap $(($gid+1)):$(($gid+1)):$(($subgidSize-$gid)) \ + docker.io/library/ubuntu /bin/cat /proc/self/uid_map + 0 1 1000 + 1000 0 1 + 1001 1001 64536 +``` + +which uses the same UID and GID mapping as when specifying +`--userns keep-id:uid=$uid,gid=$gid` with Podman 4.3.0 (or greater) + +``` +$ uid=1000 +$ gid=1000 +$ podman run --rm \ + --user $uid:$gid \ + --userns keep-id:uid=$uid,gid=$gid \ + docker.io/library/ubuntu /bin/cat /proc/self/uid_map + 0 1 1000 + 1000 0 1 + 1001 1001 64536 +``` + +Replace `/bin/cat /proc/self/uid_map` with +`/bin/cat /proc/self/gid_map` to show the GID mapping. + +### 40) Podman fails to find expected image with "error locating pulled image", "image not known" + +When trying to do a Podman command that pulls an image from local storage or a remote repository, +an error is raised saying "image not known" or "error locating pulled image". Even though the image +had been verified before the Podman command was invoked. + +#### Symptom + +After verifying that an image is in place either locally or on a remote repository, a Podman command +referencing that image will fail in a manner like: +``` +# ls Containerfile +FROM registry.access.redhat.com/ubi8-minimal:latest +MAINTAINER Podman Community +USER root + +# podman build . +STEP 1/2: FROM registry.access.redhat.com/ubi8-minimal +Trying to pull registry.access.redhat.com/ubi8-minimal:latest... +Getting image source signatures +Checking if image destination supports signatures +Copying blob a6577091999b done +Copying config abb1ba1bce done +Writing manifest to image destination +Storing signatures +Error: error creating build container: error locating pulled image "registry.access.redhat.com/ubi8-minimal:latest" name in containers storage: registry.access.redhat.com/ubi8-minimal\:latest: image not known +``` + +#### Solution +The general cause for this is a timing issue. To make Podman commands as +efficient as possible, read and write locks are only established for critical +sections within the code. When pulling an image from a repository, a copy of +that image is first written to local storage using a write lock. This lock is +released before the image is then acquired/read. If another process does a +harmful command such as `podman system prune --all` or `podman system reset` +or `podman rmi --all`, between the time the image is written and before the +first process can acquire it, this type of `image not known` error can arise. + +The maintainers of Podman have considered heavier-duty locks to close this +timing window. However, the slowdown that all Podman commands would encounter +was not considered worth the cost of completely closing this small timing window. + +### 41) A podman build step with `--mount=type=secret` fails with "operation not permitted" + +Executing a step in a `Dockerfile`/`Containerfile` which mounts secrets using `--mount=type=secret` fails with "operation not permitted" when running on a host filesystem mounted with `nosuid` and when using the `runc` runtime. + +#### Symptom + +A `RUN` line in the `Dockerfile`/`Containerfile` contains a [secret mount](https://github.com/containers/common/blob/main/docs/Containerfile.5.md) such as `--mount=type=secret,id=MY_USER,target=/etc/dnf/vars/MY_USER`. +When running `podman build` the process fails with an error message like: + +``` +STEP 3/13: RUN --mount=type=secret,id=MY_USER,target=/etc/dnf/vars/MY_USER --mount=type=secret,id=MY_USER,target=/etc/dnf/vars/MY_USER ...: time="2023-06-13T18:04:59+02:00" level=error msg="runc create failed: unable to start container process: error during container init: error mounting \"/var/tmp/buildah2251989386/mnt/buildah-bind-target-11\" to rootfs at \"/etc/dnf/vars/MY_USER\": mount /var/tmp/buildah2251989386/mnt/buildah-bind-target-11:/etc/dnf/vars/MY_USER (via /proc/self/fd/7), flags: 0x1021: operation not permitted" +: exit status 1 +ERRO[0002] did not get container create message from subprocess: EOF +``` + +#### Solution + +* Install `crun`, e.g. with `dnf install crun`. +* Use the `crun` runtime by passing `--runtime /usr/bin/crun` to `podman build`. + +See also [Buildah issue 4228](https://github.com/containers/buildah/issues/4228) for a full discussion of the problem. + +### 42) podman-in-podman builds that are file I/0 intensive are very slow + +When using the `overlay` storage driver to do a nested `podman build` inside a running container, file I/O operations such as `COPY` of a large amount of data is very slow or can hang completely. + +#### Symptom + +Using the default `overlay` storage driver, a `COPY`, `ADD`, or an I/O intensive `RUN` line in a `Containerfile` that is run inside another container is very slow or hangs completely when running a `podman build` inside the running parent container. + +#### Solution + +This could be caused by the child container using `fuse-overlayfs` for writing to `/var/lib/containers/storage`. Writes can be slow with `fuse-overlayfs`. The solution is to use the native `overlay` filesystem by using a local directory on the host system as a volume to `/var/lib/containers/storage` like so: `podman run --privileged --rm -it -v ./nested_storage:/var/lib/containers/storage parent:latest`. Ensure that the base image of `parent:latest` in this example has no contents in `/var/lib/containers/storage` in the image itself for this to work. Once using the native volume, the nested container should not fall back to `fuse-overlayfs` to write files and the nested build will complete much faster. + +If you don't have access to the parent run process, such as in a CI environment, then the second option is to change the storage driver to `vfs` in the parent image by changing changing this line in your `storage.conf` file: `driver = "vfs"`. You may have to run `podman system reset` for this to take effect. You know it's changed when `podman info |grep graphDriverName` outputs `graphDriverName: vfs`. This method is slower performance than using the volume method above but is significantly faster than `fuse-overlayfs` + +### 43) `podman run --userns=auto` fails with "Error: creating container storage: not enough unused IDs in user namespace" + +Using `--userns=auto` when creating new containers does not work as long as any containers exist that were created with `--userns=keep-id` or `--userns=nomap` + +#### Symptom + +1. Run with `--userns=auto` + ``` + $ podman run --rm -d --userns=auto alpine sleep 3600 + ``` + The command succeeds. +2. Run with `--userns=auto` + ``` + $ podman run --rm -d --userns=auto alpine sleep 3600 + ``` + The command succeeds. +3. Run with `--userns=keep-id` + ``` + $ podman run --rm -d --userns=keep-id alpine sleep 3600 + ``` + The command succeeds. +4. Run with `--userns=auto` + ``` + $ podman run --rm -d --userns=auto alpine sleep 3600 + ``` + The command fails with the error message + ``` + Error: creating container storage: not enough unused IDs in user namespace + ``` + +#### Solution + +Any existing containers that were created using `--userns=keep-id` or `--userns=nomap` must first be deleted before any new container can be created with `--userns=auto` + +### 44) `sudo podman run --userns=auto` fails with `Cannot find mappings for user "containers"` + +When rootful podman is invoked with `--userns=auto`, podman needs to +pick subranges of subuids and subgids for the user namespace of the container. +Rootful podman ensures that the subuid and subgid ranges for such containers +do not overlap, but how can rootful podman prevent other tools +from accidentally using these IDs? + +It's not possible to block other tools that are running as root from using these IDs, +but such tools would normally not use subuids and subgids that have already +been assigned to a user in _/etc/subuid_ and _/etc/subgid_. + +The username _containers_ on the host has a special function for rootful Podman. +Rootful podman uses the subuids and subgids of the user _containers_ when +running `--userns=auto` containers. The user _containers_ has no need for these +subuids and subgids because no processes should be started as the user _containers_. +In other words, the user _containers_ is a special user that only exists on the system +to reserve _subuids_ and _subgids_ for rootful podman. + +_containers_ is the default username but it can be changed by setting the +option `root-auto-userns-user` in the file _/etc/containers/storage.conf_ + +#### Symptom + +Run rootful podman with `--userns=auto` +``` +sudo podman run --rm --userns=auto alpine echo hello +``` +The command fails with the error message: +``` +ERRO[0000] Cannot find mappings for user "containers": no subuid ranges found for user "containers" in /etc/subuid +Error: creating container storage: not enough unused IDs in user namespace +``` + +The files _/etc/subuid_ and _/etc/subgid_ do not have any lines that start with `containers:` + +#### Solution + +Add subuid and subgid ranges for the user _containers_ in _/etc/subuid_ and _/etc/subgid_ +or provide such ranges with _/etc/nsswitch.conf_. +For details, see [subid(5)](https://man7.org/linux/man-pages/man5/subuid.5.html). + +The following steps create the user _containers_ and assigns big subuid and subgid ranges to it: + +1. Create the user _containers_ + ``` + sudo useradd --comment "Helper user to reserve subuids and subgids for Podman" \ + --no-create-home \ + --shell /usr/sbin/nologin \ + containers + ``` +2. Check the subuid and subgid ranges of the user _containers_ + ``` + $ grep ^containers: /etc/subuid + containers:720896:65536 + $ grep ^containers: /etc/subgid + containers:720896:65536 + ``` + By default __useradd__ assigns 65536 subuids and 65536 subgids to a new user. + Typically you would like the reserved pool to be bigger than that. The bigger + the size, the more containers could be started with `sudo podman run --userns=auto ...` +3. Edit the line for the user _containers_ in the files _/etc/subuid_ and _/etc/subgid_ + to make the ranges bigger. Ensure that the subuid range of the user _containers_ do + not overlap with any other subuid ranges in the files _/etc/subuid_. Ensure that the + subgid range of the user _containers_ do not overlap with any other subgid ranges in + the files _/etc/subgid_. + +Test the echo command again + +``` +sudo podman run --rm --userns=auto alpine echo hello +``` + +The command succeeds and prints `hello` diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-unmount.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-unmount.1.md new file mode 100644 index 000000000..09b920f21 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-unmount.1.md @@ -0,0 +1,75 @@ +--- +title: podman-unmount +version: v5.5.2 +--- + +% podman-unmount 1 + +## NAME +podman\-unmount - Unmount a working container's root filesystem + +## SYNOPSIS +**podman unmount** [*options*] *container* [...] + +**podman umount** [*options*] *container* [...] + +**podman container unmount** [*options*] *container* [...] + +**podman container umount** [*options*] *container* [...] + +## DESCRIPTION +Unmounts the specified containers' root file system, if no other processes +are using it. + +Container storage increments a mount counter each time a container is mounted. +When a container is unmounted, the mount counter is decremented, and the +container's root filesystem is physically unmounted only when the mount +counter reaches zero indicating no other processes are using the mount. +An unmount can be forced with the --force flag. + +Note: Podman can be used to unmount Podman containers as well as external containers. +External containers are containers created in container/storage by other tools like +Buildah and CRI-O. + +## OPTIONS +#### **--all**, **-a** + +All of the currently mounted containers are unmounted. + +#### **--force**, **-f** + +Force the unmounting of specified containers' root file system, even if other +processes have mounted it. + +Note: Other processes can fail if the mount point they are using is removed without their knowledge. + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Unmount container with a given ID: +``` +podman container unmount containerID +``` + +Unmount multiple containers with given IDs: +``` +podman unmount containerID1 containerID2 containerID3 +``` + +Unmount all containers: +``` +podman unmount --all +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-mount(1)](podman-mount.1.md)**, **[podman-image-mount(1)](podman-image-mount.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-unpause.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-unpause.1.md new file mode 100644 index 000000000..f01ef7ba1 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-unpause.1.md @@ -0,0 +1,103 @@ +--- +title: podman-unpause +version: v5.5.2 +--- + +% podman-unpause 1 + +## NAME +podman\-unpause - Unpause one or more containers + +## SYNOPSIS +**podman unpause** [*options*]|[*container* ...] + +**podman container unpause** [*options*]|[*container* ...] + +## DESCRIPTION +Unpauses the processes in one or more containers. Container IDs or names can be used as input. + +## OPTIONS + +#### **--all**, **-a** + +Unpause all paused containers. + + +[//]: # (BEGIN included file options/cidfile.read.md) +#### **--cidfile**=*file* + +Read container ID from the specified *file* and unpause the container. +Can be specified multiple times. + +[//]: # (END included file options/cidfile.read.md) + +#### **--filter**, **-f**=*filter* + +Filter what containers unpause. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +|------------|-------------------------------------------------------------------------------------------------| +| id | [ID] Container's ID (CID prefix match by default; accepts regex) | +| name | [Name] Container's name (accepts regex) | +| label | [Key] or [Key=Value] Label assigned to a container | +| exited | [Int] Container's exit code | +| status | [Status] Container's status: 'created', 'initialized', 'exited', 'paused', 'running', 'unknown' | +| ancestor | [ImageName] Image or descendant used to create container | +| before | [ID] or [Name] Containers created before this container | +| since | [ID] or [Name] Containers created since this container | +| volume | [VolumeName] or [MountpointDestination] Volume mounted in container | +| health | [Status] healthy or unhealthy | +| pod | [Pod] name or full or partial ID of pod | +| network | [Network] name or full ID of network | +| until | [DateTime] Containers created before the given duration or time. | +| command | [Command] the command the container is executing, only argv[0] is taken | + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLE + +Unpause specified container: +``` +podman unpause mywebserver +``` + +Unpause container by a partial container ID: +``` +podman unpause 860a4b23 +``` + +Unpause all **paused** containers: +``` +podman unpause --all +``` + +Unpause container using ID specified in given files: +``` +podman unpause --cidfile /home/user/cidfile-1 +podman unpause --cidfile /home/user/cidfile-1 --cidfile ./cidfile-2 +``` + +Unpause the latest container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines): +``` +podman unpause --latest +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-pause(1)](podman-pause.1.md)** + +## HISTORY +September 2017, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-unshare.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-unshare.1.md new file mode 100644 index 000000000..77022bc37 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-unshare.1.md @@ -0,0 +1,114 @@ +--- +title: podman-unshare +version: v5.5.2 +--- + +% podman-unshare 1 + +## NAME +podman\-unshare - Run a command inside of a modified user namespace + +## SYNOPSIS +**podman unshare** [*options*] [*command*] + +## DESCRIPTION +Launches a process (by default, *$SHELL*) in a new user namespace. The user +namespace is configured so that the invoking user's UID and primary GID appear +to be UID 0 and GID 0, respectively. Any ranges which match that user and +group in `/etc/subuid` and `/etc/subgid` are also mapped in as themselves with the +help of the *newuidmap(1)* and *newgidmap(1)* helpers. + +**podman unshare** is useful for troubleshooting unprivileged operations and for +manually clearing storage and other data related to images and containers. + +It is also useful to use the **podman mount** command. If an unprivileged user wants to mount and work with a container, then they need to execute +**podman unshare**. Executing **podman mount** fails for unprivileged users unless the user is running inside a **podman unshare** session. + +The unshare session defines two environment variables: + +- **CONTAINERS_GRAPHROOT**: the path to the persistent container's data. +- **CONTAINERS_RUNROOT**: the path to the volatile container's data. + +*IMPORTANT: This command is not available with the remote Podman client.* + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +#### **--rootless-netns** + +Join the rootless network namespace used for netavark networking. It can be used to +connect to a rootless container via IP address (bridge networking). This is otherwise +not possible from the host network namespace. + +## Exit Codes + +The exit code from `podman unshare` gives information about why the container +failed to run or why it exited. When `podman unshare` commands exit with a non-zero code, +the exit codes follow the `chroot` standard, see below: + + **125** The error is with podman **_itself_** + + $ podman unshare --foo; echo $? + Error: unknown flag: --foo + 125 + + **126** Executing a _contained command_ and the _command_ cannot be invoked + + $ podman unshare /etc; echo $? + Error: fork/exec /etc: permission denied + 126 + + **127** Executing a _contained command_ and the _command_ cannot be found + + $ podman unshare foo; echo $? + Error: fork/exec /usr/bin/bogus: no such file or directory + 127 + + **Exit code** _contained command_ exit code + + $ podman unshare /bin/sh -c 'exit 3'; echo $? + 3 + +## EXAMPLE + +Execute specified command in rootless user namespace: +``` +$ podman unshare id +uid=0(root) gid=0(root) groups=0(root),65534(nobody) +``` + +Show user namespace mappings for rootless containers: +``` +$ podman unshare cat /proc/self/uid_map /proc/self/gid_map + 0 1000 1 + 1 10000 65536 + 0 1000 1 + 1 10000 65536 +``` + + +Show rootless netns information in user namespace for rootless containers: +``` +$ podman unshare --rootless-netns ip addr +1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 + link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 + inet 127.0.0.1/8 scope host lo + valid_lft forever preferred_lft forever + inet6 ::1/128 scope host + valid_lft forever preferred_lft forever +2: tap0: mtu 65520 qdisc fq_codel state UNKNOWN group default qlen 1000 + link/ether aa:8c:0b:73:98:f6 brd ff:ff:ff:ff:ff:ff + inet 10.0.2.100/24 brd 10.0.2.255 scope global tap0 + valid_lft forever preferred_lft forever + inet6 fd00::a88c:bff:fe73:98f6/64 scope global dynamic mngtmpaddr + valid_lft 86389sec preferred_lft 14389sec + inet6 fe80::a88c:bff:fe73:98f6/64 scope link + valid_lft forever preferred_lft forever +``` + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-mount(1)](podman-mount.1.md)**, **namespaces(7)**, **newuidmap(1)**, **newgidmap(1)**, **user\_namespaces(7)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-untag.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-untag.1.md new file mode 100644 index 000000000..fce9235c8 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-untag.1.md @@ -0,0 +1,46 @@ +--- +title: podman-untag +version: v5.5.2 +--- + +% podman-untag 1 + +## NAME +podman\-untag - Remove one or more names from a locally-stored image + +## SYNOPSIS +**podman untag** *image* [*name*[:*tag*]...] + +**podman image untag** *image* [*name*[:*tag*]...] + +## DESCRIPTION +Remove one or more names from an image in the local storage. The image can be referred to by ID or reference. If no name is specified, all names are removed from the image. If a specified name is a short name and does not include a registry, `localhost/` is prefixed (e.g., `fedora` -> `localhost/fedora`). If a specified name does not include a tag, `:latest` is appended (e.g., `localhost/fedora` -> `localhost/fedora\\:latest`). + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLES + +Remove all tags from the specified image. +``` +$ podman untag 0e3bbc2 +``` + +Remove tag from specified image. +``` +$ podman untag imageName:latest otherImageName:latest +``` + +Remove multiple tags from the specified image. +``` +$ podman untag httpd myhttpd myregistryhost:5000/fedora/httpd\\:v2 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +December 2019, Originally compiled by Sascha Grunert diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-update.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-update.1.md new file mode 100644 index 000000000..6f25d2892 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-update.1.md @@ -0,0 +1,562 @@ +--- +title: podman-update +version: v5.5.2 +--- + +% podman-update 1 + +## NAME +podman\-update - Update the configuration of a given container + +## SYNOPSIS +**podman update** [*options*] *container* + +**podman container update** [*options*] *container* + +## DESCRIPTION + +Updates the configuration of an existing container, allowing changes to resource limits and healthchecks. + +## OPTIONS + + +[//]: # (BEGIN included file options/blkio-weight.md) +#### **--blkio-weight**=*weight* + +Block IO relative weight. The _weight_ is a value between **10** and **1000**. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/blkio-weight.md) + + +[//]: # (BEGIN included file options/blkio-weight-device.md) +#### **--blkio-weight-device**=*device:weight* + +Block IO relative device weight. + +[//]: # (END included file options/blkio-weight-device.md) + + +[//]: # (BEGIN included file options/cpu-period.md) +#### **--cpu-period**=*limit* + +Set the CPU period for the Completely Fair Scheduler (CFS), which is a +duration in microseconds. Once the container's CPU quota is used up, it will not +be scheduled to run until the current period ends. Defaults to 100000 +microseconds. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-period.md) + + +[//]: # (BEGIN included file options/cpu-quota.md) +#### **--cpu-quota**=*limit* + +Limit the CPU Completely Fair Scheduler (CFS) quota. + +Limit the container's CPU usage. By default, containers run with the full +CPU resource. The limit is a number in microseconds. If a number is provided, +the container is allowed to use that much CPU time until the CPU period +ends (controllable via **--cpu-period**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-quota.md) + + +[//]: # (BEGIN included file options/cpu-rt-period.md) +#### **--cpu-rt-period**=*microseconds* + +Limit the CPU real-time period in microseconds. + +Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-period.md) + + +[//]: # (BEGIN included file options/cpu-rt-runtime.md) +#### **--cpu-rt-runtime**=*microseconds* + +Limit the CPU real-time runtime in microseconds. + +Limit the containers Real Time CPU usage. This option tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex: +Period of 1,000,000us and Runtime of 950,000us means that this container can consume 95% of available CPU and leave the remaining 5% to normal priority tasks. + +The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup. + +This option is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/cpu-rt-runtime.md) + + +[//]: # (BEGIN included file options/cpu-shares.md) +#### **--cpu-shares**, **-c**=*shares* + +CPU shares (relative weight). + +By default, all containers get the same proportion of CPU cycles. This +proportion can be modified by changing the container's CPU share weighting +relative to the combined weight of all the running containers. +Default weight is **1024**. + +The proportion only applies when CPU-intensive processes are running. +When tasks in one container are idle, other containers can use the +left-over CPU time. The actual amount of CPU time varies depending on +the number of containers running on the system. + +For example, consider three containers, one has a cpu-share of 1024 and +two others have a cpu-share setting of 512. When processes in all three +containers attempt to use 100% of CPU, the first container receives +50% of the total CPU time. If a fourth container is added with a cpu-share +of 1024, the first container only gets 33% of the CPU. The remaining containers +receive 16.5%, 16.5% and 33% of the CPU. + +On a multi-core system, the shares of CPU time are distributed over all CPU +cores. Even if a container is limited to less than 100% of CPU time, it can +use 100% of each individual CPU core. + +For example, consider a system with more than three cores. +If the container _C0_ is started with **--cpu-shares=512** running one process, +and another container _C1_ with **--cpu-shares=1024** running two processes, +this can result in the following division of CPU shares: + +| PID | container | CPU | CPU share | +| ---- | ----------- | ------- | ------------ | +| 100 | C0 | 0 | 100% of CPU0 | +| 101 | C1 | 1 | 100% of CPU1 | +| 102 | C1 | 2 | 100% of CPU2 | + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpu-shares.md) + + +[//]: # (BEGIN included file options/cpus.container.md) +#### **--cpus**=*number* + +Number of CPUs. The default is *0.0* which means no limit. This is shorthand +for **--cpu-period** and **--cpu-quota**, therefore the option cannot be specified with +**--cpu-period** or **--cpu-quota**. + +On some systems, changing the CPU limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpus.container.md) + + +[//]: # (BEGIN included file options/cpuset-cpus.md) +#### **--cpuset-cpus**=*number* + +CPUs in which to allow execution. Can be specified as a comma-separated list +(e.g. **0,1**), as a range (e.g. **0-3**), or any combination thereof +(e.g. **0-3,7,11-15**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-cpus.md) + + +[//]: # (BEGIN included file options/cpuset-mems.md) +#### **--cpuset-mems**=*nodes* + +Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on +NUMA systems. + +If there are four memory nodes on the system (0-3), use **--cpuset-mems=0,1** +then processes in the container only uses memory from the first +two memory nodes. + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/cpuset-mems.md) + + +[//]: # (BEGIN included file options/device-read-bps.md) +#### **--device-read-bps**=*path:rate* + +Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-bps.md) + + +[//]: # (BEGIN included file options/device-read-iops.md) +#### **--device-read-iops**=*path:rate* + +Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-read-iops.md) + + +[//]: # (BEGIN included file options/device-write-bps.md) +#### **--device-write-bps**=*path:rate* + +Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-bps.md) + + +[//]: # (BEGIN included file options/device-write-iops.md) +#### **--device-write-iops**=*path:rate* + +Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**). + +On some systems, changing the resource limits may not be allowed for non-root +users. For more details, see +https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/device-write-iops.md) + + +[//]: # (BEGIN included file options/env.update.md) +#### **--env**, **-e**=*env* + +Add a value (e.g. env=*value*) to the container. Can be used multiple times. +If the value already exists in the container, it is overridden. +To remove an environment variable from the container, use the `--unsetenv` +option. + +Note that the env updates only affect the main container process after +the next start. + +[//]: # (END included file options/env.update.md) + + +[//]: # (BEGIN included file options/health-cmd.md) +#### **--health-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set or alter a healthcheck command for a container. The command is a command to be executed inside the +container that determines the container health. The command is required for other healthcheck options +to be applied. A value of **none** disables existing healthchecks. + +Multiple options can be passed in the form of a JSON array; otherwise, the command is interpreted +as an argument to **/bin/sh -c**. + +Note: The default values are used even if healthcheck is configured in the image. + +[//]: # (END included file options/health-cmd.md) + + +[//]: # (BEGIN included file options/health-interval.md) +#### **--health-interval**=*interval* + +Set an interval for the healthchecks. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-interval.md) + +Changing this setting resets the timer. + + +[//]: # (BEGIN included file options/health-log-destination.md) +#### **--health-log-destination**=*directory_path* + +Set the destination of the HealthCheck log. Directory path, local or events_logger (local use container state file) (Default: local) + +* `local`: (default) HealthCheck logs are stored in overlay containers. (For example: `$runroot/healthcheck.log`) +* `directory`: creates a log file named `-healthcheck.log` with HealthCheck logs in the specified directory. +* `events_logger`: The log will be written with logging mechanism set by events_logger. It also saves the log to a default directory, for performance on a system with a large number of logs. + +[//]: # (END included file options/health-log-destination.md) + +Warning: Changing this setting may cause the loss of previous logs. + + +[//]: # (BEGIN included file options/health-max-log-count.md) +#### **--health-max-log-count**=*number of stored logs* + +Set maximum number of attempts in the HealthCheck log file. ('0' value means an infinite number of attempts in the log file) (Default: 5 attempts) + +[//]: # (END included file options/health-max-log-count.md) + + +[//]: # (BEGIN included file options/health-max-log-size.md) +#### **--health-max-log-size**=*size of stored logs* + +Set maximum length in characters of stored HealthCheck log. ("0" value means an infinite log length) (Default: 500 characters) + +[//]: # (END included file options/health-max-log-size.md) + + +[//]: # (BEGIN included file options/health-on-failure.md) +#### **--health-on-failure**=*action* + +Action to take once the container transitions to an unhealthy state. The default is **none**. + +- **none**: Take no action. +- **kill**: Kill the container. +- **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. +- **stop**: Stop the container. + +[//]: # (END included file options/health-on-failure.md) + + +[//]: # (BEGIN included file options/health-retries.md) +#### **--health-retries**=*retries* + +The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is **3**. + +Note: This parameter can overwrite the healthcheck configuration from the image. + +[//]: # (END included file options/health-retries.md) + + +[//]: # (BEGIN included file options/health-start-period.md) +#### **--health-start-period**=*period* + +The initialization time needed for a container to bootstrap. The value can be expressed in time format like +**2m3s**. The default value is **0s**. + +Note: The health check command is executed as soon as a container is started, if the health check is successful +the container's health state will be updated to `healthy`. However, if the health check fails, the health state will +stay as `starting` until either the health check is successful or until the `--health-start-period` time is over. If the +health check command fails after the `--health-start-period` time is over, the health state will be updated to `unhealthy`. +The health check command is executed periodically based on the value of `--health-interval`. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-start-period.md) + + +[//]: # (BEGIN included file options/health-startup-cmd.md) +#### **--health-startup-cmd**=*"command"* | *'["command", "arg1", ...]'* + +Set a startup healthcheck command for a container. This command is executed inside the container and is used to gate the regular +healthcheck. When the startup command succeeds, the regular healthcheck begins and the startup healthcheck ceases. Optionally, +if the command fails for a set number of attempts, the container is restarted. A startup healthcheck can be used to ensure that +containers with an extended startup period are not marked as unhealthy until they are fully started. Startup healthchecks can only be +used when a regular healthcheck (from the container's image or the **--health-cmd** option) is also set. + +[//]: # (END included file options/health-startup-cmd.md) + + +[//]: # (BEGIN included file options/health-startup-interval.md) +#### **--health-startup-interval**=*interval* + +Set an interval for the startup healthcheck. An _interval_ of **disable** results in no automatic timer setup. The default is **30s**. + +[//]: # (END included file options/health-startup-interval.md) + +Changing this setting resets the timer, depending on the state of the container. + + +[//]: # (BEGIN included file options/health-startup-retries.md) +#### **--health-startup-retries**=*retries* + +The number of attempts allowed before the startup healthcheck restarts the container. If set to **0**, the container is never restarted. The default is **0**. + +[//]: # (END included file options/health-startup-retries.md) + + +[//]: # (BEGIN included file options/health-startup-success.md) +#### **--health-startup-success**=*retries* + +The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value +of **0** means that any success begins the regular healthcheck. The default is **0**. + +[//]: # (END included file options/health-startup-success.md) + + +[//]: # (BEGIN included file options/health-startup-timeout.md) +#### **--health-startup-timeout**=*timeout* + +The maximum time a startup healthcheck command has to complete before it is marked as failed. The value can be expressed in a time +format like **2m3s**. The default value is **30s**. + +[//]: # (END included file options/health-startup-timeout.md) + + +[//]: # (BEGIN included file options/health-timeout.md) +#### **--health-timeout**=*timeout* + +The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the +value can be expressed in a time format such as **1m22s**. The default value is **30s**. + +Note: A timeout marks the healthcheck as failed but does not terminate the running process. +This ensures that a slow but eventually successful healthcheck does not disrupt the container +but is still accounted for in the health status. + +Note: This parameter will overwrite related healthcheck configuration from the image. + +[//]: # (END included file options/health-timeout.md) + + +[//]: # (BEGIN included file options/memory.md) +#### **--memory**, **-m**=*number[unit]* + +Memory limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Allows the memory available to a container to be constrained. If the host +supports swap memory, then the **-m** memory setting can be larger than physical +RAM. If a limit of 0 is specified (not using **-m**), the container's memory is +not limited. The actual limit may be rounded up to a multiple of the operating +system's page size (the value is very large, that's millions of trillions). + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory.md) + + +[//]: # (BEGIN included file options/memory-reservation.md) +#### **--memory-reservation**=*number[unit]* + +Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +After setting memory reservation, when the system detects memory contention +or low memory, containers are forced to restrict their consumption to their +reservation. So always set the value below **--memory**, otherwise the +hard limit takes precedence. By default, memory reservation is the same +as memory limit. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-reservation.md) + + +[//]: # (BEGIN included file options/memory-swap.md) +#### **--memory-swap**=*number[unit]* + +A limit value equal to memory plus swap. +A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes). + +Must be used with the **-m** (**--memory**) flag. +The argument value must be larger than that of + **-m** (**--memory**) By default, it is set to double +the value of **--memory**. + +Set _number_ to **-1** to enable unlimited swap. + +This option is not supported on cgroups V1 rootless systems. + +[//]: # (END included file options/memory-swap.md) + + +[//]: # (BEGIN included file options/memory-swappiness.md) +#### **--memory-swappiness**=*number* + +Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*. + +This flag is only supported on cgroups V1 rootful systems. + +[//]: # (END included file options/memory-swappiness.md) + + +[//]: # (BEGIN included file options/no-healthcheck.md) +#### **--no-healthcheck** + +Disable any defined healthchecks for container. + +[//]: # (END included file options/no-healthcheck.md) + + +[//]: # (BEGIN included file options/pids-limit.md) +#### **--pids-limit**=*limit* + +Tune the container's pids limit. Set to **-1** to have unlimited pids for the container. The default is **2048** on systems that support "pids" cgroup controller. + +[//]: # (END included file options/pids-limit.md) + + +[//]: # (BEGIN included file options/restart.md) +#### **--restart**=*policy* + +Restart policy to follow when containers exit. +Restart policy does not take effect if a container is stopped via the **podman kill** or **podman stop** commands. + +Valid _policy_ values are: + +- `no` : Do not restart containers on exit +- `never` : Synonym for **no**; do not restart containers on exit +- `on-failure[\:max_retries]` : Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional *max_retries* count is hit +- `always` : Restart containers when they exit, regardless of status, retrying indefinitely +- `unless-stopped` : Identical to **always** + +Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot. + +When running containers in systemd services, use the restart functionality provided by systemd. +In other words, do not use this option in a container unit, instead set the `Restart=` systemd directive in the `[Service]` section. +See **podman-systemd.unit**(5) and **systemd.service**(5). + +[//]: # (END included file options/restart.md) + + +[//]: # (BEGIN included file options/unsetenv.update.md) +#### **--unsetenv**=*env* + +Unset environment variables from the container. + +Note that the env updates only affect the main container process after +the next start. + +[//]: # (END included file options/unsetenv.update.md) + + +## EXAMPLEs + +Update a container with a new cpu quota and period. +``` +podman update --cpus=5 myCtr +``` + +Update a container with all available options for cgroups v2. +``` +podman update --cpus 5 --cpuset-cpus 0 --cpu-shares 123 --cpuset-mems 0 --memory 1G --memory-swap 2G --memory-reservation 2G --blkio-weight-device /dev/zero:123 --blkio-weight 123 --device-read-bps /dev/zero:10mb --device-write-bps /dev/zero:10mb --device-read-iops /dev/zero:1000 --device-write-iops /dev/zero:1000 --pids-limit 123 ctrID +``` + +Update a container with all available options for cgroups v1. +``` +podman update --cpus 5 --cpuset-cpus 0 --cpu-shares 123 --cpuset-mems 0 --memory 1G --memory-swap 2G --memory-reservation 2G --memory-swappiness 50 --pids-limit 123 ctrID +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-create(1)](podman-create.1.md)**, **[podman-run(1)](podman-run.1.md)** + +## HISTORY +August 2022, Originally written by Charlie Doern diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-version.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-version.1.md new file mode 100644 index 000000000..fb2683f5a --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-version.1.md @@ -0,0 +1,60 @@ +--- +title: podman-version +version: v5.5.2 +--- + +% podman-version 1 + +## NAME +podman\-version - Display the Podman version information + +## SYNOPSIS +**podman version** [*options*] + +## DESCRIPTION +Shows the following information: Remote API Version, Version, Go Version, Git Commit, Build Time, +OS, and Architecture. + +## OPTIONS + +#### **--format**, **-f**=*format* + +Change output format to "json" or a Go template. + +| **Placeholder** | **Description** | +| ------------------- | ------------------------ | +| .Client ... | Version of local podman | +| .Server ... | Version of remote podman | + +Each of the above fields branch deeper into further subfields +such as .Version, .APIVersion, .GoVersion, and more. + +## Example + +A sample output of the `version` command: +``` +$ podman version +Version: 2.0.0 +API Version: 1 +Go Version: go1.14.2 +Git Commit: 4520664f63c3a7f9a80227715359e20069d95542 +Built: Tue May 19 10:48:59 2020 +OS/Arch: linux/amd64 +``` + +Filtering out only the version: +``` +$ podman version --format '{{.Client.Version}}' +2.0.0 +``` + +#### **--help**, **-h** + +Print usage statement + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +November 2018, Added --format flag by Tomas Tomecek +July 2017, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-volume-create.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-volume-create.1.md new file mode 100644 index 000000000..542e80237 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-volume-create.1.md @@ -0,0 +1,213 @@ +--- +title: podman-volume-create +version: v5.5.2 +--- + +% podman-volume-create 1 + +## NAME +podman\-volume\-create - Create a new volume + +## SYNOPSIS +**podman volume create** [*options*] [*name*] + +## DESCRIPTION + +Creates an empty volume and prepares it to be used by containers. The volume +can be created with a specific name, if a name is not given a random name is +generated. You can add metadata to the volume by using the **--label** flag and +driver options can be set using the **--opt** flag. + +## OPTIONS + +#### **--driver**, **-d**=*driver* + +Specify the volume driver name (default **local**). +There are two drivers supported by Podman itself: **local** and **image**. + +The **local** driver uses a directory on disk as the backend by default, but can also use the **mount(8)** command to mount a filesystem as the volume if **--opt** is specified. + +The **image** driver uses an image as the backing store of for the volume. +An overlay filesystem is created, which allows changes to the volume to be committed as a new layer on top of the image. + +Using a value other than **local** or **image**, Podman attempts to create the volume using a volume plugin with the given name. +Such plugins must be defined in the **volume_plugins** section of the **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** configuration file. + +#### **--help** + +Print usage statement + +#### **--ignore** + +Don't fail if the named volume already exists, instead just print the name. Note that the new options are not applied to the existing volume. + +#### **--label**, **-l**=*label* + +Set metadata for a volume (e.g., --label mykey=value). + +#### **--opt**, **-o**=*option* + +Set driver specific options. +For the default driver, **local**, this allows a volume to be configured to mount a filesystem on the host. + +For the `local` driver the following options are supported: `type`, `device`, `o`, and `[no]copy`. + + - The `type` option sets the type of the filesystem to be mounted, and is equivalent to the `-t` flag to **mount(8)**. + - The `device` option sets the device to be mounted, and is equivalent to the `device` argument to **mount(8)**. + - The `copy` option enables copying files from the container image path where the mount is created to the newly created volume on the first run. `copy` is the default. + +The `o` option sets options for the mount, and is equivalent to the filesystem +options (also `-o`) passed to **mount(8)** with the following exceptions: + + - The `o` option supports `uid` and `gid` options to set the UID and GID of the created volume that are not normally supported by **mount(8)**. + - The `o` option supports the `size` option to set the maximum size of the created volume, the `inodes` option to set the maximum number of inodes for the volume, and `noquota` to completely disable quota support even for tracking of disk usage. + The `size` option is supported on the "tmpfs" and "xfs[note]" file systems. + The `inodes` option is supported on the "xfs[note]" file systems. + Note: xfs filesystems must be mounted with the `prjquota` flag described in the **xfs_quota(8)** man page. Podman will throw an error if they're not. + - The `o` option supports using volume options other than the UID/GID options with the **local** driver and requires root privileges. + - The `o` options supports the `timeout` option which allows users to set a driver specific timeout in seconds before volume creation fails. For example, **--opt=o=timeout=10** sets a driver timeout of 10 seconds. + +***Note*** Do not confuse the `--opt,-o` create option with the `-o` mount option. For example, with `podman volume create`, use `-o=o=uid=1000` *not* `-o=uid=1000`. + +For the **image** driver, the only supported option is `image`, which specifies the image the volume is based on. +This option is mandatory when using the **image** driver. + +When not using the **local** and **image** drivers, the given options are passed directly to the volume plugin. In this case, supported options are dictated by the plugin in question, not Podman. + +## EXAMPLES + +Create empty volume. +``` +$ podman volume create +``` + +Create empty named volume. +``` +$ podman volume create myvol +``` + +Create empty named volume with specified label. +``` +$ podman volume create --label foo=bar myvol +``` + +Create tmpfs named volume with specified size and mount options. +``` +# podman volume create --opt device=tmpfs --opt type=tmpfs --opt o=size=2M,nodev,noexec myvol +``` + +Create tmpfs named volume testvol with specified options. +``` +# podman volume create --opt device=tmpfs --opt type=tmpfs --opt o=uid=1000,gid=1000 testvol +``` + +Create image named volume using the specified local image in containers/storage. +``` +# podman volume create --driver image --opt image=fedora\:latest fedoraVol +``` + +## QUOTAS + +`podman volume create` uses `XFS project quota controls` for controlling the size and the number of inodes of builtin volumes. The directory used to store the volumes must be an `XFS` file system and be mounted with the `pquota` option. + +Example /etc/fstab entry: +``` +/dev/podman/podman-var /var xfs defaults,x-systemd.device-timeout=0,pquota 1 2 +``` + +Podman generates project IDs for each builtin volume, but these project IDs need to be unique for the XFS file system. These project IDs by default are generated randomly, with a potential for overlap with other quotas on the same file +system. + +The xfs_quota tool can be used to assign a project ID to the storage driver directory, e.g.: + +``` +echo 100000:/var/lib/containers/storage/overlay >> /etc/projects +echo 200000:/var/lib/containers/storage/volumes >> /etc/projects +echo storage:100000 >> /etc/projid +echo volumes:200000 >> /etc/projid +xfs_quota -x -c 'project -s storage volumes' / +``` + +In the example above we are configuring the overlay storage driver for newly +created containers as well as volumes to use project IDs with a **start offset**. +All containers are assigned larger project IDs (e.g. >= 100000). +All volume assigned project IDs larger project IDs starting with 200000. +This prevents xfs_quota management conflicts with containers/storage. + +## MOUNT EXAMPLES + +`podman volume create` allows the `type`, `device`, and `o` options to be passed to `mount(8)` when using the `local` driver. + +## [s3fs-fuse](https://github.com/s3fs-fuse/s3fs-fuse) + +[s3fs-fuse](https://github.com/s3fs-fuse/s3fs-fuse) or just `s3fs`, is a [fuse](https://github.com/libfuse/libfuse) filesystem that allows s3 prefixes to be mounted as filesystem mounts. + +**Installing:** +```shell +$ doas dnf install s3fs-fuse +``` + +**Simple usage:** +```shell +$ s3fs --help +$ s3fs -o use_xattr,endpoint=aq-central-1 bucket:/prefix /mnt +``` + +**Equivalent through `mount(8)`** +```shell +$ mount -t fuse.s3fs -o use_xattr,endpoint=aq-central-1 bucket:/prefix /mnt +``` + +**Equivalent through `podman volume create`** +```shell +$ podman volume create s3fs-fuse-volume -o type=fuse.s3fs -o device=bucket:/prefix -o o=use_xattr,endpoint=aq-central-1 +``` + +**The volume can then be mounted in a container with** +```shell +$ podman run -v s3fs-fuse-volume:/s3:z --rm -it fedora:latest +``` + +Please see the available [options](https://github.com/s3fs-fuse/s3fs-fuse/wiki/Fuse-Over-Amazon#options) on their wiki. + +### Using with other container users + +The above example works because the volume is mounted as the host user and inside the container `root` is mapped to the user in the host. + +If the mount is accessed by a different user inside the container, a "Permission denied" error will be raised. + +```shell +$ podman run --user bin:bin -v s3fs-fuse-volume:/s3:z,U --rm -it fedora:latest +$ ls /s3 +# ls: /s3: Permission denied +``` + +In FUSE-land, mounts are protected for the user who mounted them; specify the `allow_other` mount option if other users need access. +> Note: This will remove the normal fuse [security measures](https://github.com/libfuse/libfuse/wiki/FAQ#why-dont-other-users-have-access-to-the-mounted-filesystem) on the mount point, after which, the normal filesystem permissions will have to protect it + +```shell +$ podman volume create s3fs-fuse-other-volume -o type=fuse.s3fs -o device=bucket:/prefix -o o=allow_other,use_xattr,endpoint=aq-central-1 +$ podman run --user bin:bin -v s3fs-fuse-volume:/s3:z,U --rm -it fedora\:latest +$ ls /s3 +``` + +### The Prefix must exist + +`s3fs` will fail to mount if the prefix does not exist in the bucket. + +Create a s3-directory by putting an empty object at the desired `prefix/` key +```shell +$ aws s3api put-object --bucket bucket --key prefix/ +``` + +If performance is the priority, please check out the more performant [goofys](https://github.com/kahing/goofys). + +> FUSE filesystems exist for [Google Cloud Storage](https://github.com/GoogleCloudPlatform/gcsfuse) and [Azure Blob Storage](https://github.com/Azure/azure-storage-fuse) + + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[podman-volume(1)](podman-volume.1.md)**, **mount(8)**, **xfs_quota(8)**, **xfs_quota(8)**, **projects(5)**, **projid(5)** + +## HISTORY +January 2020, updated with information on volume plugins by Matthew Heon +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-volume-exists.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-volume-exists.1.md new file mode 100644 index 000000000..c8dfcba86 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-volume-exists.1.md @@ -0,0 +1,48 @@ +--- +title: podman-volume-exists +version: v5.5.2 +--- + +% podman-volume-exists 1 + +## NAME +podman\-volume\-exists - Check if the given volume exists + +## SYNOPSIS +**podman volume exists** *volume* + +## DESCRIPTION +**podman volume exists** checks if a volume exists. Podman returns an exit code +of `0` when the volume is found. A `1` is returned otherwise. An exit code of +`125` indicates there was another issue. + + +## OPTIONS + +#### **--help**, **-h** + +Print usage statement + +## EXAMPLE + +Check if a volume called `myvol` exists (the volume does actually exist). +``` +$ podman volume exists myvol +$ echo $? +0 +$ +``` + +Check if a volume called `mysql` exists (the volume does not actually exist). +``` +$ podman volume exists mysql +$ echo $? +1 +$ +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** + +## HISTORY +January 2021, Originally compiled by Paul Holzinger `` diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-volume-export.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-volume-export.1.md new file mode 100644 index 000000000..24c78481a --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-volume-export.1.md @@ -0,0 +1,43 @@ +--- +title: podman-volume-export +version: v5.5.2 +--- + +% podman-volume-export 1 + +## NAME +podman\-volume\-export - Export volume to external tar + +## SYNOPSIS +**podman volume export** [*options*] *volume* + +## DESCRIPTION + +**podman volume export** exports the contents of a podman volume and saves it as a tarball +on the local machine. **podman volume export** writes to STDOUT by default and can be +redirected to a file using the `--output` flag. + +Note: Following command is not supported by podman-remote. + +**podman volume export [OPTIONS] VOLUME** + +## OPTIONS + +#### **--help** + +Print usage statement + +#### **--output**, **-o**=*file* + +Write to a file, default is STDOUT + +## EXAMPLES + +Export named volume content into the specified file. +``` +$ podman volume export myvol --output myvol.tar + +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-volume-import(1)](podman-volume-import.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-volume-import.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-volume-import.1.md new file mode 100644 index 000000000..7dfcf5d2e --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-volume-import.1.md @@ -0,0 +1,46 @@ +--- +title: podman-volume-import +version: v5.5.2 +--- + +% podman-volume-import 1 + +## NAME +podman\-volume\-import - Import tarball contents into an existing podman volume + +## SYNOPSIS +**podman volume import** *volume* [*source*] + +## DESCRIPTION + +**podman volume import** imports the contents of a tarball into the podman volume's mount point. +The contents of the volume is merged with the content of the tarball with the latter taking precedence. +**podman volume import** can consume piped input when using `-` as source path. + +The given volume must already exist and is not created by podman volume import. + +Note: Following command is not supported by podman-remote. + +#### **--help** + +Print usage statement + +## EXAMPLES + +Import named volume content from the specified file. +``` +$ podman volume import myvol test.tar +``` + +Import named volume content from stdin. +``` +$ gunzip -c hello.tar.gz | podman volume import myvol - +``` + +Export the content from named volume and pipe it into the named volume via stdin. +``` +$ podman volume export oldmyvol | podman volume import myvol - +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-volume-export(1)](podman-volume-export.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-volume-inspect.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-volume-inspect.1.md new file mode 100644 index 000000000..ae8e54a7f --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-volume-inspect.1.md @@ -0,0 +1,109 @@ +--- +title: podman-volume-inspect +version: v5.5.2 +--- + +% podman-volume-inspect 1 + +## NAME +podman\-volume\-inspect - Get detailed information on one or more volumes + +## SYNOPSIS +**podman volume inspect** [*options*] *volume* [...] + +## DESCRIPTION + +Display detailed information on one or more volumes. The output can be formatted using +the **--format** flag and a Go template. To get detailed information about all the +existing volumes, use the **--all** flag. +Volumes can be queried individually by providing their full name or a unique partial name. + + +## OPTIONS + +#### **--all**, **-a** + +Inspect all volumes. + +#### **--format**, **-f**=*format* + +Format volume output using Go template + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------- | --------------------------------------------------------------------------- | +| .Anonymous | Indicates whether volume is anonymous | +| .CreatedAt ... | Volume creation time | +| .Driver | Volume driver | +| .GID | GID the volume was created with | +| .Labels ... | Label information associated with the volume | +| .LockNumber | Number of the volume's Libpod lock | +| .MountCount | Number of times the volume is mounted | +| .Mountpoint | Source of volume mount point | +| .Name | Volume name | +| .NeedsChown | Indicates volume will be chowned on next use | +| .NeedsCopyUp | Indicates data at the destination will be copied into the volume on next use| +| .Options ... | Volume options | +| .Scope | Volume scope | +| .Status ... | Status of the volume | +| .StorageID | StorageID of the volume | +| .Timeout | Timeout of the volume | +| .UID | UID the volume was created with | + +#### **--help** + +Print usage statement + + +## EXAMPLES + +Inspect named volume. +``` +$ podman volume inspect myvol +[ + { + "Name": "myvol", + "Driver": "local", + "Mountpoint": "/home/myusername/.local/share/containers/storage/volumes/myvol/_data", + "CreatedAt": "2023-03-13T16:26:48.423069028-04:00", + "Labels": {}, + "Scope": "local", + "Options": {}, + "MountCount": 0, + "NeedsCopyUp": true, + "NeedsChown": true + } +] +``` + +Inspect all volumes. +``` +$ podman volume inspect --all +[ + { + "Name": "myvol", + "Driver": "local", + "Mountpoint": "/home/myusername/.local/share/containers/storage/volumes/myvol/_data", + "CreatedAt": "2023-03-13T16:26:48.423069028-04:00", + "Labels": {}, + "Scope": "local", + "Options": {}, + "MountCount": 0, + "NeedsCopyUp": true, + "NeedsChown": true + } +] +``` + +Inspect named volume and display its Driver and Scope field. +``` +$ podman volume inspect --format "{{.Driver}} {{.Scope}}" myvol +local local +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-volume-ls.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-volume-ls.1.md new file mode 100644 index 000000000..7a266e5d8 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-volume-ls.1.md @@ -0,0 +1,117 @@ +--- +title: podman-volume-ls +version: v5.5.2 +--- + +% podman-volume-ls 1 + +## NAME +podman\-volume\-ls - List all the available volumes + +## SYNOPSIS +**podman volume ls** [*options*] + +## DESCRIPTION + +Lists all the volumes that exist. The output can be filtered using the **--filter** +flag and can be formatted to either JSON or a Go template using the **--format** +flag. Use the **--quiet** flag to print only the volume names. + +## OPTIONS + +#### **--filter**, **-f**=*filter* + +Filter what volumes are shown in the output. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive, with the only exception being `label` +which is exclusive. Filters with different keys always work exclusive. + +Volumes can be filtered by the following attributes: + +| **Filter** | **Description** | +| ---------- | ------------------------------------------------------------------------------------- | +| dangling | [Dangling] Matches all volumes not referenced by any containers | +| driver | [Driver] Matches volumes based on their driver | +| label | [Key] or [Key=Value] Label assigned to a volume | +| name | [Name] Volume name (accepts regex) | +| opt | Matches a storage driver options | +| scope | Filters volume by scope | +| after/since | Filter by volumes created after the given VOLUME (name or tag) | +| until | Only remove volumes created before given timestamp | + +#### **--format**=*format* + +Format volume output using Go template. + +Valid placeholders for the Go template are listed below: + +| **Placeholder** | **Description** | +| ------------------------- | -------------------------------------------- | +| .Anonymous | Indicates whether volume is anonymous | +| .CreatedAt ... | Volume creation time | +| .Driver | Volume driver | +| .GID | GID of volume | +| .InspectVolumeData ... | Don't use | +| .Labels ... | Label information associated with the volume | +| .LockNumber | Number of the volume's Libpod lock | +| .MountCount | Number of times the volume is mounted | +| .Mountpoint | Source of volume mount point | +| .Name | Volume name | +| .NeedsChown | Indicates whether volume needs to be chowned | +| .NeedsCopyUp | Indicates if volume needs to be copied up to | +| .Options ... | Volume options | +| .Scope | Volume scope | +| .Status ... | Status of the volume | +| .StorageID | StorageID of the volume | +| .Timeout | Timeout of the volume | +| .UID | UID of volume | +| .VolumeConfigResponse ... | Don't use | + +#### **--help** + +Print usage statement. + + +[//]: # (BEGIN included file options/noheading.md) +#### **--noheading**, **-n** + +Omit the table headings from the listing. + +[//]: # (END included file options/noheading.md) + +#### **--quiet**, **-q** + +Print volume output in quiet mode. Only print the volume names. + +## EXAMPLES + +List all volumes. +``` +$ podman volume ls +``` + +List all volumes and display content as json format. +``` +$ podman volume ls --format json +``` + +List all volumes and display their Driver and Scope fields +``` +$ podman volume ls --format "{{.Driver}} {{.Scope}}" +``` + +List volumes with the name foo and label blue. +``` +$ podman volume ls --filter name=foo,label=blue +``` + +List volumes with the label key=value. +``` +$ podman volume ls --filter label=key=value +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-volume-mount.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-volume-mount.1.md new file mode 100644 index 000000000..045b0981c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-volume-mount.1.md @@ -0,0 +1,41 @@ +--- +title: podman-volume-mount +version: v5.5.2 +--- + +% podman-volume-mount 1 + +## NAME +podman\-volume\-mount - Mount a volume filesystem + +## SYNOPSIS +**podman volume mount** [*volume* ...] + +## DESCRIPTION +Mounts the specified volumes' file system in a location which can be +accessed from the host, and returns its location. + +Rootless mode only supports mounting file volumes unless Podman is run within the user namespace +via the `podman unshare` command. All other volume types fail to mount. + +## RETURN VALUE +The location of the mounted file system. On error an empty string and errno is +returned. + +## EXAMPLE + +Mount specified volume. As Root: +``` +# podman volume mount foo +/home/dwalsh/.local/share/containers/storage/volumes/foo/_data +``` + +In rootless mode, volume mounting only works after executing the podman unshare command to enter the user namespace. +``` +$ podman unshare +# podman volume mount foo +/home/dwalsh/.local/share/containers/storage/volumes/foo/_data +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-volume-unmount(1)](podman-volume-unmount.1.md)**, **[podman-unshare(1)](podman-unshare.1.md)**, **mount(8)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-volume-prune.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-volume-prune.1.md new file mode 100644 index 000000000..a568a1223 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-volume-prune.1.md @@ -0,0 +1,77 @@ +--- +title: podman-volume-prune +version: v5.5.2 +--- + +% podman-volume-prune 1 + +## NAME +podman\-volume\-prune - Remove all unused volumes + +## SYNOPSIS +**podman volume prune** [*options*] + +## DESCRIPTION + +Removes unused volumes. By default all unused volumes are removed, the **--filter** flag can +be used to filter specific volumes. Users are prompted to confirm the removal of all the +unused volumes. To bypass the confirmation, use the **--force** flag. + + +## OPTIONS + +#### **--filter** + +Provide filter values. + +The *filters* argument format is of `key=value`. If there is more than one *filter*, then pass multiple OPTIONS: **--filter** *foo=bar* **--filter** *bif=baz*. + +Supported filters: + +| Filter | Description | +|:-----------:|------------------------------------------------------------------------------------------------------------| +| dangling | [Bool] Only remove volumes not referenced by any containers | +| driver | [String] Only remove volumes with the given driver | +| label | [String] Only remove volumes, with (or without, in the case of label!=[...] is used) the specified labels. | +| name | [String] Only remove volume with the given name | +| opt | [String] Only remove volumes created with the given options | +| scope | [String] Only remove volumes with the given scope | +| until | [DateTime] Only remove volumes created before given timestamp. | +| after/since | [Volume] Filter by volumes created after the given VOLUME (name or tag) | + +The `label` *filter* accepts two formats. One is the `label`=*key* or `label`=*key*=*value*, which removes volumes with the specified labels. The other format is the `label!`=*key* or `label!`=*key*=*value*, which removes volumes without the specified labels. + +The `until` *filter* can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the machine’s time. + +#### **--force**, **-f** + +Do not prompt for confirmation. + +#### **--help** + +Print usage statement + + +## EXAMPLES + + +Prune all unused volumes. +``` +$ podman volume prune +``` + +Prune all volumes. Note: this command will also remove all containers that are using a volume. +``` +$ podman volume prune --force +``` + +Prune all volumes that contain the specified label. +``` +$ podman volume prune --filter label=mylabel=mylabelvalue +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-volume-reload.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-volume-reload.1.md new file mode 100644 index 000000000..bb4e954c9 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-volume-reload.1.md @@ -0,0 +1,35 @@ +--- +title: podman-volume-reload +version: v5.5.2 +--- + +% podman-volume-reload 1 + +## NAME +podman\-volume\-reload - Reload all volumes from volumes plugins + +## SYNOPSIS +**podman volume reload** + +## DESCRIPTION + +**podman volume reload** checks all configured volume plugins and updates the libpod database with all available volumes. +Existing volumes are also removed from the database when they are no longer present in the plugin. + +This command it is best effort and cannot guarantee a perfect state because plugins can be modified from the outside at any time. + +Note: This command is not supported with podman-remote. + +## EXAMPLES + +Reload the volume plugins. +``` +$ podman volume reload +Added: +vol6 +Removed: +t3 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-volume-rm.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-volume-rm.1.md new file mode 100644 index 000000000..89b0cf180 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-volume-rm.1.md @@ -0,0 +1,70 @@ +--- +title: podman-volume-rm +version: v5.5.2 +--- + +% podman-volume-rm 1 + +## NAME +podman\-volume\-rm - Remove one or more volumes + +## SYNOPSIS +**podman volume rm** [*options*] *volume* [...] + +## DESCRIPTION + +Removes one or more volumes. Only volumes that are not being used are removed. +If a volume is being used by a container, an error is returned unless the **--force** +flag is being used. To remove all volumes, use the **--all** flag. +Volumes can be removed individually by providing their full name or a unique partial name. + +## OPTIONS + +#### **--all**, **-a** + +Remove all volumes. + +#### **--force**, **-f** + +Remove a volume by force. +If it is being used by containers, the containers are removed first. + +#### **--help** + +Print usage statement + +#### **--time**, **-t**=*seconds* + +Seconds to wait before forcibly stopping running containers that are using the specified volume. The --force option must be specified to use the --time option. Use -1 for infinite wait. + +## EXAMPLES + +Remove multiple specified volumes. +``` +$ podman volume rm myvol1 myvol2 +``` + +Remove all volumes. +``` +$ podman volume rm --all +``` + +Remove the specified volume even if it is in use. Note, this removes all containers using the volume. +``` +$ podman volume rm --force myvol +``` + +## Exit Status + **0** All specified volumes removed + + **1** One of the specified volumes did not exist, and no other failures + + **2** One of the specified volumes is being used by a container + + **125** The command fails for any other reason + +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-volume-unmount.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-volume-unmount.1.md new file mode 100644 index 000000000..789031692 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-volume-unmount.1.md @@ -0,0 +1,37 @@ +--- +title: podman-volume-unmount +version: v5.5.2 +--- + +% podman-volume-unmount 1 + +## NAME +podman\-volume\-unmount - Unmount a volume + +## SYNOPSIS +**podman volume unmount** *volume* [...] + +**podman volume umount** *volume* [...] + +## DESCRIPTION +Unmounts the specified volume, if there are no other containers +using it. + +Volume storage increments a mount counter each time a volume is mounted. +When a volume is unmounted, the mount counter is decremented, and the +volume's filesystem is physically unmounted only when the mount +counter reaches zero indicating no other processes are using the mount. + +## EXAMPLE + +Unmount volume with a given ID: +``` +podman volume unmount volumeID +``` + +Unmount multiple volumes with given IDs: +``` +podman volume unmount volumeID1 volumeID2 volumeID3 +``` +## SEE ALSO +**[podman(1)](podman.1.md)**, **[podman-volume(1)](podman-volume.1.md)**, **[podman-volume-mount(1)](podman-volume-mount.1.md)** diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-volume.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-volume.1.md new file mode 100644 index 000000000..dffc07b54 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-volume.1.md @@ -0,0 +1,37 @@ +--- +title: podman-volume +version: v5.5.2 +--- + +% podman-volume 1 + +## NAME +podman\-volume - Simple management tool for volumes + +## SYNOPSIS +**podman volume** *subcommand* + +## DESCRIPTION +podman volume is a set of subcommands that manage volumes. + +## SUBCOMMANDS + +| Command | Man Page | Description | +| ------- | ------------------------------------------------------ | ------------------------------------------------------------------------------ | +| create | [podman-volume-create(1)](podman-volume-create.1.md) | Create a new volume. | +| exists | [podman-volume-exists(1)](podman-volume-exists.1.md) | Check if the given volume exists. | +| export | [podman-volume-export(1)](podman-volume-export.1.md) | Export volume to external tar. | +| import | [podman-volume-import(1)](podman-volume-import.1.md) | Import tarball contents into an existing podman volume. | +| inspect | [podman-volume-inspect(1)](podman-volume-inspect.1.md) | Get detailed information on one or more volumes. | +| ls | [podman-volume-ls(1)](podman-volume-ls.1.md) | List all the available volumes. | +| mount | [podman-volume-mount(1)](podman-volume-mount.1.md) | Mount a volume filesystem. | +| prune | [podman-volume-prune(1)](podman-volume-prune.1.md) | Remove all unused volumes. | +| reload | [podman-volume-reload(1)](podman-volume-reload.1.md) | Reload all volumes from volumes plugins. | +| rm | [podman-volume-rm(1)](podman-volume-rm.1.md) | Remove one or more volumes. | +| unmount | [podman-volume-unmount(1)](podman-volume-unmount.1.md) | Unmount a volume. | + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +November 2018, Originally compiled by Urvashi Mohnani diff --git a/versioned_docs/version-5.5.2/source/markdown/podman-wait.1.md b/versioned_docs/version-5.5.2/source/markdown/podman-wait.1.md new file mode 100644 index 000000000..dad299a26 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman-wait.1.md @@ -0,0 +1,103 @@ +--- +title: podman-wait +version: v5.5.2 +--- + +% podman-wait 1 + +## NAME +podman\-wait - Wait on one or more containers to stop and print their exit codes + +## SYNOPSIS +**podman wait** [*options*] *container* [...] + +**podman container wait** [*options*] *container* [...] + +## DESCRIPTION +Waits on one or more containers to stop. The container can be referred to by its +name or ID. In the case of multiple containers, Podman waits on each consecutively. +After all conditions are satisfied, the containers' return codes are printed +separated by newline in the same order as they were given to the command. An +exit code of -1 is emitted for all conditions other than "stopped" and +"exited". + +When waiting for containers with a restart policy of `always` or `on-failure`, +such as those created by `podman kube play`, the containers may be repeatedly +exiting and restarting, possibly with different exit codes. `podman wait` will +only display and detect the first exit after the wait command was started. + +When running a container with podman run --rm wait does not wait for the +container to be fully removed. To wait for the removal of a container use +`--condition=removing`. + +## OPTIONS + +#### **--condition**=*state* +Container state or condition to wait for. Can be specified multiple times where at least one condition must match for the command to return. Supported values are "configured", "created", "exited", "healthy", "initialized", "paused", "removing", "running", "stopped", "stopping", "unhealthy". The default condition is "stopped". + +#### **--help**, **-h** + + Print usage statement + + +#### **--ignore** +Ignore errors when a specified container is missing and mark its return code as -1. + +#### **--interval**, **-i**=*duration* + Time interval to wait before polling for completion. A duration string is a sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". Time unit defaults to "ms". + + +[//]: # (BEGIN included file options/latest.md) +#### **--latest**, **-l** + +Instead of providing the container name or ID, use the last created container. +Note: the last started container can be from other users of Podman on the host machine. +(This option is not available with the remote Podman client, including Mac and Windows +(excluding WSL2) machines) + +[//]: # (END included file options/latest.md) + +## EXAMPLES + +Wait for the specified container to exit. +``` +$ podman wait mywebserver +0 +``` + +Wait for the latest container to exit. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines) +``` +$ podman wait --latest +0 +``` + +Wait for the container to exit, checking every two seconds. +``` +$ podman wait --interval 2s mywebserver +0 +``` + +Wait for the container by ID. This container exits with error status 1: +``` +$ podman wait 860a4b23 +1 +``` + +Wait for both specified containers to exit. +``` +$ podman wait mywebserver myftpserver +0 +125 +``` + +Wait for the named container to exit, but do not fail if the container does not exist. +``` +$ podman wait --ignore does-not-exist +-1 +``` + +## SEE ALSO +**[podman(1)](podman.1.md)** + +## HISTORY +September 2017, Originally compiled by Brent Baude diff --git a/versioned_docs/version-5.5.2/source/markdown/podman.1.md b/versioned_docs/version-5.5.2/source/markdown/podman.1.md new file mode 100644 index 000000000..1e815990c --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podman.1.md @@ -0,0 +1,491 @@ +--- +title: podman +version: v5.5.2 +--- + +% podman 1 + +## NAME +podman - Simple management tool for pods, containers and images + +## SYNOPSIS +**podman** [*options*] *command* + +## DESCRIPTION +Podman (Pod Manager) is a fully featured container engine that is a simple daemonless tool. +Podman provides a Docker-CLI comparable command line that eases the transition from other +container engines and allows the management of pods, containers and images. Simply put: `alias docker=podman`. +Most Podman commands can be run as a regular user, without requiring additional +privileges. + +Podman uses Buildah(1) internally to create container images. Both tools share image +(not container) storage, hence each can use or manipulate images (but not containers) +created by the other. + +Default settings for flags are defined in `containers.conf`. Most settings for +Remote connections use the server's containers.conf, except when documented in +man pages. + +**podman [GLOBAL OPTIONS]** + +## GLOBAL OPTIONS + +#### **--cdi-spec-dir**=*path* + +The CDI spec directory path (may be set multiple times). Default path is `/etc/cdi`. + +#### **--cgroup-manager**=*manager* + +The CGroup manager to use for container cgroups. Supported values are __cgroupfs__ or __systemd__. Default is _systemd_ unless overridden in the containers.conf file. + +Note: Setting this flag can cause certain commands to break when called on containers previously created by the other CGroup manager type. +Note: CGroup manager is not supported in rootless mode when using CGroups Version V1. + +#### **--config** +Location of config file. Mainly for docker compatibility, only the authentication parts of the config are supported. + +#### **--conmon** +Path of the conmon binary (Default path is configured in `containers.conf`) + +#### **--connection**, **-c** +Connection to use for remote podman, including Mac and Windows (excluding WSL2) machines, (Default connection is configured in `containers.conf`) +Setting this option switches the **--remote** option to true. +Remote connections use local containers.conf for default. + +#### **--events-backend**=*type* + +Backend to use for storing events. Allowed values are **file**, **journald**, and +**none**. When *file* is specified, the events are stored under +`/events/events.log` (see **--tmpdir** below). + +#### **--help**, **-h** + +Print usage statement + +#### **--hooks-dir**=*path* + +Each `*.json` file in the path configures a hook for Podman containers. For more details on the syntax of the JSON files and the semantics of hook injection, see `oci-hooks(5)`. Podman and libpod currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. + +This option may be set multiple times; paths from later options have higher precedence (`oci-hooks(5)` discusses directory precedence). + +For the annotation conditions, libpod uses any annotations set in the generated OCI configuration. + +For the bind-mount conditions, only mounts explicitly requested by the caller via `--volume` are considered. Bind mounts that libpod inserts by default (e.g. `/dev/shm`) are not considered. + +If `--hooks-dir` is unset for root callers, Podman and libpod currently default to `/usr/share/containers/oci/hooks.d` and `/etc/containers/oci/hooks.d` in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting `--hooks-dir`. + +Podman and libpod currently support an additional `precreate` state which is called before the runtime's `create` operation. Unlike the other stages, which receive the container state on their standard input, `precreate` hooks receive the proposed runtime configuration on their standard input. They may alter that configuration as they see fit, and write the altered form to their standard output. + +**WARNING**: the `precreate` hook allows powerful changes to occur, such as adding additional mounts to the runtime configuration. That power also makes it easy to break things. Before reporting libpod errors, try running a container with `precreate` hooks disabled to see if the problem is due to one of the hooks. + +#### **--identity**=*path* + +Path to ssh identity file. If the identity file has been encrypted, podman prompts the user for the passphrase. +If no identity file is provided and no user is given, podman defaults to the user running the podman command. +Podman prompts for the login password on the remote server. + +Identity value resolution precedence: + - command line value + - environment variable `CONTAINER_SSHKEY`, if `CONTAINER_HOST` is found + - `containers.conf` +Remote connections use local containers.conf for default. + +#### **--imagestore**=*path* + +Path of the imagestore where images are stored. By default, the storage library stores all the images in the graphroot but if an imagestore is provided, then the storage library will store newly pulled images in the provided imagestore and keep using the graphroot for everything else. If the user is using the overlay driver, then the images which were already part of the graphroot will still be accessible. + +This will override *imagestore* option in `containers-storage.conf(5)`, refer to `containers-storage.conf(5)` for more details. + +#### **--log-level**=*level* + +Log messages at and above specified level: __debug__, __info__, __warn__, __error__, __fatal__ or __panic__ (default: _warn_) + +#### **--module**=*path* + +Load the specified `containers.conf(5)` module. Can be an absolute or relative path. Please refer to `containers.conf(5)` for details. + +This flag is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. +Further note that the flag is a root-level flag and must be specified before any Podman sub-command. + +#### **--network-cmd-path**=*path* +Path to the `slirp4netns(1)` command binary to use for setting up a slirp4netns network. +If "" is used, then the binary will first be searched using the `helper_binaries_dir` option in `containers.conf`, and second using the `$PATH` environment variable. +**Note:** This option is deprecated and will be removed with Podman 6.0. Use the `helper_binaries_dir` option in `containers.conf` instead. + +#### **--network-config-dir**=*directory* + +Path to the directory where network configuration files are located. +For the netavark backend "/etc/containers/networks" is used as root +and "$graphroot/networks" as rootless. +For the CNI backend the default is "/etc/cni/net.d" as root +and "$HOME/.config/cni/net.d" as rootless. +CNI is deprecated and will be removed in the next major Podman version 5.0 in preference of Netavark. + +#### **--out**=*path* +Redirect the output of podman to the specified path without affecting the container output or its logs. This parameter can be used to capture the output from any of podman's commands directly into a file and enable suppression of podman's output by specifying /dev/null as the path. To explicitly disable the container logging, the **--log-driver** option should be used. + +#### **--remote**, **-r** +When true, access to the Podman service is remote. Defaults to false. +Settings can be modified in the containers.conf file. If the CONTAINER_HOST +environment variable is set, the **--remote** option defaults to true. + +#### **--root**=*value* + +Storage root dir in which data, including images, is stored (default: "/var/lib/containers/storage" for UID 0, "$HOME/.local/share/containers/storage" for other users). +Default root dir configured in `containers-storage.conf(5)`. + +Overriding this option causes the *storage-opt* settings in `containers-storage.conf(5)` to be ignored. The user must specify additional options via the `--storage-opt` flag. + +#### **--runroot**=*value* + +Storage state directory where all state information is stored (default: "/run/containers/storage" for UID 0, "/run/user/$UID/run" for other users). +Default state dir configured in `containers-storage.conf(5)`. + +#### **--runtime**=*value* + +Name of the OCI runtime as specified in containers.conf or absolute path to the OCI compatible binary used to run containers. + +#### **--runtime-flag**=*flag* + +Adds global flags for the container runtime. To list the supported flags, please +consult the manpages of the selected container runtime (`runc` is the default +runtime, the manpage to consult is `runc(8)`. When the machine is configured +for cgroup V2, the default runtime is `crun`, the manpage to consult is `crun(8)`.). + +Note: Do not pass the leading `--` to the flag. To pass the runc flag `--log-format json` +to podman build, the option given can be `--runtime-flag log-format=json`. + + +#### **--ssh**=*value* + +This option allows the user to change the ssh mode, meaning that rather than using the default **golang** mode, one can instead use **--ssh=native** +to use the installed ssh binary and config file declared in containers.conf. + +#### **--storage-driver**=*value* + +Storage driver. The default storage driver for UID 0 is configured in `containers-storage.conf(5)` in rootless mode), and is *vfs* for non-root users when *fuse-overlayfs* is not available. The `STORAGE_DRIVER` environment variable overrides the default. The --storage-driver specified driver overrides all. + +Overriding this option causes the *storage-opt* settings in `containers-storage.conf(5)` to be ignored. The user must +specify additional options via the `--storage-opt` flag. + +#### **--storage-opt**=*value* + +Specify a storage driver option. Default storage driver options are configured in `containers-storage.conf(5)`. The `STORAGE_OPTS` environment variable overrides the default. The --storage-opt specified options override all. Specify --storage-opt="" so no storage options is used. + +#### **--syslog** + +Output logging information to syslog as well as the console (default *false*). + +On remote clients, including Mac and Windows (excluding WSL2) machines, logging is directed to the file $HOME/.config/containers/podman.log. + +#### **--tmpdir**=*path* + +Path to the tmp directory, for libpod runtime content. Defaults to `$XDG_RUNTIME_DIR/libpod/tmp` as rootless and `/run/libpod/tmp` as rootful. + +NOTE --tmpdir is not used for the temporary storage of downloaded images. Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + +#### **--transient-store** + +Enables a global transient storage mode where all container metadata is stored on non-persistent media (i.e. in the location specified by `--runroot`). +This mode allows starting containers faster, as well as guaranteeing a fresh state on boot in case of unclean shutdowns or other problems. However +it is not compatible with a traditional model where containers persist across reboots. + +Default value for this is configured in `containers-storage.conf(5)`. + +#### **--url**=*value* +URL to access Podman service (default from `containers.conf`, rootless `unix:///run/user/$UID/podman/podman.sock` or as root `unix:///run/podman/podman.sock`). +Setting this option switches the **--remote** option to true. + + - `CONTAINER_HOST` is of the format `://[]@][:][]` + +Details: + - `schema` is one of: + * `ssh` (default): a local unix(7) socket on the named `host` and `port`, reachable via SSH + * `tcp`: an unencrypted, unauthenticated TCP connection to the named `host` and `port` + * `unix`: a local unix(7) socket at the specified `path`, or the default for the user + - `user` defaults to either `root` or the current running user (`ssh` only) + - `password` has no default (`ssh` only) + - `host` must be provided and is either the IP or name of the machine hosting the Podman service (`ssh` and `tcp`) + - `port` defaults to 22 (`ssh` and `tcp`) + - `path` defaults to either `/run/podman/podman.sock`, or `/run/user/$UID/podman/podman.sock` if running rootless (`unix`), or must be explicitly specified (`ssh`) + +URL value resolution precedence: + - command line value + - environment variable `CONTAINER_HOST` + - `engine.service_destinations` table in containers.conf, excluding the /usr/share/containers directory + - `unix:///run/podman/podman.sock` + +Remote connections use local containers.conf for default. + +Some example URL values in valid formats: + - `unix:///run/podman/podman.sock` + - `unix:///run/user/$UID/podman/podman.sock` + - `ssh://notroot@localhost:22/run/user/$UID/podman/podman.sock` + - `ssh://root@localhost:22/run/podman/podman.sock` + - `tcp://localhost:34451` + - `tcp://127.0.0.1:34451` + +#### **--version**, **-v** + +Print the version + +#### **--volumepath**=*value* + +Volume directory where builtin volume information is stored (default: "/var/lib/containers/storage/volumes" for UID 0, "$HOME/.local/share/containers/storage/volumes" for other users). Default volume path can be overridden in `containers.conf`. + +## Environment Variables + +Podman can set up environment variables from env of [engine] table in containers.conf. These variables can be overridden by passing environment variables before the `podman` commands. + +#### **CONTAINERS_CONF** + +Set default locations of containers.conf file + +#### **CONTAINERS_REGISTRIES_CONF** + +Set default location of the registries.conf file. + +#### **CONTAINERS_STORAGE_CONF** + +Set default location of the storage.conf file. + +#### **CONTAINER_CONNECTION** + +Override default `--connection` value to access Podman service. Automatically enables the --remote option. + +#### **CONTAINER_HOST** + +Set default `--url` value to access Podman service. Automatically enables --remote option. + +#### **CONTAINER_SSHKEY** + +Set default `--identity` path to ssh key file value used to access Podman service. + +#### **PODMAN_CONNECTIONS_CONF** + +The path to the file where the system connections and farms created with `podman system connection add` +and `podman farm add` are stored, by default it uses `~/.config/containers/podman-connections.json`. + +#### **STORAGE_DRIVER** + +Set default `--storage-driver` value. + +#### **STORAGE_OPTS** + +Set default `--storage-opt` value. + +#### **TMPDIR** + +Set the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. + +#### **XDG_CONFIG_HOME** + +In Rootless mode configuration files are read from `XDG_CONFIG_HOME` when +specified, otherwise in the home directory of the user under +`$HOME/.config/containers`. + +#### **XDG_DATA_HOME** + +In Rootless mode images are pulled under `XDG_DATA_HOME` when specified, +otherwise in the home directory of the user under +`$HOME/.local/share/containers/storage`. + +#### **XDG_RUNTIME_DIR** + +In Rootless mode temporary configuration data is stored in `${XDG_RUNTIME_DIR}/containers`. + +## Remote Access + +The Podman command can be used with remote services using the `--remote` flag. Connections can +be made using local unix domain sockets, ssh or directly to tcp sockets. When specifying the +podman --remote flag, only the global options `--url`, `--identity`, `--log-level`, `--connection` are used. + +Connection information can also be managed using the containers.conf file. + +## Exit Codes + +The exit code from `podman` gives information about why the container +failed to run or why it exited. When `podman` commands exit with a non-zero code, +the exit codes follow the `chroot` standard, see below: + + **125** The error is with podman **_itself_** + + $ podman run --foo busybox; echo $? + Error: unknown flag: --foo + 125 + + **126** Executing a _container command_ and the _command_ cannot be invoked + + $ podman run busybox /etc; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error + 126 + + **127** Executing a _container command_ and the _command_ cannot be found + + $ podman run busybox foo; echo $? + Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error + 127 + + **Exit code** otherwise, `podman` returns the exit code of the _container command_ + + $ podman run busybox /bin/sh -c 'exit 3'; echo $? + 3 + + +## COMMANDS + +| Command | Description | +|--------------------------------------------------|------------------------------------------------------------------------------| +| [podman-artifact(1)](podman-artifact.1.md) | Manage OCI artifacts. | +| [podman-attach(1)](podman-attach.1.md) | Attach to a running container. | +| [podman-auto-update(1)](podman-auto-update.1.md) | Auto update containers according to their auto-update policy | +| [podman-build(1)](podman-build.1.md) | Build a container image using a Containerfile. | +| [podman-farm(1)](podman-farm.1.md) | Farm out builds to machines running podman for different architectures | +| [podman-commit(1)](podman-commit.1.md) | Create new image based on the changed container. | +| [podman-completion(1)](podman-completion.1.md) | Generate shell completion scripts | +| [podman-compose(1)](podman-compose.1.md) | Run Compose workloads via an external compose provider. | +| [podman-container(1)](podman-container.1.md) | Manage containers. | +| [podman-cp(1)](podman-cp.1.md) | Copy files/folders between a container and the local filesystem. | +| [podman-create(1)](podman-create.1.md) | Create a new container. | +| [podman-diff(1)](podman-diff.1.md) | Inspect changes on a container or image's filesystem. | +| [podman-events(1)](podman-events.1.md) | Monitor Podman events | +| [podman-exec(1)](podman-exec.1.md) | Execute a command in a running container. | +| [podman-export(1)](podman-export.1.md) | Export a container's filesystem contents as a tar archive. | +| [podman-generate(1)](podman-generate.1.md) | Generate structured data based on containers, pods or volumes. | +| [podman-healthcheck(1)](podman-healthcheck.1.md) | Manage healthchecks for containers | +| [podman-history(1)](podman-history.1.md) | Show the history of an image. | +| [podman-image(1)](podman-image.1.md) | Manage images. | +| [podman-images(1)](podman-images.1.md) | List images in local storage. | +| [podman-import(1)](podman-import.1.md) | Import a tarball and save it as a filesystem image. | +| [podman-info(1)](podman-info.1.md) | Display Podman related system information. | +| [podman-init(1)](podman-init.1.md) | Initialize one or more containers | +| [podman-inspect(1)](podman-inspect.1.md) | Display a container, image, volume, network, or pod's configuration. | +| [podman-kill(1)](podman-kill.1.md) | Kill the main process in one or more containers. | +| [podman-load(1)](podman-load.1.md) | Load image(s) from a tar archive into container storage. | +| [podman-login(1)](podman-login.1.md) | Log in to a container registry. | +| [podman-logout(1)](podman-logout.1.md) | Log out of a container registry. | +| [podman-logs(1)](podman-logs.1.md) | Display the logs of one or more containers. | +| [podman-machine(1)](podman-machine.1.md) | Manage Podman's virtual machine | +| [podman-manifest(1)](podman-manifest.1.md) | Create and manipulate manifest lists and image indexes. | +| [podman-mount(1)](podman-mount.1.md) | Mount a working container's root filesystem. | +| [podman-network(1)](podman-network.1.md) | Manage Podman networks. | +| [podman-pause(1)](podman-pause.1.md) | Pause one or more containers. | +| [podman-kube(1)](podman-kube.1.md) | Play containers, pods or volumes based on a structured input file. | +| [podman-pod(1)](podman-pod.1.md) | Management tool for groups of containers, called pods. | +| [podman-port(1)](podman-port.1.md) | List port mappings for a container. | +| [podman-ps(1)](podman-ps.1.md) | Print out information about containers. | +| [podman-pull(1)](podman-pull.1.md) | Pull an image from a registry. | +| [podman-push(1)](podman-push.1.md) | Push an image, manifest list or image index from local storage to elsewhere. | +| [podman-rename(1)](podman-rename.1.md) | Rename an existing container. | +| [podman-restart(1)](podman-restart.1.md) | Restart one or more containers. | +| [podman-rm(1)](podman-rm.1.md) | Remove one or more containers. | +| [podman-rmi(1)](podman-rmi.1.md) | Remove one or more locally stored images. | +| [podman-run(1)](podman-run.1.md) | Run a command in a new container. | +| [podman-save(1)](podman-save.1.md) | Save image(s) to an archive. | +| [podman-search(1)](podman-search.1.md) | Search a registry for an image. | +| [podman-secret(1)](podman-secret.1.md) | Manage podman secrets. | +| [podman-start(1)](podman-start.1.md) | Start one or more containers. | +| [podman-stats(1)](podman-stats.1.md) | Display a live stream of one or more container's resource usage statistics. | +| [podman-stop(1)](podman-stop.1.md) | Stop one or more running containers. | +| [podman-system(1)](podman-system.1.md) | Manage podman. | +| [podman-tag(1)](podman-tag.1.md) | Add an additional name to a local image. | +| [podman-top(1)](podman-top.1.md) | Display the running processes of a container. | +| [podman-unmount(1)](podman-unmount.1.md) | Unmount a working container's root filesystem. | +| [podman-unpause(1)](podman-unpause.1.md) | Unpause one or more containers. | +| [podman-unshare(1)](podman-unshare.1.md) | Run a command inside of a modified user namespace. | +| [podman-untag(1)](podman-untag.1.md) | Remove one or more names from a locally-stored image. | +| [podman-update(1)](podman-update.1.md) | Update the configuration of a given container. | +| [podman-version(1)](podman-version.1.md) | Display the Podman version information. | +| [podman-volume(1)](podman-volume.1.md) | Simple management tool for volumes. | +| [podman-wait(1)](podman-wait.1.md) | Wait on one or more containers to stop and print their exit codes. | + +## CONFIGURATION FILES + +**containers.conf** (`/usr/share/containers/containers.conf`, `/etc/containers/containers.conf`, `$HOME/.config/containers/containers.conf`) + +Podman has builtin defaults for command line options. These defaults can be overridden using the containers.conf configuration files. + +Distributions ship the `/usr/share/containers/containers.conf` file with their default settings. Administrators can override fields in this file by creating the `/etc/containers/containers.conf` file. Users can further modify defaults by creating the `$HOME/.config/containers/containers.conf` file. Podman merges its builtin defaults with the specified fields from these files, if they exist. Fields specified in the users file override the administrator's file, which overrides the distribution's file, which override the built-in defaults. + +Podman uses builtin defaults if no containers.conf file is found. + +If the **CONTAINERS_CONF** environment variable is set, then its value is used for the containers.conf file rather than the default. + +**mounts.conf** (`/usr/share/containers/mounts.conf`) + +The mounts.conf file specifies volume mount directories that are automatically mounted inside containers when executing the `podman run` or `podman start` commands. Administrators can override the defaults file by creating `/etc/containers/mounts.conf`. + +When Podman runs in rootless mode, the file `$HOME/.config/containers/mounts.conf` overrides the default if it exists. For details, see containers-mounts.conf(5). + +**policy.json** (`/etc/containers/policy.json`, `$HOME/.config/containers/policy.json`) + +Signature verification policy files are used to specify policy, e.g. trusted keys, applicable when deciding whether to accept an image, or individual signatures of that image, as valid. For details, see containers-policy.json(5). + +**registries.conf** (`/etc/containers/registries.conf`, `$HOME/.config/containers/registries.conf`) + +registries.conf is the configuration file which specifies which container registries is consulted when completing image names which do not include a registry or domain portion. + +Non root users of Podman can create the `$HOME/.config/containers/registries.conf` file to be used instead of the system defaults. + +If the **CONTAINERS_REGISTRIES_CONF** environment variable is set, then its value is used for the registries.conf file rather than the default. + +**storage.conf** (`/etc/containers/storage.conf`, `$HOME/.config/containers/storage.conf`) + +storage.conf is the storage configuration file for all tools using containers/storage + +The storage configuration file specifies all of the available container storage options for tools using shared container storage. + +When Podman runs in rootless mode, the file `$HOME/.config/containers/storage.conf` is used instead of the system defaults. + +If the **CONTAINERS_STORAGE_CONF** environment variable is set, then its value is used for the storage.conf file rather than the default. + +## Rootless mode +Podman can also be used as non-root user. When podman runs in rootless mode, a user namespace is automatically created for the user, defined in `/etc/subuid` and `/etc/subgid`. + +Containers created by a non-root user are not visible to other users and are not seen or managed by Podman running as root. + +It is required to have multiple UIDS/GIDS set for a user. Be sure the user is present in the files `/etc/subuid` and `/etc/subgid`. + +Execute the following commands to add the ranges to the files + + $ sudo usermod --add-subuids 10000-75535 USERNAME + $ sudo usermod --add-subgids 10000-75535 USERNAME + +Or just add the content manually. + + $ echo USERNAME:10000:65536 >> /etc/subuid + $ echo USERNAME:10000:65536 >> /etc/subgid + +See the `subuid(5)` and `subgid(5)` man pages for more information. + + + +Note: whitespace in any row of `/etc/subuid` or `/etc/subgid`, including trailing blanks, may result in no entry failures. + +Images are pulled under `XDG_DATA_HOME` when specified, otherwise in the home directory of the user under `.local/share/containers/storage`. + +Currently slirp4netns or pasta is required to be installed to create a network +device, otherwise rootless containers need to run in the network namespace of +the host. + +In certain environments like HPC (High Performance Computing), users cannot take advantage of the additional UIDs and GIDs from the `/etc/subuid` and `/etc/subgid` systems. However, in this environment, rootless Podman can operate with a single UID. To make this work, set the `ignore_chown_errors` option in the `containers-storage.conf(5)` file. This option tells Podman when pulling an image to ignore chown errors when attempting to change a file in a container image to match the non-root UID in the image. This means all files get saved as the user's UID. Note this can cause issues when running the container. + +### **NOTE:** Unsupported file systems in rootless mode + +The Overlay file system (OverlayFS) is not supported with kernels prior to 5.12.9 in rootless mode. The fuse-overlayfs package is a tool that provides the functionality of OverlayFS in user namespace that allows mounting file systems in rootless environments. It is recommended to install the fuse-overlayfs package. In rootless mode, Podman automatically uses the fuse-overlayfs program as the mount_program if installed, as long as the `$HOME/.config/containers/storage.conf` file was not previously created. If storage.conf exists in the homedir, add `mount_program = "/usr/bin/fuse-overlayfs"` under `[storage.options.overlay]` to enable this feature. + +The Network File System (NFS) and other distributed file systems (for example: Lustre, Spectrum Scale, the General Parallel File System (GPFS)) are not supported when running in rootless mode as these file systems do not understand user namespace. However, rootless Podman can make use of an NFS Homedir by modifying the `$HOME/.config/containers/storage.conf` to have the `graphroot` option point to a directory stored on local (Non NFS) storage. + +## SEE ALSO +**[containers-mounts.conf(5)](https://github.com/containers/common/blob/main/docs/containers-mounts.conf.5.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **[oci-hooks(5)](https://github.com/containers/common/blob/main/pkg/hooks/docs/oci-hooks.5.md)**, **[containers-policy.json(5)](https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/main/man/runc.8.md)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, **[pasta(1)](https://passt.top/builds/latest/web/passt.1.html)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)** + +### Troubleshooting + +See [podman-troubleshooting(7)](https://github.com/containers/podman/blob/main/troubleshooting.md) +for solutions to common issues. + +See [podman-rootless(7)](https://github.com/containers/podman/blob/main/rootless.md) +for rootless issues. + +## HISTORY +Dec 2016, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.2/source/markdown/podmansh.1.md b/versioned_docs/version-5.5.2/source/markdown/podmansh.1.md new file mode 100644 index 000000000..7bdc9d499 --- /dev/null +++ b/versioned_docs/version-5.5.2/source/markdown/podmansh.1.md @@ -0,0 +1,138 @@ +--- +title: podmansh +version: v5.5.2 +--- + +% podmansh 1 + +## NAME +podmansh - Execute login shell within the Podman `podmansh` container + +## SYNOPSIS +**podmansh** + +## DESCRIPTION + +Execute a user shell within a container when the user logs into the system. The container that the users get added to can be defined via a Podman Quadlet file. This user only has access to volumes and capabilities configured into the Quadlet file. + +Administrators can create a Quadlet in /etc/containers/systemd/users, which systemd will start for all users when they log in. The administrator can create a specific Quadlet with the container name `podmansh`, then enable users to use the login shell /usr/bin/podmansh. These user login shells are automatically executed inside the `podmansh` container via Podman. + +Optionally, the administrator can place Quadlet files in the /etc/containers/systemd/users/${UID} directory for a user. Only this UID will execute these Quadlet services when that user logs in. + +The user is confined to the container environment via all of the security mechanisms, including SELinux. The only information that will be available from the system comes from volumes leaked into the container. + +Systemd will automatically create the container when the user session is started. Systemd will take down the container when all connections to the user session are removed. This means users can log in to the system multiple times, with each session connected to the same container. + +Administrators can use volumes to expose specific host data from the host system to the user, without the user being exposed to other parts of the system. + +Timeout for podmansh can be set using the `podmansh_timeout` option in containers.conf. + +## Setup +Create user login session using useradd while running as root. + +``` +# useradd -s /usr/bin/podmansh lockedu +# grep lockedu /etc/passwd +lockedu:x:4008:4008::/home/lockedu:/usr/bin/podmansh +``` + +Create a Podman Quadlet file that looks something like one of the following. + +Fully locked down container, no access to host OS. + +``` +# USERID=$(id -u lockedu) +# mkdir -p /etc/containers/systemd/users/${USERID} +# cat > /etc/containers/systemd/users/${USERID}/podmansh.container << _EOF +[Unit] +Description=The podmansh container +After=local-fs.target + +[Container] +Image=registry.fedoraproject.org/fedora +ContainerName=podmansh +RemapUsers=keep-id +RunInit=yes +DropCapability=all +NoNewPrivileges=true + +Exec=sleep infinity + +[Install] +RequiredBy=default.target +_EOF +``` + +Alternatively, while running as root, create a Quadlet where the user is allowed to become root within the user namespace. They can also permanently read/write content from their home directory which is volume mounted from the actual host's users account, rather than being inside of the container. + +``` +# useradd -s /usr/bin/podmansh confinedu +# grep confinedu /etc/passwd +confinedu:x:4009:4009::/home/confinedu:/usr/bin/podmansh +# USERID=$(id -u confinedu) +# mkdir -p /etc/containers/systemd/users/${USERID} +# cat > /etc/containers/systemd/users/${USERID}/podmansh.container << _EOF +[Unit] +Description=The podmansh container +After=local-fs.target + +[Container] +Image=registry.fedoraproject.org/fedora +ContainerName=podmansh +RemapUsers=keep-id +RunInit=yes + +Volume=%h/data:%h:Z +Exec=sleep infinity + +[Service] +ExecStartPre=/usr/bin/mkdir -p %h/data + +[Install] +RequiredBy=default.target +_EOF +``` + +Another example, while running as root, create a Quadlet where the users inside this container are allowed to execute containers with SELinux separation and able to read and write content in the $HOME/data directory. + +``` +# useradd -s /usr/bin/podmansh fullu +# grep fullu /etc/passwd +fullu:x:4010:4010::/home/fullu:/usr/bin/podmansh +# USERID=$(id -u fullu) +# mkdir -p /etc/containers/systemd/users/${USERID} +# cat > /etc/containers/systemd/users/${USERID}/podmansh.container << _EOF +[Unit] +Description=The podmansh container +After=local-fs.target + +[Container] +Image=registry.fedoraproject.org/fedora +ContainerName=podmansh +RemapUsers=keep-id +RunInit=yes +PodmanArgs=--security-opt=unmask=/sys/fs/selinux \ + --security-opt=label=nested \ + --security-opt=label=user:container_user_u \ + --security-opt=label=type:container_user_t \ + --security-opt=label=role:container_user_r \ + --security-opt=label=level:s0-s0:c0.c1023 + +Volume=%h/data:%h:Z +WorkingDir=%h +Volume=/sys/fs/selinux:/sys/fs/selinux +Exec=sleep infinity + +[Service] +ExecStartPre=/usr/bin/mkdir -p %h/data + +[Install] +RequiredBy=default.target +_EOF +``` + +## SEE ALSO +**[containers.conf(5)](containers.conf.5.md)**, **[podman(1)](podman.1.md)**, **[podman-exec(1)](podman-exec.1.md)**, **[podman-systemd.unit(5)](podman-systemd.unit.5.md)** + +## HISTORY +May 2023, Originally compiled by Dan Walsh diff --git a/versioned_docs/version-5.5.2/tutorials/README.md b/versioned_docs/version-5.5.2/tutorials/README.md new file mode 100644 index 000000000..b5ee0fe06 --- /dev/null +++ b/versioned_docs/version-5.5.2/tutorials/README.md @@ -0,0 +1,46 @@ +--- +title: Podman Tutorials +version: v5.5.2 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +# Podman Tutorials + +## Links to a number of useful tutorials for the Podman utility. + +**[Introduction Tutorial](podman_tutorial.md)** + +Learn how to set up Podman and perform some basic commands with the utility. + +**[Basic Setup and Use of Podman in a Rootless environment](rootless_tutorial.md)** + +The steps required to set up rootless Podman are enumerated. + +**[Setup Mac/Windows](mac_win_client.md)** + +Special setup for running the Podman remote client on a Mac or Windows PC and connecting to Podman running on a Linux VM are documented. + +**[Remote Client](remote_client.md)** + +A brief how-to on using the Podman remote-client. + +**[How to use libpod for custom/derivative projects](podman-derivative-api.md)** + +How the libpod API can be used within your own project. + +**[Image Signing](image_signing.md)** + +Learn how to set up and use image signing with Podman. + +**[Basic Networking](basic_networking.md)** + +A basic guide to common network setups with Podman + +**[Socket activation](socket_activation.md)** + +Learn how to run containers that support socket activation. + +**[Performance](performance.md)** + +Performance guide regarding Podman configuration and usage. diff --git a/versioned_docs/version-5.5.2/tutorials/basic_networking.md b/versioned_docs/version-5.5.2/tutorials/basic_networking.md new file mode 100644 index 000000000..77c3ae8b3 --- /dev/null +++ b/versioned_docs/version-5.5.2/tutorials/basic_networking.md @@ -0,0 +1,336 @@ +--- +title: Basic Networking Guide for Podman +version: v5.5.2 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + + +# Basic Networking Guide for Podman + + +It seems once people understand the basics of containers, networking is one of the first +aspects they begin experimenting with. And regarding networking, it takes very +little experimentation before ending up on the deep end of the pool. The following +guide shows the most common network setups for Podman rootful and rootless containers. +Each setup is supported with an example. + + +## Differences between rootful and rootless container networking + +One of the guiding factors on networking for containers with Podman is going to +be whether or not the container is run by a root user or not. This is because +unprivileged users cannot create networking interfaces on the host. Therefore, +for rootless containers, the default network mode is slirp4netns. Because of the +limited privileges, slirp4netns lacks some of the features of networking +compared to rootful Podman's networking; for example, slirp4netns cannot give +containers a routable IP address. The default networking mode for rootful +containers on the other side is netavark, which allows a container to have a +routable IP address. + +## Firewalls + +The role of a firewall will not impact the setup and configuration of networking, +but it will impact traffic on those networks. The most obvious is inbound network +traffic to the container host, which is being passed onto containers usually with +port mapping. Depending on the firewall implementation, we have observed firewall +ports being opened automatically due to running a container with a port mapping (for +example). If container traffic does not seem to work properly, check the firewall +and allow traffic on ports the container is using. A common problem is that +reloading the firewall deletes the netavark iptables rules resulting in a loss of +network connectivity for rootful containers. Podman v3 provides the podman +network reload command to restore this without having to restart the container. + +## Basic Network Setups + +Most containers and pods being run with Podman adhere to a couple of simple scenarios. +By default, rootful Podman will create a bridged network. This is the most straightforward +and preferred network setup for Podman. Bridge networking creates an interface for +the container on an internal bridge network, which is then connected to the internet +via Network Address Translation(NAT). We also see users wanting to use `macvlan` +for networking as well. The `macvlan` plugin forwards an entire network interface +from the host into the container, allowing it access to the network the host is connected +to. And finally, the default network configuration for rootless containers is slirp4netns. +The slirp4netns network mode has limited capabilities but can be run on users without +root privileges. It creates a tunnel from the host into the container to forward +traffic. + +### Bridge + +A bridge network is defined as an internal network is created where both the +container and host are attached. Then this network is capable of allowing the containers +to communicate outside the host. + + +*[Image: bridge_network]* + +Consider the above illustration. It depicts a laptop user running two containers: +a web and db instance. These two containers are on the virtual network with the +host. Additionally, by default, these containers can initiate communications outside +the laptop (to the Internet for example). The containers on the virtual network +typically have non-routable, also known as private IP addresses. + +When dealing with communication that is being initiated outside the host, the outside +client typically must address the laptop’s external network interface and given port +number. Assuming the host allows incoming traffic, the host will know to forward +the incoming traffic on that port to the specific container. To accomplish this, +firewall rules are added to forward traffic when a container requests a specific +port be forwarded. + +Bridge networking is the default for Podman containers created as root. Podman provides +a default bridge network, but you can create others using the `podman network create` +command. Containers can be joined to a network when they are created with the +`--network` flag, or after they are created via the `podman network connect` and +`podman network disconnect` commands. + +As mentioned earlier, slirp4netns is the default network configuration for rootless +users. But as of Podman version 4.0, rootless users can also use netavark. +The user experience of rootless netavark is very akin to a rootful netavark, except that +there is no default network configuration provided. You simply need to create a +network, and the one will be created as a bridge network. If you would like to switch from +CNI networking to netavark, you must issue the `podman system reset --force` command. +This will delete all of your images, containers, and custom networks. + +``` +$ podman network create +``` + +When rootless containers are run, network operations +will be executed inside an extra network namespace. To join this namespace, use +`podman unshare --rootless-netns`. + +#### Default Network + +The default network `podman` with netavark is memory-only. It does not support dns resolution because of backwards compatibility with Docker. To change settings, export the in-memory network and change the file. + +For the default rootful network use +``` +podman network inspect podman | jq .[] > /etc/containers/networks/podman.json +``` + +And for the rootless network use + +``` +podman network inspect podman | jq .[] > ~/.local/share/containers/storage/networks/podman.json +``` + + +#### Example + +By default, rootful containers use the netavark for its default network if +you have not migrated from Podman v3. +In this case, no network name must be passed to Podman. However, you can create +additional bridged networks with the podman create command. + +The following example shows how to set up a web server and expose it to the network +outside the host as both rootful and rootless. It will also show how an outside +client can connect to the container. + +``` +(rootful) $ sudo podman run -dt --name webserver -p 8080:80 quay.io/libpod/banner +00f3440c7576aae2d5b193c40513c29c7964e96bf797cf0cc352c2b68ccbe66a +``` + +Now run the container. +``` +$ podman run -dt --name webserver --network podman1 -p 8081:80 quay.io/libpod/banner +269fd0d6b2c8ed60f2ca41d7beceec2471d72fb9a33aa8ca45b81dc9a0abbb12 +``` +Note in the above run command, the container’s port 80 (where the Nginx server is +running) was mapped to the host’s port 8080. Port 8080 was chosen to demonstrate +how the host and container ports can be mapped for external access. The port could +very well have been 80 as well (except for rootless users). + +To connect from an outside client to the webserver, simply point an HTTP client to +the host’s IP address at port 8080 for rootful and port 8081 for rootless. +``` +(outside_host): $ curl 192.168.99.109:8080 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ + +(outside_host): $ curl 192.168.99.109:8081 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ +``` + +### Macvlan + +With macvlan, the container is given access to a physical network interface on the +host. This interface can configure multiple subinterfaces. And each subinterface +is capable of having its own MAC and IP address. In the case of Podman containers, +the container will present itself as if it is on the same network as the host. + +*[Image: macvlan_network]* + +In the illustration, outside clients will be able to access the web container by +its IP address directly. Usually the network information, including IP address, +is leased from a DHCP server like most other network clients on the network. If +the laptop is running a firewall, such as firewalld, then accommodations will need +to be made for proper access. + +Note that Podman has to be run as root in order to use macvlan. + +#### Example + +The following example demonstrates how to set up a web container on a macvlan and +how to access that container from outside the host. First, create the macvlan network. + You need to know the network interface on the host that connects to the routable +network. In the example case, it is eth0. + +``` +$ sudo podman network create -d macvlan -o parent=eth0 webnetwork +webnetwork +``` + +The next step is to ensure that the DHCP service is running. This handles +the DHCP leases from the network. If DHCP is not needed, the `--subnet` option +can be used to assign a static subnet in the `network create` command above. + +CNI and netavark both use their own DHCP service; therefore, you need to know +what backend you are using. To see what you are using, run this command: +``` +$ sudo podman info --format {{.Host.NetworkBackend}} +``` +If this command does not work, you are using an older version prior to Podman +v4.0 which means you are using CNI. +If the netavark backend is used, at least Podman v4.5 with netavark v1.6 is +required to use DHCP. + +For netavark use: +``` +$ sudo systemctl enable --now netavark-dhcp-proxy.socket +``` +Or if the system doesn't use systemd, start the daemon manually: +``` +$ /usr/libexec/podman/netavark dhcp-proxy --activity-timeout 0 +``` + +With CNI use: +``` +$ sudo systemctl enable --now cni-dhcp.socket +``` +Or if the system doesn't use systemd, start the daemon manually: +``` +$ sudo /usr/libexec/cni/dhcp daemon +``` +Note that depending on the distribution, the binary location may differ. + +Now run the container and be certain to attach it to the network we created earlier. +``` +$ sudo podman run -dt --name webserver --network webnetwork quay.io/libpod/banner +03d82083c434d7e937fc0b87c25401f46ab5050007df403bf988e25e52c5cc40 +[baude@localhost ~]$ sudo podman exec webserver ip address show eth0 +2: eth0@if3: mtu 1500 qdisc noqueue state +UP +link/ether 0a:3c:e2:eb:87:0f brd ff:ff:ff:ff:ff:ff +inet 192.168.99.186/24 brd 192.168.99.255 scope global eth0 +valid_lft forever preferred_lft forever +inet6 fe80::83c:e2ff:feeb:870f/64 scope link +valid_lft forever preferred_lft forever +``` +Because the container has a routable IP address (on this network) and is not being +managed by firewalld, no change to the firewall is needed. +``` +(outside_host): $ curl http://192.168.99.186 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ +``` + + + +### Slirp4netns + +Slirp4netns is the default network setup for rootless containers and pods. It was +invented because unprivileged users are not allowed to make network interfaces on +the host. Slirp4netns creates a TAP device in the container’s network namespace +and connects to the usermode TCP/IP stack. Consider the following illustration. + +*[Image: slirp_network]* + +The unprivileged user on this laptop has created two containers: a DB container and +a web container. Both of these containers have the ability to access content on +networks outside the laptop. And outside clients can access the containers if the +container is bound to a host port and the laptop firewall allows it. Remember, unprivileged +users must use ports 1024 through 65535 as lower ports require root privileges. (CAP_NET_BIND_SERVICE) +Note: this can be adjusted using the `sysctl net.ipv4.ip_unprivileged_port_start` + +One of the drawbacks of slirp4netns is that the containers are completely isolated +from each other. Unlike the bridge approach, there is no virtual network. For containers +to communicate with each other, they can use the port mappings with the host system, +or they can be put into a Pod where they share the same network namespace. See [Communicating +between containers and pods](#Communicating-between-containers-and-pods) for more information. + +#### Example + +The following example will show how two rootless containers can communicate with +each other where one is a web server. Then it will show how a client on the host’s +network can communicate with the rootless web server. + +First, run the rootless web server and map port 80 from the container to a non-privileged +port like 8080. +``` +$ podman run -dt --name webserver -p 8080:80 quay.io/libpod/banner +17ea33ccd7f55ff45766b3ec596b990a5f2ba66eb9159cb89748a85dc3cebfe0 +``` +Because rootless containers cannot communicate with each other directly with TCP/IP +via IP addresses, the host and the port mapping are used. To do so, the IP address +of the host (interface) must be known. +``` +$ ip address show eth0 +3: eth0: mtu 1500 qdisc fq_codel state UP group +default qlen 1000 +link/ether 3c:e1:a1:c1:7a:3f brd ff:ff:ff:ff:ff:ff +altname eth0 +inet 192.168.99.109/24 brd 192.168.99.255 scope global dynamic noprefixroute eth0 +valid_lft 78808sec preferred_lft 78808sec +inet6 fe80::5632:6f10:9e76:c33/64 scope link noprefixroute +valid_lft forever preferred_lft forever +``` +From another rootless container, use the host’s IP address and port to communicate +between the two rootless containers successfully. +``` +$ podman run -it quay.io/libpod/banner curl http://192.168.99.109:8080 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ +``` + +From a client outside the host, the IP address and port can also be used: +``` +(outside_host): $ curl http://192.168.99.109:8080 + ___ __ + / _ \___ ___/ /_ _ ___ ____ + / ___/ _ \/ _ / ' \/ _ `/ _ \ +/_/ \___/\_,_/_/_/_/\_,_/_//_/ +``` + +## Communicating between containers and pods + +Most users of containers have a decent understanding of how containers communicate +with each other and the rest of the world. Usually each container has its own IP +address and networking information. They communicate amongst each other using regular +TCP/IP means like IP addresses or, in many cases, using DNS names often based on +the container name. But pods are a collection of one or more containers, and with +that, some uniqueness is inherited. + +By definition, all containers in a Podman pod share the same network namespace. This +fact means that they will have the same IP address, MAC addresses, and port mappings. +You can conveniently communicate between containers in a pod by using localhost. + +*[Image: slirp_network]* + +The above illustration describes a Pod on a bridged network. As depicted, the Pod +has two containers “inside” it: a DB and a Web container. Because they share the +same network namespace, the DB and Web container can communicate with each other +using localhost (127.0.0.1). Furthermore, they are also both addressable by the +IP address (and DNS name if applicable) assigned to the Pod itself. + +For more information on container to container networking, see [Configuring container +networking with Podman](https://www.redhat.com/sysadmin/container-networking-podman). diff --git a/versioned_docs/version-5.5.2/tutorials/image_signing.md b/versioned_docs/version-5.5.2/tutorials/image_signing.md new file mode 100644 index 000000000..d6880a80a --- /dev/null +++ b/versioned_docs/version-5.5.2/tutorials/image_signing.md @@ -0,0 +1,199 @@ +--- +title: How to sign and distribute container images using Podman +version: v5.5.2 +--- + +# How to sign and distribute container images using Podman + +Signing container images originates from the motivation of trusting only +dedicated image providers to mitigate man-in-the-middle (MITM) attacks or +attacks on container registries. One way to sign images is to utilize a GNU +Privacy Guard ([GPG][0]) key. This technique is generally compatible with any +OCI compliant container registry like [Quay.io][1]. It is worth mentioning that +the OpenShift integrated container registry supports this signing mechanism out +of the box, which makes separate signature storage unnecessary. + +[0]: https://gnupg.org +[1]: https://quay.io + +From a technical perspective, we can utilize Podman to sign the image before +pushing it into a remote registry. After that, all systems running Podman have +to be configured to retrieve the signatures from a remote server, which can +be any simple web server. This means that every unsigned image will be rejected +during an image pull operation. But how does this work? + +First of all, we have to create a GPG key pair or select an already locally +available one. To generate a new GPG key, just run `gpg --full-gen-key` and +follow the interactive dialog. Now we should be able to verify that the key +exists locally: + +```bash +> gpg --list-keys sgrunert@suse.com +pub rsa2048 2018-11-26 [SC] [expires: 2020-11-25] + XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX +uid [ultimate] Sascha Grunert +sub rsa2048 2018-11-26 [E] [expires: 2020-11-25] +``` + +Now let’s assume that we run a container registry. For example we could simply +start one on our local machine: + +```bash +sudo podman run -d -p 5000:5000 docker.io/registry +``` + +The registry does not know anything about image signing, it just provides the remote +storage for the container images. This means if we want to sign an image, we +have to take care of how to distribute the signatures. + +Let’s choose a standard `alpine` image for our signing experiment: + +```bash +sudo podman pull docker://docker.io/alpine:latest +``` + +```bash +sudo podman images alpine +REPOSITORY TAG IMAGE ID CREATED SIZE +docker.io/library/alpine latest e7d92cdc71fe 6 weeks ago 5.86 MB +``` + +Now we can re-tag the image to point it to our local registry: + +```bash +sudo podman tag alpine localhost:5000/alpine +``` + +```bash +sudo podman images alpine +REPOSITORY TAG IMAGE ID CREATED SIZE +localhost:5000/alpine latest e7d92cdc71fe 6 weeks ago 5.86 MB +docker.io/library/alpine latest e7d92cdc71fe 6 weeks ago 5.86 MB +``` + +Podman would now be able to push the image and sign it in one command. But to +let this work, we have to modify our system-wide registries configuration at +`/etc/containers/registries.d/default.yaml`: + +```yaml +default-docker: + sigstore: http://localhost:8000 # Added by us + sigstore-staging: file:///var/lib/containers/sigstore +``` + +We can see that we have two signature stores configured: + +- `sigstore`: referencing a web server for signature reading +- `sigstore-staging`: referencing a file path for signature writing + +Now, let’s push and sign the image: + +```bash +sudo -E GNUPGHOME=$HOME/.gnupg \ + podman push \ + --tls-verify=false \ + --sign-by sgrunert@suse.com \ + localhost:5000/alpine +… +Storing signatures +``` + +If we now take a look at the systems signature storage, then we see that there +is a new signature available, which was caused by the image push: + +```bash +sudo ls /var/lib/containers/sigstore +'alpine@sha256=e9b65ef660a3ff91d28cc50eba84f21798a6c5c39b4dd165047db49e84ae1fb9' +``` + +The default signature store in our edited version of +`/etc/containers/registries.d/default.yaml` references a web server listening at +`http://localhost:8000`. For our experiment, we simply start a new server inside +the local staging signature store: + +```bash +sudo bash -c 'cd /var/lib/containers/sigstore && python3 -m http.server' +Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ... +``` + +Let’s remove the local images for our verification test: + +``` +sudo podman rmi docker.io/alpine localhost:5000/alpine +``` + +We have to write a policy to enforce that the signature has to be valid. This +can be done by adding a new rule in `/etc/containers/policy.json`. From the +below example, copy the `"docker"` entry into the `"transports"` section of your +`policy.json`. + +```json +{ + "default": [{ "type": "insecureAcceptAnything" }], + "transports": { + "docker": { + "localhost:5000": [ + { + "type": "signedBy", + "keyType": "GPGKeys", + "keyPath": "/tmp/key.gpg" + } + ] + } + } +} +``` + +The `keyPath` does not exist yet, so we have to put the GPG key there: + +```bash +gpg --output /tmp/key.gpg --armor --export sgrunert@suse.com +``` + +If we now pull the image: + +```bash +sudo podman pull --tls-verify=false localhost:5000/alpine +… +Storing signatures +e7d92cdc71feacf90708cb59182d0df1b911f8ae022d29e8e95d75ca6a99776a +``` + +Then we can see in the logs of the web server that the signature has been +accessed: + +``` +127.0.0.1 - - [04/Mar/2020 11:18:21] "GET /alpine@sha256=e9b65ef660a3ff91d28cc50eba84f21798a6c5c39b4dd165047db49e84ae1fb9/signature-1 HTTP/1.1" 200 - +``` + +As a counterpart example, if we specify the wrong key at `/tmp/key.gpg`: + +```bash +gpg --output /tmp/key.gpg --armor --export mail@saschagrunert.de +File '/tmp/key.gpg' exists. Overwrite? (y/N) y +``` + +Then a pull is not possible any more: + +```bash +sudo podman pull --tls-verify=false localhost:5000/alpine +Trying to pull localhost:5000/alpine... +Error: pulling image "localhost:5000/alpine": unable to pull localhost:5000/alpine: unable to pull image: Source image rejected: Invalid GPG signature: … +``` + +So in general there are four main things to be taken into consideration when +signing container images with Podman and GPG: + +1. We need a valid private GPG key on the signing machine and corresponding + public keys on every system which would pull the image +2. A web server has to run somewhere which has access to the signature storage +3. The web server has to be configured in any + `/etc/containers/registries.d/*.yaml` file +4. Every image pulling system has to be configured to contain the enforcing + policy configuration via `policy.conf` + +That’s it for image signing and GPG. The cool thing is that this setup works out +of the box with [CRI-O][2] as well and can be used to sign container images in +Kubernetes environments. + +[2]: https://cri-o.io diff --git a/versioned_docs/version-5.5.2/tutorials/mac_client.md b/versioned_docs/version-5.5.2/tutorials/mac_client.md new file mode 100644 index 000000000..34ff93e5c --- /dev/null +++ b/versioned_docs/version-5.5.2/tutorials/mac_client.md @@ -0,0 +1,7 @@ +--- +title: "[Podman Mac Client tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md)" +version: v5.5.2 +--- + +# [Podman Mac Client tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) +This tutorial has moved! You can find out how to set up Podman on macOS (as well as Windows) [here](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) diff --git a/versioned_docs/version-5.5.2/tutorials/mac_win_client.md b/versioned_docs/version-5.5.2/tutorials/mac_win_client.md new file mode 100644 index 000000000..93fa2a094 --- /dev/null +++ b/versioned_docs/version-5.5.2/tutorials/mac_win_client.md @@ -0,0 +1,120 @@ +--- +title: Podman Remote clients for macOS and Windows +version: v5.5.2 +--- + +# Podman Remote clients for macOS and Windows + +*** +**_NOTE:_** For running Podman on Windows, refer to the [Podman for Windows](podman-for-windows.md) guide, which uses the recommended approach of a Podman-managed Linux backend. For Mac, see the [Podman installation instructions](https://podman.io/getting-started/installation). This guide covers the advanced usage of Podman with a custom Linux VM or a remote external Linux system. +*** + +## Introduction + +The core Podman runtime environment can only run on Linux operating systems. But other operating systems can use the “remote client” to manage their containers to a Linux backend. This remote client is nearly identical to the standard Podman program. Certain functions that do not make sense for remote clients have been removed. For example, the “--latest” switch for container commands has been removed. + +### Brief architecture + +The remote client uses a client-server model. You need Podman installed on a Linux machine or VM that also has the SSH daemon running. On the local operating system, when you execute a Podman command, Podman connects to the server via SSH. It then connects to the Podman service by using systemd socket activation. The Podman commands are executed on the server. From the client's point of view, it seems like Podman runs locally. + +## Obtaining and installing Podman + +### Windows + +Installing the Windows Podman client begins by downloading the Podman Windows installer. The Windows installer is built with each Podman release and is downloadable from its [release description page](https://github.com/containers/podman/releases/latest). The Windows installer file is named `podman-#.#.#-setup.exe`, where the `#` symbols represent the version number of Podman. + +Once you have downloaded the installer to your Windows host, simply double click the installer and Podman will be installed. The path is also set to put `podman` in the default user path. + +Podman must be run at a command prompt using the Windows Command Prompt (`cmd.exe`) or PowerShell (`pwsh.exe`) applications. + +### macOS + +The Mac Client is available through [Homebrew](https://brew.sh/). You can download homebrew via the instructions on their site. Install podman using: +``` +$ brew install podman +``` + +## Creating the first connection + +### Enable the Podman service on the server machine. + +Before performing any Podman client commands, you must enable the podman.sock SystemD service on the Linux server. In these examples, we are running Podman as a normal, unprivileged user, also known as a rootless user. By default, the rootless socket listens at `/run/user/${UID}/podman/podman.sock`. You can enable and start this socket permanently, using the following commands: +``` +$ systemctl --user enable --now podman.socket +``` +You will need to enable linger for this user in order for the socket to work when the user is not logged in. + +``` +sudo loginctl enable-linger $USER +``` + +You can verify that the socket is listening with a simple Podman command. + +``` +$ podman --remote info +host: + arch: amd64 + buildahVersion: 1.16.0-dev + cgroupVersion: v2 + conmon: + package: conmon-2.0.19-1.fc32.x86_64 +``` + +#### Enable sshd + +In order for the client to communicate with the server you need to enable and start the SSH daemon on your Linux machine, if it is not currently enabled. +``` +sudo systemctl enable --now sshd +``` + +#### Setting up SSH +Remote podman uses SSH to communicate between the client and server. The remote client works considerably smoother using SSH keys. To set up your ssh connection, you need to generate an ssh key pair from your client machine. +``` +$ ssh-keygen +``` +Your public key by default should be in your home directory under .ssh\id_rsa.pub. You then need to copy the contents of id_rsa.pub and append it into ~/.ssh/authorized_keys on the Linux server. On a Mac, you can automate this using ssh-copy-id. + +If you do not wish to use SSH keys, you will be prompted with each Podman command for your login password. + +## Using the client + +The first step in using the Podman remote client is to configure a connection.. + +You can add a connection by using the `podman system connection add` command. + +``` +C:\Users\baude> podman system connection add baude --identity c:\Users\baude\.ssh\id_rsa ssh://192.168.122.1/run/user/1000/podman/podman.sock +``` + +This will add a remote connection to Podman and if it is the first connection added, it will mark the connection as the default. You can observe your connections with `podman system connection list` + +``` +C:\Users\baude> podman system connection list +Name Identity URI +baude* id_rsa ssh://baude@192.168.122.1/run/user/1000/podman/podman.sock +``` + +Now we can test the connection with `podman info`. + +``` +C:\Users\baude> podman info +host: + arch: amd64 + buildahVersion: 1.16.0-dev + cgroupVersion: v2 + conmon: + package: conmon-2.0.19-1.fc32.x86_64 +``` + +Podman has also introduced a “--connection” flag where you can use other connections you have defined. If no connection is provided, the default connection will be used. + +``` +C:\Users\baude> podman system connection --help +``` + +## Wrap up + +You can use the podman remote clients to manage your containers running on a Linux server. The communication between client and server relies heavily on SSH connections and the use of SSH keys are encouraged. Once you have Podman installed on your remote client, you should set up a connection using `podman system connection add` which will then be used by subsequent Podman commands. + +## History +Originally published on [Red Hat Enable Sysadmin](https://www.redhat.com/sysadmin/podman-clients-macos-windows) diff --git a/versioned_docs/version-5.5.2/tutorials/performance.md b/versioned_docs/version-5.5.2/tutorials/performance.md new file mode 100644 index 000000000..3385ad05d --- /dev/null +++ b/versioned_docs/version-5.5.2/tutorials/performance.md @@ -0,0 +1,249 @@ +--- +title: Podman performance guide +version: v5.5.2 +--- + +# Podman performance guide + +The performance of Podman may be influenced by a number of factors, such as, + +* the specified Podman command-line options and configuration +* the OCI runtime +* the host file system +* the container image + +Changing any of these may or may not have any noticeable effect on the performance of Podman on your system. + +## Using a separate user account for benchmarking + +Some performance tips, such as using a different storage driver would require the user to run `podman system reset`, +which erases all containers and container images for the user. +Instead of benchmarking different alternatives in your own home directory, you could create a new user +that afterwards can be removed. + +### Example: Specify the storage driver _vfs_ and run `/bin/true` in an Alpine container + +Interactively + +``` +sudo useradd testuser +sudo machinectl shell testuser@ +podman pull docker.io/library/alpine +/usr/bin/time -v podman --storage-driver=vfs run --rm docker.io/library/alpine /bin/true +exit +``` + +Noninteractively + +``` +sudo useradd testuser +systemd-run --machine=testuser@ --quiet --user --collect --pipe --wait \ + podman --storage-driver=vfs pull docker.io/library/alpine +systemd-run --machine=testuser@ --quiet --user --collect --pipe --wait \ + /usr/bin/time -v podman --storage-driver=vfs run --rm docker.io/library/alpine /bin/true +``` + +The command `/usr/bin/time -v` measures and displays benchmarking information. + +## Performance considerations + +### Use a fast OCI runtime + +Podman uses an OCI runtime when running containers. +The fastest OCI runtime is probably [__crun__](https://github.com/containers/crun). + +Check that you are using crun + +``` +$ podman info --format={{.Host.OCIRuntime.Name}} +crun +``` + +To benchmark an OCI runtime, create a test user account and +specify the OCI runtime path with [__--runtime__](https://docs.podman.io/en/latest/markdown/podman.1.html#runtime-value). + +### Choosing a storage driver + +The following storage drivers are listed from fastest to slowest: + +1. native overlayfs +2. fuse-overlayfs +3. vfs + +There is one notable exception to this speed ranking. +Creating a container takes significantly longer with _native overlayfs_ than _fuse-overlayfs_ +when these conditions are all met: + +* rootless Podman is used +* a modified UID/GID mapping is used +* _native overlayfs_ is used +* no container has yet been created with the specified container image and UID/GID mapping + +Runtime speed is not affected. Only __podman create__ and the container creation phases of +__podman run__ and __podman build__ are affected. +For more details, see [GitHub comment](https://github.com/containers/podman/issues/16541#issuecomment-1352790422). +Command-line options that modify the UID/GID mapping are for example __--userns__, __--uidmap__ and __--gidmap__. +The command-line option `--userns auto` is particularly affected by this performance penalty, +because different UID/GID mappings could potentially be used on each invocation. For other uses of +__--userns__, __--uidmap__ and __--gidmap__ the performance penalty is a one-time cost +that only occurs the first time the command is run. + +Using native overlayfs as an unprivileged user is available for Podman version >= 3.1 on a Linux kernel version >= 5.13. +If SELinux is not used, then Linux kernel version 5.11 or later is sufficient. +Native overlayfs support is included in RHEL >= 8.5, see [release notes](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/8.5_release_notes/index). + +To show the current storage driver + +``` +$ podman info -f {{.Store.GraphDriverName}} +overlay +$ podman info -f '{{index .Store.GraphStatus "Native Overlay Diff"}}' +true +``` + +Storage driver | Result of `podman info -f {{.Store.GraphDriverName}}` | Result of `podman info -f '{{index .Store.GraphStatus "Native Overlay Diff"}}` +---- | ------ | ----- +native overlayfs | overlay | true +fuse-overlayfs | overlay | false +VFS | vfs | false + +Before changing the storage driver, running `podman system reset` is required. +The command erases all containers and container images for the user. +See the example above "_Using a separate user account for benchmarking_" for how to benchmark a storage driver in a separate test account. + +#### Specifying the storage driver with command-line options + +Storage driver | Podman command +---- | ------ +native overlayfs | `podman --storage-driver=overlay run ...` +fuse-overlayfs | `podman --storage-driver=overlay --storage-opt overlay.mount_program=/usr/bin/fuse-overlayfs run ...` +VFS | `podman --storage-driver=vfs run ...` + +#### Configuring the default storage driver + +The default storage driver can be configured in +_/etc/containers/storage.conf_ and overridden by a user in +_~/.config/containers/storage.conf_ + +To configure native overlayfs: +``` +[storage] +driver = "overlay" +``` + +To configure fuse-overlayfs: +``` +[storage] +driver = "overlay" +[storage.options.overlay] +mount_program = "/usr/bin/fuse-overlayfs" +``` + +To configure VFS: +``` +[storage] +driver = "vfs" +``` + +See storage.conf(5) for all available configuration settings. + +### Network performance for rootless Podman + +When using rootless Podman, network traffic is normally passed through the network driver +[pasta](https://passt.top/passt/about/#pasta). This comes with a performance penalty. + +You can avoid using _pasta_ in the following ways: + +* Use socket activation for listening network sockets. Communication over the activated socket does not pass through + pasta, so it has the same performance characteristics as the normal network on the host. + Socket-activated services can be started and stopped in different ways: + + Let systemd start the service when the first client connects. Let the service terminate by itself after some time of inactivity. + Using a service on demand, can free up compute resources. + + Start the service explicitly (`systemctl --user enable foobar.service`). If the service is already + running when the first client connects, there will be no delay due to container startup. + The [socket activation tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/socket_activation.md) + provides more information about socket activation support in Podman. + +* Set up the network manually as root. Create a bridge and virtual ethernet pair (VETH). Note: compared to other methods, + this setup doesn't provide any network isolation. In containers granted CAP_NET_ADMIN or CAP_NET_RAW, processes can + open packet or raw sockets directly facing the host, which allows them to send arbitrary frames, including + crafted Ethernet and IP packets, as well as receiving packets that were not originally intended for the container, + by means of ARP spoofing. + For more information, see + + An [example](https://lists.podman.io/archives/list/podman@lists.podman.io/thread/W6MCYO6RY5YFRTSUDAOEZA7SC2EFXRZE/) posted on the Podman mailing list + + The section _DIY networking_ in [Podman-Rootless-Networking.pdf](https://containers.github.io/podman.io_old/old/community/meeting/notes/2021-10-05/Podman-Rootless-Networking.pdf) + +* Use `--network=host`. No network namespace is created. The container will use the host’s network. + Note: By using `--network=host`, the container is given full access to local system services such as D-bus and is therefore considered insecure. + +Side note: Pasta is faster than the network driver [slirp4netns](https://github.com/containers/podman/blob/main/docs/tutorials/basic_networking.md#slirp4netns). +Pasta is the default network driver since Podman 5.0.0. + +Since Podman 5.1.0 the default network driver can be shown with + +``` +$ podman info -f '{{.Host.RootlessNetworkCmd}}' +pasta +``` + +### Lazy pulling of container images + +Podman supports lazy pulling for the following container image formats: + +* __zstd:chunked__ + +* __eStargz__ + +__zstd:chunked__ has better performance than __eStargz__. + +See the article [_Pull container images faster with partial pulls_](https://www.redhat.com/sysadmin/faster-container-image-pulls) by Giuseppe Scrivano and Dan Walsh. + +### Choosing a host file system + +Lazy pulling of container images can run more efficiently when the file system has reflink support. The file systems XFS and BTRFS have reflink support. + +### Option --log-driver + +The `podman run` option [__--log-driver__](https://docs.podman.io/en/latest/markdown/podman-run.1.html#log-driver-driver) specifies the logging driver for the container. + +If logging is not needed, consider using `--log-driver=none` to disable logging. + +### Reuse the package repository cache when building container images + +The first step of a container build is often to download metadata from +the package repositories and post-process that data. + +To speed up container builds, you could prepare a directory on the host +that contains the package metadata and then make the directory available +to the container build by using an _overlay mount_. + +#### Example : Speed up _podman build_ by reusing the DNF metadata cache + +In this example the containers are based on Fedora 36. + +First create an empty directory on the host, for example *$HOME/dnf_cache_f36*. + +``` +$ mkdir $HOME/dnf_cache_f36 +``` + +Fill the directory with the most recent __dnf__ metadata cache. + +``` +$ podman run --rm -v $HOME/dnf_cache_f36:/var/cache/dnf:Z registry.fedoraproject.org/fedora:36 dnf makecache +``` + +Create a new directory, for example, _$HOME/ctr_ and a file _$HOME/ctr/Containerfile_ with these contents + +``` +FROM registry.fedoraproject.org/fedora:36 +RUN dnf -y update && dnf -y install cowsay && dnf clean all +``` + +To build the Containerfile using the prepared metadata cache, provide the directory _$HOME/dnf_cache_f36_ as an _overlay mount_ (volume option `:O`) + +``` +$ podman build -v $HOME/dnf_cache_f36:/var/cache/dnf:O -t cowsay $HOME/ctr +``` + +The article [_Speeding up container image builds with Buildah_](https://www.redhat.com/sysadmin/speeding-container-buildah) by Dan Walsh provides more details. diff --git a/versioned_docs/version-5.5.2/tutorials/podman-derivative-api.md b/versioned_docs/version-5.5.2/tutorials/podman-derivative-api.md new file mode 100644 index 000000000..2f1f9c006 --- /dev/null +++ b/versioned_docs/version-5.5.2/tutorials/podman-derivative-api.md @@ -0,0 +1,60 @@ +--- +title: How to use libpod for custom/derivative projects +version: v5.5.2 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +# How to use libpod for custom/derivative projects + +libpod today is a Golang library and a CLI. The choice of interface you make has advantages and disadvantages. + +Using the REST API +--- + +Advantages: + + - Stable, versioned API + - Language-agnostic + - [Well-documented](http://docs.podman.io/en/latest/_static/api.html) API + +Disadvantages: + + - Error handling is less verbose than Golang API + - May be slower + +Running as a subprocess +--- + +Advantages: + + - Many commands output JSON + - Works with languages other than Golang + - Easy to get started + +Disadvantages: + + - Error handling is harder + - May be slower + - Can't hook into or control low-level things like how images are pulled + +Vendoring into a Go project +--- + +Advantages: + + - Significant power and control + +Disadvantages: + + - You are now on the hook for container runtime security updates (partially, `runc`/`crun` are separate) + - Binary size + - Potential skew between multiple libpod versions operating on the same storage can cause problems + +Making the choice +--- + +A good question to ask first is: Do you want users to be able to use `podman` to manipulate the containers created by your project? +If so, that makes it more likely that you want to run `podman` as a subprocess or using the HTTP API. If you want a separate image store and a fundamentally +different experience; if what you're doing with containers is quite different from those created by the `podman` CLI, +that may drive you towards vendoring. diff --git a/versioned_docs/version-5.5.2/tutorials/podman-for-windows.md b/versioned_docs/version-5.5.2/tutorials/podman-for-windows.md new file mode 100644 index 000000000..652a06a9b --- /dev/null +++ b/versioned_docs/version-5.5.2/tutorials/podman-for-windows.md @@ -0,0 +1,426 @@ +--- +title: Documentation +version: v5.5.2 +--- + +![](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +Podman for Windows +================== + +While "containers are Linux," Podman also runs on Mac and Windows, where it +provides a native CLI and embeds a guest Linux system to launch your +containers. This guest is referred to as a Podman machine and is managed with +the `podman machine` command. On Windows, each Podman machine is backed by a +virtualized Windows Subsystem for Linux (WSLv2) distribution. The podman command +can be run directly from your Windows PowerShell (or CMD) prompt, where it +remotely communicates with the podman service running in the WSL environment. +Alternatively, you can access Podman directly from the WSL instance if you +prefer a Linux prompt and Linux tooling. In addition to command-line access, +Podman also listens for Docker API clients, supporting direct usage of +Docker-based tools and programmatic access from your language of choice. + +Prerequisites +------------- + +Since Podman uses WSL, you need a recent release of Windows 10 or Windows 11. +On x64, WSL requires build 18362 or later, and 19041 or later is required for +arm64 systems. Internally, WSL uses virtualization, so your system must +support and have hardware virtualization enabled. If you are running Windows +on a VM, you must have a VM that supports nested virtualization. + +It is also recommended to install the modern "Windows Terminal," which +provides a superior user experience to the standard PowerShell and CMD +prompts, as well as a WSL prompt, should you want it. + +You can install it by searching the Windows Store or by running the following +`winget` command: + +`winget install Microsoft.WindowsTerminal` + + +Installing Podman +----------------- + +Installing the Windows Podman client begins by downloading the Podman Windows +installer. The Windows installer is built with each Podman release and can be +downloaded from the official + [GitHub release page](https://github.com/containers/podman/releases). +Be sure to download a 4.1 or later release for the capabilities discussed +in this guide. + +*[Image: Installing Podman 4.1.0]* + +Once downloaded, simply run the EXE file, and relaunch a new terminal. After +this point, podman.exe will be present on your PATH, and you will be able to run +the `podman machine init` command to create your first machine. + +`PS C:\Users\User> podman machine init` + +Automatic WSL Installation +-------------------------- + +If WSL has not been installed on your system, the first machine init command +will prompt a dialog to begin an automated install. If accepted, this process +will install the necessary Windows components, restart the system, and after +login, relaunch the machine creation process in a terminal window. Be sure to +wait a minute or two for the relaunch to occur, as Windows has a delay before +executing startup items. Alternatively, you can decline automatic installation +and install WSL manually. However, this will require additional download and +setup time. + +Machine Init Process +-------------------- + +After WSL is installed, the init command will install a minimal installation +of Fedora, customizing it to run podman. + +``` +PS C:\Users\User> podman machine init +Extracting compressed file +Importing operating system into WSL (this may take 5+ minutes on a new WSL install)... +Installing packages (this will take a while)... +Complete! +Configuring system... +Generating public/private ed25519 key pair. +Your identification has been saved in podman-machine-default +Your public key has been saved in podman-machine-default.pub +The key fingerprint is: +SHA256:RGTGg2Q/LX7ijN+mzu8+BzcS3cEWP6Hir6pYllJtceA root@WINPC +Machine init complete +To start your machine run: + + podman machine start +``` + + +Starting Machine +---------------- + +After the machine init process completes, it can then be started and stopped +as desired: + +``` +PS C:\Users\User> podman machine start + +Starting machine "podman-machine-default" + +This machine is currently configured in rootless mode. If your containers +require root permissions (e.g. ports < 1024), or if you run into compatibility +issues with non-podman clients, you can switch using the following command: + + podman machine set --rootful + +API forwarding listening on: npipe:////./pipe/docker_engine + +Docker API clients default to this address. You do not need to set DOCKER_HOST. +Machine "podman-machine-default" started successfully +``` + +First Podman Command +-------------------- + +From this point on, podman commands operate similarly to how they would on +Linux. + +For a quick working example with a small image, you can run the Linux date +command on PowerShell. + +``` +PS C:\Users\User> podman run ubi8-micro date +Thu May 5 21:56:42 UTC 2022 +``` + +Port Forwarding +--------------- + +Port forwarding also works as expected; ports will be bound against localhost +(127.0.0.1). Note: When running as rootless (the default), you must use a port +greater than 1023. See the Rootful and Rootless section for more details. + +To launch httpd, you can run: + +``` +PS C:\Users\User> podman run --rm -d -p 8080:80 --name httpd docker.io/library/httpd +f708641300564a6caf90c145e64cd852e76f77f6a41699478bb83a162dceada9 +``` + +A curl command against localhost on the PowerShell prompt will return a +successful HTTP response: + +``` +PS C:\Users\User> curl http://localhost:8080/ -UseBasicParsing + +StatusCode : 200 +StatusDescription : OK +Content :

It works!

+``` + +As with Linux, to stop, run: + +`podman stop httpd` + + +Using API Forwarding +-------------------- + +API forwarding allows Docker API tools and clients to use podman as if it was +Docker. Provided there is no other service listening on the Docker API pipe; +no special settings will be required. + +``` +PS C:\Users\User> .\docker.exe run -it fedora echo "Hello Podman!" +Hello Podman! +``` + +Otherwise, after starting the machine, you will be notified of an environment +variable you can set for tools to point to podman. Alternatively, you can shut +down both the conflicting service and podman, then finally run `podman machine +start` to restart, which should grab the Docker API address. + + +``` +Another process was listening on the default Docker API pipe address. +You can still connect Docker API clients by setting DOCKER HOST using the +following PowerShell command in your terminal session: + + $Env:DOCKER_HOST = 'npipe:////./pipe/podman-machine-default' + +Or in a classic CMD prompt: + + set DOCKER_HOST=npipe:////./pipe/podman-machine-default + +Alternatively, terminate the other process and restart podman machine. +Machine "podman-machine-default" started successfully + +PS C:\Users\User> $Env:DOCKER_HOST = 'npipe:////./pipe/podman-machine-default' +PS C:\Users\User>.\docker.exe version --format '{{(index .Server.Components 0).Name}}' +Podman Engine +``` + +Rootful & Rootless +------------------ + +On the embedded WSL Linux distro, podman can either be run under the root user +(rootful) or a non-privileged user (rootless). For behavioral consistency with +Podman on Linux, rootless is the default. Note: Rootful and Rootless +containers are distinct and isolated from one another. Podman commands against +one (e.g., podman ps) will not represent results/state for the other. + +While most containers run fine in a rootless setting, you may find a case +where the container only functions with root privileges. If this is the case, +you can switch the machine to rootful by stopping it and using the set +command: + +``` +podman machine stop +podman machine set --rootful +``` + +To restore rootless execution, set rootful to false: + +``` +podman machine stop +podman machine set --rootful=false +``` + +Another case in which you may wish to use rootful execution is binding a port +less than 1024. However, future versions of podman will likely drop this to a +lower number to improve compatibility with defaults on system port services (such +as MySQL) + +Volume Mounting +--------------- + +New in Podman v4.1 is the ability to perform volume mounts from Windows paths into a +Linux container. This supports several notation schemes, including: + +Windows Style Paths: + +`podman run --rm -v c:\Users\User\myfolder:/myfolder ubi8-micro ls /myfolder` + +Unixy Windows Paths: + +`podman run --rm -v /c/Users/User/myfolder:/myfolder ubi8-micro ls /myfolder` + +Linux paths local to the WSL filesystem: + +`podman run --rm -v /var/myfolder:/myfolder ubi-micro ls /myfolder` + +All of the above conventions work, whether running on a Windows prompt or the +WSL Linux shell. Although when using Windows paths on Linux, appropriately quote +or escape the Windows path portion of the argument. + + +Listing Podman Machine(s) +------------------------- + +To list the available podman machine instances and their current resource +usage, use the `podman machine ls` command: + +``` +PS C:\Users\User> podman machine ls + + +NAME VM TYPE CREATED LAST UP CPUS MEMORY DISK SIZE +podman-machine-default wsl 2 hours ago Currently running 4 331.1MB 768MB +``` + +Since WSL shares the same virtual machine and Linux kernel across multiple +distributions, the CPU and Memory values represent the total resources shared +across running systems. The opposite applies to the Disk value. It is +independent and represents the amount of storage for each individual +distribution. + + +Accessing the Podman Linux Environment +-------------------------------------- + +While using the podman.exe client on the Windows environment provides a +seamless native experience supporting the usage of local desktop tools and +APIs, there are a few scenarios in which you may wish to access the Linux +environment: + ++ Updating to the latest stable packages on the embedded Fedora instance ++ Using Linux development tools directly ++ Using a workflow that relies on EXT4 filesystem performance or behavior + semantics + +There are three mechanisms to access the embedded WSL distribution: +1. SSH using `podman machine ssh` +2. WSL command on the Windows PowerShell prompt +3. Windows Terminal Integration + +### Using SSH + +SSH access provides a similar experience as Podman on Mac. It immediately +drops you into the appropriate user based on your machine's rootful/rootless +configuration (root in the former, 'user' in the latter). The --username +option can be used to override with a specific user. + +An example task using SSH is updating your Linux environment to pull down the +latest OS bugfixes: + +`podman machine ssh sudo dnf upgrade -y` + +### Using the WSL Command + +The `wsl` command provides direct access to the Linux system but enters the +shell as root first. This is due to design limitations of WSL, where running +systemd (Linux's system services) requires the usage of a privileged process +namespace. + +Unless you have no other distributions of WSL installed, it's recommended to +use the `-d` option with the name of your podman machine (podman-machine-default +is the default) + +``` +PS C:\Users\User> wsl -d podman-machine-default +``` + +You will be automatically entered into a nested process namespace where +systemd is running. If you need to access the parent namespace, hit `ctrl-d` +or type exit. This also means to log out, you need to exit twice. + +``` +[root@WINPC /]# podman --version +podman version 4.1.0 +``` + + +To access commands as the non-privileged user (rootless podman), you must +first type `su user`. Alternatively, you can prefix the `wsl` command to use the +special `enterns`: + +``` +wsl -d podman-machine-default enterns su user +[user@WINPC /]$ id +uid=1000(user) gid=1000(user) groups=1000(user),10(wheel) +``` + +Likewise, running commands as root without entering a prompt should also be +prefixed with `enterns`. + +`wsl -d podman-machine-default enterns systemctl status` + +Accessing the WSL instance as a specific user using `wsl -u` or using inline +commands without `enterns` is not recommended since commands will execute +against the incorrect namespace. + +### Using Windows Terminal Integration + +Entering WSL as root is a 2-click operation. Simply click the drop-down tag, +and pick 'podman-machine-default,' where you will be entered directly as root. + +*[Image: Using WSL in Windows Terminal]* + +As before, to switch to a non-privileged user for rootless podman commands, +type `su user`. + +``` +[root@WINPC /]# su user +[user@WINPC /]$ podman info --format '{{.Store.RunRoot}}' +/run/user/1000/containers +``` + +Stopping a Podman Machine +------------------------- + +To stop a running podman machine, use the `podman machine stop` command: + +``` +PS C:\Users\User> podman machine stop +Machine "podman-machine-default" stopped successfully +``` + +Removing a Podman Machine +------------------------- + +To remove a machine, use the `podman machine rm` command: + +``` +PS C:\Users\User> podman machine rm + +The following files will be deleted: + +C:\Users\User\.ssh\podman-machine-default +C:\Users\User\.ssh\podman-machine-default.pub +C:\Users\User\.local\share\containers\podman\machine\wsl\podman-machine-default_fedora-35-x86_64.tar +C:\Users\User\.config\containers\podman\machine\wsl\podman-machine-default.json +C:\Users\User\.local\share\containers\podman\machine\wsl\wsldist\podman-machine-default + + +Are you sure you want to continue? [y/N] y +``` + + + +Troubleshooting +--------------- + +Recovering from a failed auto-installation of WSL + +If auto-install fails and retrying is unsuccessful, you can attempt to reset +your WSL system state and perform a manual WSL installation using the `wsl +--install` command. To do so, perform the following steps: + +1. Launch PowerShell as administrator + ``` + Start-Process powershell -Verb RunAs + ``` +2. Disable WSL Features + ``` + dism.exe /online /disable-feature /featurename:Microsoft-Windows-Subsystem-Linux /norestart + dism.exe /online /disable-feature /featurename:VirtualMachinePlatform /norestart + ``` +3. Reboot +4. Run manual WSL install + ``` + wsl --install + ``` +5. Continue with podman machine init + +Install Certificate Authority +============================= + +Instructions for installing a CA certificate can be found [here](podman-install-certificate-authority.md). diff --git a/versioned_docs/version-5.5.2/tutorials/podman-install-certificate-authority.md b/versioned_docs/version-5.5.2/tutorials/podman-install-certificate-authority.md new file mode 100644 index 000000000..26cf85ce4 --- /dev/null +++ b/versioned_docs/version-5.5.2/tutorials/podman-install-certificate-authority.md @@ -0,0 +1,114 @@ +--- +title: Documentation +version: v5.5.2 +--- + +*[Image: PODMAN logo]* + +Install Certificate Authority +============================= + +Organizations may create their own local certificate authority (CA) or acquire one from a third party. This may mean more than one certificate, such as one or more intermediate certificates and a root certificate, for example. In any case, it is necessary to add the certificate authority (CA) certificate(s) so that it can be employed for various use cases. + +### Method one + +Certificates may be either individual or concatenated (bundles). The following steps are one method to add such certificates to Podman. It is assumed that Podman is running and the certificate(s) to be installed are available on an accessible server via curl. If such access is not possible, an alternative method follows. + +First, assuming a running Podman machine, ssh into the machine: +``` +podman machine ssh +``` + +If Podman is running in the default rootless mode, an additional command is required to get to a root shell: + +``` +[core@localhost ~]$ sudo su - +``` + +After issuing the above command, the prompt should change to indicate the "root" instead of the "core" user. + +Next, while in the machine, change to the directory where the certificate(s) should be installed: +``` +[root@localhost ~]# cd /etc/pki/ca-trust/source/anchors +``` + +Then use curl to download the certificate. Notes: +* The -k is only necessary if connecting securely to a server for which the certificate is not yet trusted +* The MY-SERVER.COM/SOME-CERTIFICATE.pem should be replaced as appropriate +``` +[root@localhost anchors]# curl -k -o some-certificate.pem https://MY-SERVER.COM/SOME-CERTIFICATE.pem +``` + +Repeat as necessary for multiple certificates. + +Once all of the certificates have been downloaded, run the command to add the certificates to the list of trusted CAs: +``` +[root@localhost anchors]# update-ca-trust +``` + +Exit the machine: +``` +[root@localhost anchors]# exit +``` + +If the "sudo su -" command was used to switch to a root shell as described above, an additional exit command is needed to exit the machine: + +``` +[core@localhost ~]$ exit +``` + +If the certificates are still not accepted, it might be necessary to restart the Podman machine. To do this, issue the following commands on the host (and not inside the Podman machine): + +``` +podman machine stop +podman machine start +``` + +### Alternative Method + +If the above method is for some reason not practical or desirable, the certificate may be created using vi. + +As above, assuming a running Podman machine, ssh into the machine: + +``` +podman machine ssh +``` + +If the prompt starts with "core" instead of "root", switch to a root shell: + +``` +[core@localhost ~]$ sudo su - +``` + +Next, change to the directory where the certificate(s) should be installed: +``` +[root@localhost ~]# cd /etc/pki/ca-trust/source/anchors +``` + +Then use vi to create the certificate. +``` +[root@localhost ~]# vi SOME-CERTIFICATE.pem +``` +After vi opens, copy the certificate to the clipboard, then in insert mode, paste the clipboard contents to vi. Lastly, save the file and close vi. + +Repeat as necessary for multiple certificates. + +Once all of the certificates have been created, run the command to add the certificates to the list of trusted CAs: +``` +[root@localhost anchors]# update-ca-trust +``` + +Exit the machine: +``` +[root@localhost anchors]# exit +``` + +If the "sudo su -" command described above was used, an additional exit command is needed: + +``` +[core@localhost ~]$ exit +``` + +### Final Notes + +The certificate installation will persist during machine restarts. There is no need to stop and start the machine to begin using the certificate. diff --git a/versioned_docs/version-5.5.2/tutorials/podman_tutorial.md b/versioned_docs/version-5.5.2/tutorials/podman_tutorial.md new file mode 100644 index 000000000..0f5fbd383 --- /dev/null +++ b/versioned_docs/version-5.5.2/tutorials/podman_tutorial.md @@ -0,0 +1,149 @@ +--- +title: Basic Setup and Use of Podman +version: v5.5.2 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +# Basic Setup and Use of Podman +Podman is a utility provided as part of the libpod library. It can be used to create and maintain +containers. The following tutorial will teach you how to set up Podman and perform some basic +commands with Podman. + +If you are running on a Mac or Windows PC, you should instead follow the [Mac and Windows tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) +to set up the remote Podman client. + +**NOTE**: the code samples are intended to be run as a non-root user, and use `sudo` where +root escalation is required. + +## Installing Podman + +For installing or building Podman, see the [installation instructions](https://podman.io/getting-started/installation). + +## Familiarizing yourself with Podman + +### Running a sample container +This sample container will run a very basic httpd server (named basic_httpd) that serves only its index +page. +```console +podman run --name basic_httpd -dt -p 8080:80/tcp docker.io/nginx +``` +Because the container is being run in detached mode, represented by the *-d* in the `podman run` command, Podman +will print the container ID after it has run. Note that we use port forwarding to be able to +access the HTTP server. For successful running at least slirp4netns v0.3.0 is needed. + +### Listing running containers +The Podman *ps* command is used to list creating and running containers. +```console +podman ps +``` + +Note: If you add *-a* to the *ps* command, Podman will show all containers. +### Inspecting a running container +You can "inspect" a running container for metadata and details about itself. We can even use +the inspect subcommand to see what IP address was assigned to the container. As the container is running in rootless mode, an IP address is not assigned and the value will be listed as "none" in the output from inspect. +```console +podman inspect basic_httpd | grep IPAddress\": + "SecondaryIPAddresses": null, + "IPAddress": "", +``` + +### Testing the httpd server +As we do not have the IP address of the container, we can test the network communication between the host +operating system and the container using curl. The following command should display the index page of our +containerized httpd server. +```console +curl http://localhost:8080 +``` + +### Viewing the container's logs +You can view the container's logs with Podman as well: +```console +podman logs +10.88.0.1 - - [07/Feb/2018:15:22:11 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:30 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:30 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:31 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:31 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +``` + +### Viewing the container's pids +And you can observe the httpd pid in the container with *top*. +```console +podman top + UID PID PPID C STIME TTY TIME CMD + 0 31873 31863 0 09:21 ? 00:00:00 nginx: master process nginx -g daemon off; + 101 31889 31873 0 09:21 ? 00:00:00 nginx: worker process +``` + +### Checkpointing the container +Checkpointing a container stops the container while writing the state of all processes in the container to disk. +With this a container can later be restored and continue running at exactly the same point in time as the +checkpoint. This capability requires CRIU 3.11 or later installed on the system. +This feature is not supported as rootless; as such, if you wish to try it, you'll need to re-create your container as root, using the same command but with sudo. + +To checkpoint the container use: +```console +sudo podman container checkpoint +``` + +### Restoring the container +Restoring a container is only possible for a previously checkpointed container. The restored container will +continue to run at exactly the same point in time it was checkpointed. +To restore the container use: +```console +sudo podman container restore +``` + +After being restored, the container will answer requests again as it did before checkpointing. +```console +curl http://:8080 +``` + +### Migrate the container +To live migrate a container from one host to another the container is checkpointed on the source +system of the migration, transferred to the destination system and then restored on the destination +system. When transferring the checkpoint, it is possible to specify an output-file. + +On the source system: +```console +sudo podman container checkpoint -e /tmp/checkpoint.tar.gz +scp /tmp/checkpoint.tar.gz :/tmp +``` + +On the destination system: +```console +sudo podman container restore -i /tmp/checkpoint.tar.gz +``` + +After being restored, the container will answer requests again as it did before checkpointing. This +time the container will continue to run on the destination system. +```console +curl http://:8080 +``` + +### Stopping the container +To stop the httpd container: +```console +podman stop +``` +You can also check the status of one or more containers using the *ps* subcommand. In this case, we should +use the *-a* argument to list all containers. +```console +podman ps -a +``` + +### Removing the container +To remove the httpd container: +```console +podman rm +``` +You can verify the deletion of the container by running *podman ps -a*. + +## Integration Tests +For more information on how to set up and run the integration tests in your environment, checkout the Integration Tests [README.md](https://github.com/containers/podman/blob/main/test/README.md) + +## More information + +For more information on Podman and its subcommands, checkout the asciiart demos on the [README.md](https://github.com/containers/podman/blob/main/README.md#commands) +page. diff --git a/versioned_docs/version-5.5.2/tutorials/podman_tutorial_cn.md b/versioned_docs/version-5.5.2/tutorials/podman_tutorial_cn.md new file mode 100644 index 000000000..e86b46ead --- /dev/null +++ b/versioned_docs/version-5.5.2/tutorials/podman_tutorial_cn.md @@ -0,0 +1,175 @@ +--- +title: Documentation +version: v5.5.2 +--- + +> - 译文出自：[掘金翻译计划](https://juejin.cn/translate) + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +Podman是由libpod库提供一个实用的程序，可以被用于创建和管理容器。 + +下面的教程会教你如何启动 Podman 并使用 Podman 执行一些基本的命令。 + +如果你正在使用 Mac 或者 Windows +，你应该先查看[Mac 和 Windows 使用说明](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md)来设置 Podman +远程客户端。 + +**注意**：示例中所有命令皆以非 root 的用户运行，必要的时候通过 `sudo` 命令来获取 root 权限。 + +## 安装Podman + +安装或者编译 Podman ，请参照[安装说明](https://podman.io/getting-started/installation)。 + +## 熟悉podman + +### 运行一个示例容器 + +这个示例容器会运行一个简单的只有主页的 httpd 服务器。 + +```console +podman run --name basic_httpd -dt -p 8080:80/tcp docker.io/nginx +``` + +因为命令中的 *-d* 参数表明容器以 "detached" 模式运行，所以 Podman 会在容器运行后打印容器的 ID。 + +注意为了访问这个 HTTP 服务器，我们将使用端口转发。成功运行需要 slirp4netns 的 v0.3.0+ 版本。 + +Podman 的 *ps* 命令用于列出正在创建和运行的容器。 + +```console +podman ps +``` + +**注意**：如果为 *ps* 命令添加 *-a* 参数，Podman 将展示所有的容器。 + +### 查看正在运行的容器 + +你可以 "inspect" (查看)一个正在运行的容器的元数据以及其他详细信息。我们甚至可以使用 inspect 的子命令查看分配给容器的 IP 地址。由于容器以非 root 模式运行，没有分配 IP 地址，inspect 的输出会是 " +none" 。 + +```console +podman inspect -l | grep IPAddress\": + "SecondaryIPAddresses": null, + "IPAddress": "", +``` + +**注意**：*-l* 参数是**最近的容器**的指代，你也可以使用容器的ID 代替 *-l* + +### 测试httpd服务器 + +由于我们没有容器的 IP 地址，我们可以使用 curl 测试主机和容器之间的网络通信。下面的命令应该显示我们的容器化 httpd 服务器 的主页。 + +```console +curl http://localhost:8080 +``` + +### 查看容器的日志 + +你也可以使用 podman 查看容器的日志 + +```console +podman logs --latest +10.88.0.1 - - [07/Feb/2018:15:22:11 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:30 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:30 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:31 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +10.88.0.1 - - [07/Feb/2018:15:22:31 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.55.1" "-" +``` + +### 查看容器中的进程pid + +你可以使用 *top* 命令查看容器中 httpd 的 pid + +```console +podman top + UID PID PPID C STIME TTY TIME CMD + 0 31873 31863 0 09:21 ? 00:00:00 nginx: master process nginx -g daemon off; + 101 31889 31873 0 09:21 ? 00:00:00 nginx: worker process +``` + +### 设置容器的检查点 + +设置检查点会在停止容器的同时把容器中所有进程的状态写入磁盘。 + +有了它，容器后续可以被恢复，并在与检查点完全相同的时间点继续运行。 这个功能需要在系统上安装 CRIU 的 3.11+ 版本。 + +这个功能不支持非 root 模式，因此，如果你想尝试使用它，你需要使用 sudo 方式重新创建容器。 + +设置容器检查点请使用： + +```console +sudo podman container checkpoint +``` + +### 恢复容器 + +恢复容器只能在以前设置过检查点的容器上使用。恢复的容器会在与设置检查点时完全相同的时间点继续运行。 + +恢复容器请使用： + +```console +sudo podman container restore +``` + +恢复之后。容器会像设置检查点之前一样回复请求 + +```console +curl http://:8080 +``` + +### 迁移容器 + +为了将容器从一个主机上热迁移到另一个主机，容器可以在在源系统上创建检查点，传输到目的系统，然后再在目的系统上恢复。 +为了便于传输容器的检查点，可以将其存储在一个指定的输出文件中。 + +在源系统上： + +```console +sudo podman container checkpoint -e /tmp/checkpoint.tar.gz +scp /tmp/checkpoint.tar.gz :/tmp +``` + +在目标系统上： + +```console +sudo podman container restore -i /tmp/checkpoint.tar.gz +``` + +恢复之后，容器会像设置检查点之前一样回复请求。这时，容器会在目标系统上继续运行。 + +```console +curl http://:8080 +``` + +### 停止容器 + +停止 httpd 容器 + +```console +podman stop --latest +``` + +你还可以使用 *ps* 命令检查一个或多个容器的状态，在这个例子中，我们使用 *-a* 参数列出所有的容器。 + +```console +podman ps -a +``` + +### 移除容器 + +移除 httpd 容器 + +```console +podman rm --latest +``` + +你可以使用 *podman ps -a* 验证容器的删除。 + +## 集成测试 + +在环境中如何设置并运行集成测试请查看集成测试的[自述页面](https://github.com/containers/podman/blob/main/test/README.md) + +## 更多信息 + +有关podman 和它的子命令的更多信息请查看 podman 的[自述页面](https://github.com/containers/podman/blob/main/README.md#commands) diff --git a/versioned_docs/version-5.5.2/tutorials/qemu-remote-tutorial.md b/versioned_docs/version-5.5.2/tutorials/qemu-remote-tutorial.md new file mode 100644 index 000000000..9d49bf960 --- /dev/null +++ b/versioned_docs/version-5.5.2/tutorials/qemu-remote-tutorial.md @@ -0,0 +1,137 @@ +--- +title: Podman-remote client for Windows with QEMU VM +version: v5.5.2 +--- + +# Podman-remote client for Windows with QEMU VM + +*** +**_NOTE:_** For running Podman on Windows, refer to the [Podman for Windows](podman-for-windows.md) guide, which uses the recommended approach of a Podman-managed Linux backend. For Mac, see the [Podman installation instructions](https://podman.io/getting-started/installation). This guide covers the advanced usage of Podman with a custom Linux VM. +*** + +## Introduction + +This is an experimental setup using QEMU VM for running Podman for the already supported [Podman-remote](https://docs.podman.io/en/latest/markdown/podman-remote.1.html) client on Windows. +The officially supported and recommended way of running Podman on Windows is using [Podman machine](https://docs.podman.io/en/latest/markdown/podman-machine.1.html). + +## Prerequisites + +* Windows 10 Build 18362 or later (Build 19044/Version 21H2 or later recommended) +* SSH client feature installed on the machine +* Hyper-V acceleration should be operational on the machine +* Directory `C:\qemu-remote\` will be used for storing needed assets +* Port `57561` is free to use for ssh over a loopback interface + +## Obtaining and installing + +### QEMU + +Download QEMU (7.2.0 minimal) from https://qemu.weilnetz.de/w64/ + +Then download the Fedora CoreOS (FCOS) image for QEMU from https://getfedora.org/coreos/download?tab=metal_virtualized&stream=testing&arch=x86_64 + +One will need `.xz` format extraction tool like xz itself or 7-zip. Use it to extract the `.qcow2` image to C:\qemu-remote\fedora-coreos-37.20221127.2.0-qemu.x86_64.qcow2 + +With xz the command line (when run from the same directory) will be +``` +xz -d fedora-coreos-37.20221127.2.0-qemu.x86_64.qcow2.xz +``` + +### Podman + +Download and install the latest release of Podman for Windows. Podman releases can be obtained from the official Podman GitHub release page: https://github.com/containers/podman/releases + +#### Older Podman releases + +When using older Podman releases (4.3.x and earlier), where `gvproxy.exe` is missing from the installation directory, +it could be obtained from the official releases https://github.com/containers/gvisor-tap-vsock/releases +One would need version `0.5.0` or a more recent release. Download `gvproxy-windows.exe` and copy it to +the Podman installation directory (or any other location, which is added to the PATH environment variable) +renaming the binary to `gvproxy.exe`. + +### SSH + +Generate ssh keys with an empty passphrase + +ssh-keygen -t ed25519 -f C:\qemu-remote\remote + +### Ignition for FCOS + +Create ignition file C:\qemu-remote\remote.ign with the content of +``` +{"ignition":{"config":{"replace":{"verification":{}}},"proxy":{},"security":{"tls":{}},"timeouts":{},"version":"3.2.0"},"passwd":{"users":[{"name":"core","sshAuthorizedKeys":["YOURSSHKEYHERE"],"uid":501},{"name":"root","sshAuthorizedKeys":["YOURSSHKEYHERE"]}]},"storage":{"directories":[{"group":{"name":"core"},"path":"/home/core/.config","user":{"name":"core"},"mode":493},{"group":{"name":"core"},"path":"/home/core/.config/containers","user":{"name":"core"},"mode":493},{"group":{"name":"core"},"path":"/home/core/.config/systemd","user":{"name":"core"},"mode":493},{"group":{"name":"core"},"path":"/home/core/.config/systemd/user","user":{"name":"core"},"mode":493},{"group":{"name":"core"},"path":"/home/core/.config/systemd/user/default.target.wants","user":{"name":"core"},"mode":493},{"group":{"name":"root"},"path":"/etc/containers/registries.conf.d","user":{"name":"root"},"mode":493},{"group":{"name":"root"},"path":"/etc/systemd/system.conf.d","user":{"name":"root"},"mode":493},{"group":{"name":"root"},"path":"/etc/environment.d","user":{"name":"root"},"mode":493}],"files":[{"group":{"name":"core"},"path":"/home/core/.config/systemd/user/linger-example.service","user":{"name":"core"},"contents":{"source":"data:,%5BUnit%5D%0ADescription=A%20systemd%20user%20unit%20demo%0AAfter=network-online.target%0AWants=network-online.target%20podman.socket%0A%5BService%5D%0AExecStart=%2Fusr%2Fbin%2Fsleep%20infinity%0A","verification":{}},"mode":484},{"group":{"name":"core"},"path":"/home/core/.config/containers/containers.conf","user":{"name":"core"},"contents":{"source":"data:,%5Bcontainers%5D%0Anetns=%22bridge%22%0A","verification":{}},"mode":484},{"group":{"name":"root"},"overwrite":true,"path":"/etc/subuid","user":{"name":"root"},"contents":{"source":"data:,core:100000:1000000","verification":{}},"mode":484},{"group":{"name":"root"},"overwrite":true,"path":"/etc/subgid","user":{"name":"root"},"contents":{"source":"data:,core:100000:1000000","verification":{}},"mode":484},{"group":{"name":"root"},"path":"/etc/systemd/system/user@.service.d/delegate.conf","user":{"name":"root"},"contents":{"source":"data:,%5BService%5D%0ADelegate=memory%20pids%20cpu%20io%0A","verification":{}},"mode":420},{"group":{"name":"core"},"path":"/var/lib/systemd/linger/core","user":{"name":"core"},"contents":{"verification":{}},"mode":420},{"group":{"name":"root"},"path":"/etc/containers/containers.conf","user":{"name":"root"},"contents":{"source":"data:,%5Bengine%5D%0Amachine_enabled=true%0A","verification":{}},"mode":420},{"group":{"name":"root"},"path":"/etc/containers/podman-machine","user":{"name":"root"},"contents":{"source":"data:,qemu%0A","verification":{}},"mode":420},{"group":{"name":"root"},"path":"/etc/containers/registries.conf.d/999-podman-machine.conf","user":{"name":"root"},"contents":{"source":"data:,unqualified-search-registries=%5B%22docker.io%22%5D%0A","verification":{}},"mode":420},{"group":{},"path":"/etc/tmpfiles.d/podman-docker.conf","user":{},"contents":{"source":"data:,L+%20%20%2Frun%2Fdocker.sock%20%20%20-%20%20%20%20-%20%20%20%20-%20%20%20%20%20-%20%20%20%2Frun%2Fpodman%2Fpodman.sock%0A","verification":{}},"mode":420},{"group":{"name":"root"},"path":"/etc/profile.d/docker-host.sh","user":{"name":"root"},"contents":{"source":"data:,export%20DOCKER_HOST=%22unix:%2F%2F$%28podman%20info%20-f%20%22%7B%7B.Host.RemoteSocket.Path%7D%7D%22%29%22%0A","verification":{}},"mode":420}],"links":[{"group":{"name":"core"},"path":"/home/core/.config/systemd/user/default.target.wants/linger-example.service","user":{"name":"core"},"hard":false,"target":"/home/core/.config/systemd/user/linger-example.service"},{"group":{"name":"root"},"overwrite":true,"path":"/usr/local/bin/docker","user":{"name":"root"},"hard":false,"target":"/usr/bin/podman"},{"group":{"name":"root"},"overwrite":false,"path":"/etc/localtime","user":{"name":"root"},"hard":false,"target":"\\usr\\share\\zoneinfo"}]},"systemd":{"units":[{"enabled":true,"name":"podman.socket"},{"contents":"[Unit]\nRequires=dev-virtio\\\\x2dports-vport1p1.device\nAfter=remove-moby.service sshd.socket sshd.service\nOnFailure=emergency.target\nOnFailureJobMode=isolate\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/bin/sh -c '/usr/bin/echo Ready \u003e/dev/vport1p1'\n[Install]\nRequiredBy=default.target\n","enabled":true,"name":"ready.service"},{"enabled":false,"mask":true,"name":"docker.service"},{"enabled":false,"mask":true,"name":"docker.socket"},{"contents":"[Unit]\nDescription=Remove moby-engine\n# Run once for the machine\nAfter=systemd-machine-id-commit.service\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/rpm-ostree override remove moby-engine\nExecStart=/usr/bin/rpm-ostree ex apply-live --allow-replacement\nExecStartPost=/bin/touch /var/lib/%N.stamp\n\n[Install]\nWantedBy=default.target\n","enabled":true,"name":"remove-moby.service"},{"contents":"[Unit]\nDescription=Environment setter from QEMU FW_CFG\n[Service]\nType=oneshot\nRemainAfterExit=yes\nEnvironment=FWCFGRAW=/sys/firmware/qemu_fw_cfg/by_name/opt/com.coreos/environment/raw\nEnvironment=SYSTEMD_CONF=/etc/systemd/system.conf.d/default-env.conf\nEnvironment=ENVD_CONF=/etc/environment.d/default-env.conf\nEnvironment=PROFILE_CONF=/etc/profile.d/default-env.sh\nExecStart=/usr/bin/bash -c '/usr/bin/test -f ${FWCFGRAW} \u0026\u0026\\\n\techo \"[Manager]\\n#Got from QEMU FW_CFG\\nDefaultEnvironment=$(/usr/bin/base64 -d ${FWCFGRAW} | sed -e \"s+|+ +g\")\\n\" \u003e ${SYSTEMD_CONF} ||\\\n\techo \"[Manager]\\n#Got nothing from QEMU FW_CFG\\n#DefaultEnvironment=\\n\" \u003e ${SYSTEMD_CONF}'\nExecStart=/usr/bin/bash -c '/usr/bin/test -f ${FWCFGRAW} \u0026\u0026 (\\\n\techo \"#Got from QEMU FW_CFG\"\u003e ${ENVD_CONF};\\\n\tIFS=\"|\";\\\n\tfor iprxy in $(/usr/bin/base64 -d ${FWCFGRAW}); do\\\n\t\techo \"$iprxy\" \u003e\u003e ${ENVD_CONF}; done ) || \\\n\techo \"#Got nothing from QEMU FW_CFG\"\u003e ${ENVD_CONF}'\nExecStart=/usr/bin/bash -c '/usr/bin/test -f ${FWCFGRAW} \u0026\u0026 (\\\n\techo \"#Got from QEMU FW_CFG\"\u003e ${PROFILE_CONF};\\\n\tIFS=\"|\";\\\n\tfor iprxy in $(/usr/bin/base64 -d ${FWCFGRAW}); do\\\n\t\techo \"export $iprxy\" \u003e\u003e ${PROFILE_CONF}; done ) || \\\n\techo \"#Got nothing from QEMU FW_CFG\"\u003e ${PROFILE_CONF}'\nExecStartPost=/usr/bin/systemctl daemon-reload\n[Install]\nWantedBy=sysinit.target\n","enabled":true,"name":"envset-fwcfg.service"}]}} +``` + +Replace "YOURSSHKEYHERE" with the actual pub keys you generated. + +## Launching + +### gvproxy + +One needs to run gvproxy first to make it ready for the QEMU VM launched afterward. Run it with the command below: +``` +gvproxy.exe -listen-qemu unix://C:/qemu-remote/vlan_remote.sock -pid-file C:\qemu-remote\proxy.pid -ssh-port 57561 -forward-sock C:\qemu-remote\podman.sock -forward-dest /run/user/501/podman/podman.sock -forward-user core -forward-identity C:\qemu-remote\remote +``` + +### QEMU + +Launch QEMU with the following command (the following configures it to use 4 CPUs and 8 GB RAM, but it could be adjusted for less): + +``` +qemu-system-x86_64w.exe -m 8192 -smp 4 -fw_cfg name=opt/com.coreos/config,file=C:\qemu-remote\remote.ign -netdev stream,id=vlan,server=off,addr.type=unix,addr.path=C:\qemu-remote\vlan_remote.sock -device virtio-net-pci,netdev=vlan,mac=5a:94:ef:e4:0c:ee -device virtio-serial -chardev socket,path=C:\qemu-remote\ready.sock,server=on,wait=off,id=apodman-machine-default_ready -device virtserialport,chardev=apodman-machine-default_ready,name=org.fedoraproject.port.0 -pidfile C:\qemu-remote\vm.pid -machine q35,accel=whpx:tcg -cpu max,vmx=off,monitor=off -drive if=virtio,file=C:\qemu-remote\fedora-coreos-37.20221127.2.0-qemu.x86_64.qcow2 +``` + +### First time launch extras + +Observe QEMU loading and wait for the message of SSH keys being provisioned to the machine. Next, before making the first ssh connection, one would need to add it to known hosts. +We are using `127.0.0.1` instead of `localhost` to force IPv4. + +``` +ssh-keyscan -p 57561 127.0.0.1 >> %USERPROFILE%\.ssh\known_hosts +``` + +### Add new connection to Podman + +Create a connection named "qemuremote" + +``` +podman system connection add --identity C:\qemu-remote\remote -p 57561 qemuremote ssh://core@127.0.0.1 +``` + +#### Optional + +Make it default for simplicity of operation/testing + +``` +podman system connection default qemuremote +``` + +## Using Podman + +Choose the active connection to be "qemuremote" (not needed if one made it default). + +Run some basic network enabled workload: + +``` +podman run -d --rm -p 8080:80 nginx +``` + +Test it with + +``` +curl http -v http://localhost:8080 +``` + +## Shutting down the machine + +The built-in machinery of Podman machine will not work for a custom machine. One needs to gracefully shut it down by connecting via SSH: + +``` +ssh -i C:\qemu-remote\remote -p 57561 core@127.0.0.1 +``` + +And then executing + +``` +sudo poweroff +``` diff --git a/versioned_docs/version-5.5.2/tutorials/remote_client.md b/versioned_docs/version-5.5.2/tutorials/remote_client.md new file mode 100644 index 000000000..2b67e5102 --- /dev/null +++ b/versioned_docs/version-5.5.2/tutorials/remote_client.md @@ -0,0 +1,124 @@ +--- +title: Podman remote-client tutorial +version: v5.5.2 +--- + +# Podman remote-client tutorial + +## Introduction +The purpose of the Podman remote-client is to allow users to interact with a Podman "backend" while on a separate client. The command line interface of the remote client is exactly the same as the regular Podman commands with the exception of some flags being removed as they do not apply to the remote-client. + +The remote client takes advantage of a client-server model. You need Podman installed on a Linux machine or VM that also has the SSH daemon running. On the local operating system, when you execute a Podman command, Podman connects to the server via SSH. It then connects to the Podman service by using systemd socket activation, and hitting our [Rest API](https://docs.podman.io/en/latest/_static/api.html). The Podman commands are executed on the server. From the client's point of view, it seems like Podman runs locally. + +This tutorial is for running Podman remotely on Linux. If you are using a Mac or a Windows PC, please follow the [Mac and Windows tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) + +## Obtaining and installing Podman + +### Client machine +You will need either Podman or the podman-remote client. The difference between the two is that the compiled podman-remote client can only act as a remote client connecting to a backend, while Podman can run local, standard Podman commands, as well as act as a remote client (using `podman --remote`) + +If you already have Podman installed, you do not need to install podman-remote. + +You can find out how to [install Podman here](https://podman.io/getting-started/installation) + +If you would like to install only the podman-remote client, it is downloadable from its [release description page](https://github.com/containers/podman/releases/latest). You can also build it from source using the `make podman-remote` + + +### Server Machine +You will need to [install Podman](https://podman.io/getting-started/installation) on your server machine. + + +## Creating the first connection + +### Enable the Podman service on the server machine. + +Before performing any Podman client commands, you must enable the podman.sock SystemD service on the Linux server. In these examples, we are running Podman as a normal, unprivileged user, also known as a rootless user. By default, the rootless socket listens at `/run/user/${UID}/podman/podman.sock`. You can enable this socket permanently using the following command: +``` +systemctl --user enable --now podman.socket +``` +You will need to enable linger for this user in order for the socket to work when the user is not logged in: + +``` +sudo loginctl enable-linger $USER +``` +This is only required if you are not running Podman as root. + +You can verify that the socket is listening with a simple Podman command. + +``` +podman --remote info +host: + arch: amd64 + buildahVersion: 1.16.0-dev + cgroupVersion: v2 + conmon: + package: conmon-2.0.19-1.fc32.x86_64 +``` + +#### Enable sshd + +In order for the Podman client to communicate with the server you need to enable and start the SSH daemon on your Linux machine, if it is not currently enabled. +``` +sudo systemctl enable --now sshd +``` + +#### Setting up SSH +Remote Podman uses SSH to communicate between the client and server. The remote client works considerably smoother using SSH keys. To set up your ssh connection, you need to generate an ssh key pair from your client machine. *NOTE:* in some instances, using a `rsa` key will cause connection issues, be sure to create an `ed25519` key. +``` +ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 +``` +Your public key by default should be in your home directory under `~/.ssh/id_ed25519.pub`. You then need to copy the contents of `id_ed25519.pub` and append it into `~/.ssh/authorized_keys` on the Linux server. You can automate this using `ssh-copy-id`: +``` +ssh-copy-id -i ~/.ssh/id_ed25519.pub 192.168.122.1 +``` + +If you do not wish to use SSH keys, you will be prompted with each Podman command for your login password. + +## Using the client + +Note: `podman-remote` is equivalent to `podman --remote` here, depending on what you have chosen to install. + +The first step in using the Podman remote client is to configure a connection. + +You can add a connection by using the `podman-remote system connection add` command. + +``` +podman-remote system connection add myuser --identity ~/.ssh/id_ed25519 ssh://myuser@192.168.122.1/run/user/1000/podman/podman.sock +``` + +This will add a remote connection to Podman and if it is the first connection added, it will mark the connection as the default. You can observe your connections with `podman-remote system connection list`: + +``` +podman-remote system connection list +Name Identity URI +myuser* id_ed25519 ssh://myuser@192.168.122.1/run/user/1000/podman/podman.sock +``` + +Now we can test the connection with `podman info`: + +``` +podman-remote info +host: + arch: amd64 + buildahVersion: 1.16.0-dev + cgroupVersion: v2 + conmon: + package: conmon-2.0.19-1.fc32.x86_64 +``` + +Podman-remote has also introduced a “--connection” flag where you can use other connections you have defined. If no connection is provided, the default connection will be used. + +``` +podman-remote system connection --help +``` + +## Wrap up + +You can use the Podman remote clients to manage your containers running on a Linux server. The communication between client and server relies heavily on SSH connections and the use of SSH keys are encouraged. Once you have Podman installed on your remote client, you should set up a connection using `podman-remote system connection add` which will then be used by subsequent Podman commands. + +# Troubleshooting + +See the [Troubleshooting](https://github.com/containers/podman/blob/main/troubleshooting.md) document if you run into issues. + +## History +Adapted from the [Mac and Windows tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/mac_win_client.md) diff --git a/versioned_docs/version-5.5.2/tutorials/rootless_tutorial.md b/versioned_docs/version-5.5.2/tutorials/rootless_tutorial.md new file mode 100644 index 000000000..737295a49 --- /dev/null +++ b/versioned_docs/version-5.5.2/tutorials/rootless_tutorial.md @@ -0,0 +1,221 @@ +--- +title: Basic Setup and Use of Podman in a Rootless environment. +version: v5.5.2 +--- + +![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png) + +# Basic Setup and Use of Podman in a Rootless environment. + +Prior to allowing users without root privileges to run Podman, the administrator must install or build Podman and complete the following configurations. + +## Administrator Actions + +### Installing Podman + +For installing Podman, see the [installation instructions](https://podman.io/getting-started/installation). + +### Building Podman + +For building Podman, see the [build instructions](https://podman.io/getting-started/installation#building-from-scratch). + +### Networking configuration + +A user-mode networking tool for unprivileged network namespaces must be installed on the machine in order for Podman to run in a rootless environment. + +Podman supports two rootless networking tools: [pasta](https://passt.top/passt/about/#pasta) (provided by [passt](https://passt.top/passt/about/)) and [slirp4netns](https://github.com/rootless-containers/slirp4netns). + +pasta is the default since Podman 5.0, while slirp4netns was the default for previous versions. Passt is a more modern replacement for SLIRP that amongst other things fully supports IPv6 and is more secure architecturally (runs in a separate process, uses modern Linux mechanisms for isolation etc). + +Passt is [available on most Linux distributions](https://passt.top/passt/about/#availability) via their package distribution software such as `yum`, `dnf`, `apt`, `zypper`, etc. under the name `passt`. If the package is not available, you can build and install `passt` from [its upstream](https://passt.top/passt/about/#try-it). + +Alternatively, slirp4netns can be installed in the same fashion either from your distribution's repositories or by following [the instructions](https://github.com/rootless-containers/slirp4netns?tab=readme-ov-file#install) provided on its GitHub. + +The major user-facing difference between the two is outlined in [Shortcomings of Rootless Podman](https://github.com/containers/podman/blob/main/rootless.md?plain=1#L11) and expanded upon in **[podman-network(1)](https://github.com/containers/podman/blob/main/docs/source/markdown/podman-network.1.md#pasta)**. + +> [!note] +> pasta's default situation of not being being able to communicate between the container and the host has been fixed in Podman 5.3: see [Podman 5.3 changes for improved networking experience with pasta](https://blog.podman.io/2024/10/podman-5-3-changes-for-improved-networking-experience-with-pasta/). + +The default rootless networking tool can be selected in **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)** under the `[network]` section with `default_rootless_network_cmd`, which can be set to `pasta` (default) or `slirp4netns`. + +### `/etc/subuid` and `/etc/subgid` configuration + +Rootless Podman requires the user running it to have a range of UIDs listed in the files `/etc/subuid` and `/etc/subgid`. The `shadow-utils` or `newuid` package provides these files on different distributions and they must be installed on the system. Root privileges are required to add or update entries within these files. The following is a summary from the [How does rootless Podman work?](https://opensource.com/article/19/2/how-does-rootless-podman-work) article by Dan Walsh on [opensource.com](https://opensource.com) + +For each user that will be allowed to create containers, update `/etc/subuid` and `/etc/subgid` for the user with fields that look like the following. Note that the values for each user must be unique. If there is overlap, there is a potential for a user to use another user's namespace and they could corrupt it. + +``` +# cat /etc/subuid +johndoe:100000:65536 +test:165536:65536 +``` + +The format of this file is `USERNAME:UID:RANGE` + +* username as listed in `/etc/passwd` or in the output of [`getpwent`](https://man7.org/linux/man-pages/man3/getpwent.3.html). +* The initial UID allocated for the user. +* The size of the range of UIDs allocated for the user. + +This means the user `johndoe` is allocated UIDs 100000-165535 as well as their standard UID in the `/etc/passwd` file. NOTE: this is not currently supported with network installs; these files must be available locally to the host machine. It is not possible to configure this with LDAP or Active Directory. + +Rather than updating the files directly, the `usermod` program can be used to assign UIDs and GIDs to a user. + +``` +# usermod --add-subuids 100000-165535 --add-subgids 100000-165535 johndoe +grep johndoe /etc/subuid /etc/subgid +/etc/subuid:johndoe:100000:65536 +/etc/subgid:johndoe:100000:65536 +``` + +If you update either `/etc/subuid` or `/etc/subgid`, you need to stop all the running containers owned by the user and kill the pause process that is running on the system for that user. This can be done automatically by running [`podman system migrate`](https://github.com/containers/podman/blob/main/docs/source/markdown/podman-system-migrate.1.md) as that user. + +#### Giving access to additional groups + +Users can fully map additional groups to a container namespace if +those groups subordinated to the user: + +``` +# usermod --add-subgids 2000-2000 johndoe +grep johndoe /etc/subgid +``` + +This means the user `johndoe` can "impersonate" the group `2000` inside the +container. Note that it is usually not a good idea to subordinate active +user ids to other users, because it would allow user impersonation. + +`johndoe` can use `--group-add keep-groups` to preserve the additional +groups, and `--gidmap="+g102000:@2000"` to map the group `2000` in the host +to the group `102000` in the container: + +``` +$ podman run \ + --rm \ + --group-add keep-groups \ + --gidmap="+g102000:@2000" \ + --volume "$PWD:/data:ro" \ + --workdir /data \ + alpine ls -lisa +``` + +### Enable unprivileged `ping` + +(It is very unlikely that you will need to do this on a modern distro). + +Users running in a non-privileged container may not be able to use the `ping` utility from that container. + +If this is required, the administrator must verify that the UID of the user is part of the range in the `/proc/sys/net/ipv4/ping_group_range` file. + +To change its value the administrator can use a call similar to: `sysctl -w "net.ipv4.ping_group_range=0 2000000"`. + +To make the change persist, the administrator will need to add a file with the `.conf` file extension in `/etc/sysctl.d` that contains `net.ipv4.ping_group_range=0 $MAX_GID`, where `$MAX_GID` is the highest assignable GID of the user running the container. + + +## User Actions + +The majority of the work necessary to run Podman in a rootless environment is on the shoulders of the machine’s administrator. + +Once the Administrator has completed the setup on the machine and then the configurations for the user in `/etc/subuid` and `/etc/subgid`, the user can just start using any Podman command that they wish. + +### User Configuration Files + +The Podman configuration files for root reside in `/usr/share/containers` with overrides in `/etc/containers`. In the rootless environment they reside in `${XDG_CONFIG_HOME}/containers` and are owned by each individual user. + +Note: in environments without `XDG` environment variables, Podman internally sets the following defaults: + +- `$XDG_CONFIG_HOME` = `$HOME/.config` +- `$XDG_DATA_HOME` = `$HOME/.local/share` +- `$XDG_RUNTIME_DIR` = + - `/run/user/$UID` on `systemd` environments + - `$TMPDIR/podman-run-$UID` otherwise + +The three main configuration files are [containers.conf](https://github.com/containers/common/blob/main/docs/containers.conf.5.md), [storage.conf](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md) and [registries.conf](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md). The user can modify these files as they wish. + +#### containers.conf +Podman reads + +1. `/usr/share/containers/containers.conf` +2. `/etc/containers/containers.conf` +3. `${XDG_CONFIG_HOME}/containers/containers.conf` + +if they exist, in that order. Each file can override the previous for particular fields. + +#### storage.conf +For `storage.conf` the order is + +1. `/etc/containers/storage.conf` +2. `${XDG_CONFIG_HOME}/containers/storage.conf` + +In rootless Podman, certain fields in `/etc/containers/storage.conf` are ignored. These fields are: +``` +graphroot="" + container storage graph dir (default: "/var/lib/containers/storage") + Default directory to store all writable content created by container storage programs. + +runroot="" + container storage run dir (default: "/run/containers/storage") + Default directory to store all temporary writable content created by container storage programs. +``` +In rootless Podman these fields default to +``` +graphroot="${XDG_DATA_HOME}/containers/storage" +runroot="${XDG_RUNTIME_DIR}/containers" +``` +[\$XDG_RUNTIME_DIR](https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html#variables) defaults on most systems to `/run/user/$UID`. + +#### registries +Registry configuration is read in this order + +1. `/etc/containers/registries.conf` +2. `/etc/containers/registries.d/*` +3. `${XDG_CONFIG_HOME}/containers/registries.conf` + +The files in the home directory should be used to configure rootless Podman for personal needs. These files are not created by default. Users can copy the files from `/usr/share/containers` or `/etc/containers` and modify them. + +#### Authorization files +The default authorization file used by the `podman login` and `podman logout` commands is `${XDG_RUNTIME_DIR}/containers/auth.json`. + +### Using volumes + +Rootless Podman is not, and will never be, root; it's not a `setuid` binary, and gains no privileges when it runs. Instead, Podman makes use of a user namespace to shift the UIDs and GIDs of a block of users it is given access to on the host (via the `newuidmap` and `newgidmap` executables) and your own user within the containers that Podman creates. + +If your container runs with the root user, then `root` in the container is actually your user on the host. UID/GID 1 is the first UID/GID specified in your user's mapping in `/etc/subuid` and `/etc/subgid`, etc. If you mount a directory from the host into a container as a rootless user, and create a file in that directory as root in the container, you'll see it's actually owned by your user on the host. + +So, for example, + +``` +host$ whoami +john + +# a folder which is empty +host$ ls /home/john/folder +host$ podman run -it -v /home/john/folder:/container/volume mycontainer /bin/bash + +# Now I'm in the container +root@container# whoami +root +root@container# touch /container/volume/test +root@container# ls -l /container/volume +total 0 +-rw-r--r-- 1 root root 0 May 20 21:47 test +root@container# exit + +# I check again +host$ ls -l /home/john/folder +total 0 +-rw-r--r-- 1 john john 0 May 20 21:47 test +``` + +We do recognize that this doesn't really match how many people intend to use rootless Podman - they want their UID inside and outside the container to match. Thus, we provide the `--userns=keep-id` flag, which ensures that your user is mapped to its own UID and GID inside the container. + +It is also helpful to distinguish between running Podman as a rootless user, and a container which is built to run rootless. If the container you're trying to run has a `USER` which is not root, then when mounting volumes you **must** use `--userns=keep-id`. This is because the container user would not be able to become `root` and access the mounted volumes. + +Another consideration in regards to volumes: + +- When providing the path of a directory you'd like to bind-mount, the path needs to be provided as an absolute path + or a relative path that starts with `.` (a dot), otherwise the string will be interpreted as the name of a named volume. + +## More information + +If you are still experiencing problems running Podman in a rootless environment, please refer to the [Shortcomings of Rootless Podman](https://github.com/containers/podman/blob/main/rootless.md) page which lists known issues and solutions to known issues in this environment. + +For more information on Podman and its subcommands, follow the links on the main [README.md](https://github.com/containers/podman/blob/main/README.md#podman-information-for-developers) page or the [podman.io](https://podman.io) web site. diff --git a/versioned_docs/version-5.5.2/tutorials/socket_activation.md b/versioned_docs/version-5.5.2/tutorials/socket_activation.md new file mode 100644 index 000000000..8944617a1 --- /dev/null +++ b/versioned_docs/version-5.5.2/tutorials/socket_activation.md @@ -0,0 +1,289 @@ +--- +title: Podman socket activation +version: v5.5.2 +--- + +# Podman socket activation + +Socket activation conceptually works by having systemd create a socket (e.g. TCP, UDP or Unix +socket). As soon as a client connects to the socket, systemd will start the systemd service that is +configured for the socket. The newly started program inherits the file descriptor of the socket +and can then accept the incoming connection (in other words run the system call `accept()`). +This description corresponds to the default systemd socket configuration +[`Accept=no`](https://www.freedesktop.org/software/systemd/man/systemd.socket.html#Accept=) +that lets the service accept the socket. + +Podman supports two forms of socket activation: + +* Socket activation of the API service +* Socket activation of containers + +## Socket activation of the API service + +The architecture looks like this + +``` mermaid +stateDiagram-v2 + [*] --> systemd: first client connects + systemd --> podman: socket inherited via fork/exec +``` + +The file _/usr/lib/systemd/user/podman.socket_ on a Fedora system defines the Podman API socket for +rootless users: + +``` +$ cat /usr/lib/systemd/user/podman.socket +[Unit] +Description=Podman API Socket +Documentation=man:podman-system-service(1) + +[Socket] +ListenStream=%t/podman/podman.sock +SocketMode=0660 + +[Install] +WantedBy=sockets.target +``` + +The socket is configured to be a Unix socket and can be started like this + +``` +$ systemctl --user start podman.socket +$ ls $XDG_RUNTIME_DIR/podman/podman.sock +/run/user/1000/podman/podman.sock +$ +``` +The socket can later be used by for instance __docker-compose__ that needs a Docker-compatible API + +``` +$ export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock +$ docker-compose up +``` + +When __docker-compose__ or any other client connects to the UNIX socket `$XDG_RUNTIME_DIR/podman/podman.sock`, +the service _podman.service_ is started. See its definition in the file _/usr/lib/systemd/user/podman.service_. + +## Socket activation of containers + +Since version 3.4.0 Podman supports socket activation of containers, i.e., passing +a socket-activated socket to the container. Thanks to the fork/exec model of Podman, the socket will be first +inherited by conmon and then by the OCI runtime and finally by the container +as can be seen in the following diagram: + + +``` mermaid +stateDiagram-v2 + [*] --> systemd: first client connects + systemd --> podman: socket inherited via fork/exec + state "OCI runtime" as s2 + podman --> conmon: socket inherited via double fork/exec + conmon --> s2: socket inherited via fork/exec + s2 --> container: socket inherited via exec +``` + +This type of socket activation can be used in systemd services that are generated from container unit files (see [podman-systemd.unit(5)](https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html)) (Note, quadlet requires the use of cgroup v2) or from the command [`podman generate systemd`](https://docs.podman.io/en/latest/markdown/podman-generate-systemd.1.html). +The container must also support socket activation. Not all software daemons support socket activation +but it's getting more popular. For instance Apache HTTP server, MariaDB, DBUS, PipeWire, Gunicorn, CUPS +all have socket activation support. + +### Example: socket-activated echo server container in a systemd service + +This example shows how to run the socket-activated echo server +[socket-activate-echo](https://github.com/eriksjolund/socket-activate-echo/pkgs/container/socket-activate-echo) +in a systemd user service. Podman version 4.4.0 or higher is required. + +Enable lingering for your regular user + +``` +$ loginctl enable-linger $USER +``` + +The command has these effects on your enabled systemd user units: + +* the units are automatically started after a reboot +* the units are not automatically stopped after you log out + +Create directories + +``` +$ mkdir -p ~/.config/systemd/user +$ mkdir -p ~/.config/containers/systemd +``` + +Create the file _~/.config/containers/systemd/echo.container_ with the file contents: + +``` +[Unit] +Description=Example echo service +Requires=echo.socket +After=echo.socket + +[Container] +Image=ghcr.io/eriksjolund/socket-activate-echo +Network=none + +[Install] +WantedBy=default.target +``` + +The file follows the syntax described in [__podman-systemd.unit__(5)](https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html). + +The `[Install]` section is optional. If you remove the two last lines, the _echo.service_ will not +be automatically started after a reboot. Instead, the _echo.service_ is started when the first +client connects to the socket. + +The line `Network=none` is optional. It improves security by removing network connectivity for the container. +The container can still be serving the internet because `Network=none` has no effect on activated sockets. + +A socket-activated service also requires a systemd socket unit. +Create the file _~/.config/systemd/user/echo.socket_ that defines the +sockets that the container should use + +``` +[Unit] +Description=Example echo socket + +[Socket] +ListenStream=127.0.0.1:3000 +ListenDatagram=127.0.0.1:3000 +ListenStream=[::1]:3000 +ListenDatagram=[::1]:3000 +ListenStream=%h/echo_stream_sock + +# VMADDR_CID_ANY (-1U) = 2^32 -1 = 4294967295 +# See "man vsock" +ListenStream=vsock:4294967295:3000 + +[Install] +WantedBy=sockets.target +``` + +`%h` is a systemd specifier that expands to the user's home directory. + +After editing the unit files, systemd needs to reload its configuration. + +``` +$ systemctl --user daemon-reload +``` + +While reloading its configuration systemd generates the unit _echo.service_ +from the file _~/.config/containers/systemd/echo.container_ +by executing the unit generator `/usr/lib/systemd/system-generators/podman-system-generator`. + +Optional: View the generated _echo.service_ to see the `podman run` command that +will be run. + +``` +$ systemctl --user cat echo.service +``` + +Configure systemd to automatically start _echo.socket_ after reboots. + +``` +$ systemctl --user enable echo.socket +``` + +Pull the container image beforehand + +``` +$ podman pull ghcr.io/eriksjolund/socket-activate-echo +``` + +Start the socket unit + +``` +$ systemctl --user start echo.socket +``` + +Test the echo server with the program __socat__ + +``` +$ echo hello | socat -t 30 - tcp4:127.0.0.1:3000 +hello +$ echo hello | socat -t 30 - tcp6:[::1]:3000 +hello +$ echo hello | socat -t 30 - udp4:127.0.0.1:3000 +hello +$ echo hello | socat -t 30 - udp6:[::1]:3000 +hello +$ echo hello | socat -t 30 - unix:$HOME/echo_stream_sock +hello +$ echo hello | socat -t 30 - VSOCK-CONNECT:1:3000 +hello +``` + +The option `-t 30` configures socat to use a timeout of 30 seconds when socat reads from the socket awaiting to get an EOF (End-Of-File). +As the container image has already been pulled, such a long timeout is not really needed. + +The echo server works as expected. It replies _"hello"_ after receiving the text _"hello"_. + +### Example: socket activate an Apache HTTP server with systemd-socket-activate + +Instead of setting up a systemd service to test out socket activation, an alternative is to use the command-line +tool [__systemd-socket-activate__](https://www.freedesktop.org/software/systemd/man/systemd-socket-activate.html#). + +Let's build a container image for the Apache HTTP server that is configured to support socket activation on port 8080. + +Create a new directory _ctr_ and a file _ctr/Containerfile_ with this contents + +``` +FROM docker.io/library/fedora +RUN dnf -y update && dnf install -y httpd && dnf clean all +RUN sed -i "s/Listen 80/Listen 127.0.0.1:8080/g" /etc/httpd/conf/httpd.conf +CMD ["/usr/sbin/httpd", "-DFOREGROUND"] +``` + +Build the container image + +``` +$ podman build -t socket-activate-httpd ctr +``` + +In one shell, start __systemd-socket-activate__. + +``` +$ systemd-socket-activate -l 8080 podman run --rm --network=none localhost/socket-activate-httpd +``` + +The TCP port number 8080 is given as an option to __systemd-socket-activate__. The __--publish__ (__-p__) +option for `podman run` is not used. + +In another shell, fetch a web page from _localhost:8080_ + +``` +$ curl -s localhost:8080 | head -6 + + + + + +Test Page for the HTTP Server on Fedora +$ +``` + +### Disabling the network with _--network=none_ + +If the container only needs to communicate over the socket-activated socket, it's possible to disable +the network by passing __--network=none__ to `podman run`. This improves security because the +container then runs with less privileges. + +### Native network performance over the socket-activated socket + +When using rootless Podman, network traffic is normally passed through slirp4netns. This comes with +a performance penalty. Fortunately, communication over the socket-activated socket does not pass through +slirp4netns so it has the same performance characteristics as the normal network on the host. + +### Starting a socket-activated service + +There is a delay when the first connection is made because the container needs to +start up. To minimize this delay, consider passing __--pull=never__ to `podman run` and instead +pull the container image beforehand. Instead of waiting for the start of the service to be triggered by the +first client connecting to it, the service can also be explicitly started (`systemctl --user start echo.service`). + +### Stopping a socket-activated service + +Some services run a command (configured by the systemd directive __ExecStart__) that exits after some time of inactivity. +Depending on the restart configuration for the service +(systemd directive [__Restart__](https://www.freedesktop.org/software/systemd/man/systemd.service.html#Restart=)), +it may then be stopped. An example of this is _podman.service_ that stops after some time of inactivity. +The service will be started again when the next client connects to the socket. diff --git a/versioned_sidebars/version-5.4.1-sidebars.json b/versioned_sidebars/version-5.4.1-sidebars.json new file mode 100644 index 000000000..3cdc130a3 --- /dev/null +++ b/versioned_sidebars/version-5.4.1-sidebars.json @@ -0,0 +1,45 @@ +{ + "tutorialSidebar": [ + { + "type": "doc", + "id": "index", + "label": "Overview" + }, + { + "type": "doc", + "id": "source/markdown/podman.1", + "label": "Podman Command" + }, + { + "type": "category", + "label": "Tutorials", + "items": [ + "tutorials/README", + "tutorials/basic_networking", + "tutorials/image_signing", + "tutorials/mac_client", + "tutorials/mac_win_client", + "tutorials/performance", + "tutorials/podman-derivative-api", + "tutorials/podman-for-windows", + "tutorials/podman-install-certificate-authority", + "tutorials/podman_tutorial", + "tutorials/podman_tutorial_cn", + "tutorials/qemu-remote-tutorial", + "tutorials/remote_client", + "tutorials/rootless_tutorial", + "tutorials/socket_activation" + ] + }, + { + "type": "doc", + "id": "kubernetes_support", + "label": "Kubernetes Support" + }, + { + "type": "doc", + "id": "MANPAGE_SYNTAX", + "label": "Manual Page Syntax" + } + ] +} \ No newline at end of file diff --git a/versioned_sidebars/version-5.4.2-sidebars.json b/versioned_sidebars/version-5.4.2-sidebars.json new file mode 100644 index 000000000..3cdc130a3 --- /dev/null +++ b/versioned_sidebars/version-5.4.2-sidebars.json @@ -0,0 +1,45 @@ +{ + "tutorialSidebar": [ + { + "type": "doc", + "id": "index", + "label": "Overview" + }, + { + "type": "doc", + "id": "source/markdown/podman.1", + "label": "Podman Command" + }, + { + "type": "category", + "label": "Tutorials", + "items": [ + "tutorials/README", + "tutorials/basic_networking", + "tutorials/image_signing", + "tutorials/mac_client", + "tutorials/mac_win_client", + "tutorials/performance", + "tutorials/podman-derivative-api", + "tutorials/podman-for-windows", + "tutorials/podman-install-certificate-authority", + "tutorials/podman_tutorial", + "tutorials/podman_tutorial_cn", + "tutorials/qemu-remote-tutorial", + "tutorials/remote_client", + "tutorials/rootless_tutorial", + "tutorials/socket_activation" + ] + }, + { + "type": "doc", + "id": "kubernetes_support", + "label": "Kubernetes Support" + }, + { + "type": "doc", + "id": "MANPAGE_SYNTAX", + "label": "Manual Page Syntax" + } + ] +} \ No newline at end of file diff --git a/versioned_sidebars/version-5.5.0-sidebars.json b/versioned_sidebars/version-5.5.0-sidebars.json new file mode 100644 index 000000000..3cdc130a3 --- /dev/null +++ b/versioned_sidebars/version-5.5.0-sidebars.json @@ -0,0 +1,45 @@ +{ + "tutorialSidebar": [ + { + "type": "doc", + "id": "index", + "label": "Overview" + }, + { + "type": "doc", + "id": "source/markdown/podman.1", + "label": "Podman Command" + }, + { + "type": "category", + "label": "Tutorials", + "items": [ + "tutorials/README", + "tutorials/basic_networking", + "tutorials/image_signing", + "tutorials/mac_client", + "tutorials/mac_win_client", + "tutorials/performance", + "tutorials/podman-derivative-api", + "tutorials/podman-for-windows", + "tutorials/podman-install-certificate-authority", + "tutorials/podman_tutorial", + "tutorials/podman_tutorial_cn", + "tutorials/qemu-remote-tutorial", + "tutorials/remote_client", + "tutorials/rootless_tutorial", + "tutorials/socket_activation" + ] + }, + { + "type": "doc", + "id": "kubernetes_support", + "label": "Kubernetes Support" + }, + { + "type": "doc", + "id": "MANPAGE_SYNTAX", + "label": "Manual Page Syntax" + } + ] +} \ No newline at end of file diff --git a/versioned_sidebars/version-5.5.1-sidebars.json b/versioned_sidebars/version-5.5.1-sidebars.json new file mode 100644 index 000000000..3cdc130a3 --- /dev/null +++ b/versioned_sidebars/version-5.5.1-sidebars.json @@ -0,0 +1,45 @@ +{ + "tutorialSidebar": [ + { + "type": "doc", + "id": "index", + "label": "Overview" + }, + { + "type": "doc", + "id": "source/markdown/podman.1", + "label": "Podman Command" + }, + { + "type": "category", + "label": "Tutorials", + "items": [ + "tutorials/README", + "tutorials/basic_networking", + "tutorials/image_signing", + "tutorials/mac_client", + "tutorials/mac_win_client", + "tutorials/performance", + "tutorials/podman-derivative-api", + "tutorials/podman-for-windows", + "tutorials/podman-install-certificate-authority", + "tutorials/podman_tutorial", + "tutorials/podman_tutorial_cn", + "tutorials/qemu-remote-tutorial", + "tutorials/remote_client", + "tutorials/rootless_tutorial", + "tutorials/socket_activation" + ] + }, + { + "type": "doc", + "id": "kubernetes_support", + "label": "Kubernetes Support" + }, + { + "type": "doc", + "id": "MANPAGE_SYNTAX", + "label": "Manual Page Syntax" + } + ] +} \ No newline at end of file diff --git a/versioned_sidebars/version-5.5.2-sidebars.json b/versioned_sidebars/version-5.5.2-sidebars.json new file mode 100644 index 000000000..3cdc130a3 --- /dev/null +++ b/versioned_sidebars/version-5.5.2-sidebars.json @@ -0,0 +1,45 @@ +{ + "tutorialSidebar": [ + { + "type": "doc", + "id": "index", + "label": "Overview" + }, + { + "type": "doc", + "id": "source/markdown/podman.1", + "label": "Podman Command" + }, + { + "type": "category", + "label": "Tutorials", + "items": [ + "tutorials/README", + "tutorials/basic_networking", + "tutorials/image_signing", + "tutorials/mac_client", + "tutorials/mac_win_client", + "tutorials/performance", + "tutorials/podman-derivative-api", + "tutorials/podman-for-windows", + "tutorials/podman-install-certificate-authority", + "tutorials/podman_tutorial", + "tutorials/podman_tutorial_cn", + "tutorials/qemu-remote-tutorial", + "tutorials/remote_client", + "tutorials/rootless_tutorial", + "tutorials/socket_activation" + ] + }, + { + "type": "doc", + "id": "kubernetes_support", + "label": "Kubernetes Support" + }, + { + "type": "doc", + "id": "MANPAGE_SYNTAX", + "label": "Manual Page Syntax" + } + ] +} \ No newline at end of file diff --git a/versions.json b/versions.json new file mode 100644 index 000000000..ce05a5999 --- /dev/null +++ b/versions.json @@ -0,0 +1,7 @@ +[ + "5.5.2", + "5.5.1", + "5.5.0", + "5.4.2", + "5.4.1" +] \ No newline at end of file diff --git a/yarn.lock b/yarn.lock index f808c78a5..ff14df24e 100644 --- a/yarn.lock +++ b/yarn.lock @@ -5,133 +5,125 @@ __metadata: version: 6 cacheKey: 8 -"@aashutoshrathi/word-wrap@npm:^1.2.3": - version: 1.2.6 - resolution: "@aashutoshrathi/word-wrap@npm:1.2.6" - checksum: ada901b9e7c680d190f1d012c84217ce0063d8f5c5a7725bb91ec3c5ed99bb7572680eb2d2938a531ccbaec39a95422fcd8a6b4a13110c7d98dd75402f66a0cd - languageName: node - linkType: hard - -"@algolia/autocomplete-core@npm:1.9.3": - version: 1.9.3 - resolution: "@algolia/autocomplete-core@npm:1.9.3" +"@algolia/autocomplete-core@npm:1.17.9": + version: 1.17.9 + resolution: "@algolia/autocomplete-core@npm:1.17.9" dependencies: - "@algolia/autocomplete-plugin-algolia-insights": 1.9.3 - "@algolia/autocomplete-shared": 1.9.3 - checksum: ce78048568660184a4fa3c6548f344a7f5ce0ba45d4cfc233f9756b6d4f360afd5ae3a18efefcd27a626d3a0d6cf22d9cba3e21b217afae62b8e9d11bc4960da + "@algolia/autocomplete-plugin-algolia-insights": 1.17.9 + "@algolia/autocomplete-shared": 1.17.9 + checksum: dde242b1a2d8485e6c7bc94d00e25d707aa66dcd276ee1dde13213f1620bf6a1d289a61c657e40c707ca726a8aa009ab5e8229f92ae5cf22266de490b0634d20 languageName: node linkType: hard -"@algolia/autocomplete-plugin-algolia-insights@npm:1.9.3": - version: 1.9.3 - resolution: "@algolia/autocomplete-plugin-algolia-insights@npm:1.9.3" +"@algolia/autocomplete-plugin-algolia-insights@npm:1.17.9": + version: 1.17.9 + resolution: "@algolia/autocomplete-plugin-algolia-insights@npm:1.17.9" dependencies: - "@algolia/autocomplete-shared": 1.9.3 + "@algolia/autocomplete-shared": 1.17.9 peerDependencies: search-insights: ">= 1 < 3" - checksum: 030695bf692021c27f52a3d4931efed23032796e326d4ae7957ae91b51c36a10dc2d885fb043909e853f961c994b8e9ff087f50bb918cfa075370562251a199f + checksum: 32761d44a407d7c5ecfae98bb78b45a1ca85c59f44167ea36057315fb357c49684e9126bb7a67a513a27bda60a9661cecd6215f2daa903288860201b0b18c745 languageName: node linkType: hard -"@algolia/autocomplete-preset-algolia@npm:1.9.3": - version: 1.9.3 - resolution: "@algolia/autocomplete-preset-algolia@npm:1.9.3" +"@algolia/autocomplete-preset-algolia@npm:1.17.9": + version: 1.17.9 + resolution: "@algolia/autocomplete-preset-algolia@npm:1.17.9" dependencies: - "@algolia/autocomplete-shared": 1.9.3 + "@algolia/autocomplete-shared": 1.17.9 peerDependencies: "@algolia/client-search": ">= 4.9.1 < 6" algoliasearch: ">= 4.9.1 < 6" - checksum: 1ab3273d3054b348eed286ad1a54b21807846326485507b872477b827dc688006d4f14233cebd0bf49b2932ec8e29eca6d76e48a3c9e9e963b25153b987549c0 + checksum: 0dac2aae02121d37466b4ce1ca533420b25cd70e218a9e645e6194bd84a6012a0e94c22125437adb89599ecf14e4488882f91da382c6c9a8d9447e929b317522 languageName: node linkType: hard -"@algolia/autocomplete-shared@npm:1.9.3": - version: 1.9.3 - resolution: "@algolia/autocomplete-shared@npm:1.9.3" +"@algolia/autocomplete-shared@npm:1.17.9": + version: 1.17.9 + resolution: "@algolia/autocomplete-shared@npm:1.17.9" peerDependencies: "@algolia/client-search": ">= 4.9.1 < 6" algoliasearch: ">= 4.9.1 < 6" - checksum: 06014c8b08d30c452de079f48c0235d8fa09904bf511da8dc1b7e491819940fd4ff36b9bf65340242b2e157a26799a3b9aea01feee9c5bf67be3c48d7dff43d7 + checksum: f16223f5995db0deb014a066e3587ec2da76e62b861aa21411be92cb255b7023507803283803d8c960b396a2c6b690951337c32fef34f68c59ecfb3822dee577 languageName: node linkType: hard -"@algolia/cache-browser-local-storage@npm:4.20.0": - version: 4.20.0 - resolution: "@algolia/cache-browser-local-storage@npm:4.20.0" +"@algolia/client-abtesting@npm:5.34.0": + version: 5.34.0 + resolution: "@algolia/client-abtesting@npm:5.34.0" dependencies: - "@algolia/cache-common": 4.20.0 - checksum: b9ca7e190ab77ddf4d30d22223345f69fc89899aa6887ee716e4ffcef14c8c9d28b782cb7cc96a0f04eed95a989878a6feca5b9aa6add0cd1846222c3308bb65 - languageName: node - linkType: hard - -"@algolia/cache-common@npm:4.20.0": - version: 4.20.0 - resolution: "@algolia/cache-common@npm:4.20.0" - checksum: a46377de8a309feea109aae1283fc9157c73766a4c51e3085870a1fc49f6e33698814379f3bbdf475713fa0663dace86fc90f0466e64469b1b885a0538abace4 + "@algolia/client-common": 5.34.0 + "@algolia/requester-browser-xhr": 5.34.0 + "@algolia/requester-fetch": 5.34.0 + "@algolia/requester-node-http": 5.34.0 + checksum: 7c62915e1dc6713f6d97abfc029d137f32c73510e51440af21eec051de8712cc37d573e46a019e158fc096a8238ca3af34c270391df098f230283f18cd67d732 languageName: node linkType: hard -"@algolia/cache-in-memory@npm:4.20.0": - version: 4.20.0 - resolution: "@algolia/cache-in-memory@npm:4.20.0" +"@algolia/client-analytics@npm:5.34.0": + version: 5.34.0 + resolution: "@algolia/client-analytics@npm:5.34.0" dependencies: - "@algolia/cache-common": 4.20.0 - checksum: 3d67dcfae431605c8b9b1502f14865722f13b97b2822e1e3ed53bbf7bf66a120a825ccf5ed03476ebdf4aa15482dad5bfc6c2c93d81f07f862c373c689f49317 + "@algolia/client-common": 5.34.0 + "@algolia/requester-browser-xhr": 5.34.0 + "@algolia/requester-fetch": 5.34.0 + "@algolia/requester-node-http": 5.34.0 + checksum: 3687fb8050c8f4b5c4badd4758e1d6c21a21b97acdd42637facec156728534eb49168b0b0e233389d133b4396e78b963d4369620918c3260c76a0e8bcdf2dd0a languageName: node linkType: hard -"@algolia/client-account@npm:4.20.0": - version: 4.20.0 - resolution: "@algolia/client-account@npm:4.20.0" - dependencies: - "@algolia/client-common": 4.20.0 - "@algolia/client-search": 4.20.0 - "@algolia/transporter": 4.20.0 - checksum: b59e9c7a324bbfba4abdab3f41d333522eb1abce7dab74e69d297acd9ee2a3c60e82e5e9db42e6a46b5ea26a35728533e6e4ff846c631b588ceb73d14dcbc5fb +"@algolia/client-common@npm:5.34.0": + version: 5.34.0 + resolution: "@algolia/client-common@npm:5.34.0" + checksum: 2b6dc410328c3aa7dbc1894cb304a9de6872972ec73f8314196b5f947b9290b3a5cfe6efd7c3b563c35319b25c83cee5111baa02aec02264f812519b669b5405 languageName: node linkType: hard -"@algolia/client-analytics@npm:4.20.0": - version: 4.20.0 - resolution: "@algolia/client-analytics@npm:4.20.0" +"@algolia/client-insights@npm:5.34.0": + version: 5.34.0 + resolution: "@algolia/client-insights@npm:5.34.0" dependencies: - "@algolia/client-common": 4.20.0 - "@algolia/client-search": 4.20.0 - "@algolia/requester-common": 4.20.0 - "@algolia/transporter": 4.20.0 - checksum: 0be4120ab72162e0640e49eedddff81bfc2c590e9a9322d1788b8c01e06fdabcaaaa9cd75b5b516e502deb888d3ba2285ac5e1c3bb91fc9eb552a24a716dc6e3 + "@algolia/client-common": 5.34.0 + "@algolia/requester-browser-xhr": 5.34.0 + "@algolia/requester-fetch": 5.34.0 + "@algolia/requester-node-http": 5.34.0 + checksum: 62941f5d29e5d6e2230248cf153192b7ba308af6fb4cc9bbe24e8b9410168afb05cf64d1f8356a5f57971cf628fc1829acd141ddce61505b9899310893f0b265 languageName: node linkType: hard -"@algolia/client-common@npm:4.20.0": - version: 4.20.0 - resolution: "@algolia/client-common@npm:4.20.0" +"@algolia/client-personalization@npm:5.34.0": + version: 5.34.0 + resolution: "@algolia/client-personalization@npm:5.34.0" dependencies: - "@algolia/requester-common": 4.20.0 - "@algolia/transporter": 4.20.0 - checksum: 88a27b5f8bba38349e1dbe47634e2ee159a413ff1a3baf6a65fbf244835f8d368e9f0a5ccce8bfe94ec405b38608be5bed45bcb140517f3aba6fe3b7045db373 + "@algolia/client-common": 5.34.0 + "@algolia/requester-browser-xhr": 5.34.0 + "@algolia/requester-fetch": 5.34.0 + "@algolia/requester-node-http": 5.34.0 + checksum: a8a406d5bdd9266f4fdeb79b6b41bf2436477ced25d2e955d3b170d72cad909aa812ebd051634012b58add8ac325af64d66a7cc38065accbb8fccc736a0a4d87 languageName: node linkType: hard -"@algolia/client-personalization@npm:4.20.0": - version: 4.20.0 - resolution: "@algolia/client-personalization@npm:4.20.0" +"@algolia/client-query-suggestions@npm:5.34.0": + version: 5.34.0 + resolution: "@algolia/client-query-suggestions@npm:5.34.0" dependencies: - "@algolia/client-common": 4.20.0 - "@algolia/requester-common": 4.20.0 - "@algolia/transporter": 4.20.0 - checksum: ddb92ebe135564e03db6ac75da7fdc1c7500a0deffb7e41d5a02a413216a06daea008f8062dab606ba8af4c3c34e550354f48e6ea7b048882c385d915643799a + "@algolia/client-common": 5.34.0 + "@algolia/requester-browser-xhr": 5.34.0 + "@algolia/requester-fetch": 5.34.0 + "@algolia/requester-node-http": 5.34.0 + checksum: c5636bc13fd833cc2927e56c9a77909f4110b22045a19fbb6eb9b4035b2ecc254af443eb64a3483ba81f823ac2d93474a351a86532b27ef79977db61b5b44080 languageName: node linkType: hard -"@algolia/client-search@npm:4.20.0": - version: 4.20.0 - resolution: "@algolia/client-search@npm:4.20.0" +"@algolia/client-search@npm:5.34.0": + version: 5.34.0 + resolution: "@algolia/client-search@npm:5.34.0" dependencies: - "@algolia/client-common": 4.20.0 - "@algolia/requester-common": 4.20.0 - "@algolia/transporter": 4.20.0 - checksum: 9fb6624dab6753f336f3207ee2af3558baeec4772ef739b6f6ed6a754c366e2e8d62cbf1cf8b28d5f763bec276a0a5fc36db2bf6f53a707890a411afcf550e92 + "@algolia/client-common": 5.34.0 + "@algolia/requester-browser-xhr": 5.34.0 + "@algolia/requester-fetch": 5.34.0 + "@algolia/requester-node-http": 5.34.0 + checksum: 2c509acb2866d6859d915a894af406a14f8bd21e2041881f43e66eb2a0cc79fe966f2367dde662060f3a4a7c146341bc6cd78a7df778963ffe3dd8cce896ce36 languageName: node linkType: hard @@ -142,55 +134,66 @@ __metadata: languageName: node linkType: hard -"@algolia/logger-common@npm:4.20.0": - version: 4.20.0 - resolution: "@algolia/logger-common@npm:4.20.0" - checksum: 06ed28f76b630c8e7597534b15138ab6f71c10dfc6e13f1fb1b76965b39c88fd1d9cb3fe6bb9d046de6533ebcbe5ad92e751bc36fabe98ceda39d1d5f47bb637 +"@algolia/ingestion@npm:1.34.0": + version: 1.34.0 + resolution: "@algolia/ingestion@npm:1.34.0" + dependencies: + "@algolia/client-common": 5.34.0 + "@algolia/requester-browser-xhr": 5.34.0 + "@algolia/requester-fetch": 5.34.0 + "@algolia/requester-node-http": 5.34.0 + checksum: 1166992bd7f0ad3a96b82ded6f7814615b1da0e41552915a0af23619a6c118100bdd46f95221b77b24f98328eb69d58e331e7c0fc9fcd3baf140fa71bb61ffac languageName: node linkType: hard -"@algolia/logger-console@npm:4.20.0": - version: 4.20.0 - resolution: "@algolia/logger-console@npm:4.20.0" +"@algolia/monitoring@npm:1.34.0": + version: 1.34.0 + resolution: "@algolia/monitoring@npm:1.34.0" dependencies: - "@algolia/logger-common": 4.20.0 - checksum: 721dffe37563e2998d4c361f09a05736b4baa141bfb7da25d50f890ba8257ac99845dd94b43d0d6db38e2fdab96508a726e184a00e5b1e83ef18a16da6fc716c + "@algolia/client-common": 5.34.0 + "@algolia/requester-browser-xhr": 5.34.0 + "@algolia/requester-fetch": 5.34.0 + "@algolia/requester-node-http": 5.34.0 + checksum: fc5535363e40510cc2e0e0c456b5cf809940beb6cc3d7a4f2df6e9e1ab5bbd7f1d2091e19d220429427dffda9ca018a764cd3a4a66fe089949ca07ac297e68a2 languageName: node linkType: hard -"@algolia/requester-browser-xhr@npm:4.20.0": - version: 4.20.0 - resolution: "@algolia/requester-browser-xhr@npm:4.20.0" +"@algolia/recommend@npm:5.34.0": + version: 5.34.0 + resolution: "@algolia/recommend@npm:5.34.0" dependencies: - "@algolia/requester-common": 4.20.0 - checksum: 669790c7dfd491318976b9d61d98d9785880d7385ba33669f3f8b9c66ea88320bcded82d34f58b5df74b2cb8beb62ef48a28d39117f7997be84348c9fa7f6132 + "@algolia/client-common": 5.34.0 + "@algolia/requester-browser-xhr": 5.34.0 + "@algolia/requester-fetch": 5.34.0 + "@algolia/requester-node-http": 5.34.0 + checksum: 32acfb07924b1b95c84723d546400e26452df8a947d91689fe813eaa495b8cef4e900b0c571ede9627124a2d598ce4796d2da69a7a2a8b29314881db026719e0 languageName: node linkType: hard -"@algolia/requester-common@npm:4.20.0": - version: 4.20.0 - resolution: "@algolia/requester-common@npm:4.20.0" - checksum: 8580ffd2be146bbdb5d4a57668bba4a5014f406cb2e5c65f596db6babab46c48d30c6e4732034ee1f987970aa27dcdab567959d654fa5fa74c4bcaf98312a724 +"@algolia/requester-browser-xhr@npm:5.34.0": + version: 5.34.0 + resolution: "@algolia/requester-browser-xhr@npm:5.34.0" + dependencies: + "@algolia/client-common": 5.34.0 + checksum: ef50fa002ba318dcf4ebfbab00def93a1dc28a71bf658eaf5390230b3650cce517a8da6cd8fb7b84cf1dffda0ac6e757c833299b8cf0e665bc8136aace002215 languageName: node linkType: hard -"@algolia/requester-node-http@npm:4.20.0": - version: 4.20.0 - resolution: "@algolia/requester-node-http@npm:4.20.0" +"@algolia/requester-fetch@npm:5.34.0": + version: 5.34.0 + resolution: "@algolia/requester-fetch@npm:5.34.0" dependencies: - "@algolia/requester-common": 4.20.0 - checksum: 7857114b59c67e0d22e8a7ff3f755d11534a1602a4fc80802d3b35802777880a4980420914ea4a6e3e21198f5bacb95906289ce1bb9372458bf6a60a723bee59 + "@algolia/client-common": 5.34.0 + checksum: 707eee2258cee1f3d5c04b2227ea8b0ac46590d2d68bd8da122971571a32e1ee3152dc22be2792d1a2ac5afc999b7877f493bfbd85f5b9017dabb632301ea360 languageName: node linkType: hard -"@algolia/transporter@npm:4.20.0": - version: 4.20.0 - resolution: "@algolia/transporter@npm:4.20.0" +"@algolia/requester-node-http@npm:5.34.0": + version: 5.34.0 + resolution: "@algolia/requester-node-http@npm:5.34.0" dependencies: - "@algolia/cache-common": 4.20.0 - "@algolia/logger-common": 4.20.0 - "@algolia/requester-common": 4.20.0 - checksum: f834d5c8fcb7dfa9b7044cb81e9fab44a32f9dd0c3868a0f85fe0de4f4d27ad11fdc9c3c78541bc944c2593f4be56517a8ce593309d062b8a46ca0d6fcb5dcbc + "@algolia/client-common": 5.34.0 + checksum: 83581b5c0440a5e600df1c7f2177a93c105c3107bd7f8a1fcb1e06e2935ee86726dde5df2e77d9d350b874ae21ef1b3b1ba1f9b3fcd37e9f3e08d9e2db70abbf languageName: node linkType: hard @@ -202,401 +205,337 @@ __metadata: linkType: hard "@ampproject/remapping@npm:^2.2.0": - version: 2.2.1 - resolution: "@ampproject/remapping@npm:2.2.1" + version: 2.3.0 + resolution: "@ampproject/remapping@npm:2.3.0" dependencies: - "@jridgewell/gen-mapping": ^0.3.0 - "@jridgewell/trace-mapping": ^0.3.9 - checksum: 03c04fd526acc64a1f4df22651186f3e5ef0a9d6d6530ce4482ec9841269cf7a11dbb8af79237c282d721c5312024ff17529cd72cc4768c11e999b58e2302079 + "@jridgewell/gen-mapping": ^0.3.5 + "@jridgewell/trace-mapping": ^0.3.24 + checksum: d3ad7b89d973df059c4e8e6d7c972cbeb1bb2f18f002a3bd04ae0707da214cb06cc06929b65aa2313b9347463df2914772298bae8b1d7973f246bb3f2ab3e8f0 languageName: node linkType: hard -"@babel/code-frame@npm:^7.0.0, @babel/code-frame@npm:^7.10.4, @babel/code-frame@npm:^7.16.0, @babel/code-frame@npm:^7.22.13, @babel/code-frame@npm:^7.8.3": - version: 7.22.13 - resolution: "@babel/code-frame@npm:7.22.13" +"@babel/code-frame@npm:^7.0.0, @babel/code-frame@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/code-frame@npm:7.27.1" dependencies: - "@babel/highlight": ^7.22.13 - chalk: ^2.4.2 - checksum: 22e342c8077c8b77eeb11f554ecca2ba14153f707b85294fcf6070b6f6150aae88a7b7436dd88d8c9289970585f3fe5b9b941c5aa3aa26a6d5a8ef3f292da058 - languageName: node - linkType: hard - -"@babel/compat-data@npm:^7.22.20, @babel/compat-data@npm:^7.22.6, @babel/compat-data@npm:^7.22.9": - version: 7.22.20 - resolution: "@babel/compat-data@npm:7.22.20" - checksum: efedd1d18878c10fde95e4d82b1236a9aba41395ef798cbb651f58dbf5632dbff475736c507b8d13d4c8f44809d41c0eb2ef0d694283af9ba5dd8339b6dab451 + "@babel/helper-validator-identifier": ^7.27.1 + js-tokens: ^4.0.0 + picocolors: ^1.1.1 + checksum: 5874edc5d37406c4a0bb14cf79c8e51ad412fb0423d176775ac14fc0259831be1bf95bdda9c2aa651126990505e09a9f0ed85deaa99893bc316d2682c5115bdc languageName: node linkType: hard -"@babel/core@npm:7.12.9": - version: 7.12.9 - resolution: "@babel/core@npm:7.12.9" - dependencies: - "@babel/code-frame": ^7.10.4 - "@babel/generator": ^7.12.5 - "@babel/helper-module-transforms": ^7.12.1 - "@babel/helpers": ^7.12.5 - "@babel/parser": ^7.12.7 - "@babel/template": ^7.12.7 - "@babel/traverse": ^7.12.9 - "@babel/types": ^7.12.7 - convert-source-map: ^1.7.0 - debug: ^4.1.0 - gensync: ^1.0.0-beta.1 - json5: ^2.1.2 - lodash: ^4.17.19 - resolve: ^1.3.2 - semver: ^5.4.1 - source-map: ^0.5.0 - checksum: 4d34eca4688214a4eb6bd5dde906b69a7824f17b931f52cd03628a8ac94d8fbe15565aebffdde106e974c8738cd64ac62c6a6060baa7139a06db1f18c4ff872d +"@babel/compat-data@npm:^7.27.2, @babel/compat-data@npm:^7.27.7, @babel/compat-data@npm:^7.28.0": + version: 7.28.0 + resolution: "@babel/compat-data@npm:7.28.0" + checksum: 37a40d4ea10a32783bc24c4ad374200f5db864c8dfa42f82e76f02b8e84e4c65e6a017fc014d165b08833f89333dff4cb635fce30f03c333ea3525ea7e20f0a2 languageName: node linkType: hard -"@babel/core@npm:^7.18.6, @babel/core@npm:^7.19.6": - version: 7.23.0 - resolution: "@babel/core@npm:7.23.0" +"@babel/core@npm:^7.21.3, @babel/core@npm:^7.25.9": + version: 7.28.0 + resolution: "@babel/core@npm:7.28.0" dependencies: "@ampproject/remapping": ^2.2.0 - "@babel/code-frame": ^7.22.13 - "@babel/generator": ^7.23.0 - "@babel/helper-compilation-targets": ^7.22.15 - "@babel/helper-module-transforms": ^7.23.0 - "@babel/helpers": ^7.23.0 - "@babel/parser": ^7.23.0 - "@babel/template": ^7.22.15 - "@babel/traverse": ^7.23.0 - "@babel/types": ^7.23.0 + "@babel/code-frame": ^7.27.1 + "@babel/generator": ^7.28.0 + "@babel/helper-compilation-targets": ^7.27.2 + "@babel/helper-module-transforms": ^7.27.3 + "@babel/helpers": ^7.27.6 + "@babel/parser": ^7.28.0 + "@babel/template": ^7.27.2 + "@babel/traverse": ^7.28.0 + "@babel/types": ^7.28.0 convert-source-map: ^2.0.0 debug: ^4.1.0 gensync: ^1.0.0-beta.2 json5: ^2.2.3 semver: ^6.3.1 - checksum: cebd9b48dbc970a7548522f207f245c69567e5ea17ebb1a4e4de563823cf20a01177fe8d2fe19b6e1461361f92fa169fd0b29f8ee9d44eeec84842be1feee5f2 + checksum: 86da9e26c96e22d96deca0509969d273476f61c30464f262dec5e5a163422e07d5ab690ed54619d10fcab784abd10567022ce3d90f175b40279874f5288215e3 languageName: node linkType: hard -"@babel/generator@npm:^7.12.5, @babel/generator@npm:^7.18.7, @babel/generator@npm:^7.23.0": - version: 7.23.0 - resolution: "@babel/generator@npm:7.23.0" +"@babel/generator@npm:^7.25.9, @babel/generator@npm:^7.28.0": + version: 7.28.0 + resolution: "@babel/generator@npm:7.28.0" dependencies: - "@babel/types": ^7.23.0 - "@jridgewell/gen-mapping": ^0.3.2 - "@jridgewell/trace-mapping": ^0.3.17 - jsesc: ^2.5.1 - checksum: 8efe24adad34300f1f8ea2add420b28171a646edc70f2a1b3e1683842f23b8b7ffa7e35ef0119294e1901f45bfea5b3dc70abe1f10a1917ccdfb41bed69be5f1 - languageName: node - linkType: hard - -"@babel/helper-annotate-as-pure@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/helper-annotate-as-pure@npm:7.22.5" - dependencies: - "@babel/types": ^7.22.5 - checksum: 53da330f1835c46f26b7bf4da31f7a496dee9fd8696cca12366b94ba19d97421ce519a74a837f687749318f94d1a37f8d1abcbf35e8ed22c32d16373b2f6198d + "@babel/parser": ^7.28.0 + "@babel/types": ^7.28.0 + "@jridgewell/gen-mapping": ^0.3.12 + "@jridgewell/trace-mapping": ^0.3.28 + jsesc: ^3.0.2 + checksum: 3fc9ecca7e7a617cf7b7357e11975ddfaba4261f374ab915f5d9f3b1ddc8fd58da9f39492396416eb08cf61972d1aa13c92d4cca206533c553d8651c2740f07f languageName: node linkType: hard -"@babel/helper-builder-binary-assignment-operator-visitor@npm:^7.22.5": - version: 7.22.15 - resolution: "@babel/helper-builder-binary-assignment-operator-visitor@npm:7.22.15" +"@babel/helper-annotate-as-pure@npm:^7.27.1, @babel/helper-annotate-as-pure@npm:^7.27.3": + version: 7.27.3 + resolution: "@babel/helper-annotate-as-pure@npm:7.27.3" dependencies: - "@babel/types": ^7.22.15 - checksum: 639c697a1c729f9fafa2dd4c9af2e18568190299b5907bd4c2d0bc818fcbd1e83ffeecc2af24327a7faa7ac4c34edd9d7940510a5e66296c19bad17001cf5c7a + "@babel/types": ^7.27.3 + checksum: 63863a5c936ef82b546ca289c9d1b18fabfc24da5c4ee382830b124e2e79b68d626207febc8d4bffc720f50b2ee65691d7d12cc0308679dee2cd6bdc926b7190 languageName: node linkType: hard -"@babel/helper-compilation-targets@npm:^7.22.15, @babel/helper-compilation-targets@npm:^7.22.5, @babel/helper-compilation-targets@npm:^7.22.6": - version: 7.22.15 - resolution: "@babel/helper-compilation-targets@npm:7.22.15" +"@babel/helper-compilation-targets@npm:^7.27.1, @babel/helper-compilation-targets@npm:^7.27.2": + version: 7.27.2 + resolution: "@babel/helper-compilation-targets@npm:7.27.2" dependencies: - "@babel/compat-data": ^7.22.9 - "@babel/helper-validator-option": ^7.22.15 - browserslist: ^4.21.9 + "@babel/compat-data": ^7.27.2 + "@babel/helper-validator-option": ^7.27.1 + browserslist: ^4.24.0 lru-cache: ^5.1.1 semver: ^6.3.1 - checksum: ce85196769e091ae54dd39e4a80c2a9df1793da8588e335c383d536d54f06baf648d0a08fc873044f226398c4ded15c4ae9120ee18e7dfd7c639a68e3cdc9980 + checksum: 7b95328237de85d7af1dea010a4daa28e79f961dda48b652860d5893ce9b136fc8b9ea1f126d8e0a24963b09ba5c6631dcb907b4ce109b04452d34a6ae979807 languageName: node linkType: hard -"@babel/helper-create-class-features-plugin@npm:^7.22.11, @babel/helper-create-class-features-plugin@npm:^7.22.15, @babel/helper-create-class-features-plugin@npm:^7.22.5": - version: 7.22.15 - resolution: "@babel/helper-create-class-features-plugin@npm:7.22.15" +"@babel/helper-create-class-features-plugin@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/helper-create-class-features-plugin@npm:7.27.1" dependencies: - "@babel/helper-annotate-as-pure": ^7.22.5 - "@babel/helper-environment-visitor": ^7.22.5 - "@babel/helper-function-name": ^7.22.5 - "@babel/helper-member-expression-to-functions": ^7.22.15 - "@babel/helper-optimise-call-expression": ^7.22.5 - "@babel/helper-replace-supers": ^7.22.9 - "@babel/helper-skip-transparent-expression-wrappers": ^7.22.5 - "@babel/helper-split-export-declaration": ^7.22.6 + "@babel/helper-annotate-as-pure": ^7.27.1 + "@babel/helper-member-expression-to-functions": ^7.27.1 + "@babel/helper-optimise-call-expression": ^7.27.1 + "@babel/helper-replace-supers": ^7.27.1 + "@babel/helper-skip-transparent-expression-wrappers": ^7.27.1 + "@babel/traverse": ^7.27.1 semver: ^6.3.1 peerDependencies: "@babel/core": ^7.0.0 - checksum: 52c500d8d164abb3a360b1b7c4b8fff77bc4a5920d3a2b41ae6e1d30617b0dc0b972c1f5db35b1752007e04a748908b4a99bc872b73549ae837e87dcdde005a3 + checksum: 406954b455e5b20924e7d1b41cf932e6e98e95c3a5224c7a70c3ad96a84e8fbde915ceff7ddbf9c7d121397c4e9274f061241648475122cf6fe54e0a95caae15 languageName: node linkType: hard -"@babel/helper-create-regexp-features-plugin@npm:^7.18.6, @babel/helper-create-regexp-features-plugin@npm:^7.22.5": - version: 7.22.15 - resolution: "@babel/helper-create-regexp-features-plugin@npm:7.22.15" +"@babel/helper-create-regexp-features-plugin@npm:^7.18.6, @babel/helper-create-regexp-features-plugin@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/helper-create-regexp-features-plugin@npm:7.27.1" dependencies: - "@babel/helper-annotate-as-pure": ^7.22.5 - regexpu-core: ^5.3.1 + "@babel/helper-annotate-as-pure": ^7.27.1 + regexpu-core: ^6.2.0 semver: ^6.3.1 peerDependencies: "@babel/core": ^7.0.0 - checksum: 0243b8d4854f1dc8861b1029a46d3f6393ad72f366a5a08e36a4648aa682044f06da4c6e87a456260e1e1b33c999f898ba591a0760842c1387bcc93fbf2151a6 + checksum: 2ede6bbad0016a9262fd281ce8f1a5d69e6179dcec4ea282830e924c29a29b66b0544ecb92e4ef4acdaf2c4c990931d7dc442dbcd6a8bcec4bad73923ef70934 languageName: node linkType: hard -"@babel/helper-define-polyfill-provider@npm:^0.4.2": - version: 0.4.2 - resolution: "@babel/helper-define-polyfill-provider@npm:0.4.2" +"@babel/helper-define-polyfill-provider@npm:^0.6.5": + version: 0.6.5 + resolution: "@babel/helper-define-polyfill-provider@npm:0.6.5" dependencies: - "@babel/helper-compilation-targets": ^7.22.6 - "@babel/helper-plugin-utils": ^7.22.5 - debug: ^4.1.1 + "@babel/helper-compilation-targets": ^7.27.2 + "@babel/helper-plugin-utils": ^7.27.1 + debug: ^4.4.1 lodash.debounce: ^4.0.8 - resolve: ^1.14.2 + resolve: ^1.22.10 peerDependencies: "@babel/core": ^7.4.0 || ^8.0.0-0 <8.0.0 - checksum: 1f6dec0c5d0876d278fe15b71238eccc5f74c4e2efa2c78aaafa8bc2cc96336b8e68d94cd1a78497356c96e8b91b8c1f4452179820624d1702aee2f9832e6569 - languageName: node - linkType: hard - -"@babel/helper-environment-visitor@npm:^7.22.20, @babel/helper-environment-visitor@npm:^7.22.5": - version: 7.22.20 - resolution: "@babel/helper-environment-visitor@npm:7.22.20" - checksum: d80ee98ff66f41e233f36ca1921774c37e88a803b2f7dca3db7c057a5fea0473804db9fb6729e5dbfd07f4bed722d60f7852035c2c739382e84c335661590b69 + checksum: 9fd3b09b209c8ed0d3d8bc1f494f1368b9e1f6e46195af4ce948630fe97d7dafde4882eedace270b319bf6555ddf35e220c77505f6d634f621766cdccbba0aae languageName: node linkType: hard -"@babel/helper-function-name@npm:^7.22.5, @babel/helper-function-name@npm:^7.23.0": - version: 7.23.0 - resolution: "@babel/helper-function-name@npm:7.23.0" - dependencies: - "@babel/template": ^7.22.15 - "@babel/types": ^7.23.0 - checksum: e44542257b2d4634a1f979244eb2a4ad8e6d75eb6761b4cfceb56b562f7db150d134bc538c8e6adca3783e3bc31be949071527aa8e3aab7867d1ad2d84a26e10 - languageName: node - linkType: hard - -"@babel/helper-hoist-variables@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/helper-hoist-variables@npm:7.22.5" - dependencies: - "@babel/types": ^7.22.5 - checksum: 394ca191b4ac908a76e7c50ab52102669efe3a1c277033e49467913c7ed6f7c64d7eacbeabf3bed39ea1f41731e22993f763b1edce0f74ff8563fd1f380d92cc +"@babel/helper-globals@npm:^7.28.0": + version: 7.28.0 + resolution: "@babel/helper-globals@npm:7.28.0" + checksum: d8d7b91c12dad1ee747968af0cb73baf91053b2bcf78634da2c2c4991fb45ede9bd0c8f9b5f3254881242bc0921218fcb7c28ae885477c25177147e978ce4397 languageName: node linkType: hard -"@babel/helper-member-expression-to-functions@npm:^7.22.15": - version: 7.23.0 - resolution: "@babel/helper-member-expression-to-functions@npm:7.23.0" +"@babel/helper-member-expression-to-functions@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/helper-member-expression-to-functions@npm:7.27.1" dependencies: - "@babel/types": ^7.23.0 - checksum: 494659361370c979ada711ca685e2efe9460683c36db1b283b446122596602c901e291e09f2f980ecedfe6e0f2bd5386cb59768285446530df10c14df1024e75 + "@babel/traverse": ^7.27.1 + "@babel/types": ^7.27.1 + checksum: b13a3d120015a6fd2f6e6c2ff789cd12498745ef028710cba612cfb751b91ace700c3f96c1689228d1dcb41e9d4cf83d6dff8627dcb0c8da12d79440e783c6b8 languageName: node linkType: hard -"@babel/helper-module-imports@npm:^7.22.15, @babel/helper-module-imports@npm:^7.22.5": - version: 7.22.15 - resolution: "@babel/helper-module-imports@npm:7.22.15" +"@babel/helper-module-imports@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/helper-module-imports@npm:7.27.1" dependencies: - "@babel/types": ^7.22.15 - checksum: ecd7e457df0a46f889228f943ef9b4a47d485d82e030676767e6a2fdcbdaa63594d8124d4b55fd160b41c201025aec01fc27580352b1c87a37c9c6f33d116702 + "@babel/traverse": ^7.27.1 + "@babel/types": ^7.27.1 + checksum: 92d01c71c0e4aacdc2babce418a9a1a27a8f7d770a210ffa0f3933f321befab18b655bc1241bebc40767516731de0b85639140c42e45a8210abe1e792f115b28 languageName: node linkType: hard -"@babel/helper-module-transforms@npm:^7.12.1, @babel/helper-module-transforms@npm:^7.22.5, @babel/helper-module-transforms@npm:^7.23.0": - version: 7.23.0 - resolution: "@babel/helper-module-transforms@npm:7.23.0" +"@babel/helper-module-transforms@npm:^7.27.1, @babel/helper-module-transforms@npm:^7.27.3": + version: 7.27.3 + resolution: "@babel/helper-module-transforms@npm:7.27.3" dependencies: - "@babel/helper-environment-visitor": ^7.22.20 - "@babel/helper-module-imports": ^7.22.15 - "@babel/helper-simple-access": ^7.22.5 - "@babel/helper-split-export-declaration": ^7.22.6 - "@babel/helper-validator-identifier": ^7.22.20 + "@babel/helper-module-imports": ^7.27.1 + "@babel/helper-validator-identifier": ^7.27.1 + "@babel/traverse": ^7.27.3 peerDependencies: "@babel/core": ^7.0.0 - checksum: 6e2afffb058cf3f8ce92f5116f710dda4341c81cfcd872f9a0197ea594f7ce0ab3cb940b0590af2fe99e60d2e5448bfba6bca8156ed70a2ed4be2adc8586c891 + checksum: c611d42d3cb7ba23b1a864fcf8d6cde0dc99e876ca1c9a67e4d7919a70706ded4aaa45420de2bf7f7ea171e078e59f0edcfa15a56d74b9485e151b95b93b946e languageName: node linkType: hard -"@babel/helper-optimise-call-expression@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/helper-optimise-call-expression@npm:7.22.5" +"@babel/helper-optimise-call-expression@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/helper-optimise-call-expression@npm:7.27.1" dependencies: - "@babel/types": ^7.22.5 - checksum: c70ef6cc6b6ed32eeeec4482127e8be5451d0e5282d5495d5d569d39eb04d7f1d66ec99b327f45d1d5842a9ad8c22d48567e93fc502003a47de78d122e355f7c - languageName: node - linkType: hard - -"@babel/helper-plugin-utils@npm:7.10.4": - version: 7.10.4 - resolution: "@babel/helper-plugin-utils@npm:7.10.4" - checksum: 639ed8fc462b97a83226cee6bb081b1d77e7f73e8b033d2592ed107ee41d96601e321e5ea53a33e47469c7f1146b250a3dcda5ab873c7de162ab62120c341a41 + "@babel/types": ^7.27.1 + checksum: 0fb7ee824a384529d6b74f8a58279f9b56bfe3cce332168067dddeab2552d8eeb56dc8eaf86c04a3a09166a316cb92dfc79c4c623cd034ad4c563952c98b464f languageName: node linkType: hard -"@babel/helper-plugin-utils@npm:^7.0.0, @babel/helper-plugin-utils@npm:^7.10.4, @babel/helper-plugin-utils@npm:^7.12.13, @babel/helper-plugin-utils@npm:^7.14.5, @babel/helper-plugin-utils@npm:^7.18.6, @babel/helper-plugin-utils@npm:^7.22.5, @babel/helper-plugin-utils@npm:^7.8.0, @babel/helper-plugin-utils@npm:^7.8.3": - version: 7.22.5 - resolution: "@babel/helper-plugin-utils@npm:7.22.5" - checksum: c0fc7227076b6041acd2f0e818145d2e8c41968cc52fb5ca70eed48e21b8fe6dd88a0a91cbddf4951e33647336eb5ae184747ca706817ca3bef5e9e905151ff5 +"@babel/helper-plugin-utils@npm:^7.0.0, @babel/helper-plugin-utils@npm:^7.18.6, @babel/helper-plugin-utils@npm:^7.27.1, @babel/helper-plugin-utils@npm:^7.8.0": + version: 7.27.1 + resolution: "@babel/helper-plugin-utils@npm:7.27.1" + checksum: 5d715055301badab62bdb2336075a77f8dc8bd290cad2bc1b37ea3bf1b3efc40594d308082229f239deb4d6b5b80b0a73bce000e595ea74416e0339c11037047 languageName: node linkType: hard -"@babel/helper-remap-async-to-generator@npm:^7.22.5, @babel/helper-remap-async-to-generator@npm:^7.22.9": - version: 7.22.20 - resolution: "@babel/helper-remap-async-to-generator@npm:7.22.20" +"@babel/helper-remap-async-to-generator@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/helper-remap-async-to-generator@npm:7.27.1" dependencies: - "@babel/helper-annotate-as-pure": ^7.22.5 - "@babel/helper-environment-visitor": ^7.22.20 - "@babel/helper-wrap-function": ^7.22.20 + "@babel/helper-annotate-as-pure": ^7.27.1 + "@babel/helper-wrap-function": ^7.27.1 + "@babel/traverse": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0 - checksum: 2fe6300a6f1b58211dffa0aed1b45d4958506d096543663dba83bd9251fe8d670fa909143a65b45e72acb49e7e20fbdb73eae315d9ddaced467948c3329986e7 + checksum: 0747397ba013f87dbf575454a76c18210d61c7c9af0f697546b4bcac670b54ddc156330234407b397f0c948738c304c228e0223039bc45eab4fbf46966a5e8cc languageName: node linkType: hard -"@babel/helper-replace-supers@npm:^7.22.5, @babel/helper-replace-supers@npm:^7.22.9": - version: 7.22.20 - resolution: "@babel/helper-replace-supers@npm:7.22.20" +"@babel/helper-replace-supers@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/helper-replace-supers@npm:7.27.1" dependencies: - "@babel/helper-environment-visitor": ^7.22.20 - "@babel/helper-member-expression-to-functions": ^7.22.15 - "@babel/helper-optimise-call-expression": ^7.22.5 + "@babel/helper-member-expression-to-functions": ^7.27.1 + "@babel/helper-optimise-call-expression": ^7.27.1 + "@babel/traverse": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0 - checksum: a0008332e24daedea2e9498733e3c39b389d6d4512637e000f96f62b797e702ee24a407ccbcd7a236a551590a38f31282829a8ef35c50a3c0457d88218cae639 + checksum: 3690266c304f21008690ba68062f889a363583cabc13c3d033b94513953147af3e0a3fdb48fa1bb9fa3734b64e221fc65e5222ab70837f02321b7225f487c6ef languageName: node linkType: hard -"@babel/helper-simple-access@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/helper-simple-access@npm:7.22.5" +"@babel/helper-skip-transparent-expression-wrappers@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/helper-skip-transparent-expression-wrappers@npm:7.27.1" dependencies: - "@babel/types": ^7.22.5 - checksum: fe9686714caf7d70aedb46c3cce090f8b915b206e09225f1e4dbc416786c2fdbbee40b38b23c268b7ccef749dd2db35f255338fb4f2444429874d900dede5ad2 + "@babel/traverse": ^7.27.1 + "@babel/types": ^7.27.1 + checksum: 4f380c5d0e0769fa6942a468b0c2d7c8f0c438f941aaa88f785f8752c103631d0904c7b4e76207a3b0e6588b2dec376595370d92ca8f8f1b422c14a69aa146d4 languageName: node linkType: hard -"@babel/helper-skip-transparent-expression-wrappers@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/helper-skip-transparent-expression-wrappers@npm:7.22.5" - dependencies: - "@babel/types": ^7.22.5 - checksum: 1012ef2295eb12dc073f2b9edf3425661e9b8432a3387e62a8bc27c42963f1f216ab3124228015c748770b2257b4f1fda882ca8fa34c0bf485e929ae5bc45244 - languageName: node - linkType: hard - -"@babel/helper-split-export-declaration@npm:^7.22.6": - version: 7.22.6 - resolution: "@babel/helper-split-export-declaration@npm:7.22.6" - dependencies: - "@babel/types": ^7.22.5 - checksum: e141cace583b19d9195f9c2b8e17a3ae913b7ee9b8120246d0f9ca349ca6f03cb2c001fd5ec57488c544347c0bb584afec66c936511e447fd20a360e591ac921 +"@babel/helper-string-parser@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/helper-string-parser@npm:7.27.1" + checksum: 0a8464adc4b39b138aedcb443b09f4005d86207d7126e5e079177e05c3116107d856ec08282b365e9a79a9872f40f4092a6127f8d74c8a01c1ef789dacfc25d6 languageName: node linkType: hard -"@babel/helper-string-parser@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/helper-string-parser@npm:7.22.5" - checksum: 836851ca5ec813077bbb303acc992d75a360267aa3b5de7134d220411c852a6f17de7c0d0b8c8dcc0f567f67874c00f4528672b2a4f1bc978a3ada64c8c78467 +"@babel/helper-validator-identifier@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/helper-validator-identifier@npm:7.27.1" + checksum: 3c7e8391e59d6c85baeefe9afb86432f2ab821c6232b00ea9082a51d3e7e95a2f3fb083d74dc1f49ac82cf238e1d2295dafcb001f7b0fab479f3f56af5eaaa47 languageName: node linkType: hard -"@babel/helper-validator-identifier@npm:^7.22.20": - version: 7.22.20 - resolution: "@babel/helper-validator-identifier@npm:7.22.20" - checksum: 136412784d9428266bcdd4d91c32bcf9ff0e8d25534a9d94b044f77fe76bc50f941a90319b05aafd1ec04f7d127cd57a179a3716009ff7f3412ef835ada95bdc +"@babel/helper-validator-option@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/helper-validator-option@npm:7.27.1" + checksum: db73e6a308092531c629ee5de7f0d04390835b21a263be2644276cb27da2384b64676cab9f22cd8d8dbd854c92b1d7d56fc8517cf0070c35d1c14a8c828b0903 languageName: node linkType: hard -"@babel/helper-validator-option@npm:^7.22.15": - version: 7.22.15 - resolution: "@babel/helper-validator-option@npm:7.22.15" - checksum: 68da52b1e10002a543161494c4bc0f4d0398c8fdf361d5f7f4272e95c45d5b32d974896d44f6a0ea7378c9204988879d73613ca683e13bd1304e46d25ff67a8d +"@babel/helper-wrap-function@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/helper-wrap-function@npm:7.27.1" + dependencies: + "@babel/template": ^7.27.1 + "@babel/traverse": ^7.27.1 + "@babel/types": ^7.27.1 + checksum: b0427765766494cb5455a188d4cdef5e6167f2835a8ed76f3c25fa3bbe2ec2a716588fa326c52fab0d184a9537200d76e48656e516580a914129d74528322821 languageName: node linkType: hard -"@babel/helper-wrap-function@npm:^7.22.20": - version: 7.22.20 - resolution: "@babel/helper-wrap-function@npm:7.22.20" +"@babel/helpers@npm:^7.27.6": + version: 7.27.6 + resolution: "@babel/helpers@npm:7.27.6" dependencies: - "@babel/helper-function-name": ^7.22.5 - "@babel/template": ^7.22.15 - "@babel/types": ^7.22.19 - checksum: 221ed9b5572612aeb571e4ce6a256f2dee85b3c9536f1dd5e611b0255e5f59a3d0ec392d8d46d4152149156a8109f92f20379b1d6d36abb613176e0e33f05fca + "@babel/template": ^7.27.2 + "@babel/types": ^7.27.6 + checksum: 12f96a5800ff677481dbc0a022c617303e945210cac4821ad5377a31201ffd8d9c4d00f039ed1487cf2a3d15868fb2d6cabecdb1aba334bd40a846f1938053a2 languageName: node linkType: hard -"@babel/helpers@npm:^7.12.5, @babel/helpers@npm:^7.23.0": - version: 7.23.1 - resolution: "@babel/helpers@npm:7.23.1" +"@babel/parser@npm:^7.27.2, @babel/parser@npm:^7.28.0": + version: 7.28.0 + resolution: "@babel/parser@npm:7.28.0" dependencies: - "@babel/template": ^7.22.15 - "@babel/traverse": ^7.23.0 - "@babel/types": ^7.23.0 - checksum: acfc345102045c24ea2a4d60e00dcf8220e215af3add4520e2167700661338e6a80bd56baf44bb764af05ec6621101c9afc315dc107e18c61fa6da8acbdbb893 + "@babel/types": ^7.28.0 + bin: + parser: ./bin/babel-parser.js + checksum: 718e4ce9b0914701d6f74af610d3e7d52b355ef1dcf34a7dedc5930e96579e387f04f96187e308e601828b900b8e4e66d2fe85023beba2ac46587023c45b01cf languageName: node linkType: hard -"@babel/highlight@npm:^7.22.13": - version: 7.22.20 - resolution: "@babel/highlight@npm:7.22.20" +"@babel/plugin-bugfix-firefox-class-in-computed-class-key@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-bugfix-firefox-class-in-computed-class-key@npm:7.27.1" dependencies: - "@babel/helper-validator-identifier": ^7.22.20 - chalk: ^2.4.2 - js-tokens: ^4.0.0 - checksum: 84bd034dca309a5e680083cd827a766780ca63cef37308404f17653d32366ea76262bd2364b2d38776232f2d01b649f26721417d507e8b4b6da3e4e739f6d134 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/traverse": ^7.27.1 + peerDependencies: + "@babel/core": ^7.0.0 + checksum: 72f24b9487e445fa61cf8be552aad394a648c2bb445c38d39d1df003186d9685b87dd8d388c950f438ea0ca44c82099d9c49252fb681c719cc72edf02bbe0304 languageName: node linkType: hard -"@babel/parser@npm:^7.12.7, @babel/parser@npm:^7.18.8, @babel/parser@npm:^7.22.15, @babel/parser@npm:^7.23.0": - version: 7.23.0 - resolution: "@babel/parser@npm:7.23.0" - bin: - parser: ./bin/babel-parser.js - checksum: 453fdf8b9e2c2b7d7b02139e0ce003d1af21947bbc03eb350fb248ee335c9b85e4ab41697ddbdd97079698de825a265e45a0846bb2ed47a2c7c1df833f42a354 +"@babel/plugin-bugfix-safari-class-field-initializer-scope@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-bugfix-safari-class-field-initializer-scope@npm:7.27.1" + dependencies: + "@babel/helper-plugin-utils": ^7.27.1 + peerDependencies: + "@babel/core": ^7.0.0 + checksum: eb7f4146dc01f1198ce559a90b077e58b951a07521ec414e3c7d4593bf6c4ab5c2af22242a7e9fec085e20299e0ba6ea97f44a45e84ab148141bf9eb959ad25e languageName: node linkType: hard -"@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@npm:^7.22.15": - version: 7.22.15 - resolution: "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@npm:7.22.15" +"@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0 - checksum: 8910ca21a7ec7c06f7b247d4b86c97c5aa15ef321518f44f6f490c5912fdf82c605aaa02b90892e375d82ccbedeadfdeadd922c1b836c9dd4c596871bf654753 + checksum: 621cfddfcc99a81e74f8b6f9101fd260b27500cb1a568e3ceae9cc8afe9aee45ac3bca3900a2b66c612b1a2366d29ef67d4df5a1c975be727eaad6906f98c2c6 languageName: node linkType: hard -"@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@npm:^7.22.15": - version: 7.22.15 - resolution: "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@npm:7.22.15" +"@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/helper-skip-transparent-expression-wrappers": ^7.22.5 - "@babel/plugin-transform-optional-chaining": ^7.22.15 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/helper-skip-transparent-expression-wrappers": ^7.27.1 + "@babel/plugin-transform-optional-chaining": ^7.27.1 peerDependencies: "@babel/core": ^7.13.0 - checksum: fbefedc0da014c37f1a50a8094ce7dbbf2181ae93243f23d6ecba2499b5b20196c2124d6a4dfe3e9e0125798e80593103e456352a4beb4e5c6f7c75efb80fdac + checksum: f07aa80272bd7a46b7ba11a4644da6c9b6a5a64e848dfaffdad6f02663adefd512e1aaebe664c4dd95f7ed4f80c872c7f8db8d8e34b47aae0930b412a28711a0 languageName: node linkType: hard -"@babel/plugin-proposal-object-rest-spread@npm:7.12.1": - version: 7.12.1 - resolution: "@babel/plugin-proposal-object-rest-spread@npm:7.12.1" +"@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.10.4 - "@babel/plugin-syntax-object-rest-spread": ^7.8.0 - "@babel/plugin-transform-parameters": ^7.12.1 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/traverse": ^7.27.1 peerDependencies: - "@babel/core": ^7.0.0-0 - checksum: 221a41630c9a7162bf0416c71695b3f7f38482078a1d0d3af7abdc4f07ea1c9feed890399158d56c1d0278c971fe6f565ce822e9351e4481f7d98e9ff735dced + "@babel/core": ^7.0.0 + checksum: 4d6792ccade2d6b9d5577b0a879ab22d05ac8a1206b1a636b6ffdb53a0c0bacaf0f7947e46de254f228ffd75456f4b95ccd82fdeaefc0b92d88af3c5991863ad languageName: node linkType: hard @@ -609,1721 +548,2190 @@ __metadata: languageName: node linkType: hard -"@babel/plugin-syntax-async-generators@npm:^7.8.4": - version: 7.8.4 - resolution: "@babel/plugin-syntax-async-generators@npm:7.8.4" +"@babel/plugin-syntax-dynamic-import@npm:^7.8.3": + version: 7.8.3 + resolution: "@babel/plugin-syntax-dynamic-import@npm:7.8.3" dependencies: "@babel/helper-plugin-utils": ^7.8.0 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 7ed1c1d9b9e5b64ef028ea5e755c0be2d4e5e4e3d6cf7df757b9a8c4cfa4193d268176d0f1f7fbecdda6fe722885c7fda681f480f3741d8a2d26854736f05367 + checksum: ce307af83cf433d4ec42932329fad25fa73138ab39c7436882ea28742e1c0066626d224e0ad2988724c82644e41601cef607b36194f695cb78a1fcdc959637bd languageName: node linkType: hard -"@babel/plugin-syntax-class-properties@npm:^7.12.13": - version: 7.12.13 - resolution: "@babel/plugin-syntax-class-properties@npm:7.12.13" +"@babel/plugin-syntax-import-assertions@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-syntax-import-assertions@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.12.13 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 24f34b196d6342f28d4bad303612d7ff566ab0a013ce89e775d98d6f832969462e7235f3e7eaf17678a533d4be0ba45d3ae34ab4e5a9dcbda5d98d49e5efa2fc + checksum: fb661d630808d67ecb85eabad25aac4e9696a20464bad4c4a6a0d3d40e4dc22557d47e9be3d591ec06429cf048cfe169b8891c373606344d51c4f3ac0f91d6d0 languageName: node linkType: hard -"@babel/plugin-syntax-class-static-block@npm:^7.14.5": - version: 7.14.5 - resolution: "@babel/plugin-syntax-class-static-block@npm:7.14.5" +"@babel/plugin-syntax-import-attributes@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-syntax-import-attributes@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.14.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 3e80814b5b6d4fe17826093918680a351c2d34398a914ce6e55d8083d72a9bdde4fbaf6a2dcea0e23a03de26dc2917ae3efd603d27099e2b98380345703bf948 + checksum: 97973982fff1bbf86b3d1df13380567042887c50e2ae13a400d02a8ff2c9742a60a75e279bfb73019e1cd9710f04be5e6ab81f896e6678dcfcec8b135e8896cf languageName: node linkType: hard -"@babel/plugin-syntax-dynamic-import@npm:^7.8.3": - version: 7.8.3 - resolution: "@babel/plugin-syntax-dynamic-import@npm:7.8.3" +"@babel/plugin-syntax-jsx@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-syntax-jsx@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.8.0 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: ce307af83cf433d4ec42932329fad25fa73138ab39c7436882ea28742e1c0066626d224e0ad2988724c82644e41601cef607b36194f695cb78a1fcdc959637bd + checksum: c6d1324cff286a369aa95d99b8abd21dd07821b5d3affd5fe7d6058c84cff9190743287826463ee57a7beecd10fa1e4bc99061df532ee14e188c1c8937b13e3a languageName: node linkType: hard -"@babel/plugin-syntax-export-namespace-from@npm:^7.8.3": - version: 7.8.3 - resolution: "@babel/plugin-syntax-export-namespace-from@npm:7.8.3" +"@babel/plugin-syntax-typescript@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-syntax-typescript@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.8.3 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 85740478be5b0de185228e7814451d74ab8ce0a26fcca7613955262a26e99e8e15e9da58f60c754b84515d4c679b590dbd3f2148f0f58025f4ae706f1c5a5d4a + checksum: 87836f7e32af624c2914c73cd6b9803cf324e07d43f61dbb973c6a86f75df725e12540d91fac7141c14b697aa9268fd064220998daced156e96ac3062d7afb41 languageName: node linkType: hard -"@babel/plugin-syntax-import-assertions@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-syntax-import-assertions@npm:7.22.5" +"@babel/plugin-syntax-unicode-sets-regex@npm:^7.18.6": + version: 7.18.6 + resolution: "@babel/plugin-syntax-unicode-sets-regex@npm:7.18.6" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-create-regexp-features-plugin": ^7.18.6 + "@babel/helper-plugin-utils": ^7.18.6 peerDependencies: - "@babel/core": ^7.0.0-0 - checksum: 2b8b5572db04a7bef1e6cd20debf447e4eef7cb012616f5eceb8fa3e23ce469b8f76ee74fd6d1e158ba17a8f58b0aec579d092fb67c5a30e83ccfbc5754916c1 + "@babel/core": ^7.0.0 + checksum: a651d700fe63ff0ddfd7186f4ebc24447ca734f114433139e3c027bc94a900d013cf1ef2e2db8430425ba542e39ae160c3b05f06b59fd4656273a3df97679e9c languageName: node linkType: hard -"@babel/plugin-syntax-import-attributes@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-syntax-import-attributes@npm:7.22.5" +"@babel/plugin-transform-arrow-functions@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-arrow-functions@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 197b3c5ea2a9649347f033342cb222ab47f4645633695205c0250c6bf2af29e643753b8bb24a2db39948bef08e7c540babfd365591eb57fc110cb30b425ffc47 + checksum: 62c2cc0ae2093336b1aa1376741c5ed245c0987d9e4b4c5313da4a38155509a7098b5acce582b6781cc0699381420010da2e3086353344abe0a6a0ec38961eb7 languageName: node linkType: hard -"@babel/plugin-syntax-import-meta@npm:^7.10.4": - version: 7.10.4 - resolution: "@babel/plugin-syntax-import-meta@npm:7.10.4" +"@babel/plugin-transform-async-generator-functions@npm:^7.28.0": + version: 7.28.0 + resolution: "@babel/plugin-transform-async-generator-functions@npm:7.28.0" dependencies: - "@babel/helper-plugin-utils": ^7.10.4 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/helper-remap-async-to-generator": ^7.27.1 + "@babel/traverse": ^7.28.0 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 166ac1125d10b9c0c430e4156249a13858c0366d38844883d75d27389621ebe651115cb2ceb6dc011534d5055719fa1727b59f39e1ab3ca97820eef3dcab5b9b + checksum: 174aaccd7a8386fd7f32240c3f65a93cf60dcc5f6a2123cfbff44c0d22b424cd41de3a0c6d136b6a2fa60a8ca01550c261677284cb18a0daeab70730b2265f1d languageName: node linkType: hard -"@babel/plugin-syntax-json-strings@npm:^7.8.3": - version: 7.8.3 - resolution: "@babel/plugin-syntax-json-strings@npm:7.8.3" +"@babel/plugin-transform-async-to-generator@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-async-to-generator@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.8.0 + "@babel/helper-module-imports": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/helper-remap-async-to-generator": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: bf5aea1f3188c9a507e16efe030efb996853ca3cadd6512c51db7233cc58f3ac89ff8c6bdfb01d30843b161cfe7d321e1bf28da82f7ab8d7e6bc5464666f354a + checksum: d79d7a7ae7d416f6a48200017d027a6ba94c09c7617eea8b4e9c803630f00094c1a4fc32bf20ce3282567824ce3fcbda51653aac4003c71ea4e681b331338979 languageName: node linkType: hard -"@babel/plugin-syntax-jsx@npm:7.12.1": - version: 7.12.1 - resolution: "@babel/plugin-syntax-jsx@npm:7.12.1" +"@babel/plugin-transform-block-scoped-functions@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-block-scoped-functions@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.10.4 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: d4b9b589c484b2e0856799770f060dff34c67b24d7f4526f66309a0e0e9cf388a5c1f2c0da329d1973cc87d1b2cede8f3dc8facfac59e785d6393a003bcdd0f9 + checksum: 7fb4988ca80cf1fc8345310d5edfe38e86b3a72a302675cdd09404d5064fe1d1fe1283ebe658ad2b71445ecef857bfb29a748064306b5f6c628e0084759c2201 languageName: node linkType: hard -"@babel/plugin-syntax-jsx@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-syntax-jsx@npm:7.22.5" +"@babel/plugin-transform-block-scoping@npm:^7.28.0": + version: 7.28.0 + resolution: "@babel/plugin-transform-block-scoping@npm:7.28.0" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 8829d30c2617ab31393d99cec2978e41f014f4ac6f01a1cecf4c4dd8320c3ec12fdc3ce121126b2d8d32f6887e99ca1a0bad53dedb1e6ad165640b92b24980ce + checksum: 6d740f9a386e5fbdffd9e7c5a8400bff8d54068241a78b8e71aba6f1f46eff0c4297902f5f1543bee1ed076ec88d0dc4ceed19e98a466802c14d3c20f178f712 languageName: node linkType: hard -"@babel/plugin-syntax-logical-assignment-operators@npm:^7.10.4": - version: 7.10.4 - resolution: "@babel/plugin-syntax-logical-assignment-operators@npm:7.10.4" +"@babel/plugin-transform-class-properties@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-class-properties@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.10.4 + "@babel/helper-create-class-features-plugin": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: aff33577037e34e515911255cdbb1fd39efee33658aa00b8a5fd3a4b903585112d037cce1cc9e4632f0487dc554486106b79ccd5ea63a2e00df4363f6d4ff886 + checksum: 475a6e5a9454912fe1bdc171941976ca10ea4e707675d671cdb5ce6b6761d84d1791ac61b6bca81a2e5f6430cb7b9d8e4b2392404110e69c28207a754e196294 languageName: node linkType: hard -"@babel/plugin-syntax-nullish-coalescing-operator@npm:^7.8.3": - version: 7.8.3 - resolution: "@babel/plugin-syntax-nullish-coalescing-operator@npm:7.8.3" +"@babel/plugin-transform-class-static-block@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-class-static-block@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.8.0 + "@babel/helper-create-class-features-plugin": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: - "@babel/core": ^7.0.0-0 - checksum: 87aca4918916020d1fedba54c0e232de408df2644a425d153be368313fdde40d96088feed6c4e5ab72aac89be5d07fef2ddf329a15109c5eb65df006bf2580d1 + "@babel/core": ^7.12.0 + checksum: 69688fe1641ae0ea025b916b8c2336e8b5643a5ec292e8f546ecd35d9d9d4bb301d738910822a79d867098cf687d550d92cd906ae4cda03c0f69b1ece2149a58 languageName: node linkType: hard -"@babel/plugin-syntax-numeric-separator@npm:^7.10.4": - version: 7.10.4 - resolution: "@babel/plugin-syntax-numeric-separator@npm:7.10.4" +"@babel/plugin-transform-classes@npm:^7.28.0": + version: 7.28.0 + resolution: "@babel/plugin-transform-classes@npm:7.28.0" dependencies: - "@babel/helper-plugin-utils": ^7.10.4 + "@babel/helper-annotate-as-pure": ^7.27.3 + "@babel/helper-compilation-targets": ^7.27.2 + "@babel/helper-globals": ^7.28.0 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/helper-replace-supers": ^7.27.1 + "@babel/traverse": ^7.28.0 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 01ec5547bd0497f76cc903ff4d6b02abc8c05f301c88d2622b6d834e33a5651aa7c7a3d80d8d57656a4588f7276eba357f6b7e006482f5b564b7a6488de493a1 + checksum: 0b47188046a4f1579123354ee30d08874b4b585d45128a3d492fa1cba7e26c8039d8c44d38d85f4eaa9b5a53064c66f032cfc35526c73c74a865a11edf3a0c28 languageName: node linkType: hard -"@babel/plugin-syntax-object-rest-spread@npm:7.8.3, @babel/plugin-syntax-object-rest-spread@npm:^7.8.0, @babel/plugin-syntax-object-rest-spread@npm:^7.8.3": - version: 7.8.3 - resolution: "@babel/plugin-syntax-object-rest-spread@npm:7.8.3" +"@babel/plugin-transform-computed-properties@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-computed-properties@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.8.0 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/template": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: fddcf581a57f77e80eb6b981b10658421bc321ba5f0a5b754118c6a92a5448f12a0c336f77b8abf734841e102e5126d69110a306eadb03ca3e1547cab31f5cbf + checksum: 48bd20f7d631b08c51155751bf75b698d4a22cca36f41c22921ab92e53039c9ec5c3544e5282e18692325ef85d2e4a18c27e12c62b5e20c26fb0c92447e35224 languageName: node linkType: hard -"@babel/plugin-syntax-optional-catch-binding@npm:^7.8.3": - version: 7.8.3 - resolution: "@babel/plugin-syntax-optional-catch-binding@npm:7.8.3" +"@babel/plugin-transform-destructuring@npm:^7.28.0": + version: 7.28.0 + resolution: "@babel/plugin-transform-destructuring@npm:7.28.0" dependencies: - "@babel/helper-plugin-utils": ^7.8.0 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/traverse": ^7.28.0 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 910d90e72bc90ea1ce698e89c1027fed8845212d5ab588e35ef91f13b93143845f94e2539d831dc8d8ededc14ec02f04f7bd6a8179edd43a326c784e7ed7f0b9 + checksum: 5b464d6a03c6eaa1327b60ffc1630ca977db0256938b34e281e65c81c965680e930a6bac043272942d6d4bbd7d1eddded0b7231779429ba51275e092e7367859 languageName: node linkType: hard -"@babel/plugin-syntax-optional-chaining@npm:^7.8.3": - version: 7.8.3 - resolution: "@babel/plugin-syntax-optional-chaining@npm:7.8.3" +"@babel/plugin-transform-dotall-regex@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-dotall-regex@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.8.0 + "@babel/helper-create-regexp-features-plugin": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: eef94d53a1453361553c1f98b68d17782861a04a392840341bc91780838dd4e695209c783631cf0de14c635758beafb6a3a65399846ffa4386bff90639347f30 + checksum: 2173e5b13f403538ffc6bd57b190cedf4caf320abc13a99e5b2721864e7148dbd3bd7c82d92377136af80432818f665fdd9a1fd33bc5549a4c91e24e5ce2413c languageName: node linkType: hard -"@babel/plugin-syntax-private-property-in-object@npm:^7.14.5": - version: 7.14.5 - resolution: "@babel/plugin-syntax-private-property-in-object@npm:7.14.5" +"@babel/plugin-transform-duplicate-keys@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-duplicate-keys@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.14.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: b317174783e6e96029b743ccff2a67d63d38756876e7e5d0ba53a322e38d9ca452c13354a57de1ad476b4c066dbae699e0ca157441da611117a47af88985ecda + checksum: ef2112d658338e3ff0827f39a53c0cfa211f1cbbe60363bca833a5269df389598ec965e7283600b46533c39cdca82307d0d69c0f518290ec5b00bb713044715b languageName: node linkType: hard -"@babel/plugin-syntax-top-level-await@npm:^7.14.5": - version: 7.14.5 - resolution: "@babel/plugin-syntax-top-level-await@npm:7.14.5" +"@babel/plugin-transform-duplicate-named-capturing-groups-regex@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-duplicate-named-capturing-groups-regex@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.14.5 + "@babel/helper-create-regexp-features-plugin": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: - "@babel/core": ^7.0.0-0 - checksum: bbd1a56b095be7820029b209677b194db9b1d26691fe999856462e66b25b281f031f3dfd91b1619e9dcf95bebe336211833b854d0fb8780d618e35667c2d0d7e + "@babel/core": ^7.0.0 + checksum: 2a109613535e6ac79240dced71429e988affd6a5b3d0cd0f563c8d6c208c51ce7bf2c300bc1150502376b26a51f279119b3358f1c0f2d2f8abca3bcd62e1ae46 languageName: node linkType: hard -"@babel/plugin-syntax-typescript@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-syntax-typescript@npm:7.22.5" +"@babel/plugin-transform-dynamic-import@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-dynamic-import@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 8ab7718fbb026d64da93681a57797d60326097fd7cb930380c8bffd9eb101689e90142c760a14b51e8e69c88a73ba3da956cb4520a3b0c65743aee5c71ef360a + checksum: 7a9fbc8d17148b7f11a1d1ca3990d2c2cd44bd08a45dcaf14f20a017721235b9044b20e6168b6940282bb1b48fb78e6afbdfb9dd9d82fde614e15baa7d579932 languageName: node linkType: hard -"@babel/plugin-syntax-unicode-sets-regex@npm:^7.18.6": - version: 7.18.6 - resolution: "@babel/plugin-syntax-unicode-sets-regex@npm:7.18.6" +"@babel/plugin-transform-explicit-resource-management@npm:^7.28.0": + version: 7.28.0 + resolution: "@babel/plugin-transform-explicit-resource-management@npm:7.28.0" dependencies: - "@babel/helper-create-regexp-features-plugin": ^7.18.6 - "@babel/helper-plugin-utils": ^7.18.6 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/plugin-transform-destructuring": ^7.28.0 peerDependencies: - "@babel/core": ^7.0.0 - checksum: a651d700fe63ff0ddfd7186f4ebc24447ca734f114433139e3c027bc94a900d013cf1ef2e2db8430425ba542e39ae160c3b05f06b59fd4656273a3df97679e9c + "@babel/core": ^7.0.0-0 + checksum: a44140097ed4854883c426613f4e8763237cd0fdab1c780514f4315f6c148d6b528d7a57fe6fdec4dbce28a21b70393ef3507b72dfec2e30bfc8d7db1ff19474 languageName: node linkType: hard -"@babel/plugin-transform-arrow-functions@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-arrow-functions@npm:7.22.5" +"@babel/plugin-transform-exponentiation-operator@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-exponentiation-operator@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 35abb6c57062802c7ce8bd96b2ef2883e3124370c688bbd67609f7d2453802fb73944df8808f893b6c67de978eb2bcf87bbfe325e46d6f39b5fcb09ece11d01a + checksum: 4ff4a0f30babc457a5ae8564deda209599627c2ce647284a0e8e66f65b44f6d968cf77761a4cc31b45b61693f0810479248c79e681681d8ccb39d0c52944c1fd languageName: node linkType: hard -"@babel/plugin-transform-async-generator-functions@npm:^7.22.15": - version: 7.22.15 - resolution: "@babel/plugin-transform-async-generator-functions@npm:7.22.15" +"@babel/plugin-transform-export-namespace-from@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-export-namespace-from@npm:7.27.1" dependencies: - "@babel/helper-environment-visitor": ^7.22.5 - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/helper-remap-async-to-generator": ^7.22.9 - "@babel/plugin-syntax-async-generators": ^7.8.4 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: fad98786b446ce63bde0d14a221e2617eef5a7bbca62b49d96f16ab5e1694521234cfba6145b830fbf9af16d60a8a3dbf148e8694830bd91796fe333b0599e73 + checksum: 85082923eca317094f08f4953d8ea2a6558b3117826c0b740676983902b7236df1f4213ad844cb38c2dae104753dbe8f1cc51f01567835d476d32f5f544a4385 languageName: node linkType: hard -"@babel/plugin-transform-async-to-generator@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-async-to-generator@npm:7.22.5" +"@babel/plugin-transform-for-of@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-for-of@npm:7.27.1" dependencies: - "@babel/helper-module-imports": ^7.22.5 - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/helper-remap-async-to-generator": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/helper-skip-transparent-expression-wrappers": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: b95f23f99dcb379a9f0a1c2a3bbea3f8dc0e1b16dc1ac8b484fe378370169290a7a63d520959a9ba1232837cf74a80e23f6facbe14fd42a3cda6d3c2d7168e62 + checksum: c9224e08de5d80b2c834383d4359aa9e519db434291711434dd996a4f86b7b664ad67b45d65459b7ec11fa582e3e11a3c769b8a8ca71594bdd4e2f0503f84126 languageName: node linkType: hard -"@babel/plugin-transform-block-scoped-functions@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-block-scoped-functions@npm:7.22.5" +"@babel/plugin-transform-function-name@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-function-name@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-compilation-targets": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/traverse": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 416b1341858e8ca4e524dee66044735956ced5f478b2c3b9bc11ec2285b0c25d7dbb96d79887169eb938084c95d0a89338c8b2fe70d473bd9dc92e5d9db1732c + checksum: 26a2a183c3c52a96495967420a64afc5a09f743a230272a131668abf23001e393afa6371e6f8e6c60f4182bea210ed31d1caf866452d91009c1daac345a52f23 languageName: node linkType: hard -"@babel/plugin-transform-block-scoping@npm:^7.22.15": - version: 7.23.0 - resolution: "@babel/plugin-transform-block-scoping@npm:7.23.0" +"@babel/plugin-transform-json-strings@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-json-strings@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 0cfe925cc3b5a3ad407e2253fab3ceeaa117a4b291c9cb245578880872999bca91bd83ffa0128ae9ca356330702e1ef1dcb26804f28d2cef678239caf629f73e + checksum: 2c05a02f63b49f47069271b3405a66c3c8038de5b995b0700b1bd9a5e2bb3e67abd01e4604629302a521f4d8122a4233944aefa16559fd4373d256cc5d3da57f languageName: node linkType: hard -"@babel/plugin-transform-class-properties@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-class-properties@npm:7.22.5" +"@babel/plugin-transform-literals@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-literals@npm:7.27.1" dependencies: - "@babel/helper-create-class-features-plugin": ^7.22.5 - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: b830152dfc2ff2f647f0abe76e6251babdfbef54d18c4b2c73a6bf76b1a00050a5d998dac80dc901a48514e95604324943a9dd39317073fe0928b559e0e0c579 + checksum: 0a76d12ab19f32dd139964aea7da48cecdb7de0b75e207e576f0f700121fe92367d788f328bf4fb44b8261a0f605c97b44e62ae61cddbb67b14e94c88b411f95 languageName: node linkType: hard -"@babel/plugin-transform-class-static-block@npm:^7.22.11": - version: 7.22.11 - resolution: "@babel/plugin-transform-class-static-block@npm:7.22.11" +"@babel/plugin-transform-logical-assignment-operators@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-logical-assignment-operators@npm:7.27.1" dependencies: - "@babel/helper-create-class-features-plugin": ^7.22.11 - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/plugin-syntax-class-static-block": ^7.14.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: - "@babel/core": ^7.12.0 - checksum: 69f040506fad66f1c6918d288d0e0edbc5c8a07c8b4462c1184ad2f9f08995d68b057126c213871c0853ae0c72afc60ec87492049dfacb20902e32346a448bcb + "@babel/core": ^7.0.0-0 + checksum: 2757955d81d65cc4701c17b83720745f6858f7a1d1d58117e379c204f47adbeb066b778596b6168bdbf4a22c229aab595d79a9abc261d0c6bfd62d4419466e73 languageName: node linkType: hard -"@babel/plugin-transform-classes@npm:^7.22.15": - version: 7.22.15 - resolution: "@babel/plugin-transform-classes@npm:7.22.15" +"@babel/plugin-transform-member-expression-literals@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-member-expression-literals@npm:7.27.1" dependencies: - "@babel/helper-annotate-as-pure": ^7.22.5 - "@babel/helper-compilation-targets": ^7.22.15 - "@babel/helper-environment-visitor": ^7.22.5 - "@babel/helper-function-name": ^7.22.5 - "@babel/helper-optimise-call-expression": ^7.22.5 - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/helper-replace-supers": ^7.22.9 - "@babel/helper-split-export-declaration": ^7.22.6 - globals: ^11.1.0 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: d3f4d0c107dd8a3557ea3575cc777fab27efa92958b41e4a9822f7499725c1f554beae58855de16ddec0a7b694e45f59a26cea8fbde4275563f72f09c6e039a0 + checksum: 804121430a6dcd431e6ffe99c6d1fbbc44b43478113b79c677629e7f877b4f78a06b69c6bfb2747fd84ee91879fe2eb32e4620b53124603086cf5b727593ebe8 languageName: node linkType: hard -"@babel/plugin-transform-computed-properties@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-computed-properties@npm:7.22.5" +"@babel/plugin-transform-modules-amd@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-modules-amd@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/template": ^7.22.5 + "@babel/helper-module-transforms": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: c2a77a0f94ec71efbc569109ec14ea2aa925b333289272ced8b33c6108bdbb02caf01830ffc7e49486b62dec51911924d13f3a76f1149f40daace1898009e131 + checksum: 8bb36d448e438d5d30f4faf19120e8c18aa87730269e65d805bf6032824d175ed738057cc392c2c8a650028f1ae0f346cad8d6b723f31a037b586e2092a7be18 languageName: node linkType: hard -"@babel/plugin-transform-destructuring@npm:^7.22.15": - version: 7.23.0 - resolution: "@babel/plugin-transform-destructuring@npm:7.23.0" +"@babel/plugin-transform-modules-commonjs@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-modules-commonjs@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-module-transforms": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: cd6dd454ccc2766be551e4f8a04b1acc2aa539fa19e5c7501c56cc2f8cc921dd41a7ffb78455b4c4b2f954fcab8ca4561ba7c9c7bd5af9f19465243603d18cc3 + checksum: bc45c1beff9b145c982bd6a614af338893d38bce18a9df7d658c9084e0d8114b286dcd0e015132ae7b15dd966153cb13321e4800df9766d0ddd892d22bf09d2a languageName: node linkType: hard -"@babel/plugin-transform-dotall-regex@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-dotall-regex@npm:7.22.5" +"@babel/plugin-transform-modules-systemjs@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-modules-systemjs@npm:7.27.1" dependencies: - "@babel/helper-create-regexp-features-plugin": ^7.22.5 - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-module-transforms": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/helper-validator-identifier": ^7.27.1 + "@babel/traverse": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 409b658d11e3082c8f69e9cdef2d96e4d6d11256f005772425fb230cc48fd05945edbfbcb709dab293a1a2f01f9c8a5bb7b4131e632b23264039d9f95864b453 + checksum: 7c17a8973676c18525d87f277944616596f1b154cc2b9263bfd78ecdbf5f4288ec46c7f58017321ca3e3d6dfeb96875467b95311a39719b475d42a157525d87f languageName: node linkType: hard -"@babel/plugin-transform-duplicate-keys@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-duplicate-keys@npm:7.22.5" +"@babel/plugin-transform-modules-umd@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-modules-umd@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-module-transforms": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: bb1280fbabaab6fab2ede585df34900712698210a3bd413f4df5bae6d8c24be36b496c92722ae676a7a67d060a4624f4d6c23b923485f906bfba8773c69f55b4 + checksum: b007dd89231f2eeccf1c71a85629bcb692573303977a4b1c5f19a835ea6b5142c18ef07849bc6d752b874a11bc0ddf3c67468b77c8ee8310290b688a4f01ef31 languageName: node linkType: hard -"@babel/plugin-transform-dynamic-import@npm:^7.22.11": - version: 7.22.11 - resolution: "@babel/plugin-transform-dynamic-import@npm:7.22.11" +"@babel/plugin-transform-named-capturing-groups-regex@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-named-capturing-groups-regex@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/plugin-syntax-dynamic-import": ^7.8.3 + "@babel/helper-create-regexp-features-plugin": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: - "@babel/core": ^7.0.0-0 - checksum: 78fc9c532210bf9e8f231747f542318568ac360ee6c27e80853962c984283c73da3f8f8aebe83c2096090a435b356b092ed85de617a156cbe0729d847632be45 + "@babel/core": ^7.0.0 + checksum: a711c92d9753df26cefc1792481e5cbff4fe4f32b383d76b25e36fa865d8023b1b9aa6338cf18f5c0e864c71a7fbe8115e840872ccd61a914d9953849c68de7d languageName: node linkType: hard -"@babel/plugin-transform-exponentiation-operator@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-exponentiation-operator@npm:7.22.5" +"@babel/plugin-transform-new-target@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-new-target@npm:7.27.1" dependencies: - "@babel/helper-builder-binary-assignment-operator-visitor": ^7.22.5 - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: f2d660c1b1d51ad5fec1cd5ad426a52187204068c4158f8c4aa977b31535c61b66898d532603eef21c15756827be8277f724c869b888d560f26d7fe848bb5eae + checksum: 32c8078d843bda001244509442d68fd3af088d7348ba883f45c262b2c817a27ffc553b0d78e7f7a763271b2ece7fac56151baad7a91fb21f5bb1d2f38e5acad7 languageName: node linkType: hard -"@babel/plugin-transform-export-namespace-from@npm:^7.22.11": - version: 7.22.11 - resolution: "@babel/plugin-transform-export-namespace-from@npm:7.22.11" +"@babel/plugin-transform-nullish-coalescing-operator@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-nullish-coalescing-operator@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/plugin-syntax-export-namespace-from": ^7.8.3 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 73af5883a321ed56a4bfd43c8a7de0164faebe619287706896fc6ee2f7a4e69042adaa1338c0b8b4bdb9f7e5fdceb016fb1d40694cb43ca3b8827429e8aac4bf + checksum: 1c6b3730748782d2178cc30f5cc37be7d7666148260f3f2dfc43999908bdd319bdfebaaf19cf04ac1f9dee0f7081093d3fa730cda5ae1b34bcd73ce406a78be7 languageName: node linkType: hard -"@babel/plugin-transform-for-of@npm:^7.22.15": - version: 7.22.15 - resolution: "@babel/plugin-transform-for-of@npm:7.22.15" +"@babel/plugin-transform-numeric-separator@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-numeric-separator@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: f395ae7bce31e14961460f56cf751b5d6e37dd27d7df5b1f4e49fec1c11b6f9cf71991c7ffbe6549878591e87df0d66af798cf26edfa4bfa6b4c3dba1fb2f73a + checksum: 049b958911de86d32408cd78017940a207e49c054ae9534ab53a32a57122cc592c0aae3c166d6f29bd1a7d75cc779d71883582dd76cb28b2fbb493e842d8ffca languageName: node linkType: hard -"@babel/plugin-transform-function-name@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-function-name@npm:7.22.5" +"@babel/plugin-transform-object-rest-spread@npm:^7.28.0": + version: 7.28.0 + resolution: "@babel/plugin-transform-object-rest-spread@npm:7.28.0" dependencies: - "@babel/helper-compilation-targets": ^7.22.5 - "@babel/helper-function-name": ^7.22.5 - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-compilation-targets": ^7.27.2 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/plugin-transform-destructuring": ^7.28.0 + "@babel/plugin-transform-parameters": ^7.27.7 + "@babel/traverse": ^7.28.0 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: cff3b876357999cb8ae30e439c3ec6b0491a53b0aa6f722920a4675a6dd5b53af97a833051df4b34791fe5b3dd326ccf769d5c8e45b322aa50ee11a660b17845 + checksum: 7c32c988b4b040d0091d0210b6b946249571858b2f33f3a5105f41c28ee0b8440a9dfb2aa46f3ae0d3014f86ddf16aee9a0cbf4229daf8e013235352b8f31fc9 languageName: node linkType: hard -"@babel/plugin-transform-json-strings@npm:^7.22.11": - version: 7.22.11 - resolution: "@babel/plugin-transform-json-strings@npm:7.22.11" +"@babel/plugin-transform-object-super@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-object-super@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/plugin-syntax-json-strings": ^7.8.3 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/helper-replace-supers": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 50665e5979e66358c50e90a26db53c55917f78175127ac2fa05c7888d156d418ffb930ec0a109353db0a7c5f57c756ce01bfc9825d24cbfd2b3ec453f2ed8cba + checksum: 46b819cb9a6cd3cfefe42d07875fee414f18d5e66040366ae856116db560ad4e16f3899a0a7fddd6773e0d1458444f94b208b67c0e3b6977a27ea17a5c13dbf6 languageName: node linkType: hard -"@babel/plugin-transform-literals@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-literals@npm:7.22.5" +"@babel/plugin-transform-optional-catch-binding@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-optional-catch-binding@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: ec37cc2ffb32667af935ab32fe28f00920ec8a1eb999aa6dc6602f2bebd8ba205a558aeedcdccdebf334381d5c57106c61f52332045730393e73410892a9735b + checksum: f4356b04cf21a98480f9788ea50f1f13ee88e89bb6393ba4b84d1f39a4a84c7928c9a4328e8f4c5b6deb218da68a8fd17bf4f46faec7653ddc20ffaaa5ba49f4 languageName: node linkType: hard -"@babel/plugin-transform-logical-assignment-operators@npm:^7.22.11": - version: 7.22.11 - resolution: "@babel/plugin-transform-logical-assignment-operators@npm:7.22.11" +"@babel/plugin-transform-optional-chaining@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-optional-chaining@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/plugin-syntax-logical-assignment-operators": ^7.10.4 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/helper-skip-transparent-expression-wrappers": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: c664e9798e85afa7f92f07b867682dee7392046181d82f5d21bae6f2ca26dfe9c8375cdc52b7483c3fc09a983c1989f60eff9fbc4f373b0c0a74090553d05739 + checksum: c4428d31f182d724db6f10575669aad3dbccceb0dea26aa9071fa89f11b3456278da3097fcc78937639a13c105a82cd452dc0218ce51abdbcf7626a013b928a5 languageName: node linkType: hard -"@babel/plugin-transform-member-expression-literals@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-member-expression-literals@npm:7.22.5" +"@babel/plugin-transform-parameters@npm:^7.27.7": + version: 7.27.7 + resolution: "@babel/plugin-transform-parameters@npm:7.27.7" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: ec4b0e07915ddd4fda0142fd104ee61015c208608a84cfa13643a95d18760b1dc1ceb6c6e0548898b8c49e5959a994e46367260176dbabc4467f729b21868504 + checksum: d51f195e1d6ac5d9fce583e9a70a5bfe403e62386e5eb06db9fbc6533f895a98ff7e7c3dcaa311a8e6fa7a9794466e81cdabcba6af9f59d787fb767bfe7868b4 languageName: node linkType: hard -"@babel/plugin-transform-modules-amd@npm:^7.22.5": - version: 7.23.0 - resolution: "@babel/plugin-transform-modules-amd@npm:7.23.0" +"@babel/plugin-transform-private-methods@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-private-methods@npm:7.27.1" dependencies: - "@babel/helper-module-transforms": ^7.23.0 - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-create-class-features-plugin": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 5d92875170a37b8282d4bcd805f55829b8fab0f9c8d08b53d32a7a0bfdc62b868e489b52d329ae768ecafc0c993eed0ad7a387baa673ac33211390a9f833ab5d + checksum: c76f8f6056946466116e67eb9d8014a2d748ade2062636ab82045c1dac9c233aff10e597777bc5af6f26428beb845ceb41b95007abef7d0484da95789da56662 languageName: node linkType: hard -"@babel/plugin-transform-modules-commonjs@npm:^7.22.15, @babel/plugin-transform-modules-commonjs@npm:^7.23.0": - version: 7.23.0 - resolution: "@babel/plugin-transform-modules-commonjs@npm:7.23.0" +"@babel/plugin-transform-private-property-in-object@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-private-property-in-object@npm:7.27.1" dependencies: - "@babel/helper-module-transforms": ^7.23.0 - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/helper-simple-access": ^7.22.5 + "@babel/helper-annotate-as-pure": ^7.27.1 + "@babel/helper-create-class-features-plugin": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 7fb25997194053e167c4207c319ff05362392da841bd9f42ddb3caf9c8798a5d203bd926d23ddf5830fdf05eddc82c2810f40d1287e3a4f80b07eff13d1024b5 + checksum: af539af1bd423aa46b9da83d649be716494ca80783841f47094b6741fa24e11141446027fd152ddff791dede9d4a76d0d5eb467402a2e584d7f5ea90e2673c7e languageName: node linkType: hard -"@babel/plugin-transform-modules-systemjs@npm:^7.22.11": - version: 7.23.0 - resolution: "@babel/plugin-transform-modules-systemjs@npm:7.23.0" +"@babel/plugin-transform-property-literals@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-property-literals@npm:7.27.1" dependencies: - "@babel/helper-hoist-variables": ^7.22.5 - "@babel/helper-module-transforms": ^7.23.0 - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/helper-validator-identifier": ^7.22.20 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 2d481458b22605046badea2317d5cc5c94ac3031c2293e34c96f02063f5b02af0979c4da6a8fbc67cc249541575dc9c6d710db6b919ede70b7337a22d9fd57a7 + checksum: 7caec27d5ed8870895c9faf4f71def72745d69da0d8e77903146a4e135fd7bed5778f5f9cebb36c5fba86338e6194dd67a08c033fc84b4299b7eceab6d9630cb languageName: node linkType: hard -"@babel/plugin-transform-modules-umd@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-modules-umd@npm:7.22.5" +"@babel/plugin-transform-react-constant-elements@npm:^7.21.3": + version: 7.27.1 + resolution: "@babel/plugin-transform-react-constant-elements@npm:7.27.1" dependencies: - "@babel/helper-module-transforms": ^7.22.5 - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 46622834c54c551b231963b867adbc80854881b3e516ff29984a8da989bd81665bd70e8cba6710345248e97166689310f544aee1a5773e262845a8f1b3e5b8b4 + checksum: 8372cf17ed551cd2e3da4f32a211881265692a17ad4c4fd40a8adcb89316d147db54f023630022ad7ec7474c4108647f67e3a62db43e515246a7574dcb5eeefe languageName: node linkType: hard -"@babel/plugin-transform-named-capturing-groups-regex@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-named-capturing-groups-regex@npm:7.22.5" +"@babel/plugin-transform-react-display-name@npm:^7.27.1": + version: 7.28.0 + resolution: "@babel/plugin-transform-react-display-name@npm:7.28.0" dependencies: - "@babel/helper-create-regexp-features-plugin": ^7.22.5 - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: - "@babel/core": ^7.0.0 - checksum: 3ee564ddee620c035b928fdc942c5d17e9c4b98329b76f9cefac65c111135d925eb94ed324064cd7556d4f5123beec79abea1d4b97d1c8a2a5c748887a2eb623 + "@babel/core": ^7.0.0-0 + checksum: 268b1a9192974439d17949e170b01cac2a2aa003c844e2fe3b8361146f42f66487178cffdfa8ce862aa9e6c814bc37f879a70300cb3f067815d15fa6aad04e6d languageName: node linkType: hard -"@babel/plugin-transform-new-target@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-new-target@npm:7.22.5" +"@babel/plugin-transform-react-jsx-development@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-react-jsx-development@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/plugin-transform-react-jsx": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 6b72112773487a881a1d6ffa680afde08bad699252020e86122180ee7a88854d5da3f15d9bca3331cf2e025df045604494a8208a2e63b486266b07c14e2ffbf3 + checksum: b88865d5b8c018992f2332da939faa15c4d4a864c9435a5937beaff3fe43781432cc42e0a5d5631098e0bd4066fc33f5fa72203b388b074c3545fe7aaa21e474 languageName: node linkType: hard -"@babel/plugin-transform-nullish-coalescing-operator@npm:^7.22.11": - version: 7.22.11 - resolution: "@babel/plugin-transform-nullish-coalescing-operator@npm:7.22.11" +"@babel/plugin-transform-react-jsx@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-react-jsx@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/plugin-syntax-nullish-coalescing-operator": ^7.8.3 + "@babel/helper-annotate-as-pure": ^7.27.1 + "@babel/helper-module-imports": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/plugin-syntax-jsx": ^7.27.1 + "@babel/types": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 167babecc8b8fe70796a7b7d34af667ebbf43da166c21689502e5e8cc93180b7a85979c77c9f64b7cce431b36718bd0a6df9e5e0ffea4ae22afb22cfef886372 + checksum: 960d36e5d11ba68e4fbf1e2b935c153cb6ea7b0004f838aaee8baf7de30462b8f0562743a39ce3c370cc70b8f79d3c549104a415a615b2b0055b71fd025df0f3 languageName: node linkType: hard -"@babel/plugin-transform-numeric-separator@npm:^7.22.11": - version: 7.22.11 - resolution: "@babel/plugin-transform-numeric-separator@npm:7.22.11" +"@babel/plugin-transform-react-pure-annotations@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-react-pure-annotations@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/plugin-syntax-numeric-separator": ^7.10.4 + "@babel/helper-annotate-as-pure": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: af064d06a4a041767ec396a5f258103f64785df290e038bba9f0ef454e6c914f2ac45d862bbdad8fac2c7ad47fa4e95356f29053c60c100a0160b02a995fe2a3 + checksum: a6f591c5e85a1ab0685d4a25afe591fe8d11dc0b73c677cf9560ff8d540d036a1cce9efcb729fc9092def4d854dc304ffdc063a89a9247900b69c516bf971a4c languageName: node linkType: hard -"@babel/plugin-transform-object-rest-spread@npm:^7.22.15": - version: 7.22.15 - resolution: "@babel/plugin-transform-object-rest-spread@npm:7.22.15" +"@babel/plugin-transform-regenerator@npm:^7.28.0": + version: 7.28.1 + resolution: "@babel/plugin-transform-regenerator@npm:7.28.1" dependencies: - "@babel/compat-data": ^7.22.9 - "@babel/helper-compilation-targets": ^7.22.15 - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/plugin-syntax-object-rest-spread": ^7.8.3 - "@babel/plugin-transform-parameters": ^7.22.15 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 62197a6f12289c1c1bd57f3bed9f0f765ca32390bfe91e0b5561dd94dd9770f4480c4162dec98da094bc0ba99d2c2ebba68de47c019454041b0b7a68ba2ec66d + checksum: c0bc0123ce2227c5074c7c17d6b72b558f0b38360aa180751c897086912f5e17e18855d361ac29f542343ad30ee128b937398282dc9a12c795fa8227954e48ea languageName: node linkType: hard -"@babel/plugin-transform-object-super@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-object-super@npm:7.22.5" +"@babel/plugin-transform-regexp-modifiers@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-regexp-modifiers@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/helper-replace-supers": ^7.22.5 + "@babel/helper-create-regexp-features-plugin": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: - "@babel/core": ^7.0.0-0 - checksum: b71887877d74cb64dbccb5c0324fa67e31171e6a5311991f626650e44a4083e5436a1eaa89da78c0474fb095d4ec322d63ee778b202d33aa2e4194e1ed8e62d7 + "@babel/core": ^7.0.0 + checksum: f6cb385fe0e798bff7e9b20cf5912bf40e180895ff3610b1ccdce260f3c20daaebb3a99dc087c8168a99151cd3e16b94f4689fd5a4b01cf1834b45c133e620b2 languageName: node linkType: hard -"@babel/plugin-transform-optional-catch-binding@npm:^7.22.11": - version: 7.22.11 - resolution: "@babel/plugin-transform-optional-catch-binding@npm:7.22.11" +"@babel/plugin-transform-reserved-words@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-reserved-words@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/plugin-syntax-optional-catch-binding": ^7.8.3 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: f17abd90e1de67c84d63afea29c8021c74abb2794d3a6eeafb0bbe7372d3db32aefca386e392116ec63884537a4a2815d090d26264d259bacc08f6e3ed05294c + checksum: dea0b66742d2863b369c06c053e11e15ba785892ea19cccf7aef3c1bdaa38b6ab082e19984c5ea7810d275d9445c5400fcc385ad71ce707ed9256fadb102af3b languageName: node linkType: hard -"@babel/plugin-transform-optional-chaining@npm:^7.22.15": - version: 7.23.0 - resolution: "@babel/plugin-transform-optional-chaining@npm:7.23.0" +"@babel/plugin-transform-runtime@npm:^7.25.9": + version: 7.28.0 + resolution: "@babel/plugin-transform-runtime@npm:7.28.0" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/helper-skip-transparent-expression-wrappers": ^7.22.5 - "@babel/plugin-syntax-optional-chaining": ^7.8.3 + "@babel/helper-module-imports": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 + babel-plugin-polyfill-corejs2: ^0.4.14 + babel-plugin-polyfill-corejs3: ^0.13.0 + babel-plugin-polyfill-regenerator: ^0.6.5 + semver: ^6.3.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: f702634f2b97e5260dbec0d4bde05ccb6f4d96d7bfa946481aeacfa205ca846cb6e096a38312f9d51fdbdac1f258f211138c5f7075952e46a5bf8574de6a1329 + checksum: 8d324eb312636efe706917a5d44f867538654453c9bf4efd34b0dbd712c6d80e604092b98acbfcb318f42bec707b590c28ae95c659ff359a64a4ccb7621dc400 languageName: node linkType: hard -"@babel/plugin-transform-parameters@npm:^7.12.1, @babel/plugin-transform-parameters@npm:^7.22.15": - version: 7.22.15 - resolution: "@babel/plugin-transform-parameters@npm:7.22.15" +"@babel/plugin-transform-shorthand-properties@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-shorthand-properties@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 541188bb7d1876cad87687b5c7daf90f63d8208ae83df24acb1e2b05020ad1c78786b2723ca4054a83fcb74fb6509f30c4cacc5b538ee684224261ad5fb047c1 + checksum: fbba6e2aef0b69681acb68202aa249c0598e470cc0853d7ff5bd0171fd6a7ec31d77cfabcce9df6360fc8349eded7e4a65218c32551bd3fc0caaa1ac899ac6d4 languageName: node linkType: hard -"@babel/plugin-transform-private-methods@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-private-methods@npm:7.22.5" +"@babel/plugin-transform-spread@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-spread@npm:7.27.1" dependencies: - "@babel/helper-create-class-features-plugin": ^7.22.5 - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/helper-skip-transparent-expression-wrappers": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 321479b4fcb6d3b3ef622ab22fd24001e43d46e680e8e41324c033d5810c84646e470f81b44cbcbef5c22e99030784f7cac92f1829974da7a47a60a7139082c3 + checksum: 58b08085ee9c29955ac3b68d61c1a79728d44d19a69cb5eb669794aeaf54c57c6647af7b979c1297e81ede3d08b3ddcb1936ef39a533f28ff3e399a9be54dab1 languageName: node linkType: hard -"@babel/plugin-transform-private-property-in-object@npm:^7.22.11": - version: 7.22.11 - resolution: "@babel/plugin-transform-private-property-in-object@npm:7.22.11" +"@babel/plugin-transform-sticky-regex@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-sticky-regex@npm:7.27.1" dependencies: - "@babel/helper-annotate-as-pure": ^7.22.5 - "@babel/helper-create-class-features-plugin": ^7.22.11 - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/plugin-syntax-private-property-in-object": ^7.14.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 4d029d84901e53c46dead7a46e2990a7bc62470f4e4ca58a0d063394f86652fd58fe4eea1eb941da3669cd536b559b9d058b342b59300026346b7a2a51badac8 + checksum: e1414a502efba92c7974681767e365a8cda6c5e9e5f33472a9eaa0ce2e75cea0a9bef881ff8dda37c7810ad902f98d3c00ead92a3ac3b73a79d011df85b5a189 languageName: node linkType: hard -"@babel/plugin-transform-property-literals@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-property-literals@npm:7.22.5" +"@babel/plugin-transform-template-literals@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-template-literals@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 796176a3176106f77fcb8cd04eb34a8475ce82d6d03a88db089531b8f0453a2fb8b0c6ec9a52c27948bc0ea478becec449893741fc546dfc3930ab927e3f9f2e + checksum: 93aad782503b691faef7c0893372d5243df3219b07f1f22cfc32c104af6a2e7acd6102c128439eab15336d048f1b214ca134b87b0630d8cd568bf447f78b25ce languageName: node linkType: hard -"@babel/plugin-transform-react-constant-elements@npm:^7.18.12": - version: 7.22.5 - resolution: "@babel/plugin-transform-react-constant-elements@npm:7.22.5" +"@babel/plugin-transform-typeof-symbol@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-typeof-symbol@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 596db90e37174dd703f4859fef3c86156a7c8564d8351168ac6fdca79c912ef8b8746ae04516ac3909d2cc750702d58d451badacb3c54ea998938ad05d99f9d2 + checksum: ed8048c8de72c60969a64cf2273cc6d9275d8fa8db9bd25a1268273a00fb9cbd79931140311411bda1443aa56cb3961fb911d1795abacde7f0482f1d8fdf0356 languageName: node linkType: hard -"@babel/plugin-transform-react-display-name@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-react-display-name@npm:7.22.5" +"@babel/plugin-transform-typescript@npm:^7.27.1": + version: 7.28.0 + resolution: "@babel/plugin-transform-typescript@npm:7.28.0" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-annotate-as-pure": ^7.27.3 + "@babel/helper-create-class-features-plugin": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/helper-skip-transparent-expression-wrappers": ^7.27.1 + "@babel/plugin-syntax-typescript": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: a12bfd1e4e93055efca3ace3c34722571bda59d9740dca364d225d9c6e3ca874f134694d21715c42cc63d79efd46db9665bd4a022998767f9245f1e29d5d204d + checksum: 14c1024bcd57fcd469d90cf0c15c3cd4e771e2eb2cd9afee3aa79b59c8ed103654f7c5c71cdb3bfe31c1d0cb08bfad8c80f5aa1d24b4b454bd21301d5925533d languageName: node linkType: hard -"@babel/plugin-transform-react-jsx-development@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-react-jsx-development@npm:7.22.5" +"@babel/plugin-transform-unicode-escapes@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-unicode-escapes@npm:7.27.1" dependencies: - "@babel/plugin-transform-react-jsx": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 36bc3ff0b96bb0ef4723070a50cfdf2e72cfd903a59eba448f9fe92fea47574d6f22efd99364413719e1f3fb3c51b6c9b2990b87af088f8486a84b2a5f9e4560 + checksum: d817154bc10758ddd85b716e0bc1af1a1091e088400289ab6b78a1a4d609907ce3d2f1fd51a6fd0e0c8ecbb5f8e3aab4957e0747776d132d2379e85c3ef0520a languageName: node linkType: hard -"@babel/plugin-transform-react-jsx@npm:^7.22.15, @babel/plugin-transform-react-jsx@npm:^7.22.5": - version: 7.22.15 - resolution: "@babel/plugin-transform-react-jsx@npm:7.22.15" +"@babel/plugin-transform-unicode-property-regex@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-unicode-property-regex@npm:7.27.1" dependencies: - "@babel/helper-annotate-as-pure": ^7.22.5 - "@babel/helper-module-imports": ^7.22.15 - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/plugin-syntax-jsx": ^7.22.5 - "@babel/types": ^7.22.15 + "@babel/helper-create-regexp-features-plugin": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 3899054e89550c3a0ef041af7c47ee266e2e934f498ee80fefeda778a6aa177b48aa8b4d2a8bf5848de977fec564571699ab952d9fa089c4c19b45ddb121df09 + checksum: 5d99c89537d1ebaac3f526c04b162cf95a47d363d4829f78c6701a2c06ab78a48da66a94f853f85f44a3d72153410ba923e072bed4b7166fa097f503eb14131d languageName: node linkType: hard -"@babel/plugin-transform-react-pure-annotations@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-react-pure-annotations@npm:7.22.5" +"@babel/plugin-transform-unicode-regex@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-unicode-regex@npm:7.27.1" dependencies: - "@babel/helper-annotate-as-pure": ^7.22.5 - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-create-regexp-features-plugin": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 092021c4f404e267002099ec20b3f12dd730cb90b0d83c5feed3dc00dbe43b9c42c795a18e7c6c7d7bddea20c7dd56221b146aec81b37f2e7eb5137331c61120 + checksum: a34d89a2b75fb78e66d97c3dc90d4877f7e31f43316b52176f95a5dee20e9bb56ecf158eafc42a001676ddf7b393d9e67650bad6b32f5405780f25fb83cd68e3 languageName: node linkType: hard -"@babel/plugin-transform-regenerator@npm:^7.22.10": - version: 7.22.10 - resolution: "@babel/plugin-transform-regenerator@npm:7.22.10" +"@babel/plugin-transform-unicode-sets-regex@npm:^7.27.1": + version: 7.27.1 + resolution: "@babel/plugin-transform-unicode-sets-regex@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 - regenerator-transform: ^0.15.2 + "@babel/helper-create-regexp-features-plugin": ^7.27.1 + "@babel/helper-plugin-utils": ^7.27.1 peerDependencies: - "@babel/core": ^7.0.0-0 - checksum: e13678d62d6fa96f11cb8b863f00e8693491e7adc88bfca3f2820f80cbac8336e7dec3a596eee6a1c4663b7ececc3564f2cd7fb44ed6d4ce84ac2bb7f39ecc6e + "@babel/core": ^7.0.0 + checksum: 295126074c7388ab05c82ef3ed0907a1ee4666bbdd763477ead9aba6eb2c74bdf65669416861ac93d337a4a27640963bb214acadc2697275ce95aab14868d57f languageName: node linkType: hard -"@babel/plugin-transform-reserved-words@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-reserved-words@npm:7.22.5" +"@babel/preset-env@npm:^7.20.2, @babel/preset-env@npm:^7.25.9": + version: 7.28.0 + resolution: "@babel/preset-env@npm:7.28.0" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/compat-data": ^7.28.0 + "@babel/helper-compilation-targets": ^7.27.2 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/helper-validator-option": ^7.27.1 + "@babel/plugin-bugfix-firefox-class-in-computed-class-key": ^7.27.1 + "@babel/plugin-bugfix-safari-class-field-initializer-scope": ^7.27.1 + "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": ^7.27.1 + "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": ^7.27.1 + "@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly": ^7.27.1 + "@babel/plugin-proposal-private-property-in-object": 7.21.0-placeholder-for-preset-env.2 + "@babel/plugin-syntax-import-assertions": ^7.27.1 + "@babel/plugin-syntax-import-attributes": ^7.27.1 + "@babel/plugin-syntax-unicode-sets-regex": ^7.18.6 + "@babel/plugin-transform-arrow-functions": ^7.27.1 + "@babel/plugin-transform-async-generator-functions": ^7.28.0 + "@babel/plugin-transform-async-to-generator": ^7.27.1 + "@babel/plugin-transform-block-scoped-functions": ^7.27.1 + "@babel/plugin-transform-block-scoping": ^7.28.0 + "@babel/plugin-transform-class-properties": ^7.27.1 + "@babel/plugin-transform-class-static-block": ^7.27.1 + "@babel/plugin-transform-classes": ^7.28.0 + "@babel/plugin-transform-computed-properties": ^7.27.1 + "@babel/plugin-transform-destructuring": ^7.28.0 + "@babel/plugin-transform-dotall-regex": ^7.27.1 + "@babel/plugin-transform-duplicate-keys": ^7.27.1 + "@babel/plugin-transform-duplicate-named-capturing-groups-regex": ^7.27.1 + "@babel/plugin-transform-dynamic-import": ^7.27.1 + "@babel/plugin-transform-explicit-resource-management": ^7.28.0 + "@babel/plugin-transform-exponentiation-operator": ^7.27.1 + "@babel/plugin-transform-export-namespace-from": ^7.27.1 + "@babel/plugin-transform-for-of": ^7.27.1 + "@babel/plugin-transform-function-name": ^7.27.1 + "@babel/plugin-transform-json-strings": ^7.27.1 + "@babel/plugin-transform-literals": ^7.27.1 + "@babel/plugin-transform-logical-assignment-operators": ^7.27.1 + "@babel/plugin-transform-member-expression-literals": ^7.27.1 + "@babel/plugin-transform-modules-amd": ^7.27.1 + "@babel/plugin-transform-modules-commonjs": ^7.27.1 + "@babel/plugin-transform-modules-systemjs": ^7.27.1 + "@babel/plugin-transform-modules-umd": ^7.27.1 + "@babel/plugin-transform-named-capturing-groups-regex": ^7.27.1 + "@babel/plugin-transform-new-target": ^7.27.1 + "@babel/plugin-transform-nullish-coalescing-operator": ^7.27.1 + "@babel/plugin-transform-numeric-separator": ^7.27.1 + "@babel/plugin-transform-object-rest-spread": ^7.28.0 + "@babel/plugin-transform-object-super": ^7.27.1 + "@babel/plugin-transform-optional-catch-binding": ^7.27.1 + "@babel/plugin-transform-optional-chaining": ^7.27.1 + "@babel/plugin-transform-parameters": ^7.27.7 + "@babel/plugin-transform-private-methods": ^7.27.1 + "@babel/plugin-transform-private-property-in-object": ^7.27.1 + "@babel/plugin-transform-property-literals": ^7.27.1 + "@babel/plugin-transform-regenerator": ^7.28.0 + "@babel/plugin-transform-regexp-modifiers": ^7.27.1 + "@babel/plugin-transform-reserved-words": ^7.27.1 + "@babel/plugin-transform-shorthand-properties": ^7.27.1 + "@babel/plugin-transform-spread": ^7.27.1 + "@babel/plugin-transform-sticky-regex": ^7.27.1 + "@babel/plugin-transform-template-literals": ^7.27.1 + "@babel/plugin-transform-typeof-symbol": ^7.27.1 + "@babel/plugin-transform-unicode-escapes": ^7.27.1 + "@babel/plugin-transform-unicode-property-regex": ^7.27.1 + "@babel/plugin-transform-unicode-regex": ^7.27.1 + "@babel/plugin-transform-unicode-sets-regex": ^7.27.1 + "@babel/preset-modules": 0.1.6-no-external-plugins + babel-plugin-polyfill-corejs2: ^0.4.14 + babel-plugin-polyfill-corejs3: ^0.13.0 + babel-plugin-polyfill-regenerator: ^0.6.5 + core-js-compat: ^3.43.0 + semver: ^6.3.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 3ffd7dbc425fe8132bfec118b9817572799cab1473113a635d25ab606c1f5a2341a636c04cf6b22df3813320365ed5a965b5eeb3192320a10e4cc2c137bd8bfc + checksum: 90399ed6350ac413fb507dc5c9e29e98d10684c4b7c7c6ae7b204bb91a7a9cd3bf8f944167a931a73112c8c820d0d1f42d4c15d7c4a7cf19196bf11c19663513 languageName: node linkType: hard -"@babel/plugin-transform-runtime@npm:^7.18.6": - version: 7.22.15 - resolution: "@babel/plugin-transform-runtime@npm:7.22.15" +"@babel/preset-modules@npm:0.1.6-no-external-plugins": + version: 0.1.6-no-external-plugins + resolution: "@babel/preset-modules@npm:0.1.6-no-external-plugins" dependencies: - "@babel/helper-module-imports": ^7.22.15 - "@babel/helper-plugin-utils": ^7.22.5 - babel-plugin-polyfill-corejs2: ^0.4.5 - babel-plugin-polyfill-corejs3: ^0.8.3 - babel-plugin-polyfill-regenerator: ^0.5.2 - semver: ^6.3.1 + "@babel/helper-plugin-utils": ^7.0.0 + "@babel/types": ^7.4.4 + esutils: ^2.0.2 peerDependencies: - "@babel/core": ^7.0.0-0 - checksum: 7edf20b13d02f856276221624abf3b8084daa3f265a6e5c70ee0d0c63087fcf726dc8756a9c8bb3d25a1ce8697ab66ec8cdd15be992c21aed9971cb5bfe80a5b + "@babel/core": ^7.0.0-0 || ^8.0.0-0 <8.0.0 + checksum: 4855e799bc50f2449fb5210f78ea9e8fd46cf4f242243f1e2ed838e2bd702e25e73e822e7f8447722a5f4baa5e67a8f7a0e403f3e7ce04540ff743a9c411c375 languageName: node linkType: hard -"@babel/plugin-transform-shorthand-properties@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-shorthand-properties@npm:7.22.5" +"@babel/preset-react@npm:^7.18.6, @babel/preset-react@npm:^7.25.9": + version: 7.27.1 + resolution: "@babel/preset-react@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/helper-validator-option": ^7.27.1 + "@babel/plugin-transform-react-display-name": ^7.27.1 + "@babel/plugin-transform-react-jsx": ^7.27.1 + "@babel/plugin-transform-react-jsx-development": ^7.27.1 + "@babel/plugin-transform-react-pure-annotations": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: a5ac902c56ea8effa99f681340ee61bac21094588f7aef0bc01dff98246651702e677552fa6d10e548c4ac22a3ffad047dd2f8c8f0540b68316c2c203e56818b + checksum: 00bc146f9c742eed804c598d3f31b7d889c1baf8c768989b7f84a93ca527dd1518d3b86781e89ca45cae6dbee136510d3a121658e01416c5578aecf751517bb5 languageName: node linkType: hard -"@babel/plugin-transform-spread@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-spread@npm:7.22.5" +"@babel/preset-typescript@npm:^7.21.0, @babel/preset-typescript@npm:^7.25.9": + version: 7.27.1 + resolution: "@babel/preset-typescript@npm:7.27.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/helper-skip-transparent-expression-wrappers": ^7.22.5 + "@babel/helper-plugin-utils": ^7.27.1 + "@babel/helper-validator-option": ^7.27.1 + "@babel/plugin-syntax-jsx": ^7.27.1 + "@babel/plugin-transform-modules-commonjs": ^7.27.1 + "@babel/plugin-transform-typescript": ^7.27.1 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 5587f0deb60b3dfc9b274e269031cc45ec75facccf1933ea2ea71ced9fd3ce98ed91bb36d6cd26817c14474b90ed998c5078415f0eab531caf301496ce24c95c + checksum: 38020f1b23e88ec4fbffd5737da455d8939244bddfb48a2516aef93fb5947bd9163fb807ce6eff3e43fa5ffe9113aa131305fef0fb5053998410bbfcfe6ce0ec languageName: node linkType: hard -"@babel/plugin-transform-sticky-regex@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-sticky-regex@npm:7.22.5" +"@babel/runtime-corejs3@npm:^7.25.9": + version: 7.28.0 + resolution: "@babel/runtime-corejs3@npm:7.28.0" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 - peerDependencies: - "@babel/core": ^7.0.0-0 - checksum: 63b2c575e3e7f96c32d52ed45ee098fb7d354b35c2223b8c8e76840b32cc529ee0c0ceb5742fd082e56e91e3d82842a367ce177e82b05039af3d602c9627a729 + core-js-pure: ^3.43.0 + checksum: 4cc29a833b1c0d2b02bfb6a1a96fbb6517f679e70176f3cdd0f55c4886809e32ff991cea0ce10066855d7c3093a4f42b3869b62c833d07961b7738a2dae52085 languageName: node linkType: hard -"@babel/plugin-transform-template-literals@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-template-literals@npm:7.22.5" - dependencies: - "@babel/helper-plugin-utils": ^7.22.5 - peerDependencies: - "@babel/core": ^7.0.0-0 - checksum: 27e9bb030654cb425381c69754be4abe6a7c75b45cd7f962cd8d604b841b2f0fb7b024f2efc1c25cc53f5b16d79d5e8cfc47cacbdaa983895b3aeefa3e7e24ff +"@babel/runtime@npm:^7.1.2, @babel/runtime@npm:^7.10.3, @babel/runtime@npm:^7.12.13, @babel/runtime@npm:^7.12.5, @babel/runtime@npm:^7.25.9": + version: 7.27.6 + resolution: "@babel/runtime@npm:7.27.6" + checksum: 3f7b879df1823c0926bd5dbc941c62f5d60faa790c1aab9758c04799e1f04ee8d93553be9ec059d4e5882f19fe03cbe8933ee4f46212dced0f6d8205992c9c9a languageName: node linkType: hard -"@babel/plugin-transform-typeof-symbol@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-typeof-symbol@npm:7.22.5" +"@babel/template@npm:^7.27.1, @babel/template@npm:^7.27.2": + version: 7.27.2 + resolution: "@babel/template@npm:7.27.2" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 - peerDependencies: - "@babel/core": ^7.0.0-0 - checksum: 82a53a63ffc3010b689ca9a54e5f53b2718b9f4b4a9818f36f9b7dba234f38a01876680553d2716a645a61920b5e6e4aaf8d4a0064add379b27ca0b403049512 + "@babel/code-frame": ^7.27.1 + "@babel/parser": ^7.27.2 + "@babel/types": ^7.27.1 + checksum: ff5628bc066060624afd970616090e5bba91c6240c2e4b458d13267a523572cbfcbf549391eec8217b94b064cf96571c6273f0c04b28a8567b96edc675c28e27 languageName: node linkType: hard -"@babel/plugin-transform-typescript@npm:^7.22.15": - version: 7.22.15 - resolution: "@babel/plugin-transform-typescript@npm:7.22.15" +"@babel/traverse@npm:^7.25.9, @babel/traverse@npm:^7.27.1, @babel/traverse@npm:^7.27.3, @babel/traverse@npm:^7.28.0": + version: 7.28.0 + resolution: "@babel/traverse@npm:7.28.0" dependencies: - "@babel/helper-annotate-as-pure": ^7.22.5 - "@babel/helper-create-class-features-plugin": ^7.22.15 - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/plugin-syntax-typescript": ^7.22.5 - peerDependencies: - "@babel/core": ^7.0.0-0 - checksum: c5d96cdbf0e1512707aa1c1e3ac6b370a25fd9c545d26008ce44eb13a47bd7fd67a1eb799c98b5ccc82e33a345fda55c0055e1fe3ed97646ed405dd13020b226 + "@babel/code-frame": ^7.27.1 + "@babel/generator": ^7.28.0 + "@babel/helper-globals": ^7.28.0 + "@babel/parser": ^7.28.0 + "@babel/template": ^7.27.2 + "@babel/types": ^7.28.0 + debug: ^4.3.1 + checksum: f1b6ed2a37f593ee02db82521f8d54c8540a7ec2735c6c127ba687de306d62ac5a7c6471819783128e0b825c4f7e374206ebbd1daf00d07f05a4528f5b1b4c07 languageName: node linkType: hard -"@babel/plugin-transform-unicode-escapes@npm:^7.22.10": - version: 7.22.10 - resolution: "@babel/plugin-transform-unicode-escapes@npm:7.22.10" +"@babel/types@npm:^7.21.3, @babel/types@npm:^7.27.1, @babel/types@npm:^7.27.3, @babel/types@npm:^7.27.6, @babel/types@npm:^7.28.0, @babel/types@npm:^7.4.4": + version: 7.28.1 + resolution: "@babel/types@npm:7.28.1" dependencies: - "@babel/helper-plugin-utils": ^7.22.5 - peerDependencies: - "@babel/core": ^7.0.0-0 - checksum: 807f40ed1324c8cb107c45358f1903384ca3f0ef1d01c5a3c5c9b271c8d8eec66936a3dcc8d75ddfceea9421420368c2e77ae3adef0a50557e778dfe296bf382 + "@babel/helper-string-parser": ^7.27.1 + "@babel/helper-validator-identifier": ^7.27.1 + checksum: da49a23f86e36f4e4d996a648949a97b9387bae4d1fed747e9fd4bf0dd2a6d11302b6f70f2d00fe58dc12e090f47792596ee76e8def1c52f25d6806cd3a32d7f languageName: node linkType: hard -"@babel/plugin-transform-unicode-property-regex@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-unicode-property-regex@npm:7.22.5" - dependencies: - "@babel/helper-create-regexp-features-plugin": ^7.22.5 - "@babel/helper-plugin-utils": ^7.22.5 - peerDependencies: - "@babel/core": ^7.0.0-0 - checksum: 2495e5f663cb388e3d888b4ba3df419ac436a5012144ac170b622ddfc221f9ea9bdba839fa2bc0185cb776b578030666406452ec7791cbf0e7a3d4c88ae9574c +"@colors/colors@npm:1.5.0": + version: 1.5.0 + resolution: "@colors/colors@npm:1.5.0" + checksum: d64d5260bed1d5012ae3fc617d38d1afc0329fec05342f4e6b838f46998855ba56e0a73833f4a80fa8378c84810da254f76a8a19c39d038260dc06dc4e007425 languageName: node linkType: hard -"@babel/plugin-transform-unicode-regex@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-unicode-regex@npm:7.22.5" - dependencies: - "@babel/helper-create-regexp-features-plugin": ^7.22.5 - "@babel/helper-plugin-utils": ^7.22.5 +"@csstools/cascade-layer-name-parser@npm:^2.0.5": + version: 2.0.5 + resolution: "@csstools/cascade-layer-name-parser@npm:2.0.5" peerDependencies: - "@babel/core": ^7.0.0-0 - checksum: 6b5d1404c8c623b0ec9bd436c00d885a17d6a34f3f2597996343ddb9d94f6379705b21582dfd4cec2c47fd34068872e74ab6b9580116c0566b3f9447e2a7fa06 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + checksum: fb26ae1db6f7a71ee0c3fdaea89f5325f88d7a0b2505fcf4b75e94f2c816ef1edb2961eecbc397df06f67d696ccc6bc99588ea9ee07dd7632bf10febf6b67ed9 languageName: node linkType: hard -"@babel/plugin-transform-unicode-sets-regex@npm:^7.22.5": - version: 7.22.5 - resolution: "@babel/plugin-transform-unicode-sets-regex@npm:7.22.5" - dependencies: - "@babel/helper-create-regexp-features-plugin": ^7.22.5 - "@babel/helper-plugin-utils": ^7.22.5 - peerDependencies: - "@babel/core": ^7.0.0 - checksum: c042070f980b139547f8b0179efbc049ac5930abec7fc26ed7a41d89a048d8ab17d362200e204b6f71c3c20d6991a0e74415e1a412a49adc8131c2a40c04822e +"@csstools/color-helpers@npm:^5.0.2": + version: 5.0.2 + resolution: "@csstools/color-helpers@npm:5.0.2" + checksum: 76753f9823579af959630be5f7682e1abe5ae13b75621532927cfc1ff601cc1e31b78547fe387699980820bb7353e20e8cab258fab590aac9d19aa44984283d5 languageName: node linkType: hard -"@babel/preset-env@npm:^7.18.6, @babel/preset-env@npm:^7.19.4": - version: 7.22.20 - resolution: "@babel/preset-env@npm:7.22.20" - dependencies: - "@babel/compat-data": ^7.22.20 - "@babel/helper-compilation-targets": ^7.22.15 - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/helper-validator-option": ^7.22.15 - "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": ^7.22.15 - "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": ^7.22.15 - "@babel/plugin-proposal-private-property-in-object": 7.21.0-placeholder-for-preset-env.2 - "@babel/plugin-syntax-async-generators": ^7.8.4 - "@babel/plugin-syntax-class-properties": ^7.12.13 - "@babel/plugin-syntax-class-static-block": ^7.14.5 - "@babel/plugin-syntax-dynamic-import": ^7.8.3 - "@babel/plugin-syntax-export-namespace-from": ^7.8.3 - "@babel/plugin-syntax-import-assertions": ^7.22.5 - "@babel/plugin-syntax-import-attributes": ^7.22.5 - "@babel/plugin-syntax-import-meta": ^7.10.4 - "@babel/plugin-syntax-json-strings": ^7.8.3 - "@babel/plugin-syntax-logical-assignment-operators": ^7.10.4 - "@babel/plugin-syntax-nullish-coalescing-operator": ^7.8.3 - "@babel/plugin-syntax-numeric-separator": ^7.10.4 - "@babel/plugin-syntax-object-rest-spread": ^7.8.3 - "@babel/plugin-syntax-optional-catch-binding": ^7.8.3 - "@babel/plugin-syntax-optional-chaining": ^7.8.3 - "@babel/plugin-syntax-private-property-in-object": ^7.14.5 - "@babel/plugin-syntax-top-level-await": ^7.14.5 - "@babel/plugin-syntax-unicode-sets-regex": ^7.18.6 - "@babel/plugin-transform-arrow-functions": ^7.22.5 - "@babel/plugin-transform-async-generator-functions": ^7.22.15 - "@babel/plugin-transform-async-to-generator": ^7.22.5 - "@babel/plugin-transform-block-scoped-functions": ^7.22.5 - "@babel/plugin-transform-block-scoping": ^7.22.15 - "@babel/plugin-transform-class-properties": ^7.22.5 - "@babel/plugin-transform-class-static-block": ^7.22.11 - "@babel/plugin-transform-classes": ^7.22.15 - "@babel/plugin-transform-computed-properties": ^7.22.5 - "@babel/plugin-transform-destructuring": ^7.22.15 - "@babel/plugin-transform-dotall-regex": ^7.22.5 - "@babel/plugin-transform-duplicate-keys": ^7.22.5 - "@babel/plugin-transform-dynamic-import": ^7.22.11 - "@babel/plugin-transform-exponentiation-operator": ^7.22.5 - "@babel/plugin-transform-export-namespace-from": ^7.22.11 - "@babel/plugin-transform-for-of": ^7.22.15 - "@babel/plugin-transform-function-name": ^7.22.5 - "@babel/plugin-transform-json-strings": ^7.22.11 - "@babel/plugin-transform-literals": ^7.22.5 - "@babel/plugin-transform-logical-assignment-operators": ^7.22.11 - "@babel/plugin-transform-member-expression-literals": ^7.22.5 - "@babel/plugin-transform-modules-amd": ^7.22.5 - "@babel/plugin-transform-modules-commonjs": ^7.22.15 - "@babel/plugin-transform-modules-systemjs": ^7.22.11 - "@babel/plugin-transform-modules-umd": ^7.22.5 - "@babel/plugin-transform-named-capturing-groups-regex": ^7.22.5 - "@babel/plugin-transform-new-target": ^7.22.5 - "@babel/plugin-transform-nullish-coalescing-operator": ^7.22.11 - "@babel/plugin-transform-numeric-separator": ^7.22.11 - "@babel/plugin-transform-object-rest-spread": ^7.22.15 - "@babel/plugin-transform-object-super": ^7.22.5 - "@babel/plugin-transform-optional-catch-binding": ^7.22.11 - "@babel/plugin-transform-optional-chaining": ^7.22.15 - "@babel/plugin-transform-parameters": ^7.22.15 - "@babel/plugin-transform-private-methods": ^7.22.5 - "@babel/plugin-transform-private-property-in-object": ^7.22.11 - "@babel/plugin-transform-property-literals": ^7.22.5 - "@babel/plugin-transform-regenerator": ^7.22.10 - "@babel/plugin-transform-reserved-words": ^7.22.5 - "@babel/plugin-transform-shorthand-properties": ^7.22.5 - "@babel/plugin-transform-spread": ^7.22.5 - "@babel/plugin-transform-sticky-regex": ^7.22.5 - "@babel/plugin-transform-template-literals": ^7.22.5 - "@babel/plugin-transform-typeof-symbol": ^7.22.5 - "@babel/plugin-transform-unicode-escapes": ^7.22.10 - "@babel/plugin-transform-unicode-property-regex": ^7.22.5 - "@babel/plugin-transform-unicode-regex": ^7.22.5 - "@babel/plugin-transform-unicode-sets-regex": ^7.22.5 - "@babel/preset-modules": 0.1.6-no-external-plugins - "@babel/types": ^7.22.19 - babel-plugin-polyfill-corejs2: ^0.4.5 - babel-plugin-polyfill-corejs3: ^0.8.3 - babel-plugin-polyfill-regenerator: ^0.5.2 - core-js-compat: ^3.31.0 - semver: ^6.3.1 +"@csstools/css-calc@npm:^2.1.4": + version: 2.1.4 + resolution: "@csstools/css-calc@npm:2.1.4" peerDependencies: - "@babel/core": ^7.0.0-0 - checksum: 99357a5cb30f53bacdc0d1cd6dff0f052ea6c2d1ba874d969bba69897ef716e87283e84a59dc52fb49aa31fd1b6f55ed756c64c04f5678380700239f6030b881 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + checksum: b833d1a031dfb3e3268655aa384121b864fce9bad05f111a3cf2a343eed69ba5d723f3f7cd0793fd7b7a28de2f8141f94568828f48de41d86cefa452eee06390 languageName: node linkType: hard -"@babel/preset-modules@npm:0.1.6-no-external-plugins": - version: 0.1.6-no-external-plugins - resolution: "@babel/preset-modules@npm:0.1.6-no-external-plugins" +"@csstools/css-color-parser@npm:^3.0.10": + version: 3.0.10 + resolution: "@csstools/css-color-parser@npm:3.0.10" dependencies: - "@babel/helper-plugin-utils": ^7.0.0 - "@babel/types": ^7.4.4 - esutils: ^2.0.2 + "@csstools/color-helpers": ^5.0.2 + "@csstools/css-calc": ^2.1.4 peerDependencies: - "@babel/core": ^7.0.0-0 || ^8.0.0-0 <8.0.0 - checksum: 4855e799bc50f2449fb5210f78ea9e8fd46cf4f242243f1e2ed838e2bd702e25e73e822e7f8447722a5f4baa5e67a8f7a0e403f3e7ce04540ff743a9c411c375 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + checksum: 53741dd054b5347c1c5fc51efdff336f9ac4398ef9402603eabd95cf046e8a7c1eae67dfe2497af77b6bfae3dcd5f5ae23aaa37e7d6329210e1768a9c8e8fc90 languageName: node linkType: hard -"@babel/preset-react@npm:^7.18.6": - version: 7.22.15 - resolution: "@babel/preset-react@npm:7.22.15" - dependencies: - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/helper-validator-option": ^7.22.15 - "@babel/plugin-transform-react-display-name": ^7.22.5 - "@babel/plugin-transform-react-jsx": ^7.22.15 - "@babel/plugin-transform-react-jsx-development": ^7.22.5 - "@babel/plugin-transform-react-pure-annotations": ^7.22.5 +"@csstools/css-parser-algorithms@npm:^3.0.5": + version: 3.0.5 + resolution: "@csstools/css-parser-algorithms@npm:3.0.5" peerDependencies: - "@babel/core": ^7.0.0-0 - checksum: c3ef99dfa2e9f57d2e08603e883aa20f47630a826c8e413888a93ae6e0084b5016871e463829be125329d40a1ba0a89f7c43d77b6dab52083c225cb43e63d10e + "@csstools/css-tokenizer": ^3.0.4 + checksum: 80647139574431071e4664ad3c3e141deef4368f0ca536a63b3872487db68cf0d908fb76000f967deb1866963a90e6357fc6b9b00fdfa032f3321cebfcc66cd7 languageName: node linkType: hard -"@babel/preset-typescript@npm:^7.18.6": - version: 7.23.0 - resolution: "@babel/preset-typescript@npm:7.23.0" - dependencies: - "@babel/helper-plugin-utils": ^7.22.5 - "@babel/helper-validator-option": ^7.22.15 - "@babel/plugin-syntax-jsx": ^7.22.5 - "@babel/plugin-transform-modules-commonjs": ^7.23.0 - "@babel/plugin-transform-typescript": ^7.22.15 - peerDependencies: - "@babel/core": ^7.0.0-0 - checksum: 3d5fce83e83f11c07e0ea13542bca181abb3b482b8981ec9c64e6add9d7beed3c54d063dc4bc9fd383165c71114a245abef89a289680833c5a8552fe3e7c4407 +"@csstools/css-tokenizer@npm:^3.0.4": + version: 3.0.4 + resolution: "@csstools/css-tokenizer@npm:3.0.4" + checksum: adc6681d3a0d7a75dc8e5ee0488c99ad4509e4810ae45dd6549a2e64a996e8d75512e70bb244778dc0c6ee85723e20eaeea8c083bf65b51eb19034e182554243 languageName: node linkType: hard -"@babel/regjsgen@npm:^0.8.0": - version: 0.8.0 - resolution: "@babel/regjsgen@npm:0.8.0" - checksum: 89c338fee774770e5a487382170711014d49a68eb281e74f2b5eac88f38300a4ad545516a7786a8dd5702e9cf009c94c2f582d200f077ac5decd74c56b973730 +"@csstools/media-query-list-parser@npm:^4.0.3": + version: 4.0.3 + resolution: "@csstools/media-query-list-parser@npm:4.0.3" + peerDependencies: + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + checksum: dd7dc015a94e0832e5289794f6ab730d1c3fdc85fbd92433eb608dceb91e4977d345c08fe90c487359ce3ba39185fe15789d09c321c799f5c18c6aec7bd8da09 languageName: node linkType: hard -"@babel/runtime-corejs3@npm:^7.18.6": - version: 7.23.1 - resolution: "@babel/runtime-corejs3@npm:7.23.1" +"@csstools/postcss-cascade-layers@npm:^5.0.2": + version: 5.0.2 + resolution: "@csstools/postcss-cascade-layers@npm:5.0.2" dependencies: - core-js-pure: ^3.30.2 - regenerator-runtime: ^0.14.0 - checksum: 5d52b0cc8b5d243e67cf29c584d15acdc0c89b64de4a3fe1cb8a83b84b64a5621802e36931f93ca696cb637884abd11c8514615d890a4edf057ec4464f73915d + "@csstools/selector-specificity": ^5.0.0 + postcss-selector-parser: ^7.0.0 + peerDependencies: + postcss: ^8.4 + checksum: 597f93addd18bf0cf56b744681da6028edfba66192198f492fb37f13f87bdddce8c2da7b2dd1fa67a4ec9dfd076b55ff6d3635523df1a937767c6a12abb28b7a languageName: node linkType: hard -"@babel/runtime@npm:^7.1.2, @babel/runtime@npm:^7.10.3, @babel/runtime@npm:^7.12.13, @babel/runtime@npm:^7.12.5, @babel/runtime@npm:^7.18.6, @babel/runtime@npm:^7.20.13, @babel/runtime@npm:^7.8.4": - version: 7.23.1 - resolution: "@babel/runtime@npm:7.23.1" +"@csstools/postcss-color-function@npm:^4.0.10": + version: 4.0.10 + resolution: "@csstools/postcss-color-function@npm:4.0.10" dependencies: - regenerator-runtime: ^0.14.0 - checksum: 0cd0d43e6e7dc7f9152fda8c8312b08321cda2f56ef53d6c22ebdd773abdc6f5d0a69008de90aa41908d00e2c1facb24715ff121274e689305c858355ff02c70 + "@csstools/css-color-parser": ^3.0.10 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + "@csstools/postcss-progressive-custom-properties": ^4.1.0 + "@csstools/utilities": ^2.0.0 + peerDependencies: + postcss: ^8.4 + checksum: bf7650eab21784bfd3ed5618e1df081a989cedccf54b80accc72819dd463c4c57d99b9c4e5479cac5d889f39d09cc8ad610b82148300591e6bc547b238464056 languageName: node linkType: hard -"@babel/template@npm:^7.12.7, @babel/template@npm:^7.22.15, @babel/template@npm:^7.22.5": - version: 7.22.15 - resolution: "@babel/template@npm:7.22.15" +"@csstools/postcss-color-mix-function@npm:^3.0.10": + version: 3.0.10 + resolution: "@csstools/postcss-color-mix-function@npm:3.0.10" dependencies: - "@babel/code-frame": ^7.22.13 - "@babel/parser": ^7.22.15 - "@babel/types": ^7.22.15 - checksum: 1f3e7dcd6c44f5904c184b3f7fe280394b191f2fed819919ffa1e529c259d5b197da8981b6ca491c235aee8dbad4a50b7e31304aa531271cb823a4a24a0dd8fd + "@csstools/css-color-parser": ^3.0.10 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + "@csstools/postcss-progressive-custom-properties": ^4.1.0 + "@csstools/utilities": ^2.0.0 + peerDependencies: + postcss: ^8.4 + checksum: ea52be6f45979297de77310a095d2df105e0da064300f489572cb9b78e4906e9e6bbbe8fdfc82cf2e01a8bdb2473c36a234852ad5c5ea1eda580b9bc222159b4 languageName: node linkType: hard -"@babel/traverse@npm:^7.12.9, @babel/traverse@npm:^7.18.8, @babel/traverse@npm:^7.23.0": - version: 7.23.0 - resolution: "@babel/traverse@npm:7.23.0" +"@csstools/postcss-color-mix-variadic-function-arguments@npm:^1.0.0": + version: 1.0.0 + resolution: "@csstools/postcss-color-mix-variadic-function-arguments@npm:1.0.0" dependencies: - "@babel/code-frame": ^7.22.13 - "@babel/generator": ^7.23.0 - "@babel/helper-environment-visitor": ^7.22.20 - "@babel/helper-function-name": ^7.23.0 - "@babel/helper-hoist-variables": ^7.22.5 - "@babel/helper-split-export-declaration": ^7.22.6 - "@babel/parser": ^7.23.0 - "@babel/types": ^7.23.0 - debug: ^4.1.0 - globals: ^11.1.0 - checksum: 0b17fae53269e1af2cd3edba00892bc2975ad5df9eea7b84815dab07dfec2928c451066d51bc65b4be61d8499e77db7e547ce69ef2a7b0eca3f96269cb43a0b0 + "@csstools/css-color-parser": ^3.0.10 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + "@csstools/postcss-progressive-custom-properties": ^4.1.0 + "@csstools/utilities": ^2.0.0 + peerDependencies: + postcss: ^8.4 + checksum: f12bf1d63eaf348ebe2ef9c79ddb1a63df3370a556f02d11cbe3ab8540016bd47fd7384948a426207f92131e0f5981d3695fbd046b5768c0ec63e45cc92e31a7 languageName: node linkType: hard -"@babel/types@npm:^7.12.7, @babel/types@npm:^7.20.0, @babel/types@npm:^7.22.15, @babel/types@npm:^7.22.19, @babel/types@npm:^7.22.5, @babel/types@npm:^7.23.0, @babel/types@npm:^7.4.4, @babel/types@npm:^7.8.3": - version: 7.23.0 - resolution: "@babel/types@npm:7.23.0" +"@csstools/postcss-content-alt-text@npm:^2.0.6": + version: 2.0.6 + resolution: "@csstools/postcss-content-alt-text@npm:2.0.6" dependencies: - "@babel/helper-string-parser": ^7.22.5 - "@babel/helper-validator-identifier": ^7.22.20 - to-fast-properties: ^2.0.0 - checksum: 215fe04bd7feef79eeb4d33374b39909ce9cad1611c4135a4f7fdf41fe3280594105af6d7094354751514625ea92d0875aba355f53e86a92600f290e77b0e604 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + "@csstools/postcss-progressive-custom-properties": ^4.1.0 + "@csstools/utilities": ^2.0.0 + peerDependencies: + postcss: ^8.4 + checksum: 2edca1f35b9d59cc3933a318db8cdeaed435169c35d1b0e9fb394349d4633c544ca03243b21be849c8d9f0986a9b10125635e7ed33ef89c28c1346cdb05fdab6 languageName: node linkType: hard -"@colors/colors@npm:1.5.0": - version: 1.5.0 - resolution: "@colors/colors@npm:1.5.0" - checksum: d64d5260bed1d5012ae3fc617d38d1afc0329fec05342f4e6b838f46998855ba56e0a73833f4a80fa8378c84810da254f76a8a19c39d038260dc06dc4e007425 +"@csstools/postcss-exponential-functions@npm:^2.0.9": + version: 2.0.9 + resolution: "@csstools/postcss-exponential-functions@npm:2.0.9" + dependencies: + "@csstools/css-calc": ^2.1.4 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + peerDependencies: + postcss: ^8.4 + checksum: 80d5847d747fc67c32ee3ba49f9c9290654fb086c58b2f13256b14124b7349dac68ba8e107f631248cef2448ca57ef18adbbbc816dd63a54ba91826345373f39 languageName: node linkType: hard -"@discoveryjs/json-ext@npm:0.5.7": - version: 0.5.7 - resolution: "@discoveryjs/json-ext@npm:0.5.7" - checksum: 2176d301cc258ea5c2324402997cf8134ebb212469c0d397591636cea8d3c02f2b3cf9fd58dcb748c7a0dade77ebdc1b10284fa63e608c033a1db52fddc69918 +"@csstools/postcss-font-format-keywords@npm:^4.0.0": + version: 4.0.0 + resolution: "@csstools/postcss-font-format-keywords@npm:4.0.0" + dependencies: + "@csstools/utilities": ^2.0.0 + postcss-value-parser: ^4.2.0 + peerDependencies: + postcss: ^8.4 + checksum: 63091d4748cfc5a51e3c288cd620f058a4e776ba15da6180edaee94aaad9c4e92076f575d064dabc00b28966b33dd1e59f84a6ca6a66aed59556ef92a0dfed45 languageName: node linkType: hard -"@docsearch/css@npm:3.5.2": - version: 3.5.2 - resolution: "@docsearch/css@npm:3.5.2" - checksum: d1d60dd230dd48f896755f21bd20b59583ba844212d7d336953ae48d389baaf868bdf83320fb734a4ed679c3f95b15d620cf3764cd538f6941cae239f8c9d35d +"@csstools/postcss-gamut-mapping@npm:^2.0.10": + version: 2.0.10 + resolution: "@csstools/postcss-gamut-mapping@npm:2.0.10" + dependencies: + "@csstools/css-color-parser": ^3.0.10 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + peerDependencies: + postcss: ^8.4 + checksum: 371449cc8c3db29a27b75afeb500777150f9f9e4edca71f63f2de12bc2c68f4157450ed6a6fdddfaa5596f4a17922176b862d14458a7ce6c15c81d06a0e9fc12 languageName: node linkType: hard -"@docsearch/react@npm:^3.1.1": - version: 3.5.2 - resolution: "@docsearch/react@npm:3.5.2" +"@csstools/postcss-gradients-interpolation-method@npm:^5.0.10": + version: 5.0.10 + resolution: "@csstools/postcss-gradients-interpolation-method@npm:5.0.10" dependencies: - "@algolia/autocomplete-core": 1.9.3 - "@algolia/autocomplete-preset-algolia": 1.9.3 - "@docsearch/css": 3.5.2 - algoliasearch: ^4.19.1 + "@csstools/css-color-parser": ^3.0.10 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + "@csstools/postcss-progressive-custom-properties": ^4.1.0 + "@csstools/utilities": ^2.0.0 peerDependencies: - "@types/react": ">= 16.8.0 < 19.0.0" - react: ">= 16.8.0 < 19.0.0" - react-dom: ">= 16.8.0 < 19.0.0" - search-insights: ">= 1 < 3" - peerDependenciesMeta: - "@types/react": - optional: true - react: - optional: true - react-dom: - optional: true - search-insights: - optional: true - checksum: 4b4584c2c73fc18cbd599047538896450974e134c2c74f19eb202db0ce8e6c3c49c6f65ed6ade61c796d476d3cbb55d6be58df62bc9568a0c72d88e42fca1d16 + postcss: ^8.4 + checksum: ed639018eddd83ebcb96f1c09573c052ebaad153d87abc5f5fa3c0b6dc2a4ed151e25da91c173b87b7b087688c9ec3239210eba2dbc4b9d6bc624a05209e2d33 languageName: node linkType: hard -"@docusaurus/core@npm:2.4.3, @docusaurus/core@npm:^2.4.1": - version: 2.4.3 - resolution: "@docusaurus/core@npm:2.4.3" +"@csstools/postcss-hwb-function@npm:^4.0.10": + version: 4.0.10 + resolution: "@csstools/postcss-hwb-function@npm:4.0.10" dependencies: - "@babel/core": ^7.18.6 - "@babel/generator": ^7.18.7 - "@babel/plugin-syntax-dynamic-import": ^7.8.3 - "@babel/plugin-transform-runtime": ^7.18.6 - "@babel/preset-env": ^7.18.6 - "@babel/preset-react": ^7.18.6 - "@babel/preset-typescript": ^7.18.6 - "@babel/runtime": ^7.18.6 - "@babel/runtime-corejs3": ^7.18.6 - "@babel/traverse": ^7.18.8 - "@docusaurus/cssnano-preset": 2.4.3 - "@docusaurus/logger": 2.4.3 - "@docusaurus/mdx-loader": 2.4.3 - "@docusaurus/react-loadable": 5.5.2 - "@docusaurus/utils": 2.4.3 - "@docusaurus/utils-common": 2.4.3 - "@docusaurus/utils-validation": 2.4.3 - "@slorber/static-site-generator-webpack-plugin": ^4.0.7 - "@svgr/webpack": ^6.2.1 - autoprefixer: ^10.4.7 - babel-loader: ^8.2.5 - babel-plugin-dynamic-import-node: ^2.3.3 - boxen: ^6.2.1 - chalk: ^4.1.2 - chokidar: ^3.5.3 - clean-css: ^5.3.0 - cli-table3: ^0.6.2 - combine-promises: ^1.1.0 - commander: ^5.1.0 - copy-webpack-plugin: ^11.0.0 - core-js: ^3.23.3 - css-loader: ^6.7.1 - css-minimizer-webpack-plugin: ^4.0.0 - cssnano: ^5.1.12 - del: ^6.1.1 - detect-port: ^1.3.0 - escape-html: ^1.0.3 - eta: ^2.0.0 - file-loader: ^6.2.0 - fs-extra: ^10.1.0 - html-minifier-terser: ^6.1.0 - html-tags: ^3.2.0 - html-webpack-plugin: ^5.5.0 - import-fresh: ^3.3.0 - leven: ^3.1.0 - lodash: ^4.17.21 - mini-css-extract-plugin: ^2.6.1 - postcss: ^8.4.14 - postcss-loader: ^7.0.0 - prompts: ^2.4.2 - react-dev-utils: ^12.0.1 - react-helmet-async: ^1.3.0 - react-loadable: "npm:@docusaurus/react-loadable@5.5.2" - react-loadable-ssr-addon-v5-slorber: ^1.0.1 - react-router: ^5.3.3 - react-router-config: ^5.1.1 - react-router-dom: ^5.3.3 - rtl-detect: ^1.0.4 - semver: ^7.3.7 - serve-handler: ^6.1.3 - shelljs: ^0.8.5 - terser-webpack-plugin: ^5.3.3 - tslib: ^2.4.0 - update-notifier: ^5.1.0 - url-loader: ^4.1.1 - wait-on: ^6.0.1 - webpack: ^5.73.0 - webpack-bundle-analyzer: ^4.5.0 - webpack-dev-server: ^4.9.3 - webpack-merge: ^5.8.0 - webpackbar: ^5.0.2 - peerDependencies: - react: ^16.8.4 || ^17.0.0 - react-dom: ^16.8.4 || ^17.0.0 - bin: - docusaurus: bin/docusaurus.mjs - checksum: cce7173ee131364857c16f70f94155ba0e1b044cde54045fb0cf62ad138f8d8ef093f5aba7c7617a9aa0545b3ee3930aec2e09f645daec015696968338963013 + "@csstools/css-color-parser": ^3.0.10 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + "@csstools/postcss-progressive-custom-properties": ^4.1.0 + "@csstools/utilities": ^2.0.0 + peerDependencies: + postcss: ^8.4 + checksum: b2a003fe844b0d5b44a1ba46754afdb298be94a771e2b4109391e774b07a04bfad0bc8d9e833bb862567bed533f54cdc146cdc5b869b69bdd3e5526e2651c200 languageName: node linkType: hard -"@docusaurus/cssnano-preset@npm:2.4.3": - version: 2.4.3 - resolution: "@docusaurus/cssnano-preset@npm:2.4.3" +"@csstools/postcss-ic-unit@npm:^4.0.2": + version: 4.0.2 + resolution: "@csstools/postcss-ic-unit@npm:4.0.2" dependencies: - cssnano-preset-advanced: ^5.3.8 - postcss: ^8.4.14 - postcss-sort-media-queries: ^4.2.1 - tslib: ^2.4.0 - checksum: f4a4c60b075c23541da90e00ae26af2e7eaadf20d783b37b9110a5e34599e4e91947425e33bad58ba71abee81c85cca99f5d7d76575f53fbaf73617b55e39c62 + "@csstools/postcss-progressive-custom-properties": ^4.1.0 + "@csstools/utilities": ^2.0.0 + postcss-value-parser: ^4.2.0 + peerDependencies: + postcss: ^8.4 + checksum: 4242221d9c1ed5f6062b6816a5cbbfb121aa919a0468bb786ff84e8eaf4e7656754b4587c51e9b2ae5bc6a7e53ac17ce05297b095866c8a02edb3b31ce74e18e languageName: node linkType: hard -"@docusaurus/eslint-plugin@npm:^2.4.1": - version: 2.4.3 - resolution: "@docusaurus/eslint-plugin@npm:2.4.3" - dependencies: - "@typescript-eslint/utils": ^5.30.5 - tslib: ^2.4.0 +"@csstools/postcss-initial@npm:^2.0.1": + version: 2.0.1 + resolution: "@csstools/postcss-initial@npm:2.0.1" peerDependencies: - eslint: ">=6" - checksum: c2ff2083b96e08aeca05b63168149f5a0aa154387a70e6fd2f9db7baf4feb3c39f471f8b182c9a12927b9ee7026bc494d4b95921f5b6d98ff176e624f1e1dad2 + postcss: ^8.4 + checksum: 914e9f56faf4e69757b0c905c4808dd39b1de30d151db5817da04510b89cb19b570a405ac2ca070941a42d5ce3f48682329de5ac21ac76416a0a98fee2de2d0d languageName: node linkType: hard -"@docusaurus/logger@npm:2.4.3": - version: 2.4.3 - resolution: "@docusaurus/logger@npm:2.4.3" +"@csstools/postcss-is-pseudo-class@npm:^5.0.3": + version: 5.0.3 + resolution: "@csstools/postcss-is-pseudo-class@npm:5.0.3" dependencies: - chalk: ^4.1.2 - tslib: ^2.4.0 - checksum: f026a8233aa317f16ce5b25c6785a431f319c52fc07a1b9e26f4b3df2197974e75830a16b6140314f8f4ef02dc19242106ec2ae1599740b26d516cc34c56102f + "@csstools/selector-specificity": ^5.0.0 + postcss-selector-parser: ^7.0.0 + peerDependencies: + postcss: ^8.4 + checksum: 60474c5d651bd4dd940c2727d71b235390fb631fc347d0b29f92f7d29cf812e6c796284eeb9206441bfcd00b778068a2fadc465262a4752310b2f9abbc432973 languageName: node linkType: hard -"@docusaurus/mdx-loader@npm:2.4.3": - version: 2.4.3 - resolution: "@docusaurus/mdx-loader@npm:2.4.3" +"@csstools/postcss-light-dark-function@npm:^2.0.9": + version: 2.0.9 + resolution: "@csstools/postcss-light-dark-function@npm:2.0.9" dependencies: - "@babel/parser": ^7.18.8 - "@babel/traverse": ^7.18.8 - "@docusaurus/logger": 2.4.3 - "@docusaurus/utils": 2.4.3 - "@mdx-js/mdx": ^1.6.22 - escape-html: ^1.0.3 - file-loader: ^6.2.0 - fs-extra: ^10.1.0 - image-size: ^1.0.1 - mdast-util-to-string: ^2.0.0 - remark-emoji: ^2.2.0 - stringify-object: ^3.3.0 - tslib: ^2.4.0 - unified: ^9.2.2 - unist-util-visit: ^2.0.3 - url-loader: ^4.1.1 - webpack: ^5.73.0 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + "@csstools/postcss-progressive-custom-properties": ^4.1.0 + "@csstools/utilities": ^2.0.0 peerDependencies: - react: ^16.8.4 || ^17.0.0 - react-dom: ^16.8.4 || ^17.0.0 - checksum: 5a774f7ea5f484e888b2bd1bf8b182279e3788afec779eb8920cf468b92ab8d83a1ae8be51925074241a4d1a38d989cfb366d2baf0f67ed6f063342395a7ca8e + postcss: ^8.4 + checksum: 98a68dc44dfc053b8afddf96bcf8790703d58455bc36475908255f716b88a1e87e49807ff7ae8ecf9c7345ee88524eadd2a872c8ab347348dee1a37f58c58bc4 languageName: node linkType: hard -"@docusaurus/module-type-aliases@npm:2.4.3, @docusaurus/module-type-aliases@npm:^2.4.1": - version: 2.4.3 - resolution: "@docusaurus/module-type-aliases@npm:2.4.3" - dependencies: - "@docusaurus/react-loadable": 5.5.2 - "@docusaurus/types": 2.4.3 - "@types/history": ^4.7.11 +"@csstools/postcss-logical-float-and-clear@npm:^3.0.0": + version: 3.0.0 + resolution: "@csstools/postcss-logical-float-and-clear@npm:3.0.0" + peerDependencies: + postcss: ^8.4 + checksum: 793d9a89c28d4809a83b6111d321f60947a59f119d61046e5c4023ce2caedbb221298e69b6df38995e51b763545807db7b03da47e47461622f32928fec92b65f + languageName: node + linkType: hard + +"@csstools/postcss-logical-overflow@npm:^2.0.0": + version: 2.0.0 + resolution: "@csstools/postcss-logical-overflow@npm:2.0.0" + peerDependencies: + postcss: ^8.4 + checksum: bf73ea1d7754f59773af5a7b434e9eaa2ce05c8fe7aa26a726dce8f2a42abb0f5686fbf9672d25912250226174c35f2c5737ca072d21f8b68420500b7449fe58 + languageName: node + linkType: hard + +"@csstools/postcss-logical-overscroll-behavior@npm:^2.0.0": + version: 2.0.0 + resolution: "@csstools/postcss-logical-overscroll-behavior@npm:2.0.0" + peerDependencies: + postcss: ^8.4 + checksum: bf043fdad02b9578fc2dcddb409b014a15dee65a9813ceb583237dff1caf807e18101f68bde2b0d8b685139d823114ab8deed6da3027878d11a945755824d3b1 + languageName: node + linkType: hard + +"@csstools/postcss-logical-resize@npm:^3.0.0": + version: 3.0.0 + resolution: "@csstools/postcss-logical-resize@npm:3.0.0" + dependencies: + postcss-value-parser: ^4.2.0 + peerDependencies: + postcss: ^8.4 + checksum: 3be1133a9ac27e0a0d73b19d573adc00ad78a697522eaf6c9de90260882ba8ff0904c7ab3e68379ee7724e28661c4b497cb665e258214bc8355f4a0d91021c46 + languageName: node + linkType: hard + +"@csstools/postcss-logical-viewport-units@npm:^3.0.4": + version: 3.0.4 + resolution: "@csstools/postcss-logical-viewport-units@npm:3.0.4" + dependencies: + "@csstools/css-tokenizer": ^3.0.4 + "@csstools/utilities": ^2.0.0 + peerDependencies: + postcss: ^8.4 + checksum: ddb8d9b473c55cce1c1261652d657d33d9306d80112eac578d53b05dd48a5607ea2064fcf6bc298ccc1e63143e11517d35230bad6063dae14d445530c45a81ec + languageName: node + linkType: hard + +"@csstools/postcss-media-minmax@npm:^2.0.9": + version: 2.0.9 + resolution: "@csstools/postcss-media-minmax@npm:2.0.9" + dependencies: + "@csstools/css-calc": ^2.1.4 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + "@csstools/media-query-list-parser": ^4.0.3 + peerDependencies: + postcss: ^8.4 + checksum: 24da18a5a41daef2ea4cf7d85f459b5b425085501324a3f0546309ba13f682ab57d9aabc4e639a724cd1d91a0ead046b9ab8164adad31d89c9e39ca918f5494b + languageName: node + linkType: hard + +"@csstools/postcss-media-queries-aspect-ratio-number-values@npm:^3.0.5": + version: 3.0.5 + resolution: "@csstools/postcss-media-queries-aspect-ratio-number-values@npm:3.0.5" + dependencies: + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + "@csstools/media-query-list-parser": ^4.0.3 + peerDependencies: + postcss: ^8.4 + checksum: 5a316f59c3d422eef942d01c4007d14fad8f85ce85efce080a90d8d3eb3257dc6fcce612c5ee57cf4665993a03bc5ccb538dac8e25041242ecf74f5c348a3c5a + languageName: node + linkType: hard + +"@csstools/postcss-nested-calc@npm:^4.0.0": + version: 4.0.0 + resolution: "@csstools/postcss-nested-calc@npm:4.0.0" + dependencies: + "@csstools/utilities": ^2.0.0 + postcss-value-parser: ^4.2.0 + peerDependencies: + postcss: ^8.4 + checksum: f334861687d7e3a4b9c26940e767a06f07e0095cab405a5b086fca407d6f743c57b552d4504ba7d5b1700a97da3507a41bf3bc2d126a26028b79f96ea38b6af5 + languageName: node + linkType: hard + +"@csstools/postcss-normalize-display-values@npm:^4.0.0": + version: 4.0.0 + resolution: "@csstools/postcss-normalize-display-values@npm:4.0.0" + dependencies: + postcss-value-parser: ^4.2.0 + peerDependencies: + postcss: ^8.4 + checksum: 750093837486da6dd0cc66183fe9909a18485f23610669806b708ab9942c721a773997cde37fd7ee085aca3d6de065ffd5609c77df5e2f303d67af106e53726e + languageName: node + linkType: hard + +"@csstools/postcss-oklab-function@npm:^4.0.10": + version: 4.0.10 + resolution: "@csstools/postcss-oklab-function@npm:4.0.10" + dependencies: + "@csstools/css-color-parser": ^3.0.10 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + "@csstools/postcss-progressive-custom-properties": ^4.1.0 + "@csstools/utilities": ^2.0.0 + peerDependencies: + postcss: ^8.4 + checksum: 5d715a58e821aa5f5d30efe69b4b0a3dde301c75343d30c7b6a1a39ce3f6b7d060c10d063cda1c6424d58e4efeebee187f910fe7c011a701d623b71d3444b603 + languageName: node + linkType: hard + +"@csstools/postcss-progressive-custom-properties@npm:^4.1.0": + version: 4.1.0 + resolution: "@csstools/postcss-progressive-custom-properties@npm:4.1.0" + dependencies: + postcss-value-parser: ^4.2.0 + peerDependencies: + postcss: ^8.4 + checksum: ac60f683d25e224a15e5b2c06b1b0e29f51f72cc9f2704b82565e489d7f0f8532267a4b9300396ae402a93590bc9c35d5002ffda446f430e2c1c61a6cffcfd5c + languageName: node + linkType: hard + +"@csstools/postcss-random-function@npm:^2.0.1": + version: 2.0.1 + resolution: "@csstools/postcss-random-function@npm:2.0.1" + dependencies: + "@csstools/css-calc": ^2.1.4 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + peerDependencies: + postcss: ^8.4 + checksum: d421a790b11675edf493f3e48259636beca164c494ed2883042118b35674d26f04e1a46f9e89203a179e20acc2a1f5912078ec81b330a2c1a1abef7e7387e587 + languageName: node + linkType: hard + +"@csstools/postcss-relative-color-syntax@npm:^3.0.10": + version: 3.0.10 + resolution: "@csstools/postcss-relative-color-syntax@npm:3.0.10" + dependencies: + "@csstools/css-color-parser": ^3.0.10 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + "@csstools/postcss-progressive-custom-properties": ^4.1.0 + "@csstools/utilities": ^2.0.0 + peerDependencies: + postcss: ^8.4 + checksum: d09d0e559a538f3e0c120f1c660de799ada6f9f77423b945faf6648d914f8c6a3a6d8647ab6c895e5edaade4dfcceb207d6a44ff5e7e63998330677bf304cb08 + languageName: node + linkType: hard + +"@csstools/postcss-scope-pseudo-class@npm:^4.0.1": + version: 4.0.1 + resolution: "@csstools/postcss-scope-pseudo-class@npm:4.0.1" + dependencies: + postcss-selector-parser: ^7.0.0 + peerDependencies: + postcss: ^8.4 + checksum: 043667ad54b3a26e619d6c16129c1f4d8f8c7cd1c52443475aa7782dbc411390c23bd2fe41ea9c6a3f280594abbcdd9d4117a3d7c27cd2a77e31e6fd11e29fc0 + languageName: node + linkType: hard + +"@csstools/postcss-sign-functions@npm:^1.1.4": + version: 1.1.4 + resolution: "@csstools/postcss-sign-functions@npm:1.1.4" + dependencies: + "@csstools/css-calc": ^2.1.4 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + peerDependencies: + postcss: ^8.4 + checksum: 0afcb008142a0a41df51267d79cf950f4f314394dca7c041e3a0be87df56517ac5400861630a979b5bef49f01c296025106622110384039e3c8f82802d6adcde + languageName: node + linkType: hard + +"@csstools/postcss-stepped-value-functions@npm:^4.0.9": + version: 4.0.9 + resolution: "@csstools/postcss-stepped-value-functions@npm:4.0.9" + dependencies: + "@csstools/css-calc": ^2.1.4 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + peerDependencies: + postcss: ^8.4 + checksum: 6465a883be42d4cc4a4e83be2626a1351de4bfe84a63641c53e7c39d3c0e109152489ca2d8235625cdf6726341c676b9fbbca18fe80bb5eae8d488a0e42fc5e4 + languageName: node + linkType: hard + +"@csstools/postcss-text-decoration-shorthand@npm:^4.0.2": + version: 4.0.2 + resolution: "@csstools/postcss-text-decoration-shorthand@npm:4.0.2" + dependencies: + "@csstools/color-helpers": ^5.0.2 + postcss-value-parser: ^4.2.0 + peerDependencies: + postcss: ^8.4 + checksum: c67b9c6582f7cd05d8a0df5ba98531ca07721c80f3ddf8ec69d1b9da5c6e1fd9313e25ce9ed378bbdf11c6dcd37367f3ebf1d4fabb6af99232e11bb662bfa1f9 + languageName: node + linkType: hard + +"@csstools/postcss-trigonometric-functions@npm:^4.0.9": + version: 4.0.9 + resolution: "@csstools/postcss-trigonometric-functions@npm:4.0.9" + dependencies: + "@csstools/css-calc": ^2.1.4 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + peerDependencies: + postcss: ^8.4 + checksum: c746cd986df061a87de4f2d0129aa2d2e98a2948e5005fe6fe419a9e9ec7a0f7382461847cbd3f67f8f66169bdf23a1d7f53ca6b9922ddd235ec45f2867a8825 + languageName: node + linkType: hard + +"@csstools/postcss-unset-value@npm:^4.0.0": + version: 4.0.0 + resolution: "@csstools/postcss-unset-value@npm:4.0.0" + peerDependencies: + postcss: ^8.4 + checksum: 3d194feea11f80ba82e19733d1531546abeba0af9fe6fc105acdf10452d699661da4e1bce45101f90bcb624a30570e469cee945c5a62b9ffe1445959a0b782d1 + languageName: node + linkType: hard + +"@csstools/selector-resolve-nested@npm:^3.1.0": + version: 3.1.0 + resolution: "@csstools/selector-resolve-nested@npm:3.1.0" + peerDependencies: + postcss-selector-parser: ^7.0.0 + checksum: eaad6a6c99345cae2849a2c73daf53381fabd75851eefd830ee743e4d454d4e2930aa99c8b9e651fed92b9a8361f352c6c754abf82c576bba4953f1e59c927e9 + languageName: node + linkType: hard + +"@csstools/selector-specificity@npm:^5.0.0": + version: 5.0.0 + resolution: "@csstools/selector-specificity@npm:5.0.0" + peerDependencies: + postcss-selector-parser: ^7.0.0 + checksum: 8df1a01a1fa52b66c7ba0286e1c77d1faff45009876f09ddcac542a1c4bca9f34ee92a10acf056b8e7b7ac93679c1635496c6cdfd7d88dbaff2b6afd1eb823ec + languageName: node + linkType: hard + +"@csstools/utilities@npm:^2.0.0": + version: 2.0.0 + resolution: "@csstools/utilities@npm:2.0.0" + peerDependencies: + postcss: ^8.4 + checksum: c9c8d82063ec5156d56b056c9124fed95714f05d7c1a64043174b0559aa099989f17a826579f22045384defe152e32d6355b7a9660cfed96819f43fccf277941 + languageName: node + linkType: hard + +"@discoveryjs/json-ext@npm:0.5.7": + version: 0.5.7 + resolution: "@discoveryjs/json-ext@npm:0.5.7" + checksum: 2176d301cc258ea5c2324402997cf8134ebb212469c0d397591636cea8d3c02f2b3cf9fd58dcb748c7a0dade77ebdc1b10284fa63e608c033a1db52fddc69918 + languageName: node + linkType: hard + +"@docsearch/css@npm:3.9.0": + version: 3.9.0 + resolution: "@docsearch/css@npm:3.9.0" + checksum: 8e6f5a995d17881c76b31e5364274b3387917ccbc417ba183009f2655dd507244f7009d27807675f09011efcd8e13d80505e7e17eff1a5d93bcd71324a5fc262 + languageName: node + linkType: hard + +"@docsearch/react@npm:^3.9.0": + version: 3.9.0 + resolution: "@docsearch/react@npm:3.9.0" + dependencies: + "@algolia/autocomplete-core": 1.17.9 + "@algolia/autocomplete-preset-algolia": 1.17.9 + "@docsearch/css": 3.9.0 + algoliasearch: ^5.14.2 + peerDependencies: + "@types/react": ">= 16.8.0 < 20.0.0" + react: ">= 16.8.0 < 20.0.0" + react-dom: ">= 16.8.0 < 20.0.0" + search-insights: ">= 1 < 3" + peerDependenciesMeta: + "@types/react": + optional: true + react: + optional: true + react-dom: + optional: true + search-insights: + optional: true + checksum: af6c531af5f4c10fb57d4d29ae47fe297e4201c5130492e2c73c34306348bf87ab05b7eeae2cb83a6c33dbe8da3754b82275b86ae0116df65f34a9e51f9291bc + languageName: node + linkType: hard + +"@docusaurus/babel@npm:3.8.1": + version: 3.8.1 + resolution: "@docusaurus/babel@npm:3.8.1" + dependencies: + "@babel/core": ^7.25.9 + "@babel/generator": ^7.25.9 + "@babel/plugin-syntax-dynamic-import": ^7.8.3 + "@babel/plugin-transform-runtime": ^7.25.9 + "@babel/preset-env": ^7.25.9 + "@babel/preset-react": ^7.25.9 + "@babel/preset-typescript": ^7.25.9 + "@babel/runtime": ^7.25.9 + "@babel/runtime-corejs3": ^7.25.9 + "@babel/traverse": ^7.25.9 + "@docusaurus/logger": 3.8.1 + "@docusaurus/utils": 3.8.1 + babel-plugin-dynamic-import-node: ^2.3.3 + fs-extra: ^11.1.1 + tslib: ^2.6.0 + checksum: 0aee376cd9f7ca94eafba3c2a128308d366f25313541dd4ff1c7b78a6dc831d30b757bf5aaf5e5e364d37f47d9de6c08ce3c862638e26dfff63003c9040f43be + languageName: node + linkType: hard + +"@docusaurus/bundler@npm:3.8.1": + version: 3.8.1 + resolution: "@docusaurus/bundler@npm:3.8.1" + dependencies: + "@babel/core": ^7.25.9 + "@docusaurus/babel": 3.8.1 + "@docusaurus/cssnano-preset": 3.8.1 + "@docusaurus/logger": 3.8.1 + "@docusaurus/types": 3.8.1 + "@docusaurus/utils": 3.8.1 + babel-loader: ^9.2.1 + clean-css: ^5.3.3 + copy-webpack-plugin: ^11.0.0 + css-loader: ^6.11.0 + css-minimizer-webpack-plugin: ^5.0.1 + cssnano: ^6.1.2 + file-loader: ^6.2.0 + html-minifier-terser: ^7.2.0 + mini-css-extract-plugin: ^2.9.2 + null-loader: ^4.0.1 + postcss: ^8.5.4 + postcss-loader: ^7.3.4 + postcss-preset-env: ^10.2.1 + terser-webpack-plugin: ^5.3.9 + tslib: ^2.6.0 + url-loader: ^4.1.1 + webpack: ^5.95.0 + webpackbar: ^6.0.1 + peerDependencies: + "@docusaurus/faster": "*" + peerDependenciesMeta: + "@docusaurus/faster": + optional: true + checksum: 275553ca59dd7ff10bc2ad06cf823fb0213a23faf818e0153cfefbd41d59ebadffd9b4c6565c1a70b357c3de049f7e1998d89fb99617efd297d6548029550d91 + languageName: node + linkType: hard + +"@docusaurus/core@latest, @docusaurus/core@npm:3.8.1": + version: 3.8.1 + resolution: "@docusaurus/core@npm:3.8.1" + dependencies: + "@docusaurus/babel": 3.8.1 + "@docusaurus/bundler": 3.8.1 + "@docusaurus/logger": 3.8.1 + "@docusaurus/mdx-loader": 3.8.1 + "@docusaurus/utils": 3.8.1 + "@docusaurus/utils-common": 3.8.1 + "@docusaurus/utils-validation": 3.8.1 + boxen: ^6.2.1 + chalk: ^4.1.2 + chokidar: ^3.5.3 + cli-table3: ^0.6.3 + combine-promises: ^1.1.0 + commander: ^5.1.0 + core-js: ^3.31.1 + detect-port: ^1.5.1 + escape-html: ^1.0.3 + eta: ^2.2.0 + eval: ^0.1.8 + execa: 5.1.1 + fs-extra: ^11.1.1 + html-tags: ^3.3.1 + html-webpack-plugin: ^5.6.0 + leven: ^3.1.0 + lodash: ^4.17.21 + open: ^8.4.0 + p-map: ^4.0.0 + prompts: ^2.4.2 + react-helmet-async: "npm:@slorber/react-helmet-async@1.3.0" + react-loadable: "npm:@docusaurus/react-loadable@6.0.0" + react-loadable-ssr-addon-v5-slorber: ^1.0.1 + react-router: ^5.3.4 + react-router-config: ^5.1.1 + react-router-dom: ^5.3.4 + semver: ^7.5.4 + serve-handler: ^6.1.6 + tinypool: ^1.0.2 + tslib: ^2.6.0 + update-notifier: ^6.0.2 + webpack: ^5.95.0 + webpack-bundle-analyzer: ^4.10.2 + webpack-dev-server: ^4.15.2 + webpack-merge: ^6.0.1 + peerDependencies: + "@mdx-js/react": ^3.0.0 + react: ^18.0.0 || ^19.0.0 + react-dom: ^18.0.0 || ^19.0.0 + bin: + docusaurus: bin/docusaurus.mjs + checksum: a8ff71da5bf012929c17d48cab228cdb9f8c1b3442bd38ef36f194c011da194d1cc80b383a16970811d4a817605ef41a9d73858df41bd504c162560042f37885 + languageName: node + linkType: hard + +"@docusaurus/cssnano-preset@npm:3.8.1": + version: 3.8.1 + resolution: "@docusaurus/cssnano-preset@npm:3.8.1" + dependencies: + cssnano-preset-advanced: ^6.1.2 + postcss: ^8.5.4 + postcss-sort-media-queries: ^5.2.0 + tslib: ^2.6.0 + checksum: 4fada596bedf182007ec12ca4e4af373fa7763724d9219ea695a71f9325f2984c0b76a4dbbeb39f2fea14b174ff7e285915c463156f7cd02fe583c44e361c2ba + languageName: node + linkType: hard + +"@docusaurus/eslint-plugin@latest": + version: 3.8.1 + resolution: "@docusaurus/eslint-plugin@npm:3.8.1" + dependencies: + "@typescript-eslint/utils": ^5.62.0 + tslib: ^2.6.0 + peerDependencies: + eslint: ">=6" + checksum: ed856229f37f1ad2bb459593d55cc0d24cc39ea92b1846430f85862abe87df223fb035688dd9b7a8e14540033d4efb067095f0be6ada138430c6840dffdd5dfe + languageName: node + linkType: hard + +"@docusaurus/logger@npm:3.8.1": + version: 3.8.1 + resolution: "@docusaurus/logger@npm:3.8.1" + dependencies: + chalk: ^4.1.2 + tslib: ^2.6.0 + checksum: acbd23e1f99b606dd51aa92754d729d86918ae7f29ec91105ab352fa83342386ae697386d54c2cd686a0e953f137e94af889b6bbb311c2c56e65db3ba9d4d6ea + languageName: node + linkType: hard + +"@docusaurus/mdx-loader@npm:3.8.1": + version: 3.8.1 + resolution: "@docusaurus/mdx-loader@npm:3.8.1" + dependencies: + "@docusaurus/logger": 3.8.1 + "@docusaurus/utils": 3.8.1 + "@docusaurus/utils-validation": 3.8.1 + "@mdx-js/mdx": ^3.0.0 + "@slorber/remark-comment": ^1.0.0 + escape-html: ^1.0.3 + estree-util-value-to-estree: ^3.0.1 + file-loader: ^6.2.0 + fs-extra: ^11.1.1 + image-size: ^2.0.2 + mdast-util-mdx: ^3.0.0 + mdast-util-to-string: ^4.0.0 + rehype-raw: ^7.0.0 + remark-directive: ^3.0.0 + remark-emoji: ^4.0.0 + remark-frontmatter: ^5.0.0 + remark-gfm: ^4.0.0 + stringify-object: ^3.3.0 + tslib: ^2.6.0 + unified: ^11.0.3 + unist-util-visit: ^5.0.0 + url-loader: ^4.1.1 + vfile: ^6.0.1 + webpack: ^5.88.1 + peerDependencies: + react: ^18.0.0 || ^19.0.0 + react-dom: ^18.0.0 || ^19.0.0 + checksum: a2790de0a0bb98753bded46f43b1d2c99e976260478b592516755f3f00d32660099f17ff256d0381748ffcbdd2372d92a70d2b96672cdc9c23189157a645fe72 + languageName: node + linkType: hard + +"@docusaurus/module-type-aliases@latest, @docusaurus/module-type-aliases@npm:3.8.1": + version: 3.8.1 + resolution: "@docusaurus/module-type-aliases@npm:3.8.1" + dependencies: + "@docusaurus/types": 3.8.1 + "@types/history": ^4.7.11 "@types/react": "*" "@types/react-router-config": "*" "@types/react-router-dom": "*" - react-helmet-async: "*" - react-loadable: "npm:@docusaurus/react-loadable@5.5.2" + react-helmet-async: "npm:@slorber/react-helmet-async@1.3.0" + react-loadable: "npm:@docusaurus/react-loadable@6.0.0" peerDependencies: react: "*" react-dom: "*" - checksum: 22ce1a6a20acc35cdd2ec57e55f29e65dbe0fb3a46aaa8c033ec78bf04cd3087f0523c816c744ed311095512dd686c83e0a8619cc1a2a937c27cd54527739c38 + checksum: 7bcefad2a499bebb3a577ee18848fb496f0d4ddc5d9cac4c4ee43760d44c6f87fe5e8eb2d940692999216904e8f4c4b5f6b1dbca8e54475301e2c2d063494149 languageName: node linkType: hard -"@docusaurus/plugin-content-blog@npm:2.4.3, @docusaurus/plugin-content-blog@npm:^2.4.1": - version: 2.4.3 - resolution: "@docusaurus/plugin-content-blog@npm:2.4.3" +"@docusaurus/plugin-content-blog@latest, @docusaurus/plugin-content-blog@npm:3.8.1": + version: 3.8.1 + resolution: "@docusaurus/plugin-content-blog@npm:3.8.1" dependencies: - "@docusaurus/core": 2.4.3 - "@docusaurus/logger": 2.4.3 - "@docusaurus/mdx-loader": 2.4.3 - "@docusaurus/types": 2.4.3 - "@docusaurus/utils": 2.4.3 - "@docusaurus/utils-common": 2.4.3 - "@docusaurus/utils-validation": 2.4.3 - cheerio: ^1.0.0-rc.12 + "@docusaurus/core": 3.8.1 + "@docusaurus/logger": 3.8.1 + "@docusaurus/mdx-loader": 3.8.1 + "@docusaurus/theme-common": 3.8.1 + "@docusaurus/types": 3.8.1 + "@docusaurus/utils": 3.8.1 + "@docusaurus/utils-common": 3.8.1 + "@docusaurus/utils-validation": 3.8.1 + cheerio: 1.0.0-rc.12 feed: ^4.2.2 - fs-extra: ^10.1.0 + fs-extra: ^11.1.1 lodash: ^4.17.21 - reading-time: ^1.5.0 - tslib: ^2.4.0 - unist-util-visit: ^2.0.3 + schema-dts: ^1.1.2 + srcset: ^4.0.0 + tslib: ^2.6.0 + unist-util-visit: ^5.0.0 utility-types: ^3.10.0 - webpack: ^5.73.0 + webpack: ^5.88.1 peerDependencies: - react: ^16.8.4 || ^17.0.0 - react-dom: ^16.8.4 || ^17.0.0 - checksum: 9fd41331c609b9488eea363e617e3763a814c75f83eb1b858cef402a0f5b96f67a342e25ff8c333489e550eb4d379eae09a88b986a97c25170fe203662e2f1ae + "@docusaurus/plugin-content-docs": "*" + react: ^18.0.0 || ^19.0.0 + react-dom: ^18.0.0 || ^19.0.0 + checksum: c91300a817bee8ef367338748c5f8c1a1402af16c9ff4ed7a5e529573b9bee5258c31d55f8dfd43253a119a2412dd2bb14ff36931ac78b11942a72332ce3e4c6 languageName: node linkType: hard -"@docusaurus/plugin-content-docs@npm:2.4.3": - version: 2.4.3 - resolution: "@docusaurus/plugin-content-docs@npm:2.4.3" +"@docusaurus/plugin-content-docs@npm:3.8.1, @docusaurus/plugin-content-docs@npm:^2 || ^3": + version: 3.8.1 + resolution: "@docusaurus/plugin-content-docs@npm:3.8.1" dependencies: - "@docusaurus/core": 2.4.3 - "@docusaurus/logger": 2.4.3 - "@docusaurus/mdx-loader": 2.4.3 - "@docusaurus/module-type-aliases": 2.4.3 - "@docusaurus/types": 2.4.3 - "@docusaurus/utils": 2.4.3 - "@docusaurus/utils-validation": 2.4.3 - "@types/react-router-config": ^5.0.6 + "@docusaurus/core": 3.8.1 + "@docusaurus/logger": 3.8.1 + "@docusaurus/mdx-loader": 3.8.1 + "@docusaurus/module-type-aliases": 3.8.1 + "@docusaurus/theme-common": 3.8.1 + "@docusaurus/types": 3.8.1 + "@docusaurus/utils": 3.8.1 + "@docusaurus/utils-common": 3.8.1 + "@docusaurus/utils-validation": 3.8.1 + "@types/react-router-config": ^5.0.7 combine-promises: ^1.1.0 - fs-extra: ^10.1.0 - import-fresh: ^3.3.0 + fs-extra: ^11.1.1 js-yaml: ^4.1.0 lodash: ^4.17.21 - tslib: ^2.4.0 + schema-dts: ^1.1.2 + tslib: ^2.6.0 utility-types: ^3.10.0 - webpack: ^5.73.0 - peerDependencies: - react: ^16.8.4 || ^17.0.0 - react-dom: ^16.8.4 || ^17.0.0 - checksum: bc01201f64721131eb84f264e51c7497b8034d2a3d99d762169f5dc456c3d8882acfa01fdbaa8fdc6e2e220479b36e0c9e8e17397bf887884589535bdeaeb4bb - languageName: node - linkType: hard - -"@docusaurus/plugin-content-pages@npm:2.4.3": - version: 2.4.3 - resolution: "@docusaurus/plugin-content-pages@npm:2.4.3" - dependencies: - "@docusaurus/core": 2.4.3 - "@docusaurus/mdx-loader": 2.4.3 - "@docusaurus/types": 2.4.3 - "@docusaurus/utils": 2.4.3 - "@docusaurus/utils-validation": 2.4.3 - fs-extra: ^10.1.0 - tslib: ^2.4.0 - webpack: ^5.73.0 + webpack: ^5.88.1 peerDependencies: - react: ^16.8.4 || ^17.0.0 - react-dom: ^16.8.4 || ^17.0.0 - checksum: 00439c2e1a1f345cd549739db13a3610b6d9f7ffa6cf7507ad6ac1f3c8d24041947acc2a446be7edf1a613cf354a50d1133aa28ddf64a0eff6ed8a31bf1a542f + react: ^18.0.0 || ^19.0.0 + react-dom: ^18.0.0 || ^19.0.0 + checksum: af408e555180d458ac477803fe6bf1f8014adb53fccbf02523575b24e2721771f31b4bd17947483591ca52c8238a3809743351e94348ca5476f907cf99ac6a91 languageName: node linkType: hard -"@docusaurus/plugin-debug@npm:2.4.3": - version: 2.4.3 - resolution: "@docusaurus/plugin-debug@npm:2.4.3" +"@docusaurus/plugin-content-pages@npm:3.8.1": + version: 3.8.1 + resolution: "@docusaurus/plugin-content-pages@npm:3.8.1" dependencies: - "@docusaurus/core": 2.4.3 - "@docusaurus/types": 2.4.3 - "@docusaurus/utils": 2.4.3 - fs-extra: ^10.1.0 - react-json-view: ^1.21.3 - tslib: ^2.4.0 + "@docusaurus/core": 3.8.1 + "@docusaurus/mdx-loader": 3.8.1 + "@docusaurus/types": 3.8.1 + "@docusaurus/utils": 3.8.1 + "@docusaurus/utils-validation": 3.8.1 + fs-extra: ^11.1.1 + tslib: ^2.6.0 + webpack: ^5.88.1 peerDependencies: - react: ^16.8.4 || ^17.0.0 - react-dom: ^16.8.4 || ^17.0.0 - checksum: 88955828b72e463e04501cc6bedf802208e377ae0f4d72735625bcbb47918afc4f2588355c6914064cfdbe4945d3da6473ce76319aa1f66dd975b3b43c4c39b0 + react: ^18.0.0 || ^19.0.0 + react-dom: ^18.0.0 || ^19.0.0 + checksum: 3ca2bc0b7e120da10afc18f2073aa09cd1e9a3adaa87f6689a3f13f8bf2752a045477ccc82a6fc9f96404988a30498837daea8b9a5c116274b88b1e091dfaa07 languageName: node linkType: hard -"@docusaurus/plugin-google-analytics@npm:2.4.3": - version: 2.4.3 - resolution: "@docusaurus/plugin-google-analytics@npm:2.4.3" +"@docusaurus/plugin-css-cascade-layers@npm:3.8.1": + version: 3.8.1 + resolution: "@docusaurus/plugin-css-cascade-layers@npm:3.8.1" dependencies: - "@docusaurus/core": 2.4.3 - "@docusaurus/types": 2.4.3 - "@docusaurus/utils-validation": 2.4.3 - tslib: ^2.4.0 - peerDependencies: - react: ^16.8.4 || ^17.0.0 - react-dom: ^16.8.4 || ^17.0.0 - checksum: 6e30de6b5c479493614a5552a295f07ffb9c83f3740a68c7d4dbac378b8288da7430f26cdc246d763855c6084ad86a6f87286e6c8b40f4817794bb1a04e109ea + "@docusaurus/core": 3.8.1 + "@docusaurus/types": 3.8.1 + "@docusaurus/utils": 3.8.1 + "@docusaurus/utils-validation": 3.8.1 + tslib: ^2.6.0 + checksum: da12b362f6ed0236583b0a3341a9c0b45fc497197540bfbcd19552d450bdd8ac0688ec303721f47ddc570caea0a3055fbbbe46a8f2cbbbe59bacca2f89131106 languageName: node linkType: hard -"@docusaurus/plugin-google-gtag@npm:2.4.3": - version: 2.4.3 - resolution: "@docusaurus/plugin-google-gtag@npm:2.4.3" +"@docusaurus/plugin-debug@npm:3.8.1": + version: 3.8.1 + resolution: "@docusaurus/plugin-debug@npm:3.8.1" dependencies: - "@docusaurus/core": 2.4.3 - "@docusaurus/types": 2.4.3 - "@docusaurus/utils-validation": 2.4.3 - tslib: ^2.4.0 + "@docusaurus/core": 3.8.1 + "@docusaurus/types": 3.8.1 + "@docusaurus/utils": 3.8.1 + fs-extra: ^11.1.1 + react-json-view-lite: ^2.3.0 + tslib: ^2.6.0 peerDependencies: - react: ^16.8.4 || ^17.0.0 - react-dom: ^16.8.4 || ^17.0.0 - checksum: 4aaac4d262b3bb7fc3f16620c5329b90db92bf28361ced54f2945fc0e4669483e2f36b076332e0ee9d11b6233cd2c81ca35c953119bad42171e62571c1692d6a + react: ^18.0.0 || ^19.0.0 + react-dom: ^18.0.0 || ^19.0.0 + checksum: 89fac8490c6fbcd048a069c848fc51bc0e815dfc462dbb2fa6b4143b6b156cf9742cc1a73ff86491bbbeab91ecdef8f0d2fa71578fda343682b559eb216813e8 languageName: node linkType: hard -"@docusaurus/plugin-google-tag-manager@npm:2.4.3": - version: 2.4.3 - resolution: "@docusaurus/plugin-google-tag-manager@npm:2.4.3" +"@docusaurus/plugin-google-analytics@npm:3.8.1": + version: 3.8.1 + resolution: "@docusaurus/plugin-google-analytics@npm:3.8.1" dependencies: - "@docusaurus/core": 2.4.3 - "@docusaurus/types": 2.4.3 - "@docusaurus/utils-validation": 2.4.3 - tslib: ^2.4.0 + "@docusaurus/core": 3.8.1 + "@docusaurus/types": 3.8.1 + "@docusaurus/utils-validation": 3.8.1 + tslib: ^2.6.0 peerDependencies: - react: ^16.8.4 || ^17.0.0 - react-dom: ^16.8.4 || ^17.0.0 - checksum: c3af89b4d41fab463d853cbfbe8f43d384f702dd09fd914fffcca01fdf94c282d1b98d762c9142fe21f6471f5dd643679e8d11344c95fdf6657aff0618c3c7a5 + react: ^18.0.0 || ^19.0.0 + react-dom: ^18.0.0 || ^19.0.0 + checksum: fb140f94f93f4b2a690af7daf09330027dbdf55559e312776b23670009f6e51e7830f12f87ab0ae67e038723088bd43e0f1cbeed94bdac03db781e2915dcf253 languageName: node linkType: hard -"@docusaurus/plugin-sitemap@npm:2.4.3": - version: 2.4.3 - resolution: "@docusaurus/plugin-sitemap@npm:2.4.3" +"@docusaurus/plugin-google-gtag@npm:3.8.1": + version: 3.8.1 + resolution: "@docusaurus/plugin-google-gtag@npm:3.8.1" dependencies: - "@docusaurus/core": 2.4.3 - "@docusaurus/logger": 2.4.3 - "@docusaurus/types": 2.4.3 - "@docusaurus/utils": 2.4.3 - "@docusaurus/utils-common": 2.4.3 - "@docusaurus/utils-validation": 2.4.3 - fs-extra: ^10.1.0 - sitemap: ^7.1.1 - tslib: ^2.4.0 + "@docusaurus/core": 3.8.1 + "@docusaurus/types": 3.8.1 + "@docusaurus/utils-validation": 3.8.1 + "@types/gtag.js": ^0.0.12 + tslib: ^2.6.0 peerDependencies: - react: ^16.8.4 || ^17.0.0 - react-dom: ^16.8.4 || ^17.0.0 - checksum: cf96b9f0e32cefa58e37a4bc2f0a112ea657f06faf47b780ec2ba39d5e2daca6486a73f3b376c56ad3bb42f3f0c3f70a783f1ce1964b74e2ba273e6f439e439b + react: ^18.0.0 || ^19.0.0 + react-dom: ^18.0.0 || ^19.0.0 + checksum: 5f2cd8f602e4f003dde7377f4ff771a7431a5e914bb5b49854ed39ab97ec013521866f53b12527a1cabd49a5a0513513db6554f4591f87b32577980475d07332 languageName: node linkType: hard -"@docusaurus/preset-classic@npm:^2.4.1": - version: 2.4.3 - resolution: "@docusaurus/preset-classic@npm:2.4.3" +"@docusaurus/plugin-google-tag-manager@npm:3.8.1": + version: 3.8.1 + resolution: "@docusaurus/plugin-google-tag-manager@npm:3.8.1" dependencies: - "@docusaurus/core": 2.4.3 - "@docusaurus/plugin-content-blog": 2.4.3 - "@docusaurus/plugin-content-docs": 2.4.3 - "@docusaurus/plugin-content-pages": 2.4.3 - "@docusaurus/plugin-debug": 2.4.3 - "@docusaurus/plugin-google-analytics": 2.4.3 - "@docusaurus/plugin-google-gtag": 2.4.3 - "@docusaurus/plugin-google-tag-manager": 2.4.3 - "@docusaurus/plugin-sitemap": 2.4.3 - "@docusaurus/theme-classic": 2.4.3 - "@docusaurus/theme-common": 2.4.3 - "@docusaurus/theme-search-algolia": 2.4.3 - "@docusaurus/types": 2.4.3 + "@docusaurus/core": 3.8.1 + "@docusaurus/types": 3.8.1 + "@docusaurus/utils-validation": 3.8.1 + tslib: ^2.6.0 peerDependencies: - react: ^16.8.4 || ^17.0.0 - react-dom: ^16.8.4 || ^17.0.0 - checksum: a321badc44696adf4ab2d4a5d6c93f595e8c17988aec9609d325928a1d60f5e0205b23fe849b28ddaed24f7935829e86c402f6b761d6e65db4224270b9dd443c + react: ^18.0.0 || ^19.0.0 + react-dom: ^18.0.0 || ^19.0.0 + checksum: c4b8dd30e21634bfb7609919ba04be54ff19c9e7c4657eef2cba622886b5d223e9f586239b52b3ccb464db77c0a87827cd804cd23f2c000f3309ccde06af296b languageName: node linkType: hard -"@docusaurus/react-loadable@npm:5.5.2, react-loadable@npm:@docusaurus/react-loadable@5.5.2": - version: 5.5.2 - resolution: "@docusaurus/react-loadable@npm:5.5.2" +"@docusaurus/plugin-sitemap@npm:3.8.1": + version: 3.8.1 + resolution: "@docusaurus/plugin-sitemap@npm:3.8.1" dependencies: - "@types/react": "*" - prop-types: ^15.6.2 - peerDependencies: - react: "*" - checksum: 930fb9e2936412a12461f210acdc154a433283921ca43ac3fc3b84cb6c12eb738b3a3719373022bf68004efeb1a928dbe36c467d7a1f86454ed6241576d936e7 - languageName: node - linkType: hard - -"@docusaurus/theme-classic@npm:2.4.3": - version: 2.4.3 - resolution: "@docusaurus/theme-classic@npm:2.4.3" - dependencies: - "@docusaurus/core": 2.4.3 - "@docusaurus/mdx-loader": 2.4.3 - "@docusaurus/module-type-aliases": 2.4.3 - "@docusaurus/plugin-content-blog": 2.4.3 - "@docusaurus/plugin-content-docs": 2.4.3 - "@docusaurus/plugin-content-pages": 2.4.3 - "@docusaurus/theme-common": 2.4.3 - "@docusaurus/theme-translations": 2.4.3 - "@docusaurus/types": 2.4.3 - "@docusaurus/utils": 2.4.3 - "@docusaurus/utils-common": 2.4.3 - "@docusaurus/utils-validation": 2.4.3 - "@mdx-js/react": ^1.6.22 - clsx: ^1.2.1 - copy-text-to-clipboard: ^3.0.1 - infima: 0.2.0-alpha.43 + "@docusaurus/core": 3.8.1 + "@docusaurus/logger": 3.8.1 + "@docusaurus/types": 3.8.1 + "@docusaurus/utils": 3.8.1 + "@docusaurus/utils-common": 3.8.1 + "@docusaurus/utils-validation": 3.8.1 + fs-extra: ^11.1.1 + sitemap: ^7.1.1 + tslib: ^2.6.0 + peerDependencies: + react: ^18.0.0 || ^19.0.0 + react-dom: ^18.0.0 || ^19.0.0 + checksum: 513344f57e6fcd004b276f68d0557992b81ad3dfac2df706652c4555446635c088d6f04d49e1664a98f5ac9ab5e302306ec7ceedde30754d3754dd7199f45c26 + languageName: node + linkType: hard + +"@docusaurus/plugin-svgr@npm:3.8.1": + version: 3.8.1 + resolution: "@docusaurus/plugin-svgr@npm:3.8.1" + dependencies: + "@docusaurus/core": 3.8.1 + "@docusaurus/types": 3.8.1 + "@docusaurus/utils": 3.8.1 + "@docusaurus/utils-validation": 3.8.1 + "@svgr/core": 8.1.0 + "@svgr/webpack": ^8.1.0 + tslib: ^2.6.0 + webpack: ^5.88.1 + peerDependencies: + react: ^18.0.0 || ^19.0.0 + react-dom: ^18.0.0 || ^19.0.0 + checksum: 9c8210f19f0736b8144d9a0e8ff77c93f509fe65c153c8e50955adff367040fbea6bc45ed085f0d3c262aecd23f48f0c492a3705f9f7ebeee6417e5e305b88c5 + languageName: node + linkType: hard + +"@docusaurus/preset-classic@latest": + version: 3.8.1 + resolution: "@docusaurus/preset-classic@npm:3.8.1" + dependencies: + "@docusaurus/core": 3.8.1 + "@docusaurus/plugin-content-blog": 3.8.1 + "@docusaurus/plugin-content-docs": 3.8.1 + "@docusaurus/plugin-content-pages": 3.8.1 + "@docusaurus/plugin-css-cascade-layers": 3.8.1 + "@docusaurus/plugin-debug": 3.8.1 + "@docusaurus/plugin-google-analytics": 3.8.1 + "@docusaurus/plugin-google-gtag": 3.8.1 + "@docusaurus/plugin-google-tag-manager": 3.8.1 + "@docusaurus/plugin-sitemap": 3.8.1 + "@docusaurus/plugin-svgr": 3.8.1 + "@docusaurus/theme-classic": 3.8.1 + "@docusaurus/theme-common": 3.8.1 + "@docusaurus/theme-search-algolia": 3.8.1 + "@docusaurus/types": 3.8.1 + peerDependencies: + react: ^18.0.0 || ^19.0.0 + react-dom: ^18.0.0 || ^19.0.0 + checksum: cb6776d1c31727ff17b9b7114ea148e907391839ee8a4702f2fd97098671d7781f81f2f8eab0da434c36ec4b6e79d99b5d6a4178f2876c05b1dadb8edc5e45d3 + languageName: node + linkType: hard + +"@docusaurus/theme-classic@npm:3.8.1": + version: 3.8.1 + resolution: "@docusaurus/theme-classic@npm:3.8.1" + dependencies: + "@docusaurus/core": 3.8.1 + "@docusaurus/logger": 3.8.1 + "@docusaurus/mdx-loader": 3.8.1 + "@docusaurus/module-type-aliases": 3.8.1 + "@docusaurus/plugin-content-blog": 3.8.1 + "@docusaurus/plugin-content-docs": 3.8.1 + "@docusaurus/plugin-content-pages": 3.8.1 + "@docusaurus/theme-common": 3.8.1 + "@docusaurus/theme-translations": 3.8.1 + "@docusaurus/types": 3.8.1 + "@docusaurus/utils": 3.8.1 + "@docusaurus/utils-common": 3.8.1 + "@docusaurus/utils-validation": 3.8.1 + "@mdx-js/react": ^3.0.0 + clsx: ^2.0.0 + copy-text-to-clipboard: ^3.2.0 + infima: 0.2.0-alpha.45 lodash: ^4.17.21 nprogress: ^0.2.0 - postcss: ^8.4.14 - prism-react-renderer: ^1.3.5 - prismjs: ^1.28.0 - react-router-dom: ^5.3.3 - rtlcss: ^3.5.0 - tslib: ^2.4.0 + postcss: ^8.5.4 + prism-react-renderer: ^2.3.0 + prismjs: ^1.29.0 + react-router-dom: ^5.3.4 + rtlcss: ^4.1.0 + tslib: ^2.6.0 utility-types: ^3.10.0 peerDependencies: - react: ^16.8.4 || ^17.0.0 - react-dom: ^16.8.4 || ^17.0.0 - checksum: 215b7fa416f40ce68773265a168af47fa770583ebe33ec7b34c7e082dfe7c79252b589a6b26532cb0ab7dd089611a9cd0e20c94df097be320a227b98e3b3fbb8 + react: ^18.0.0 || ^19.0.0 + react-dom: ^18.0.0 || ^19.0.0 + checksum: 99dd400732529ff7330ae4b2198f34645521b536db97ccd219284044f27dac55530723792c2c33e450b5b31d51f100e8280b19ca513e7e45572e6a534921268e languageName: node linkType: hard -"@docusaurus/theme-common@npm:2.4.3": - version: 2.4.3 - resolution: "@docusaurus/theme-common@npm:2.4.3" +"@docusaurus/theme-common@npm:3.8.1": + version: 3.8.1 + resolution: "@docusaurus/theme-common@npm:3.8.1" dependencies: - "@docusaurus/mdx-loader": 2.4.3 - "@docusaurus/module-type-aliases": 2.4.3 - "@docusaurus/plugin-content-blog": 2.4.3 - "@docusaurus/plugin-content-docs": 2.4.3 - "@docusaurus/plugin-content-pages": 2.4.3 - "@docusaurus/utils": 2.4.3 - "@docusaurus/utils-common": 2.4.3 + "@docusaurus/mdx-loader": 3.8.1 + "@docusaurus/module-type-aliases": 3.8.1 + "@docusaurus/utils": 3.8.1 + "@docusaurus/utils-common": 3.8.1 "@types/history": ^4.7.11 "@types/react": "*" "@types/react-router-config": "*" - clsx: ^1.2.1 + clsx: ^2.0.0 parse-numeric-range: ^1.3.0 - prism-react-renderer: ^1.3.5 - tslib: ^2.4.0 - use-sync-external-store: ^1.2.0 + prism-react-renderer: ^2.3.0 + tslib: ^2.6.0 utility-types: ^3.10.0 peerDependencies: - react: ^16.8.4 || ^17.0.0 - react-dom: ^16.8.4 || ^17.0.0 - checksum: 76817f548705542124d708c804e724674ec9bf996a5cb2a5c9a2919416367567cca4a3fa6055589990c339f6e1fb9d3944e25ed30b79fabe191db00d6ef986ca + "@docusaurus/plugin-content-docs": "*" + react: ^18.0.0 || ^19.0.0 + react-dom: ^18.0.0 || ^19.0.0 + checksum: 00c8500f15b9c45d0b6978a3b0aa59bccb8a7c32c6b5a58d0200f67fd4fc256a98984c1acddf829c44f75a989811a6fa48fca8f7cedbb096a07848ced243649a languageName: node linkType: hard -"@docusaurus/theme-live-codeblock@npm:^2.4.1": - version: 2.4.3 - resolution: "@docusaurus/theme-live-codeblock@npm:2.4.3" +"@docusaurus/theme-live-codeblock@latest": + version: 3.8.1 + resolution: "@docusaurus/theme-live-codeblock@npm:3.8.1" dependencies: - "@docusaurus/core": 2.4.3 - "@docusaurus/theme-common": 2.4.3 - "@docusaurus/theme-translations": 2.4.3 - "@docusaurus/utils-validation": 2.4.3 + "@docusaurus/core": 3.8.1 + "@docusaurus/theme-common": 3.8.1 + "@docusaurus/theme-translations": 3.8.1 + "@docusaurus/utils-validation": 3.8.1 "@philpl/buble": ^0.19.7 - clsx: ^1.2.1 - fs-extra: ^10.1.0 - react-live: 2.2.3 - tslib: ^2.4.0 - peerDependencies: - react: ^16.8.4 || ^17.0.0 - react-dom: ^16.8.4 || ^17.0.0 - checksum: c96a6abf667b80ef3506ae4dc5012fb2c3602a7ff145ecb5c8660153929f989c5bfa09727f7e8be501ed45536565c00bd048f7a0a796d0ff1f6dd2aea88ed199 - languageName: node - linkType: hard - -"@docusaurus/theme-search-algolia@npm:2.4.3": - version: 2.4.3 - resolution: "@docusaurus/theme-search-algolia@npm:2.4.3" - dependencies: - "@docsearch/react": ^3.1.1 - "@docusaurus/core": 2.4.3 - "@docusaurus/logger": 2.4.3 - "@docusaurus/plugin-content-docs": 2.4.3 - "@docusaurus/theme-common": 2.4.3 - "@docusaurus/theme-translations": 2.4.3 - "@docusaurus/utils": 2.4.3 - "@docusaurus/utils-validation": 2.4.3 - algoliasearch: ^4.13.1 - algoliasearch-helper: ^3.10.0 - clsx: ^1.2.1 - eta: ^2.0.0 - fs-extra: ^10.1.0 + clsx: ^2.0.0 + fs-extra: ^11.1.1 + react-live: ^4.1.6 + tslib: ^2.6.0 + peerDependencies: + react: ^18.0.0 || ^19.0.0 + react-dom: ^18.0.0 || ^19.0.0 + checksum: 39cccaec5bd23835c77c5293a14193ab567118b0090430611fa457054ca8bf8d972692542872b436a4329cbf3b1650c81871554267f4f3185e3c62ab2bf388da + languageName: node + linkType: hard + +"@docusaurus/theme-search-algolia@npm:3.8.1": + version: 3.8.1 + resolution: "@docusaurus/theme-search-algolia@npm:3.8.1" + dependencies: + "@docsearch/react": ^3.9.0 + "@docusaurus/core": 3.8.1 + "@docusaurus/logger": 3.8.1 + "@docusaurus/plugin-content-docs": 3.8.1 + "@docusaurus/theme-common": 3.8.1 + "@docusaurus/theme-translations": 3.8.1 + "@docusaurus/utils": 3.8.1 + "@docusaurus/utils-validation": 3.8.1 + algoliasearch: ^5.17.1 + algoliasearch-helper: ^3.22.6 + clsx: ^2.0.0 + eta: ^2.2.0 + fs-extra: ^11.1.1 lodash: ^4.17.21 - tslib: ^2.4.0 + tslib: ^2.6.0 utility-types: ^3.10.0 peerDependencies: - react: ^16.8.4 || ^17.0.0 - react-dom: ^16.8.4 || ^17.0.0 - checksum: 665d244c25bff21dd45c983c9b85f9827d2dd58945b802d645370b5e7092820532faf488c0bc0ce88e8fc0088c7f56eb9abb96589cf3857372c1b61bba6cbed7 + react: ^18.0.0 || ^19.0.0 + react-dom: ^18.0.0 || ^19.0.0 + checksum: 9420b116072268fac1c53e400911b449169ed6899ac054d3380528cf98363a37edb1e3aa26faa7428d30401e1b9221a2bd6c8770e9f062cb1670f72318db6857 languageName: node linkType: hard -"@docusaurus/theme-translations@npm:2.4.3": - version: 2.4.3 - resolution: "@docusaurus/theme-translations@npm:2.4.3" +"@docusaurus/theme-translations@npm:3.8.1, @docusaurus/theme-translations@npm:^2 || ^3": + version: 3.8.1 + resolution: "@docusaurus/theme-translations@npm:3.8.1" dependencies: - fs-extra: ^10.1.0 - tslib: ^2.4.0 - checksum: 8424583a130b0d32b6adf578dc5daeefaad199019c8a6a23fbd67577209be64923cde59d423ea9d41d6e7cfc2318e7fa6a17a665e8ae1c871ce0880525f9b8fd + fs-extra: ^11.1.1 + tslib: ^2.6.0 + checksum: 24a05a2c755df2e88e27ae7be716ef291b265726259558e83ec82886989d7cafc2ff7b4e35ad27f8e3dcee16686369c7c963574a023bdedc881f9969524b4417 languageName: node linkType: hard -"@docusaurus/types@npm:2.4.3": - version: 2.4.3 - resolution: "@docusaurus/types@npm:2.4.3" +"@docusaurus/types@npm:3.8.1": + version: 3.8.1 + resolution: "@docusaurus/types@npm:3.8.1" dependencies: + "@mdx-js/mdx": ^3.0.0 "@types/history": ^4.7.11 "@types/react": "*" commander: ^5.1.0 - joi: ^17.6.0 - react-helmet-async: ^1.3.0 + joi: ^17.9.2 + react-helmet-async: "npm:@slorber/react-helmet-async@1.3.0" utility-types: ^3.10.0 - webpack: ^5.73.0 - webpack-merge: ^5.8.0 + webpack: ^5.95.0 + webpack-merge: ^5.9.0 peerDependencies: - react: ^16.8.4 || ^17.0.0 - react-dom: ^16.8.4 || ^17.0.0 - checksum: c123c45630e885b588f808baa06a97f8408a3381906f65cb92ae75732aedfca6ab2cada94f969c08e043b885b95298616440326259b789010e0986cbcd7a960b + react: ^18.0.0 || ^19.0.0 + react-dom: ^18.0.0 || ^19.0.0 + checksum: 51ffefcf438c1d7a2bae13c5e78145c05908292726a7934a63fabc43a29972a279f963ce7da081ebbd6d62cb11de4b7084c2534fc366adf423f9857b2deeb528 + languageName: node + linkType: hard + +"@docusaurus/utils-common@npm:3.8.1, @docusaurus/utils-common@npm:^2 || ^3": + version: 3.8.1 + resolution: "@docusaurus/utils-common@npm:3.8.1" + dependencies: + "@docusaurus/types": 3.8.1 + tslib: ^2.6.0 + checksum: 2720815d2b96a9d419a3355ce727bb5bf4bd0554f3aab6f62f2510d77b30724745b08da4ebaae7c4d409af0192d92052718d9059902b3a37d83606ade80a62ac + languageName: node + linkType: hard + +"@docusaurus/utils-validation@npm:3.8.1, @docusaurus/utils-validation@npm:^2 || ^3": + version: 3.8.1 + resolution: "@docusaurus/utils-validation@npm:3.8.1" + dependencies: + "@docusaurus/logger": 3.8.1 + "@docusaurus/utils": 3.8.1 + "@docusaurus/utils-common": 3.8.1 + fs-extra: ^11.2.0 + joi: ^17.9.2 + js-yaml: ^4.1.0 + lodash: ^4.17.21 + tslib: ^2.6.0 + checksum: 1685ad1e8fd9e8625149cfa84ce164b109b1c013959e50e492ddb413705437d061e29850d5da5b35912d47085f0fe5b78faa0fe76d838beccce5f9b55579d21c languageName: node linkType: hard -"@docusaurus/utils-common@npm:2.4.3": - version: 2.4.3 - resolution: "@docusaurus/utils-common@npm:2.4.3" +"@docusaurus/utils@npm:3.8.1, @docusaurus/utils@npm:^2 || ^3": + version: 3.8.1 + resolution: "@docusaurus/utils@npm:3.8.1" dependencies: + "@docusaurus/logger": 3.8.1 + "@docusaurus/types": 3.8.1 + "@docusaurus/utils-common": 3.8.1 + escape-string-regexp: ^4.0.0 + execa: 5.1.1 + file-loader: ^6.2.0 + fs-extra: ^11.1.1 + github-slugger: ^1.5.0 + globby: ^11.1.0 + gray-matter: ^4.0.3 + jiti: ^1.20.0 + js-yaml: ^4.1.0 + lodash: ^4.17.21 + micromatch: ^4.0.5 + p-queue: ^6.6.2 + prompts: ^2.4.2 + resolve-pathname: ^3.0.0 + tslib: ^2.6.0 + url-loader: ^4.1.1 + utility-types: ^3.10.0 + webpack: ^5.88.1 + checksum: 8491c475380247de61c39c006a9e5846aaed64d27f5318b2d3b1c5b96d34858182b83b7f28c080bcf3b2fd24c27e1f5a9392e91726d218eb1e0a246848ebfd62 + languageName: node + linkType: hard + +"@easyops-cn/autocomplete.js@npm:^0.38.1": + version: 0.38.1 + resolution: "@easyops-cn/autocomplete.js@npm:0.38.1" + dependencies: + cssesc: ^3.0.0 + immediate: ^3.2.3 + checksum: d88b61f12c383856b8d5cedf176a6d07a21e013dc2c78be029af81e2e026ece2bb988c6ea7f9951a2759c2e6f806ea1d1c9627bf36d9cbe376e897a94ce5da09 + languageName: node + linkType: hard + +"@easyops-cn/docusaurus-search-local@npm:^0.52.0": + version: 0.52.0 + resolution: "@easyops-cn/docusaurus-search-local@npm:0.52.0" + dependencies: + "@docusaurus/plugin-content-docs": ^2 || ^3 + "@docusaurus/theme-translations": ^2 || ^3 + "@docusaurus/utils": ^2 || ^3 + "@docusaurus/utils-common": ^2 || ^3 + "@docusaurus/utils-validation": ^2 || ^3 + "@easyops-cn/autocomplete.js": ^0.38.1 + "@node-rs/jieba": ^1.6.0 + cheerio: ^1.0.0 + clsx: ^2.1.1 + comlink: ^4.4.2 + debug: ^4.2.0 + fs-extra: ^10.0.0 + klaw-sync: ^6.0.0 + lunr: ^2.3.9 + lunr-languages: ^1.4.0 + mark.js: ^8.11.1 tslib: ^2.4.0 peerDependencies: - "@docusaurus/types": "*" - peerDependenciesMeta: - "@docusaurus/types": - optional: true - checksum: 1ae315d8d8ce7a0163a698ffdca55b734d21f336512138c128bc0fa2a8d224edbaad0c8dbd7a3de2e8ef734dc2656c505d09066dee4fc84819d153593abb8984 + "@docusaurus/theme-common": ^2 || ^3 + react: ^16.14.0 || ^17 || ^18 || ^19 + react-dom: ^16.14.0 || 17 || ^18 || ^19 + checksum: 423ba2ab00eb6fad1d492e4ed1f03828e73458f938c018ba95077f90c7ccaf80a83580a5be31b9864d4cb7bb9d632eade38c5766af51563bc62b4079500d5926 + languageName: node + linkType: hard + +"@emnapi/core@npm:^1.4.3": + version: 1.4.5 + resolution: "@emnapi/core@npm:1.4.5" + dependencies: + "@emnapi/wasi-threads": 1.0.4 + tslib: ^2.4.0 + checksum: ae4800fe2bcc1c790e588ce19e299fa85c6e1fe2a4ac44eda26be1ad4220b6121de18a735d5fa81307a86576fe2038ab53bde5f8f6aa3708b9276d6600a50b52 languageName: node linkType: hard -"@docusaurus/utils-validation@npm:2.4.3": - version: 2.4.3 - resolution: "@docusaurus/utils-validation@npm:2.4.3" +"@emnapi/runtime@npm:^1.4.3": + version: 1.4.5 + resolution: "@emnapi/runtime@npm:1.4.5" dependencies: - "@docusaurus/logger": 2.4.3 - "@docusaurus/utils": 2.4.3 - joi: ^17.6.0 - js-yaml: ^4.1.0 tslib: ^2.4.0 - checksum: d3472b3f7a0a029c2cef1f00bc9db403d5f7e74e2091eccbc45d06f5776a84fd73bd1a18cf3a8a3cc0348ce49f753a1300deac670c2a82c56070cc40ca9df06e + checksum: 99ab25d55cf1ceeec12f83b60f48e744f8e1dfc8d52a2ed81b3b09bf15182e61ef55f25b69d51ec83044861bddaa4404e7c3285bf71dd518a7980867e41c2a10 languageName: node linkType: hard -"@docusaurus/utils@npm:2.4.3": - version: 2.4.3 - resolution: "@docusaurus/utils@npm:2.4.3" +"@emnapi/wasi-threads@npm:1.0.4": + version: 1.0.4 + resolution: "@emnapi/wasi-threads@npm:1.0.4" dependencies: - "@docusaurus/logger": 2.4.3 - "@svgr/webpack": ^6.2.1 - escape-string-regexp: ^4.0.0 - file-loader: ^6.2.0 - fs-extra: ^10.1.0 - github-slugger: ^1.4.0 - globby: ^11.1.0 - gray-matter: ^4.0.3 - js-yaml: ^4.1.0 - lodash: ^4.17.21 - micromatch: ^4.0.5 - resolve-pathname: ^3.0.0 - shelljs: ^0.8.5 tslib: ^2.4.0 - url-loader: ^4.1.1 - webpack: ^5.73.0 - peerDependencies: - "@docusaurus/types": "*" - peerDependenciesMeta: - "@docusaurus/types": - optional: true - checksum: dd1aa7688d1a4b2775e13a91d528608ceab33c57a921404d9a989867c31c8ef17fe3892e4f5680dfb4a783da7b9973e2077e907ff4ac172927433e606e8fa9b9 + checksum: 106cbb0c86e0e5a8830a3262105a6531e09ebcc21724f0da64ec49d76d87cbf894e0afcbc3a3621a104abf7465e3f758bffb5afa61a308c31abc847525c10d93 languageName: node linkType: hard "@eslint-community/eslint-utils@npm:^4.2.0": - version: 4.4.0 - resolution: "@eslint-community/eslint-utils@npm:4.4.0" + version: 4.7.0 + resolution: "@eslint-community/eslint-utils@npm:4.7.0" dependencies: - eslint-visitor-keys: ^3.3.0 + eslint-visitor-keys: ^3.4.3 peerDependencies: eslint: ^6.0.0 || ^7.0.0 || >=8.0.0 - checksum: cdfe3ae42b4f572cbfb46d20edafe6f36fc5fb52bf2d90875c58aefe226892b9677fef60820e2832caf864a326fe4fc225714c46e8389ccca04d5f9288aabd22 + checksum: b177e3b75c0b8d0e5d71f1c532edb7e40b31313db61f0c879f9bf19c3abb2783c6c372b5deb2396dab4432f2946b9972122ac682e77010376c029dfd0149c681 languageName: node linkType: hard "@eslint-community/regexpp@npm:^4.4.0, @eslint-community/regexpp@npm:^4.6.1": - version: 4.9.1 - resolution: "@eslint-community/regexpp@npm:4.9.1" - checksum: 06fb839e9c756f6375cc545c2f2e05a0a64576bd6370e8e3c07983fd29a3d6e164ef4aa48a361f7d27e6713ab79c83053ff6a2ccb78748bc955e344279c4a3b6 + version: 4.12.1 + resolution: "@eslint-community/regexpp@npm:4.12.1" + checksum: 0d628680e204bc316d545b4993d3658427ca404ae646ce541fcc65306b8c712c340e5e573e30fb9f85f4855c0c5f6dca9868931f2fcced06417fbe1a0c6cd2d6 languageName: node linkType: hard @@ -2351,14 +2759,14 @@ __metadata: languageName: node linkType: hard -"@hapi/hoek@npm:^9.0.0": +"@hapi/hoek@npm:^9.0.0, @hapi/hoek@npm:^9.3.0": version: 9.3.0 resolution: "@hapi/hoek@npm:9.3.0" checksum: 4771c7a776242c3c022b168046af4e324d116a9d2e1d60631ee64f474c6e38d1bb07092d898bf95c7bc5d334c5582798a1456321b2e53ca817d4e7c88bc25b43 languageName: node linkType: hard -"@hapi/topo@npm:^5.0.0": +"@hapi/topo@npm:^5.1.0": version: 5.1.0 resolution: "@hapi/topo@npm:5.1.0" dependencies: @@ -2424,6 +2832,15 @@ __metadata: languageName: node linkType: hard +"@isaacs/fs-minipass@npm:^4.0.0": + version: 4.0.1 + resolution: "@isaacs/fs-minipass@npm:4.0.1" + dependencies: + minipass: ^7.0.4 + checksum: 5d36d289960e886484362d9eb6a51d1ea28baed5f5d0140bbe62b99bac52eaf06cc01c2bc0d3575977962f84f6b2c4387b043ee632216643d4787b0999465bf2 + languageName: node + linkType: hard + "@jest/schemas@npm:^29.6.3": version: 29.6.3 resolution: "@jest/schemas@npm:29.6.3" @@ -2447,105 +2864,260 @@ __metadata: languageName: node linkType: hard -"@jridgewell/gen-mapping@npm:^0.3.0, @jridgewell/gen-mapping@npm:^0.3.2": - version: 0.3.3 - resolution: "@jridgewell/gen-mapping@npm:0.3.3" +"@jridgewell/gen-mapping@npm:^0.3.12, @jridgewell/gen-mapping@npm:^0.3.2, @jridgewell/gen-mapping@npm:^0.3.5": + version: 0.3.12 + resolution: "@jridgewell/gen-mapping@npm:0.3.12" dependencies: - "@jridgewell/set-array": ^1.0.1 - "@jridgewell/sourcemap-codec": ^1.4.10 - "@jridgewell/trace-mapping": ^0.3.9 - checksum: 4a74944bd31f22354fc01c3da32e83c19e519e3bbadafa114f6da4522ea77dd0c2842607e923a591d60a76699d819a2fbb6f3552e277efdb9b58b081390b60ab + "@jridgewell/sourcemap-codec": ^1.5.0 + "@jridgewell/trace-mapping": ^0.3.24 + checksum: 56ee1631945084897f274e65348afbaca7970ce92e3c23b3a23b2fe5d0d2f0c67614f0df0f2bb070e585e944bbaaf0c11cee3a36318ab8a36af46f2fd566bc40 languageName: node linkType: hard "@jridgewell/resolve-uri@npm:^3.1.0": - version: 3.1.1 - resolution: "@jridgewell/resolve-uri@npm:3.1.1" - checksum: f5b441fe7900eab4f9155b3b93f9800a916257f4e8563afbcd3b5a5337b55e52bd8ae6735453b1b745457d9f6cdb16d74cd6220bbdd98cf153239e13f6cbb653 - languageName: node - linkType: hard - -"@jridgewell/set-array@npm:^1.0.1": - version: 1.1.2 - resolution: "@jridgewell/set-array@npm:1.1.2" - checksum: 69a84d5980385f396ff60a175f7177af0b8da4ddb81824cb7016a9ef914eee9806c72b6b65942003c63f7983d4f39a5c6c27185bbca88eb4690b62075602e28e + version: 3.1.2 + resolution: "@jridgewell/resolve-uri@npm:3.1.2" + checksum: 83b85f72c59d1c080b4cbec0fef84528963a1b5db34e4370fa4bd1e3ff64a0d80e0cee7369d11d73c704e0286fb2865b530acac7a871088fbe92b5edf1000870 languageName: node linkType: hard "@jridgewell/source-map@npm:^0.3.3": - version: 0.3.5 - resolution: "@jridgewell/source-map@npm:0.3.5" + version: 0.3.10 + resolution: "@jridgewell/source-map@npm:0.3.10" dependencies: - "@jridgewell/gen-mapping": ^0.3.0 - "@jridgewell/trace-mapping": ^0.3.9 - checksum: 1ad4dec0bdafbade57920a50acec6634f88a0eb735851e0dda906fa9894e7f0549c492678aad1a10f8e144bfe87f238307bf2a914a1bc85b7781d345417e9f6f + "@jridgewell/gen-mapping": ^0.3.5 + "@jridgewell/trace-mapping": ^0.3.25 + checksum: 035d6e6df0e60744506b14033f1569fd5ddc269abeb68bf50c2911118e2a4fa50dab474d49a59a993e4ee6795c4ae5940381e0d09fc204972c5387788d22d010 languageName: node linkType: hard -"@jridgewell/sourcemap-codec@npm:^1.4.10, @jridgewell/sourcemap-codec@npm:^1.4.14": - version: 1.4.15 - resolution: "@jridgewell/sourcemap-codec@npm:1.4.15" - checksum: b881c7e503db3fc7f3c1f35a1dd2655a188cc51a3612d76efc8a6eb74728bef5606e6758ee77423e564092b4a518aba569bbb21c9bac5ab7a35b0c6ae7e344c8 +"@jridgewell/sourcemap-codec@npm:^1.4.14, @jridgewell/sourcemap-codec@npm:^1.5.0": + version: 1.5.4 + resolution: "@jridgewell/sourcemap-codec@npm:1.5.4" + checksum: 959093724bfbc7c1c9aadc08066154f5c1f2acc647b45bd59beec46922cbfc6a9eda4a2114656de5bc00bb3600e420ea9a4cb05e68dcf388619f573b77bd9f0c languageName: node linkType: hard -"@jridgewell/trace-mapping@npm:^0.3.17, @jridgewell/trace-mapping@npm:^0.3.9": - version: 0.3.19 - resolution: "@jridgewell/trace-mapping@npm:0.3.19" +"@jridgewell/trace-mapping@npm:^0.3.18, @jridgewell/trace-mapping@npm:^0.3.24, @jridgewell/trace-mapping@npm:^0.3.25, @jridgewell/trace-mapping@npm:^0.3.28": + version: 0.3.29 + resolution: "@jridgewell/trace-mapping@npm:0.3.29" dependencies: "@jridgewell/resolve-uri": ^3.1.0 "@jridgewell/sourcemap-codec": ^1.4.14 - checksum: 956a6f0f6fec060fb48c6bf1f5ec2064e13cd38c8be3873877d4b92b4a27ba58289a34071752671262a3e3c202abcc3fa2aac64d8447b4b0fa1ba3c9047f1c20 + checksum: 5e92eeafa5131a4f6b7122063833d657f885cb581c812da54f705d7a599ff36a75a4a093a83b0f6c7e95642f5772dd94753f696915e8afea082237abf7423ca3 languageName: node linkType: hard "@leichtgewicht/ip-codec@npm:^2.0.1": - version: 2.0.4 - resolution: "@leichtgewicht/ip-codec@npm:2.0.4" - checksum: 468de1f04d33de6d300892683d7c8aecbf96d1e2c5fe084f95f816e50a054d45b7c1ebfb141a1447d844b86a948733f6eebd92234da8581c84a1ad4de2946a2d + version: 2.0.5 + resolution: "@leichtgewicht/ip-codec@npm:2.0.5" + checksum: 4fcd025d0a923cb6b87b631a83436a693b255779c583158bbeacde6b4dd75b94cc1eba1c9c188de5fc36c218d160524ea08bfe4ef03a056b00ff14126d66f881 + languageName: node + linkType: hard + +"@mdx-js/mdx@npm:^3.0.0": + version: 3.1.0 + resolution: "@mdx-js/mdx@npm:3.1.0" + dependencies: + "@types/estree": ^1.0.0 + "@types/estree-jsx": ^1.0.0 + "@types/hast": ^3.0.0 + "@types/mdx": ^2.0.0 + collapse-white-space: ^2.0.0 + devlop: ^1.0.0 + estree-util-is-identifier-name: ^3.0.0 + estree-util-scope: ^1.0.0 + estree-walker: ^3.0.0 + hast-util-to-jsx-runtime: ^2.0.0 + markdown-extensions: ^2.0.0 + recma-build-jsx: ^1.0.0 + recma-jsx: ^1.0.0 + recma-stringify: ^1.0.0 + rehype-recma: ^1.0.0 + remark-mdx: ^3.0.0 + remark-parse: ^11.0.0 + remark-rehype: ^11.0.0 + source-map: ^0.7.0 + unified: ^11.0.0 + unist-util-position-from-estree: ^2.0.0 + unist-util-stringify-position: ^4.0.0 + unist-util-visit: ^5.0.0 + vfile: ^6.0.0 + checksum: 8a1aa72ddb23294ef28903fc7ad32439a8588106949d789477c2e858e6f068c7b979ae4b2296e820987f7c4d75d6781dafb6fe6a514828bb2ab2b81d89548064 + languageName: node + linkType: hard + +"@mdx-js/react@npm:^3.0.0": + version: 3.1.0 + resolution: "@mdx-js/react@npm:3.1.0" + dependencies: + "@types/mdx": ^2.0.0 + peerDependencies: + "@types/react": ">=16" + react: ">=16" + checksum: c5a9c495f43f498ece24a768762a1743abe2be33d050d7eab731beb754e631700547f039198c6262c998d9a443906bd78811c3fa38bc2fb37659848161dac331 languageName: node linkType: hard -"@mdx-js/mdx@npm:^1.6.22": - version: 1.6.22 - resolution: "@mdx-js/mdx@npm:1.6.22" +"@napi-rs/wasm-runtime@npm:^0.2.3": + version: 0.2.12 + resolution: "@napi-rs/wasm-runtime@npm:0.2.12" dependencies: - "@babel/core": 7.12.9 - "@babel/plugin-syntax-jsx": 7.12.1 - "@babel/plugin-syntax-object-rest-spread": 7.8.3 - "@mdx-js/util": 1.6.22 - babel-plugin-apply-mdx-type-prop: 1.6.22 - babel-plugin-extract-import-names: 1.6.22 - camelcase-css: 2.0.1 - detab: 2.0.4 - hast-util-raw: 6.0.1 - lodash.uniq: 4.5.0 - mdast-util-to-hast: 10.0.1 - remark-footnotes: 2.0.0 - remark-mdx: 1.6.22 - remark-parse: 8.0.3 - remark-squeeze-paragraphs: 4.0.0 - style-to-object: 0.3.0 - unified: 9.2.0 - unist-builder: 2.0.3 - unist-util-visit: 2.0.3 - checksum: 0839b4a3899416326ea6578fe9e470af319da559bc6d3669c60942e456b49a98eebeb3358c623007b4786a2175a450d2c51cd59df64639013c5a3d22366931a6 + "@emnapi/core": ^1.4.3 + "@emnapi/runtime": ^1.4.3 + "@tybys/wasm-util": ^0.10.0 + checksum: 676271082b2e356623faa1fefd552a82abb8c00f8218e333091851456c52c81686b98f77fcd119b9b2f4f215d924e4b23acd6401d9934157c80da17be783ec3d languageName: node linkType: hard -"@mdx-js/react@npm:^1.6.22": - version: 1.6.22 - resolution: "@mdx-js/react@npm:1.6.22" - peerDependencies: - react: ^16.13.1 || ^17.0.0 - checksum: bc84bd514bc127f898819a0c6f1a6915d9541011bd8aefa1fcc1c9bea8939f31051409e546bdec92babfa5b56092a16d05ef6d318304ac029299df5181dc94c8 +"@node-rs/jieba-android-arm-eabi@npm:1.10.4": + version: 1.10.4 + resolution: "@node-rs/jieba-android-arm-eabi@npm:1.10.4" + conditions: os=android & cpu=arm + languageName: node + linkType: hard + +"@node-rs/jieba-android-arm64@npm:1.10.4": + version: 1.10.4 + resolution: "@node-rs/jieba-android-arm64@npm:1.10.4" + conditions: os=android & cpu=arm64 + languageName: node + linkType: hard + +"@node-rs/jieba-darwin-arm64@npm:1.10.4": + version: 1.10.4 + resolution: "@node-rs/jieba-darwin-arm64@npm:1.10.4" + conditions: os=darwin & cpu=arm64 + languageName: node + linkType: hard + +"@node-rs/jieba-darwin-x64@npm:1.10.4": + version: 1.10.4 + resolution: "@node-rs/jieba-darwin-x64@npm:1.10.4" + conditions: os=darwin & cpu=x64 + languageName: node + linkType: hard + +"@node-rs/jieba-freebsd-x64@npm:1.10.4": + version: 1.10.4 + resolution: "@node-rs/jieba-freebsd-x64@npm:1.10.4" + conditions: os=freebsd & cpu=x64 + languageName: node + linkType: hard + +"@node-rs/jieba-linux-arm-gnueabihf@npm:1.10.4": + version: 1.10.4 + resolution: "@node-rs/jieba-linux-arm-gnueabihf@npm:1.10.4" + conditions: os=linux & cpu=arm + languageName: node + linkType: hard + +"@node-rs/jieba-linux-arm64-gnu@npm:1.10.4": + version: 1.10.4 + resolution: "@node-rs/jieba-linux-arm64-gnu@npm:1.10.4" + conditions: os=linux & cpu=arm64 & libc=glibc + languageName: node + linkType: hard + +"@node-rs/jieba-linux-arm64-musl@npm:1.10.4": + version: 1.10.4 + resolution: "@node-rs/jieba-linux-arm64-musl@npm:1.10.4" + conditions: os=linux & cpu=arm64 & libc=musl languageName: node linkType: hard -"@mdx-js/util@npm:1.6.22": - version: 1.6.22 - resolution: "@mdx-js/util@npm:1.6.22" - checksum: 4b393907e39a1a75214f0314bf72a0adfa5e5adffd050dd5efe9c055b8549481a3cfc9f308c16dfb33311daf3ff63added7d5fd1fe52db614c004f886e0e559a +"@node-rs/jieba-linux-x64-gnu@npm:1.10.4": + version: 1.10.4 + resolution: "@node-rs/jieba-linux-x64-gnu@npm:1.10.4" + conditions: os=linux & cpu=x64 & libc=glibc + languageName: node + linkType: hard + +"@node-rs/jieba-linux-x64-musl@npm:1.10.4": + version: 1.10.4 + resolution: "@node-rs/jieba-linux-x64-musl@npm:1.10.4" + conditions: os=linux & cpu=x64 & libc=musl + languageName: node + linkType: hard + +"@node-rs/jieba-wasm32-wasi@npm:1.10.4": + version: 1.10.4 + resolution: "@node-rs/jieba-wasm32-wasi@npm:1.10.4" + dependencies: + "@napi-rs/wasm-runtime": ^0.2.3 + conditions: cpu=wasm32 + languageName: node + linkType: hard + +"@node-rs/jieba-win32-arm64-msvc@npm:1.10.4": + version: 1.10.4 + resolution: "@node-rs/jieba-win32-arm64-msvc@npm:1.10.4" + conditions: os=win32 & cpu=arm64 + languageName: node + linkType: hard + +"@node-rs/jieba-win32-ia32-msvc@npm:1.10.4": + version: 1.10.4 + resolution: "@node-rs/jieba-win32-ia32-msvc@npm:1.10.4" + conditions: os=win32 & cpu=ia32 + languageName: node + linkType: hard + +"@node-rs/jieba-win32-x64-msvc@npm:1.10.4": + version: 1.10.4 + resolution: "@node-rs/jieba-win32-x64-msvc@npm:1.10.4" + conditions: os=win32 & cpu=x64 + languageName: node + linkType: hard + +"@node-rs/jieba@npm:^1.6.0": + version: 1.10.4 + resolution: "@node-rs/jieba@npm:1.10.4" + dependencies: + "@node-rs/jieba-android-arm-eabi": 1.10.4 + "@node-rs/jieba-android-arm64": 1.10.4 + "@node-rs/jieba-darwin-arm64": 1.10.4 + "@node-rs/jieba-darwin-x64": 1.10.4 + "@node-rs/jieba-freebsd-x64": 1.10.4 + "@node-rs/jieba-linux-arm-gnueabihf": 1.10.4 + "@node-rs/jieba-linux-arm64-gnu": 1.10.4 + "@node-rs/jieba-linux-arm64-musl": 1.10.4 + "@node-rs/jieba-linux-x64-gnu": 1.10.4 + "@node-rs/jieba-linux-x64-musl": 1.10.4 + "@node-rs/jieba-wasm32-wasi": 1.10.4 + "@node-rs/jieba-win32-arm64-msvc": 1.10.4 + "@node-rs/jieba-win32-ia32-msvc": 1.10.4 + "@node-rs/jieba-win32-x64-msvc": 1.10.4 + dependenciesMeta: + "@node-rs/jieba-android-arm-eabi": + optional: true + "@node-rs/jieba-android-arm64": + optional: true + "@node-rs/jieba-darwin-arm64": + optional: true + "@node-rs/jieba-darwin-x64": + optional: true + "@node-rs/jieba-freebsd-x64": + optional: true + "@node-rs/jieba-linux-arm-gnueabihf": + optional: true + "@node-rs/jieba-linux-arm64-gnu": + optional: true + "@node-rs/jieba-linux-arm64-musl": + optional: true + "@node-rs/jieba-linux-x64-gnu": + optional: true + "@node-rs/jieba-linux-x64-musl": + optional: true + "@node-rs/jieba-wasm32-wasi": + optional: true + "@node-rs/jieba-win32-arm64-msvc": + optional: true + "@node-rs/jieba-win32-ia32-msvc": + optional: true + "@node-rs/jieba-win32-x64-msvc": + optional: true + checksum: 7e1a0505829902f7ef4ec0aa6355d83af482df9d76e5a46366e8c4fae73cedbe47c34075a7e318bce2be1f738d75104d4494cd9a7f320f9ff8aa276b475ad5a3 languageName: node linkType: hard @@ -2576,12 +3148,25 @@ __metadata: languageName: node linkType: hard -"@npmcli/fs@npm:^3.1.0": - version: 3.1.0 - resolution: "@npmcli/fs@npm:3.1.0" +"@npmcli/agent@npm:^3.0.0": + version: 3.0.0 + resolution: "@npmcli/agent@npm:3.0.0" + dependencies: + agent-base: ^7.1.0 + http-proxy-agent: ^7.0.0 + https-proxy-agent: ^7.0.1 + lru-cache: ^10.0.1 + socks-proxy-agent: ^8.0.3 + checksum: e8fc25d536250ed3e669813b36e8c6d805628b472353c57afd8c4fde0fcfcf3dda4ffe22f7af8c9070812ec2e7a03fb41d7151547cef3508efe661a5a3add20f + languageName: node + linkType: hard + +"@npmcli/fs@npm:^4.0.0": + version: 4.0.0 + resolution: "@npmcli/fs@npm:4.0.0" dependencies: semver: ^7.3.5 - checksum: a50a6818de5fc557d0b0e6f50ec780a7a02ab8ad07e5ac8b16bf519e0ad60a144ac64f97d05c443c3367235d337182e1d012bbac0eb8dbae8dc7b40b193efd0e + checksum: 68951c589e9a4328698a35fd82fe71909a257d6f2ede0434d236fa55634f0fbcad9bb8755553ce5849bd25ee6f019f4d435921ac715c853582c4a7f5983c8d4a languageName: node linkType: hard @@ -2611,19 +3196,46 @@ __metadata: languageName: node linkType: hard -"@polka/url@npm:^1.0.0-next.20": - version: 1.0.0-next.23 - resolution: "@polka/url@npm:1.0.0-next.23" - checksum: 4b0330de1ceecd1002c7e7449094d0c41f2ed0e21765f4835ccc7b003f2f024ac557d503b9ffdf0918cf50b80d5b8c99dfc5a91927e7b3c468b09c6bb42a3c41 +"@pnpm/config.env-replace@npm:^1.1.0": + version: 1.1.0 + resolution: "@pnpm/config.env-replace@npm:1.1.0" + checksum: a3d2b57e35eec9543d9eb085854f6e33e8102dac99fdef2fad2eebdbbfc345e93299f0c20e8eb61c1b4c7aa123bfd47c175678626f161cda65dd147c2b6e1fa0 + languageName: node + linkType: hard + +"@pnpm/network.ca-file@npm:^1.0.1": + version: 1.0.2 + resolution: "@pnpm/network.ca-file@npm:1.0.2" + dependencies: + graceful-fs: 4.2.10 + checksum: d8d0884646500576bd5390464d13db1bb9a62e32a1069293e5bddb2ad8354b354b7e2d2a35e12850025651e795e6a80ce9e601c66312504667b7e3ee7b52becc + languageName: node + linkType: hard + +"@pnpm/npm-conf@npm:^2.1.0": + version: 2.3.1 + resolution: "@pnpm/npm-conf@npm:2.3.1" + dependencies: + "@pnpm/config.env-replace": ^1.1.0 + "@pnpm/network.ca-file": ^1.0.1 + config-chain: ^1.1.11 + checksum: 9e1e1ce5faa64719e866b02d10e28d727d809365eb3692ccfdc420ab6d2073b93abe403994691868f265e34a5601a8eee18ffff6562b27124d971418ba6bb815 + languageName: node + linkType: hard + +"@polka/url@npm:^1.0.0-next.24": + version: 1.0.0-next.29 + resolution: "@polka/url@npm:1.0.0-next.29" + checksum: 69ca11ab15a4ffec7f0b07fcc4e1f01489b3d9683a7e1867758818386575c60c213401259ba3705b8a812228d17e2bfd18e6f021194d943fff4bca389c9d4f28 languageName: node linkType: hard -"@sideway/address@npm:^4.1.3": - version: 4.1.4 - resolution: "@sideway/address@npm:4.1.4" +"@sideway/address@npm:^4.1.5": + version: 4.1.5 + resolution: "@sideway/address@npm:4.1.5" dependencies: "@hapi/hoek": ^9.0.0 - checksum: b9fca2a93ac2c975ba12e0a6d97853832fb1f4fb02393015e012b47fa916a75ca95102d77214b2a29a2784740df2407951af8c5dde054824c65577fd293c4cdb + checksum: 3e3ea0f00b4765d86509282290368a4a5fd39a7995fdc6de42116ca19a96120858e56c2c995081def06e1c53e1f8bccc7d013f6326602bec9d56b72ee2772b9d languageName: node linkType: hard @@ -2648,34 +3260,41 @@ __metadata: languageName: node linkType: hard -"@sindresorhus/is@npm:^0.14.0": - version: 0.14.0 - resolution: "@sindresorhus/is@npm:0.14.0" - checksum: 971e0441dd44ba3909b467219a5e242da0fc584048db5324cfb8048148fa8dcc9d44d71e3948972c4f6121d24e5da402ef191420d1266a95f713bb6d6e59c98a +"@sindresorhus/is@npm:^4.6.0": + version: 4.6.0 + resolution: "@sindresorhus/is@npm:4.6.0" + checksum: 83839f13da2c29d55c97abc3bc2c55b250d33a0447554997a85c539e058e57b8da092da396e252b11ec24a0279a0bed1f537fa26302209327060643e327f81d2 languageName: node linkType: hard -"@slorber/static-site-generator-webpack-plugin@npm:^4.0.7": - version: 4.0.7 - resolution: "@slorber/static-site-generator-webpack-plugin@npm:4.0.7" +"@sindresorhus/is@npm:^5.2.0": + version: 5.6.0 + resolution: "@sindresorhus/is@npm:5.6.0" + checksum: 2e6e0c3acf188dcd9aea0f324ac1b6ad04c9fc672392a7b5a1218512fcde066965797eba8b9fe2108657a504388bd4a6664e6e6602555168e828a6df08b9f10e + languageName: node + linkType: hard + +"@slorber/remark-comment@npm:^1.0.0": + version: 1.0.0 + resolution: "@slorber/remark-comment@npm:1.0.0" dependencies: - eval: ^0.1.8 - p-map: ^4.0.0 - webpack-sources: ^3.2.2 - checksum: a1e1d8b22dd51059524993f3fdd6861db10eb950debc389e5dd650702287fa2004eace03e6bc8f25b977bd7bc01d76a50aa271cbb73c58a8ec558945d728f307 + micromark-factory-space: ^1.0.0 + micromark-util-character: ^1.1.0 + micromark-util-symbol: ^1.0.1 + checksum: c96f1533d09913c57381859966f10a706afd8eb680923924af1c451f3b72f22c31e394028d7535131c10f8682d3c60206da95c50fb4f016fbbd04218c853cc88 languageName: node linkType: hard -"@svgr/babel-plugin-add-jsx-attribute@npm:^6.5.1": - version: 6.5.1 - resolution: "@svgr/babel-plugin-add-jsx-attribute@npm:6.5.1" +"@svgr/babel-plugin-add-jsx-attribute@npm:8.0.0": + version: 8.0.0 + resolution: "@svgr/babel-plugin-add-jsx-attribute@npm:8.0.0" peerDependencies: "@babel/core": ^7.0.0-0 - checksum: cab83832830a57735329ed68f67c03b57ca21fa037b0134847b0c5c0ef4beca89956d7dacfbf7b2a10fd901e7009e877512086db2ee918b8c69aee7742ae32c0 + checksum: 3fc8e35d16f5abe0af5efe5851f27581225ac405d6a1ca44cda0df064cddfcc29a428c48c2e4bef6cebf627c9ac2f652a096030edb02cf5a120ce28d3c234710 languageName: node linkType: hard -"@svgr/babel-plugin-remove-jsx-attribute@npm:*": +"@svgr/babel-plugin-remove-jsx-attribute@npm:8.0.0": version: 8.0.0 resolution: "@svgr/babel-plugin-remove-jsx-attribute@npm:8.0.0" peerDependencies: @@ -2684,7 +3303,7 @@ __metadata: languageName: node linkType: hard -"@svgr/babel-plugin-remove-jsx-empty-expression@npm:*": +"@svgr/babel-plugin-remove-jsx-empty-expression@npm:8.0.0": version: 8.0.0 resolution: "@svgr/babel-plugin-remove-jsx-empty-expression@npm:8.0.0" peerDependencies: @@ -2693,148 +3312,141 @@ __metadata: languageName: node linkType: hard -"@svgr/babel-plugin-replace-jsx-attribute-value@npm:^6.5.1": - version: 6.5.1 - resolution: "@svgr/babel-plugin-replace-jsx-attribute-value@npm:6.5.1" +"@svgr/babel-plugin-replace-jsx-attribute-value@npm:8.0.0": + version: 8.0.0 + resolution: "@svgr/babel-plugin-replace-jsx-attribute-value@npm:8.0.0" peerDependencies: "@babel/core": ^7.0.0-0 - checksum: b7d2125758e766e1ebd14b92216b800bdc976959bc696dbfa1e28682919147c1df4bb8b1b5fd037d7a83026e27e681fea3b8d3741af8d3cf4c9dfa3d412125df + checksum: 1edda65ef4f4dd8f021143c8ec276a08f6baa6f733b8e8ee2e7775597bf6b97afb47fdeefd579d6ae6c959fe2e634f55cd61d99377631212228c8cfb351b8921 languageName: node linkType: hard -"@svgr/babel-plugin-svg-dynamic-title@npm:^6.5.1": - version: 6.5.1 - resolution: "@svgr/babel-plugin-svg-dynamic-title@npm:6.5.1" +"@svgr/babel-plugin-svg-dynamic-title@npm:8.0.0": + version: 8.0.0 + resolution: "@svgr/babel-plugin-svg-dynamic-title@npm:8.0.0" peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 0fd42ebf127ae9163ef341e84972daa99bdcb9e6ed3f83aabd95ee173fddc43e40e02fa847fbc0a1058cf5549f72b7960a2c5e22c3e4ac18f7e3ac81277852ae + checksum: 876cec891488992e6a9aebb8155e2bea4ec461b4718c51de36e988e00e271c6d9d01ef6be17b9effd44b2b3d7db0b41c161a5904a46ae6f38b26b387ad7f3709 languageName: node linkType: hard -"@svgr/babel-plugin-svg-em-dimensions@npm:^6.5.1": - version: 6.5.1 - resolution: "@svgr/babel-plugin-svg-em-dimensions@npm:6.5.1" +"@svgr/babel-plugin-svg-em-dimensions@npm:8.0.0": + version: 8.0.0 + resolution: "@svgr/babel-plugin-svg-em-dimensions@npm:8.0.0" peerDependencies: "@babel/core": ^7.0.0-0 - checksum: c1550ee9f548526fa66fd171e3ffb5696bfc4e4cd108a631d39db492c7410dc10bba4eb5a190e9df824bf806130ccc586ae7d2e43c547e6a4f93bbb29a18f344 + checksum: be0e2d391164428327d9ec469a52cea7d93189c6b0e2c290999e048f597d777852f701c64dca44cd45b31ed14a7f859520326e2e4ad7c3a4545d0aa235bc7e9a languageName: node linkType: hard -"@svgr/babel-plugin-transform-react-native-svg@npm:^6.5.1": - version: 6.5.1 - resolution: "@svgr/babel-plugin-transform-react-native-svg@npm:6.5.1" +"@svgr/babel-plugin-transform-react-native-svg@npm:8.1.0": + version: 8.1.0 + resolution: "@svgr/babel-plugin-transform-react-native-svg@npm:8.1.0" peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 4c924af22b948b812629e80efb90ad1ec8faae26a232d8ca8a06b46b53e966a2c415a57806a3ff0ea806a622612e546422719b69ec6839717a7755dac19171d9 + checksum: 85b434a57572f53bd2b9f0606f253e1fcf57b4a8c554ec3f2d43ed17f50d8cae200cb3aaf1ec9d626e1456e8b135dce530ae047eb0bed6d4bf98a752d6640459 languageName: node linkType: hard -"@svgr/babel-plugin-transform-svg-component@npm:^6.5.1": - version: 6.5.1 - resolution: "@svgr/babel-plugin-transform-svg-component@npm:6.5.1" +"@svgr/babel-plugin-transform-svg-component@npm:8.0.0": + version: 8.0.0 + resolution: "@svgr/babel-plugin-transform-svg-component@npm:8.0.0" peerDependencies: "@babel/core": ^7.0.0-0 - checksum: e496bb5ee871feb6bcab250b6e067322da7dd5c9c2b530b41e5586fe090f86611339b49d0a909c334d9b24cbca0fa755c949a2526c6ad03c6b5885666874cf5f + checksum: 04e2023d75693eeb0890341c40e449881184663056c249be7e5c80168e4aabb0fadd255e8d5d2dbf54b8c2a6e700efba994377135bfa4060dc4a2e860116ef8c languageName: node linkType: hard -"@svgr/babel-preset@npm:^6.5.1": - version: 6.5.1 - resolution: "@svgr/babel-preset@npm:6.5.1" +"@svgr/babel-preset@npm:8.1.0": + version: 8.1.0 + resolution: "@svgr/babel-preset@npm:8.1.0" dependencies: - "@svgr/babel-plugin-add-jsx-attribute": ^6.5.1 - "@svgr/babel-plugin-remove-jsx-attribute": "*" - "@svgr/babel-plugin-remove-jsx-empty-expression": "*" - "@svgr/babel-plugin-replace-jsx-attribute-value": ^6.5.1 - "@svgr/babel-plugin-svg-dynamic-title": ^6.5.1 - "@svgr/babel-plugin-svg-em-dimensions": ^6.5.1 - "@svgr/babel-plugin-transform-react-native-svg": ^6.5.1 - "@svgr/babel-plugin-transform-svg-component": ^6.5.1 + "@svgr/babel-plugin-add-jsx-attribute": 8.0.0 + "@svgr/babel-plugin-remove-jsx-attribute": 8.0.0 + "@svgr/babel-plugin-remove-jsx-empty-expression": 8.0.0 + "@svgr/babel-plugin-replace-jsx-attribute-value": 8.0.0 + "@svgr/babel-plugin-svg-dynamic-title": 8.0.0 + "@svgr/babel-plugin-svg-em-dimensions": 8.0.0 + "@svgr/babel-plugin-transform-react-native-svg": 8.1.0 + "@svgr/babel-plugin-transform-svg-component": 8.0.0 peerDependencies: "@babel/core": ^7.0.0-0 - checksum: 9f124be39a8e64f909162f925b3a63ddaa5a342a5e24fc0b7f7d9d4d7f7e3b916596c754fb557dc259928399cad5366a27cb231627a0d2dcc4b13ac521cf05af + checksum: 3a67930f080b8891e1e8e2595716b879c944d253112bae763dce59807ba23454d162216c8d66a0a0e3d4f38a649ecd6c387e545d1e1261dd69a68e9a3392ee08 languageName: node linkType: hard -"@svgr/core@npm:^6.5.1": - version: 6.5.1 - resolution: "@svgr/core@npm:6.5.1" +"@svgr/core@npm:8.1.0": + version: 8.1.0 + resolution: "@svgr/core@npm:8.1.0" dependencies: - "@babel/core": ^7.19.6 - "@svgr/babel-preset": ^6.5.1 - "@svgr/plugin-jsx": ^6.5.1 + "@babel/core": ^7.21.3 + "@svgr/babel-preset": 8.1.0 camelcase: ^6.2.0 - cosmiconfig: ^7.0.1 - checksum: fd6d6d5da5aeb956703310480b626c1fb3e3973ad9fe8025efc1dcf3d895f857b70d100c63cf32cebb20eb83c9607bafa464c9436e18fe6fe4fafdc73ed6b1a5 + cosmiconfig: ^8.1.3 + snake-case: ^3.0.4 + checksum: da4a12865c7dc59829d58df8bd232d6c85b7115fda40da0d2f844a1a51886e2e945560596ecfc0345d37837ac457de86a931e8b8d8550e729e0c688c02250d8a languageName: node linkType: hard -"@svgr/hast-util-to-babel-ast@npm:^6.5.1": - version: 6.5.1 - resolution: "@svgr/hast-util-to-babel-ast@npm:6.5.1" +"@svgr/hast-util-to-babel-ast@npm:8.0.0": + version: 8.0.0 + resolution: "@svgr/hast-util-to-babel-ast@npm:8.0.0" dependencies: - "@babel/types": ^7.20.0 + "@babel/types": ^7.21.3 entities: ^4.4.0 - checksum: 37923cce1b3f4e2039077b0c570b6edbabe37d1cf1a6ee35e71e0fe00f9cffac450eec45e9720b1010418131a999cb0047331ba1b6d1d2c69af1b92ac785aacf + checksum: 88401281a38bbc7527e65ff5437970414391a86158ef4b4046c89764c156d2d39ecd7cce77be8a51994c9fb3249170cb1eb8b9128b62faaa81743ef6ed3534ab languageName: node linkType: hard -"@svgr/plugin-jsx@npm:^6.5.1": - version: 6.5.1 - resolution: "@svgr/plugin-jsx@npm:6.5.1" +"@svgr/plugin-jsx@npm:8.1.0": + version: 8.1.0 + resolution: "@svgr/plugin-jsx@npm:8.1.0" dependencies: - "@babel/core": ^7.19.6 - "@svgr/babel-preset": ^6.5.1 - "@svgr/hast-util-to-babel-ast": ^6.5.1 + "@babel/core": ^7.21.3 + "@svgr/babel-preset": 8.1.0 + "@svgr/hast-util-to-babel-ast": 8.0.0 svg-parser: ^2.0.4 peerDependencies: - "@svgr/core": ^6.0.0 - checksum: 42f22847a6bdf930514d7bedd3c5e1fd8d53eb3594779f9db16cb94c762425907c375cd8ec789114e100a4d38068aca6c7ab5efea4c612fba63f0630c44cc859 + "@svgr/core": "*" + checksum: 0418a9780753d3544912ee2dad5d2cf8d12e1ba74df8053651b3886aeda54d5f0f7d2dece0af5e0d838332c4f139a57f0dabaa3ca1afa4d1a765efce6a7656f2 languageName: node linkType: hard -"@svgr/plugin-svgo@npm:^6.5.1": - version: 6.5.1 - resolution: "@svgr/plugin-svgo@npm:6.5.1" +"@svgr/plugin-svgo@npm:8.1.0": + version: 8.1.0 + resolution: "@svgr/plugin-svgo@npm:8.1.0" dependencies: - cosmiconfig: ^7.0.1 - deepmerge: ^4.2.2 - svgo: ^2.8.0 + cosmiconfig: ^8.1.3 + deepmerge: ^4.3.1 + svgo: ^3.0.2 peerDependencies: "@svgr/core": "*" - checksum: cd2833530ac0485221adc2146fd992ab20d79f4b12eebcd45fa859721dd779483158e11dfd9a534858fe468416b9412416e25cbe07ac7932c44ed5fa2021c72e + checksum: 59d9d214cebaacca9ca71a561f463d8b7e5a68ca9443e4792a42d903acd52259b1790c0680bc6afecc3f00a255a6cbd7ea278a9f625bac443620ea58a590c2d0 languageName: node linkType: hard -"@svgr/webpack@npm:^6.2.1": - version: 6.5.1 - resolution: "@svgr/webpack@npm:6.5.1" +"@svgr/webpack@npm:^8.1.0": + version: 8.1.0 + resolution: "@svgr/webpack@npm:8.1.0" dependencies: - "@babel/core": ^7.19.6 - "@babel/plugin-transform-react-constant-elements": ^7.18.12 - "@babel/preset-env": ^7.19.4 + "@babel/core": ^7.21.3 + "@babel/plugin-transform-react-constant-elements": ^7.21.3 + "@babel/preset-env": ^7.20.2 "@babel/preset-react": ^7.18.6 - "@babel/preset-typescript": ^7.18.6 - "@svgr/core": ^6.5.1 - "@svgr/plugin-jsx": ^6.5.1 - "@svgr/plugin-svgo": ^6.5.1 - checksum: d10582eb4fa82a5b6d314cb49f2c640af4fd3a60f5b76095d2b14e383ef6a43a6f4674b68774a21787dbde69dec0a251cfcfc3f9a96c82754ba5d5c6daf785f0 + "@babel/preset-typescript": ^7.21.0 + "@svgr/core": 8.1.0 + "@svgr/plugin-jsx": 8.1.0 + "@svgr/plugin-svgo": 8.1.0 + checksum: c6eec5b0cf2fb2ecd3a7a362d272eda35330b17c76802a3481f499b5d07ff8f87b31d2571043bff399b051a1767b1e2e499dbf186104d1c06d76f9f1535fac01 languageName: node linkType: hard -"@szmarczak/http-timer@npm:^1.1.2": - version: 1.1.2 - resolution: "@szmarczak/http-timer@npm:1.1.2" +"@szmarczak/http-timer@npm:^5.0.1": + version: 5.0.1 + resolution: "@szmarczak/http-timer@npm:5.0.1" dependencies: - defer-to-connect: ^1.0.1 - checksum: 4d9158061c5f397c57b4988cde33a163244e4f02df16364f103971957a32886beb104d6180902cbe8b38cb940e234d9f98a4e486200deca621923f62f50a06fe - languageName: node - linkType: hard - -"@tootallnate/once@npm:2": - version: 2.0.0 - resolution: "@tootallnate/once@npm:2.0.0" - checksum: ad87447820dd3f24825d2d947ebc03072b20a42bfc96cbafec16bff8bbda6c1a81fcb0be56d5b21968560c5359a0af4038a68ba150c3e1694fe4c109a063bed8 + defer-to-connect: ^2.0.1 + checksum: fc9cb993e808806692e4a3337c90ece0ec00c89f4b67e3652a356b89730da98bc824273a6d67ca84d5f33cd85f317dcd5ce39d8cc0a2f060145a608a7cb8ce92 languageName: node linkType: hard @@ -2852,110 +3464,167 @@ __metadata: languageName: node linkType: hard +"@tybys/wasm-util@npm:^0.10.0": + version: 0.10.0 + resolution: "@tybys/wasm-util@npm:0.10.0" + dependencies: + tslib: ^2.4.0 + checksum: c3034e0535b91f28dc74c72fc538f353cda0fa9107bb313e8b89f101402b7dc8e400442d07560775cdd7cb63d33549867ed776372fbaa41dc68bcd108e5cff8a + languageName: node + linkType: hard + "@types/body-parser@npm:*": - version: 1.19.3 - resolution: "@types/body-parser@npm:1.19.3" + version: 1.19.6 + resolution: "@types/body-parser@npm:1.19.6" dependencies: "@types/connect": "*" "@types/node": "*" - checksum: 932fa71437c275023799123680ef26ffd90efd37f51a1abe405e6ae6e5b4ad9511b7a3a8f5a12877ed1444a02b6286c0a137a98e914b3c61932390c83643cc2c + checksum: 33041e88eae00af2cfa0827e951e5f1751eafab2a8b6fce06cd89ef368a988907996436b1325180edaeddd1c0c7d0d0d4c20a6c9ff294a91e0039a9db9e9b658 languageName: node linkType: hard "@types/bonjour@npm:^3.5.9": - version: 3.5.11 - resolution: "@types/bonjour@npm:3.5.11" + version: 3.5.13 + resolution: "@types/bonjour@npm:3.5.13" dependencies: "@types/node": "*" - checksum: 12fb86a1bb4a610f16ef6d7d68f85e7c31070029f02b6622073794a271e75abcf58230ed205a2ae23c53be2c08b9e507d3b91fa0dc9dfe76c4b1f5e19e9370cb + checksum: e827570e097bd7d625a673c9c208af2d1a22fa3885c0a1646533cf24394c839c3e5f60ac1bc60c0ddcc69c0615078c9fb2c01b42596c7c582d895d974f2409ee languageName: node linkType: hard "@types/connect-history-api-fallback@npm:^1.3.5": - version: 1.5.1 - resolution: "@types/connect-history-api-fallback@npm:1.5.1" + version: 1.5.4 + resolution: "@types/connect-history-api-fallback@npm:1.5.4" dependencies: "@types/express-serve-static-core": "*" "@types/node": "*" - checksum: bc5e46663300eba56eaf8ef242156256e2bdadc52bb7d6543f4b37f2945b6a810901c245711f8321fce7d94c7b588b308a86519f3e1f87a80eb87841d808dbdc + checksum: e1dee43b8570ffac02d2d47a2b4ba80d3ca0dd1840632dafb221da199e59dbe3778d3d7303c9e23c6b401f37c076935a5bc2aeae1c4e5feaefe1c371fe2073fd languageName: node linkType: hard "@types/connect@npm:*": - version: 3.4.36 - resolution: "@types/connect@npm:3.4.36" + version: 3.4.38 + resolution: "@types/connect@npm:3.4.38" dependencies: "@types/node": "*" - checksum: 4dee3d966fb527b98f0cbbdcf6977c9193fc3204ed539b7522fe5e64dfa45f9017bdda4ffb1f760062262fce7701a0ee1c2f6ce2e50af36c74d4e37052303172 + checksum: 7eb1bc5342a9604facd57598a6c62621e244822442976c443efb84ff745246b10d06e8b309b6e80130026a396f19bf6793b7cecd7380169f369dac3bfc46fb99 languageName: node linkType: hard "@types/debug@npm:^4.0.0": - version: 4.1.9 - resolution: "@types/debug@npm:4.1.9" + version: 4.1.12 + resolution: "@types/debug@npm:4.1.12" dependencies: "@types/ms": "*" - checksum: e88ee8b19d106f33eb0d3bc58bacff9702e98d821fd1ebd1de8942e6b97419e19a1ccf39370f1764a1dc66f79fd4619f3412e1be6eeb9f0b76412f5ffe4ead93 + checksum: 47876a852de8240bfdaf7481357af2b88cb660d30c72e73789abf00c499d6bc7cd5e52f41c915d1b9cd8ec9fef5b05688d7b7aef17f7f272c2d04679508d1053 languageName: node linkType: hard -"@types/eslint-scope@npm:^3.7.3": - version: 3.7.5 - resolution: "@types/eslint-scope@npm:3.7.5" +"@types/eslint-scope@npm:^3.7.7": + version: 3.7.7 + resolution: "@types/eslint-scope@npm:3.7.7" dependencies: "@types/eslint": "*" "@types/estree": "*" - checksum: e91ce335c3791c2cf6084caa0073f90d5b7ae3fcf27785ade8422b7d896159fa14a5a3f1efd31ef03e9ebc1ff04983288280dfe8c9a5579a958539f59df8cc9f + checksum: e2889a124aaab0b89af1bab5959847c5bec09809209255de0e63b9f54c629a94781daa04adb66bffcdd742f5e25a17614fb933965093c0eea64aacda4309380e languageName: node linkType: hard "@types/eslint@npm:*": - version: 8.44.3 - resolution: "@types/eslint@npm:8.44.3" + version: 9.6.1 + resolution: "@types/eslint@npm:9.6.1" dependencies: "@types/estree": "*" "@types/json-schema": "*" - checksum: 3a0d152785400cb83a887a646d9c8877468e686b6fb439635c64856b70dbe91019e588d2b32bc923cd60642bf5dca7f70b2cf61eb431cf25fbdf2932f6e13dd3 + checksum: c286e79707ab604b577cf8ce51d9bbb9780e3d6a68b38a83febe13fa05b8012c92de17c28532fac2b03d3c460123f5055d603a579685325246ca1c86828223e0 languageName: node linkType: hard -"@types/estree@npm:*, @types/estree@npm:^1.0.0": - version: 1.0.2 - resolution: "@types/estree@npm:1.0.2" - checksum: aeedb1b2fe20cbe06f44b99b562bf9703e360bfcdf5bb3d61d248182ee1dd63500f2474e12f098ffe1f5ac3202b43b3e18ec99902d9328d5374f5512fa077e45 +"@types/estree-jsx@npm:^1.0.0": + version: 1.0.5 + resolution: "@types/estree-jsx@npm:1.0.5" + dependencies: + "@types/estree": "*" + checksum: a028ab0cd7b2950168a05c6a86026eb3a36a54a4adfae57f13911d7b49dffe573d9c2b28421b2d029b49b3d02fcd686611be2622dc3dad6d9791166c083f6008 + languageName: node + linkType: hard + +"@types/estree@npm:*, @types/estree@npm:^1.0.0, @types/estree@npm:^1.0.8": + version: 1.0.8 + resolution: "@types/estree@npm:1.0.8" + checksum: bd93e2e415b6f182ec4da1074e1f36c480f1d26add3e696d54fb30c09bc470897e41361c8fd957bf0985024f8fbf1e6e2aff977d79352ef7eb93a5c6dcff6c11 + languageName: node + linkType: hard + +"@types/express-serve-static-core@npm:*, @types/express-serve-static-core@npm:^5.0.0": + version: 5.0.7 + resolution: "@types/express-serve-static-core@npm:5.0.7" + dependencies: + "@types/node": "*" + "@types/qs": "*" + "@types/range-parser": "*" + "@types/send": "*" + checksum: 3539f5866720c081053daeb97d6786614791b382ec2f30b46f05c09076c99ae14c87755b00d8367f7d456535191594d67336dbaa764e8fbbba9ca3dfb15dae00 languageName: node linkType: hard -"@types/express-serve-static-core@npm:*, @types/express-serve-static-core@npm:^4.17.33": - version: 4.17.37 - resolution: "@types/express-serve-static-core@npm:4.17.37" +"@types/express-serve-static-core@npm:^4.17.33": + version: 4.19.6 + resolution: "@types/express-serve-static-core@npm:4.19.6" dependencies: "@types/node": "*" "@types/qs": "*" "@types/range-parser": "*" "@types/send": "*" - checksum: 2dab1380e45eb44e56ecc1be1c42c4b897364d2f2a08e03ca28fbcb1e6866e390217385435813711c046f9acd684424d088855dc32825d5cbecf72c60ecd037f + checksum: b0576eddc2d25ccdf10e68ba09598b87a4d7b2ad04a81dc847cb39fe56beb0b6a5cc017b1e00aa0060cb3b38e700384ce96d291a116a0f1e54895564a104aae9 + languageName: node + linkType: hard + +"@types/express@npm:*": + version: 5.0.3 + resolution: "@types/express@npm:5.0.3" + dependencies: + "@types/body-parser": "*" + "@types/express-serve-static-core": ^5.0.0 + "@types/serve-static": "*" + checksum: bb6f10c14c8e3cce07f79ee172688aa9592852abd7577b663cd0c2054307f172c2b2b36468c918fed0d4ac359b99695807b384b3da6157dfa79acbac2226b59b languageName: node linkType: hard -"@types/express@npm:*, @types/express@npm:^4.17.13": - version: 4.17.18 - resolution: "@types/express@npm:4.17.18" +"@types/express@npm:^4.17.13": + version: 4.17.23 + resolution: "@types/express@npm:4.17.23" dependencies: "@types/body-parser": "*" "@types/express-serve-static-core": ^4.17.33 "@types/qs": "*" "@types/serve-static": "*" - checksum: 8c178da4f0edff1f006d871fbdc3f849620986ff10bad252f3dfd45b57554e26aaa28c602285df028930d5216e257a06fbaf795070f8bb42f7d87e3b689cba50 + checksum: f1a020c6ad6dc0169a3277199605d60649d463a72c920673e0f230ab1e76f2d3aa23daabd25ef8e62eda314e26b879306c58ec806e669e1e40ca37a4b73a44b0 + languageName: node + linkType: hard + +"@types/gtag.js@npm:^0.0.12": + version: 0.0.12 + resolution: "@types/gtag.js@npm:0.0.12" + checksum: 34efc27fbfd0013255b8bfd4af38ded9d5a6ba761130c76f17fd3a9585d83acc88d8005aab667cfec4bdec0e7c7217f689739799a8f61aed0edb929be58b162e languageName: node linkType: hard "@types/hast@npm:^2.0.0": - version: 2.3.6 - resolution: "@types/hast@npm:2.3.6" + version: 2.3.10 + resolution: "@types/hast@npm:2.3.10" dependencies: "@types/unist": ^2 - checksum: c004372f6ab919ec92a2de43e4380707e27b76fe371c7d06ab26547c1e851dfba2a7c740c544218df8c7e0a94443458793c43730ad563a39e3fdc1a48904d7f5 + checksum: 41531b7fbf590b02452996fc63272479c20a07269e370bd6514982cbcd1819b4b84d3ea620f2410d1b9541a23d08ce2eeb0a592145d05e00e249c3d56700d460 + languageName: node + linkType: hard + +"@types/hast@npm:^3.0.0": + version: 3.0.4 + resolution: "@types/hast@npm:3.0.4" + dependencies: + "@types/unist": "*" + checksum: 7a973e8d16fcdf3936090fa2280f408fb2b6a4f13b42edeb5fbd614efe042b82eac68e298e556d50f6b4ad585a3a93c353e9c826feccdc77af59de8dd400d044 languageName: node linkType: hard @@ -2973,97 +3642,115 @@ __metadata: languageName: node linkType: hard +"@types/http-cache-semantics@npm:^4.0.2": + version: 4.0.4 + resolution: "@types/http-cache-semantics@npm:4.0.4" + checksum: 7f4dd832e618bc1e271be49717d7b4066d77c2d4eed5b81198eb987e532bb3e1c7e02f45d77918185bad936f884b700c10cebe06305f50400f382ab75055f9e8 + languageName: node + linkType: hard + "@types/http-errors@npm:*": - version: 2.0.2 - resolution: "@types/http-errors@npm:2.0.2" - checksum: d7f14045240ac4b563725130942b8e5c8080bfabc724c8ff3f166ea928ff7ae02c5194763bc8f6aaf21897e8a44049b0492493b9de3e058247e58fdfe0f86692 + version: 2.0.5 + resolution: "@types/http-errors@npm:2.0.5" + checksum: a88da669366bc483e8f3b3eb3d34ada5f8d13eeeef851b1204d77e2ba6fc42aba4566d877cca5c095204a3f4349b87fe397e3e21288837bdd945dd514120755b languageName: node linkType: hard "@types/http-proxy@npm:^1.17.8": - version: 1.17.12 - resolution: "@types/http-proxy@npm:1.17.12" + version: 1.17.16 + resolution: "@types/http-proxy@npm:1.17.16" dependencies: "@types/node": "*" - checksum: 89700c8e3c8f2c59c87c8db8e7a070c97a3b30a4a38223aca6b8b817e6f2ca931f5a500e16ecadc1ebcfed2676cc60e073d8f887e621d84420298728ec6fd000 + checksum: f5ab4afe7e3feba9d87bdddbf44e03d9a836bd2cdab679a794badbff7c4bfb6bebf46bfe22d9964eb1820e1349f2ff7807cccb20fd27cb17f03db849289e5892 languageName: node linkType: hard "@types/istanbul-lib-coverage@npm:*, @types/istanbul-lib-coverage@npm:^2.0.0": - version: 2.0.4 - resolution: "@types/istanbul-lib-coverage@npm:2.0.4" - checksum: a25d7589ee65c94d31464c16b72a9dc81dfa0bea9d3e105ae03882d616e2a0712a9c101a599ec482d297c3591e16336962878cb3eb1a0a62d5b76d277a890ce7 + version: 2.0.6 + resolution: "@types/istanbul-lib-coverage@npm:2.0.6" + checksum: 3feac423fd3e5449485afac999dcfcb3d44a37c830af898b689fadc65d26526460bedb889db278e0d4d815a670331796494d073a10ee6e3a6526301fe7415778 languageName: node linkType: hard "@types/istanbul-lib-report@npm:*": - version: 3.0.1 - resolution: "@types/istanbul-lib-report@npm:3.0.1" + version: 3.0.3 + resolution: "@types/istanbul-lib-report@npm:3.0.3" dependencies: "@types/istanbul-lib-coverage": "*" - checksum: cfc66de48577bb7b2636a6afded7056483693c3ea70916276518cdfaa0d4b51bf564ded88fb13e75716665c3af3d4d54e9c2de042c0219dcabad7e81c398688b + checksum: b91e9b60f865ff08cb35667a427b70f6c2c63e88105eadd29a112582942af47ed99c60610180aa8dcc22382fa405033f141c119c69b95db78c4c709fbadfeeb4 languageName: node linkType: hard "@types/istanbul-reports@npm:^3.0.0": - version: 3.0.2 - resolution: "@types/istanbul-reports@npm:3.0.2" + version: 3.0.4 + resolution: "@types/istanbul-reports@npm:3.0.4" dependencies: "@types/istanbul-lib-report": "*" - checksum: f52028d6fe4d28f0085dd7ed66ccfa6af632579e9a4091b90928ffef93d4dbec0bacd49e9caf1b939d05df9eafc5ac1f5939413cdf8ac59fbe4b29602d4d0939 + checksum: 93eb18835770b3431f68ae9ac1ca91741ab85f7606f310a34b3586b5a34450ec038c3eed7ab19266635499594de52ff73723a54a72a75b9f7d6a956f01edee95 languageName: node linkType: hard -"@types/json-schema@npm:*, @types/json-schema@npm:^7.0.4, @types/json-schema@npm:^7.0.5, @types/json-schema@npm:^7.0.8, @types/json-schema@npm:^7.0.9": - version: 7.0.13 - resolution: "@types/json-schema@npm:7.0.13" - checksum: 345df21a678fa72fb389f35f33de77833d09d4a142bb2bcb27c18690efa4cf70fc2876e43843cefb3fbdb9fcb12cd3e970a90936df30f53bbee899865ff605ab +"@types/json-schema@npm:*, @types/json-schema@npm:^7.0.15, @types/json-schema@npm:^7.0.8, @types/json-schema@npm:^7.0.9": + version: 7.0.15 + resolution: "@types/json-schema@npm:7.0.15" + checksum: 97ed0cb44d4070aecea772b7b2e2ed971e10c81ec87dd4ecc160322ffa55ff330dace1793489540e3e318d90942064bb697cc0f8989391797792d919737b3b98 languageName: node linkType: hard -"@types/keyv@npm:^3.1.1": - version: 3.1.4 - resolution: "@types/keyv@npm:3.1.4" +"@types/mdast@npm:^3.0.0": + version: 3.0.15 + resolution: "@types/mdast@npm:3.0.15" dependencies: - "@types/node": "*" - checksum: e009a2bfb50e90ca9b7c6e8f648f8464067271fd99116f881073fa6fa76dc8d0133181dd65e6614d5fb1220d671d67b0124aef7d97dc02d7e342ab143a47779d + "@types/unist": ^2 + checksum: af85042a4e3af3f879bde4059fa9e76c71cb552dffc896cdcc6cf9dc1fd38e37035c2dbd6245cfa6535b433f1f0478f5549696234ccace47a64055a10c656530 languageName: node linkType: hard -"@types/mdast@npm:^3.0.0": - version: 3.0.13 - resolution: "@types/mdast@npm:3.0.13" +"@types/mdast@npm:^4.0.0, @types/mdast@npm:^4.0.2": + version: 4.0.4 + resolution: "@types/mdast@npm:4.0.4" dependencies: - "@types/unist": ^2 - checksum: f13fa17a2931ed1492a2f0012a3abd6de3a2d1128145981321909e03fedba80162668f284a4af92aca3732b27e933c5f4772336d96b9ae660bfde696d07abbe6 + "@types/unist": "*" + checksum: 20c4e9574cc409db662a35cba52b068b91eb696b3049e94321219d47d34c8ccc99a142be5c76c80a538b612457b03586bc2f6b727a3e9e7530f4c8568f6282ee languageName: node linkType: hard -"@types/mime@npm:*": - version: 3.0.2 - resolution: "@types/mime@npm:3.0.2" - checksum: 09cf74f6377d1b27f4a24512cb689ad30af59880ac473ed6f7bc5285ecde88bbe8fe500789340ad57810da9d6fe1704f86e8bfe147b9ea76d58925204a60b906 +"@types/mdx@npm:^2.0.0": + version: 2.0.13 + resolution: "@types/mdx@npm:2.0.13" + checksum: 195137b548e75a85f0558bb1ca5088aff1c01ae0fc64454da06085b7513a043356d0bb51ed559d3cbc7ad724ccd8cef2a7d07d014b89a47a74dff8875ceb3b15 languageName: node linkType: hard "@types/mime@npm:^1": - version: 1.3.3 - resolution: "@types/mime@npm:1.3.3" - checksum: 7e27dede6517c1d604821a8a5412d6b7131decc8397ad4bac9216fc90dea26c9571426623ebeea2a9b89dbfb89ad98f7370a3c62cd2be8896c6e897333b117c9 + version: 1.3.5 + resolution: "@types/mime@npm:1.3.5" + checksum: e29a5f9c4776f5229d84e525b7cd7dd960b51c30a0fb9a028c0821790b82fca9f672dab56561e2acd9e8eed51d431bde52eafdfef30f643586c4162f1aecfc78 languageName: node linkType: hard "@types/ms@npm:*": - version: 0.7.32 - resolution: "@types/ms@npm:0.7.32" - checksum: 610744605c5924aa2657c8a62d307052af4f0e38e2aa015f154ef03391fabb4fd903f9c9baacb41f6e5798b8697e898463c351e5faf638738603ed29137b5254 + version: 2.1.0 + resolution: "@types/ms@npm:2.1.0" + checksum: 532d2ebb91937ccc4a89389715e5b47d4c66e708d15942fe6cc25add6dc37b2be058230a327dd50f43f89b8b6d5d52b74685a9e8f70516edfc9bdd6be910eff4 + languageName: node + linkType: hard + +"@types/node-forge@npm:^1.3.0": + version: 1.3.13 + resolution: "@types/node-forge@npm:1.3.13" + dependencies: + "@types/node": "*" + checksum: dee446d958e7098c8ad74076843d27cb46908632cf289f732ccc5c0a2c1e62927df44d22725bd37a84579ea3336e52b4c064385c53e22b741e277d07c9da20cb languageName: node linkType: hard "@types/node@npm:*": - version: 20.8.3 - resolution: "@types/node@npm:20.8.3" - checksum: bfb88b341faeb19f8fd37306a3bf433721b876c6491d10fcb0b13fd26601fa36ee45113dd82b1e1c23e3c957dff5b99f81a16493cefa03abe797e41a2487a4f7 + version: 24.0.15 + resolution: "@types/node@npm:24.0.15" + dependencies: + undici-types: ~7.8.0 + checksum: 27f31e6976587efdfd13c0024703d7e11e6a27a6af48d488c6e5662733c9e8d47ac059e38cd9d491425f68f0c5e8e2bc060859b0b66afe79af0697acb0c25e4d languageName: node linkType: hard @@ -3074,49 +3761,42 @@ __metadata: languageName: node linkType: hard -"@types/parse-json@npm:^4.0.0": - version: 4.0.0 - resolution: "@types/parse-json@npm:4.0.0" - checksum: fd6bce2b674b6efc3db4c7c3d336bd70c90838e8439de639b909ce22f3720d21344f52427f1d9e57b265fcb7f6c018699b99e5e0c208a1a4823014269a6bf35b - languageName: node - linkType: hard - -"@types/parse5@npm:^5.0.0": - version: 5.0.3 - resolution: "@types/parse5@npm:5.0.3" - checksum: d6b7495cb1850f9f2e9c5e103ede9f2d30a5320669707b105c403868adc9e4bf8d3a7ff314cc23f67826bbbbbc0e6147346ce9062ab429f099dba7a01f463919 +"@types/prismjs@npm:^1.26.0": + version: 1.26.5 + resolution: "@types/prismjs@npm:1.26.5" + checksum: d208b04ee9b6de6b2dc916439a81baa47e64ab3659a66d3d34bc3e42faccba9d4b26f590d76f97f7978d1dfaafa0861f81172b1e3c68696dd7a42d73aaaf5b7b languageName: node linkType: hard -"@types/prop-types@npm:*, @types/prop-types@npm:^15.0.0": - version: 15.7.8 - resolution: "@types/prop-types@npm:15.7.8" - checksum: 61dfad79da8b1081c450bab83b77935df487ae1cdd4660ec7df6be8e74725c15fa45cf486ce057addc956ca4ae78300b97091e2a25061133d1b9a1440bc896ae +"@types/prop-types@npm:^15.0.0": + version: 15.7.15 + resolution: "@types/prop-types@npm:15.7.15" + checksum: 31aa2f59b28f24da6fb4f1d70807dae2aedfce090ec63eaf9ea01727a9533ef6eaf017de5bff99fbccad7d1c9e644f52c6c2ba30869465dd22b1a7221c29f356 languageName: node linkType: hard "@types/qs@npm:*": - version: 6.9.8 - resolution: "@types/qs@npm:6.9.8" - checksum: c28e07d00d07970e5134c6eed184a0189b8a4649e28fdf36d9117fe671c067a44820890de6bdecef18217647a95e9c6aebdaaae69f5fe4b0bec9345db885f77e + version: 6.14.0 + resolution: "@types/qs@npm:6.14.0" + checksum: 1909205514d22b3cbc7c2314e2bd8056d5f05dfb21cf4377f0730ee5e338ea19957c41735d5e4806c746176563f50005bbab602d8358432e25d900bdf4970826 languageName: node linkType: hard "@types/range-parser@npm:*": - version: 1.2.5 - resolution: "@types/range-parser@npm:1.2.5" - checksum: db9aaa04a02d019395a9a4346475669a2864a32a6477ad0fc457bd2ef39a167cabe742f55a8a3fa8bc90abac795b716c22b37348bc3e19313ebe6c9310815233 + version: 1.2.7 + resolution: "@types/range-parser@npm:1.2.7" + checksum: 95640233b689dfbd85b8c6ee268812a732cf36d5affead89e806fe30da9a430767af8ef2cd661024fd97e19d61f3dec75af2df5e80ec3bea000019ab7028629a languageName: node linkType: hard -"@types/react-router-config@npm:*, @types/react-router-config@npm:^5.0.6": - version: 5.0.8 - resolution: "@types/react-router-config@npm:5.0.8" +"@types/react-router-config@npm:*, @types/react-router-config@npm:^5.0.7": + version: 5.0.11 + resolution: "@types/react-router-config@npm:5.0.11" dependencies: "@types/history": ^4.7.11 "@types/react": "*" "@types/react-router": ^5.1.0 - checksum: afbd96e526fcdd19a3c8604912496a5a7ecfdcd848632a003ef8af69701ca74f14451e4fac93d265b678ca07c82ec4a103126f64c040a4aefa1a8172619be2bd + checksum: 4b72d9b71e0576e193c11e5085bbdac43f31debfa3b6ebc24666f3d646ef25c1f57f16c29b1ddd3051c881e85f8e0d4ab5a7bbd5fc215b9377f57675b210be7c languageName: node linkType: hard @@ -3142,22 +3822,11 @@ __metadata: linkType: hard "@types/react@npm:*": - version: 18.2.25 - resolution: "@types/react@npm:18.2.25" + version: 19.1.8 + resolution: "@types/react@npm:19.1.8" dependencies: - "@types/prop-types": "*" - "@types/scheduler": "*" csstype: ^3.0.2 - checksum: 177515cd44135d56191ec6c5c10edd490c96c175d37624d9c37bc2007c3abcf6cc2d2137d2a073d692cdc5129d5d5785bd60a6ddd315f695da5d8b989fa2afc5 - languageName: node - linkType: hard - -"@types/responselike@npm:^1.0.0": - version: 1.0.1 - resolution: "@types/responselike@npm:1.0.1" - dependencies: - "@types/node": "*" - checksum: ae8c36c9354aaedfa462dab655aa17613529d545a418acc54ba0214145fc1d0454be2ae107031a1b2c24768f19f2af7e4096a85d1e604010becd0bec2355cb0e + checksum: 17e0c74d9c01214938fa805aaa8b97925bf3c5514e88fdf94bec42c0a6d4abbc63d4e30255db176f46fd7f0aa89f8085b9b2b2fa5abaffbbf7e5009386ada892 languageName: node linkType: hard @@ -3169,96 +3838,96 @@ __metadata: linkType: hard "@types/sax@npm:^1.2.1": - version: 1.2.5 - resolution: "@types/sax@npm:1.2.5" + version: 1.2.7 + resolution: "@types/sax@npm:1.2.7" dependencies: "@types/node": "*" - checksum: a4bf27d7eb1b99030e75dea01fab2fa3959554f5c463b4f577dbbc9d8ed88a5b26b83ac84d045ae5a53e350057f120574db6e1c4e8507c011299dd023e4fa4f2 - languageName: node - linkType: hard - -"@types/scheduler@npm:*": - version: 0.16.4 - resolution: "@types/scheduler@npm:0.16.4" - checksum: a57b0f10da1b021e6bd5eeef8a1917dd3b08a8715bd8029e2ded2096d8f091bb1bb1fef2d66e139588a983c4bfbad29b59e48011141725fa83c76e986e1257d7 + checksum: 7ece5fbb5d9c8fc76ab0de2f99d705edf92f18e701d4f9d9b0647275e32eb65e656c1badf9dfaa12f4e1ff3e250561c8c9cfe79e8b5f33dd1417ac0f1804f6cc languageName: node linkType: hard "@types/semver@npm:^7.3.12": - version: 7.5.3 - resolution: "@types/semver@npm:7.5.3" - checksum: 349fdd1ab6c213bac5c991bac766bd07b8b12e63762462bb058740dcd2eb09c8193d068bb226f134661275f2022976214c0e727a4e5eb83ec1b131127c980d3e + version: 7.7.0 + resolution: "@types/semver@npm:7.7.0" + checksum: d488eaeddb23879a0a8a759bed667e1a76cb0dd4d23e3255538e24c189db387357953ca9e7a3bda2bb7f95e84cac8fe0db4fbe6b3456e893043337732d1d23cc languageName: node linkType: hard "@types/send@npm:*": - version: 0.17.2 - resolution: "@types/send@npm:0.17.2" + version: 0.17.5 + resolution: "@types/send@npm:0.17.5" dependencies: "@types/mime": ^1 "@types/node": "*" - checksum: 1ff5b1bd6a4f6fdc6402c7024781ff5dbd0e1f51a43c69529fb67c710943c7416d2f0d77c57c70fccf6616f25f838f32f960284526e408d4edae2e91e1fce95a + checksum: bff5add75eb178c3b80bebc422db483c76eeb2cb5016508c952e4fc67d968794f9c709b978d086bf60e4d6fbfe8c0b77e99a7603a615c671c1f97f808458d4a8 languageName: node linkType: hard "@types/serve-index@npm:^1.9.1": - version: 1.9.2 - resolution: "@types/serve-index@npm:1.9.2" + version: 1.9.4 + resolution: "@types/serve-index@npm:1.9.4" dependencies: "@types/express": "*" - checksum: 4fd0a8fcdd6e2b2d7704a539b7c1e0d143e9e00be4c3992394fe2ef7e9b67283d74b43db3f92b0e0717d779aa51184168bbae617d30456357cb95ec58aa59ea8 + checksum: 72727c88d54da5b13275ebfb75dcdc4aa12417bbe9da1939e017c4c5f0c906fae843aa4e0fbfe360e7ee9df2f3d388c21abfc488f77ce58693fb57809f8ded92 languageName: node linkType: hard "@types/serve-static@npm:*, @types/serve-static@npm:^1.13.10": - version: 1.15.3 - resolution: "@types/serve-static@npm:1.15.3" + version: 1.15.8 + resolution: "@types/serve-static@npm:1.15.8" dependencies: "@types/http-errors": "*" - "@types/mime": "*" "@types/node": "*" - checksum: afa52252f0ba94cdb5391e80f23e17fd629bdf2a31be8876e2c4490312ed6b0570822dd7de7cea04c9002049e207709563568b7f4ee10bb9f456321db1e83e40 + "@types/send": "*" + checksum: 41e0fb40bfdf3b5c2ac997c5dd5d58af9229e6a325dab1cf5f73b488b09635d933c1aa6f0e3265d6df8b45be0d09af36a9ffe90175088726f1db6bf104bf9ecf languageName: node linkType: hard "@types/sockjs@npm:^0.3.33": - version: 0.3.34 - resolution: "@types/sockjs@npm:0.3.34" + version: 0.3.36 + resolution: "@types/sockjs@npm:0.3.36" dependencies: "@types/node": "*" - checksum: 1d38b1976a97f5895a6be00cead1b2a59d842f023b6e35450b7eec8a3131c860c447aba3f7ea3c880c066d8277b0c76fae9d080be1aad475811b568ed6079d49 + checksum: b4b5381122465d80ea8b158537c00bc82317222d3fb31fd7229ff25b31fa89134abfbab969118da55622236bf3d8fee75759f3959908b5688991f492008f29bc + languageName: node + linkType: hard + +"@types/unist@npm:*, @types/unist@npm:^3.0.0": + version: 3.0.3 + resolution: "@types/unist@npm:3.0.3" + checksum: 96e6453da9e075aaef1dc22482463898198acdc1eeb99b465e65e34303e2ec1e3b1ed4469a9118275ec284dc98019f63c3f5d49422f0e4ac707e5ab90fb3b71a languageName: node linkType: hard -"@types/unist@npm:^2, @types/unist@npm:^2.0.0, @types/unist@npm:^2.0.2, @types/unist@npm:^2.0.3": - version: 2.0.8 - resolution: "@types/unist@npm:2.0.8" - checksum: f4852d10a6752dc70df363917ef74453e5d2fd42824c0f6d09d19d530618e1402193977b1207366af4415aaec81d4e262c64d00345402020c4ca179216e553c7 +"@types/unist@npm:^2, @types/unist@npm:^2.0.0": + version: 2.0.11 + resolution: "@types/unist@npm:2.0.11" + checksum: 6d436e832bc35c6dde9f056ac515ebf2b3384a1d7f63679d12358766f9b313368077402e9c1126a14d827f10370a5485e628bf61aa91117cf4fc882423191a4e languageName: node linkType: hard "@types/ws@npm:^8.5.5": - version: 8.5.6 - resolution: "@types/ws@npm:8.5.6" + version: 8.18.1 + resolution: "@types/ws@npm:8.18.1" dependencies: "@types/node": "*" - checksum: 7addb0c5fa4e7713d5209afb8a90f1852b12c02cb537395adf7a05fbaf21205dc5f7c110fd5ad6f3dbf147112cbff33fb11d8633059cb344f0c14f595b1ea1fb + checksum: 0331b14cde388e2805af66cad3e3f51857db8e68ed91e5b99750915e96fe7572e58296dc99999331bbcf08f0ff00a227a0bb214e991f53c2a5aca7b0e71173fa languageName: node linkType: hard "@types/yargs-parser@npm:*": - version: 21.0.1 - resolution: "@types/yargs-parser@npm:21.0.1" - checksum: 64e6316c2045e2d460c4fb79572f872f9d2f98fddc6d9d3949c71f0b6ad0ef8a2706cf49db26dfb02a9cb81433abb8f340f015e1d20a9692279abe9477b72c8e + version: 21.0.3 + resolution: "@types/yargs-parser@npm:21.0.3" + checksum: ef236c27f9432983e91432d974243e6c4cdae227cb673740320eff32d04d853eed59c92ca6f1142a335cfdc0e17cccafa62e95886a8154ca8891cc2dec4ee6fc languageName: node linkType: hard "@types/yargs@npm:^17.0.8": - version: 17.0.28 - resolution: "@types/yargs@npm:17.0.28" + version: 17.0.33 + resolution: "@types/yargs@npm:17.0.33" dependencies: "@types/yargs-parser": "*" - checksum: f78c5e5c29903933c0557b4ffcd1d0b8564d66859c8ca4aa51da3714e49109ed7c2644334a1918d033df19028f4cecc91fd2e502651bb8e8451f246c371da847 + checksum: ee013f257472ab643cb0584cf3e1ff9b0c44bca1c9ba662395300a7f1a6c55fa9d41bd40ddff42d99f5d95febb3907c9ff600fbcb92dadbec22c6a76de7e1236 languageName: node linkType: hard @@ -3355,7 +4024,7 @@ __metadata: languageName: node linkType: hard -"@typescript-eslint/utils@npm:5.62.0, @typescript-eslint/utils@npm:^5.30.5": +"@typescript-eslint/utils@npm:5.62.0, @typescript-eslint/utils@npm:^5.62.0": version: 5.62.0 resolution: "@typescript-eslint/utils@npm:5.62.0" dependencies: @@ -3383,161 +4052,161 @@ __metadata: languageName: node linkType: hard -"@ungap/structured-clone@npm:^1.2.0": - version: 1.2.0 - resolution: "@ungap/structured-clone@npm:1.2.0" - checksum: 4f656b7b4672f2ce6e272f2427d8b0824ed11546a601d8d5412b9d7704e83db38a8d9f402ecdf2b9063fc164af842ad0ec4a55819f621ed7e7ea4d1efcc74524 +"@ungap/structured-clone@npm:^1.0.0, @ungap/structured-clone@npm:^1.2.0": + version: 1.3.0 + resolution: "@ungap/structured-clone@npm:1.3.0" + checksum: 64ed518f49c2b31f5b50f8570a1e37bde3b62f2460042c50f132430b2d869c4a6586f13aa33a58a4722715b8158c68cae2827389d6752ac54da2893c83e480fc languageName: node linkType: hard -"@webassemblyjs/ast@npm:1.11.6, @webassemblyjs/ast@npm:^1.11.5": - version: 1.11.6 - resolution: "@webassemblyjs/ast@npm:1.11.6" +"@webassemblyjs/ast@npm:1.14.1, @webassemblyjs/ast@npm:^1.14.1": + version: 1.14.1 + resolution: "@webassemblyjs/ast@npm:1.14.1" dependencies: - "@webassemblyjs/helper-numbers": 1.11.6 - "@webassemblyjs/helper-wasm-bytecode": 1.11.6 - checksum: 38ef1b526ca47c210f30975b06df2faf1a8170b1636ce239fc5738fc231ce28389dd61ecedd1bacfc03cbe95b16d1af848c805652080cb60982836eb4ed2c6cf + "@webassemblyjs/helper-numbers": 1.13.2 + "@webassemblyjs/helper-wasm-bytecode": 1.13.2 + checksum: f9154ad9ea14f6f2374ebe918c221fd69a4d4514126a1acc6fa4966e8d27ab28cb550a5e6880032cf620e19640578658a7e5a55bd2aad1e3db4e9d598b8f2099 languageName: node linkType: hard -"@webassemblyjs/floating-point-hex-parser@npm:1.11.6": - version: 1.11.6 - resolution: "@webassemblyjs/floating-point-hex-parser@npm:1.11.6" - checksum: 29b08758841fd8b299c7152eda36b9eb4921e9c584eb4594437b5cd90ed6b920523606eae7316175f89c20628da14326801090167cc7fbffc77af448ac84b7e2 +"@webassemblyjs/floating-point-hex-parser@npm:1.13.2": + version: 1.13.2 + resolution: "@webassemblyjs/floating-point-hex-parser@npm:1.13.2" + checksum: e866ec8433f4a70baa511df5e8f2ebcd6c24f4e2cc6274c7c5aabe2bcce3459ea4680e0f35d450e1f3602acf3913b6b8e4f15069c8cfd34ae8609fb9a7d01795 languageName: node linkType: hard -"@webassemblyjs/helper-api-error@npm:1.11.6": - version: 1.11.6 - resolution: "@webassemblyjs/helper-api-error@npm:1.11.6" - checksum: e8563df85161096343008f9161adb138a6e8f3c2cc338d6a36011aa55eabb32f2fd138ffe63bc278d009ada001cc41d263dadd1c0be01be6c2ed99076103689f +"@webassemblyjs/helper-api-error@npm:1.13.2": + version: 1.13.2 + resolution: "@webassemblyjs/helper-api-error@npm:1.13.2" + checksum: 48b5df7fd3095bb252f59a139fe2cbd999a62ac9b488123e9a0da3906ad8a2f2da7b2eb21d328c01a90da987380928706395c2897d1f3ed9e2125b6d75a920d0 languageName: node linkType: hard -"@webassemblyjs/helper-buffer@npm:1.11.6": - version: 1.11.6 - resolution: "@webassemblyjs/helper-buffer@npm:1.11.6" - checksum: b14d0573bf680d22b2522e8a341ec451fddd645d1f9c6bd9012ccb7e587a2973b86ab7b89fe91e1c79939ba96095f503af04369a3b356c8023c13a5893221644 +"@webassemblyjs/helper-buffer@npm:1.14.1": + version: 1.14.1 + resolution: "@webassemblyjs/helper-buffer@npm:1.14.1" + checksum: b611e981dfd6a797c3d8fc3a772de29a6e55033737c2c09c31bb66c613bdbb2d25f915df1dee62a602c6acc057ca71128432fa8c3e22a893e1219dc454f14ede languageName: node linkType: hard -"@webassemblyjs/helper-numbers@npm:1.11.6": - version: 1.11.6 - resolution: "@webassemblyjs/helper-numbers@npm:1.11.6" +"@webassemblyjs/helper-numbers@npm:1.13.2": + version: 1.13.2 + resolution: "@webassemblyjs/helper-numbers@npm:1.13.2" dependencies: - "@webassemblyjs/floating-point-hex-parser": 1.11.6 - "@webassemblyjs/helper-api-error": 1.11.6 + "@webassemblyjs/floating-point-hex-parser": 1.13.2 + "@webassemblyjs/helper-api-error": 1.13.2 "@xtuc/long": 4.2.2 - checksum: f4b562fa219f84368528339e0f8d273ad44e047a07641ffcaaec6f93e5b76fd86490a009aa91a294584e1436d74b0a01fa9fde45e333a4c657b58168b04da424 + checksum: 49e2c9bf9b66997e480f6b44d80f895b3cde4de52ac135921d28e144565edca6903a519f627f4089b5509de1d7f9e5023f0e1a94ff78a36c9e2eb30e7c18ffd2 languageName: node linkType: hard -"@webassemblyjs/helper-wasm-bytecode@npm:1.11.6": - version: 1.11.6 - resolution: "@webassemblyjs/helper-wasm-bytecode@npm:1.11.6" - checksum: 3535ef4f1fba38de3475e383b3980f4bbf3de72bbb631c2b6584c7df45be4eccd62c6ff48b5edd3f1bcff275cfd605a37679ec199fc91fd0a7705d7f1e3972dc +"@webassemblyjs/helper-wasm-bytecode@npm:1.13.2": + version: 1.13.2 + resolution: "@webassemblyjs/helper-wasm-bytecode@npm:1.13.2" + checksum: 8e059e1c1f0294f4fc3df8e4eaff3c5ef6e2e1358f34ebc118eaf5070ed59e56ed7fc92b28be734ebde17c8d662d5d27e06ade686c282445135da083ae11c128 languageName: node linkType: hard -"@webassemblyjs/helper-wasm-section@npm:1.11.6": - version: 1.11.6 - resolution: "@webassemblyjs/helper-wasm-section@npm:1.11.6" +"@webassemblyjs/helper-wasm-section@npm:1.14.1": + version: 1.14.1 + resolution: "@webassemblyjs/helper-wasm-section@npm:1.14.1" dependencies: - "@webassemblyjs/ast": 1.11.6 - "@webassemblyjs/helper-buffer": 1.11.6 - "@webassemblyjs/helper-wasm-bytecode": 1.11.6 - "@webassemblyjs/wasm-gen": 1.11.6 - checksum: b2cf751bf4552b5b9999d27bbb7692d0aca75260140195cb58ea6374d7b9c2dc69b61e10b211a0e773f66209c3ddd612137ed66097e3684d7816f854997682e9 + "@webassemblyjs/ast": 1.14.1 + "@webassemblyjs/helper-buffer": 1.14.1 + "@webassemblyjs/helper-wasm-bytecode": 1.13.2 + "@webassemblyjs/wasm-gen": 1.14.1 + checksum: 0a08d454a63192cd66abf91b6f060ac4b466cef341262246e9dcc828dd4c8536195dea9b46a1244b1eac65b59b8b502164a771a190052a92ff0a0a2ded0f8f53 languageName: node linkType: hard -"@webassemblyjs/ieee754@npm:1.11.6": - version: 1.11.6 - resolution: "@webassemblyjs/ieee754@npm:1.11.6" +"@webassemblyjs/ieee754@npm:1.13.2": + version: 1.13.2 + resolution: "@webassemblyjs/ieee754@npm:1.13.2" dependencies: "@xtuc/ieee754": ^1.2.0 - checksum: 13574b8e41f6ca39b700e292d7edf102577db5650fe8add7066a320aa4b7a7c09a5056feccac7a74eb68c10dea9546d4461412af351f13f6b24b5f32379b49de + checksum: d7e3520baa37a7309fa7db4d73d69fb869878853b1ebd4b168821bd03fcc4c0e1669c06231315b0039035d9a7a462e53de3ad982da4a426a4b0743b5888e8673 languageName: node linkType: hard -"@webassemblyjs/leb128@npm:1.11.6": - version: 1.11.6 - resolution: "@webassemblyjs/leb128@npm:1.11.6" +"@webassemblyjs/leb128@npm:1.13.2": + version: 1.13.2 + resolution: "@webassemblyjs/leb128@npm:1.13.2" dependencies: "@xtuc/long": 4.2.2 - checksum: 7ea942dc9777d4b18a5ebfa3a937b30ae9e1d2ce1fee637583ed7f376334dd1d4274f813d2e250056cca803e0952def4b954913f1a3c9068bcd4ab4ee5143bf0 + checksum: 64083507f7cff477a6d71a9e325d95665cea78ec8df99ca7c050e1cfbe300fbcf0842ca3dcf3b4fa55028350135588a4f879398d3dd2b6a8de9913ce7faf5333 languageName: node linkType: hard -"@webassemblyjs/utf8@npm:1.11.6": - version: 1.11.6 - resolution: "@webassemblyjs/utf8@npm:1.11.6" - checksum: 807fe5b5ce10c390cfdd93e0fb92abda8aebabb5199980681e7c3743ee3306a75729bcd1e56a3903980e96c885ee53ef901fcbaac8efdfa480f9c0dae1d08713 +"@webassemblyjs/utf8@npm:1.13.2": + version: 1.13.2 + resolution: "@webassemblyjs/utf8@npm:1.13.2" + checksum: 95ec6052f30eefa8d50c9b2a3394d08b17d53a4aa52821451d41d774c126fa8f39b988fbf5bff56da86852a87c16d676e576775a4071e5e5ccf020cc85a4b281 languageName: node linkType: hard -"@webassemblyjs/wasm-edit@npm:^1.11.5": - version: 1.11.6 - resolution: "@webassemblyjs/wasm-edit@npm:1.11.6" +"@webassemblyjs/wasm-edit@npm:^1.14.1": + version: 1.14.1 + resolution: "@webassemblyjs/wasm-edit@npm:1.14.1" dependencies: - "@webassemblyjs/ast": 1.11.6 - "@webassemblyjs/helper-buffer": 1.11.6 - "@webassemblyjs/helper-wasm-bytecode": 1.11.6 - "@webassemblyjs/helper-wasm-section": 1.11.6 - "@webassemblyjs/wasm-gen": 1.11.6 - "@webassemblyjs/wasm-opt": 1.11.6 - "@webassemblyjs/wasm-parser": 1.11.6 - "@webassemblyjs/wast-printer": 1.11.6 - checksum: 29ce75870496d6fad864d815ebb072395a8a3a04dc9c3f4e1ffdc63fc5fa58b1f34304a1117296d8240054cfdbc38aca88e71fb51483cf29ffab0a61ef27b481 + "@webassemblyjs/ast": 1.14.1 + "@webassemblyjs/helper-buffer": 1.14.1 + "@webassemblyjs/helper-wasm-bytecode": 1.13.2 + "@webassemblyjs/helper-wasm-section": 1.14.1 + "@webassemblyjs/wasm-gen": 1.14.1 + "@webassemblyjs/wasm-opt": 1.14.1 + "@webassemblyjs/wasm-parser": 1.14.1 + "@webassemblyjs/wast-printer": 1.14.1 + checksum: 9341c3146bb1b7863f03d6050c2a66990f20384ca137388047bbe1feffacb599e94fca7b7c18287d17e2449ffb4005fdc7f41f674a6975af9ad8522756f8ffff languageName: node linkType: hard -"@webassemblyjs/wasm-gen@npm:1.11.6": - version: 1.11.6 - resolution: "@webassemblyjs/wasm-gen@npm:1.11.6" +"@webassemblyjs/wasm-gen@npm:1.14.1": + version: 1.14.1 + resolution: "@webassemblyjs/wasm-gen@npm:1.14.1" dependencies: - "@webassemblyjs/ast": 1.11.6 - "@webassemblyjs/helper-wasm-bytecode": 1.11.6 - "@webassemblyjs/ieee754": 1.11.6 - "@webassemblyjs/leb128": 1.11.6 - "@webassemblyjs/utf8": 1.11.6 - checksum: a645a2eecbea24833c3260a249704a7f554ef4a94c6000984728e94bb2bc9140a68dfd6fd21d5e0bbb09f6dfc98e083a45760a83ae0417b41a0196ff6d45a23a + "@webassemblyjs/ast": 1.14.1 + "@webassemblyjs/helper-wasm-bytecode": 1.13.2 + "@webassemblyjs/ieee754": 1.13.2 + "@webassemblyjs/leb128": 1.13.2 + "@webassemblyjs/utf8": 1.13.2 + checksum: 401b12bec7431c4fc29d9414bbe40d3c6dc5be04d25a116657c42329f5481f0129f3b5834c293f26f0e42681ceac9157bf078ce9bdb6a7f78037c650373f98b2 languageName: node linkType: hard -"@webassemblyjs/wasm-opt@npm:1.11.6": - version: 1.11.6 - resolution: "@webassemblyjs/wasm-opt@npm:1.11.6" +"@webassemblyjs/wasm-opt@npm:1.14.1": + version: 1.14.1 + resolution: "@webassemblyjs/wasm-opt@npm:1.14.1" dependencies: - "@webassemblyjs/ast": 1.11.6 - "@webassemblyjs/helper-buffer": 1.11.6 - "@webassemblyjs/wasm-gen": 1.11.6 - "@webassemblyjs/wasm-parser": 1.11.6 - checksum: b4557f195487f8e97336ddf79f7bef40d788239169aac707f6eaa2fa5fe243557c2d74e550a8e57f2788e70c7ae4e7d32f7be16101afe183d597b747a3bdd528 + "@webassemblyjs/ast": 1.14.1 + "@webassemblyjs/helper-buffer": 1.14.1 + "@webassemblyjs/wasm-gen": 1.14.1 + "@webassemblyjs/wasm-parser": 1.14.1 + checksum: 60c697a9e9129d8d23573856df0791ba33cea4a3bc2339044cae73128c0983802e5e50a42157b990eeafe1237eb8e7653db6de5f02b54a0ae7b81b02dcdf2ae9 languageName: node linkType: hard -"@webassemblyjs/wasm-parser@npm:1.11.6, @webassemblyjs/wasm-parser@npm:^1.11.5": - version: 1.11.6 - resolution: "@webassemblyjs/wasm-parser@npm:1.11.6" +"@webassemblyjs/wasm-parser@npm:1.14.1, @webassemblyjs/wasm-parser@npm:^1.14.1": + version: 1.14.1 + resolution: "@webassemblyjs/wasm-parser@npm:1.14.1" dependencies: - "@webassemblyjs/ast": 1.11.6 - "@webassemblyjs/helper-api-error": 1.11.6 - "@webassemblyjs/helper-wasm-bytecode": 1.11.6 - "@webassemblyjs/ieee754": 1.11.6 - "@webassemblyjs/leb128": 1.11.6 - "@webassemblyjs/utf8": 1.11.6 - checksum: 8200a8d77c15621724a23fdabe58d5571415cda98a7058f542e670ea965dd75499f5e34a48675184947c66f3df23adf55df060312e6d72d57908e3f049620d8a + "@webassemblyjs/ast": 1.14.1 + "@webassemblyjs/helper-api-error": 1.13.2 + "@webassemblyjs/helper-wasm-bytecode": 1.13.2 + "@webassemblyjs/ieee754": 1.13.2 + "@webassemblyjs/leb128": 1.13.2 + "@webassemblyjs/utf8": 1.13.2 + checksum: 93f1fe2676da465b4e824419d9812a3d7218de4c3addd4e916c04bc86055fa134416c1b67e4b7cbde8d728c0dce2721d06cc0bfe7a7db7c093a0898009937405 languageName: node linkType: hard -"@webassemblyjs/wast-printer@npm:1.11.6": - version: 1.11.6 - resolution: "@webassemblyjs/wast-printer@npm:1.11.6" +"@webassemblyjs/wast-printer@npm:1.14.1": + version: 1.14.1 + resolution: "@webassemblyjs/wast-printer@npm:1.14.1" dependencies: - "@webassemblyjs/ast": 1.11.6 + "@webassemblyjs/ast": 1.14.1 "@xtuc/long": 4.2.2 - checksum: d2fa6a4c427325ec81463e9c809aa6572af6d47f619f3091bf4c4a6fc34f1da3df7caddaac50b8e7a457f8784c62cd58c6311b6cb69b0162ccd8d4c072f79cf8 + checksum: 517881a0554debe6945de719d100b2d8883a2d24ddf47552cdeda866341e2bb153cd824a864bc7e2a61190a4b66b18f9899907e0074e9e820d2912ac0789ea60 languageName: node linkType: hard @@ -3555,14 +4224,14 @@ __metadata: languageName: node linkType: hard -"abbrev@npm:^1.0.0": - version: 1.1.1 - resolution: "abbrev@npm:1.1.1" - checksum: a4a97ec07d7ea112c517036882b2ac22f3109b7b19077dc656316d07d308438aac28e4d9746dc4d84bf6b1e75b4a7b0a5f3cb30592419f128ca9a8cee3bcfa17 +"abbrev@npm:^3.0.0": + version: 3.0.1 + resolution: "abbrev@npm:3.0.1" + checksum: e70b209f5f408dd3a3bbd0eec4b10a2ffd64704a4a3821d0969d84928cc490a8eb60f85b78a95622c1841113edac10161c62e52f5e7d0027aa26786a8136e02e languageName: node linkType: hard -"accepts@npm:~1.3.4, accepts@npm:~1.3.5, accepts@npm:~1.3.8": +"accepts@npm:~1.3.4, accepts@npm:~1.3.8": version: 1.3.8 resolution: "accepts@npm:1.3.8" dependencies: @@ -3590,16 +4259,16 @@ __metadata: languageName: node linkType: hard -"acorn-import-assertions@npm:^1.9.0": - version: 1.9.0 - resolution: "acorn-import-assertions@npm:1.9.0" +"acorn-import-phases@npm:^1.0.3": + version: 1.0.4 + resolution: "acorn-import-phases@npm:1.0.4" peerDependencies: - acorn: ^8 - checksum: 944fb2659d0845c467066bdcda2e20c05abe3aaf11972116df457ce2627628a81764d800dd55031ba19de513ee0d43bb771bc679cc0eda66dc8b4fade143bc0c + acorn: ^8.14.0 + checksum: e669cccfb6711af305150fcbfddcf4485fffdc4547a0ecabebe94103b47124cc02bfd186240061c00ac954cfb0461b4ecc3e203e138e43042b7af32063fa9510 languageName: node linkType: hard -"acorn-jsx@npm:^5.0.1, acorn-jsx@npm:^5.3.2": +"acorn-jsx@npm:^5.0.0, acorn-jsx@npm:^5.0.1, acorn-jsx@npm:^5.3.2": version: 5.3.2 resolution: "acorn-jsx@npm:5.3.2" peerDependencies: @@ -3609,9 +4278,11 @@ __metadata: linkType: hard "acorn-walk@npm:^8.0.0": - version: 8.2.0 - resolution: "acorn-walk@npm:8.2.0" - checksum: 1715e76c01dd7b2d4ca472f9c58968516a4899378a63ad5b6c2d668bba8da21a71976c14ec5f5b75f887b6317c4ae0b897ab141c831d741dc76024d8745f1ad1 + version: 8.3.4 + resolution: "acorn-walk@npm:8.3.4" + dependencies: + acorn: ^8.11.0 + checksum: 4ff03f42323e7cf90f1683e08606b0f460e1e6ac263d2730e3df91c7665b6f64e696db6ea27ee4bed18c2599569be61f28a8399fa170c611161a348c402ca19c languageName: node linkType: hard @@ -3624,37 +4295,26 @@ __metadata: languageName: node linkType: hard -"acorn@npm:^8.0.4, acorn@npm:^8.7.1, acorn@npm:^8.8.2, acorn@npm:^8.9.0": - version: 8.10.0 - resolution: "acorn@npm:8.10.0" +"acorn@npm:^8.0.0, acorn@npm:^8.0.4, acorn@npm:^8.11.0, acorn@npm:^8.14.0, acorn@npm:^8.15.0, acorn@npm:^8.9.0": + version: 8.15.0 + resolution: "acorn@npm:8.15.0" bin: acorn: bin/acorn - checksum: 538ba38af0cc9e5ef983aee196c4b8b4d87c0c94532334fa7e065b2c8a1f85863467bb774231aae91613fcda5e68740c15d97b1967ae3394d20faddddd8af61d + checksum: 309c6b49aedf1a2e34aaf266de06de04aab6eb097c02375c66fdeb0f64556a6a823540409914fb364d9a11bc30d79d485a2eba29af47992d3490e9886c4391c3 languageName: node linkType: hard -"address@npm:^1.0.1, address@npm:^1.1.2": +"address@npm:^1.0.1": version: 1.2.2 resolution: "address@npm:1.2.2" checksum: ace439960c1e3564d8f523aff23a841904bf33a2a7c2e064f7f60a064194075758b9690e65bd9785692a4ef698a998c57eb74d145881a1cecab8ba658ddb1607 languageName: node linkType: hard -"agent-base@npm:6, agent-base@npm:^6.0.2": - version: 6.0.2 - resolution: "agent-base@npm:6.0.2" - dependencies: - debug: 4 - checksum: f52b6872cc96fd5f622071b71ef200e01c7c4c454ee68bc9accca90c98cfb39f2810e3e9aa330435835eedc8c23f4f8a15267f67c6e245d2b33757575bdac49d - languageName: node - linkType: hard - -"agentkeepalive@npm:^4.2.1": - version: 4.5.0 - resolution: "agentkeepalive@npm:4.5.0" - dependencies: - humanize-ms: ^1.2.1 - checksum: 13278cd5b125e51eddd5079f04d6fe0914ac1b8b91c1f3db2c1822f99ac1a7457869068997784342fe455d59daaff22e14fb7b8c3da4e741896e7e31faf92481 +"agent-base@npm:^7.1.0, agent-base@npm:^7.1.2": + version: 7.1.4 + resolution: "agent-base@npm:7.1.4" + checksum: 86a7f542af277cfbd77dd61e7df8422f90bac512953709003a1c530171a9d019d072e2400eab2b59f84b49ab9dd237be44315ca663ac73e82b3922d10ea5eafa languageName: node linkType: hard @@ -3682,7 +4342,7 @@ __metadata: languageName: node linkType: hard -"ajv-keywords@npm:^3.4.1, ajv-keywords@npm:^3.5.2": +"ajv-keywords@npm:^3.5.2": version: 3.5.2 resolution: "ajv-keywords@npm:3.5.2" peerDependencies: @@ -3702,7 +4362,7 @@ __metadata: languageName: node linkType: hard -"ajv@npm:^6.12.2, ajv@npm:^6.12.4, ajv@npm:^6.12.5": +"ajv@npm:^6.12.4, ajv@npm:^6.12.5": version: 6.12.6 resolution: "ajv@npm:6.12.6" dependencies: @@ -3715,51 +4375,50 @@ __metadata: linkType: hard "ajv@npm:^8.0.0, ajv@npm:^8.9.0": - version: 8.12.0 - resolution: "ajv@npm:8.12.0" + version: 8.17.1 + resolution: "ajv@npm:8.17.1" dependencies: - fast-deep-equal: ^3.1.1 + fast-deep-equal: ^3.1.3 + fast-uri: ^3.0.1 json-schema-traverse: ^1.0.0 require-from-string: ^2.0.2 - uri-js: ^4.2.2 - checksum: 4dc13714e316e67537c8b31bc063f99a1d9d9a497eb4bbd55191ac0dcd5e4985bbb71570352ad6f1e76684fb6d790928f96ba3b2d4fd6e10024be9612fe3f001 + checksum: 1797bf242cfffbaf3b870d13565bd1716b73f214bb7ada9a497063aada210200da36e3ed40237285f3255acc4feeae91b1fb183625331bad27da95973f7253d9 languageName: node linkType: hard -"algoliasearch-helper@npm:^3.10.0": - version: 3.14.2 - resolution: "algoliasearch-helper@npm:3.14.2" +"algoliasearch-helper@npm:^3.22.6": + version: 3.26.0 + resolution: "algoliasearch-helper@npm:3.26.0" dependencies: "@algolia/events": ^4.0.1 peerDependencies: algoliasearch: ">= 3.1 < 6" - checksum: d66444b25fe8ee64675bb660ff1980870751818cb4a29c57bda6ca410372f2bfa031a455dcd5981941736db89d8294187c5b3bc1ce2a2567c6e43657ccd208b8 + checksum: 78cee5928c1f2b42b80694985bb3aa2fc5119ebedcfc7569c4599db03eeee81e965d53cdd7f5b1ccb05145ed08ae8158f8d71b01cbb70a8e90201d9fe88931ad languageName: node linkType: hard -"algoliasearch@npm:^4.13.1, algoliasearch@npm:^4.19.1": - version: 4.20.0 - resolution: "algoliasearch@npm:4.20.0" +"algoliasearch@npm:^5.14.2, algoliasearch@npm:^5.17.1": + version: 5.34.0 + resolution: "algoliasearch@npm:5.34.0" dependencies: - "@algolia/cache-browser-local-storage": 4.20.0 - "@algolia/cache-common": 4.20.0 - "@algolia/cache-in-memory": 4.20.0 - "@algolia/client-account": 4.20.0 - "@algolia/client-analytics": 4.20.0 - "@algolia/client-common": 4.20.0 - "@algolia/client-personalization": 4.20.0 - "@algolia/client-search": 4.20.0 - "@algolia/logger-common": 4.20.0 - "@algolia/logger-console": 4.20.0 - "@algolia/requester-browser-xhr": 4.20.0 - "@algolia/requester-common": 4.20.0 - "@algolia/requester-node-http": 4.20.0 - "@algolia/transporter": 4.20.0 - checksum: 078954944452f57d2e3b47c6ed4905caf797814324a4d5068a8b6685d434a885977a3e607714c5fb6eb29c7c3e717b3ee9cb01c8b2320e2c7bd73bcd8d42e70f + "@algolia/client-abtesting": 5.34.0 + "@algolia/client-analytics": 5.34.0 + "@algolia/client-common": 5.34.0 + "@algolia/client-insights": 5.34.0 + "@algolia/client-personalization": 5.34.0 + "@algolia/client-query-suggestions": 5.34.0 + "@algolia/client-search": 5.34.0 + "@algolia/ingestion": 1.34.0 + "@algolia/monitoring": 1.34.0 + "@algolia/recommend": 5.34.0 + "@algolia/requester-browser-xhr": 5.34.0 + "@algolia/requester-fetch": 5.34.0 + "@algolia/requester-node-http": 5.34.0 + checksum: 9f8ad645b55bf1b83350ac8ecad755c6310caabdba0898d52b40f091be4272b673c776cd3911a6be22f4b46cb910516eee5250b37fce81ff49a7bcac73bc54d3 languageName: node linkType: hard -"ansi-align@npm:^3.0.0, ansi-align@npm:^3.0.1": +"ansi-align@npm:^3.0.1": version: 3.0.1 resolution: "ansi-align@npm:3.0.1" dependencies: @@ -3768,6 +4427,15 @@ __metadata: languageName: node linkType: hard +"ansi-escapes@npm:^4.3.2": + version: 4.3.2 + resolution: "ansi-escapes@npm:4.3.2" + dependencies: + type-fest: ^0.21.3 + checksum: 93111c42189c0a6bed9cdb4d7f2829548e943827ee8479c74d6e0b22ee127b2a21d3f8b5ca57723b8ef78ce011fbfc2784350eb2bde3ccfccf2f575fa8489815 + languageName: node + linkType: hard + "ansi-escapes@npm:^5.0.0": version: 5.0.0 resolution: "ansi-escapes@npm:5.0.0" @@ -3794,9 +4462,9 @@ __metadata: linkType: hard "ansi-regex@npm:^6.0.1": - version: 6.0.1 - resolution: "ansi-regex@npm:6.0.1" - checksum: 1ff8b7667cded1de4fa2c9ae283e979fc87036864317da86a2e546725f96406746411d0d85e87a2d12fa5abd715d90006de7fa4fa0477c92321ad3b4c7d4e169 + version: 6.1.0 + resolution: "ansi-regex@npm:6.1.0" + checksum: 495834a53b0856c02acd40446f7130cb0f8284f4a39afdab20d5dc42b2e198b1196119fe887beed8f9055c4ff2055e3b2f6d4641d0be018cdfb64fedf6fc1aac languageName: node linkType: hard @@ -3842,23 +4510,6 @@ __metadata: languageName: node linkType: hard -"aproba@npm:^1.0.3 || ^2.0.0": - version: 2.0.0 - resolution: "aproba@npm:2.0.0" - checksum: 5615cadcfb45289eea63f8afd064ab656006361020e1735112e346593856f87435e02d8dcc7ff0d11928bc7d425f27bc7c2a84f6c0b35ab0ff659c814c138a24 - languageName: node - linkType: hard - -"are-we-there-yet@npm:^3.0.0": - version: 3.0.1 - resolution: "are-we-there-yet@npm:3.0.1" - dependencies: - delegates: ^1.0.0 - readable-stream: ^3.6.0 - checksum: 52590c24860fa7173bedeb69a4c05fb573473e860197f618b9a28432ee4379049336727ae3a1f9c4cb083114601c1140cee578376164d0e651217a9843f9fe83 - languageName: node - linkType: hard - "arg@npm:^5.0.0, arg@npm:^5.0.2": version: 5.0.2 resolution: "arg@npm:5.0.2" @@ -3889,13 +4540,6 @@ __metadata: languageName: node linkType: hard -"array-flatten@npm:^2.1.2": - version: 2.1.2 - resolution: "array-flatten@npm:2.1.2" - checksum: e8988aac1fbfcdaae343d08c9a06a6fddd2c6141721eeeea45c3cf523bf4431d29a46602929455ed548c7a3e0769928cdc630405427297e7081bd118fdec9262 - languageName: node - linkType: hard - "array-union@npm:^2.1.0": version: 2.1.0 resolution: "array-union@npm:2.1.0" @@ -3903,21 +4547,16 @@ __metadata: languageName: node linkType: hard -"asap@npm:~2.0.3": - version: 2.0.6 - resolution: "asap@npm:2.0.6" - checksum: b296c92c4b969e973260e47523207cd5769abd27c245a68c26dc7a0fe8053c55bb04360237cb51cab1df52be939da77150ace99ad331fb7fb13b3423ed73ff3d - languageName: node - linkType: hard - -"at-least-node@npm:^1.0.0": - version: 1.0.0 - resolution: "at-least-node@npm:1.0.0" - checksum: 463e2f8e43384f1afb54bc68485c436d7622acec08b6fad269b421cb1d29cebb5af751426793d0961ed243146fe4dc983402f6d5a51b720b277818dbf6f2e49e +"astring@npm:^1.8.0": + version: 1.9.0 + resolution: "astring@npm:1.9.0" + bin: + astring: bin/astring + checksum: 69ffde3643f5280c6846231a995af878a94d3eab41d1a19a86b8c15f456453f63a7982cf5dd72d270b9f50dd26763a3e1e48377c961b7df16f550132b6dba805 languageName: node linkType: hard -"autoprefixer@npm:^10.4.12, autoprefixer@npm:^10.4.13, autoprefixer@npm:^10.4.7": +"autoprefixer@npm:^10.4.13, autoprefixer@npm:^10.4.19, autoprefixer@npm:^10.4.21": version: 10.4.21 resolution: "autoprefixer@npm:10.4.21" dependencies: @@ -3935,39 +4574,16 @@ __metadata: languageName: node linkType: hard -"axios@npm:^0.25.0": - version: 0.25.0 - resolution: "axios@npm:0.25.0" - dependencies: - follow-redirects: ^1.14.7 - checksum: 2a8a3787c05f2a0c9c3878f49782357e2a9f38945b93018fb0c4fd788171c43dceefbb577988628e09fea53952744d1ecebde234b561f1e703aa43e0a598a3ad - languageName: node - linkType: hard - -"babel-loader@npm:^8.2.5": - version: 8.3.0 - resolution: "babel-loader@npm:8.3.0" - dependencies: - find-cache-dir: ^3.3.1 - loader-utils: ^2.0.0 - make-dir: ^3.1.0 - schema-utils: ^2.6.5 - peerDependencies: - "@babel/core": ^7.0.0 - webpack: ">=2" - checksum: d48bcf9e030e598656ad3ff5fb85967db2eaaf38af5b4a4b99d25618a2057f9f100e6b231af2a46c1913206db506115ca7a8cbdf52c9c73d767070dae4352ab5 - languageName: node - linkType: hard - -"babel-plugin-apply-mdx-type-prop@npm:1.6.22": - version: 1.6.22 - resolution: "babel-plugin-apply-mdx-type-prop@npm:1.6.22" +"babel-loader@npm:^9.2.1": + version: 9.2.1 + resolution: "babel-loader@npm:9.2.1" dependencies: - "@babel/helper-plugin-utils": 7.10.4 - "@mdx-js/util": 1.6.22 + find-cache-dir: ^4.0.0 + schema-utils: ^4.0.0 peerDependencies: - "@babel/core": ^7.11.6 - checksum: 43e2100164a8f3e46fddd76afcbfb1f02cbebd5612cfe63f3d344a740b0afbdc4d2bf5659cffe9323dd2554c7b86b23ebedae9dadcec353b6594f4292a1a28e2 + "@babel/core": ^7.12.0 + webpack: ">=5" + checksum: e1858d7625ad7cc8cabe6bbb8657f957041ffb1308375f359e92aa1654f413bfbb86a281bbf7cd4f7fff374d571c637b117551deac0231d779a198d4e4e78331 languageName: node linkType: hard @@ -3980,55 +4596,39 @@ __metadata: languageName: node linkType: hard -"babel-plugin-extract-import-names@npm:1.6.22": - version: 1.6.22 - resolution: "babel-plugin-extract-import-names@npm:1.6.22" - dependencies: - "@babel/helper-plugin-utils": 7.10.4 - checksum: 145ccf09c96d36411d340e78086555f8d4d5924ea39fcb0eca461c066cfa98bc4344982bb35eb85d054ef88f8d4dfc0205ba27370c1d8fcc78191b02908d044d - languageName: node - linkType: hard - -"babel-plugin-polyfill-corejs2@npm:^0.4.5": - version: 0.4.5 - resolution: "babel-plugin-polyfill-corejs2@npm:0.4.5" +"babel-plugin-polyfill-corejs2@npm:^0.4.14": + version: 0.4.14 + resolution: "babel-plugin-polyfill-corejs2@npm:0.4.14" dependencies: - "@babel/compat-data": ^7.22.6 - "@babel/helper-define-polyfill-provider": ^0.4.2 + "@babel/compat-data": ^7.27.7 + "@babel/helper-define-polyfill-provider": ^0.6.5 semver: ^6.3.1 peerDependencies: "@babel/core": ^7.4.0 || ^8.0.0-0 <8.0.0 - checksum: 33a8e06aa54e2858d211c743d179f0487b03222f9ca1bfd7c4865bca243fca942a3358cb75f6bb894ed476cbddede834811fbd6903ff589f055821146f053e1a + checksum: d654334c1b4390d08282416144b7b6f3d74d2cab44b2bfa2b6405c828882c82907b8b67698dce1be046c218d2d4fe5bf7fb6d01879938f3129dad969e8cfc44d languageName: node linkType: hard -"babel-plugin-polyfill-corejs3@npm:^0.8.3": - version: 0.8.4 - resolution: "babel-plugin-polyfill-corejs3@npm:0.8.4" +"babel-plugin-polyfill-corejs3@npm:^0.13.0": + version: 0.13.0 + resolution: "babel-plugin-polyfill-corejs3@npm:0.13.0" dependencies: - "@babel/helper-define-polyfill-provider": ^0.4.2 - core-js-compat: ^3.32.2 + "@babel/helper-define-polyfill-provider": ^0.6.5 + core-js-compat: ^3.43.0 peerDependencies: "@babel/core": ^7.4.0 || ^8.0.0-0 <8.0.0 - checksum: 7243241a5b978b1335d51bcbd1248d6c4df88f6b3726706e71e0392f111c59bbf01118c85bb0ed42dce65e90e8fc768d19eda0a81a321cbe54abd3df9a285dc8 + checksum: cf526031acd97ff2124e7c10e15047e6eeb0620d029c687f1dca99916a8fe6cac0e634b84c913db6cb68b7a024f82492ba8fdcc2a6266e7b05bdac2cba0c2434 languageName: node linkType: hard -"babel-plugin-polyfill-regenerator@npm:^0.5.2": - version: 0.5.2 - resolution: "babel-plugin-polyfill-regenerator@npm:0.5.2" +"babel-plugin-polyfill-regenerator@npm:^0.6.5": + version: 0.6.5 + resolution: "babel-plugin-polyfill-regenerator@npm:0.6.5" dependencies: - "@babel/helper-define-polyfill-provider": ^0.4.2 + "@babel/helper-define-polyfill-provider": ^0.6.5 peerDependencies: "@babel/core": ^7.4.0 || ^8.0.0-0 <8.0.0 - checksum: d962200f604016a9a09bc9b4aaf60a3db7af876bb65bcefaeac04d44ac9d9ec4037cf24ce117760cc141d7046b6394c7eb0320ba9665cb4a2ee64df2be187c93 - languageName: node - linkType: hard - -"bail@npm:^1.0.0": - version: 1.0.5 - resolution: "bail@npm:1.0.5" - checksum: 6c334940d7eaa4e656a12fb12407b6555649b6deb6df04270fa806e0da82684ebe4a4e47815b271c794b40f8d6fa286e0c248b14ddbabb324a917fab09b7301a + checksum: ed1932fa9a31e0752fd10ebf48ab9513a654987cab1182890839523cb898559d24ae0578fdc475d9f995390420e64eeaa4b0427045b56949dace3c725bc66dbb languageName: node linkType: hard @@ -4046,13 +4646,6 @@ __metadata: languageName: node linkType: hard -"base16@npm:^1.0.0": - version: 1.0.0 - resolution: "base16@npm:1.0.0" - checksum: 0cd449a2db0f0f957e4b6b57e33bc43c9e20d4f1dd744065db94b5da35e8e71fa4dc4bc7a901e59a84d5f8b6936e3c520e2471787f667fc155fb0f50d8540f5d - languageName: node - linkType: hard - "batch@npm:0.6.1": version: 0.6.1 resolution: "batch@npm:0.6.1" @@ -4068,41 +4661,39 @@ __metadata: linkType: hard "binary-extensions@npm:^2.0.0": - version: 2.2.0 - resolution: "binary-extensions@npm:2.2.0" - checksum: ccd267956c58d2315f5d3ea6757cf09863c5fc703e50fbeb13a7dc849b812ef76e3cf9ca8f35a0c48498776a7478d7b4a0418e1e2b8cb9cb9731f2922aaad7f8 + version: 2.3.0 + resolution: "binary-extensions@npm:2.3.0" + checksum: bcad01494e8a9283abf18c1b967af65ee79b0c6a9e6fcfafebfe91dbe6e0fc7272bafb73389e198b310516ae04f7ad17d79aacf6cb4c0d5d5202a7e2e52c7d98 languageName: node linkType: hard -"body-parser@npm:1.20.1": - version: 1.20.1 - resolution: "body-parser@npm:1.20.1" +"body-parser@npm:1.20.3": + version: 1.20.3 + resolution: "body-parser@npm:1.20.3" dependencies: bytes: 3.1.2 - content-type: ~1.0.4 + content-type: ~1.0.5 debug: 2.6.9 depd: 2.0.0 destroy: 1.2.0 http-errors: 2.0.0 iconv-lite: 0.4.24 on-finished: 2.4.1 - qs: 6.11.0 - raw-body: 2.5.1 + qs: 6.13.0 + raw-body: 2.5.2 type-is: ~1.6.18 unpipe: 1.0.0 - checksum: f1050dbac3bede6a78f0b87947a8d548ce43f91ccc718a50dd774f3c81f2d8b04693e52acf62659fad23101827dd318da1fb1363444ff9a8482b886a3e4a5266 + checksum: 1a35c59a6be8d852b00946330141c4f142c6af0f970faa87f10ad74f1ee7118078056706a05ae3093c54dabca9cd3770fa62a170a85801da1a4324f04381167d languageName: node linkType: hard "bonjour-service@npm:^1.0.11": - version: 1.1.1 - resolution: "bonjour-service@npm:1.1.1" + version: 1.3.0 + resolution: "bonjour-service@npm:1.3.0" dependencies: - array-flatten: ^2.1.2 - dns-equal: ^1.0.0 fast-deep-equal: ^3.1.3 multicast-dns: ^7.2.5 - checksum: 832d0cf78b91368fac8bb11fd7a714e46f4c4fb1bb14d7283bce614a6fb3aae2f3fe209aba5b4fa051811c1cab6921d073a83db8432fb23292f27dd4161fb0f1 + checksum: 737bd40d0b609b18afdfcaf3c416a60d7dc94aedc4cb9d6e7af459a7f3bdffadc199370a48c46739d92689741cad4ec8a6987a3e4d869dd301b521227b92e082 languageName: node linkType: hard @@ -4113,22 +4704,6 @@ __metadata: languageName: node linkType: hard -"boxen@npm:^5.0.0": - version: 5.1.2 - resolution: "boxen@npm:5.1.2" - dependencies: - ansi-align: ^3.0.0 - camelcase: ^6.2.0 - chalk: ^4.1.0 - cli-boxes: ^2.2.1 - string-width: ^4.2.2 - type-fest: ^0.20.2 - widest-line: ^3.1.0 - wrap-ansi: ^7.0.0 - checksum: 82d03e42a72576ff235123f17b7c505372fe05c83f75f61e7d4fa4bcb393897ec95ce766fecb8f26b915f0f7a7227d66e5ec7cef43f5b2bd9d3aeed47ec55877 - languageName: node - linkType: hard - "boxen@npm:^6.2.1": version: 6.2.1 resolution: "boxen@npm:6.2.1" @@ -4145,35 +4720,42 @@ __metadata: languageName: node linkType: hard -"brace-expansion@npm:^1.1.7": - version: 1.1.11 - resolution: "brace-expansion@npm:1.1.11" +"boxen@npm:^7.0.0": + version: 7.1.1 + resolution: "boxen@npm:7.1.1" dependencies: - balanced-match: ^1.0.0 - concat-map: 0.0.1 - checksum: faf34a7bb0c3fcf4b59c7808bc5d2a96a40988addf2e7e09dfbb67a2251800e0d14cd2bfc1aa79174f2f5095c54ff27f46fb1289fe2d77dac755b5eb3434cc07 + ansi-align: ^3.0.1 + camelcase: ^7.0.1 + chalk: ^5.2.0 + cli-boxes: ^3.0.0 + string-width: ^5.1.2 + type-fest: ^2.13.0 + widest-line: ^4.0.1 + wrap-ansi: ^8.1.0 + checksum: ad8833d5f2845b0a728fdf8a0bc1505dff0c518edcb0fd56979a08774b1f26cf48b71e66532179ccdfb9ed95b64aa008689cca26f7776f93f002b8000a683d76 languageName: node linkType: hard -"brace-expansion@npm:^2.0.1": - version: 2.0.1 - resolution: "brace-expansion@npm:2.0.1" +"brace-expansion@npm:^1.1.7": + version: 1.1.12 + resolution: "brace-expansion@npm:1.1.12" dependencies: balanced-match: ^1.0.0 - checksum: a61e7cd2e8a8505e9f0036b3b6108ba5e926b4b55089eeb5550cd04a471fe216c96d4fe7e4c7f995c728c554ae20ddfc4244cad10aef255e72b62930afd233d1 + concat-map: 0.0.1 + checksum: 12cb6d6310629e3048cadb003e1aca4d8c9bb5c67c3c321bafdd7e7a50155de081f78ea3e0ed92ecc75a9015e784f301efc8132383132f4f7904ad1ac529c562 languageName: node linkType: hard -"braces@npm:^3.0.2, braces@npm:~3.0.2": - version: 3.0.2 - resolution: "braces@npm:3.0.2" +"brace-expansion@npm:^2.0.1": + version: 2.0.2 + resolution: "brace-expansion@npm:2.0.2" dependencies: - fill-range: ^7.0.1 - checksum: e2a8e769a863f3d4ee887b5fe21f63193a891c68b612ddb4b68d82d1b5f3ff9073af066c343e9867a393fe4c2555dcb33e89b937195feb9c1613d259edfcd459 + balanced-match: ^1.0.0 + checksum: 01dff195e3646bc4b0d27b63d9bab84d2ebc06121ff5013ad6e5356daa5a9d6b60fa26cf73c74797f2dc3fbec112af13578d51f75228c1112b26c790a87b0488 languageName: node linkType: hard -"braces@npm:^3.0.3": +"braces@npm:^3.0.2, braces@npm:^3.0.3, braces@npm:~3.0.2": version: 3.0.3 resolution: "braces@npm:3.0.3" dependencies: @@ -4182,47 +4764,17 @@ __metadata: languageName: node linkType: hard -"browserslist@npm:^4.0.0, browserslist@npm:^4.14.5, browserslist@npm:^4.18.1, browserslist@npm:^4.21.4, browserslist@npm:^4.21.9, browserslist@npm:^4.22.1": - version: 4.22.1 - resolution: "browserslist@npm:4.22.1" - dependencies: - caniuse-lite: ^1.0.30001541 - electron-to-chromium: ^1.4.535 - node-releases: ^2.0.13 - update-browserslist-db: ^1.0.13 - bin: - browserslist: cli.js - checksum: 7e6b10c53f7dd5d83fd2b95b00518889096382539fed6403829d447e05df4744088de46a571071afb447046abc3c66ad06fbc790e70234ec2517452e32ffd862 - languageName: node - linkType: hard - -"browserslist@npm:^4.24.4": - version: 4.24.4 - resolution: "browserslist@npm:4.24.4" +"browserslist@npm:^4.0.0, browserslist@npm:^4.23.0, browserslist@npm:^4.24.0, browserslist@npm:^4.24.4, browserslist@npm:^4.25.0, browserslist@npm:^4.25.1": + version: 4.25.1 + resolution: "browserslist@npm:4.25.1" dependencies: - caniuse-lite: ^1.0.30001688 - electron-to-chromium: ^1.5.73 + caniuse-lite: ^1.0.30001726 + electron-to-chromium: ^1.5.173 node-releases: ^2.0.19 - update-browserslist-db: ^1.1.1 + update-browserslist-db: ^1.1.3 bin: browserslist: cli.js - checksum: 64074bf6cf0a9ae3094d753270e3eae9cf925149db45d646f0bc67bacc2e46d7ded64a4e835b95f5fdcf0350f63a83c3755b32f80831f643a47f0886deb8a065 - languageName: node - linkType: hard - -"buble@npm:0.19.6": - version: 0.19.6 - resolution: "buble@npm:0.19.6" - dependencies: - chalk: ^2.4.1 - magic-string: ^0.25.1 - minimist: ^1.2.0 - os-homedir: ^1.0.1 - regexpu-core: ^4.2.0 - vlq: ^1.0.0 - bin: - buble: ./bin/buble - checksum: 565fec70c3283de499f334804e1fade787ebd21bdc8cdb84b0466b852951bc9adca15f8d55cbc879f2361e898eae6adf4a4da0664e0913092228a1ae0ff7240e + checksum: 2a7e4317e809b09a436456221a1fcb8ccbd101bada187ed217f7a07a9e42ced822c7c86a0a4333d7d1b4e6e0c859d201732ffff1585d6bcacd8d226f6ddce7e3 languageName: node linkType: hard @@ -4247,48 +4799,77 @@ __metadata: languageName: node linkType: hard -"cacache@npm:^17.0.0": - version: 17.1.4 - resolution: "cacache@npm:17.1.4" +"cacache@npm:^19.0.1": + version: 19.0.1 + resolution: "cacache@npm:19.0.1" dependencies: - "@npmcli/fs": ^3.1.0 + "@npmcli/fs": ^4.0.0 fs-minipass: ^3.0.0 glob: ^10.2.2 - lru-cache: ^7.7.1 + lru-cache: ^10.0.1 minipass: ^7.0.3 - minipass-collect: ^1.0.2 + minipass-collect: ^2.0.1 minipass-flush: ^1.0.5 minipass-pipeline: ^1.2.4 - p-map: ^4.0.0 - ssri: ^10.0.0 - tar: ^6.1.11 - unique-filename: ^3.0.0 - checksum: b7751df756656954a51201335addced8f63fc53266fa56392c9f5ae83c8d27debffb4458ac2d168a744a4517ec3f2163af05c20097f93d17bdc2dc8a385e14a6 + p-map: ^7.0.2 + ssri: ^12.0.0 + tar: ^7.4.3 + unique-filename: ^4.0.0 + checksum: e95684717de6881b4cdaa949fa7574e3171946421cd8291769dd3d2417dbf7abf4aa557d1f968cca83dcbc95bed2a281072b09abfc977c942413146ef7ed4525 languageName: node linkType: hard -"cacheable-request@npm:^6.0.0": - version: 6.1.0 - resolution: "cacheable-request@npm:6.1.0" +"cacheable-lookup@npm:^7.0.0": + version: 7.0.0 + resolution: "cacheable-lookup@npm:7.0.0" + checksum: 9e2856763fc0a7347ab34d704c010440b819d4bb5e3593b664381b7433e942dd22e67ee5581f12256f908e79b82d30b86ebbacf40a081bfe10ee93fbfbc2d6a9 + languageName: node + linkType: hard + +"cacheable-request@npm:^10.2.8": + version: 10.2.14 + resolution: "cacheable-request@npm:10.2.14" dependencies: - clone-response: ^1.0.2 - get-stream: ^5.1.0 - http-cache-semantics: ^4.0.0 - keyv: ^3.0.0 - lowercase-keys: ^2.0.0 - normalize-url: ^4.1.0 - responselike: ^1.0.2 - checksum: b510b237b18d17e89942e9ee2d2a077cb38db03f12167fd100932dfa8fc963424bfae0bfa1598df4ae16c944a5484e43e03df8f32105b04395ee9495e9e4e9f1 + "@types/http-cache-semantics": ^4.0.2 + get-stream: ^6.0.1 + http-cache-semantics: ^4.1.1 + keyv: ^4.5.3 + mimic-response: ^4.0.0 + normalize-url: ^8.0.0 + responselike: ^3.0.0 + checksum: 56f2b8e1c497c91f8391f0b099d19907a7dde25e71087e622b23e45fc8061736c2a6964ef121b16f377c3c61079cf8dc17320ab54004209d1343e4d26aba7015 languageName: node linkType: hard -"call-bind@npm:^1.0.0, call-bind@npm:^1.0.2": +"call-bind-apply-helpers@npm:^1.0.0, call-bind-apply-helpers@npm:^1.0.1, call-bind-apply-helpers@npm:^1.0.2": version: 1.0.2 - resolution: "call-bind@npm:1.0.2" + resolution: "call-bind-apply-helpers@npm:1.0.2" + dependencies: + es-errors: ^1.3.0 + function-bind: ^1.1.2 + checksum: b2863d74fcf2a6948221f65d95b91b4b2d90cfe8927650b506141e669f7d5de65cea191bf788838bc40d13846b7886c5bc5c84ab96c3adbcf88ad69a72fcdc6b + languageName: node + linkType: hard + +"call-bind@npm:^1.0.8": + version: 1.0.8 + resolution: "call-bind@npm:1.0.8" + dependencies: + call-bind-apply-helpers: ^1.0.0 + es-define-property: ^1.0.0 + get-intrinsic: ^1.2.4 + set-function-length: ^1.2.2 + checksum: aa2899bce917a5392fd73bd32e71799c37c0b7ab454e0ed13af7f6727549091182aade8bbb7b55f304a5bc436d543241c14090fb8a3137e9875e23f444f4f5a9 + languageName: node + linkType: hard + +"call-bound@npm:^1.0.2, call-bound@npm:^1.0.3": + version: 1.0.4 + resolution: "call-bound@npm:1.0.4" dependencies: - function-bind: ^1.1.1 - get-intrinsic: ^1.0.2 - checksum: f8e31de9d19988a4b80f3e704788c4a2d6b6f3d17cfec4f57dc29ced450c53a49270dc66bf0fbd693329ee948dd33e6c90a329519aef17474a4d961e8d6426b0 + call-bind-apply-helpers: ^1.0.2 + get-intrinsic: ^1.3.0 + checksum: 2f6399488d1c272f56306ca60ff696575e2b7f31daf23bc11574798c84d9f2759dceb0cb1f471a85b77f28962a7ac6411f51d283ea2e45319009a19b6ccab3b2 languageName: node linkType: hard @@ -4309,7 +4890,7 @@ __metadata: languageName: node linkType: hard -"camelcase-css@npm:2.0.1, camelcase-css@npm:^2.0.1": +"camelcase-css@npm:^2.0.1": version: 2.0.1 resolution: "camelcase-css@npm:2.0.1" checksum: 1cec2b3b3dcb5026688a470b00299a8db7d904c4802845c353dbd12d9d248d3346949a814d83bfd988d4d2e5b9904c07efe76fecd195a1d4f05b543e7c0b56b1 @@ -4323,6 +4904,13 @@ __metadata: languageName: node linkType: hard +"camelcase@npm:^7.0.1": + version: 7.0.1 + resolution: "camelcase@npm:7.0.1" + checksum: 86ab8f3ebf08bcdbe605a211a242f00ed30d8bfb77dab4ebb744dd36efbc84432d1c4adb28975ba87a1b8be40a80fbd1e60e2f06565315918fa7350011a26d3d + languageName: node + linkType: hard + "caniuse-api@npm:^3.0.0": version: 3.0.0 resolution: "caniuse-api@npm:3.0.0" @@ -4335,24 +4923,17 @@ __metadata: languageName: node linkType: hard -"caniuse-lite@npm:^1.0.0, caniuse-lite@npm:^1.0.30001541": - version: 1.0.30001546 - resolution: "caniuse-lite@npm:1.0.30001546" - checksum: d3ef82f5ee94743002c5b2dd61c84342debcc94b2d5907b64ade3514ecfc4f20bbe86a6bc453fd6436d5fbcf6582e07405d7c2077565675a71c83adc238a11fa - languageName: node - linkType: hard - -"caniuse-lite@npm:^1.0.30001688, caniuse-lite@npm:^1.0.30001702": - version: 1.0.30001707 - resolution: "caniuse-lite@npm:1.0.30001707" - checksum: 38824c9f88d754428844e64ba18197c06f4f8503035e30eace88c6bffdcf5f682dcf3cef895b60cd6f19c71e6714731adc1940b612ea606c6875cd2f801e4836 +"caniuse-lite@npm:^1.0.0, caniuse-lite@npm:^1.0.30001702, caniuse-lite@npm:^1.0.30001726": + version: 1.0.30001727 + resolution: "caniuse-lite@npm:1.0.30001727" + checksum: 2bc6112f242701198a99c17713d4409be9b404d09005f34f351ec29a4ea46c054e7aa4982bc16f06b81b7a375cbc61c937e89650170cbce84db772a376ed3963 languageName: node linkType: hard -"ccount@npm:^1.0.0": - version: 1.1.0 - resolution: "ccount@npm:1.1.0" - checksum: b335a79d0aa4308919cf7507babcfa04ac63d389ebed49dbf26990d4607c8a4713cde93cc83e707d84571ddfe1e7615dad248be9bc422ae4c188210f71b08b78 +"ccount@npm:^2.0.0": + version: 2.0.1 + resolution: "ccount@npm:2.0.1" + checksum: 48193dada54c9e260e0acf57fc16171a225305548f9ad20d5471e0f7a8c026aedd8747091dccb0d900cde7df4e4ddbd235df0d8de4a64c71b12f0d3303eeafd4 languageName: node linkType: hard @@ -4363,7 +4944,7 @@ __metadata: languageName: node linkType: hard -"chalk@npm:^2.4.1, chalk@npm:^2.4.2": +"chalk@npm:^2.4.2": version: 2.4.2 resolution: "chalk@npm:2.4.2" dependencies: @@ -4374,7 +4955,7 @@ __metadata: languageName: node linkType: hard -"chalk@npm:^4.0.0, chalk@npm:^4.1.0, chalk@npm:^4.1.2": +"chalk@npm:^4.0.0, chalk@npm:^4.1.2": version: 4.1.2 resolution: "chalk@npm:4.1.2" dependencies: @@ -4384,17 +4965,31 @@ __metadata: languageName: node linkType: hard -"character-entities-legacy@npm:^1.0.0": - version: 1.1.4 - resolution: "character-entities-legacy@npm:1.1.4" - checksum: fe03a82c154414da3a0c8ab3188e4237ec68006cbcd681cf23c7cfb9502a0e76cd30ab69a2e50857ca10d984d57de3b307680fff5328ccd427f400e559c3a811 +"chalk@npm:^5.0.1, chalk@npm:^5.2.0": + version: 5.4.1 + resolution: "chalk@npm:5.4.1" + checksum: 0c656f30b782fed4d99198825c0860158901f449a6b12b818b0aabad27ec970389e7e8767d0e00762175b23620c812e70c4fd92c0210e55fc2d993638b74e86e languageName: node linkType: hard -"character-entities@npm:^1.0.0": - version: 1.2.4 - resolution: "character-entities@npm:1.2.4" - checksum: e1545716571ead57beac008433c1ff69517cd8ca5b336889321c5b8ff4a99c29b65589a701e9c086cda8a5e346a67295e2684f6c7ea96819fe85cbf49bf8686d +"char-regex@npm:^1.0.2": + version: 1.0.2 + resolution: "char-regex@npm:1.0.2" + checksum: b563e4b6039b15213114626621e7a3d12f31008bdce20f9c741d69987f62aeaace7ec30f6018890ad77b2e9b4d95324c9f5acfca58a9441e3b1dcdd1e2525d17 + languageName: node + linkType: hard + +"character-entities-html4@npm:^2.0.0": + version: 2.1.0 + resolution: "character-entities-html4@npm:2.1.0" + checksum: 7034aa7c7fa90309667f6dd50499c8a760c3d3a6fb159adb4e0bada0107d194551cdbad0714302f62d06ce4ed68565c8c2e15fdef2e8f8764eb63fa92b34b11d + languageName: node + linkType: hard + +"character-entities-legacy@npm:^3.0.0": + version: 3.0.0 + resolution: "character-entities-legacy@npm:3.0.0" + checksum: 7582af055cb488b626d364b7d7a4e46b06abd526fb63c0e4eb35bcb9c9799cc4f76b39f34fdccef2d1174ac95e53e9ab355aae83227c1a2505877893fce77731 languageName: node linkType: hard @@ -4405,10 +5000,10 @@ __metadata: languageName: node linkType: hard -"character-reference-invalid@npm:^1.0.0": - version: 1.1.4 - resolution: "character-reference-invalid@npm:1.1.4" - checksum: 20274574c70e05e2f81135f3b93285536bc8ff70f37f0809b0d17791a832838f1e49938382899ed4cb444e5bbd4314ca1415231344ba29f4222ce2ccf24fea0b +"character-reference-invalid@npm:^2.0.0": + version: 2.0.1 + resolution: "character-reference-invalid@npm:2.0.1" + checksum: 98d3b1a52ae510b7329e6ee7f6210df14f1e318c5415975d4c9e7ee0ef4c07875d47c6e74230c64551f12f556b4a8ccc24d9f3691a2aa197019e72a95e9297ee languageName: node linkType: hard @@ -4426,7 +5021,7 @@ __metadata: languageName: node linkType: hard -"cheerio@npm:^1.0.0-rc.12": +"cheerio@npm:1.0.0-rc.12": version: 1.0.0-rc.12 resolution: "cheerio@npm:1.0.0-rc.12" dependencies: @@ -4441,26 +5036,26 @@ __metadata: languageName: node linkType: hard -"chokidar@npm:^3.4.2, chokidar@npm:^3.5.3": - version: 3.5.3 - resolution: "chokidar@npm:3.5.3" +"cheerio@npm:^1.0.0": + version: 1.1.2 + resolution: "cheerio@npm:1.1.2" dependencies: - anymatch: ~3.1.2 - braces: ~3.0.2 - fsevents: ~2.3.2 - glob-parent: ~5.1.2 - is-binary-path: ~2.1.0 - is-glob: ~4.0.1 - normalize-path: ~3.0.0 - readdirp: ~3.6.0 - dependenciesMeta: - fsevents: - optional: true - checksum: b49fcde40176ba007ff361b198a2d35df60d9bb2a5aab228279eb810feae9294a6b4649ab15981304447afe1e6ffbf4788ad5db77235dc770ab777c6e771980c + cheerio-select: ^2.1.0 + dom-serializer: ^2.0.0 + domhandler: ^5.0.3 + domutils: ^3.2.2 + encoding-sniffer: ^0.2.1 + htmlparser2: ^10.0.0 + parse5: ^7.3.0 + parse5-htmlparser2-tree-adapter: ^7.1.0 + parse5-parser-stream: ^7.1.2 + undici: ^7.12.0 + whatwg-mimetype: ^4.0.0 + checksum: 84fec985143d81323d39f13bbe1b65ff4f934bfbfcfe586ab7674f4a54b13b3e9c6aa9b23e4a54e7147e08fafaed12f5f9bad554bb707579b3db464eeccc158f languageName: node linkType: hard -"chokidar@npm:^3.6.0": +"chokidar@npm:^3.5.3, chokidar@npm:^3.6.0": version: 3.6.0 resolution: "chokidar@npm:3.6.0" dependencies: @@ -4479,24 +5074,17 @@ __metadata: languageName: node linkType: hard -"chownr@npm:^2.0.0": - version: 2.0.0 - resolution: "chownr@npm:2.0.0" - checksum: c57cf9dd0791e2f18a5ee9c1a299ae6e801ff58fee96dc8bfd0dcb4738a6ce58dd252a3605b1c93c6418fe4f9d5093b28ffbf4d66648cb2a9c67eaef9679be2f +"chownr@npm:^3.0.0": + version: 3.0.0 + resolution: "chownr@npm:3.0.0" + checksum: fd73a4bab48b79e66903fe1cafbdc208956f41ea4f856df883d0c7277b7ab29fd33ee65f93b2ec9192fc0169238f2f8307b7735d27c155821d886b84aa97aa8d languageName: node linkType: hard "chrome-trace-event@npm:^1.0.2": - version: 1.0.3 - resolution: "chrome-trace-event@npm:1.0.3" - checksum: cb8b1fc7e881aaef973bd0c4a43cd353c2ad8323fb471a041e64f7c2dd849cde4aad15f8b753331a32dda45c973f032c8a03b8177fc85d60eaa75e91e08bfb97 - languageName: node - linkType: hard - -"ci-info@npm:^2.0.0": - version: 2.0.0 - resolution: "ci-info@npm:2.0.0" - checksum: 3b374666a85ea3ca43fa49aa3a048d21c9b475c96eb13c133505d2324e7ae5efd6a454f41efe46a152269e9b6a00c9edbe63ec7fa1921957165aae16625acd67 + version: 1.0.4 + resolution: "chrome-trace-event@npm:1.0.4" + checksum: fcbbd9dd0cd5b48444319007cc0c15870fd8612cc0df320908aa9d5e8a244084d48571eb28bf3c58c19327d2c5838f354c2d89fac3956d8e992273437401ac19 languageName: node linkType: hard @@ -4507,12 +5095,12 @@ __metadata: languageName: node linkType: hard -"clean-css@npm:^5.2.2, clean-css@npm:^5.3.0": - version: 5.3.2 - resolution: "clean-css@npm:5.3.2" +"clean-css@npm:^5.2.2, clean-css@npm:^5.3.3, clean-css@npm:~5.3.2": + version: 5.3.3 + resolution: "clean-css@npm:5.3.3" dependencies: source-map: ~0.6.0 - checksum: 8787b281acc9878f309b5f835d410085deedfd4e126472666773040a6a8a72f472a1d24185947d23b87b1c419bf2c5ed429395d5c5ff8279c98b05d8011e9758 + checksum: 941987c14860dd7d346d5cf121a82fd2caf8344160b1565c5387f7ccca4bbcaf885bace961be37c4f4713ce2d8c488dd89483c1add47bb779790edbfdcc79cbc languageName: node linkType: hard @@ -4523,13 +5111,6 @@ __metadata: languageName: node linkType: hard -"cli-boxes@npm:^2.2.1": - version: 2.2.1 - resolution: "cli-boxes@npm:2.2.1" - checksum: be79f8ec23a558b49e01311b39a1ea01243ecee30539c880cf14bf518a12e223ef40c57ead0cb44f509bffdffc5c129c746cd50d863ab879385370112af4f585 - languageName: node - linkType: hard - "cli-boxes@npm:^3.0.0": version: 3.0.0 resolution: "cli-boxes@npm:3.0.0" @@ -4546,16 +5127,16 @@ __metadata: languageName: node linkType: hard -"cli-table3@npm:^0.6.2": - version: 0.6.3 - resolution: "cli-table3@npm:0.6.3" +"cli-table3@npm:^0.6.3": + version: 0.6.5 + resolution: "cli-table3@npm:0.6.5" dependencies: "@colors/colors": 1.5.0 string-width: ^4.2.0 dependenciesMeta: "@colors/colors": optional: true - checksum: 09897f68467973f827c04e7eaadf13b55f8aec49ecd6647cc276386ea660059322e2dd8020a8b6b84d422dbdd619597046fa89cbbbdc95b2cea149a2df7c096c + checksum: ab7afbf4f8597f1c631f3ee6bb3481d0bfeac8a3b81cffb5a578f145df5c88003b6cfff46046a7acae86596fdd03db382bfa67f20973b6b57425505abc47e42c languageName: node linkType: hard @@ -4580,15 +5161,6 @@ __metadata: languageName: node linkType: hard -"clone-response@npm:^1.0.2": - version: 1.0.3 - resolution: "clone-response@npm:1.0.3" - dependencies: - mimic-response: ^1.0.0 - checksum: 4e671cac39b11c60aa8ba0a450657194a5d6504df51bca3fac5b3bd0145c4f8e8464898f87c8406b83232e3bc5cca555f51c1f9c8ac023969ebfbf7f6bdabb2e - languageName: node - linkType: hard - "clsx@npm:^1.2.1": version: 1.2.1 resolution: "clsx@npm:1.2.1" @@ -4596,10 +5168,17 @@ __metadata: languageName: node linkType: hard -"collapse-white-space@npm:^1.0.2": - version: 1.0.6 - resolution: "collapse-white-space@npm:1.0.6" - checksum: 9673fb797952c5c888341435596c69388b22cd5560c8cd3f40edb72734a9c820f56a7c9525166bcb7068b5d5805372e6fd0c4b9f2869782ad070cb5d3faf26e7 +"clsx@npm:^2.0.0, clsx@npm:^2.1.1": + version: 2.1.1 + resolution: "clsx@npm:2.1.1" + checksum: acd3e1ab9d8a433ecb3cc2f6a05ab95fe50b4a3cfc5ba47abb6cbf3754585fcb87b84e90c822a1f256c4198e3b41c7f6c391577ffc8678ad587fc0976b24fd57 + languageName: node + linkType: hard + +"collapse-white-space@npm:^2.0.0": + version: 2.1.0 + resolution: "collapse-white-space@npm:2.1.0" + checksum: c8978b1f4e7d68bf846cfdba6c6689ce8910511df7d331eb6e6757e51ceffb52768d59a28db26186c91dcf9594955b59be9f8ccd473c485790f5d8b90dc6726f languageName: node linkType: hard @@ -4635,16 +5214,7 @@ __metadata: languageName: node linkType: hard -"color-support@npm:^1.1.3": - version: 1.1.3 - resolution: "color-support@npm:1.1.3" - bin: - color-support: bin.js - checksum: 9b7356817670b9a13a26ca5af1c21615463b500783b739b7634a0c2047c16cef4b2865d7576875c31c3cddf9dd621fa19285e628f20198b233a5cfdda6d0793b - languageName: node - linkType: hard - -"colord@npm:^2.9.1": +"colord@npm:^2.9.3": version: 2.9.3 resolution: "colord@npm:2.9.3" checksum: 95d909bfbcfd8d5605cbb5af56f2d1ce2b323990258fd7c0d2eb0e6d3bb177254d7fb8213758db56bb4ede708964f78c6b992b326615f81a18a6aaf11d64c650 @@ -4665,10 +5235,10 @@ __metadata: languageName: node linkType: hard -"comma-separated-tokens@npm:^1.0.0": - version: 1.0.8 - resolution: "comma-separated-tokens@npm:1.0.8" - checksum: 0adcb07174fa4d08cf0f5c8e3aec40a36b5ff0c2c720e5e23f50fe02e6789d1d00a67036c80e0c1e1539f41d3e7f0101b074039dd833b4e4a59031b659d6ca0d +"comlink@npm:^4.4.2": + version: 4.4.2 + resolution: "comlink@npm:4.4.2" + checksum: 35313f26fdd78c202be21be49a7607f57e9e91963399b524676742ee0cf7db589be500d923ed0809b53f37996461186fb345bf867d93236be22bfae3cb7bd07e languageName: node linkType: hard @@ -4686,6 +5256,13 @@ __metadata: languageName: node linkType: hard +"commander@npm:^10.0.0": + version: 10.0.1 + resolution: "commander@npm:10.0.1" + checksum: 436901d64a818295803c1996cd856621a74f30b9f9e28a588e726b2b1670665bccd7c1a77007ebf328729f0139838a88a19265858a0fa7a8728c4656796db948 + languageName: node + linkType: hard + "commander@npm:^2.20.0": version: 2.20.3 resolution: "commander@npm:2.20.3" @@ -4721,28 +5298,14 @@ __metadata: languageName: node linkType: hard -"commondir@npm:^1.0.1": - version: 1.0.1 - resolution: "commondir@npm:1.0.1" - checksum: 59715f2fc456a73f68826285718503340b9f0dd89bfffc42749906c5cf3d4277ef11ef1cca0350d0e79204f00f1f6d83851ececc9095dc88512a697ac0b9bdcb - languageName: node - linkType: hard - -"component-props@npm:1.1.1": - version: 1.1.1 - resolution: "component-props@npm:1.1.1" - checksum: fda496d2cbe0a1de223741cafce1c3dd35214d6ad86b6b1a1c57109d047e0de149d8bbbb9fe4c39e90ad5902f0026da524a6355683c23dc12c552c3d0ddf8dcf - languageName: node - linkType: hard - -"component-xor@npm:0.0.4": - version: 0.0.4 - resolution: "component-xor@npm:0.0.4" - checksum: 3ef1bfadbe99a6c1d557fa4b22c49158987dc30177d08d0926f0663185cb154438c6e76e86cf7e30b7f2ee4c4af9e41f9da19b56ba391ab3c773aaa2bf5c1f2a +"common-path-prefix@npm:^3.0.0": + version: 3.0.0 + resolution: "common-path-prefix@npm:3.0.0" + checksum: fdb3c4f54e51e70d417ccd950c07f757582de800c0678ca388aedefefc84982039f346f9fd9a1252d08d2da9e9ef4019f580a1d1d3a10da031e4bb3c924c5818 languageName: node linkType: hard -"compressible@npm:~2.0.16": +"compressible@npm:~2.0.18": version: 2.0.18 resolution: "compressible@npm:2.0.18" dependencies: @@ -4752,17 +5315,17 @@ __metadata: linkType: hard "compression@npm:^1.7.4": - version: 1.7.4 - resolution: "compression@npm:1.7.4" + version: 1.8.1 + resolution: "compression@npm:1.8.1" dependencies: - accepts: ~1.3.5 - bytes: 3.0.0 - compressible: ~2.0.16 + bytes: 3.1.2 + compressible: ~2.0.18 debug: 2.6.9 - on-headers: ~1.0.2 - safe-buffer: 5.1.2 + negotiator: ~0.6.4 + on-headers: ~1.1.0 + safe-buffer: 5.2.1 vary: ~1.1.2 - checksum: 35c0f2eb1f28418978615dc1bc02075b34b1568f7f56c62d60f4214d4b7cc00d0f6d282b5f8a954f59872396bd770b6b15ffd8aa94c67d4bce9b8887b906999b + checksum: 906325935180cd3507d30ed898fb129deccab03689383d55536245a94610f5003923bb14c95ee6adc8d658ee13be549407eb4346ef55169045f3e41e9969808e languageName: node linkType: hard @@ -4773,17 +5336,26 @@ __metadata: languageName: node linkType: hard -"configstore@npm:^5.0.1": - version: 5.0.1 - resolution: "configstore@npm:5.0.1" +"config-chain@npm:^1.1.11": + version: 1.1.13 + resolution: "config-chain@npm:1.1.13" dependencies: - dot-prop: ^5.2.0 - graceful-fs: ^4.1.2 - make-dir: ^3.0.0 - unique-string: ^2.0.0 - write-file-atomic: ^3.0.0 - xdg-basedir: ^4.0.0 - checksum: 60ef65d493b63f96e14b11ba7ec072fdbf3d40110a94fb7199d1c287761bdea5c5244e76b2596325f30c1b652213aa75de96ea20afd4a5f82065e61ea090988e + ini: ^1.3.4 + proto-list: ~1.2.1 + checksum: 828137a28e7c2fc4b7fb229bd0cd6c1397bcf83434de54347e608154008f411749041ee392cbe42fab6307e02de4c12480260bf769b7d44b778fdea3839eafab + languageName: node + linkType: hard + +"configstore@npm:^6.0.0": + version: 6.0.0 + resolution: "configstore@npm:6.0.0" + dependencies: + dot-prop: ^6.0.1 + graceful-fs: ^4.2.6 + unique-string: ^3.0.0 + write-file-atomic: ^3.0.3 + xdg-basedir: ^5.0.1 + checksum: 81995351c10bc04c58507f17748477aeac6f47465109d20e3534cebc881d22e927cfd29e73dd852c46c55f62c2b7be4cd1fe6eb3a93ba51f7f9813c218f9bae0 languageName: node linkType: hard @@ -4794,17 +5366,10 @@ __metadata: languageName: node linkType: hard -"consola@npm:^2.15.3": - version: 2.15.3 - resolution: "consola@npm:2.15.3" - checksum: 8ef7a09b703ec67ac5c389a372a33b6dc97eda6c9876443a60d76a3076eea0259e7f67a4e54fd5a52f97df73690822d090cf8b7e102b5761348afef7c6d03e28 - languageName: node - linkType: hard - -"console-control-strings@npm:^1.1.0": - version: 1.1.0 - resolution: "console-control-strings@npm:1.1.0" - checksum: 8755d76787f94e6cf79ce4666f0c5519906d7f5b02d4b884cf41e11dcd759ed69c57da0670afd9236d229a46e0f9cf519db0cd829c6dca820bb5a5c3def584ed +"consola@npm:^3.2.3": + version: 3.4.2 + resolution: "consola@npm:3.4.2" + checksum: 32d1339e0505842f033ca34cb4572a841281caa367f438b785d3b284ab2a06134f009e605908480402c5f57f56c1e3210090c37e6417923416f76ce730d39361 languageName: node linkType: hard @@ -4824,20 +5389,13 @@ __metadata: languageName: node linkType: hard -"content-type@npm:~1.0.4": +"content-type@npm:~1.0.4, content-type@npm:~1.0.5": version: 1.0.5 resolution: "content-type@npm:1.0.5" checksum: 566271e0a251642254cde0f845f9dd4f9856e52d988f4eb0d0dcffbb7a1f8ec98de7a5215fc628f3bce30fe2fb6fd2bc064b562d721658c59b544e2d34ea2766 languageName: node linkType: hard -"convert-source-map@npm:^1.7.0": - version: 1.9.0 - resolution: "convert-source-map@npm:1.9.0" - checksum: dc55a1f28ddd0e9485ef13565f8f756b342f9a46c4ae18b843fe3c30c675d058d6a4823eff86d472f187b176f0adf51ea7b69ea38be34be4a63cbbf91b0593c8 - languageName: node - linkType: hard - "convert-source-map@npm:^2.0.0": version: 2.0.0 resolution: "convert-source-map@npm:2.0.0" @@ -4852,14 +5410,14 @@ __metadata: languageName: node linkType: hard -"cookie@npm:0.5.0": - version: 0.5.0 - resolution: "cookie@npm:0.5.0" - checksum: 1f4bd2ca5765f8c9689a7e8954183f5332139eb72b6ff783d8947032ec1fdf43109852c178e21a953a30c0dd42257828185be01b49d1eb1a67fd054ca588a180 +"cookie@npm:0.7.1": + version: 0.7.1 + resolution: "cookie@npm:0.7.1" + checksum: cec5e425549b3650eb5c3498a9ba3cde0b9cd419e3b36e4b92739d30b4d89e0b678b98c1ddc209ce7cf958cd3215671fd6ac47aec21f10c2a0cc68abd399d8a7 languageName: node linkType: hard -"copy-text-to-clipboard@npm:^3.0.1": +"copy-text-to-clipboard@npm:^3.2.0": version: 3.2.0 resolution: "copy-text-to-clipboard@npm:3.2.0" checksum: df7115c197a166d51f59e4e20ab2a68a855ae8746d25ff149b5465c694d9a405c7e6684b73a9f87ba8d653070164e229c15dfdb9fd77c30be1ff0da569661060 @@ -4882,33 +5440,26 @@ __metadata: languageName: node linkType: hard -"core-js-compat@npm:^3.31.0, core-js-compat@npm:^3.32.2": - version: 3.33.0 - resolution: "core-js-compat@npm:3.33.0" +"core-js-compat@npm:^3.43.0": + version: 3.44.0 + resolution: "core-js-compat@npm:3.44.0" dependencies: - browserslist: ^4.22.1 - checksum: 83ae54008c09b8e0ae3c59457039866c342c7e28b0d30eebb638a5b51c01432e63fe97695c90645cbc6a8b073a4f9a8b0e75f0818bbf8b4b054e01f4c17d3181 - languageName: node - linkType: hard - -"core-js-pure@npm:^3.30.2": - version: 3.33.0 - resolution: "core-js-pure@npm:3.33.0" - checksum: d47084a4de9a0cef9779eccd3ac9f435cf9fd7aa71794150cd4c6b305036bcc392d94766d4a7b6456bdd08faba7752d55c2ec40185bda161c3563081c9fa1e17 + browserslist: ^4.25.1 + checksum: 5f9196a0793060bda0e019c2462df43502b145ada8b0d95a5affc6113d08e55a171227f92c7cc8dd6108037825eb0fee50f7784110de23bfd866dbdb67983d29 languageName: node linkType: hard -"core-js@npm:^2.4.1": - version: 2.6.12 - resolution: "core-js@npm:2.6.12" - checksum: 44fa9934a85f8c78d61e0c8b7b22436330471ffe59ec5076fe7f324d6e8cf7f824b14b1c81ca73608b13bdb0fef035bd820989bf059767ad6fa13123bb8bd016 +"core-js-pure@npm:^3.43.0": + version: 3.44.0 + resolution: "core-js-pure@npm:3.44.0" + checksum: a7ed9069421b8a63a6a326cbb34828744e2c21bf7e870301a695a7cc474976a7f18326f7fff9c3e2d4fcdef1ca930e219ed5631a8e2f1baa132a893c542f4965 languageName: node linkType: hard -"core-js@npm:^3.23.3": - version: 3.33.0 - resolution: "core-js@npm:3.33.0" - checksum: dd62217935ac281faf6f833bb306fb891162919fcf9c1f0c975b1b91e82ac09a940f5deb5950bbb582739ceef716e8bd7e4f9eab8328932fb029d3bc2ecb2881 +"core-js@npm:^3.31.1": + version: 3.44.0 + resolution: "core-js@npm:3.44.0" + checksum: 1a9fca319aaeb8ae58764f9566a92d5fe7f609749dd1e5e0af4e1a0e4c6f0402d51b5ad379decb6ee722df0a65f0897a1ed1da397888e53437a52d3c105724a5 languageName: node linkType: hard @@ -4919,33 +5470,7 @@ __metadata: languageName: node linkType: hard -"cosmiconfig@npm:^6.0.0": - version: 6.0.0 - resolution: "cosmiconfig@npm:6.0.0" - dependencies: - "@types/parse-json": ^4.0.0 - import-fresh: ^3.1.0 - parse-json: ^5.0.0 - path-type: ^4.0.0 - yaml: ^1.7.2 - checksum: 8eed7c854b91643ecb820767d0deb038b50780ecc3d53b0b19e03ed8aabed4ae77271198d1ae3d49c3b110867edf679f5faad924820a8d1774144a87cb6f98fc - languageName: node - linkType: hard - -"cosmiconfig@npm:^7.0.1": - version: 7.1.0 - resolution: "cosmiconfig@npm:7.1.0" - dependencies: - "@types/parse-json": ^4.0.0 - import-fresh: ^3.2.1 - parse-json: ^5.0.0 - path-type: ^4.0.0 - yaml: ^1.10.0 - checksum: c53bf7befc1591b2651a22414a5e786cd5f2eeaa87f3678a3d49d6069835a9d8d1aef223728e98aa8fec9a95bf831120d245096db12abe019fecb51f5696c96f - languageName: node - linkType: hard - -"cosmiconfig@npm:^8.2.0": +"cosmiconfig@npm:^8.1.3, cosmiconfig@npm:^8.3.5": version: 8.3.6 resolution: "cosmiconfig@npm:8.3.6" dependencies: @@ -4958,74 +5483,97 @@ __metadata: peerDependenciesMeta: typescript: optional: true - checksum: dc339ebea427898c9e03bf01b56ba7afbac07fc7d2a2d5a15d6e9c14de98275a9565da949375aee1809591c152c0a3877bb86dbeaf74d5bd5aaa79955ad9e7a0 - languageName: node - linkType: hard - -"cross-fetch@npm:^3.1.5": - version: 3.1.8 - resolution: "cross-fetch@npm:3.1.8" - dependencies: - node-fetch: ^2.6.12 - checksum: 78f993fa099eaaa041122ab037fe9503ecbbcb9daef234d1d2e0b9230a983f64d645d088c464e21a247b825a08dc444a6e7064adfa93536d3a9454b4745b3632 + checksum: dc339ebea427898c9e03bf01b56ba7afbac07fc7d2a2d5a15d6e9c14de98275a9565da949375aee1809591c152c0a3877bb86dbeaf74d5bd5aaa79955ad9e7a0 languageName: node linkType: hard -"cross-spawn@npm:^7.0.0, cross-spawn@npm:^7.0.2, cross-spawn@npm:^7.0.3": - version: 7.0.3 - resolution: "cross-spawn@npm:7.0.3" +"cross-spawn@npm:^7.0.2, cross-spawn@npm:^7.0.3, cross-spawn@npm:^7.0.6": + version: 7.0.6 + resolution: "cross-spawn@npm:7.0.6" dependencies: path-key: ^3.1.0 shebang-command: ^2.0.0 which: ^2.0.1 - checksum: 671cc7c7288c3a8406f3c69a3ae2fc85555c04169e9d611def9a675635472614f1c0ed0ef80955d5b6d4e724f6ced67f0ad1bb006c2ea643488fcfef994d7f52 + checksum: 8d306efacaf6f3f60e0224c287664093fa9185680b2d195852ba9a863f85d02dcc737094c6e512175f8ee0161f9b87c73c6826034c2422e39de7d6569cf4503b languageName: node linkType: hard -"crypto-random-string@npm:^2.0.0": - version: 2.0.0 - resolution: "crypto-random-string@npm:2.0.0" - checksum: 0283879f55e7c16fdceacc181f87a0a65c53bc16ffe1d58b9d19a6277adcd71900d02bb2c4843dd55e78c51e30e89b0fec618a7f170ebcc95b33182c28f05fd6 +"crypto-random-string@npm:^4.0.0": + version: 4.0.0 + resolution: "crypto-random-string@npm:4.0.0" + dependencies: + type-fest: ^1.0.1 + checksum: 91f148f27bcc8582798f0fb3e75a09d9174557f39c3c40a89dd1bd70fb5a14a02548245aa26fa7d663c426ac5026f4729841231c84f9e30e8c8ece5e38656741 + languageName: node + linkType: hard + +"css-blank-pseudo@npm:^7.0.1": + version: 7.0.1 + resolution: "css-blank-pseudo@npm:7.0.1" + dependencies: + postcss-selector-parser: ^7.0.0 + peerDependencies: + postcss: ^8.4 + checksum: 0720f013394141e129f757ffadb780a47be37fae71d195a1e8fbd02b038001bc2c3b62be83e397fe1fb1282ba656b7fce4e972d583defb6f8163e0d791c816a4 languageName: node linkType: hard -"css-declaration-sorter@npm:^6.3.1": - version: 6.4.1 - resolution: "css-declaration-sorter@npm:6.4.1" +"css-declaration-sorter@npm:^7.2.0": + version: 7.2.0 + resolution: "css-declaration-sorter@npm:7.2.0" peerDependencies: postcss: ^8.0.9 - checksum: cbdc9e0d481011b1a28fd5b60d4eb55fe204391d31a0b1b490b2cecf4baa85810f9b8c48adab4df644f4718104ed3ed72c64a9745e3216173767bf4aeca7f9b8 + checksum: 69b2f63a1c7c593123fabcbb353618ed01eb75f6404da9321328fbb30d603d89c47195129fadf1dc316e1406a0881400b324c2bded9438c47196e1c96ec726dd + languageName: node + linkType: hard + +"css-has-pseudo@npm:^7.0.2": + version: 7.0.2 + resolution: "css-has-pseudo@npm:7.0.2" + dependencies: + "@csstools/selector-specificity": ^5.0.0 + postcss-selector-parser: ^7.0.0 + postcss-value-parser: ^4.2.0 + peerDependencies: + postcss: ^8.4 + checksum: 422ae6eb59982dcd7a9e2ccfe1471070c71764d7f7167d3541ed91c938791e66d3def93dcb25affb1f7ee366f221ddeffddb45c87a7ce7195d77d6d67e52be0e languageName: node linkType: hard -"css-loader@npm:^6.7.1": - version: 6.8.1 - resolution: "css-loader@npm:6.8.1" +"css-loader@npm:^6.11.0": + version: 6.11.0 + resolution: "css-loader@npm:6.11.0" dependencies: icss-utils: ^5.1.0 - postcss: ^8.4.21 - postcss-modules-extract-imports: ^3.0.0 - postcss-modules-local-by-default: ^4.0.3 - postcss-modules-scope: ^3.0.0 + postcss: ^8.4.33 + postcss-modules-extract-imports: ^3.1.0 + postcss-modules-local-by-default: ^4.0.5 + postcss-modules-scope: ^3.2.0 postcss-modules-values: ^4.0.0 postcss-value-parser: ^4.2.0 - semver: ^7.3.8 + semver: ^7.5.4 peerDependencies: + "@rspack/core": 0.x || 1.x webpack: ^5.0.0 - checksum: 7c1784247bdbe76dc5c55fb1ac84f1d4177a74c47259942c9cfdb7a8e6baef11967a0bc85ac285f26bd26d5059decb848af8154a03fdb4f4894f41212f45eef3 + peerDependenciesMeta: + "@rspack/core": + optional: true + webpack: + optional: true + checksum: 5c8d35975a7121334905394e88e28f05df72f037dbed2fb8fec4be5f0b313ae73a13894ba791867d4a4190c35896da84a7fd0c54fb426db55d85ba5e714edbe3 languageName: node linkType: hard -"css-minimizer-webpack-plugin@npm:^4.0.0": - version: 4.2.2 - resolution: "css-minimizer-webpack-plugin@npm:4.2.2" +"css-minimizer-webpack-plugin@npm:^5.0.1": + version: 5.0.1 + resolution: "css-minimizer-webpack-plugin@npm:5.0.1" dependencies: - cssnano: ^5.1.8 - jest-worker: ^29.1.2 - postcss: ^8.4.17 - schema-utils: ^4.0.0 - serialize-javascript: ^6.0.0 - source-map: ^0.6.1 + "@jridgewell/trace-mapping": ^0.3.18 + cssnano: ^6.0.1 + jest-worker: ^29.4.3 + postcss: ^8.4.24 + schema-utils: ^4.0.1 + serialize-javascript: ^6.0.1 peerDependencies: webpack: ^5.0.0 peerDependenciesMeta: @@ -5041,7 +5589,16 @@ __metadata: optional: true lightningcss: optional: true - checksum: 5417e76a445f35832aa96807c835b8e92834a6cd285b1b788dfe3ca0fa90fec7eb2dd6efa9d3649f9d8244b99b7da2d065951603b94918e8f6a366a5049cacdd + checksum: 10055802c61d1ae72584eac03b6bd221ecbefde11d337be44a5459d8de075b38f91b80949f95cd0c3a10295615ee013f82130bfac5fe9b5b3e8e75531f232680 + languageName: node + linkType: hard + +"css-prefers-color-scheme@npm:^10.0.0": + version: 10.0.0 + resolution: "css-prefers-color-scheme@npm:10.0.0" + peerDependencies: + postcss: ^8.4 + checksum: 02b634aac859f5b07482563e39fc415544f8b35064b6b73e93408892dccb86fbb2eff407df4ae666780ee06350601fc6cd3ca42bc05900c7062f52589723d350 languageName: node linkType: hard @@ -5059,32 +5616,49 @@ __metadata: linkType: hard "css-select@npm:^5.1.0": - version: 5.1.0 - resolution: "css-select@npm:5.1.0" + version: 5.2.2 + resolution: "css-select@npm:5.2.2" dependencies: boolbase: ^1.0.0 css-what: ^6.1.0 domhandler: ^5.0.2 domutils: ^3.0.1 nth-check: ^2.0.1 - checksum: 2772c049b188d3b8a8159907192e926e11824aea525b8282981f72ba3f349cf9ecd523fdf7734875ee2cb772246c22117fc062da105b6d59afe8dcd5c99c9bda + checksum: 0ab672620c6bdfe4129dfecf202f6b90f92018b24a1a93cfbb295c24026d0163130ba4b98d7443f87246a2c1d67413798a7a5920cd102b0cfecfbc89896515aa languageName: node linkType: hard -"css-tree@npm:^1.1.2, css-tree@npm:^1.1.3": - version: 1.1.3 - resolution: "css-tree@npm:1.1.3" +"css-tree@npm:^2.3.1": + version: 2.3.1 + resolution: "css-tree@npm:2.3.1" + dependencies: + mdn-data: 2.0.30 + source-map-js: ^1.0.1 + checksum: 493cc24b5c22b05ee5314b8a0d72d8a5869491c1458017ae5ed75aeb6c3596637dbe1b11dac2548974624adec9f7a1f3a6cf40593dc1f9185eb0e8279543fbc0 + languageName: node + linkType: hard + +"css-tree@npm:~2.2.0": + version: 2.2.1 + resolution: "css-tree@npm:2.2.1" dependencies: - mdn-data: 2.0.14 - source-map: ^0.6.1 - checksum: 79f9b81803991b6977b7fcb1588799270438274d89066ce08f117f5cdb5e20019b446d766c61506dd772c839df84caa16042d6076f20c97187f5abe3b50e7d1f + mdn-data: 2.0.28 + source-map-js: ^1.0.1 + checksum: b94aa8cc2f09e6f66c91548411fcf74badcbad3e150345074715012d16333ce573596ff5dfca03c2a87edf1924716db765120f94247e919d72753628ba3aba27 languageName: node linkType: hard "css-what@npm:^6.0.1, css-what@npm:^6.1.0": - version: 6.1.0 - resolution: "css-what@npm:6.1.0" - checksum: b975e547e1e90b79625918f84e67db5d33d896e6de846c9b584094e529f0c63e2ab85ee33b9daffd05bff3a146a1916bec664e18bb76dd5f66cbff9fc13b2bbe + version: 6.2.2 + resolution: "css-what@npm:6.2.2" + checksum: 4d1f07b348a638e1f8b4c72804a1e93881f35e0f541256aec5ac0497c5855df7db7ab02da030de950d4813044f6d029a14ca657e0f92c3987e4b604246235b2b + languageName: node + linkType: hard + +"cssdb@npm:^8.3.0": + version: 8.3.1 + resolution: "cssdb@npm:8.3.1" + checksum: 72e3ea4cfc2930483c3e981483f46cabb2d6573860931edd1d96f0d10b5fd85abd97f221f3b19aa3660dc6c583c84dc61fefba4227bac98efc3df678b974778a languageName: node linkType: hard @@ -5097,100 +5671,108 @@ __metadata: languageName: node linkType: hard -"cssnano-preset-advanced@npm:^5.3.8": - version: 5.3.10 - resolution: "cssnano-preset-advanced@npm:5.3.10" - dependencies: - autoprefixer: ^10.4.12 - cssnano-preset-default: ^5.2.14 - postcss-discard-unused: ^5.1.0 - postcss-merge-idents: ^5.1.1 - postcss-reduce-idents: ^5.2.0 - postcss-zindex: ^5.1.0 - peerDependencies: - postcss: ^8.2.15 - checksum: d21cb382aea2f35c9eaa50686280bbd5158260edf73020731364b03bae0d887292da51ed0b20b369f51d2573ee8c02c695f604647b839a9ca746be8a44c3bb5b - languageName: node - linkType: hard - -"cssnano-preset-default@npm:^5.2.14": - version: 5.2.14 - resolution: "cssnano-preset-default@npm:5.2.14" - dependencies: - css-declaration-sorter: ^6.3.1 - cssnano-utils: ^3.1.0 - postcss-calc: ^8.2.3 - postcss-colormin: ^5.3.1 - postcss-convert-values: ^5.1.3 - postcss-discard-comments: ^5.1.2 - postcss-discard-duplicates: ^5.1.0 - postcss-discard-empty: ^5.1.1 - postcss-discard-overridden: ^5.1.0 - postcss-merge-longhand: ^5.1.7 - postcss-merge-rules: ^5.1.4 - postcss-minify-font-values: ^5.1.0 - postcss-minify-gradients: ^5.1.1 - postcss-minify-params: ^5.1.4 - postcss-minify-selectors: ^5.2.1 - postcss-normalize-charset: ^5.1.0 - postcss-normalize-display-values: ^5.1.0 - postcss-normalize-positions: ^5.1.1 - postcss-normalize-repeat-style: ^5.1.1 - postcss-normalize-string: ^5.1.0 - postcss-normalize-timing-functions: ^5.1.0 - postcss-normalize-unicode: ^5.1.1 - postcss-normalize-url: ^5.1.0 - postcss-normalize-whitespace: ^5.1.1 - postcss-ordered-values: ^5.1.3 - postcss-reduce-initial: ^5.1.2 - postcss-reduce-transforms: ^5.1.0 - postcss-svgo: ^5.1.0 - postcss-unique-selectors: ^5.1.1 - peerDependencies: - postcss: ^8.2.15 - checksum: d3bbbe3d50c6174afb28d0bdb65b511fdab33952ec84810aef58b87189f3891c34aaa8b6a6101acd5314f8acded839b43513e39a75f91a698ddc985a1b1d9e95 - languageName: node - linkType: hard - -"cssnano-utils@npm:^3.1.0": - version: 3.1.0 - resolution: "cssnano-utils@npm:3.1.0" +"cssnano-preset-advanced@npm:^6.1.2": + version: 6.1.2 + resolution: "cssnano-preset-advanced@npm:6.1.2" + dependencies: + autoprefixer: ^10.4.19 + browserslist: ^4.23.0 + cssnano-preset-default: ^6.1.2 + postcss-discard-unused: ^6.0.5 + postcss-merge-idents: ^6.0.3 + postcss-reduce-idents: ^6.0.3 + postcss-zindex: ^6.0.2 + peerDependencies: + postcss: ^8.4.31 + checksum: cf70e27915947412730abb3075587efb66bcea58d7f1b906a7225bb4a40c9ca40150251a2ac33363d4f55bbdeb9ba000c242fa6244ee36cba2477ac07fbbe791 + languageName: node + linkType: hard + +"cssnano-preset-default@npm:^6.1.2": + version: 6.1.2 + resolution: "cssnano-preset-default@npm:6.1.2" + dependencies: + browserslist: ^4.23.0 + css-declaration-sorter: ^7.2.0 + cssnano-utils: ^4.0.2 + postcss-calc: ^9.0.1 + postcss-colormin: ^6.1.0 + postcss-convert-values: ^6.1.0 + postcss-discard-comments: ^6.0.2 + postcss-discard-duplicates: ^6.0.3 + postcss-discard-empty: ^6.0.3 + postcss-discard-overridden: ^6.0.2 + postcss-merge-longhand: ^6.0.5 + postcss-merge-rules: ^6.1.1 + postcss-minify-font-values: ^6.1.0 + postcss-minify-gradients: ^6.0.3 + postcss-minify-params: ^6.1.0 + postcss-minify-selectors: ^6.0.4 + postcss-normalize-charset: ^6.0.2 + postcss-normalize-display-values: ^6.0.2 + postcss-normalize-positions: ^6.0.2 + postcss-normalize-repeat-style: ^6.0.2 + postcss-normalize-string: ^6.0.2 + postcss-normalize-timing-functions: ^6.0.2 + postcss-normalize-unicode: ^6.1.0 + postcss-normalize-url: ^6.0.2 + postcss-normalize-whitespace: ^6.0.2 + postcss-ordered-values: ^6.0.2 + postcss-reduce-initial: ^6.1.0 + postcss-reduce-transforms: ^6.0.2 + postcss-svgo: ^6.0.3 + postcss-unique-selectors: ^6.0.4 + peerDependencies: + postcss: ^8.4.31 + checksum: 51d93e52df7141143947dc4695b5087c04b41ea153e4f4c0282ac012b62c7457c6aca244f604ae94fa3b4840903a30a1e7df38f8610e0b304d05e3065375ee56 + languageName: node + linkType: hard + +"cssnano-utils@npm:^4.0.2": + version: 4.0.2 + resolution: "cssnano-utils@npm:4.0.2" peerDependencies: - postcss: ^8.2.15 - checksum: 975c84ce9174cf23bb1da1e9faed8421954607e9ea76440cd3bb0c1bea7e17e490d800fca5ae2812d1d9e9d5524eef23ede0a3f52497d7ccc628e5d7321536f2 + postcss: ^8.4.31 + checksum: f04c6854e75d847c7a43aff835e003d5bc7387ddfc476f0ad3a2d63663d0cec41047d46604c1717bf6b5a8e24e54bb519e465ff78d62c7e073c7cbe2279bebaf languageName: node linkType: hard -"cssnano@npm:^5.1.12, cssnano@npm:^5.1.8": - version: 5.1.15 - resolution: "cssnano@npm:5.1.15" +"cssnano@npm:^6.0.1, cssnano@npm:^6.1.2": + version: 6.1.2 + resolution: "cssnano@npm:6.1.2" dependencies: - cssnano-preset-default: ^5.2.14 - lilconfig: ^2.0.3 - yaml: ^1.10.2 + cssnano-preset-default: ^6.1.2 + lilconfig: ^3.1.1 peerDependencies: - postcss: ^8.2.15 - checksum: ca9e1922178617c66c2f1548824b2c7af2ecf69cc3a187fc96bf8d29251c2e84d9e4966c69cf64a2a6a057a37dff7d6d057bc8a2a0957e6ea382e452ae9d0bbb + postcss: ^8.4.31 + checksum: 65aad92c5ee0089ffd4cd933c18c65edbf7634f7c3cd833a499dc948aa7e4168be22130dfe83bde07fcdc87f7c45a02d09040b7f439498208bc90b8d5a9abcc8 languageName: node linkType: hard -"csso@npm:^4.2.0": - version: 4.2.0 - resolution: "csso@npm:4.2.0" +"csso@npm:^5.0.5": + version: 5.0.5 + resolution: "csso@npm:5.0.5" dependencies: - css-tree: ^1.1.2 - checksum: 380ba9663da3bcea58dee358a0d8c4468bb6539be3c439dc266ac41c047217f52fd698fb7e4b6b6ccdfb8cf53ef4ceed8cc8ceccb8dfca2aa628319826b5b998 + css-tree: ~2.2.0 + checksum: 0ad858d36bf5012ed243e9ec69962a867509061986d2ee07cc040a4b26e4d062c00d4c07e5ba8d430706ceb02dd87edd30a52b5937fd45b1b6f2119c4993d59a languageName: node linkType: hard "csstype@npm:^3.0.2": - version: 3.1.2 - resolution: "csstype@npm:3.1.2" - checksum: e1a52e6c25c1314d6beef5168da704ab29c5186b877c07d822bd0806717d9a265e8493a2e35ca7e68d0f5d472d43fac1cdce70fd79fd0853dff81f3028d857b5 + version: 3.1.3 + resolution: "csstype@npm:3.1.3" + checksum: 8db785cc92d259102725b3c694ec0c823f5619a84741b5c7991b8ad135dfaa66093038a1cc63e03361a6cd28d122be48f2106ae72334e067dd619a51f49eddf7 + languageName: node + linkType: hard + +"debounce@npm:^1.2.1": + version: 1.2.1 + resolution: "debounce@npm:1.2.1" + checksum: 682a89506d9e54fb109526f4da255c5546102fbb8e3ae75eef3b04effaf5d4853756aee97475cd4650641869794e44f410eeb20ace2b18ea592287ab2038519e languageName: node linkType: hard -"debug@npm:2.6.9, debug@npm:^2.6.0": +"debug@npm:2.6.9": version: 2.6.9 resolution: "debug@npm:2.6.9" dependencies: @@ -5199,7 +5781,19 @@ __metadata: languageName: node linkType: hard -"debug@npm:4, debug@npm:4.3.4, debug@npm:^4.0.0, debug@npm:^4.1.0, debug@npm:^4.1.1, debug@npm:^4.3.1, debug@npm:^4.3.2, debug@npm:^4.3.3, debug@npm:^4.3.4": +"debug@npm:4, debug@npm:^4.0.0, debug@npm:^4.1.0, debug@npm:^4.2.0, debug@npm:^4.3.1, debug@npm:^4.3.2, debug@npm:^4.3.4, debug@npm:^4.4.1": + version: 4.4.1 + resolution: "debug@npm:4.4.1" + dependencies: + ms: ^2.1.3 + peerDependenciesMeta: + supports-color: + optional: true + checksum: a43826a01cda685ee4cec00fb2d3322eaa90ccadbef60d9287debc2a886be3e835d9199c80070ede75a409ee57828c4c6cd80e4b154f2843f0dc95a570dc0729 + languageName: node + linkType: hard + +"debug@npm:4.3.4": version: 4.3.4 resolution: "debug@npm:4.3.4" dependencies: @@ -5212,20 +5806,20 @@ __metadata: linkType: hard "decode-named-character-reference@npm:^1.0.0": - version: 1.0.2 - resolution: "decode-named-character-reference@npm:1.0.2" + version: 1.2.0 + resolution: "decode-named-character-reference@npm:1.2.0" dependencies: character-entities: ^2.0.0 - checksum: f4c71d3b93105f20076052f9cb1523a22a9c796b8296cd35eef1ca54239c78d182c136a848b83ff8da2071e3ae2b1d300bf29d00650a6d6e675438cc31b11d78 + checksum: f26b23046c1a137c0b41fa51e3ce07ba8364640322c742a31570999784abc8572fc24cb108a76b14ff72ddb75d35aad3d14b10d7743639112145a2664b9d1864 languageName: node linkType: hard -"decompress-response@npm:^3.3.0": - version: 3.3.0 - resolution: "decompress-response@npm:3.3.0" +"decompress-response@npm:^6.0.0": + version: 6.0.0 + resolution: "decompress-response@npm:6.0.0" dependencies: - mimic-response: ^1.0.0 - checksum: 952552ac3bd7de2fc18015086b09468645c9638d98a551305e485230ada278c039c91116e946d07894b39ee53c0f0d5b6473f25a224029344354513b412d7380 + mimic-response: ^3.1.0 + checksum: d377cf47e02d805e283866c3f50d3d21578b779731e8c5072d6ce8c13cc31493db1c2f6784da9d1d5250822120cefa44f1deab112d5981015f2e17444b763812 languageName: node linkType: hard @@ -5243,7 +5837,7 @@ __metadata: languageName: node linkType: hard -"deepmerge@npm:^4.2.2": +"deepmerge@npm:^4.3.1": version: 4.3.1 resolution: "deepmerge@npm:4.3.1" checksum: 2024c6a980a1b7128084170c4cf56b0fd58a63f2da1660dcfe977415f27b17dbe5888668b59d0b063753f3220719d5e400b7f113609489c90160bb9a5518d052 @@ -5259,21 +5853,21 @@ __metadata: languageName: node linkType: hard -"defer-to-connect@npm:^1.0.1": - version: 1.1.3 - resolution: "defer-to-connect@npm:1.1.3" - checksum: 9491b301dcfa04956f989481ba7a43c2231044206269eb4ab64a52d6639ee15b1252262a789eb4239fb46ab63e44d4e408641bae8e0793d640aee55398cb3930 +"defer-to-connect@npm:^2.0.1": + version: 2.0.1 + resolution: "defer-to-connect@npm:2.0.1" + checksum: 8a9b50d2f25446c0bfefb55a48e90afd58f85b21bcf78e9207cd7b804354f6409032a1705c2491686e202e64fc05f147aa5aa45f9aa82627563f045937f5791b languageName: node linkType: hard -"define-data-property@npm:^1.0.1": - version: 1.1.0 - resolution: "define-data-property@npm:1.1.0" +"define-data-property@npm:^1.0.1, define-data-property@npm:^1.1.4": + version: 1.1.4 + resolution: "define-data-property@npm:1.1.4" dependencies: - get-intrinsic: ^1.2.1 + es-define-property: ^1.0.0 + es-errors: ^1.3.0 gopd: ^1.0.1 - has-property-descriptors: ^1.0.0 - checksum: 7ad4ee84cca8ad427a4831f5693526804b62ce9dfd4efac77214e95a4382aed930072251d4075dc8dc9fc949a353ed51f19f5285a84a788ba9216cc51472a093 + checksum: 8068ee6cab694d409ac25936eb861eea704b7763f7f342adbdfe337fc27c78d7ae0eff2364b2917b58c508d723c7a074326d068eef2e45c4edcd85cf94d0313b languageName: node linkType: hard @@ -5284,7 +5878,7 @@ __metadata: languageName: node linkType: hard -"define-properties@npm:^1.1.4": +"define-properties@npm:^1.2.1": version: 1.2.1 resolution: "define-properties@npm:1.2.1" dependencies: @@ -5295,29 +5889,6 @@ __metadata: languageName: node linkType: hard -"del@npm:^6.1.1": - version: 6.1.1 - resolution: "del@npm:6.1.1" - dependencies: - globby: ^11.0.1 - graceful-fs: ^4.2.4 - is-glob: ^4.0.1 - is-path-cwd: ^2.2.0 - is-path-inside: ^3.0.2 - p-map: ^4.0.0 - rimraf: ^3.0.2 - slash: ^3.0.0 - checksum: 563288b73b8b19a7261c47fd21a330eeab6e2acd7c6208c49790dfd369127120dd7836cdf0c1eca216b77c94782a81507eac6b4734252d3bef2795cb366996b6 - languageName: node - linkType: hard - -"delegates@npm:^1.0.0": - version: 1.0.0 - resolution: "delegates@npm:1.0.0" - checksum: a51744d9b53c164ba9c0492471a1a2ffa0b6727451bdc89e31627fdf4adda9d51277cfcbfb20f0a6f08ccb3c436f341df3e92631a3440226d93a8971724771fd - languageName: node - linkType: hard - "depd@npm:2.0.0": version: 2.0.0 resolution: "depd@npm:2.0.0" @@ -5346,15 +5917,6 @@ __metadata: languageName: node linkType: hard -"detab@npm:2.0.4": - version: 2.0.4 - resolution: "detab@npm:2.0.4" - dependencies: - repeat-string: ^1.5.4 - checksum: 34b077521ecd4c6357d32ff7923be644d34aa6f6b7d717d40ec4a9168243eefaea2b512a75a460a6f70c31b0bbc31ff90f820a891803b4ddaf99e9d04d0d389d - languageName: node - linkType: hard - "detect-node@npm:^2.0.4": version: 2.1.0 resolution: "detect-node@npm:2.1.0" @@ -5362,29 +5924,25 @@ __metadata: languageName: node linkType: hard -"detect-port-alt@npm:^1.1.6": - version: 1.1.6 - resolution: "detect-port-alt@npm:1.1.6" +"detect-port@npm:^1.5.1": + version: 1.6.1 + resolution: "detect-port@npm:1.6.1" dependencies: address: ^1.0.1 - debug: ^2.6.0 + debug: 4 bin: - detect: ./bin/detect-port - detect-port: ./bin/detect-port - checksum: 9dc37b1fa4a9dd6d4889e1045849b8d841232b598d1ca888bf712f4035b07a17cf6d537465a0d7323250048d3a5a0540e3b7cf89457efc222f96f77e2c40d16a + detect: bin/detect-port.js + detect-port: bin/detect-port.js + checksum: 0429fa423abb15fc453face64e6ffa406e375f51f5b4421a7886962e680dc05824eae9b6ee4594ba273685c3add415ad00982b5da54802ac3de6f846173284c3 languageName: node linkType: hard -"detect-port@npm:^1.3.0": - version: 1.5.1 - resolution: "detect-port@npm:1.5.1" +"devlop@npm:^1.0.0, devlop@npm:^1.1.0": + version: 1.1.0 + resolution: "devlop@npm:1.1.0" dependencies: - address: ^1.0.1 - debug: 4 - bin: - detect: bin/detect-port.js - detect-port: bin/detect-port.js - checksum: b48da9340481742547263d5d985e65d078592557863402ecf538511735e83575867e94f91fe74405ea19b61351feb99efccae7e55de9a151d5654e3417cea05b + dequal: ^2.0.0 + checksum: d2ff650bac0bb6ef08c48f3ba98640bb5fec5cce81e9957eb620408d1bab1204d382a45b785c6b3314dc867bb0684936b84c6867820da6db97cbb5d3c15dd185 languageName: node linkType: hard @@ -5396,9 +5954,9 @@ __metadata: linkType: hard "diff@npm:^5.0.0": - version: 5.1.0 - resolution: "diff@npm:5.1.0" - checksum: c7bf0df7c9bfbe1cf8a678fd1b2137c4fb11be117a67bc18a0e03ae75105e8533dbfb1cda6b46beb3586ef5aed22143ef9d70713977d5fb1f9114e21455fba90 + version: 5.2.0 + resolution: "diff@npm:5.2.0" + checksum: 12b63ca9c36c72bafa3effa77121f0581b4015df18bc16bac1f8e263597735649f1a173c26f7eba17fb4162b073fee61788abe49610e6c70a2641fe1895443fd languageName: node linkType: hard @@ -5418,13 +5976,6 @@ __metadata: languageName: node linkType: hard -"dns-equal@npm:^1.0.0": - version: 1.0.0 - resolution: "dns-equal@npm:1.0.0" - checksum: a8471ac849c7c13824f053babea1bc26e2f359394dd5a460f8340d8abd13434be01e3327a5c59d212f8c8997817450efd3f3ac77bec709b21979cf0235644524 - languageName: node - linkType: hard - "dns-packet@npm:^5.2.2": version: 5.6.1 resolution: "dns-packet@npm:5.6.1" @@ -5452,16 +6003,6 @@ __metadata: languageName: node linkType: hard -"dom-iterator@npm:^1.0.0": - version: 1.0.0 - resolution: "dom-iterator@npm:1.0.0" - dependencies: - component-props: 1.1.1 - component-xor: 0.0.4 - checksum: ad02e194985969fbf3c2a73897b667f81c15f28e4e6090d853f2062737b619825dc153744cd3fa7bf71a43305041e72fe2df99bdb80480166593358438a7de75 - languageName: node - linkType: hard - "dom-serializer@npm:^1.0.1": version: 1.4.1 resolution: "dom-serializer@npm:1.4.1" @@ -5520,14 +6061,14 @@ __metadata: languageName: node linkType: hard -"domutils@npm:^3.0.1": - version: 3.1.0 - resolution: "domutils@npm:3.1.0" +"domutils@npm:^3.0.1, domutils@npm:^3.2.1, domutils@npm:^3.2.2": + version: 3.2.2 + resolution: "domutils@npm:3.2.2" dependencies: dom-serializer: ^2.0.0 domelementtype: ^2.3.0 domhandler: ^5.0.3 - checksum: e5757456ddd173caa411cfc02c2bb64133c65546d2c4081381a3bafc8a57411a41eed70494551aa58030be9e58574fcc489828bebd673863d39924fb4878f416 + checksum: ae941d56f03d857077d55dde9297e960a625229fc2b933187cc4123084d7c2d2517f58283a7336567127029f1e008449bac8ac8506d44341e29e3bb18e02f906 languageName: node linkType: hard @@ -5541,19 +6082,23 @@ __metadata: languageName: node linkType: hard -"dot-prop@npm:^5.2.0": - version: 5.3.0 - resolution: "dot-prop@npm:5.3.0" +"dot-prop@npm:^6.0.1": + version: 6.0.1 + resolution: "dot-prop@npm:6.0.1" dependencies: is-obj: ^2.0.0 - checksum: d5775790093c234ef4bfd5fbe40884ff7e6c87573e5339432870616331189f7f5d86575c5b5af2dcf0f61172990f4f734d07844b1f23482fff09e3c4bead05ea + checksum: 0f47600a4b93e1dc37261da4e6909652c008832a5d3684b5bf9a9a0d3f4c67ea949a86dceed9b72f5733ed8e8e6383cc5958df3bbd0799ee317fd181f2ece700 languageName: node linkType: hard -"duplexer3@npm:^0.1.4": - version: 0.1.5 - resolution: "duplexer3@npm:0.1.5" - checksum: e677cb4c48f031ca728601d6a20bf6aed4c629d69ef9643cb89c67583d673c4ec9317cc6427501f38bd8c368d3a18f173987cc02bd99d8cf8fe3d94259a22a20 +"dunder-proto@npm:^1.0.1": + version: 1.0.1 + resolution: "dunder-proto@npm:1.0.1" + dependencies: + call-bind-apply-helpers: ^1.0.1 + es-errors: ^1.3.0 + gopd: ^1.2.0 + checksum: 149207e36f07bd4941921b0ca929e3a28f1da7bd6b6ff8ff7f4e2f2e460675af4576eeba359c635723dc189b64cdd4787e0255897d5b135ccc5d15cb8685fc90 languageName: node linkType: hard @@ -5578,17 +6123,10 @@ __metadata: languageName: node linkType: hard -"electron-to-chromium@npm:^1.4.535": - version: 1.4.544 - resolution: "electron-to-chromium@npm:1.4.544" - checksum: 78e88e4c56fc4faaa9a405de5e0b51305531e9cdf2c71bcc9296c2c59fb68001472e5b924f8701c873bc855ab5174cf0340642712d7af05c1d8e92356529397e - languageName: node - linkType: hard - -"electron-to-chromium@npm:^1.5.73": - version: 1.5.129 - resolution: "electron-to-chromium@npm:1.5.129" - checksum: 5a5d6b5c4e2baba03a2446e5e7cfddad046220007395efc685cc800b5a8cf2990cf4f76e24555210f844276a5219e8b955f879d62c0b12ebcda9d4377d6d4c8d +"electron-to-chromium@npm:^1.5.173": + version: 1.5.188 + resolution: "electron-to-chromium@npm:1.5.188" + checksum: 5e0ae772bd28472e523e7f684dbb2b37d80e270b52a74e9bc6c8ae21563d77b54f5ca602cf7951aa6e2c6df574d87c4fbd11c9bff2f21b83d6cfa83f047a6e92 languageName: node linkType: hard @@ -5606,6 +6144,13 @@ __metadata: languageName: node linkType: hard +"emojilib@npm:^2.4.0": + version: 2.4.0 + resolution: "emojilib@npm:2.4.0" + checksum: ea241c342abda5a86ffd3a15d8f4871a616d485f700e03daea38c6ce38205847cea9f6ff8d5e962c00516b004949cc96c6e37b05559ea71a0a496faba53b56da + languageName: node + linkType: hard + "emojis-list@npm:^3.0.0": version: 3.0.0 resolution: "emojis-list@npm:3.0.0" @@ -5613,10 +6158,10 @@ __metadata: languageName: node linkType: hard -"emoticon@npm:^3.2.0": - version: 3.2.0 - resolution: "emoticon@npm:3.2.0" - checksum: f30649d18b672ab3139e95cb04f77b2442feb95c99dc59372ff80fbfd639b2bf4018bc68ab0b549bd765aecf8230d7899c43f86cfcc7b6370c06c3232783e24f +"emoticon@npm:^4.0.1": + version: 4.1.0 + resolution: "emoticon@npm:4.1.0" + checksum: b19c997ec063eef7dfacd8713e26bca8129683b58aaf6be1600723811ec5dae18974398b808ac2972183d06d00e6e51a5b88ee92e51c69680bb855776e279a64 languageName: node linkType: hard @@ -5627,6 +6172,23 @@ __metadata: languageName: node linkType: hard +"encodeurl@npm:~2.0.0": + version: 2.0.0 + resolution: "encodeurl@npm:2.0.0" + checksum: abf5cd51b78082cf8af7be6785813c33b6df2068ce5191a40ca8b1afe6a86f9230af9a9ce694a5ce4665955e5c1120871826df9c128a642e09c58d592e2807fe + languageName: node + linkType: hard + +"encoding-sniffer@npm:^0.2.1": + version: 0.2.1 + resolution: "encoding-sniffer@npm:0.2.1" + dependencies: + iconv-lite: ^0.6.3 + whatwg-encoding: ^3.1.1 + checksum: d96cc88bbab6a88f57805491fa948b7b1c30f8488939fe4397c58c79ce766a1027f4c10de1893a9b5e489c4ad8ed927f6a8a87f1d114b6f3d5cb3bbbc73601d7 + languageName: node + linkType: hard + "encoding@npm:^0.1.13": version: 0.1.13 resolution: "encoding@npm:0.1.13" @@ -5636,22 +6198,13 @@ __metadata: languageName: node linkType: hard -"end-of-stream@npm:^1.1.0": - version: 1.4.4 - resolution: "end-of-stream@npm:1.4.4" - dependencies: - once: ^1.4.0 - checksum: 530a5a5a1e517e962854a31693dbb5c0b2fc40b46dad2a56a2deec656ca040631124f4795823acc68238147805f8b021abbe221f4afed5ef3c8e8efc2024908b - languageName: node - linkType: hard - -"enhanced-resolve@npm:^5.15.0": - version: 5.15.0 - resolution: "enhanced-resolve@npm:5.15.0" +"enhanced-resolve@npm:^5.17.2": + version: 5.18.2 + resolution: "enhanced-resolve@npm:5.18.2" dependencies: graceful-fs: ^4.2.4 tapable: ^2.2.0 - checksum: fbd8cdc9263be71cc737aa8a7d6c57b43d6aa38f6cc75dde6fcd3598a130cc465f979d2f4d01bb3bf475acb43817749c79f8eef9be048683602ca91ab52e4f11 + checksum: af8c0f19cc414f69d7595507576db470c7435f550e7aa1d46292c40aaf1fe03c4d714c495bc31aa927f90887faa8880db428c8bca4dc1595844853ab2195ee25 languageName: node linkType: hard @@ -5669,6 +6222,13 @@ __metadata: languageName: node linkType: hard +"entities@npm:^6.0.0": + version: 6.0.1 + resolution: "entities@npm:6.0.1" + checksum: 937b952e81aca641660a6a07f70001c6821973dea3ae7f6a5013eadce94620f3ed2e9c745832d503c8811ce6e97704d8a0396159580c0e567d815234de7fdecf + languageName: node + linkType: hard + "env-paths@npm:^2.2.0": version: 2.2.1 resolution: "env-paths@npm:2.2.1" @@ -5692,31 +6252,71 @@ __metadata: languageName: node linkType: hard +"es-define-property@npm:^1.0.0, es-define-property@npm:^1.0.1": + version: 1.0.1 + resolution: "es-define-property@npm:1.0.1" + checksum: 0512f4e5d564021c9e3a644437b0155af2679d10d80f21adaf868e64d30efdfbd321631956f20f42d655fedb2e3a027da479fad3fa6048f768eb453a80a5f80a + languageName: node + linkType: hard + +"es-errors@npm:^1.3.0": + version: 1.3.0 + resolution: "es-errors@npm:1.3.0" + checksum: ec1414527a0ccacd7f15f4a3bc66e215f04f595ba23ca75cdae0927af099b5ec865f9f4d33e9d7e86f512f252876ac77d4281a7871531a50678132429b1271b5 + languageName: node + linkType: hard + "es-module-lexer@npm:^1.2.1": - version: 1.3.1 - resolution: "es-module-lexer@npm:1.3.1" - checksum: 3beafa7e171eb1e8cc45695edf8d51638488dddf65294d7911f8d6a96249da6a9838c87529262cc6ea53988d8272cec0f4bff93f476ed031a54ba3afb51a0ed3 + version: 1.7.0 + resolution: "es-module-lexer@npm:1.7.0" + checksum: 7858bb76ae387fdbf8a6fccc951bf18919768309850587553eca34698b9193fbc65fab03d3d9f69163d860321fbf66adf89d5821e7f4148c7cb7d7b997259211 languageName: node linkType: hard -"escalade@npm:^3.1.1": - version: 3.1.1 - resolution: "escalade@npm:3.1.1" - checksum: a3e2a99f07acb74b3ad4989c48ca0c3140f69f923e56d0cba0526240ee470b91010f9d39001f2a4a313841d237ede70a729e92125191ba5d21e74b106800b133 +"es-object-atoms@npm:^1.0.0, es-object-atoms@npm:^1.1.1": + version: 1.1.1 + resolution: "es-object-atoms@npm:1.1.1" + dependencies: + es-errors: ^1.3.0 + checksum: 214d3767287b12f36d3d7267ef342bbbe1e89f899cfd67040309fc65032372a8e60201410a99a1645f2f90c1912c8c49c8668066f6bdd954bcd614dda2e3da97 + languageName: node + linkType: hard + +"esast-util-from-estree@npm:^2.0.0": + version: 2.0.0 + resolution: "esast-util-from-estree@npm:2.0.0" + dependencies: + "@types/estree-jsx": ^1.0.0 + devlop: ^1.0.0 + estree-util-visit: ^2.0.0 + unist-util-position-from-estree: ^2.0.0 + checksum: b9ea5b6db25decbe7c3be23a00251542641c9538499905d740d76fd5c9fea9f727ad1d0cce4f2071b6d9bb2f405f4f11acbdec9b8ea6485649cf60d886b99f28 + languageName: node + linkType: hard + +"esast-util-from-js@npm:^2.0.0": + version: 2.0.1 + resolution: "esast-util-from-js@npm:2.0.1" + dependencies: + "@types/estree-jsx": ^1.0.0 + acorn: ^8.0.0 + esast-util-from-estree: ^2.0.0 + vfile-message: ^4.0.0 + checksum: a262b94d973d8cc80227e083a7f1367028c4acf524e8f8507177626302bac567f260f75ea52321c8a9650e34c47e70bcc4f7696f710002f64b21aaa630e73e43 languageName: node linkType: hard -"escalade@npm:^3.2.0": +"escalade@npm:^3.1.1, escalade@npm:^3.2.0": version: 3.2.0 resolution: "escalade@npm:3.2.0" checksum: 47b029c83de01b0d17ad99ed766347b974b0d628e848de404018f3abee728e987da0d2d370ad4574aa3d5b5bfc368754fd085d69a30f8e75903486ec4b5b709e languageName: node linkType: hard -"escape-goat@npm:^2.0.0": - version: 2.1.1 - resolution: "escape-goat@npm:2.1.1" - checksum: ce05c70c20dd7007b60d2d644b625da5412325fdb57acf671ba06cb2ab3cd6789e2087026921a05b665b0a03fadee2955e7fc0b9a67da15a6551a980b260eba7 +"escape-goat@npm:^4.0.0": + version: 4.0.0 + resolution: "escape-goat@npm:4.0.0" + checksum: 7034e0025eec7b751074b837f10312c5b768493265bdad046347c0aadbc1e652776f7e5df94766473fecb5d3681169cc188fe9ccc1e22be53318c18be1671cc0 languageName: node linkType: hard @@ -5741,14 +6341,21 @@ __metadata: languageName: node linkType: hard +"escape-string-regexp@npm:^5.0.0": + version: 5.0.0 + resolution: "escape-string-regexp@npm:5.0.0" + checksum: 20daabe197f3cb198ec28546deebcf24b3dbb1a5a269184381b3116d12f0532e06007f4bc8da25669d6a7f8efb68db0758df4cd981f57bc5b57f521a3e12c59e + languageName: node + linkType: hard + "eslint-config-prettier@npm:^8.6.0": - version: 8.10.0 - resolution: "eslint-config-prettier@npm:8.10.0" + version: 8.10.2 + resolution: "eslint-config-prettier@npm:8.10.2" peerDependencies: eslint: ">=7.0.0" bin: eslint-config-prettier: bin/cli.js - checksum: 153266badd477e49b0759816246b2132f1dbdb6c7f313ca60a9af5822fd1071c2bc5684a3720d78b725452bbac04bb130878b2513aea5e72b1b792de5a69fec8 + checksum: a92b7e8a996e65adf79de1579524235687e9d3552d088cfab4f170da60d23762addb4276169c8ca3a9551329dda8408c59f7e414101b238a6385379ac1bc3b16 languageName: node linkType: hard @@ -5849,11 +6456,11 @@ __metadata: linkType: hard "esquery@npm:^1.4.2": - version: 1.5.0 - resolution: "esquery@npm:1.5.0" + version: 1.6.0 + resolution: "esquery@npm:1.6.0" dependencies: estraverse: ^5.1.0 - checksum: aefb0d2596c230118656cd4ec7532d447333a410a48834d80ea648b1e7b5c9bc9ed8b5e33a89cb04e487b60d622f44cf5713bf4abed7c97343edefdc84a35900 + checksum: 08ec4fe446d9ab27186da274d979558557fbdbbd10968fa9758552482720c54152a5640e08b9009e5a30706b66aba510692054d4129d32d0e12e05bbc0b96fb2 languageName: node linkType: hard @@ -5880,6 +6487,83 @@ __metadata: languageName: node linkType: hard +"estree-util-attach-comments@npm:^3.0.0": + version: 3.0.0 + resolution: "estree-util-attach-comments@npm:3.0.0" + dependencies: + "@types/estree": ^1.0.0 + checksum: 56254eaef39659e6351919ebc2ae53a37a09290a14571c19e373e9d5fad343a3403d9ad0c23ae465d6e7d08c3e572fd56fb8c793efe6434a261bf1489932dbd5 + languageName: node + linkType: hard + +"estree-util-build-jsx@npm:^3.0.0": + version: 3.0.1 + resolution: "estree-util-build-jsx@npm:3.0.1" + dependencies: + "@types/estree-jsx": ^1.0.0 + devlop: ^1.0.0 + estree-util-is-identifier-name: ^3.0.0 + estree-walker: ^3.0.0 + checksum: 185eff060eda2ba32cecd15904db4f5ba0681159fbdf54f0f6586cd9411e77e733861a833d0aee3415e1d1fd4b17edf08bc9e9872cee98e6ec7b0800e1a85064 + languageName: node + linkType: hard + +"estree-util-is-identifier-name@npm:^3.0.0": + version: 3.0.0 + resolution: "estree-util-is-identifier-name@npm:3.0.0" + checksum: ea3909f0188ea164af0aadeca87c087e3e5da78d76da5ae9c7954ff1340ea3e4679c4653bbf4299ffb70caa9b322218cc1128db2541f3d2976eb9704f9857787 + languageName: node + linkType: hard + +"estree-util-scope@npm:^1.0.0": + version: 1.0.0 + resolution: "estree-util-scope@npm:1.0.0" + dependencies: + "@types/estree": ^1.0.0 + devlop: ^1.0.0 + checksum: df2ed1b4c078002d50f7e330980e7b6f2630a1f551102203ee5000b61ed8ce5720fe7b9bc1a238a5fded5cf0f157dbe516ad6807323f037b3bb594bd1a0d61bb + languageName: node + linkType: hard + +"estree-util-to-js@npm:^2.0.0": + version: 2.0.0 + resolution: "estree-util-to-js@npm:2.0.0" + dependencies: + "@types/estree-jsx": ^1.0.0 + astring: ^1.8.0 + source-map: ^0.7.0 + checksum: 833edc94ab9978e0918f90261e0a3361bf4564fec4901f326d2237a9235d3f5fc6482da3be5acc545e702c8c7cb8bc5de5c7c71ba3b080eb1975bcfdf3923d79 + languageName: node + linkType: hard + +"estree-util-value-to-estree@npm:^3.0.1": + version: 3.4.0 + resolution: "estree-util-value-to-estree@npm:3.4.0" + dependencies: + "@types/estree": ^1.0.0 + checksum: a0cb37c756b5493a6a4227c299b3bfa717ccd08d58207586e84aff4d4bd84bb784bdd5c532e112e1686c7fe519b1bb01c48a62d1188e466d085ababb66decc62 + languageName: node + linkType: hard + +"estree-util-visit@npm:^2.0.0": + version: 2.0.0 + resolution: "estree-util-visit@npm:2.0.0" + dependencies: + "@types/estree-jsx": ^1.0.0 + "@types/unist": ^3.0.0 + checksum: 6444b38f224322945a6d19ea81a8828a0eec64aefb2bf1ea791fe20df496f7b7c543408d637df899e6a8e318b638f66226f16378a33c4c2b192ba5c3f891121f + languageName: node + linkType: hard + +"estree-walker@npm:^3.0.0": + version: 3.0.3 + resolution: "estree-walker@npm:3.0.3" + dependencies: + "@types/estree": ^1.0.0 + checksum: a65728d5727b71de172c5df323385755a16c0fdab8234dc756c3854cfee343261ddfbb72a809a5660fac8c75d960bb3e21aa898c2d7e9b19bb298482ca58a3af + languageName: node + linkType: hard + "esutils@npm:^2.0.2": version: 2.0.3 resolution: "esutils@npm:2.0.3" @@ -5887,7 +6571,7 @@ __metadata: languageName: node linkType: hard -"eta@npm:^2.0.0": +"eta@npm:^2.2.0": version: 2.2.0 resolution: "eta@npm:2.2.0" checksum: 6a09631481d4f26a9662a1eb736a65cc1cbc48e24935e6ff5d83a83b0cb509ea56d588d66d7c087d590601dc59bdabdac2356936b1b789d020eb0cf2d8304d54 @@ -5911,7 +6595,7 @@ __metadata: languageName: node linkType: hard -"eventemitter3@npm:^4.0.0": +"eventemitter3@npm:^4.0.0, eventemitter3@npm:^4.0.4": version: 4.0.7 resolution: "eventemitter3@npm:4.0.7" checksum: 1875311c42fcfe9c707b2712c32664a245629b42bb0a5a84439762dd0fd637fc54d078155ea83c2af9e0323c9ac13687e03cfba79b03af9f40c89b4960099374 @@ -5932,83 +6616,83 @@ __metadata: languageName: node linkType: hard -"execa@npm:7.2.0": - version: 7.2.0 - resolution: "execa@npm:7.2.0" +"execa@npm:5.1.1, execa@npm:^5.0.0": + version: 5.1.1 + resolution: "execa@npm:5.1.1" dependencies: cross-spawn: ^7.0.3 - get-stream: ^6.0.1 - human-signals: ^4.3.0 - is-stream: ^3.0.0 + get-stream: ^6.0.0 + human-signals: ^2.1.0 + is-stream: ^2.0.0 merge-stream: ^2.0.0 - npm-run-path: ^5.1.0 - onetime: ^6.0.0 - signal-exit: ^3.0.7 - strip-final-newline: ^3.0.0 - checksum: 14fd17ba0ca8c87b277584d93b1d9fc24f2a65e5152b31d5eb159a3b814854283eaae5f51efa9525e304447e2f757c691877f7adff8fde5746aae67eb1edd1cc + npm-run-path: ^4.0.1 + onetime: ^5.1.2 + signal-exit: ^3.0.3 + strip-final-newline: ^2.0.0 + checksum: fba9022c8c8c15ed862847e94c252b3d946036d7547af310e344a527e59021fd8b6bb0723883ea87044dc4f0201f949046993124a42ccb0855cae5bf8c786343 languageName: node linkType: hard -"execa@npm:^5.0.0": - version: 5.1.1 - resolution: "execa@npm:5.1.1" +"execa@npm:7.2.0": + version: 7.2.0 + resolution: "execa@npm:7.2.0" dependencies: cross-spawn: ^7.0.3 - get-stream: ^6.0.0 - human-signals: ^2.1.0 - is-stream: ^2.0.0 + get-stream: ^6.0.1 + human-signals: ^4.3.0 + is-stream: ^3.0.0 merge-stream: ^2.0.0 - npm-run-path: ^4.0.1 - onetime: ^5.1.2 - signal-exit: ^3.0.3 - strip-final-newline: ^2.0.0 - checksum: fba9022c8c8c15ed862847e94c252b3d946036d7547af310e344a527e59021fd8b6bb0723883ea87044dc4f0201f949046993124a42ccb0855cae5bf8c786343 + npm-run-path: ^5.1.0 + onetime: ^6.0.0 + signal-exit: ^3.0.7 + strip-final-newline: ^3.0.0 + checksum: 14fd17ba0ca8c87b277584d93b1d9fc24f2a65e5152b31d5eb159a3b814854283eaae5f51efa9525e304447e2f757c691877f7adff8fde5746aae67eb1edd1cc languageName: node linkType: hard "exponential-backoff@npm:^3.1.1": - version: 3.1.1 - resolution: "exponential-backoff@npm:3.1.1" - checksum: 3d21519a4f8207c99f7457287291316306255a328770d320b401114ec8481986e4e467e854cb9914dd965e0a1ca810a23ccb559c642c88f4c7f55c55778a9b48 + version: 3.1.2 + resolution: "exponential-backoff@npm:3.1.2" + checksum: 7e191e3dd6edd8c56c88f2c8037c98fbb8034fe48778be53ed8cb30ccef371a061a4e999a469aab939b92f8f12698f3b426d52f4f76b7a20da5f9f98c3cbc862 languageName: node linkType: hard "express@npm:^4.17.3": - version: 4.18.2 - resolution: "express@npm:4.18.2" + version: 4.21.2 + resolution: "express@npm:4.21.2" dependencies: accepts: ~1.3.8 array-flatten: 1.1.1 - body-parser: 1.20.1 + body-parser: 1.20.3 content-disposition: 0.5.4 content-type: ~1.0.4 - cookie: 0.5.0 + cookie: 0.7.1 cookie-signature: 1.0.6 debug: 2.6.9 depd: 2.0.0 - encodeurl: ~1.0.2 + encodeurl: ~2.0.0 escape-html: ~1.0.3 etag: ~1.8.1 - finalhandler: 1.2.0 + finalhandler: 1.3.1 fresh: 0.5.2 http-errors: 2.0.0 - merge-descriptors: 1.0.1 + merge-descriptors: 1.0.3 methods: ~1.1.2 on-finished: 2.4.1 parseurl: ~1.3.3 - path-to-regexp: 0.1.7 + path-to-regexp: 0.1.12 proxy-addr: ~2.0.7 - qs: 6.11.0 + qs: 6.13.0 range-parser: ~1.2.1 safe-buffer: 5.2.1 - send: 0.18.0 - serve-static: 1.15.0 + send: 0.19.0 + serve-static: 1.16.2 setprototypeof: 1.2.0 statuses: 2.0.1 type-is: ~1.6.18 utils-merge: 1.0.1 vary: ~1.1.2 - checksum: 3c4b9b076879442f6b968fe53d85d9f1eeacbb4f4c41e5f16cc36d77ce39a2b0d81b3f250514982110d815b2f7173f5561367f9110fcc541f9371948e8c8b037 + checksum: 3aef1d355622732e20b8f3a7c112d4391d44e2131f4f449e1f273a309752a41abfad714e881f177645517cbe29b3ccdc10b35e7e25c13506114244a5b72f549d languageName: node linkType: hard @@ -6035,29 +6719,16 @@ __metadata: languageName: node linkType: hard -"fast-glob@npm:^3.2.11, fast-glob@npm:^3.2.9, fast-glob@npm:^3.3.0": - version: 3.3.1 - resolution: "fast-glob@npm:3.3.1" - dependencies: - "@nodelib/fs.stat": ^2.0.2 - "@nodelib/fs.walk": ^1.2.3 - glob-parent: ^5.1.2 - merge2: ^1.3.0 - micromatch: ^4.0.4 - checksum: b6f3add6403e02cf3a798bfbb1183d0f6da2afd368f27456010c0bc1f9640aea308243d4cb2c0ab142f618276e65ecb8be1661d7c62a7b4e5ba774b9ce5432e5 - languageName: node - linkType: hard - -"fast-glob@npm:^3.3.2": - version: 3.3.2 - resolution: "fast-glob@npm:3.3.2" +"fast-glob@npm:^3.2.11, fast-glob@npm:^3.2.9, fast-glob@npm:^3.3.0, fast-glob@npm:^3.3.2": + version: 3.3.3 + resolution: "fast-glob@npm:3.3.3" dependencies: "@nodelib/fs.stat": ^2.0.2 "@nodelib/fs.walk": ^1.2.3 glob-parent: ^5.1.2 merge2: ^1.3.0 - micromatch: ^4.0.4 - checksum: 900e4979f4dbc3313840078419245621259f349950411ca2fa445a2f9a1a6d98c3b5e7e0660c5ccd563aa61abe133a21765c6c0dec8e57da1ba71d8000b05ec1 + micromatch: ^4.0.8 + checksum: 0704d7b85c0305fd2cef37777337dfa26230fdd072dce9fb5c82a4b03156f3ffb8ed3e636033e65d45d2a5805a4e475825369a27404c0307f2db0c8eb3366fbd languageName: node linkType: hard @@ -6075,21 +6746,28 @@ __metadata: languageName: node linkType: hard -"fast-url-parser@npm:1.1.3": - version: 1.1.3 - resolution: "fast-url-parser@npm:1.1.3" - dependencies: - punycode: ^1.3.2 - checksum: 5043d0c4a8d775ff58504d56c096563c11b113e4cb8a2668c6f824a1cd4fb3812e2fdf76537eb24a7ce4ae7def6bd9747da630c617cf2a4b6ce0c42514e4f21c +"fast-uri@npm:^3.0.1": + version: 3.0.6 + resolution: "fast-uri@npm:3.0.6" + checksum: 7161ba2a7944778d679ba8e5f00d6a2bb479a2142df0982f541d67be6c979b17808f7edbb0ce78161c85035974bde3fa52b5137df31da46c0828cb629ba67c4e languageName: node linkType: hard "fastq@npm:^1.6.0": - version: 1.15.0 - resolution: "fastq@npm:1.15.0" + version: 1.19.1 + resolution: "fastq@npm:1.19.1" dependencies: reusify: ^1.0.4 - checksum: 0170e6bfcd5d57a70412440b8ef600da6de3b2a6c5966aeaf0a852d542daff506a0ee92d6de7679d1de82e644bce69d7a574a6c93f0b03964b5337eed75ada1a + checksum: 7691d1794fb84ad0ec2a185f10e00f0e1713b894e2c9c4d42f0bc0ba5f8c00e6e655a202074ca0b91b9c3d977aab7c30c41a8dc069fb5368576ac0054870a0e6 + languageName: node + linkType: hard + +"fault@npm:^2.0.0": + version: 2.0.1 + resolution: "fault@npm:2.0.1" + dependencies: + format: ^0.2.0 + checksum: c9b30f47d95769177130a9409976a899ed31eb598450fbad5b0d39f2f5f56d5f4a9ff9257e0bee8407cb0fc3ce37165657888c6aa6d78472e403893104329b72 languageName: node linkType: hard @@ -6102,34 +6780,15 @@ __metadata: languageName: node linkType: hard -"fbemitter@npm:^3.0.0": - version: 3.0.0 - resolution: "fbemitter@npm:3.0.0" - dependencies: - fbjs: ^3.0.0 - checksum: 069690b8cdff3521ade3c9beb92ba0a38d818a86ef36dff8690e66749aef58809db4ac0d6938eb1cacea2dbef5f2a508952d455669590264cdc146bbe839f605 - languageName: node - linkType: hard - -"fbjs-css-vars@npm:^1.0.0": - version: 1.0.2 - resolution: "fbjs-css-vars@npm:1.0.2" - checksum: 72baf6d22c45b75109118b4daecb6c8016d4c83c8c0f23f683f22e9d7c21f32fff6201d288df46eb561e3c7d4bb4489b8ad140b7f56444c453ba407e8bd28511 - languageName: node - linkType: hard - -"fbjs@npm:^3.0.0, fbjs@npm:^3.0.1": - version: 3.0.5 - resolution: "fbjs@npm:3.0.5" - dependencies: - cross-fetch: ^3.1.5 - fbjs-css-vars: ^1.0.0 - loose-envify: ^1.0.0 - object-assign: ^4.1.0 - promise: ^7.1.1 - setimmediate: ^1.0.5 - ua-parser-js: ^1.0.35 - checksum: e609b5b64686bc96495a5c67728ed9b2710b9b3d695c5759c5f5e47c9483d1c323543ac777a86459e3694efc5712c6ce7212e944feb19752867d699568bb0e54 +"fdir@npm:^6.4.4": + version: 6.4.6 + resolution: "fdir@npm:6.4.6" + peerDependencies: + picomatch: ^3 || ^4 + peerDependenciesMeta: + picomatch: + optional: true + checksum: fe9f3014901d023cf631831dcb9eae5447f4d7f69218001dd01ecf007eccc40f6c129a04411b5cc273a5f93c14e02e971e17270afc9022041c80be924091eb6f languageName: node linkType: hard @@ -6142,6 +6801,15 @@ __metadata: languageName: node linkType: hard +"figures@npm:^3.2.0": + version: 3.2.0 + resolution: "figures@npm:3.2.0" + dependencies: + escape-string-regexp: ^1.0.5 + checksum: 85a6ad29e9aca80b49b817e7c89ecc4716ff14e3779d9835af554db91bac41c0f289c418923519392a1e582b4d10482ad282021330cd045bb7b80c84152f2a2b + languageName: node + linkType: hard + "file-entry-cache@npm:^6.0.1": version: 6.0.1 resolution: "file-entry-cache@npm:6.0.1" @@ -6163,22 +6831,6 @@ __metadata: languageName: node linkType: hard -"filesize@npm:^8.0.6": - version: 8.0.7 - resolution: "filesize@npm:8.0.7" - checksum: 8603d27c5287b984cb100733640645e078f5f5ad65c6d913173e01fb99e09b0747828498fd86647685ccecb69be31f3587b9739ab1e50732116b2374aff4cbf9 - languageName: node - linkType: hard - -"fill-range@npm:^7.0.1": - version: 7.0.1 - resolution: "fill-range@npm:7.0.1" - dependencies: - to-regex-range: ^5.0.1 - checksum: cc283f4e65b504259e64fd969bcf4def4eb08d85565e906b7d36516e87819db52029a76b6363d0f02d0d532f0033c9603b9e2d943d56ee3b0d4f7ad3328ff917 - languageName: node - linkType: hard - "fill-range@npm:^7.1.1": version: 7.1.1 resolution: "fill-range@npm:7.1.1" @@ -6188,48 +6840,28 @@ __metadata: languageName: node linkType: hard -"finalhandler@npm:1.2.0": - version: 1.2.0 - resolution: "finalhandler@npm:1.2.0" +"finalhandler@npm:1.3.1": + version: 1.3.1 + resolution: "finalhandler@npm:1.3.1" dependencies: debug: 2.6.9 - encodeurl: ~1.0.2 + encodeurl: ~2.0.0 escape-html: ~1.0.3 on-finished: 2.4.1 parseurl: ~1.3.3 statuses: 2.0.1 unpipe: ~1.0.0 - checksum: 92effbfd32e22a7dff2994acedbd9bcc3aa646a3e919ea6a53238090e87097f8ef07cced90aa2cc421abdf993aefbdd5b00104d55c7c5479a8d00ed105b45716 - languageName: node - linkType: hard - -"find-cache-dir@npm:^3.3.1": - version: 3.3.2 - resolution: "find-cache-dir@npm:3.3.2" - dependencies: - commondir: ^1.0.1 - make-dir: ^3.0.2 - pkg-dir: ^4.1.0 - checksum: 1e61c2e64f5c0b1c535bd85939ae73b0e5773142713273818cc0b393ee3555fb0fd44e1a5b161b8b6c3e03e98c2fcc9c227d784850a13a90a8ab576869576817 + checksum: a8c58cd97c9cd47679a870f6833a7b417043f5a288cd6af6d0f49b476c874a506100303a128b6d3b654c3d74fa4ff2ffed68a48a27e8630cda5c918f2977dcf4 languageName: node linkType: hard -"find-up@npm:^3.0.0": - version: 3.0.0 - resolution: "find-up@npm:3.0.0" - dependencies: - locate-path: ^3.0.0 - checksum: 38eba3fe7a66e4bc7f0f5a1366dc25508b7cfc349f852640e3678d26ad9a6d7e2c43eff0a472287de4a9753ef58f066a0ea892a256fa3636ad51b3fe1e17fae9 - languageName: node - linkType: hard - -"find-up@npm:^4.0.0": - version: 4.1.0 - resolution: "find-up@npm:4.1.0" +"find-cache-dir@npm:^4.0.0": + version: 4.0.0 + resolution: "find-cache-dir@npm:4.0.0" dependencies: - locate-path: ^5.0.0 - path-exists: ^4.0.0 - checksum: 4c172680e8f8c1f78839486e14a43ef82e9decd0e74145f40707cc42e7420506d5ec92d9a11c22bd2c48fb0c384ea05dd30e10dd152fefeec6f2f75282a8b844 + common-path-prefix: ^3.0.0 + pkg-dir: ^7.0.0 + checksum: 52a456a80deeb27daa3af6e06059b63bdb9cc4af4d845fc6d6229887e505ba913cd56000349caa60bc3aa59dacdb5b4c37903d4ba34c75102d83cab330b70d2f languageName: node linkType: hard @@ -6243,84 +6875,74 @@ __metadata: languageName: node linkType: hard +"find-up@npm:^6.3.0": + version: 6.3.0 + resolution: "find-up@npm:6.3.0" + dependencies: + locate-path: ^7.1.0 + path-exists: ^5.0.0 + checksum: 9a21b7f9244a420e54c6df95b4f6fc3941efd3c3e5476f8274eb452f6a85706e7a6a90de71353ee4f091fcb4593271a6f92810a324ec542650398f928783c280 + languageName: node + linkType: hard + "flat-cache@npm:^3.0.4": - version: 3.1.1 - resolution: "flat-cache@npm:3.1.1" + version: 3.2.0 + resolution: "flat-cache@npm:3.2.0" dependencies: flatted: ^3.2.9 keyv: ^4.5.3 rimraf: ^3.0.2 - checksum: 4958cfe0f46acf84953d4e16676ef5f0d38eab3a92d532a1e8d5f88f11eea8b36d5d598070ff2aeae15f1fde18f8d7d089eefaf9db10b5a587cc1c9072325c7a + checksum: e7e0f59801e288b54bee5cb9681e9ee21ee28ef309f886b312c9d08415b79fc0f24ac842f84356ce80f47d6a53de62197ce0e6e148dc42d5db005992e2a756ec languageName: node linkType: hard -"flatted@npm:^3.2.9": - version: 3.2.9 - resolution: "flatted@npm:3.2.9" - checksum: f14167fbe26a9d20f6fca8d998e8f1f41df72c8e81f9f2c9d61ed2bea058248f5e1cbd05e7f88c0e5087a6a0b822a1e5e2b446e879f3cfbe0b07ba2d7f80b026 +"flat@npm:^5.0.2": + version: 5.0.2 + resolution: "flat@npm:5.0.2" + bin: + flat: cli.js + checksum: 12a1536ac746db74881316a181499a78ef953632ddd28050b7a3a43c62ef5462e3357c8c29d76072bb635f147f7a9a1f0c02efef6b4be28f8db62ceb3d5c7f5d languageName: node linkType: hard -"flux@npm:^4.0.1": - version: 4.0.4 - resolution: "flux@npm:4.0.4" - dependencies: - fbemitter: ^3.0.0 - fbjs: ^3.0.1 - peerDependencies: - react: ^15.0.2 || ^16.0.0 || ^17.0.0 - checksum: 8fa5c2f9322258de3e331f67c6f1078a7f91c4dec9dbe8a54c4b8a80eed19a4f91889028b768668af4a796e8f2ee75e461e1571b8615432a3920ae95cc4ff794 +"flatted@npm:^3.2.9": + version: 3.3.3 + resolution: "flatted@npm:3.3.3" + checksum: 8c96c02fbeadcf4e8ffd0fa24983241e27698b0781295622591fc13585e2f226609d95e422bcf2ef044146ffacb6b68b1f20871454eddf75ab3caa6ee5f4a1fe languageName: node linkType: hard -"follow-redirects@npm:^1.0.0, follow-redirects@npm:^1.14.7": - version: 1.15.3 - resolution: "follow-redirects@npm:1.15.3" +"follow-redirects@npm:^1.0.0": + version: 1.15.9 + resolution: "follow-redirects@npm:1.15.9" peerDependenciesMeta: debug: optional: true - checksum: 584da22ec5420c837bd096559ebfb8fe69d82512d5585004e36a3b4a6ef6d5905780e0c74508c7b72f907d1fa2b7bd339e613859e9c304d0dc96af2027fd0231 + checksum: 859e2bacc7a54506f2bf9aacb10d165df78c8c1b0ceb8023f966621b233717dab56e8d08baadc3ad3b9db58af290413d585c999694b7c146aaf2616340c3d2a6 languageName: node linkType: hard "foreground-child@npm:^3.1.0": - version: 3.1.1 - resolution: "foreground-child@npm:3.1.1" + version: 3.3.1 + resolution: "foreground-child@npm:3.3.1" dependencies: - cross-spawn: ^7.0.0 + cross-spawn: ^7.0.6 signal-exit: ^4.0.1 - checksum: 139d270bc82dc9e6f8bc045fe2aae4001dc2472157044fdfad376d0a3457f77857fa883c1c8b21b491c6caade9a926a4bed3d3d2e8d3c9202b151a4cbbd0bcd5 - languageName: node - linkType: hard - -"fork-ts-checker-webpack-plugin@npm:^6.5.0": - version: 6.5.3 - resolution: "fork-ts-checker-webpack-plugin@npm:6.5.3" - dependencies: - "@babel/code-frame": ^7.8.3 - "@types/json-schema": ^7.0.5 - chalk: ^4.1.0 - chokidar: ^3.4.2 - cosmiconfig: ^6.0.0 - deepmerge: ^4.2.2 - fs-extra: ^9.0.0 - glob: ^7.1.6 - memfs: ^3.1.2 - minimatch: ^3.0.4 - schema-utils: 2.7.0 - semver: ^7.3.2 - tapable: ^1.0.0 - peerDependencies: - eslint: ">= 6" - typescript: ">= 2.7" - vue-template-compiler: "*" - webpack: ">= 4" - peerDependenciesMeta: - eslint: - optional: true - vue-template-compiler: - optional: true - checksum: 9732a49bfeed8fc23e6e8a59795fa7c238edeba91040a9b520db54b4d316dda27f9f1893d360e296fd0ad8930627d364417d28a8c7007fba60cc730ebfce4956 + checksum: b2c1a6fc0bf0233d645d9fefdfa999abf37db1b33e5dab172b3cbfb0662b88bfbd2c9e7ab853533d199050ec6b65c03fcf078fc212d26e4990220e98c6930eef + languageName: node + linkType: hard + +"form-data-encoder@npm:^2.1.2": + version: 2.1.4 + resolution: "form-data-encoder@npm:2.1.4" + checksum: e0b3e5950fb69b3f32c273944620f9861f1933df9d3e42066e038e26dfb343d0f4465de9f27e0ead1a09d9df20bc2eed06a63c2ca2f8f00949e7202bae9e29dd + languageName: node + linkType: hard + +"format@npm:^0.2.0": + version: 0.2.2 + resolution: "format@npm:0.2.2" + checksum: 646a60e1336250d802509cf24fb801e43bd4a70a07510c816fa133aa42cdbc9c21e66e9cc0801bb183c5b031c9d68be62e7fbb6877756e52357850f92aa28799 languageName: node linkType: hard @@ -6345,7 +6967,7 @@ __metadata: languageName: node linkType: hard -"fs-extra@npm:^10.1.0": +"fs-extra@npm:^10.0.0": version: 10.1.0 resolution: "fs-extra@npm:10.1.0" dependencies: @@ -6356,24 +6978,14 @@ __metadata: languageName: node linkType: hard -"fs-extra@npm:^9.0.0": - version: 9.1.0 - resolution: "fs-extra@npm:9.1.0" +"fs-extra@npm:^11.1.1, fs-extra@npm:^11.2.0": + version: 11.3.0 + resolution: "fs-extra@npm:11.3.0" dependencies: - at-least-node: ^1.0.0 graceful-fs: ^4.2.0 jsonfile: ^6.0.1 universalify: ^2.0.0 - checksum: ba71ba32e0faa74ab931b7a0031d1523c66a73e225de7426e275e238e312d07313d2da2d33e34a52aa406c8763ade5712eb3ec9ba4d9edce652bcacdc29e6b20 - languageName: node - linkType: hard - -"fs-minipass@npm:^2.0.0": - version: 2.1.0 - resolution: "fs-minipass@npm:2.1.0" - dependencies: - minipass: ^3.0.0 - checksum: 1b8d128dae2ac6cc94230cc5ead341ba3e0efaef82dab46a33d171c044caaa6ca001364178d42069b2809c35a1c3c35079a32107c770e9ffab3901b59af8c8b1 + checksum: f983c706e0c22b0c0747a8e9c76aed6f391ba2d76734cf2757cd84da13417b402ed68fe25bace65228856c61d36d3b41da198f1ffbf33d0b34283a2f7a62c6e9 languageName: node linkType: hard @@ -6387,9 +6999,9 @@ __metadata: linkType: hard "fs-monkey@npm:^1.0.4": - version: 1.0.5 - resolution: "fs-monkey@npm:1.0.5" - checksum: 424b67f65b37fe66117ae2bb061f790fe6d4b609e1d160487c74b3d69fbf42f262c665ccfba32e8b5f113f96f92e9a58fcdebe42d5f6649bdfc72918093a3119 + version: 1.1.0 + resolution: "fs-monkey@npm:1.1.0" + checksum: ebb6305a37ca4731ffe9aceae21be40992fe5384f7a25819a1d64d17c649e7eeac3fc9ad6269cad6fffc409df0f4583253c93a930549fd82d5f8aed46beb5b9b languageName: node linkType: hard @@ -6419,13 +7031,6 @@ __metadata: languageName: node linkType: hard -"function-bind@npm:^1.1.1": - version: 1.1.1 - resolution: "function-bind@npm:1.1.1" - checksum: b32fbaebb3f8ec4969f033073b43f5c8befbb58f1a79e12f1d7490358150359ebd92f49e72ff0144f65f2c48ea2a605bff2d07965f548f6474fd8efd95bf361a - languageName: node - linkType: hard - "function-bind@npm:^1.1.2": version: 1.1.2 resolution: "function-bind@npm:1.1.2" @@ -6433,38 +7038,28 @@ __metadata: languageName: node linkType: hard -"gauge@npm:^4.0.3": - version: 4.0.4 - resolution: "gauge@npm:4.0.4" - dependencies: - aproba: ^1.0.3 || ^2.0.0 - color-support: ^1.1.3 - console-control-strings: ^1.1.0 - has-unicode: ^2.0.1 - signal-exit: ^3.0.7 - string-width: ^4.2.3 - strip-ansi: ^6.0.1 - wide-align: ^1.1.5 - checksum: 788b6bfe52f1dd8e263cda800c26ac0ca2ff6de0b6eee2fe0d9e3abf15e149b651bd27bf5226be10e6e3edb5c4e5d5985a5a1a98137e7a892f75eff76467ad2d - languageName: node - linkType: hard - -"gensync@npm:^1.0.0-beta.1, gensync@npm:^1.0.0-beta.2": +"gensync@npm:^1.0.0-beta.2": version: 1.0.0-beta.2 resolution: "gensync@npm:1.0.0-beta.2" checksum: a7437e58c6be12aa6c90f7730eac7fa9833dc78872b4ad2963d2031b00a3367a93f98aec75f9aaac7220848e4026d67a8655e870b24f20a543d103c0d65952ec languageName: node linkType: hard -"get-intrinsic@npm:^1.0.2, get-intrinsic@npm:^1.1.1, get-intrinsic@npm:^1.1.3, get-intrinsic@npm:^1.2.1": - version: 1.2.1 - resolution: "get-intrinsic@npm:1.2.1" +"get-intrinsic@npm:^1.2.4, get-intrinsic@npm:^1.2.5, get-intrinsic@npm:^1.3.0": + version: 1.3.0 + resolution: "get-intrinsic@npm:1.3.0" dependencies: - function-bind: ^1.1.1 - has: ^1.0.3 - has-proto: ^1.0.1 - has-symbols: ^1.0.3 - checksum: 5b61d88552c24b0cf6fa2d1b3bc5459d7306f699de060d76442cce49a4721f52b8c560a33ab392cf5575b7810277d54ded9d4d39a1ea61855619ebc005aa7e5f + call-bind-apply-helpers: ^1.0.2 + es-define-property: ^1.0.1 + es-errors: ^1.3.0 + es-object-atoms: ^1.1.1 + function-bind: ^1.1.2 + get-proto: ^1.0.1 + gopd: ^1.2.0 + has-symbols: ^1.1.0 + hasown: ^2.0.2 + math-intrinsics: ^1.1.0 + checksum: 301008e4482bb9a9cb49e132b88fee093bff373b4e6def8ba219b1e96b60158a6084f273ef5cafe832e42cd93462f4accb46a618d35fe59a2b507f2388c5b79d languageName: node linkType: hard @@ -6475,21 +7070,13 @@ __metadata: languageName: node linkType: hard -"get-stream@npm:^4.1.0": - version: 4.1.0 - resolution: "get-stream@npm:4.1.0" - dependencies: - pump: ^3.0.0 - checksum: 443e1914170c15bd52ff8ea6eff6dfc6d712b031303e36302d2778e3de2506af9ee964d6124010f7818736dcfde05c04ba7ca6cc26883106e084357a17ae7d73 - languageName: node - linkType: hard - -"get-stream@npm:^5.1.0": - version: 5.2.0 - resolution: "get-stream@npm:5.2.0" +"get-proto@npm:^1.0.1": + version: 1.0.1 + resolution: "get-proto@npm:1.0.1" dependencies: - pump: ^3.0.0 - checksum: 8bc1a23174a06b2b4ce600df38d6c98d2ef6d84e020c1ddad632ad75bac4e092eeb40e4c09e0761c35fc2dbc5e7fff5dab5e763a383582c4a167dd69a905bd12 + dunder-proto: ^1.0.1 + es-object-atoms: ^1.0.0 + checksum: 4fc96afdb58ced9a67558698b91433e6b037aaa6f1493af77498d7c85b141382cf223c0e5946f334fb328ee85dfe6edd06d218eaf09556f4bc4ec6005d7f5f7b languageName: node linkType: hard @@ -6500,7 +7087,7 @@ __metadata: languageName: node linkType: hard -"github-slugger@npm:^1.4.0": +"github-slugger@npm:^1.5.0": version: 1.5.0 resolution: "github-slugger@npm:1.5.0" checksum: c70988224578b3bdaa25df65973ffc8c24594a77a28550c3636e495e49d17aef5cdb04c04fa3f1744babef98c61eecc6a43299a13ea7f3cc33d680bf9053ffbe @@ -6532,22 +7119,7 @@ __metadata: languageName: node linkType: hard -"glob@npm:^10.2.2": - version: 10.3.10 - resolution: "glob@npm:10.3.10" - dependencies: - foreground-child: ^3.1.0 - jackspeak: ^2.3.5 - minimatch: ^9.0.1 - minipass: ^5.0.0 || ^6.0.2 || ^7.0.0 - path-scurry: ^1.10.1 - bin: - glob: dist/esm/bin.mjs - checksum: 4f2fe2511e157b5a3f525a54092169a5f92405f24d2aed3142f4411df328baca13059f4182f1db1bf933e2c69c0bd89e57ae87edd8950cba8c7ccbe84f721cf3 - languageName: node - linkType: hard - -"glob@npm:^10.3.10": +"glob@npm:^10.2.2, glob@npm:^10.3.10": version: 10.4.5 resolution: "glob@npm:10.4.5" dependencies: @@ -6563,7 +7135,7 @@ __metadata: languageName: node linkType: hard -"glob@npm:^7.0.0, glob@npm:^7.1.3, glob@npm:^7.1.4, glob@npm:^7.1.6": +"glob@npm:^7.1.3": version: 7.2.3 resolution: "glob@npm:7.2.3" dependencies: @@ -6586,43 +7158,16 @@ __metadata: languageName: node linkType: hard -"global-modules@npm:^2.0.0": - version: 2.0.0 - resolution: "global-modules@npm:2.0.0" - dependencies: - global-prefix: ^3.0.0 - checksum: d6197f25856c878c2fb5f038899f2dca7cbb2f7b7cf8999660c0104972d5cfa5c68b5a0a77fa8206bb536c3903a4615665acb9709b4d80846e1bb47eaef65430 - languageName: node - linkType: hard - -"global-prefix@npm:^3.0.0": - version: 3.0.0 - resolution: "global-prefix@npm:3.0.0" - dependencies: - ini: ^1.3.5 - kind-of: ^6.0.2 - which: ^1.3.1 - checksum: 8a82fc1d6f22c45484a4e34656cc91bf021a03e03213b0035098d605bfc612d7141f1e14a21097e8a0413b4884afd5b260df0b6a25605ce9d722e11f1df2881d - languageName: node - linkType: hard - -"globals@npm:^11.1.0": - version: 11.12.0 - resolution: "globals@npm:11.12.0" - checksum: 67051a45eca3db904aee189dfc7cd53c20c7d881679c93f6146ddd4c9f4ab2268e68a919df740d39c71f4445d2b38ee360fc234428baea1dbdfe68bbcb46979e - languageName: node - linkType: hard - "globals@npm:^13.19.0": - version: 13.23.0 - resolution: "globals@npm:13.23.0" + version: 13.24.0 + resolution: "globals@npm:13.24.0" dependencies: type-fest: ^0.20.2 - checksum: 194c97cf8d1ef6ba59417234c2386549c4103b6e5f24b1ff1952de61a4753e5d2069435ba629de711a6480b1b1d114a98e2ab27f85e966d5a10c319c3bbd3dc3 + checksum: 56066ef058f6867c04ff203b8a44c15b038346a62efbc3060052a1016be9f56f4cf0b2cd45b74b22b81e521a889fc7786c73691b0549c2f3a6e825b3d394f43c languageName: node linkType: hard -"globby@npm:^11.0.1, globby@npm:^11.0.4, globby@npm:^11.1.0": +"globby@npm:^11.1.0": version: 11.1.0 resolution: "globby@npm:11.1.0" dependencies: @@ -6649,35 +7194,40 @@ __metadata: languageName: node linkType: hard -"gopd@npm:^1.0.1": - version: 1.0.1 - resolution: "gopd@npm:1.0.1" - dependencies: - get-intrinsic: ^1.1.3 - checksum: a5ccfb8806e0917a94e0b3de2af2ea4979c1da920bc381667c260e00e7cafdbe844e2cb9c5bcfef4e5412e8bf73bab837285bc35c7ba73aaaf0134d4583393a6 +"gopd@npm:^1.0.1, gopd@npm:^1.2.0": + version: 1.2.0 + resolution: "gopd@npm:1.2.0" + checksum: cc6d8e655e360955bdccaca51a12a474268f95bb793fc3e1f2bdadb075f28bfd1fd988dab872daf77a61d78cbaf13744bc8727a17cfb1d150d76047d805375f3 languageName: node linkType: hard -"got@npm:^9.6.0": - version: 9.6.0 - resolution: "got@npm:9.6.0" +"got@npm:^12.1.0": + version: 12.6.1 + resolution: "got@npm:12.6.1" dependencies: - "@sindresorhus/is": ^0.14.0 - "@szmarczak/http-timer": ^1.1.2 - cacheable-request: ^6.0.0 - decompress-response: ^3.3.0 - duplexer3: ^0.1.4 - get-stream: ^4.1.0 - lowercase-keys: ^1.0.1 - mimic-response: ^1.0.1 - p-cancelable: ^1.0.0 - to-readable-stream: ^1.0.0 - url-parse-lax: ^3.0.0 - checksum: 941807bd9704bacf5eb401f0cc1212ffa1f67c6642f2d028fd75900471c221b1da2b8527f4553d2558f3faeda62ea1cf31665f8b002c6137f5de8732f07370b0 + "@sindresorhus/is": ^5.2.0 + "@szmarczak/http-timer": ^5.0.1 + cacheable-lookup: ^7.0.0 + cacheable-request: ^10.2.8 + decompress-response: ^6.0.0 + form-data-encoder: ^2.1.2 + get-stream: ^6.0.1 + http2-wrapper: ^2.1.10 + lowercase-keys: ^3.0.0 + p-cancelable: ^3.0.0 + responselike: ^3.0.0 + checksum: 3c37f5d858aca2859f9932e7609d35881d07e7f2d44c039d189396f0656896af6c77c22f2c51c563f8918be483f60ff41e219de742ab4642d4b106711baccbd5 + languageName: node + linkType: hard + +"graceful-fs@npm:4.2.10": + version: 4.2.10 + resolution: "graceful-fs@npm:4.2.10" + checksum: 3f109d70ae123951905d85032ebeae3c2a5a7a997430df00ea30df0e3a6c60cf6689b109654d6fdacd28810a053348c4d14642da1d075049e6be1ba5216218da languageName: node linkType: hard -"graceful-fs@npm:^4.1.2, graceful-fs@npm:^4.1.6, graceful-fs@npm:^4.2.0, graceful-fs@npm:^4.2.4, graceful-fs@npm:^4.2.6, graceful-fs@npm:^4.2.9": +"graceful-fs@npm:^4.1.11, graceful-fs@npm:^4.1.2, graceful-fs@npm:^4.1.6, graceful-fs@npm:^4.2.0, graceful-fs@npm:^4.2.11, graceful-fs@npm:^4.2.4, graceful-fs@npm:^4.2.6, graceful-fs@npm:^4.2.9": version: 4.2.11 resolution: "graceful-fs@npm:4.2.11" checksum: ac85f94da92d8eb6b7f5a8b20ce65e43d66761c55ce85ac96df6865308390da45a8d3f0296dd3a663de65d30ba497bd46c696cc1e248c72b13d6d567138a4fc7 @@ -6733,47 +7283,26 @@ __metadata: languageName: node linkType: hard -"has-property-descriptors@npm:^1.0.0": - version: 1.0.0 - resolution: "has-property-descriptors@npm:1.0.0" +"has-property-descriptors@npm:^1.0.0, has-property-descriptors@npm:^1.0.2": + version: 1.0.2 + resolution: "has-property-descriptors@npm:1.0.2" dependencies: - get-intrinsic: ^1.1.1 - checksum: a6d3f0a266d0294d972e354782e872e2fe1b6495b321e6ef678c9b7a06a40408a6891817350c62e752adced73a94ac903c54734fee05bf65b1905ee1368194bb - languageName: node - linkType: hard - -"has-proto@npm:^1.0.1": - version: 1.0.1 - resolution: "has-proto@npm:1.0.1" - checksum: febc5b5b531de8022806ad7407935e2135f1cc9e64636c3916c6842bd7995994ca3b29871ecd7954bd35f9e2986c17b3b227880484d22259e2f8e6ce63fd383e - languageName: node - linkType: hard - -"has-symbols@npm:^1.0.3": - version: 1.0.3 - resolution: "has-symbols@npm:1.0.3" - checksum: a054c40c631c0d5741a8285010a0777ea0c068f99ed43e5d6eb12972da223f8af553a455132fdb0801bdcfa0e0f443c0c03a68d8555aa529b3144b446c3f2410 + es-define-property: ^1.0.0 + checksum: fcbb246ea2838058be39887935231c6d5788babed499d0e9d0cc5737494c48aba4fe17ba1449e0d0fbbb1e36175442faa37f9c427ae357d6ccb1d895fbcd3de3 languageName: node linkType: hard -"has-unicode@npm:^2.0.1": - version: 2.0.1 - resolution: "has-unicode@npm:2.0.1" - checksum: 1eab07a7436512db0be40a710b29b5dc21fa04880b7f63c9980b706683127e3c1b57cb80ea96d47991bdae2dfe479604f6a1ba410106ee1046a41d1bd0814400 - languageName: node - linkType: hard - -"has-yarn@npm:^2.1.0": - version: 2.1.0 - resolution: "has-yarn@npm:2.1.0" - checksum: 5eb1d0bb8518103d7da24532bdbc7124ffc6d367b5d3c10840b508116f2f1bcbcf10fd3ba843ff6e2e991bdf9969fd862d42b2ed58aade88343326c950b7e7f7 +"has-symbols@npm:^1.1.0": + version: 1.1.0 + resolution: "has-symbols@npm:1.1.0" + checksum: b2316c7302a0e8ba3aaba215f834e96c22c86f192e7310bdf689dd0e6999510c89b00fbc5742571507cebf25764d68c988b3a0da217369a73596191ac0ce694b languageName: node linkType: hard -"has@npm:^1.0.3": - version: 1.0.4 - resolution: "has@npm:1.0.4" - checksum: 8a11ba062e0627c9578a1d08285401e39f1d071a9692ddf793199070edb5648b21c774dd733e2a181edd635bf6862731885f476f4ccf67c998d7a5ff7cef2550 +"has-yarn@npm:^3.0.0": + version: 3.0.0 + resolution: "has-yarn@npm:3.0.0" + checksum: b9e14e78e0a37bc070550c862b201534287bc10e62a86ec9c1f455ffb082db42817ce9aed914bd73f1d589bbf268520e194629ff2f62ff6b98a482c4bd2dcbfb languageName: node linkType: hard @@ -6786,70 +7315,111 @@ __metadata: languageName: node linkType: hard -"hast-to-hyperscript@npm:^9.0.0": - version: 9.0.1 - resolution: "hast-to-hyperscript@npm:9.0.1" +"hast-util-from-parse5@npm:^8.0.0": + version: 8.0.3 + resolution: "hast-util-from-parse5@npm:8.0.3" dependencies: - "@types/unist": ^2.0.3 - comma-separated-tokens: ^1.0.0 - property-information: ^5.3.0 - space-separated-tokens: ^1.0.0 - style-to-object: ^0.3.0 - unist-util-is: ^4.0.0 - web-namespaces: ^1.0.0 - checksum: de570d789853018fff2fd38fc096549b9814e366b298f60c90c159a57018230eefc44d46a246027b0e2426ed9e99f2e270050bc183d5bdfe4c9487c320b392cd + "@types/hast": ^3.0.0 + "@types/unist": ^3.0.0 + devlop: ^1.0.0 + hastscript: ^9.0.0 + property-information: ^7.0.0 + vfile: ^6.0.0 + vfile-location: ^5.0.0 + web-namespaces: ^2.0.0 + checksum: 9ca68545a957a59f2bb18c834f1b7f72cdb1fc0d6b43233faa170e721c1f41da1bb0418b477b91332973c6bc2790a09bb07971fd8f0afe98b4cd111ea9fd7c8c languageName: node linkType: hard -"hast-util-from-parse5@npm:^6.0.0": - version: 6.0.1 - resolution: "hast-util-from-parse5@npm:6.0.1" +"hast-util-parse-selector@npm:^4.0.0": + version: 4.0.0 + resolution: "hast-util-parse-selector@npm:4.0.0" dependencies: - "@types/parse5": ^5.0.0 - hastscript: ^6.0.0 - property-information: ^5.0.0 - vfile: ^4.0.0 - vfile-location: ^3.2.0 - web-namespaces: ^1.0.0 - checksum: 4daa78201468af7779161e7caa2513c329830778e0528481ab16b3e1bcef4b831f6285b526aacdddbee802f3bd9d64df55f80f010591ea1916da535e3a923b83 + "@types/hast": ^3.0.0 + checksum: 76087670d3b0b50b23a6cb70bca53a6176d6608307ccdbb3ed18b650b82e7c3513bfc40348f1389dc0c5ae872b9a768851f4335f44654abd7deafd6974c52402 languageName: node linkType: hard -"hast-util-parse-selector@npm:^2.0.0": - version: 2.2.5 - resolution: "hast-util-parse-selector@npm:2.2.5" - checksum: 22ee4afbd11754562144cb3c4f3ec52524dafba4d90ee52512902d17cf11066d83b38f7bdf6ca571bbc2541f07ba30db0d234657b6ecb8ca4631587466459605 +"hast-util-raw@npm:^9.0.0": + version: 9.1.0 + resolution: "hast-util-raw@npm:9.1.0" + dependencies: + "@types/hast": ^3.0.0 + "@types/unist": ^3.0.0 + "@ungap/structured-clone": ^1.0.0 + hast-util-from-parse5: ^8.0.0 + hast-util-to-parse5: ^8.0.0 + html-void-elements: ^3.0.0 + mdast-util-to-hast: ^13.0.0 + parse5: ^7.0.0 + unist-util-position: ^5.0.0 + unist-util-visit: ^5.0.0 + vfile: ^6.0.0 + web-namespaces: ^2.0.0 + zwitch: ^2.0.0 + checksum: 778961e2d3140362665b306caade3c12df3d03c48827a2cba3534411bb443323a86ad10ed8ef798dd7ebcccb1709edc8df7a62cedc67f69dc40482b6a855f14f languageName: node linkType: hard -"hast-util-raw@npm:6.0.1": - version: 6.0.1 - resolution: "hast-util-raw@npm:6.0.1" +"hast-util-to-estree@npm:^3.0.0": + version: 3.1.3 + resolution: "hast-util-to-estree@npm:3.1.3" dependencies: - "@types/hast": ^2.0.0 - hast-util-from-parse5: ^6.0.0 - hast-util-to-parse5: ^6.0.0 - html-void-elements: ^1.0.0 - parse5: ^6.0.0 - unist-util-position: ^3.0.0 - vfile: ^4.0.0 - web-namespaces: ^1.0.0 - xtend: ^4.0.0 - zwitch: ^1.0.0 - checksum: f6d960644f9fbbe0b92d0227b20a24d659cce021d5f9fd218e077154931b4524ee920217b7fd5a45ec2736ec1dee53de9209fe449f6f89454c01d225ff0e7851 + "@types/estree": ^1.0.0 + "@types/estree-jsx": ^1.0.0 + "@types/hast": ^3.0.0 + comma-separated-tokens: ^2.0.0 + devlop: ^1.0.0 + estree-util-attach-comments: ^3.0.0 + estree-util-is-identifier-name: ^3.0.0 + hast-util-whitespace: ^3.0.0 + mdast-util-mdx-expression: ^2.0.0 + mdast-util-mdx-jsx: ^3.0.0 + mdast-util-mdxjs-esm: ^2.0.0 + property-information: ^7.0.0 + space-separated-tokens: ^2.0.0 + style-to-js: ^1.0.0 + unist-util-position: ^5.0.0 + zwitch: ^2.0.0 + checksum: 1db15b3a5a5958f61ed4e5e80dd248ed4ecca7e80c9241bb20cf4ee55721fd9a37b54aeb0caf86da2645ce3ce4dd217455d64418bb30339ddfb087e441e491b7 languageName: node linkType: hard -"hast-util-to-parse5@npm:^6.0.0": - version: 6.0.0 - resolution: "hast-util-to-parse5@npm:6.0.0" +"hast-util-to-jsx-runtime@npm:^2.0.0": + version: 2.3.6 + resolution: "hast-util-to-jsx-runtime@npm:2.3.6" + dependencies: + "@types/estree": ^1.0.0 + "@types/hast": ^3.0.0 + "@types/unist": ^3.0.0 + comma-separated-tokens: ^2.0.0 + devlop: ^1.0.0 + estree-util-is-identifier-name: ^3.0.0 + hast-util-whitespace: ^3.0.0 + mdast-util-mdx-expression: ^2.0.0 + mdast-util-mdx-jsx: ^3.0.0 + mdast-util-mdxjs-esm: ^2.0.0 + property-information: ^7.0.0 + space-separated-tokens: ^2.0.0 + style-to-js: ^1.0.0 + unist-util-position: ^5.0.0 + vfile-message: ^4.0.0 + checksum: 78c25465cf010f1004b22f0bbb3bd47793f458ead3561c779ea2b9204ceb1adc9c048592b0a15025df0c683a12ebe16a8bef008c06d9c0369f51116f64b35a2d + languageName: node + linkType: hard + +"hast-util-to-parse5@npm:^8.0.0": + version: 8.0.0 + resolution: "hast-util-to-parse5@npm:8.0.0" dependencies: - hast-to-hyperscript: ^9.0.0 - property-information: ^5.0.0 - web-namespaces: ^1.0.0 - xtend: ^4.0.0 - zwitch: ^1.0.0 - checksum: 91a36244e37df1d63c8b7e865ab0c0a25bb7396155602be005cf71d95c348e709568f80e0f891681a3711d733ad896e70642dc41a05b574eddf2e07d285408a8 + "@types/hast": ^3.0.0 + comma-separated-tokens: ^2.0.0 + devlop: ^1.0.0 + property-information: ^6.0.0 + space-separated-tokens: ^2.0.0 + web-namespaces: ^2.0.0 + zwitch: ^2.0.0 + checksum: 137469209cb2b32b57387928878dc85310fbd5afa4807a8da69529199bb1d19044bfc95b50c3dc68d4fb2b6cb8bf99b899285597ab6ab318f50422eefd5599dd languageName: node linkType: hard @@ -6860,16 +7430,25 @@ __metadata: languageName: node linkType: hard -"hastscript@npm:^6.0.0": - version: 6.0.0 - resolution: "hastscript@npm:6.0.0" +"hast-util-whitespace@npm:^3.0.0": + version: 3.0.0 + resolution: "hast-util-whitespace@npm:3.0.0" dependencies: - "@types/hast": ^2.0.0 - comma-separated-tokens: ^1.0.0 - hast-util-parse-selector: ^2.0.0 - property-information: ^5.0.0 - space-separated-tokens: ^1.0.0 - checksum: 5e50b85af0d2cb7c17979cb1ddca75d6b96b53019dd999b39e7833192c9004201c3cee6445065620ea05d0087d9ae147a4844e582d64868be5bc6b0232dfe52d + "@types/hast": ^3.0.0 + checksum: 41d93ccce218ba935dc3c12acdf586193c35069489c8c8f50c2aa824c00dec94a3c78b03d1db40fa75381942a189161922e4b7bca700b3a2cc779634c351a1e4 + languageName: node + linkType: hard + +"hastscript@npm:^9.0.0": + version: 9.0.1 + resolution: "hastscript@npm:9.0.1" + dependencies: + "@types/hast": ^3.0.0 + comma-separated-tokens: ^2.0.0 + hast-util-parse-selector: ^4.0.0 + property-information: ^7.0.0 + space-separated-tokens: ^2.0.0 + checksum: 2bbb9a3c2dc43c9dec7f6599ef45e5eefb1c2a5f75d33d005dc432e92bf9d7cfb6c0d927f15a7592bb48601d2b582ea2e4b1131a716ac3f7b618a07d88f9a5d7 languageName: node linkType: hard @@ -6928,13 +7507,20 @@ __metadata: linkType: hard "html-entities@npm:^2.3.2": - version: 2.4.0 - resolution: "html-entities@npm:2.4.0" - checksum: 25bea32642ce9ebd0eedc4d24381883ecb0335ccb8ac26379a0958b9b16652fdbaa725d70207ce54a51db24103436a698a8e454397d3ba8ad81460224751f1dc + version: 2.6.0 + resolution: "html-entities@npm:2.6.0" + checksum: 720643f7954019c80911430a7df2728524c07080edfe812610bfc5d8191cd772b470bee0ee151bf7426679314ae53cf28a1c845d702123714e625a8565b26567 + languageName: node + linkType: hard + +"html-escaper@npm:^2.0.2": + version: 2.0.2 + resolution: "html-escaper@npm:2.0.2" + checksum: d2df2da3ad40ca9ee3a39c5cc6475ef67c8f83c234475f24d8e9ce0dc80a2c82df8e1d6fa78ddd1e9022a586ea1bd247a615e80a5cd9273d90111ddda7d9e974 languageName: node linkType: hard -"html-minifier-terser@npm:^6.0.2, html-minifier-terser@npm:^6.1.0": +"html-minifier-terser@npm:^6.0.2": version: 6.1.0 resolution: "html-minifier-terser@npm:6.1.0" dependencies: @@ -6951,6 +7537,23 @@ __metadata: languageName: node linkType: hard +"html-minifier-terser@npm:^7.2.0": + version: 7.2.0 + resolution: "html-minifier-terser@npm:7.2.0" + dependencies: + camel-case: ^4.1.2 + clean-css: ~5.3.2 + commander: ^10.0.0 + entities: ^4.4.0 + param-case: ^3.0.4 + relateurl: ^0.2.7 + terser: ^5.15.1 + bin: + html-minifier-terser: cli.js + checksum: 39feed354b5a8aafc8e910977d68cfd961d6db330a8e1a5b16a528c86b8ee7745d8945134822cf00acf7bf0d0135bf1abad650bf308bee4ea73adb003f5b8656 + languageName: node + linkType: hard + "html-react-parser@npm:^3.0.16": version: 3.0.16 resolution: "html-react-parser@npm:3.0.16" @@ -6965,23 +7568,23 @@ __metadata: languageName: node linkType: hard -"html-tags@npm:^3.2.0": +"html-tags@npm:^3.3.1": version: 3.3.1 resolution: "html-tags@npm:3.3.1" checksum: b4ef1d5a76b678e43cce46e3783d563607b1d550cab30b4f511211564574770aa8c658a400b100e588bc60b8234e59b35ff72c7851cc28f3b5403b13a2c6cbce languageName: node linkType: hard -"html-void-elements@npm:^1.0.0": - version: 1.0.5 - resolution: "html-void-elements@npm:1.0.5" - checksum: 1a56f4f6cfbeb994c21701ff72b4b7f556fe784a70e5e554d1566ff775af83b91ea93f10664f039a67802d9f7b40d4a7f1ed20312bab47bd88d89bd792ea84ca +"html-void-elements@npm:^3.0.0": + version: 3.0.0 + resolution: "html-void-elements@npm:3.0.0" + checksum: 59be397525465a7489028afa064c55763d9cccd1d7d9f630cca47137317f0e897a9ca26cef7e745e7cff1abc44260cfa407742b243a54261dfacd42230e94fce languageName: node linkType: hard -"html-webpack-plugin@npm:^5.5.0": - version: 5.5.3 - resolution: "html-webpack-plugin@npm:5.5.3" +"html-webpack-plugin@npm:^5.6.0": + version: 5.6.3 + resolution: "html-webpack-plugin@npm:5.6.3" dependencies: "@types/html-minifier-terser": ^6.0.0 html-minifier-terser: ^6.0.2 @@ -6989,8 +7592,14 @@ __metadata: pretty-error: ^4.0.0 tapable: ^2.0.0 peerDependencies: + "@rspack/core": 0.x || 1.x webpack: ^5.20.0 - checksum: ccf685195739c372ad641bbd0c9100a847904f34eedc7aff3ece7856cd6c78fd3746d2d615af1bb71e5727993fe711b89e9b744f033ed3fde646540bf5d5e954 + peerDependenciesMeta: + "@rspack/core": + optional: true + webpack: + optional: true + checksum: 59e7d971b0cfd9ba34c7acaa3c161e43c62596474dd8cd35d7b690498ff5891f21296de0aa1d2e7810348caa657e938461267155dda47913b5eeca7124406270 languageName: node linkType: hard @@ -7006,6 +7615,18 @@ __metadata: languageName: node linkType: hard +"htmlparser2@npm:^10.0.0": + version: 10.0.0 + resolution: "htmlparser2@npm:10.0.0" + dependencies: + domelementtype: ^2.3.0 + domhandler: ^5.0.3 + domutils: ^3.2.1 + entities: ^6.0.0 + checksum: ba81aca5d344437e791ffddf61d498972fc0e7dd2d41f59f920e93aedb64667a0f38fed88e0d81fe23ea5a10825991caa020212fdd72a0dc287ab2aaad95fbf5 + languageName: node + linkType: hard + "htmlparser2@npm:^6.1.0": version: 6.1.0 resolution: "htmlparser2@npm:6.1.0" @@ -7018,10 +7639,10 @@ __metadata: languageName: node linkType: hard -"http-cache-semantics@npm:^4.0.0, http-cache-semantics@npm:^4.1.1": - version: 4.1.1 - resolution: "http-cache-semantics@npm:4.1.1" - checksum: 83ac0bc60b17a3a36f9953e7be55e5c8f41acc61b22583060e8dedc9dd5e3607c823a88d0926f9150e571f90946835c7fe150732801010845c72cd8bbff1a236 +"http-cache-semantics@npm:^4.1.1": + version: 4.2.0 + resolution: "http-cache-semantics@npm:4.2.0" + checksum: 7a7246ddfce629f96832791176fd643589d954e6f3b49548dadb4290451961237fab8fcea41cd2008fe819d95b41c1e8b97f47d088afc0a1c81705287b4ddbcc languageName: node linkType: hard @@ -7058,26 +7679,25 @@ __metadata: linkType: hard "http-parser-js@npm:>=0.5.1": - version: 0.5.8 - resolution: "http-parser-js@npm:0.5.8" - checksum: 6bbdf2429858e8cf13c62375b0bfb6dc3955ca0f32e58237488bc86cd2378f31d31785fd3ac4ce93f1c74e0189cf8823c91f5cb061696214fd368d2452dc871d + version: 0.5.10 + resolution: "http-parser-js@npm:0.5.10" + checksum: 1038177c5f114860345ce7c19223d2cdd9a103265bd897bab13343c9eff4deef60f7956a674485f1234ffc9b19fb4b97f0c20a5848cfc9ccbf5d3c438d89ae89 languageName: node linkType: hard -"http-proxy-agent@npm:^5.0.0": - version: 5.0.0 - resolution: "http-proxy-agent@npm:5.0.0" +"http-proxy-agent@npm:^7.0.0": + version: 7.0.2 + resolution: "http-proxy-agent@npm:7.0.2" dependencies: - "@tootallnate/once": 2 - agent-base: 6 - debug: 4 - checksum: e2ee1ff1656a131953839b2a19cd1f3a52d97c25ba87bd2559af6ae87114abf60971e498021f9b73f9fd78aea8876d1fb0d4656aac8a03c6caa9fc175f22b786 + agent-base: ^7.1.0 + debug: ^4.3.4 + checksum: 670858c8f8f3146db5889e1fa117630910101db601fff7d5a8aa637da0abedf68c899f03d3451cac2f83bcc4c3d2dabf339b3aa00ff8080571cceb02c3ce02f3 languageName: node linkType: hard "http-proxy-middleware@npm:^2.0.3": - version: 2.0.6 - resolution: "http-proxy-middleware@npm:2.0.6" + version: 2.0.9 + resolution: "http-proxy-middleware@npm:2.0.9" dependencies: "@types/http-proxy": ^1.17.8 http-proxy: ^1.18.1 @@ -7089,7 +7709,7 @@ __metadata: peerDependenciesMeta: "@types/express": optional: true - checksum: 2ee85bc878afa6cbf34491e972ece0f5be0a3e5c98a60850cf40d2a9a5356e1fc57aab6cff33c1fc37691b0121c3a42602d2b1956c52577e87a5b77b62ae1c3a + checksum: 0ea88609b9c13fa03b89f8e6b85bd5c537027ec6990005dd81a7fbb3e73fcf8d6a6e3db2b57b1c6cddbcda80965704584dc6291d0e721b2700198c4e59ee0d0b languageName: node linkType: hard @@ -7104,13 +7724,23 @@ __metadata: languageName: node linkType: hard -"https-proxy-agent@npm:^5.0.0": - version: 5.0.1 - resolution: "https-proxy-agent@npm:5.0.1" +"http2-wrapper@npm:^2.1.10": + version: 2.2.1 + resolution: "http2-wrapper@npm:2.2.1" + dependencies: + quick-lru: ^5.1.1 + resolve-alpn: ^1.2.0 + checksum: e95e55e22c6fd61182ce81fecb9b7da3af680d479febe8ad870d05f7ebbc9f076e455193766f4e7934e50913bf1d8da3ba121fb5cd2928892390b58cf9d5c509 + languageName: node + linkType: hard + +"https-proxy-agent@npm:^7.0.1": + version: 7.0.6 + resolution: "https-proxy-agent@npm:7.0.6" dependencies: - agent-base: 6 + agent-base: ^7.1.2 debug: 4 - checksum: 571fccdf38184f05943e12d37d6ce38197becdd69e58d03f43637f7fa1269cf303a7d228aa27e5b27bbd3af8f09fd938e1c91dcfefff2df7ba77c20ed8dfc765 + checksum: b882377a120aa0544846172e5db021fa8afbf83fea2a897d397bd2ddd8095ab268c24bc462f40a15f2a8c600bf4aa05ce52927f70038d4014e68aefecfa94e8d languageName: node linkType: hard @@ -7128,15 +7758,6 @@ __metadata: languageName: node linkType: hard -"humanize-ms@npm:^1.2.1": - version: 1.2.1 - resolution: "humanize-ms@npm:1.2.1" - dependencies: - ms: ^2.0.0 - checksum: 9c7a74a2827f9294c009266c82031030eae811ca87b0da3dceb8d6071b9bde22c9f3daef0469c3c533cc67a97d8a167cd9fc0389350e5f415f61a79b171ded16 - languageName: node - linkType: hard - "husky@npm:^8.0.3": version: 8.0.3 resolution: "husky@npm:8.0.3" @@ -7155,7 +7776,7 @@ __metadata: languageName: node linkType: hard -"iconv-lite@npm:^0.6.2": +"iconv-lite@npm:0.6.3, iconv-lite@npm:^0.6.2, iconv-lite@npm:^0.6.3": version: 0.6.3 resolution: "iconv-lite@npm:0.6.3" dependencies: @@ -7174,44 +7795,42 @@ __metadata: linkType: hard "ignore@npm:^5.2.0, ignore@npm:^5.2.4": - version: 5.2.4 - resolution: "ignore@npm:5.2.4" - checksum: 3d4c309c6006e2621659311783eaea7ebcd41fe4ca1d78c91c473157ad6666a57a2df790fe0d07a12300d9aac2888204d7be8d59f9aaf665b1c7fcdb432517ef + version: 5.3.2 + resolution: "ignore@npm:5.3.2" + checksum: 2acfd32a573260ea522ea0bfeff880af426d68f6831f973129e2ba7363f422923cf53aab62f8369cbf4667c7b25b6f8a3761b34ecdb284ea18e87a5262a865be languageName: node linkType: hard -"image-size@npm:^1.0.1": - version: 1.0.2 - resolution: "image-size@npm:1.0.2" - dependencies: - queue: 6.0.2 +"image-size@npm:^2.0.2": + version: 2.0.2 + resolution: "image-size@npm:2.0.2" bin: image-size: bin/image-size.js - checksum: 01745fdb47f87cecf538e69c63f9adc5bfab30a345345c2de91105f3afbd1bfcfba1256af02bf3323077b33b0004469a837e077bf0cbb9c907e9c1e9e7547585 + checksum: 33c3fafdd8af6bb2727bca51c4bae6e6dac16e9715337a6685a1af29fcbf7a2f9ec75eeaaa61e82d20f74d6f1fa748110936e32b1dbea4521217133eb159a29d languageName: node linkType: hard -"immer@npm:^9.0.7": - version: 9.0.21 - resolution: "immer@npm:9.0.21" - checksum: 70e3c274165995352f6936695f0ef4723c52c92c92dd0e9afdfe008175af39fa28e76aafb3a2ca9d57d1fb8f796efc4dd1e1cc36f18d33fa5b74f3dfb0375432 +"immediate@npm:^3.2.3": + version: 3.3.0 + resolution: "immediate@npm:3.3.0" + checksum: 634b4305101e2452eba6c07d485bf3e415995e533c94b9c3ffbc37026fa1be34def6e4f2276b0dc2162a3f91628564a4bfb26280278b89d3ee54624e854d2f5f languageName: node linkType: hard -"import-fresh@npm:^3.1.0, import-fresh@npm:^3.2.1, import-fresh@npm:^3.3.0": - version: 3.3.0 - resolution: "import-fresh@npm:3.3.0" +"import-fresh@npm:^3.2.1, import-fresh@npm:^3.3.0": + version: 3.3.1 + resolution: "import-fresh@npm:3.3.1" dependencies: parent-module: ^1.0.0 resolve-from: ^4.0.0 - checksum: 2cacfad06e652b1edc50be650f7ec3be08c5e5a6f6d12d035c440a42a8cc028e60a5b99ca08a77ab4d6b1346da7d971915828f33cdab730d3d42f08242d09baa + checksum: a06b19461b4879cc654d46f8a6244eb55eb053437afd4cbb6613cad6be203811849ed3e4ea038783092879487299fda24af932b86bdfff67c9055ba3612b8c87 languageName: node linkType: hard -"import-lazy@npm:^2.1.0": - version: 2.1.0 - resolution: "import-lazy@npm:2.1.0" - checksum: 05294f3b9dd4971d3a996f0d2f176410fb6745d491d6e73376429189f5c1c3d290548116b2960a7cf3e89c20cdf11431739d1d2d8c54b84061980795010e803a +"import-lazy@npm:^4.0.0": + version: 4.0.0 + resolution: "import-lazy@npm:4.0.0" + checksum: 22f5e51702134aef78890156738454f620e5fe7044b204ebc057c614888a1dd6fdf2ede0fdcca44d5c173fd64f65c985f19a51775b06967ef58cc3d26898df07 languageName: node linkType: hard @@ -7229,10 +7848,10 @@ __metadata: languageName: node linkType: hard -"infima@npm:0.2.0-alpha.43": - version: 0.2.0-alpha.43 - resolution: "infima@npm:0.2.0-alpha.43" - checksum: fc5f79240e940eddd750439511767092ccb4051e5e91d253ec7630a9e7ce691812da3aa0f05e46b4c0a95dbfadeae5714fd0073f8d2df12e5aaff0697a1d6aa2 +"infima@npm:0.2.0-alpha.45": + version: 0.2.0-alpha.45 + resolution: "infima@npm:0.2.0-alpha.45" + checksum: 23e5a33b147cb3940194c23e249001e7988327bb27896b121883442bce42a532248387649eec74d008dadadcddc790fb6842f043f33c78fda35e29f0b720cf8c languageName: node linkType: hard @@ -7246,7 +7865,7 @@ __metadata: languageName: node linkType: hard -"inherits@npm:2, inherits@npm:2.0.4, inherits@npm:^2.0.0, inherits@npm:^2.0.1, inherits@npm:^2.0.3, inherits@npm:~2.0.3": +"inherits@npm:2, inherits@npm:2.0.4, inherits@npm:^2.0.1, inherits@npm:^2.0.3, inherits@npm:~2.0.3": version: 2.0.4 resolution: "inherits@npm:2.0.4" checksum: 4a48a733847879d6cf6691860a6b1e3f0f4754176e4d71494c41f3475553768b10f84b5ce1d40fbd0e34e6bfbb864ee35858ad4dd2cf31e02fc4a154b724d7f1 @@ -7267,7 +7886,7 @@ __metadata: languageName: node linkType: hard -"ini@npm:^1.3.5, ini@npm:~1.3.0": +"ini@npm:^1.3.4, ini@npm:~1.3.0": version: 1.3.8 resolution: "ini@npm:1.3.8" checksum: dfd98b0ca3a4fc1e323e38a6c8eb8936e31a97a918d3b377649ea15bdb15d481207a0dda1021efbd86b464cae29a0d33c1d7dcaf6c5672bee17fa849bc50a1b3 @@ -7281,10 +7900,10 @@ __metadata: languageName: node linkType: hard -"interpret@npm:^1.0.0": - version: 1.4.0 - resolution: "interpret@npm:1.4.0" - checksum: 2e5f51268b5941e4a17e4ef0575bc91ed0ab5f8515e3cf77486f7c14d13f3010df9c0959f37063dcc96e78d12dc6b0bb1b9e111cdfe69771f4656d2993d36155 +"inline-style-parser@npm:0.2.4": + version: 0.2.4 + resolution: "inline-style-parser@npm:0.2.4" + checksum: 5df20a21dd8d67104faaae29774bb50dc9690c75bc5c45dac107559670a5530104ead72c4cf54f390026e617e7014c65b3d68fb0bb573a37c4d1f94e9c36e1ca languageName: node linkType: hard @@ -7297,10 +7916,13 @@ __metadata: languageName: node linkType: hard -"ip@npm:^2.0.0": - version: 2.0.0 - resolution: "ip@npm:2.0.0" - checksum: cfcfac6b873b701996d71ec82a7dd27ba92450afdb421e356f44044ed688df04567344c36cbacea7d01b1c39a4c732dc012570ebe9bebfb06f27314bca625349 +"ip-address@npm:^9.0.5": + version: 9.0.5 + resolution: "ip-address@npm:9.0.5" + dependencies: + jsbn: 1.1.0 + sprintf-js: ^1.1.3 + checksum: aa15f12cfd0ef5e38349744e3654bae649a34c3b10c77a674a167e99925d1549486c5b14730eebce9fea26f6db9d5e42097b00aa4f9f612e68c79121c71652dc languageName: node linkType: hard @@ -7312,26 +7934,26 @@ __metadata: linkType: hard "ipaddr.js@npm:^2.0.1": - version: 2.1.0 - resolution: "ipaddr.js@npm:2.1.0" - checksum: 807a054f2bd720c4d97ee479d6c9e865c233bea21f139fb8dabd5a35c4226d2621c42e07b4ad94ff3f82add926a607d8d9d37c625ad0319f0e08f9f2bd1968e2 + version: 2.2.0 + resolution: "ipaddr.js@npm:2.2.0" + checksum: 770ba8451fd9bf78015e8edac0d5abd7a708cbf75f9429ca9147a9d2f3a2d60767cd5de2aab2b1e13ca6e4445bdeff42bf12ef6f151c07a5c6cf8a44328e2859 languageName: node linkType: hard -"is-alphabetical@npm:1.0.4, is-alphabetical@npm:^1.0.0": - version: 1.0.4 - resolution: "is-alphabetical@npm:1.0.4" - checksum: 6508cce44fd348f06705d377b260974f4ce68c74000e7da4045f0d919e568226dc3ce9685c5a2af272195384df6930f748ce9213fc9f399b5d31b362c66312cb +"is-alphabetical@npm:^2.0.0": + version: 2.0.1 + resolution: "is-alphabetical@npm:2.0.1" + checksum: 56207db8d9de0850f0cd30f4966bf731eb82cedfe496cbc2e97e7c3bacaf66fc54a972d2d08c0d93bb679cb84976a05d24c5ad63de56fabbfc60aadae312edaa languageName: node linkType: hard -"is-alphanumerical@npm:^1.0.0": - version: 1.0.4 - resolution: "is-alphanumerical@npm:1.0.4" +"is-alphanumerical@npm:^2.0.0": + version: 2.0.1 + resolution: "is-alphanumerical@npm:2.0.1" dependencies: - is-alphabetical: ^1.0.0 - is-decimal: ^1.0.0 - checksum: e2e491acc16fcf5b363f7c726f666a9538dba0a043665740feb45bba1652457a73441e7c5179c6768a638ed396db3437e9905f403644ec7c468fb41f4813d03f + is-alphabetical: ^2.0.0 + is-decimal: ^2.0.0 + checksum: 87acc068008d4c9c4e9f5bd5e251041d42e7a50995c77b1499cf6ed248f971aadeddb11f239cabf09f7975ee58cac7a48ffc170b7890076d8d227b24a68663c9 languageName: node linkType: hard @@ -7358,23 +7980,14 @@ __metadata: languageName: node linkType: hard -"is-ci@npm:^2.0.0": - version: 2.0.0 - resolution: "is-ci@npm:2.0.0" +"is-ci@npm:^3.0.1": + version: 3.0.1 + resolution: "is-ci@npm:3.0.1" dependencies: - ci-info: ^2.0.0 + ci-info: ^3.2.0 bin: is-ci: bin.js - checksum: 77b869057510f3efa439bbb36e9be429d53b3f51abd4776eeea79ab3b221337fe1753d1e50058a9e2c650d38246108beffb15ccfd443929d77748d8c0cc90144 - languageName: node - linkType: hard - -"is-core-module@npm:^2.13.0": - version: 2.13.0 - resolution: "is-core-module@npm:2.13.0" - dependencies: - has: ^1.0.3 - checksum: 053ab101fb390bfeb2333360fd131387bed54e476b26860dc7f5a700bbf34a0ec4454f7c8c4d43e8a0030957e4b3db6e16d35e1890ea6fb654c833095e040355 + checksum: 192c66dc7826d58f803ecae624860dccf1899fc1f3ac5505284c0a5cf5f889046ffeb958fa651e5725d5705c5bcb14f055b79150ea5fcad7456a9569de60260e languageName: node linkType: hard @@ -7387,10 +8000,10 @@ __metadata: languageName: node linkType: hard -"is-decimal@npm:^1.0.0": - version: 1.0.4 - resolution: "is-decimal@npm:1.0.4" - checksum: ed483a387517856dc395c68403a10201fddcc1b63dc56513fbe2fe86ab38766120090ecdbfed89223d84ca8b1cd28b0641b93cb6597b6e8f4c097a7c24e3fb96 +"is-decimal@npm:^2.0.0": + version: 2.0.1 + resolution: "is-decimal@npm:2.0.1" + checksum: 97132de7acdce77caa7b797632970a2ecd649a88e715db0e4dbc00ab0708b5e7574ba5903962c860cd4894a14fd12b100c0c4ac8aed445cf6f55c6cf747a4158 languageName: node linkType: hard @@ -7440,10 +8053,10 @@ __metadata: languageName: node linkType: hard -"is-hexadecimal@npm:^1.0.0": - version: 1.0.4 - resolution: "is-hexadecimal@npm:1.0.4" - checksum: a452e047587b6069332d83130f54d30da4faf2f2ebaa2ce6d073c27b5703d030d58ed9e0b729c8e4e5b52c6f1dab26781bb77b7bc6c7805f14f320e328ff8cd5 +"is-hexadecimal@npm:^2.0.0": + version: 2.0.1 + resolution: "is-hexadecimal@npm:2.0.1" + checksum: 66a2ea85994c622858f063f23eda506db29d92b52580709eb6f4c19550552d4dcf3fb81952e52f7cf972097237959e00adc7bb8c9400cd12886e15bf06145321 languageName: node linkType: hard @@ -7457,17 +8070,10 @@ __metadata: languageName: node linkType: hard -"is-lambda@npm:^1.0.1": - version: 1.0.1 - resolution: "is-lambda@npm:1.0.1" - checksum: 93a32f01940220532e5948538699ad610d5924ac86093fcee83022252b363eb0cc99ba53ab084a04e4fb62bf7b5731f55496257a4c38adf87af9c4d352c71c35 - languageName: node - linkType: hard - -"is-npm@npm:^5.0.0": - version: 5.0.0 - resolution: "is-npm@npm:5.0.0" - checksum: 9baff02b0c69a3d3c79b162cb2f9e67fb40ef6d172c16601b2e2471c21e9a4fa1fc9885a308d7bc6f3a3cd2a324c27fa0bf284c133c3349bb22571ab70d041cc +"is-npm@npm:^6.0.0": + version: 6.0.0 + resolution: "is-npm@npm:6.0.0" + checksum: fafe1ddc772345f5460514891bb8014376904ccdbddd59eee7525c9adcc08d426933f28b087bef3e17524da7ebf35c03ef484ff3b6ba9d5fecd8c6e6a7d4bf11 languageName: node linkType: hard @@ -7492,13 +8098,6 @@ __metadata: languageName: node linkType: hard -"is-path-cwd@npm:^2.2.0": - version: 2.2.0 - resolution: "is-path-cwd@npm:2.2.0" - checksum: 46a840921bb8cc0dc7b5b423a14220e7db338072a4495743a8230533ce78812dc152548c86f4b828411fe98c5451959f07cf841c6a19f611e46600bd699e8048 - languageName: node - linkType: hard - "is-path-inside@npm:^3.0.2, is-path-inside@npm:^3.0.3": version: 3.0.3 resolution: "is-path-inside@npm:3.0.3" @@ -7506,13 +8105,6 @@ __metadata: languageName: node linkType: hard -"is-plain-obj@npm:^2.0.0": - version: 2.1.0 - resolution: "is-plain-obj@npm:2.1.0" - checksum: cec9100678b0a9fe0248a81743041ed990c2d4c99f893d935545cfbc42876cbe86d207f3b895700c690ad2fa520e568c44afc1605044b535a7820c1d40e38daa - languageName: node - linkType: hard - "is-plain-obj@npm:^3.0.0": version: 3.0.0 resolution: "is-plain-obj@npm:3.0.0" @@ -7536,13 +8128,6 @@ __metadata: languageName: node linkType: hard -"is-plain-object@npm:^5.0.0": - version: 5.0.0 - resolution: "is-plain-object@npm:5.0.0" - checksum: e32d27061eef62c0847d303125440a38660517e586f2f3db7c9d179ae5b6674ab0f469d519b2e25c147a1a3bc87156d0d5f4d8821e0ce4a9ee7fe1fcf11ce45c - languageName: node - linkType: hard - "is-regexp@npm:^1.0.0": version: 1.0.0 resolution: "is-regexp@npm:1.0.0" @@ -7550,13 +8135,6 @@ __metadata: languageName: node linkType: hard -"is-root@npm:^2.1.0": - version: 2.1.0 - resolution: "is-root@npm:2.1.0" - checksum: 37eea0822a2a9123feb58a9d101558ba276771a6d830f87005683349a9acff15958a9ca590a44e778c6b335660b83e85c744789080d734f6081a935a4880aee2 - languageName: node - linkType: hard - "is-stream@npm:^2.0.0": version: 2.0.1 resolution: "is-stream@npm:2.0.1" @@ -7578,20 +8156,6 @@ __metadata: languageName: node linkType: hard -"is-whitespace-character@npm:^1.0.0": - version: 1.0.4 - resolution: "is-whitespace-character@npm:1.0.4" - checksum: adab8ad9847ccfcb6f1b7000b8f622881b5ba2a09ce8be2794a6d2b10c3af325b469fc562c9fb889f468eed27be06e227ac609d0aa1e3a59b4dbcc88e2b0418e - languageName: node - linkType: hard - -"is-word-character@npm:^1.0.0": - version: 1.0.4 - resolution: "is-word-character@npm:1.0.4" - checksum: 1821d6c6abe5bc0b3abe3fdc565d66d7c8a74ea4e93bc77b4a47d26e2e2a306d6ab7d92b353b0d2b182869e3ecaa8f4a346c62d0e31d38ebc0ceaf7cae182c3f - languageName: node - linkType: hard - "is-wsl@npm:^2.2.0": version: 2.2.0 resolution: "is-wsl@npm:2.2.0" @@ -7601,10 +8165,10 @@ __metadata: languageName: node linkType: hard -"is-yarn-global@npm:^0.3.0": - version: 0.3.0 - resolution: "is-yarn-global@npm:0.3.0" - checksum: bca013d65fee2862024c9fbb3ba13720ffca2fe750095174c1c80922fdda16402b5c233f5ac9e265bc12ecb5446e7b7f519a32d9541788f01d4d44e24d2bf481 +"is-yarn-global@npm:^0.4.0": + version: 0.4.1 + resolution: "is-yarn-global@npm:0.4.1" + checksum: 79ec4e6f581c53d4fefdf5f6c237f9a3ad8db29c85cdc4659e76ae345659317552052a97b7e56952aa5d94a23c798ebec8ccad72fb14d3b26dc647ddceddd716 languageName: node linkType: hard @@ -7629,6 +8193,13 @@ __metadata: languageName: node linkType: hard +"isexe@npm:^3.1.1": + version: 3.1.1 + resolution: "isexe@npm:3.1.1" + checksum: 7fe1931ee4e88eb5aa524cd3ceb8c882537bc3a81b02e438b240e47012eef49c86904d0f0e593ea7c3a9996d18d0f1f3be8d3eaa92333977b0c3a9d353d5563e + languageName: node + linkType: hard + "isobject@npm:^3.0.1": version: 3.0.1 resolution: "isobject@npm:3.0.1" @@ -7636,19 +8207,6 @@ __metadata: languageName: node linkType: hard -"jackspeak@npm:^2.3.5": - version: 2.3.6 - resolution: "jackspeak@npm:2.3.6" - dependencies: - "@isaacs/cliui": ^8.0.2 - "@pkgjs/parseargs": ^0.11.0 - dependenciesMeta: - "@pkgjs/parseargs": - optional: true - checksum: 57d43ad11eadc98cdfe7496612f6bbb5255ea69fe51ea431162db302c2a11011642f50cfad57288bd0aea78384a0612b16e131944ad8ecd09d619041c8531b54 - languageName: node - linkType: hard - "jackspeak@npm:^3.1.2": version: 3.4.3 resolution: "jackspeak@npm:3.4.3" @@ -7687,7 +8245,7 @@ __metadata: languageName: node linkType: hard -"jest-worker@npm:^29.1.2": +"jest-worker@npm:^29.4.3": version: 29.7.0 resolution: "jest-worker@npm:29.7.0" dependencies: @@ -7699,16 +8257,7 @@ __metadata: languageName: node linkType: hard -"jiti@npm:^1.18.2": - version: 1.20.0 - resolution: "jiti@npm:1.20.0" - bin: - jiti: bin/jiti.js - checksum: 7924062b5675142e3e272a27735be84b7bfc0a0eb73217fc2dcafa034f37c4f7b4b9ffc07dd98bcff0f739a8811ce1544db205ae7e97b1c86f0df92c65ce3c72 - languageName: node - linkType: hard - -"jiti@npm:^1.21.6": +"jiti@npm:^1.20.0, jiti@npm:^1.21.6": version: 1.21.7 resolution: "jiti@npm:1.21.7" bin: @@ -7717,16 +8266,16 @@ __metadata: languageName: node linkType: hard -"joi@npm:^17.6.0": - version: 17.11.0 - resolution: "joi@npm:17.11.0" +"joi@npm:^17.9.2": + version: 17.13.3 + resolution: "joi@npm:17.13.3" dependencies: - "@hapi/hoek": ^9.0.0 - "@hapi/topo": ^5.0.0 - "@sideway/address": ^4.1.3 + "@hapi/hoek": ^9.3.0 + "@hapi/topo": ^5.1.0 + "@sideway/address": ^4.1.5 "@sideway/formula": ^3.0.1 "@sideway/pinpoint": ^2.0.0 - checksum: 3a4e9ecba345cdafe585e7ed8270a44b39718e11dff3749aa27e0001a63d578b75100c062be28e6f48f960b594864034e7a13833f33fbd7ad56d5ce6b617f9bf + checksum: 66ed454fee3d8e8da1ce21657fd2c7d565d98f3e539d2c5c028767e5f38cbd6297ce54df8312d1d094e62eb38f9452ebb43da4ce87321df66cf5e3f128cbc400 languageName: node linkType: hard @@ -7760,12 +8309,19 @@ __metadata: languageName: node linkType: hard -"jsesc@npm:^2.5.1": - version: 2.5.2 - resolution: "jsesc@npm:2.5.2" +"jsbn@npm:1.1.0": + version: 1.1.0 + resolution: "jsbn@npm:1.1.0" + checksum: 944f924f2bd67ad533b3850eee47603eed0f6ae425fd1ee8c760f477e8c34a05f144c1bd4f5a5dd1963141dc79a2c55f89ccc5ab77d039e7077f3ad196b64965 + languageName: node + linkType: hard + +"jsesc@npm:^3.0.2": + version: 3.1.0 + resolution: "jsesc@npm:3.1.0" bin: jsesc: bin/jsesc - checksum: 4dc190771129e12023f729ce20e1e0bfceac84d73a85bc3119f7f938843fe25a4aeccb54b6494dce26fcf263d815f5f31acdefac7cc9329efb8422a4f4d9fa9d + checksum: 19c94095ea026725540c0d29da33ab03144f6bcf2d4159e4833d534976e99e0c09c38cefa9a575279a51fc36b31166f8d6d05c9fe2645d5f15851d690b41f17f languageName: node linkType: hard @@ -7778,10 +8334,12 @@ __metadata: languageName: node linkType: hard -"json-buffer@npm:3.0.0": - version: 3.0.0 - resolution: "json-buffer@npm:3.0.0" - checksum: 0cecacb8025370686a916069a2ff81f7d55167421b6aa7270ee74e244012650dd6bce22b0852202ea7ff8624fce50ff0ec1bdf95914ccb4553426e290d5a63fa +"jsesc@npm:~3.0.2": + version: 3.0.2 + resolution: "jsesc@npm:3.0.2" + bin: + jsesc: bin/jsesc + checksum: a36d3ca40574a974d9c2063bf68c2b6141c20da8f2a36bd3279fc802563f35f0527a6c828801295bdfb2803952cf2cf387786c2c90ed564f88d5782475abfe3c languageName: node linkType: hard @@ -7842,15 +8400,6 @@ __metadata: languageName: node linkType: hard -"keyv@npm:^3.0.0": - version: 3.1.0 - resolution: "keyv@npm:3.1.0" - dependencies: - json-buffer: 3.0.0 - checksum: bb7e8f3acffdbafbc2dd5b63f377fe6ec4c0e2c44fc82720449ef8ab54f4a7ce3802671ed94c0f475ae0a8549703353a2124561fcf3317010c141b32ca1ce903 - languageName: node - linkType: hard - "keyv@npm:^4.5.3": version: 4.5.4 resolution: "keyv@npm:4.5.4" @@ -7867,6 +8416,15 @@ __metadata: languageName: node linkType: hard +"klaw-sync@npm:^6.0.0": + version: 6.0.0 + resolution: "klaw-sync@npm:6.0.0" + dependencies: + graceful-fs: ^4.1.11 + checksum: 0da397f8961313c3ef8f79fb63af9002cde5a8fb2aeb1a37351feff0dd6006129c790400c3f5c3b4e757bedcabb13d21ec0a5eaef5a593d59515d4f2c291e475 + languageName: node + linkType: hard + "kleur@npm:^3.0.3": version: 3.0.3 resolution: "kleur@npm:3.0.3" @@ -7881,22 +8439,22 @@ __metadata: languageName: node linkType: hard -"latest-version@npm:^5.1.0": - version: 5.1.0 - resolution: "latest-version@npm:5.1.0" +"latest-version@npm:^7.0.0": + version: 7.0.0 + resolution: "latest-version@npm:7.0.0" dependencies: - package-json: ^6.3.0 - checksum: fbc72b071eb66c40f652441fd783a9cca62f08bf42433651937f078cd9ef94bf728ec7743992777826e4e89305aef24f234b515e6030503a2cbee7fc9bdc2c0f + package-json: ^8.1.0 + checksum: 1f0deba00d5a34394cce4463c938811f51bbb539b131674f4bb2062c63f2cc3b80bccd56ecade3bd5932d04a34cf0a5a8a2ccc4ec9e5e6b285a9a7b3e27d0d66 languageName: node linkType: hard "launch-editor@npm:^2.6.0": - version: 2.6.1 - resolution: "launch-editor@npm:2.6.1" + version: 2.10.0 + resolution: "launch-editor@npm:2.10.0" dependencies: picocolors: ^1.0.0 shell-quote: ^1.8.1 - checksum: e06d193075ac09f7f8109f10cabe464a211bf7ed4cbe75f83348d6f67bf4d9f162f06e7a1ab3e1cd7fc250b5342c3b57080618aff2e646dc34248fe499227601 + checksum: 0cd219f98a8be1cedc73119c1a18ff232eb1386dcc0f4e710b21234e62bf55513342a3e0939cd67c3d920fc7d714457876bc782a5b17e03f59acbbafd23c5f50 languageName: node linkType: hard @@ -7917,14 +8475,14 @@ __metadata: languageName: node linkType: hard -"lilconfig@npm:2.1.0, lilconfig@npm:^2.0.3": +"lilconfig@npm:2.1.0": version: 2.1.0 resolution: "lilconfig@npm:2.1.0" checksum: 8549bb352b8192375fed4a74694cd61ad293904eee33f9d4866c2192865c44c4eb35d10782966242634e0cbc1e91fe62b1247f148dc5514918e3a966da7ea117 languageName: node linkType: hard -"lilconfig@npm:^3.0.0, lilconfig@npm:^3.1.3": +"lilconfig@npm:^3.0.0, lilconfig@npm:^3.1.1, lilconfig@npm:^3.1.3": version: 3.1.3 resolution: "lilconfig@npm:3.1.3" checksum: 644eb10830350f9cdc88610f71a921f510574ed02424b57b0b3abb66ea725d7a082559552524a842f4e0272c196b88dfe1ff7d35ffcc6f45736777185cd67c9a @@ -7995,32 +8553,6 @@ __metadata: languageName: node linkType: hard -"loader-utils@npm:^3.2.0": - version: 3.2.1 - resolution: "loader-utils@npm:3.2.1" - checksum: 4e3ea054cdc8be1ab1f1238f49f42fdf0483039eff920fb1d442039f3f0ad4ebd11fb8e584ccdf2cb7e3c56b3d40c1832416e6408a55651b843da288960cc792 - languageName: node - linkType: hard - -"locate-path@npm:^3.0.0": - version: 3.0.0 - resolution: "locate-path@npm:3.0.0" - dependencies: - p-locate: ^3.0.0 - path-exists: ^3.0.0 - checksum: 53db3996672f21f8b0bf2a2c645ae2c13ffdae1eeecfcd399a583bce8516c0b88dcb4222ca6efbbbeb6949df7e46860895be2c02e8d3219abd373ace3bfb4e11 - languageName: node - linkType: hard - -"locate-path@npm:^5.0.0": - version: 5.0.0 - resolution: "locate-path@npm:5.0.0" - dependencies: - p-locate: ^4.1.0 - checksum: 83e51725e67517287d73e1ded92b28602e3ae5580b301fe54bfb76c0c723e3f285b19252e375712316774cf52006cb236aed5704692c32db0d5d089b69696e30 - languageName: node - linkType: hard - "locate-path@npm:^6.0.0": version: 6.0.0 resolution: "locate-path@npm:6.0.0" @@ -8030,10 +8562,12 @@ __metadata: languageName: node linkType: hard -"lodash.curry@npm:^4.0.1": - version: 4.1.1 - resolution: "lodash.curry@npm:4.1.1" - checksum: 9192b70fe7df4d1ff780c0260bee271afa9168c93fe4fa24bc861900240531b59781b5fdaadf4644fea8f4fbcd96f0700539ab294b579ffc1022c6c15dcc462a +"locate-path@npm:^7.1.0": + version: 7.2.0 + resolution: "locate-path@npm:7.2.0" + dependencies: + p-locate: ^6.0.0 + checksum: c1b653bdf29beaecb3d307dfb7c44d98a2a98a02ebe353c9ad055d1ac45d6ed4e1142563d222df9b9efebc2bcb7d4c792b507fad9e7150a04c29530b7db570f8 languageName: node linkType: hard @@ -8044,34 +8578,6 @@ __metadata: languageName: node linkType: hard -"lodash.escape@npm:^4.0.1": - version: 4.0.1 - resolution: "lodash.escape@npm:4.0.1" - checksum: fcb54f457497256964d619d5cccbd80a961916fca60df3fe0fa3e7f052715c2944c0ed5aefb4f9e047d127d44aa2d55555f3350cb42c6549e9e293fb30b41e7f - languageName: node - linkType: hard - -"lodash.flatten@npm:^4.4.0": - version: 4.4.0 - resolution: "lodash.flatten@npm:4.4.0" - checksum: 0ac34a393d4b795d4b7421153d27c13ae67e08786c9cbb60ff5b732210d46f833598eee3fb3844bb10070e8488efe390ea53bb567377e0cb47e9e630bf0811cb - languageName: node - linkType: hard - -"lodash.flow@npm:^3.3.0": - version: 3.5.0 - resolution: "lodash.flow@npm:3.5.0" - checksum: a9a62ad344e3c5a1f42bc121da20f64dd855aaafecee24b1db640f29b88bd165d81c37ff7e380a7191de6f70b26f5918abcebbee8396624f78f3618a0b18634c - languageName: node - linkType: hard - -"lodash.invokemap@npm:^4.6.0": - version: 4.6.0 - resolution: "lodash.invokemap@npm:4.6.0" - checksum: 646ceebbefbcb6da301f8c2868254680fd0bcdc6ada470495d9ae49c9c32938829c1b38a38c95d0258409a9655f85db404b16e648381c7450b7ed3d9c52d8808 - languageName: node - linkType: hard - "lodash.memoize@npm:^4.1.2": version: 4.1.2 resolution: "lodash.memoize@npm:4.1.2" @@ -8086,28 +8592,14 @@ __metadata: languageName: node linkType: hard -"lodash.pullall@npm:^4.2.0": - version: 4.2.0 - resolution: "lodash.pullall@npm:4.2.0" - checksum: 7a5fbaedf186ec197ce1e0b9ba1d88a89773ebaf6a8291c7d273838cac59cb3b339cf36ef00e94172862ee84d2304c38face161846f08f5581d0553dcbdcd090 - languageName: node - linkType: hard - -"lodash.uniq@npm:4.5.0, lodash.uniq@npm:^4.5.0": +"lodash.uniq@npm:^4.5.0": version: 4.5.0 resolution: "lodash.uniq@npm:4.5.0" checksum: a4779b57a8d0f3c441af13d9afe7ecff22dd1b8ce1129849f71d9bbc8e8ee4e46dfb4b7c28f7ad3d67481edd6e51126e4e2a6ee276e25906d10f7140187c392d languageName: node linkType: hard -"lodash.uniqby@npm:^4.7.0": - version: 4.7.0 - resolution: "lodash.uniqby@npm:4.7.0" - checksum: 659264545a95726d1493123345aad8cbf56e17810fa9a0b029852c6d42bc80517696af09d99b23bef1845d10d95e01b8b4a1da578f22aeba7a30d3e0022a4938 - languageName: node - linkType: hard - -"lodash@npm:^4.17.19, lodash@npm:^4.17.20, lodash@npm:^4.17.21": +"lodash@npm:^4.17.20, lodash@npm:^4.17.21": version: 4.17.21 resolution: "lodash@npm:4.17.21" checksum: eb835a2e51d381e561e508ce932ea50a8e5a68f4ebdd771ea240d3048244a8d13658acbd502cd4829768c56f2e16bdd4340b9ea141297d472517b83868e677f7 @@ -8127,6 +8619,13 @@ __metadata: languageName: node linkType: hard +"longest-streak@npm:^3.0.0": + version: 3.1.0 + resolution: "longest-streak@npm:3.1.0" + checksum: d7f952ed004cbdb5c8bcfc4f7f5c3d65449e6c5a9e9be4505a656e3df5a57ee125f284286b4bf8ecea0c21a7b3bf2b8f9001ad506c319b9815ad6a63a47d0fd0 + languageName: node + linkType: hard + "loose-envify@npm:^1.0.0, loose-envify@npm:^1.1.0, loose-envify@npm:^1.2.0, loose-envify@npm:^1.3.1, loose-envify@npm:^1.4.0": version: 1.4.0 resolution: "loose-envify@npm:1.4.0" @@ -8147,21 +8646,14 @@ __metadata: languageName: node linkType: hard -"lowercase-keys@npm:^1.0.0, lowercase-keys@npm:^1.0.1": - version: 1.0.1 - resolution: "lowercase-keys@npm:1.0.1" - checksum: 4d045026595936e09953e3867722e309415ff2c80d7701d067546d75ef698dac218a4f53c6d1d0e7368b47e45fd7529df47e6cb56fbb90523ba599f898b3d147 - languageName: node - linkType: hard - -"lowercase-keys@npm:^2.0.0": - version: 2.0.0 - resolution: "lowercase-keys@npm:2.0.0" - checksum: 24d7ebd56ccdf15ff529ca9e08863f3c54b0b9d1edb97a3ae1af34940ae666c01a1e6d200707bce730a8ef76cb57cc10e65f245ecaaf7e6bc8639f2fb460ac23 +"lowercase-keys@npm:^3.0.0": + version: 3.0.0 + resolution: "lowercase-keys@npm:3.0.0" + checksum: 67a3f81409af969bc0c4ca0e76cd7d16adb1e25aa1c197229587eaf8671275c8c067cd421795dbca4c81be0098e4c426a086a05e30de8a9c587b7a13c0c7ccc5 languageName: node linkType: hard -"lru-cache@npm:^10.2.0": +"lru-cache@npm:^10.0.1, lru-cache@npm:^10.2.0": version: 10.4.3 resolution: "lru-cache@npm:10.4.3" checksum: 6476138d2125387a6d20f100608c2583d415a4f64a0fecf30c9e2dda976614f09cad4baa0842447bd37dd459a7bd27f57d9d8f8ce558805abd487c583f3d774a @@ -8177,139 +8669,324 @@ __metadata: languageName: node linkType: hard -"lru-cache@npm:^6.0.0": - version: 6.0.0 - resolution: "lru-cache@npm:6.0.0" +"lunr-languages@npm:^1.4.0": + version: 1.14.0 + resolution: "lunr-languages@npm:1.14.0" + checksum: 05dd6338af6897932f64f9cb735d5b48f9905d892499b22a3f3abc279b2ac71a6bce0fdfe59c01464c6ad3f8e44e2956ba0637f092535239793bbadf4540e72d + languageName: node + linkType: hard + +"lunr@npm:^2.3.9": + version: 2.3.9 + resolution: "lunr@npm:2.3.9" + checksum: 176719e24fcce7d3cf1baccce9dd5633cd8bdc1f41ebe6a180112e5ee99d80373fe2454f5d4624d437e5a8319698ca6837b9950566e15d2cae5f2a543a3db4b8 + languageName: node + linkType: hard + +"magic-string@npm:^0.25.2": + version: 0.25.9 + resolution: "magic-string@npm:0.25.9" dependencies: - yallist: ^4.0.0 - checksum: f97f499f898f23e4585742138a22f22526254fdba6d75d41a1c2526b3b6cc5747ef59c5612ba7375f42aca4f8461950e925ba08c991ead0651b4918b7c978297 + sourcemap-codec: ^1.4.8 + checksum: 9a0e55a15c7303fc360f9572a71cffba1f61451bc92c5602b1206c9d17f492403bf96f946dfce7483e66822d6b74607262e24392e87b0ac27b786e69a40e9b1a + languageName: node + linkType: hard + +"make-fetch-happen@npm:^14.0.3": + version: 14.0.3 + resolution: "make-fetch-happen@npm:14.0.3" + dependencies: + "@npmcli/agent": ^3.0.0 + cacache: ^19.0.1 + http-cache-semantics: ^4.1.1 + minipass: ^7.0.2 + minipass-fetch: ^4.0.0 + minipass-flush: ^1.0.5 + minipass-pipeline: ^1.2.4 + negotiator: ^1.0.0 + proc-log: ^5.0.0 + promise-retry: ^2.0.1 + ssri: ^12.0.0 + checksum: 6fb2fee6da3d98f1953b03d315826b5c5a4ea1f908481afc113782d8027e19f080c85ae998454de4e5f27a681d3ec58d57278f0868d4e0b736f51d396b661691 + languageName: node + linkType: hard + +"mark.js@npm:^8.11.1": + version: 8.11.1 + resolution: "mark.js@npm:8.11.1" + checksum: aa6b9ae1c67245348d5b7abd253ef2acd6bb05c6be358d7d192416d964e42665fc10e0e865591c6f93ab9b57e8da1f23c23216e8ebddb580905ea7a0c0df15d4 + languageName: node + linkType: hard + +"markdown-extensions@npm:^2.0.0": + version: 2.0.0 + resolution: "markdown-extensions@npm:2.0.0" + checksum: ec4ffcb0768f112e778e7ac74cb8ef22a966c168c3e6c29829f007f015b0a0b5c79c73ee8599a0c72e440e7f5cfdbf19e80e2d77b9a313b8f66e180a330cf1b2 + languageName: node + linkType: hard + +"markdown-table@npm:^2.0.0": + version: 2.0.0 + resolution: "markdown-table@npm:2.0.0" + dependencies: + repeat-string: ^1.0.0 + checksum: 9bb634a9300016cbb41216c1eab44c74b6b7083ac07872e296f900a29449cf0e260ece03fa10c3e9784ab94c61664d1d147da0315f95e1336e2bdcc025615c90 + languageName: node + linkType: hard + +"markdown-table@npm:^3.0.0": + version: 3.0.4 + resolution: "markdown-table@npm:3.0.4" + checksum: bc24b177cbb3ef170cb38c9f191476aa63f7236ebc8980317c5e91b5bf98c8fb471cf46d8920478c5e770d7f4337326f6b5b3efbf0687c2044fd332d7a64dfcb + languageName: node + linkType: hard + +"math-intrinsics@npm:^1.1.0": + version: 1.1.0 + resolution: "math-intrinsics@npm:1.1.0" + checksum: 0e513b29d120f478c85a70f49da0b8b19bc638975eca466f2eeae0071f3ad00454c621bf66e16dd435896c208e719fc91ad79bbfba4e400fe0b372e7c1c9c9a2 + languageName: node + linkType: hard + +"mdast-util-definitions@npm:^5.0.0": + version: 5.1.2 + resolution: "mdast-util-definitions@npm:5.1.2" + dependencies: + "@types/mdast": ^3.0.0 + "@types/unist": ^2.0.0 + unist-util-visit: ^4.0.0 + checksum: 2544daccab744ea1ede76045c2577ae4f1cc1b9eb1ea51ab273fe1dca8db5a8d6f50f87759c0ce6484975914b144b7f40316f805cb9c86223a78db8de0b77bae + languageName: node + linkType: hard + +"mdast-util-directive@npm:^3.0.0": + version: 3.1.0 + resolution: "mdast-util-directive@npm:3.1.0" + dependencies: + "@types/mdast": ^4.0.0 + "@types/unist": ^3.0.0 + ccount: ^2.0.0 + devlop: ^1.0.0 + mdast-util-from-markdown: ^2.0.0 + mdast-util-to-markdown: ^2.0.0 + parse-entities: ^4.0.0 + stringify-entities: ^4.0.0 + unist-util-visit-parents: ^6.0.0 + checksum: 9c4592cb719bbf4c9e6c7761fa9d378bb7c72fbb1b60b6ef2ee74b8a7592df2f47e625e1b3c4d5d419e94d5ca8d6c8dcc474938323e324b15362583d3f63723f + languageName: node + linkType: hard + +"mdast-util-find-and-replace@npm:^3.0.0, mdast-util-find-and-replace@npm:^3.0.1": + version: 3.0.2 + resolution: "mdast-util-find-and-replace@npm:3.0.2" + dependencies: + "@types/mdast": ^4.0.0 + escape-string-regexp: ^5.0.0 + unist-util-is: ^6.0.0 + unist-util-visit-parents: ^6.0.0 + checksum: 00dde8aaf87d065034b911bdae20d17c107f5103c6ba5a3d117598c847ce005c6b03114b5603e0d07cc61fefcbb05bdb9f66100efeaa0278dbd80eda1087595f + languageName: node + linkType: hard + +"mdast-util-from-markdown@npm:^1.0.0": + version: 1.3.1 + resolution: "mdast-util-from-markdown@npm:1.3.1" + dependencies: + "@types/mdast": ^3.0.0 + "@types/unist": ^2.0.0 + decode-named-character-reference: ^1.0.0 + mdast-util-to-string: ^3.1.0 + micromark: ^3.0.0 + micromark-util-decode-numeric-character-reference: ^1.0.0 + micromark-util-decode-string: ^1.0.0 + micromark-util-normalize-identifier: ^1.0.0 + micromark-util-symbol: ^1.0.0 + micromark-util-types: ^1.0.0 + unist-util-stringify-position: ^3.0.0 + uvu: ^0.5.0 + checksum: c2fac225167e248d394332a4ea39596e04cbde07d8cdb3889e91e48972c4c3462a02b39fda3855345d90231eb17a90ac6e082fb4f012a77c1d0ddfb9c7446940 + languageName: node + linkType: hard + +"mdast-util-from-markdown@npm:^2.0.0": + version: 2.0.2 + resolution: "mdast-util-from-markdown@npm:2.0.2" + dependencies: + "@types/mdast": ^4.0.0 + "@types/unist": ^3.0.0 + decode-named-character-reference: ^1.0.0 + devlop: ^1.0.0 + mdast-util-to-string: ^4.0.0 + micromark: ^4.0.0 + micromark-util-decode-numeric-character-reference: ^2.0.0 + micromark-util-decode-string: ^2.0.0 + micromark-util-normalize-identifier: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + unist-util-stringify-position: ^4.0.0 + checksum: 1ad19f48b30ac6e0cb756070c210c78ad93c26876edfb3f75127783bc6df8b9402016d8f3e9964f3d1d5430503138ec65c145e869438727e1aa7f3cebf228fba + languageName: node + linkType: hard + +"mdast-util-frontmatter@npm:^2.0.0": + version: 2.0.1 + resolution: "mdast-util-frontmatter@npm:2.0.1" + dependencies: + "@types/mdast": ^4.0.0 + devlop: ^1.0.0 + escape-string-regexp: ^5.0.0 + mdast-util-from-markdown: ^2.0.0 + mdast-util-to-markdown: ^2.0.0 + micromark-extension-frontmatter: ^2.0.0 + checksum: 86a7c8d9eb183be2621d6d9134b9d33df2a3647e3255f68a9796e2425e25643ffae00a501e36c57d9c10973087b94aa5a2ffd865d33cdd274cc9b88cd2d90a2e languageName: node linkType: hard -"lru-cache@npm:^7.7.1": - version: 7.18.3 - resolution: "lru-cache@npm:7.18.3" - checksum: e550d772384709deea3f141af34b6d4fa392e2e418c1498c078de0ee63670f1f46f5eee746e8ef7e69e1c895af0d4224e62ee33e66a543a14763b0f2e74c1356 +"mdast-util-gfm-autolink-literal@npm:^2.0.0": + version: 2.0.1 + resolution: "mdast-util-gfm-autolink-literal@npm:2.0.1" + dependencies: + "@types/mdast": ^4.0.0 + ccount: ^2.0.0 + devlop: ^1.0.0 + mdast-util-find-and-replace: ^3.0.0 + micromark-util-character: ^2.0.0 + checksum: 5630b12e072d7004cb132231c94f667fb5813486779cb0dfb0a196d7ae0e048897a43b0b37e080017adda618ddfcbea1d7bf23c0fa31c87bfc683e0898ea1cfe languageName: node linkType: hard -"lru-cache@npm:^9.1.1 || ^10.0.0": - version: 10.0.1 - resolution: "lru-cache@npm:10.0.1" - checksum: 06f8d0e1ceabd76bb6f644a26dbb0b4c471b79c7b514c13c6856113879b3bf369eb7b497dad4ff2b7e2636db202412394865b33c332100876d838ad1372f0181 +"mdast-util-gfm-footnote@npm:^2.0.0": + version: 2.1.0 + resolution: "mdast-util-gfm-footnote@npm:2.1.0" + dependencies: + "@types/mdast": ^4.0.0 + devlop: ^1.1.0 + mdast-util-from-markdown: ^2.0.0 + mdast-util-to-markdown: ^2.0.0 + micromark-util-normalize-identifier: ^2.0.0 + checksum: a23c5531d63b254b46cbcb063b5731f56ccc9d1f038a17fa66d3994255868604a2b963f24e0f5b16dd3374743622afafcfe0c98cf90548d485bdc426ba77c618 languageName: node linkType: hard -"magic-string@npm:^0.25.1, magic-string@npm:^0.25.2": - version: 0.25.9 - resolution: "magic-string@npm:0.25.9" +"mdast-util-gfm-strikethrough@npm:^2.0.0": + version: 2.0.0 + resolution: "mdast-util-gfm-strikethrough@npm:2.0.0" dependencies: - sourcemap-codec: ^1.4.8 - checksum: 9a0e55a15c7303fc360f9572a71cffba1f61451bc92c5602b1206c9d17f492403bf96f946dfce7483e66822d6b74607262e24392e87b0ac27b786e69a40e9b1a + "@types/mdast": ^4.0.0 + mdast-util-from-markdown: ^2.0.0 + mdast-util-to-markdown: ^2.0.0 + checksum: fe9b1d0eba9b791ff9001c008744eafe3dd7a81b085f2bf521595ce4a8e8b1b44764ad9361761ad4533af3e5d913d8ad053abec38172031d9ee32a8ebd1c7dbd languageName: node linkType: hard -"make-dir@npm:^3.0.0, make-dir@npm:^3.0.2, make-dir@npm:^3.1.0": - version: 3.1.0 - resolution: "make-dir@npm:3.1.0" +"mdast-util-gfm-table@npm:^2.0.0": + version: 2.0.0 + resolution: "mdast-util-gfm-table@npm:2.0.0" dependencies: - semver: ^6.0.0 - checksum: 484200020ab5a1fdf12f393fe5f385fc8e4378824c940fba1729dcd198ae4ff24867bc7a5646331e50cead8abff5d9270c456314386e629acec6dff4b8016b78 + "@types/mdast": ^4.0.0 + devlop: ^1.0.0 + markdown-table: ^3.0.0 + mdast-util-from-markdown: ^2.0.0 + mdast-util-to-markdown: ^2.0.0 + checksum: 063a627fd0993548fd63ca0c24c437baf91ba7d51d0a38820bd459bc20bf3d13d7365ef8d28dca99176dd5eb26058f7dde51190479c186dfe6af2e11202957c9 languageName: node linkType: hard -"make-fetch-happen@npm:^11.0.3": - version: 11.1.1 - resolution: "make-fetch-happen@npm:11.1.1" +"mdast-util-gfm-task-list-item@npm:^2.0.0": + version: 2.0.0 + resolution: "mdast-util-gfm-task-list-item@npm:2.0.0" dependencies: - agentkeepalive: ^4.2.1 - cacache: ^17.0.0 - http-cache-semantics: ^4.1.1 - http-proxy-agent: ^5.0.0 - https-proxy-agent: ^5.0.0 - is-lambda: ^1.0.1 - lru-cache: ^7.7.1 - minipass: ^5.0.0 - minipass-fetch: ^3.0.0 - minipass-flush: ^1.0.5 - minipass-pipeline: ^1.2.4 - negotiator: ^0.6.3 - promise-retry: ^2.0.1 - socks-proxy-agent: ^7.0.0 - ssri: ^10.0.0 - checksum: 7268bf274a0f6dcf0343829489a4506603ff34bd0649c12058753900b0eb29191dce5dba12680719a5d0a983d3e57810f594a12f3c18494e93a1fbc6348a4540 + "@types/mdast": ^4.0.0 + devlop: ^1.0.0 + mdast-util-from-markdown: ^2.0.0 + mdast-util-to-markdown: ^2.0.0 + checksum: 37db90c59b15330fc54d790404abf5ef9f2f83e8961c53666fe7de4aab8dd5e6b3c296b6be19797456711a89a27840291d8871ff0438e9b4e15c89d170efe072 languageName: node linkType: hard -"markdown-escapes@npm:^1.0.0": - version: 1.0.4 - resolution: "markdown-escapes@npm:1.0.4" - checksum: 6833a93d72d3f70a500658872312c6fa8015c20cc835a85ae6901fa232683fbc6ed7118ebe920fea7c80039a560f339c026597d96eee0e9de602a36921804997 +"mdast-util-gfm@npm:^3.0.0": + version: 3.1.0 + resolution: "mdast-util-gfm@npm:3.1.0" + dependencies: + mdast-util-from-markdown: ^2.0.0 + mdast-util-gfm-autolink-literal: ^2.0.0 + mdast-util-gfm-footnote: ^2.0.0 + mdast-util-gfm-strikethrough: ^2.0.0 + mdast-util-gfm-table: ^2.0.0 + mdast-util-gfm-task-list-item: ^2.0.0 + mdast-util-to-markdown: ^2.0.0 + checksum: ecdadc0b46608d03eea53366cfee8c9441ddacc49fe4e12934eff8fea06f9377d2679d9d9e43177295c09c8d7def5f48d739f99b0f6144a0e228a77f5a1c76bc languageName: node linkType: hard -"mdast-squeeze-paragraphs@npm:^4.0.0": - version: 4.0.0 - resolution: "mdast-squeeze-paragraphs@npm:4.0.0" +"mdast-util-mdx-expression@npm:^2.0.0": + version: 2.0.1 + resolution: "mdast-util-mdx-expression@npm:2.0.1" dependencies: - unist-util-remove: ^2.0.0 - checksum: dfe8ec8e8a62171f020e82b088cc35cb9da787736dc133a3b45ce8811782a93e69bf06d147072e281079f09fac67be8a36153ffffd9bfbf89ed284e4c4f56f75 + "@types/estree-jsx": ^1.0.0 + "@types/hast": ^3.0.0 + "@types/mdast": ^4.0.0 + devlop: ^1.0.0 + mdast-util-from-markdown: ^2.0.0 + mdast-util-to-markdown: ^2.0.0 + checksum: 6af56b06bde3ab971129db9855dcf0d31806c70b3b052d7a90a5499a366b57ffd0c2efca67d281c448c557298ba7e3e61bd07133733b735440840dd339b28e19 languageName: node linkType: hard -"mdast-util-definitions@npm:^4.0.0": - version: 4.0.0 - resolution: "mdast-util-definitions@npm:4.0.0" +"mdast-util-mdx-jsx@npm:^3.0.0": + version: 3.2.0 + resolution: "mdast-util-mdx-jsx@npm:3.2.0" dependencies: - unist-util-visit: ^2.0.0 - checksum: 2325f20b82b3fb8cb5fda77038ee0bbdd44f82cfca7c48a854724b58bc1fe5919630a3ce7c45e210726df59d46c881d020b2da7a493bfd1ee36eb2bbfef5d78e + "@types/estree-jsx": ^1.0.0 + "@types/hast": ^3.0.0 + "@types/mdast": ^4.0.0 + "@types/unist": ^3.0.0 + ccount: ^2.0.0 + devlop: ^1.1.0 + mdast-util-from-markdown: ^2.0.0 + mdast-util-to-markdown: ^2.0.0 + parse-entities: ^4.0.0 + stringify-entities: ^4.0.0 + unist-util-stringify-position: ^4.0.0 + vfile-message: ^4.0.0 + checksum: 224f5f6ad247f0f2622ee36c82ac7a4c6a60c31850de4056bf95f531bd2f7ec8943ef34dfe8a8375851f65c07e4913c4f33045d703df4ff4d11b2de5a088f7f9 languageName: node linkType: hard -"mdast-util-definitions@npm:^5.0.0": - version: 5.1.2 - resolution: "mdast-util-definitions@npm:5.1.2" +"mdast-util-mdx@npm:^3.0.0": + version: 3.0.0 + resolution: "mdast-util-mdx@npm:3.0.0" dependencies: - "@types/mdast": ^3.0.0 - "@types/unist": ^2.0.0 - unist-util-visit: ^4.0.0 - checksum: 2544daccab744ea1ede76045c2577ae4f1cc1b9eb1ea51ab273fe1dca8db5a8d6f50f87759c0ce6484975914b144b7f40316f805cb9c86223a78db8de0b77bae + mdast-util-from-markdown: ^2.0.0 + mdast-util-mdx-expression: ^2.0.0 + mdast-util-mdx-jsx: ^3.0.0 + mdast-util-mdxjs-esm: ^2.0.0 + mdast-util-to-markdown: ^2.0.0 + checksum: e2b007d826fcd49fd57ed03e190753c8b0f7d9eff6c7cb26ba609cde15cd3a472c0cd5e4a1ee3e39a40f14be22fdb57de243e093cea0c064d6f3366cff3e3af2 languageName: node linkType: hard -"mdast-util-from-markdown@npm:^1.0.0": - version: 1.3.1 - resolution: "mdast-util-from-markdown@npm:1.3.1" +"mdast-util-mdxjs-esm@npm:^2.0.0": + version: 2.0.1 + resolution: "mdast-util-mdxjs-esm@npm:2.0.1" dependencies: - "@types/mdast": ^3.0.0 - "@types/unist": ^2.0.0 - decode-named-character-reference: ^1.0.0 - mdast-util-to-string: ^3.1.0 - micromark: ^3.0.0 - micromark-util-decode-numeric-character-reference: ^1.0.0 - micromark-util-decode-string: ^1.0.0 - micromark-util-normalize-identifier: ^1.0.0 - micromark-util-symbol: ^1.0.0 - micromark-util-types: ^1.0.0 - unist-util-stringify-position: ^3.0.0 - uvu: ^0.5.0 - checksum: c2fac225167e248d394332a4ea39596e04cbde07d8cdb3889e91e48972c4c3462a02b39fda3855345d90231eb17a90ac6e082fb4f012a77c1d0ddfb9c7446940 + "@types/estree-jsx": ^1.0.0 + "@types/hast": ^3.0.0 + "@types/mdast": ^4.0.0 + devlop: ^1.0.0 + mdast-util-from-markdown: ^2.0.0 + mdast-util-to-markdown: ^2.0.0 + checksum: 1f9dad04d31d59005332e9157ea9510dc1d03092aadbc607a10475c7eec1c158b475aa0601a3a4f74e13097ca735deb8c2d9d37928ddef25d3029fd7c9e14dc3 languageName: node linkType: hard -"mdast-util-to-hast@npm:10.0.1": - version: 10.0.1 - resolution: "mdast-util-to-hast@npm:10.0.1" +"mdast-util-phrasing@npm:^4.0.0": + version: 4.1.0 + resolution: "mdast-util-phrasing@npm:4.1.0" dependencies: - "@types/mdast": ^3.0.0 - "@types/unist": ^2.0.0 - mdast-util-definitions: ^4.0.0 - mdurl: ^1.0.0 - unist-builder: ^2.0.0 - unist-util-generated: ^1.0.0 - unist-util-position: ^3.0.0 - unist-util-visit: ^2.0.0 - checksum: e5f385757df7e9b37db4d6f326bf7b4fc1b40f9ad01fc335686578f44abe0ba46d3e60af4d5e5b763556d02e65069ef9a09c49db049b52659203a43e7fa9084d + "@types/mdast": ^4.0.0 + unist-util-is: ^6.0.0 + checksum: 3a97533e8ad104a422f8bebb34b3dde4f17167b8ed3a721cf9263c7416bd3447d2364e6d012a594aada40cac9e949db28a060bb71a982231693609034ed5324e languageName: node linkType: hard @@ -8329,10 +9006,37 @@ __metadata: languageName: node linkType: hard -"mdast-util-to-string@npm:^2.0.0": - version: 2.0.0 - resolution: "mdast-util-to-string@npm:2.0.0" - checksum: 0b2113ada10e002fbccb014170506dabe2f2ddacaacbe4bc1045c33f986652c5a162732a2c057c5335cdb58419e2ad23e368e5be226855d4d4e280b81c4e9ec2 +"mdast-util-to-hast@npm:^13.0.0": + version: 13.2.0 + resolution: "mdast-util-to-hast@npm:13.2.0" + dependencies: + "@types/hast": ^3.0.0 + "@types/mdast": ^4.0.0 + "@ungap/structured-clone": ^1.0.0 + devlop: ^1.0.0 + micromark-util-sanitize-uri: ^2.0.0 + trim-lines: ^3.0.0 + unist-util-position: ^5.0.0 + unist-util-visit: ^5.0.0 + vfile: ^6.0.0 + checksum: 7e5231ff3d4e35e1421908437577fd5098141f64918ff5cc8a0f7a8a76c5407f7a3ee88d75f7a1f7afb763989c9f357475fa0ba8296c00aaff1e940098fe86a6 + languageName: node + linkType: hard + +"mdast-util-to-markdown@npm:^2.0.0": + version: 2.1.2 + resolution: "mdast-util-to-markdown@npm:2.1.2" + dependencies: + "@types/mdast": ^4.0.0 + "@types/unist": ^3.0.0 + longest-streak: ^3.0.0 + mdast-util-phrasing: ^4.0.0 + mdast-util-to-string: ^4.0.0 + micromark-util-classify-character: ^2.0.0 + micromark-util-decode-string: ^2.0.0 + unist-util-visit: ^5.0.0 + zwitch: ^2.0.0 + checksum: 288d152bd50c00632e6e01c610bb904a220d1e226c8086c40627877959746f83ab0b872f4150cb7d910198953b1bf756e384ac3fee3e7b0ddb4517f9084c5803 languageName: node linkType: hard @@ -8345,17 +9049,26 @@ __metadata: languageName: node linkType: hard -"mdn-data@npm:2.0.14": - version: 2.0.14 - resolution: "mdn-data@npm:2.0.14" - checksum: 9d0128ed425a89f4cba8f787dca27ad9408b5cb1b220af2d938e2a0629d17d879a34d2cb19318bdb26c3f14c77dd5dfbae67211f5caaf07b61b1f2c5c8c7dc16 +"mdast-util-to-string@npm:^4.0.0": + version: 4.0.0 + resolution: "mdast-util-to-string@npm:4.0.0" + dependencies: + "@types/mdast": ^4.0.0 + checksum: 35489fb5710d58cbc2d6c8b6547df161a3f81e0f28f320dfb3548a9393555daf07c310c0c497708e67ed4dfea4a06e5655799e7d631ca91420c288b4525d6c29 languageName: node linkType: hard -"mdurl@npm:^1.0.0": - version: 1.0.1 - resolution: "mdurl@npm:1.0.1" - checksum: 71731ecba943926bfbf9f9b51e28b5945f9411c4eda80894221b47cc105afa43ba2da820732b436f0798fd3edbbffcd1fc1415843c41a87fea08a41cc1e3d02b +"mdn-data@npm:2.0.28": + version: 2.0.28 + resolution: "mdn-data@npm:2.0.28" + checksum: f51d587a6ebe8e426c3376c74ea6df3e19ec8241ed8e2466c9c8a3904d5d04397199ea4f15b8d34d14524b5de926d8724ae85207984be47e165817c26e49e0aa + languageName: node + linkType: hard + +"mdn-data@npm:2.0.30": + version: 2.0.30 + resolution: "mdn-data@npm:2.0.30" + checksum: d6ac5ac7439a1607df44b22738ecf83f48e66a0874e4482d6424a61c52da5cde5750f1d1229b6f5fa1b80a492be89465390da685b11f97d62b8adcc6e88189aa languageName: node linkType: hard @@ -8366,7 +9079,7 @@ __metadata: languageName: node linkType: hard -"memfs@npm:^3.1.2, memfs@npm:^3.4.3": +"memfs@npm:^3.4.3": version: 3.5.3 resolution: "memfs@npm:3.5.3" dependencies: @@ -8375,10 +9088,10 @@ __metadata: languageName: node linkType: hard -"merge-descriptors@npm:1.0.1": - version: 1.0.1 - resolution: "merge-descriptors@npm:1.0.1" - checksum: 5abc259d2ae25bb06d19ce2b94a21632583c74e2a9109ee1ba7fd147aa7362b380d971e0251069f8b3eb7d48c21ac839e21fa177b335e82c76ec172e30c31a26 +"merge-descriptors@npm:1.0.3": + version: 1.0.3 + resolution: "merge-descriptors@npm:1.0.3" + checksum: 52117adbe0313d5defa771c9993fe081e2d2df9b840597e966aadafde04ae8d0e3da46bac7ca4efc37d4d2b839436582659cd49c6a43eacb3fe3050896a105d1 languageName: node linkType: hard @@ -8427,6 +9140,226 @@ __metadata: languageName: node linkType: hard +"micromark-core-commonmark@npm:^2.0.0": + version: 2.0.3 + resolution: "micromark-core-commonmark@npm:2.0.3" + dependencies: + decode-named-character-reference: ^1.0.0 + devlop: ^1.0.0 + micromark-factory-destination: ^2.0.0 + micromark-factory-label: ^2.0.0 + micromark-factory-space: ^2.0.0 + micromark-factory-title: ^2.0.0 + micromark-factory-whitespace: ^2.0.0 + micromark-util-character: ^2.0.0 + micromark-util-chunked: ^2.0.0 + micromark-util-classify-character: ^2.0.0 + micromark-util-html-tag-name: ^2.0.0 + micromark-util-normalize-identifier: ^2.0.0 + micromark-util-resolve-all: ^2.0.0 + micromark-util-subtokenize: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + checksum: cfb0fd9c895f86a4e9344f7f0344fe6bd1018945798222835248146a42430b8c7bc0b2857af574cf4e1b4ce4e5c1a35a1479942421492e37baddde8de85814dc + languageName: node + linkType: hard + +"micromark-extension-directive@npm:^3.0.0": + version: 3.0.2 + resolution: "micromark-extension-directive@npm:3.0.2" + dependencies: + devlop: ^1.0.0 + micromark-factory-space: ^2.0.0 + micromark-factory-whitespace: ^2.0.0 + micromark-util-character: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + parse-entities: ^4.0.0 + checksum: 572c9e4625bc6a37146f6c905cbc8b507f171c07ad0a6d991d6ee22bbde4620826b89303f80e71c30c7903e5fa0661e1f08fb14e69b5273b33afbd87276c8a53 + languageName: node + linkType: hard + +"micromark-extension-frontmatter@npm:^2.0.0": + version: 2.0.0 + resolution: "micromark-extension-frontmatter@npm:2.0.0" + dependencies: + fault: ^2.0.0 + micromark-util-character: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + checksum: f68032df38c00ae47de15b63bcd72515bfcce39de4a9262a3a1ac9c5990f253f8e41bdc65fd17ec4bb3d144c32529ce0829571331e4901a9a413f1a53785d1e8 + languageName: node + linkType: hard + +"micromark-extension-gfm-autolink-literal@npm:^2.0.0": + version: 2.1.0 + resolution: "micromark-extension-gfm-autolink-literal@npm:2.1.0" + dependencies: + micromark-util-character: ^2.0.0 + micromark-util-sanitize-uri: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + checksum: e00a570c70c837b9cbbe94b2c23b787f44e781cd19b72f1828e3453abca2a9fb600fa539cdc75229fa3919db384491063645086e02249481e6ff3ec2c18f767c + languageName: node + linkType: hard + +"micromark-extension-gfm-footnote@npm:^2.0.0": + version: 2.1.0 + resolution: "micromark-extension-gfm-footnote@npm:2.1.0" + dependencies: + devlop: ^1.0.0 + micromark-core-commonmark: ^2.0.0 + micromark-factory-space: ^2.0.0 + micromark-util-character: ^2.0.0 + micromark-util-normalize-identifier: ^2.0.0 + micromark-util-sanitize-uri: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + checksum: ac6fb039e98395d37b71ebff7c7a249aef52678b5cf554c89c4f716111d4be62ef99a5d715a5bd5d68fa549778c977d85cb671d1d8506dc8a3a1b46e867ae52f + languageName: node + linkType: hard + +"micromark-extension-gfm-strikethrough@npm:^2.0.0": + version: 2.1.0 + resolution: "micromark-extension-gfm-strikethrough@npm:2.1.0" + dependencies: + devlop: ^1.0.0 + micromark-util-chunked: ^2.0.0 + micromark-util-classify-character: ^2.0.0 + micromark-util-resolve-all: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + checksum: cdb7a38dd6eefb6ceb6792a44a6796b10f951e8e3e45b8579f599f43e7ae26ccd048c0aa7e441b3c29dd0c54656944fe6eb0098de2bc4b5106fbc0a42e9e016c + languageName: node + linkType: hard + +"micromark-extension-gfm-table@npm:^2.0.0": + version: 2.1.1 + resolution: "micromark-extension-gfm-table@npm:2.1.1" + dependencies: + devlop: ^1.0.0 + micromark-factory-space: ^2.0.0 + micromark-util-character: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + checksum: 16a59c8c2381c8418d9cf36c605abb0b66cfebaad07e09c4c9b113298d13e0c517b652885529fcb74d149afec3f6e8ab065fd27a900073d5ec0a1d8f0c51b593 + languageName: node + linkType: hard + +"micromark-extension-gfm-tagfilter@npm:^2.0.0": + version: 2.0.0 + resolution: "micromark-extension-gfm-tagfilter@npm:2.0.0" + dependencies: + micromark-util-types: ^2.0.0 + checksum: cf21552f4a63592bfd6c96ae5d64a5f22bda4e77814e3f0501bfe80e7a49378ad140f827007f36044666f176b3a0d5fea7c2e8e7973ce4b4579b77789f01ae95 + languageName: node + linkType: hard + +"micromark-extension-gfm-task-list-item@npm:^2.0.0": + version: 2.1.0 + resolution: "micromark-extension-gfm-task-list-item@npm:2.1.0" + dependencies: + devlop: ^1.0.0 + micromark-factory-space: ^2.0.0 + micromark-util-character: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + checksum: b1ad86a4e9d68d9ad536d94fb25a5182acbc85cc79318f4a6316034342f6a71d67983cc13f12911d0290fd09b2bda43cdabe8781a2d9cca2ebe0d421e8b2b8a4 + languageName: node + linkType: hard + +"micromark-extension-gfm@npm:^3.0.0": + version: 3.0.0 + resolution: "micromark-extension-gfm@npm:3.0.0" + dependencies: + micromark-extension-gfm-autolink-literal: ^2.0.0 + micromark-extension-gfm-footnote: ^2.0.0 + micromark-extension-gfm-strikethrough: ^2.0.0 + micromark-extension-gfm-table: ^2.0.0 + micromark-extension-gfm-tagfilter: ^2.0.0 + micromark-extension-gfm-task-list-item: ^2.0.0 + micromark-util-combine-extensions: ^2.0.0 + micromark-util-types: ^2.0.0 + checksum: 2060fa62666a09532d6b3a272d413bc1b25bbb262f921d7402795ac021e1362c8913727e33d7528d5b4ccaf26922ec51208c43f795a702964817bc986de886c9 + languageName: node + linkType: hard + +"micromark-extension-mdx-expression@npm:^3.0.0": + version: 3.0.1 + resolution: "micromark-extension-mdx-expression@npm:3.0.1" + dependencies: + "@types/estree": ^1.0.0 + devlop: ^1.0.0 + micromark-factory-mdx-expression: ^2.0.0 + micromark-factory-space: ^2.0.0 + micromark-util-character: ^2.0.0 + micromark-util-events-to-acorn: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + checksum: 0e15bc3911b53704723acc300d99093e46e31a1f2210f6fadeaf065d04c964cd4588cf4aa1e9c324430bfd943dfa7f36e369a3bc92f4641015b107bbb2190034 + languageName: node + linkType: hard + +"micromark-extension-mdx-jsx@npm:^3.0.0": + version: 3.0.2 + resolution: "micromark-extension-mdx-jsx@npm:3.0.2" + dependencies: + "@types/estree": ^1.0.0 + devlop: ^1.0.0 + estree-util-is-identifier-name: ^3.0.0 + micromark-factory-mdx-expression: ^2.0.0 + micromark-factory-space: ^2.0.0 + micromark-util-character: ^2.0.0 + micromark-util-events-to-acorn: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + vfile-message: ^4.0.0 + checksum: abe07e592a95804445d2c667bc999696ac39ddd551374f5a39e2d910c8b25e75bf61b4933213696f7bc26f4a5a56d91b3ce31d9a063b6fd7bbd4633565b1d6ec + languageName: node + linkType: hard + +"micromark-extension-mdx-md@npm:^2.0.0": + version: 2.0.0 + resolution: "micromark-extension-mdx-md@npm:2.0.0" + dependencies: + micromark-util-types: ^2.0.0 + checksum: 7daf03372fd7faddf3f0ac87bdb0debb0bb770f33b586f72251e1072b222ceee75400ab6194c0e130dbf1e077369a5b627be6e9130d7a2e9e6b849f0d18ff246 + languageName: node + linkType: hard + +"micromark-extension-mdxjs-esm@npm:^3.0.0": + version: 3.0.0 + resolution: "micromark-extension-mdxjs-esm@npm:3.0.0" + dependencies: + "@types/estree": ^1.0.0 + devlop: ^1.0.0 + micromark-core-commonmark: ^2.0.0 + micromark-util-character: ^2.0.0 + micromark-util-events-to-acorn: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + unist-util-position-from-estree: ^2.0.0 + vfile-message: ^4.0.0 + checksum: fb33d850200afce567b95c90f2f7d42259bd33eea16154349e4fa77c3ec934f46c8e5c111acea16321dce3d9f85aaa4c49afe8b810e31b34effc11617aeee8f6 + languageName: node + linkType: hard + +"micromark-extension-mdxjs@npm:^3.0.0": + version: 3.0.0 + resolution: "micromark-extension-mdxjs@npm:3.0.0" + dependencies: + acorn: ^8.0.0 + acorn-jsx: ^5.0.0 + micromark-extension-mdx-expression: ^3.0.0 + micromark-extension-mdx-jsx: ^3.0.0 + micromark-extension-mdx-md: ^2.0.0 + micromark-extension-mdxjs-esm: ^3.0.0 + micromark-util-combine-extensions: ^2.0.0 + micromark-util-types: ^2.0.0 + checksum: 7da6f0fb0e1e0270a2f5ad257e7422cc16e68efa7b8214c63c9d55bc264cb872e9ca4ac9a71b9dfd13daf52e010f730bac316086f4340e4fcc6569ec699915bf + languageName: node + linkType: hard + "micromark-factory-destination@npm:^1.0.0": version: 1.1.0 resolution: "micromark-factory-destination@npm:1.1.0" @@ -8438,6 +9371,17 @@ __metadata: languageName: node linkType: hard +"micromark-factory-destination@npm:^2.0.0": + version: 2.0.1 + resolution: "micromark-factory-destination@npm:2.0.1" + dependencies: + micromark-util-character: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + checksum: 9c4baa9ca2ed43c061bbf40ddd3d85154c2a0f1f485de9dea41d7dd2ad994ebb02034a003b2c1dbe228ba83a0576d591f0e90e0bf978713f84ee7d7f3aa98320 + languageName: node + linkType: hard + "micromark-factory-label@npm:^1.0.0": version: 1.1.0 resolution: "micromark-factory-label@npm:1.1.0" @@ -8450,6 +9394,35 @@ __metadata: languageName: node linkType: hard +"micromark-factory-label@npm:^2.0.0": + version: 2.0.1 + resolution: "micromark-factory-label@npm:2.0.1" + dependencies: + devlop: ^1.0.0 + micromark-util-character: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + checksum: bd03f5a75f27cdbf03b894ddc5c4480fc0763061fecf9eb927d6429233c930394f223969a99472df142d570c831236134de3dc23245d23d9f046f9d0b623b5c2 + languageName: node + linkType: hard + +"micromark-factory-mdx-expression@npm:^2.0.0": + version: 2.0.3 + resolution: "micromark-factory-mdx-expression@npm:2.0.3" + dependencies: + "@types/estree": ^1.0.0 + devlop: ^1.0.0 + micromark-factory-space: ^2.0.0 + micromark-util-character: ^2.0.0 + micromark-util-events-to-acorn: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + unist-util-position-from-estree: ^2.0.0 + vfile-message: ^4.0.0 + checksum: f007987092a3bd00617f023d324caff10c63982e5125a3e3ff147baaf03f378e21c47306e2094b8c6480a726c57785c2175b4ffc3f3a6fde8be87e40fbdff068 + languageName: node + linkType: hard + "micromark-factory-space@npm:^1.0.0": version: 1.1.0 resolution: "micromark-factory-space@npm:1.1.0" @@ -8460,6 +9433,16 @@ __metadata: languageName: node linkType: hard +"micromark-factory-space@npm:^2.0.0": + version: 2.0.1 + resolution: "micromark-factory-space@npm:2.0.1" + dependencies: + micromark-util-character: ^2.0.0 + micromark-util-types: ^2.0.0 + checksum: 1bd68a017c1a66f4787506660c1e1c5019169aac3b1cb075d49ac5e360e0b2065e984d4e1d6e9e52a9d44000f2fa1c98e66a743d7aae78b4b05616bf3242ed71 + languageName: node + linkType: hard + "micromark-factory-title@npm:^1.0.0": version: 1.1.0 resolution: "micromark-factory-title@npm:1.1.0" @@ -8472,6 +9455,18 @@ __metadata: languageName: node linkType: hard +"micromark-factory-title@npm:^2.0.0": + version: 2.0.1 + resolution: "micromark-factory-title@npm:2.0.1" + dependencies: + micromark-factory-space: ^2.0.0 + micromark-util-character: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + checksum: b4d2e4850a8ba0dff25ce54e55a3eb0d43dda88a16293f53953153288f9d84bcdfa8ca4606b2cfbb4f132ea79587bbb478a73092a349f893f5264fbcdbce2ee1 + languageName: node + linkType: hard + "micromark-factory-whitespace@npm:^1.0.0": version: 1.1.0 resolution: "micromark-factory-whitespace@npm:1.1.0" @@ -8484,7 +9479,19 @@ __metadata: languageName: node linkType: hard -"micromark-util-character@npm:^1.0.0": +"micromark-factory-whitespace@npm:^2.0.0": + version: 2.0.1 + resolution: "micromark-factory-whitespace@npm:2.0.1" + dependencies: + micromark-factory-space: ^2.0.0 + micromark-util-character: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + checksum: 67b3944d012a42fee9e10e99178254a04d48af762b54c10a50fcab988688799993efb038daf9f5dbc04001a97b9c1b673fc6f00e6a56997877ab25449f0c8650 + languageName: node + linkType: hard + +"micromark-util-character@npm:^1.0.0, micromark-util-character@npm:^1.1.0": version: 1.2.0 resolution: "micromark-util-character@npm:1.2.0" dependencies: @@ -8494,6 +9501,16 @@ __metadata: languageName: node linkType: hard +"micromark-util-character@npm:^2.0.0": + version: 2.1.1 + resolution: "micromark-util-character@npm:2.1.1" + dependencies: + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + checksum: e9e409efe4f2596acd44587e8591b722bfc041c1577e8fe0d9c007a4776fb800f9b3637a22862ad2ba9489f4bdf72bb547fce5767dbbfe0a5e6760e2a21c6495 + languageName: node + linkType: hard + "micromark-util-chunked@npm:^1.0.0": version: 1.1.0 resolution: "micromark-util-chunked@npm:1.1.0" @@ -8503,6 +9520,15 @@ __metadata: languageName: node linkType: hard +"micromark-util-chunked@npm:^2.0.0": + version: 2.0.1 + resolution: "micromark-util-chunked@npm:2.0.1" + dependencies: + micromark-util-symbol: ^2.0.0 + checksum: f8cb2a67bcefe4bd2846d838c97b777101f0043b9f1de4f69baf3e26bb1f9885948444e3c3aec66db7595cad8173bd4567a000eb933576c233d54631f6323fe4 + languageName: node + linkType: hard + "micromark-util-classify-character@npm:^1.0.0": version: 1.1.0 resolution: "micromark-util-classify-character@npm:1.1.0" @@ -8514,6 +9540,17 @@ __metadata: languageName: node linkType: hard +"micromark-util-classify-character@npm:^2.0.0": + version: 2.0.1 + resolution: "micromark-util-classify-character@npm:2.0.1" + dependencies: + micromark-util-character: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + checksum: 4d8bbe3a6dbf69ac0fc43516866b5bab019fe3f4568edc525d4feaaaf78423fa54e6b6732b5bccbeed924455279a3758ffc9556954aafb903982598a95a02704 + languageName: node + linkType: hard + "micromark-util-combine-extensions@npm:^1.0.0": version: 1.1.0 resolution: "micromark-util-combine-extensions@npm:1.1.0" @@ -8524,6 +9561,16 @@ __metadata: languageName: node linkType: hard +"micromark-util-combine-extensions@npm:^2.0.0": + version: 2.0.1 + resolution: "micromark-util-combine-extensions@npm:2.0.1" + dependencies: + micromark-util-chunked: ^2.0.0 + micromark-util-types: ^2.0.0 + checksum: 5d22fb9ee37e8143adfe128a72b50fa09568c2cc553b3c76160486c96dbbb298c5802a177a10a215144a604b381796071b5d35be1f2c2b2ee17995eda92f0c8e + languageName: node + linkType: hard + "micromark-util-decode-numeric-character-reference@npm:^1.0.0": version: 1.1.0 resolution: "micromark-util-decode-numeric-character-reference@npm:1.1.0" @@ -8533,6 +9580,15 @@ __metadata: languageName: node linkType: hard +"micromark-util-decode-numeric-character-reference@npm:^2.0.0": + version: 2.0.2 + resolution: "micromark-util-decode-numeric-character-reference@npm:2.0.2" + dependencies: + micromark-util-symbol: ^2.0.0 + checksum: ee11c8bde51e250e302050474c4a2adca094bca05c69f6cdd241af12df285c48c88d19ee6e022b9728281c280be16328904adca994605680c43af56019f4b0b6 + languageName: node + linkType: hard + "micromark-util-decode-string@npm:^1.0.0": version: 1.1.0 resolution: "micromark-util-decode-string@npm:1.1.0" @@ -8545,6 +9601,18 @@ __metadata: languageName: node linkType: hard +"micromark-util-decode-string@npm:^2.0.0": + version: 2.0.1 + resolution: "micromark-util-decode-string@npm:2.0.1" + dependencies: + decode-named-character-reference: ^1.0.0 + micromark-util-character: ^2.0.0 + micromark-util-decode-numeric-character-reference: ^2.0.0 + micromark-util-symbol: ^2.0.0 + checksum: e9546ae53f9b5a4f9aa6aaf3e750087100d3429485ca80dbacec99ff2bb15a406fa7d93784a0fc2fe05ad7296b9295e75160ef71faec9e90110b7be2ae66241a + languageName: node + linkType: hard + "micromark-util-encode@npm:^1.0.0": version: 1.1.0 resolution: "micromark-util-encode@npm:1.1.0" @@ -8552,6 +9620,28 @@ __metadata: languageName: node linkType: hard +"micromark-util-encode@npm:^2.0.0": + version: 2.0.1 + resolution: "micromark-util-encode@npm:2.0.1" + checksum: be890b98e78dd0cdd953a313f4148c4692cc2fb05533e56fef5f421287d3c08feee38ca679f318e740530791fc251bfe8c80efa926fcceb4419b269c9343d226 + languageName: node + linkType: hard + +"micromark-util-events-to-acorn@npm:^2.0.0": + version: 2.0.3 + resolution: "micromark-util-events-to-acorn@npm:2.0.3" + dependencies: + "@types/estree": ^1.0.0 + "@types/unist": ^3.0.0 + devlop: ^1.0.0 + estree-util-visit: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + vfile-message: ^4.0.0 + checksum: 8240f1aa072b3a2ec6df4fb55a0a19dd9f53923125a892da156e378b2af0333557f803f8da5228b03e5b1511c999701f0edbff9e483d00c5af5840f8466fb314 + languageName: node + linkType: hard + "micromark-util-html-tag-name@npm:^1.0.0": version: 1.2.0 resolution: "micromark-util-html-tag-name@npm:1.2.0" @@ -8559,6 +9649,13 @@ __metadata: languageName: node linkType: hard +"micromark-util-html-tag-name@npm:^2.0.0": + version: 2.0.1 + resolution: "micromark-util-html-tag-name@npm:2.0.1" + checksum: dea365f5ad28ad74ff29fcb581f7b74fc1f80271c5141b3b2bc91c454cbb6dfca753f28ae03730d657874fcbd89d0494d0e3965dfdca06d9855f467c576afa9d + languageName: node + linkType: hard + "micromark-util-normalize-identifier@npm:^1.0.0": version: 1.1.0 resolution: "micromark-util-normalize-identifier@npm:1.1.0" @@ -8568,6 +9665,15 @@ __metadata: languageName: node linkType: hard +"micromark-util-normalize-identifier@npm:^2.0.0": + version: 2.0.1 + resolution: "micromark-util-normalize-identifier@npm:2.0.1" + dependencies: + micromark-util-symbol: ^2.0.0 + checksum: 1eb9a289d7da067323df9fdc78bfa90ca3207ad8fd893ca02f3133e973adcb3743b233393d23d95c84ccaf5d220ae7f5a28402a644f135dcd4b8cfa60a7b5f84 + languageName: node + linkType: hard + "micromark-util-resolve-all@npm:^1.0.0": version: 1.1.0 resolution: "micromark-util-resolve-all@npm:1.1.0" @@ -8577,6 +9683,15 @@ __metadata: languageName: node linkType: hard +"micromark-util-resolve-all@npm:^2.0.0": + version: 2.0.1 + resolution: "micromark-util-resolve-all@npm:2.0.1" + dependencies: + micromark-util-types: ^2.0.0 + checksum: 9275f3ddb6c26f254dd2158e66215d050454b279707a7d9ce5a3cd0eba23201021cedcb78ae1a746c1b23227dcc418ee40dd074ade195359506797a5493550cc + languageName: node + linkType: hard + "micromark-util-sanitize-uri@npm:^1.0.0, micromark-util-sanitize-uri@npm:^1.1.0": version: 1.2.0 resolution: "micromark-util-sanitize-uri@npm:1.2.0" @@ -8588,6 +9703,17 @@ __metadata: languageName: node linkType: hard +"micromark-util-sanitize-uri@npm:^2.0.0": + version: 2.0.1 + resolution: "micromark-util-sanitize-uri@npm:2.0.1" + dependencies: + micromark-util-character: ^2.0.0 + micromark-util-encode: ^2.0.0 + micromark-util-symbol: ^2.0.0 + checksum: d01517840c17de67aaa0b0f03bfe05fac8a41d99723cd8ce16c62f6810e99cd3695364a34c335485018e5e2c00e69031744630a1b85c6868aa2f2ca1b36daa2f + languageName: node + linkType: hard + "micromark-util-subtokenize@npm:^1.0.0": version: 1.1.0 resolution: "micromark-util-subtokenize@npm:1.1.0" @@ -8600,13 +9726,32 @@ __metadata: languageName: node linkType: hard -"micromark-util-symbol@npm:^1.0.0": +"micromark-util-subtokenize@npm:^2.0.0": + version: 2.1.0 + resolution: "micromark-util-subtokenize@npm:2.1.0" + dependencies: + devlop: ^1.0.0 + micromark-util-chunked: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + checksum: 2e194bc8a5279d256582020500e5072a95c1094571be49043704343032e1fffbe09c862ef9c131cf5c762e296ddb54ff8bc767b3786a798524a68d1db6942934 + languageName: node + linkType: hard + +"micromark-util-symbol@npm:^1.0.0, micromark-util-symbol@npm:^1.0.1": version: 1.1.0 resolution: "micromark-util-symbol@npm:1.1.0" checksum: 02414a753b79f67ff3276b517eeac87913aea6c028f3e668a19ea0fc09d98aea9f93d6222a76ca783d20299af9e4b8e7c797fe516b766185dcc6e93290f11f88 languageName: node linkType: hard +"micromark-util-symbol@npm:^2.0.0": + version: 2.0.1 + resolution: "micromark-util-symbol@npm:2.0.1" + checksum: fb7346950550bc85a55793dda94a8b3cb3abc068dbd7570d1162db7aee803411d06c0a5de4ae59cd945f46143bdeadd4bba02a02248fa0d18cc577babaa00044 + languageName: node + linkType: hard + "micromark-util-types@npm:^1.0.0, micromark-util-types@npm:^1.0.1": version: 1.1.0 resolution: "micromark-util-types@npm:1.1.0" @@ -8614,6 +9759,13 @@ __metadata: languageName: node linkType: hard +"micromark-util-types@npm:^2.0.0": + version: 2.0.2 + resolution: "micromark-util-types@npm:2.0.2" + checksum: 884f7974839e4bc6d2bd662e57c973a9164fd5c0d8fe16cddf07472b86a7e6726747c00674952c0321d17685d700cd3295e9f58a842a53acdf6c6d55ab051aab + languageName: node + linkType: hard + "micromark@npm:^3.0.0": version: 3.2.0 resolution: "micromark@npm:3.2.0" @@ -8639,7 +9791,32 @@ __metadata: languageName: node linkType: hard -"micromatch@npm:4.0.5, micromatch@npm:^4.0.2, micromatch@npm:^4.0.4, micromatch@npm:^4.0.5": +"micromark@npm:^4.0.0": + version: 4.0.2 + resolution: "micromark@npm:4.0.2" + dependencies: + "@types/debug": ^4.0.0 + debug: ^4.0.0 + decode-named-character-reference: ^1.0.0 + devlop: ^1.0.0 + micromark-core-commonmark: ^2.0.0 + micromark-factory-space: ^2.0.0 + micromark-util-character: ^2.0.0 + micromark-util-chunked: ^2.0.0 + micromark-util-combine-extensions: ^2.0.0 + micromark-util-decode-numeric-character-reference: ^2.0.0 + micromark-util-encode: ^2.0.0 + micromark-util-normalize-identifier: ^2.0.0 + micromark-util-resolve-all: ^2.0.0 + micromark-util-sanitize-uri: ^2.0.0 + micromark-util-subtokenize: ^2.0.0 + micromark-util-symbol: ^2.0.0 + micromark-util-types: ^2.0.0 + checksum: 5306c15dd12f543755bc627fc361d4255dfc430e7af6069a07ac0eacc338fbd761fe8e93f02a8bfab6097bab12ee903192fe31389222459d5029242a5aaba3b8 + languageName: node + linkType: hard + +"micromatch@npm:4.0.5": version: 4.0.5 resolution: "micromatch@npm:4.0.5" dependencies: @@ -8649,7 +9826,7 @@ __metadata: languageName: node linkType: hard -"micromatch@npm:^4.0.8": +"micromatch@npm:^4.0.2, micromatch@npm:^4.0.5, micromatch@npm:^4.0.8": version: 4.0.8 resolution: "micromatch@npm:4.0.8" dependencies: @@ -8659,13 +9836,20 @@ __metadata: languageName: node linkType: hard -"mime-db@npm:1.52.0, mime-db@npm:>= 1.43.0 < 2": +"mime-db@npm:1.52.0": version: 1.52.0 resolution: "mime-db@npm:1.52.0" checksum: 0d99a03585f8b39d68182803b12ac601d9c01abfa28ec56204fa330bc9f3d1c5e14beb049bafadb3dbdf646dfb94b87e24d4ec7b31b7279ef906a8ea9b6a513f languageName: node linkType: hard +"mime-db@npm:>= 1.43.0 < 2": + version: 1.54.0 + resolution: "mime-db@npm:1.54.0" + checksum: e99aaf2f23f5bd607deb08c83faba5dd25cf2fec90a7cc5b92d8260867ee08dab65312e1a589e60093dc7796d41e5fae013268418482f1db4c7d52d0a0960ac9 + languageName: node + linkType: hard + "mime-db@npm:~1.33.0": version: 1.33.0 resolution: "mime-db@npm:1.33.0" @@ -8714,21 +9898,29 @@ __metadata: languageName: node linkType: hard -"mimic-response@npm:^1.0.0, mimic-response@npm:^1.0.1": - version: 1.0.1 - resolution: "mimic-response@npm:1.0.1" - checksum: 034c78753b0e622bc03c983663b1cdf66d03861050e0c8606563d149bc2b02d63f62ce4d32be4ab50d0553ae0ffe647fc34d1f5281184c6e1e8cf4d85e8d9823 +"mimic-response@npm:^3.1.0": + version: 3.1.0 + resolution: "mimic-response@npm:3.1.0" + checksum: 25739fee32c17f433626bf19f016df9036b75b3d84a3046c7d156e72ec963dd29d7fc8a302f55a3d6c5a4ff24259676b15d915aad6480815a969ff2ec0836867 + languageName: node + linkType: hard + +"mimic-response@npm:^4.0.0": + version: 4.0.0 + resolution: "mimic-response@npm:4.0.0" + checksum: 33b804cc961efe206efdb1fca6a22540decdcfce6c14eb5c0c50e5ae9022267ab22ce8f5568b1f7247ba67500fe20d523d81e0e9f009b321ccd9d472e78d1850 languageName: node linkType: hard -"mini-css-extract-plugin@npm:^2.6.1": - version: 2.7.6 - resolution: "mini-css-extract-plugin@npm:2.7.6" +"mini-css-extract-plugin@npm:^2.9.2": + version: 2.9.2 + resolution: "mini-css-extract-plugin@npm:2.9.2" dependencies: schema-utils: ^4.0.0 + tapable: ^2.2.1 peerDependencies: webpack: ^5.0.0 - checksum: be6f7cefc6275168eb0a6b8fe977083a18c743c9612c9f00e6c1a62c3393ca7960e93fba1a7ebb09b75f36a0204ad087d772c1ef574bc29c90c0e8175a3c0b83 + checksum: 67a1f75359371a7776108999d472ae0942ccd904401e364e3a2c710d4b6fec61c4f53288594fcac35891f009e6df8825a00dfd3bfe4bcec0f862081d1f7cad50 languageName: node linkType: hard @@ -8739,7 +9931,7 @@ __metadata: languageName: node linkType: hard -"minimatch@npm:3.1.2, minimatch@npm:^3.0.4, minimatch@npm:^3.0.5, minimatch@npm:^3.1.1, minimatch@npm:^3.1.2": +"minimatch@npm:3.1.2, minimatch@npm:^3.0.5, minimatch@npm:^3.1.1, minimatch@npm:^3.1.2": version: 3.1.2 resolution: "minimatch@npm:3.1.2" dependencies: @@ -8748,15 +9940,6 @@ __metadata: languageName: node linkType: hard -"minimatch@npm:^9.0.1": - version: 9.0.3 - resolution: "minimatch@npm:9.0.3" - dependencies: - brace-expansion: ^2.0.1 - checksum: 253487976bf485b612f16bf57463520a14f512662e592e95c571afdab1442a6a6864b6c88f248ce6fc4ff0b6de04ac7aa6c8bb51e868e99d1d65eb0658a708b5 - languageName: node - linkType: hard - "minimatch@npm:^9.0.4": version: 9.0.5 resolution: "minimatch@npm:9.0.5" @@ -8766,34 +9949,34 @@ __metadata: languageName: node linkType: hard -"minimist@npm:^1.2.0, minimist@npm:^1.2.5": +"minimist@npm:^1.2.0": version: 1.2.8 resolution: "minimist@npm:1.2.8" checksum: 75a6d645fb122dad29c06a7597bddea977258957ed88d7a6df59b5cd3fe4a527e253e9bbf2e783e4b73657f9098b96a5fe96ab8a113655d4109108577ecf85b0 languageName: node linkType: hard -"minipass-collect@npm:^1.0.2": - version: 1.0.2 - resolution: "minipass-collect@npm:1.0.2" +"minipass-collect@npm:^2.0.1": + version: 2.0.1 + resolution: "minipass-collect@npm:2.0.1" dependencies: - minipass: ^3.0.0 - checksum: 14df761028f3e47293aee72888f2657695ec66bd7d09cae7ad558da30415fdc4752bbfee66287dcc6fd5e6a2fa3466d6c484dc1cbd986525d9393b9523d97f10 + minipass: ^7.0.3 + checksum: b251bceea62090f67a6cced7a446a36f4cd61ee2d5cea9aee7fff79ba8030e416327a1c5aa2908dc22629d06214b46d88fdab8c51ac76bacbf5703851b5ad342 languageName: node linkType: hard -"minipass-fetch@npm:^3.0.0": - version: 3.0.4 - resolution: "minipass-fetch@npm:3.0.4" +"minipass-fetch@npm:^4.0.0": + version: 4.0.1 + resolution: "minipass-fetch@npm:4.0.1" dependencies: encoding: ^0.1.13 minipass: ^7.0.3 minipass-sized: ^1.0.3 - minizlib: ^2.1.2 + minizlib: ^3.0.1 dependenciesMeta: encoding: optional: true - checksum: af7aad15d5c128ab1ebe52e043bdf7d62c3c6f0cecb9285b40d7b395e1375b45dcdfd40e63e93d26a0e8249c9efd5c325c65575aceee192883970ff8cb11364a + checksum: 3dfca705ce887ca9ff14d73e8d8593996dea1a1ecd8101fdbb9c10549d1f9670bc8fb66ad0192769ead4c2dc01b4f9ca1cf567ded365adff17827a303b948140 languageName: node linkType: hard @@ -8833,43 +10016,28 @@ __metadata: languageName: node linkType: hard -"minipass@npm:^5.0.0": - version: 5.0.0 - resolution: "minipass@npm:5.0.0" - checksum: 425dab288738853fded43da3314a0b5c035844d6f3097a8e3b5b29b328da8f3c1af6fc70618b32c29ff906284cf6406b6841376f21caaadd0793c1d5a6a620ea - languageName: node - linkType: hard - -"minipass@npm:^5.0.0 || ^6.0.2 || ^7.0.0, minipass@npm:^7.0.3": - version: 7.0.4 - resolution: "minipass@npm:7.0.4" - checksum: 87585e258b9488caf2e7acea242fd7856bbe9a2c84a7807643513a338d66f368c7d518200ad7b70a508664d408aa000517647b2930c259a8b1f9f0984f344a21 - languageName: node - linkType: hard - -"minipass@npm:^7.1.2": +"minipass@npm:^5.0.0 || ^6.0.2 || ^7.0.0, minipass@npm:^7.0.2, minipass@npm:^7.0.3, minipass@npm:^7.0.4, minipass@npm:^7.1.2": version: 7.1.2 resolution: "minipass@npm:7.1.2" checksum: 2bfd325b95c555f2b4d2814d49325691c7bee937d753814861b0b49d5edcda55cbbf22b6b6a60bb91eddac8668771f03c5ff647dcd9d0f798e9548b9cdc46ee3 languageName: node linkType: hard -"minizlib@npm:^2.1.1, minizlib@npm:^2.1.2": - version: 2.1.2 - resolution: "minizlib@npm:2.1.2" +"minizlib@npm:^3.0.1": + version: 3.0.2 + resolution: "minizlib@npm:3.0.2" dependencies: - minipass: ^3.0.0 - yallist: ^4.0.0 - checksum: f1fdeac0b07cf8f30fcf12f4b586795b97be856edea22b5e9072707be51fc95d41487faec3f265b42973a304fe3a64acd91a44a3826a963e37b37bafde0212c3 + minipass: ^7.1.2 + checksum: 493bed14dcb6118da7f8af356a8947cf1473289c09658e5aabd69a737800a8c3b1736fb7d7931b722268a9c9bc038a6d53c049b6a6af24b34a121823bb709996 languageName: node linkType: hard -"mkdirp@npm:^1.0.3": - version: 1.0.4 - resolution: "mkdirp@npm:1.0.4" +"mkdirp@npm:^3.0.1": + version: 3.0.1 + resolution: "mkdirp@npm:3.0.1" bin: - mkdirp: bin/cmd.js - checksum: a96865108c6c3b1b8e1d5e9f11843de1e077e57737602de1b82030815f311be11f96f09cce59bd5b903d0b29834733e5313f9301e3ed6d6f6fba2eae0df4298f + mkdirp: dist/cjs/src/bin.js + checksum: 972deb188e8fb55547f1e58d66bd6b4a3623bf0c7137802582602d73e6480c1c2268dcbafbfb1be466e00cc7e56ac514d7fd9334b7cf33e3e2ab547c16f83a8d languageName: node linkType: hard @@ -8880,10 +10048,10 @@ __metadata: languageName: node linkType: hard -"mrmime@npm:^1.0.0": - version: 1.0.1 - resolution: "mrmime@npm:1.0.1" - checksum: cc979da44bbbffebaa8eaf7a45117e851f2d4cb46a3ada6ceb78130466a04c15a0de9a9ce1c8b8ba6f6e1b8618866b1352992bf1757d241c0ddca558b9f28a77 +"mrmime@npm:^2.0.0": + version: 2.0.1 + resolution: "mrmime@npm:2.0.1" + checksum: 455a555009edb2ed6e587e0fcb5e41fcbf8f1dcca28242a57d054f02204ab198bed93ba9de75db06bd3447e8603bc74e10a22440ba99431fc4a751435fba35bf languageName: node linkType: hard @@ -8901,7 +10069,7 @@ __metadata: languageName: node linkType: hard -"ms@npm:2.1.3, ms@npm:^2.0.0": +"ms@npm:2.1.3, ms@npm:^2.1.3": version: 2.1.3 resolution: "ms@npm:2.1.3" checksum: aa92de608021b242401676e35cfa5aa42dd70cbdc082b916da7fb925c542173e36bce97ea3e804923fe92c0ad991434e4a38327e15a1b5b5f945d66df615ae6d @@ -8954,13 +10122,27 @@ __metadata: languageName: node linkType: hard -"negotiator@npm:0.6.3, negotiator@npm:^0.6.3": +"negotiator@npm:0.6.3": version: 0.6.3 resolution: "negotiator@npm:0.6.3" checksum: b8ffeb1e262eff7968fc90a2b6767b04cfd9842582a9d0ece0af7049537266e7b2506dfb1d107a32f06dd849ab2aea834d5830f7f4d0e5cb7d36e1ae55d021d9 languageName: node linkType: hard +"negotiator@npm:^1.0.0": + version: 1.0.0 + resolution: "negotiator@npm:1.0.0" + checksum: 20ebfe79b2d2e7cf9cbc8239a72662b584f71164096e6e8896c8325055497c96f6b80cd22c258e8a2f2aa382a787795ec3ee8b37b422a302c7d4381b0d5ecfbb + languageName: node + linkType: hard + +"negotiator@npm:~0.6.4": + version: 0.6.4 + resolution: "negotiator@npm:0.6.4" + checksum: 7ded10aa02a0707d1d12a9973fdb5954f98547ca7beb60e31cb3a403cc6e8f11138db7a3b0128425cf836fc85d145ec4ce983b2bdf83dca436af879c2d683510 + languageName: node + linkType: hard + "neo-async@npm:^2.6.2": version: 2.6.2 resolution: "neo-async@npm:2.6.2" @@ -8978,26 +10160,15 @@ __metadata: languageName: node linkType: hard -"node-emoji@npm:^1.10.0": - version: 1.11.0 - resolution: "node-emoji@npm:1.11.0" - dependencies: - lodash: ^4.17.21 - checksum: e8c856c04a1645062112a72e59a98b203505ed5111ff84a3a5f40611afa229b578c7d50f1e6a7f17aa62baeea4a640d2e2f61f63afc05423aa267af10977fb2b - languageName: node - linkType: hard - -"node-fetch@npm:^2.6.12": - version: 2.7.0 - resolution: "node-fetch@npm:2.7.0" +"node-emoji@npm:^2.1.0": + version: 2.2.0 + resolution: "node-emoji@npm:2.2.0" dependencies: - whatwg-url: ^5.0.0 - peerDependencies: - encoding: ^0.1.0 - peerDependenciesMeta: - encoding: - optional: true - checksum: d76d2f5edb451a3f05b15115ec89fc6be39de37c6089f1b6368df03b91e1633fd379a7e01b7ab05089a25034b2023d959b47e59759cb38d88341b2459e89d6e5 + "@sindresorhus/is": ^4.6.0 + char-regex: ^1.0.2 + emojilib: ^2.4.0 + skin-tone: ^2.0.0 + checksum: 9642bee0b8c5f2124580e6a2d4c5ec868987bc77b6ce3a335bbec8db677082cbe1a9b72c11aac60043396a8d36e0afad4bcc33d92105d103d2d1b6a59106219a languageName: node linkType: hard @@ -9009,30 +10180,22 @@ __metadata: linkType: hard "node-gyp@npm:latest": - version: 9.4.0 - resolution: "node-gyp@npm:9.4.0" + version: 11.2.0 + resolution: "node-gyp@npm:11.2.0" dependencies: env-paths: ^2.2.0 exponential-backoff: ^3.1.1 - glob: ^7.1.4 graceful-fs: ^4.2.6 - make-fetch-happen: ^11.0.3 - nopt: ^6.0.0 - npmlog: ^6.0.0 - rimraf: ^3.0.2 + make-fetch-happen: ^14.0.3 + nopt: ^8.0.0 + proc-log: ^5.0.0 semver: ^7.3.5 - tar: ^6.1.2 - which: ^2.0.2 + tar: ^7.4.3 + tinyglobby: ^0.2.12 + which: ^5.0.0 bin: node-gyp: bin/node-gyp.js - checksum: 78b404e2e0639d64e145845f7f5a3cb20c0520cdaf6dda2f6e025e9b644077202ea7de1232396ba5bde3fee84cdc79604feebe6ba3ec84d464c85d407bb5da99 - languageName: node - linkType: hard - -"node-releases@npm:^2.0.13": - version: 2.0.13 - resolution: "node-releases@npm:2.0.13" - checksum: 17ec8f315dba62710cae71a8dad3cd0288ba943d2ece43504b3b1aa8625bf138637798ab470b1d9035b0545996f63000a8a926e0f6d35d0996424f8b6d36dda3 + checksum: 2536282ba81f8a94b29482d3622b6ab298611440619e46de4512a6f32396a68b5530357c474b859787069d84a4c537d99e0c71078cce5b9f808bf84eeb78e8fb languageName: node linkType: hard @@ -9043,14 +10206,14 @@ __metadata: languageName: node linkType: hard -"nopt@npm:^6.0.0": - version: 6.0.0 - resolution: "nopt@npm:6.0.0" +"nopt@npm:^8.0.0": + version: 8.1.0 + resolution: "nopt@npm:8.1.0" dependencies: - abbrev: ^1.0.0 + abbrev: ^3.0.0 bin: nopt: bin/nopt.js - checksum: 82149371f8be0c4b9ec2f863cc6509a7fd0fa729929c009f3a58e4eb0c9e4cae9920e8f1f8eb46e7d032fec8fb01bede7f0f41a67eb3553b7b8e14fa53de1dac + checksum: 49cfd3eb6f565e292bf61f2ff1373a457238804d5a5a63a8d786c923007498cba89f3648e3b952bc10203e3e7285752abf5b14eaf012edb821e84f24e881a92a languageName: node linkType: hard @@ -9068,17 +10231,10 @@ __metadata: languageName: node linkType: hard -"normalize-url@npm:^4.1.0": - version: 4.5.1 - resolution: "normalize-url@npm:4.5.1" - checksum: 9a9dee01df02ad23e171171893e56e22d752f7cff86fb96aafeae074819b572ea655b60f8302e2d85dbb834dc885c972cc1c573892fea24df46b2765065dd05a - languageName: node - linkType: hard - -"normalize-url@npm:^6.0.1": - version: 6.1.0 - resolution: "normalize-url@npm:6.1.0" - checksum: 4a4944631173e7d521d6b80e4c85ccaeceb2870f315584fa30121f505a6dfd86439c5e3fdd8cd9e0e291290c41d0c3599f0cb12ab356722ed242584c30348e50 +"normalize-url@npm:^8.0.0": + version: 8.0.2 + resolution: "normalize-url@npm:8.0.2" + checksum: 66a0d42ae9e360654d8547a73f8c94fc8a39a975c7d3ae0b95e5927bd3bffc6dc4e20282afd6797c4a7ce6cf3847c37ce47125fde7b1a9e83d802c0e74830dee languageName: node linkType: hard @@ -9092,23 +10248,11 @@ __metadata: linkType: hard "npm-run-path@npm:^5.1.0": - version: 5.1.0 - resolution: "npm-run-path@npm:5.1.0" + version: 5.3.0 + resolution: "npm-run-path@npm:5.3.0" dependencies: path-key: ^4.0.0 - checksum: dc184eb5ec239d6a2b990b43236845332ef12f4e0beaa9701de724aa797fe40b6bbd0157fb7639d24d3ab13f5d5cf22d223a19c6300846b8126f335f788bee66 - languageName: node - linkType: hard - -"npmlog@npm:^6.0.0": - version: 6.0.2 - resolution: "npmlog@npm:6.0.2" - dependencies: - are-we-there-yet: ^3.0.0 - console-control-strings: ^1.1.0 - gauge: ^4.0.3 - set-blocking: ^2.0.0 - checksum: ae238cd264a1c3f22091cdd9e2b106f684297d3c184f1146984ecbe18aaa86343953f26b9520dedd1b1372bc0316905b736c1932d778dbeb1fcf5a1001390e2a + checksum: ae8e7a89da9594fb9c308f6555c73f618152340dcaae423e5fb3620026fefbec463618a8b761920382d666fa7a2d8d240b6fe320e8a6cdd54dc3687e2b659d25 languageName: node linkType: hard @@ -9128,7 +10272,19 @@ __metadata: languageName: node linkType: hard -"object-assign@npm:^4.0.1, object-assign@npm:^4.1.0, object-assign@npm:^4.1.1": +"null-loader@npm:^4.0.1": + version: 4.0.1 + resolution: "null-loader@npm:4.0.1" + dependencies: + loader-utils: ^2.0.0 + schema-utils: ^3.0.0 + peerDependencies: + webpack: ^4.0.0 || ^5.0.0 + checksum: eeb4c4dd2f8f41e46f5665e4500359109e95ec1028a178a60e0161984906572da7dd87644bcc3cb29f0125d77e2b2508fb4f3813cfb1c6604a15865beb4b987b + languageName: node + linkType: hard + +"object-assign@npm:^4.0.1, object-assign@npm:^4.1.1": version: 4.1.1 resolution: "object-assign@npm:4.1.1" checksum: fcc6e4ea8c7fe48abfbb552578b1c53e0d194086e2e6bbbf59e0a536381a292f39943c6e9628af05b5528aa5e3318bb30d6b2e53cadaf5b8fe9e12c4b69af23f @@ -9142,10 +10298,10 @@ __metadata: languageName: node linkType: hard -"object-inspect@npm:^1.9.0": - version: 1.12.3 - resolution: "object-inspect@npm:1.12.3" - checksum: dabfd824d97a5f407e6d5d24810d888859f6be394d8b733a77442b277e0808860555176719c5905e765e3743a7cada6b8b0a3b85e5331c530fd418cc8ae991db +"object-inspect@npm:^1.13.3": + version: 1.13.4 + resolution: "object-inspect@npm:1.13.4" + checksum: 582810c6a8d2ef988ea0a39e69e115a138dad8f42dd445383b394877e5816eb4268489f316a6f74ee9c4e0a984b3eab1028e3e79d62b1ed67c726661d55c7a8b languageName: node linkType: hard @@ -9157,14 +10313,16 @@ __metadata: linkType: hard "object.assign@npm:^4.1.0": - version: 4.1.4 - resolution: "object.assign@npm:4.1.4" - dependencies: - call-bind: ^1.0.2 - define-properties: ^1.1.4 - has-symbols: ^1.0.3 + version: 4.1.7 + resolution: "object.assign@npm:4.1.7" + dependencies: + call-bind: ^1.0.8 + call-bound: ^1.0.3 + define-properties: ^1.2.1 + es-object-atoms: ^1.0.0 + has-symbols: ^1.1.0 object-keys: ^1.1.1 - checksum: 76cab513a5999acbfe0ff355f15a6a125e71805fcf53de4e9d4e082e1989bdb81d1e329291e1e4e0ae7719f0e4ef80e88fb2d367ae60500d79d25a6224ac8864 + checksum: 60e07d2651cf4f5528c485f1aa4dbded9b384c47d80e8187cefd11320abb1aebebf78df5483451dfa549059f8281c21f7b4bf7d19e9e5e97d8d617df0df298de languageName: node linkType: hard @@ -9184,14 +10342,14 @@ __metadata: languageName: node linkType: hard -"on-headers@npm:~1.0.2": - version: 1.0.2 - resolution: "on-headers@npm:1.0.2" - checksum: 2bf13467215d1e540a62a75021e8b318a6cfc5d4fc53af8e8f84ad98dbcea02d506c6d24180cd62e1d769c44721ba542f3154effc1f7579a8288c9f7873ed8e5 +"on-headers@npm:~1.1.0": + version: 1.1.0 + resolution: "on-headers@npm:1.1.0" + checksum: 98aa64629f986fb8cc4517dd8bede73c980e31208cba97f4442c330959f60ced3dc6214b83420491f5111fc7c4f4343abe2ea62c85f505cf041d67850f238776 languageName: node linkType: hard -"once@npm:^1.3.0, once@npm:^1.3.1, once@npm:^1.4.0": +"once@npm:^1.3.0": version: 1.4.0 resolution: "once@npm:1.4.0" dependencies: @@ -9239,16 +10397,16 @@ __metadata: linkType: hard "optionator@npm:^0.9.3": - version: 0.9.3 - resolution: "optionator@npm:0.9.3" + version: 0.9.4 + resolution: "optionator@npm:0.9.4" dependencies: - "@aashutoshrathi/word-wrap": ^1.2.3 deep-is: ^0.1.3 fast-levenshtein: ^2.0.6 levn: ^0.4.1 prelude-ls: ^1.2.1 type-check: ^0.4.0 - checksum: 09281999441f2fe9c33a5eeab76700795365a061563d66b098923eb719251a42bdbe432790d35064d0816ead9296dbeb1ad51a733edf4167c96bd5d0882e428a + word-wrap: ^1.2.5 + checksum: ecbd010e3dc73e05d239976422d9ef54a82a13f37c11ca5911dff41c98a6c7f0f163b27f922c37e7f8340af9d36febd3b6e9cef508f3339d4c393d7276d716bb languageName: node linkType: hard @@ -9259,19 +10417,17 @@ __metadata: languageName: node linkType: hard -"p-cancelable@npm:^1.0.0": - version: 1.1.0 - resolution: "p-cancelable@npm:1.1.0" - checksum: 2db3814fef6d9025787f30afaee4496a8857a28be3c5706432cbad76c688a6db1874308f48e364a42f5317f5e41e8e7b4f2ff5c8ff2256dbb6264bc361704ece +"p-cancelable@npm:^3.0.0": + version: 3.0.0 + resolution: "p-cancelable@npm:3.0.0" + checksum: 2b5ae34218f9c2cf7a7c18e5d9a726ef9b165ef07e6c959f6738371509e747334b5f78f3bcdeb03d8a12dcb978faf641fd87eb21486ed7d36fb823b8ddef3219 languageName: node linkType: hard -"p-limit@npm:^2.0.0, p-limit@npm:^2.2.0": - version: 2.3.0 - resolution: "p-limit@npm:2.3.0" - dependencies: - p-try: ^2.0.0 - checksum: 84ff17f1a38126c3314e91ecfe56aecbf36430940e2873dadaa773ffe072dc23b7af8e46d4b6485d302a11673fe94c6b67ca2cfbb60c989848b02100d0594ac1 +"p-finally@npm:^1.0.0": + version: 1.0.0 + resolution: "p-finally@npm:1.0.0" + checksum: 93a654c53dc805dd5b5891bab16eb0ea46db8f66c4bfd99336ae929323b1af2b70a8b0654f8f1eae924b2b73d037031366d645f1fd18b3d30cbd15950cc4b1d4 languageName: node linkType: hard @@ -9284,21 +10440,12 @@ __metadata: languageName: node linkType: hard -"p-locate@npm:^3.0.0": - version: 3.0.0 - resolution: "p-locate@npm:3.0.0" - dependencies: - p-limit: ^2.0.0 - checksum: 83991734a9854a05fe9dbb29f707ea8a0599391f52daac32b86f08e21415e857ffa60f0e120bfe7ce0cc4faf9274a50239c7895fc0d0579d08411e513b83a4ae - languageName: node - linkType: hard - -"p-locate@npm:^4.1.0": - version: 4.1.0 - resolution: "p-locate@npm:4.1.0" +"p-limit@npm:^4.0.0": + version: 4.0.0 + resolution: "p-limit@npm:4.0.0" dependencies: - p-limit: ^2.2.0 - checksum: 513bd14a455f5da4ebfcb819ef706c54adb09097703de6aeaa5d26fe5ea16df92b48d1ac45e01e3944ce1e6aa2a66f7f8894742b8c9d6e276e16cd2049a2b870 + yocto-queue: ^1.0.0 + checksum: 01d9d70695187788f984226e16c903475ec6a947ee7b21948d6f597bed788e3112cc7ec2e171c1d37125057a5f45f3da21d8653e04a3a793589e12e9e80e756b languageName: node linkType: hard @@ -9311,6 +10458,15 @@ __metadata: languageName: node linkType: hard +"p-locate@npm:^6.0.0": + version: 6.0.0 + resolution: "p-locate@npm:6.0.0" + dependencies: + p-limit: ^4.0.0 + checksum: 2bfe5234efa5e7a4e74b30a5479a193fdd9236f8f6b4d2f3f69e3d286d9a7d7ab0c118a2a50142efcf4e41625def635bd9332d6cbf9cc65d85eb0718c579ab38 + languageName: node + linkType: hard + "p-map@npm:^4.0.0": version: 4.0.0 resolution: "p-map@npm:4.0.0" @@ -9320,6 +10476,23 @@ __metadata: languageName: node linkType: hard +"p-map@npm:^7.0.2": + version: 7.0.3 + resolution: "p-map@npm:7.0.3" + checksum: 8c92d533acf82f0d12f7e196edccff773f384098bbb048acdd55a08778ce4fc8889d8f1bde72969487bd96f9c63212698d79744c20bedfce36c5b00b46d369f8 + languageName: node + linkType: hard + +"p-queue@npm:^6.6.2": + version: 6.6.2 + resolution: "p-queue@npm:6.6.2" + dependencies: + eventemitter3: ^4.0.4 + p-timeout: ^3.2.0 + checksum: 832642fcc4ab6477b43e6d7c30209ab10952969ed211c6d6f2931be8a4f9935e3578c72e8cce053dc34f2eb6941a408a2c516a54904e989851a1a209cf19761c + languageName: node + linkType: hard + "p-retry@npm:^4.5.0": version: 4.6.2 resolution: "p-retry@npm:4.6.2" @@ -9330,10 +10503,12 @@ __metadata: languageName: node linkType: hard -"p-try@npm:^2.0.0": - version: 2.2.0 - resolution: "p-try@npm:2.2.0" - checksum: f8a8e9a7693659383f06aec604ad5ead237c7a261c18048a6e1b5b85a5f8a067e469aa24f5bc009b991ea3b058a87f5065ef4176793a200d4917349881216cae +"p-timeout@npm:^3.2.0": + version: 3.2.0 + resolution: "p-timeout@npm:3.2.0" + dependencies: + p-finally: ^1.0.0 + checksum: 3dd0eaa048780a6f23e5855df3dd45c7beacff1f820476c1d0d1bcd6648e3298752ba2c877aa1c92f6453c7dd23faaf13d9f5149fc14c0598a142e2c5e8d649c languageName: node linkType: hard @@ -9344,15 +10519,15 @@ __metadata: languageName: node linkType: hard -"package-json@npm:^6.3.0": - version: 6.5.0 - resolution: "package-json@npm:6.5.0" +"package-json@npm:^8.1.0": + version: 8.1.1 + resolution: "package-json@npm:8.1.1" dependencies: - got: ^9.6.0 - registry-auth-token: ^4.0.0 - registry-url: ^5.0.0 - semver: ^6.2.0 - checksum: cc9f890d3667d7610e6184decf543278b87f657d1ace0deb4a9c9155feca738ef88f660c82200763d3348010f4e42e9c7adc91e96ab0f86a770955995b5351e2 + got: ^12.1.0 + registry-auth-token: ^5.0.1 + registry-url: ^6.0.0 + semver: ^7.3.7 + checksum: 28bec6f42bf9fba66b7c8fea07576fc23d08ec7923433f7835d6cd8654e72169d74f9738b3785107d18a476ae76712e0daeb1dddcd6930e69f9e4b47eba7c0ca languageName: node linkType: hard @@ -9382,21 +10557,22 @@ __metadata: languageName: node linkType: hard -"parse-entities@npm:^2.0.0": - version: 2.0.0 - resolution: "parse-entities@npm:2.0.0" +"parse-entities@npm:^4.0.0": + version: 4.0.2 + resolution: "parse-entities@npm:4.0.2" dependencies: - character-entities: ^1.0.0 - character-entities-legacy: ^1.0.0 - character-reference-invalid: ^1.0.0 - is-alphanumerical: ^1.0.0 - is-decimal: ^1.0.0 - is-hexadecimal: ^1.0.0 - checksum: 7addfd3e7d747521afac33c8121a5f23043c6973809756920d37e806639b4898385d386fcf4b3c8e2ecf1bc28aac5ae97df0b112d5042034efbe80f44081ebce + "@types/unist": ^2.0.0 + character-entities-legacy: ^3.0.0 + character-reference-invalid: ^2.0.0 + decode-named-character-reference: ^1.0.0 + is-alphanumerical: ^2.0.0 + is-decimal: ^2.0.0 + is-hexadecimal: ^2.0.0 + checksum: db22b46da1a62af00409c929ac49fbd306b5ebf0dbacf4646d2ae2b58616ef90a40eedc282568a3cf740fac2a7928bc97146973a628f6977ca274dedc2ad6edc languageName: node linkType: hard -"parse-json@npm:^5.0.0, parse-json@npm:^5.2.0": +"parse-json@npm:^5.2.0": version: 5.2.0 resolution: "parse-json@npm:5.2.0" dependencies: @@ -9415,29 +10591,31 @@ __metadata: languageName: node linkType: hard -"parse5-htmlparser2-tree-adapter@npm:^7.0.0": - version: 7.0.0 - resolution: "parse5-htmlparser2-tree-adapter@npm:7.0.0" +"parse5-htmlparser2-tree-adapter@npm:^7.0.0, parse5-htmlparser2-tree-adapter@npm:^7.1.0": + version: 7.1.0 + resolution: "parse5-htmlparser2-tree-adapter@npm:7.1.0" dependencies: - domhandler: ^5.0.2 + domhandler: ^5.0.3 parse5: ^7.0.0 - checksum: fc5d01e07733142a1baf81de5c2a9c41426c04b7ab29dd218acb80cd34a63177c90aff4a4aee66cf9f1d0aeecff1389adb7452ad6f8af0a5888e3e9ad6ef733d + checksum: 98326fc5443e2149e10695adbfd0b0b3383c54398799f858b4ac2914adb199af8fcc90c2143aa5f7fd5f9482338f26ef253b468722f34d50bb215ec075d89fe9 languageName: node linkType: hard -"parse5@npm:^6.0.0": - version: 6.0.1 - resolution: "parse5@npm:6.0.1" - checksum: 7d569a176c5460897f7c8f3377eff640d54132b9be51ae8a8fa4979af940830b2b0c296ce75e5bd8f4041520aadde13170dbdec44889975f906098ea0002f4bd +"parse5-parser-stream@npm:^7.1.2": + version: 7.1.2 + resolution: "parse5-parser-stream@npm:7.1.2" + dependencies: + parse5: ^7.0.0 + checksum: 75b232d460bce6bd0e35012750a78ef034f40ccf550b7c6cec3122395af6b4553202ad3663ad468cf537ead5a2e13b6727670395fd0ff548faccad1dc2dc93cf languageName: node linkType: hard -"parse5@npm:^7.0.0": - version: 7.1.2 - resolution: "parse5@npm:7.1.2" +"parse5@npm:^7.0.0, parse5@npm:^7.3.0": + version: 7.3.0 + resolution: "parse5@npm:7.3.0" dependencies: - entities: ^4.4.0 - checksum: 59465dd05eb4c5ec87b76173d1c596e152a10e290b7abcda1aecf0f33be49646ea74840c69af975d7887543ea45564801736356c568d6b5e71792fd0f4055713 + entities: ^6.0.0 + checksum: ffd040c4695d93f0bc370e3d6d75c1b352178514af41be7afa212475ea5cead1d6e377cd9d4cec6a5e2bcf497ca50daf9e0088eadaa37dbc271f60def08fdfcd languageName: node linkType: hard @@ -9458,13 +10636,6 @@ __metadata: languageName: node linkType: hard -"path-exists@npm:^3.0.0": - version: 3.0.0 - resolution: "path-exists@npm:3.0.0" - checksum: 96e92643aa34b4b28d0de1cd2eba52a1c5313a90c6542d03f62750d82480e20bfa62bc865d5cfc6165f5fcd5aeb0851043c40a39be5989646f223300021bae0a - languageName: node - linkType: hard - "path-exists@npm:^4.0.0": version: 4.0.0 resolution: "path-exists@npm:4.0.0" @@ -9472,6 +10643,13 @@ __metadata: languageName: node linkType: hard +"path-exists@npm:^5.0.0": + version: 5.0.0 + resolution: "path-exists@npm:5.0.0" + checksum: 8ca842868cab09423994596eb2c5ec2a971c17d1a3cb36dbf060592c730c725cd524b9067d7d2a1e031fef9ba7bd2ac6dc5ec9fb92aa693265f7be3987045254 + languageName: node + linkType: hard + "path-is-absolute@npm:^1.0.0": version: 1.0.1 resolution: "path-is-absolute@npm:1.0.1" @@ -9507,16 +10685,6 @@ __metadata: languageName: node linkType: hard -"path-scurry@npm:^1.10.1": - version: 1.10.1 - resolution: "path-scurry@npm:1.10.1" - dependencies: - lru-cache: ^9.1.1 || ^10.0.0 - minipass: ^5.0.0 || ^6.0.2 || ^7.0.0 - checksum: e2557cff3a8fb8bc07afdd6ab163a92587884f9969b05bbbaf6fe7379348bfb09af9ed292af12ed32398b15fb443e81692047b786d1eeb6d898a51eb17ed7d90 - languageName: node - linkType: hard - "path-scurry@npm:^1.11.1": version: 1.11.1 resolution: "path-scurry@npm:1.11.1" @@ -9527,26 +10695,26 @@ __metadata: languageName: node linkType: hard -"path-to-regexp@npm:0.1.7": - version: 0.1.7 - resolution: "path-to-regexp@npm:0.1.7" - checksum: 69a14ea24db543e8b0f4353305c5eac6907917031340e5a8b37df688e52accd09e3cebfe1660b70d76b6bd89152f52183f28c74813dbf454ba1a01c82a38abce +"path-to-regexp@npm:0.1.12": + version: 0.1.12 + resolution: "path-to-regexp@npm:0.1.12" + checksum: ab237858bee7b25ecd885189f175ab5b5161e7b712b360d44f5c4516b8d271da3e4bf7bf0a7b9153ecb04c7d90ce8ff5158614e1208819cf62bac2b08452722e languageName: node linkType: hard -"path-to-regexp@npm:2.2.1": - version: 2.2.1 - resolution: "path-to-regexp@npm:2.2.1" - checksum: b921a74e7576e25b06ad1635abf7e8125a29220d2efc2b71d74b9591f24a27e6f09078fa9a1b27516a097ea0637b7cab79d19b83d7f36a8ef3ef5422770e89d9 +"path-to-regexp@npm:3.3.0": + version: 3.3.0 + resolution: "path-to-regexp@npm:3.3.0" + checksum: bb249d08804f7961dd44fb175466c900b893c56e909db8e2a66ec12b9d9a964af269eb7a50892c933f52b47315953dfdb4279639fbce20977c3625a9ef3055fe languageName: node linkType: hard "path-to-regexp@npm:^1.7.0": - version: 1.8.0 - resolution: "path-to-regexp@npm:1.8.0" + version: 1.9.0 + resolution: "path-to-regexp@npm:1.9.0" dependencies: isarray: 0.0.1 - checksum: 709f6f083c0552514ef4780cb2e7e4cf49b0cc89a97439f2b7cc69a608982b7690fb5d1720a7473a59806508fc2dae0be751ba49f495ecf89fd8fbc62abccbcd + checksum: 5b2ac9cab2a9f82effd30a35164b20998b18d99d96608281dd2cab6e66c0e4536187970369b185ab21d3815da1ecb7dcb2d5f97a4bf0ee6e31a9612299fca147 languageName: node linkType: hard @@ -9557,14 +10725,7 @@ __metadata: languageName: node linkType: hard -"picocolors@npm:^1.0.0": - version: 1.0.0 - resolution: "picocolors@npm:1.0.0" - checksum: a2e8092dd86c8396bdba9f2b5481032848525b3dc295ce9b57896f931e63fc16f79805144321f72976383fc249584672a75cc18d6777c6b757603f372f745981 - languageName: node - linkType: hard - -"picocolors@npm:^1.1.1": +"picocolors@npm:^1.0.0, picocolors@npm:^1.1.1": version: 1.1.1 resolution: "picocolors@npm:1.1.1" checksum: e1cf46bf84886c79055fdfa9dcb3e4711ad259949e3565154b004b260cd356c5d54b31a1437ce9782624bf766272fe6b0154f5f0c744fb7af5d454d2b60db045 @@ -9578,6 +10739,13 @@ __metadata: languageName: node linkType: hard +"picomatch@npm:^4.0.2": + version: 4.0.3 + resolution: "picomatch@npm:4.0.3" + checksum: 6817fb74eb745a71445debe1029768de55fd59a42b75606f478ee1d0dc1aa6e78b711d041a7c9d5550e042642029b7f373dc1a43b224c4b7f12d23436735dba0 + languageName: node + linkType: hard + "pidtree@npm:0.6.0": version: 0.6.0 resolution: "pidtree@npm:0.6.0" @@ -9587,156 +10755,327 @@ __metadata: languageName: node linkType: hard -"pify@npm:^2.3.0": - version: 2.3.0 - resolution: "pify@npm:2.3.0" - checksum: 9503aaeaf4577acc58642ad1d25c45c6d90288596238fb68f82811c08104c800e5a7870398e9f015d82b44ecbcbef3dc3d4251a1cbb582f6e5959fe09884b2ba +"pify@npm:^2.3.0": + version: 2.3.0 + resolution: "pify@npm:2.3.0" + checksum: 9503aaeaf4577acc58642ad1d25c45c6d90288596238fb68f82811c08104c800e5a7870398e9f015d82b44ecbcbef3dc3d4251a1cbb582f6e5959fe09884b2ba + languageName: node + linkType: hard + +"pirates@npm:^4.0.1": + version: 4.0.7 + resolution: "pirates@npm:4.0.7" + checksum: 3dcbaff13c8b5bc158416feb6dc9e49e3c6be5fddc1ea078a05a73ef6b85d79324bbb1ef59b954cdeff000dbf000c1d39f32dc69310c7b78fbada5171b583e40 + languageName: node + linkType: hard + +"pkg-dir@npm:^7.0.0": + version: 7.0.0 + resolution: "pkg-dir@npm:7.0.0" + dependencies: + find-up: ^6.3.0 + checksum: 94298b20a446bfbbd66604474de8a0cdd3b8d251225170970f15d9646f633e056c80520dd5b4c1d1050c9fed8f6a9e5054b141c93806439452efe72e57562c03 + languageName: node + linkType: hard + +"podman@workspace:.": + version: 0.0.0-use.local + resolution: "podman@workspace:." + dependencies: + "@docusaurus/core": latest + "@docusaurus/eslint-plugin": latest + "@docusaurus/module-type-aliases": latest + "@docusaurus/plugin-content-blog": latest + "@docusaurus/preset-classic": latest + "@docusaurus/theme-live-codeblock": latest + "@easyops-cn/docusaurus-search-local": ^0.52.0 + "@iconify/react": ^4.0.1 + "@tsconfig/docusaurus": ^1.0.5 + "@typescript-eslint/eslint-plugin": ^5.48.2 + "@typescript-eslint/parser": ^5.48.2 + autoprefixer: ^10.4.13 + clsx: ^1.2.1 + eslint: ^8.32.0 + eslint-config-prettier: ^8.6.0 + html-react-parser: ^3.0.16 + husky: ^8.0.3 + lint-staged: ^13.1.0 + papaparse: ^5.4.1 + postcss: ^8.4.21 + prettier: 2.8.8 + prettier-plugin-tailwindcss: ^0.6.0 + prism-react-renderer: ^1.3.5 + react: ^18.0.0 + react-dom: ^18.0.0 + react-markdown: ^8.0.5 + tailwind-scrollbar: ^3.0.0 + tailwindcss: ^3.2.4 + typescript: ^4.9.4 + languageName: unknown + linkType: soft + +"postcss-attribute-case-insensitive@npm:^7.0.1": + version: 7.0.1 + resolution: "postcss-attribute-case-insensitive@npm:7.0.1" + dependencies: + postcss-selector-parser: ^7.0.0 + peerDependencies: + postcss: ^8.4 + checksum: 18829dfc6dd2f6b1ca82afa8555f07ec8ac5687fe95612e353aa601b842bdec05ca78fc96016dba2b7d32607b31e085e5087fda00e1e0dfdc6c2a1b07b1b15c2 + languageName: node + linkType: hard + +"postcss-calc@npm:^9.0.1": + version: 9.0.1 + resolution: "postcss-calc@npm:9.0.1" + dependencies: + postcss-selector-parser: ^6.0.11 + postcss-value-parser: ^4.2.0 + peerDependencies: + postcss: ^8.2.2 + checksum: 7327ed83bfec544ab8b3e38353baa72ff6d04378b856db4ad82dbd68ce0b73668867ef182b5d4025f9dd9aa9c64aacc50cd1bd9db8d8b51ccc4cb97866b9d72b + languageName: node + linkType: hard + +"postcss-clamp@npm:^4.1.0": + version: 4.1.0 + resolution: "postcss-clamp@npm:4.1.0" + dependencies: + postcss-value-parser: ^4.2.0 + peerDependencies: + postcss: ^8.4.6 + checksum: 118eec936b3b035dc8d75c89973408f15c5a3de3d1ee210a2b3511e3e431d9c56e6f354b509a90540241e2225ffe3caaa2fdf25919c63348ce4583a28ada642c + languageName: node + linkType: hard + +"postcss-color-functional-notation@npm:^7.0.10": + version: 7.0.10 + resolution: "postcss-color-functional-notation@npm:7.0.10" + dependencies: + "@csstools/css-color-parser": ^3.0.10 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + "@csstools/postcss-progressive-custom-properties": ^4.1.0 + "@csstools/utilities": ^2.0.0 + peerDependencies: + postcss: ^8.4 + checksum: af873fbd4899bd863aeed7b40753ab3e6028bf7b8eef53b54de1cbd1b83d92b1007a9a90db314781c2bc0ec204537ca423d17cdc37aee46ed1308d7406b81729 + languageName: node + linkType: hard + +"postcss-color-hex-alpha@npm:^10.0.0": + version: 10.0.0 + resolution: "postcss-color-hex-alpha@npm:10.0.0" + dependencies: + "@csstools/utilities": ^2.0.0 + postcss-value-parser: ^4.2.0 + peerDependencies: + postcss: ^8.4 + checksum: 2dbbd66d76522c7d281c292589360f21806b6dd31a582484e7e4a848e5244d645d5c5e1b6c6219dd5fb7333808cd94a27dd0d2e1db093d043668ed7b42db59ad + languageName: node + linkType: hard + +"postcss-color-rebeccapurple@npm:^10.0.0": + version: 10.0.0 + resolution: "postcss-color-rebeccapurple@npm:10.0.0" + dependencies: + "@csstools/utilities": ^2.0.0 + postcss-value-parser: ^4.2.0 + peerDependencies: + postcss: ^8.4 + checksum: 8ca0ee2b6b45ff62abdfc9b6757d8832d398c2e47dd705759485b685f544eaed81ec00f050a1bad67ffb5e6243332085a09807d47526ce3b43456b027119e0ae + languageName: node + linkType: hard + +"postcss-colormin@npm:^6.1.0": + version: 6.1.0 + resolution: "postcss-colormin@npm:6.1.0" + dependencies: + browserslist: ^4.23.0 + caniuse-api: ^3.0.0 + colord: ^2.9.3 + postcss-value-parser: ^4.2.0 + peerDependencies: + postcss: ^8.4.31 + checksum: 55a1525de345d953bc7f32ecaa5ee6275ef0277c27d1f97ff06a1bd1a2fedf7f254e36dc1500621f1df20c25a6d2485a74a0b527d8ff74eb90726c76efe2ac8e + languageName: node + linkType: hard + +"postcss-convert-values@npm:^6.1.0": + version: 6.1.0 + resolution: "postcss-convert-values@npm:6.1.0" + dependencies: + browserslist: ^4.23.0 + postcss-value-parser: ^4.2.0 + peerDependencies: + postcss: ^8.4.31 + checksum: 43e9f66af9bdec3c76695f9dde36885abc01f662c370c490b45d895459caab2c5792f906f3ddad107129133e41485a65634da7f699eef916a636e47f6a37a299 + languageName: node + linkType: hard + +"postcss-custom-media@npm:^11.0.6": + version: 11.0.6 + resolution: "postcss-custom-media@npm:11.0.6" + dependencies: + "@csstools/cascade-layer-name-parser": ^2.0.5 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + "@csstools/media-query-list-parser": ^4.0.3 + peerDependencies: + postcss: ^8.4 + checksum: 3b8ab5eb6d80cf9dd0b74acf69530f73009d860509d820fc5349894a10c2abd08eb1ff77f90c59ee51aebf422fe09d4093ece8d15f652f771ab0fcfd03a42417 + languageName: node + linkType: hard + +"postcss-custom-properties@npm:^14.0.6": + version: 14.0.6 + resolution: "postcss-custom-properties@npm:14.0.6" + dependencies: + "@csstools/cascade-layer-name-parser": ^2.0.5 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + "@csstools/utilities": ^2.0.0 + postcss-value-parser: ^4.2.0 + peerDependencies: + postcss: ^8.4 + checksum: f78999e036e8406efcbbd2d7dec599910de88a32a3e829b0c2e78abf6d8944a79fe61fb2cc2ecd07bb96a392249846c363af40c5dc7d3ab8c36606a79c324a28 + languageName: node + linkType: hard + +"postcss-custom-selectors@npm:^8.0.5": + version: 8.0.5 + resolution: "postcss-custom-selectors@npm:8.0.5" + dependencies: + "@csstools/cascade-layer-name-parser": ^2.0.5 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + postcss-selector-parser: ^7.0.0 + peerDependencies: + postcss: ^8.4 + checksum: 191cfe62ad3eaf3d8bff75ed461baebbb3b9a52de9c1c75bded61da4ed2302d7c53c457e9febfa7cffc9a1fb7f6ed98cab8c4b2a071a1097e487e0117018e6cf languageName: node linkType: hard -"pirates@npm:^4.0.1": - version: 4.0.6 - resolution: "pirates@npm:4.0.6" - checksum: 46a65fefaf19c6f57460388a5af9ab81e3d7fd0e7bc44ca59d753cb5c4d0df97c6c6e583674869762101836d68675f027d60f841c105d72734df9dfca97cbcc6 +"postcss-dir-pseudo-class@npm:^9.0.1": + version: 9.0.1 + resolution: "postcss-dir-pseudo-class@npm:9.0.1" + dependencies: + postcss-selector-parser: ^7.0.0 + peerDependencies: + postcss: ^8.4 + checksum: 7f6212fe7f2a83e95d85df14208df3edb75b6b8f89ad865fdfbd1abf5765b6649ff46bb7ff56f7788ff8cfe60546ff305cc2fd2f9b1f9e1647a4386507714070 languageName: node linkType: hard -"pkg-dir@npm:^4.1.0": - version: 4.2.0 - resolution: "pkg-dir@npm:4.2.0" - dependencies: - find-up: ^4.0.0 - checksum: 9863e3f35132bf99ae1636d31ff1e1e3501251d480336edb1c211133c8d58906bed80f154a1d723652df1fda91e01c7442c2eeaf9dc83157c7ae89087e43c8d6 +"postcss-discard-comments@npm:^6.0.2": + version: 6.0.2 + resolution: "postcss-discard-comments@npm:6.0.2" + peerDependencies: + postcss: ^8.4.31 + checksum: c1731ccc8d1e3d910412a61395988d3033365e6532d9e5432ad7c74add8c9dcb0af0c03d4e901bf0d2b59ea4e7297a0c77a547ff2ed1b1cc065559cc0de43b4e languageName: node linkType: hard -"pkg-up@npm:^3.1.0": - version: 3.1.0 - resolution: "pkg-up@npm:3.1.0" - dependencies: - find-up: ^3.0.0 - checksum: 5bac346b7c7c903613c057ae3ab722f320716199d753f4a7d053d38f2b5955460f3e6ab73b4762c62fd3e947f58e04f1343e92089e7bb6091c90877406fcd8c8 +"postcss-discard-duplicates@npm:^6.0.3": + version: 6.0.3 + resolution: "postcss-discard-duplicates@npm:6.0.3" + peerDependencies: + postcss: ^8.4.31 + checksum: 308e3fb84c35e4703532de1efa5d6e8444cc5f167d0e40f42d7ea3fa3a37d9d636fd10729847d078e0c303eee16f8548d14b6f88a3fce4e38a2b452648465175 languageName: node linkType: hard -"podman@workspace:.": - version: 0.0.0-use.local - resolution: "podman@workspace:." - dependencies: - "@docusaurus/core": ^2.4.1 - "@docusaurus/eslint-plugin": ^2.4.1 - "@docusaurus/module-type-aliases": ^2.4.1 - "@docusaurus/plugin-content-blog": ^2.4.1 - "@docusaurus/preset-classic": ^2.4.1 - "@docusaurus/theme-live-codeblock": ^2.4.1 - "@iconify/react": ^4.0.1 - "@mdx-js/react": ^1.6.22 - "@tsconfig/docusaurus": ^1.0.5 - "@typescript-eslint/eslint-plugin": ^5.48.2 - "@typescript-eslint/parser": ^5.48.2 - autoprefixer: ^10.4.13 - clsx: ^1.2.1 - eslint: ^8.32.0 - eslint-config-prettier: ^8.6.0 - html-react-parser: ^3.0.16 - husky: ^8.0.3 - lint-staged: ^13.1.0 - papaparse: ^5.4.1 - postcss: ^8.4.21 - prettier: 2.8.8 - prettier-plugin-tailwindcss: ^0.6.0 - prism-react-renderer: ^1.3.5 - react: ^17.0.2 - react-dom: ^17.0.2 - react-markdown: ^8.0.5 - tailwind-scrollbar: ^3.0.0 - tailwindcss: ^3.2.4 - typescript: ^4.9.4 - languageName: unknown - linkType: soft +"postcss-discard-empty@npm:^6.0.3": + version: 6.0.3 + resolution: "postcss-discard-empty@npm:6.0.3" + peerDependencies: + postcss: ^8.4.31 + checksum: bad305572faa066026a295faab37e718cee096589ab827b19c990c55620b2b2a1ce9f0145212651737a66086db01b2676c1927bbb8408c5f9cb42686d5959f00 + languageName: node + linkType: hard -"postcss-calc@npm:^8.2.3": - version: 8.2.4 - resolution: "postcss-calc@npm:8.2.4" - dependencies: - postcss-selector-parser: ^6.0.9 - postcss-value-parser: ^4.2.0 +"postcss-discard-overridden@npm:^6.0.2": + version: 6.0.2 + resolution: "postcss-discard-overridden@npm:6.0.2" peerDependencies: - postcss: ^8.2.2 - checksum: 314b4cebb0c4ed0cf8356b4bce71eca78f5a7842e6a3942a3bba49db168d5296b2bd93c3f735ae1c616f2651d94719ade33becc03c73d2d79c7394fb7f73eabb + postcss: ^8.4.31 + checksum: a38e0fe7a36f83cb9b73c1ba9ee2a48cf93c69ec0ea5753935824ffb71e958e58ae0393171c0f3d0014a397469d09bbb0d56bb5ab80f0280722967e2e273aebb languageName: node linkType: hard -"postcss-colormin@npm:^5.3.1": - version: 5.3.1 - resolution: "postcss-colormin@npm:5.3.1" +"postcss-discard-unused@npm:^6.0.5": + version: 6.0.5 + resolution: "postcss-discard-unused@npm:6.0.5" dependencies: - browserslist: ^4.21.4 - caniuse-api: ^3.0.0 - colord: ^2.9.1 - postcss-value-parser: ^4.2.0 + postcss-selector-parser: ^6.0.16 peerDependencies: - postcss: ^8.2.15 - checksum: e5778baab30877cd1f51e7dc9d2242a162aeca6360a52956acd7f668c5bc235c2ccb7e4df0370a804d65ebe00c5642366f061db53aa823f9ed99972cebd16024 + postcss: ^8.4.31 + checksum: 7962640773240186de38125f142a6555b7f9b2493c4968e0f0b11c6629b2bf43ac70b9fc4ee78aa732d82670ad8bf802b2febc9a9864b022eb68530eded26836 languageName: node linkType: hard -"postcss-convert-values@npm:^5.1.3": - version: 5.1.3 - resolution: "postcss-convert-values@npm:5.1.3" +"postcss-double-position-gradients@npm:^6.0.2": + version: 6.0.2 + resolution: "postcss-double-position-gradients@npm:6.0.2" dependencies: - browserslist: ^4.21.4 + "@csstools/postcss-progressive-custom-properties": ^4.1.0 + "@csstools/utilities": ^2.0.0 postcss-value-parser: ^4.2.0 peerDependencies: - postcss: ^8.2.15 - checksum: df48cdaffabf9737f9cfdc58a3dc2841cf282506a7a944f6c70236cff295d3a69f63de6e0935eeb8a9d3f504324e5b4e240abc29e21df9e35a02585d3060aeb5 + postcss: ^8.4 + checksum: cc0302e2850334566ca7b85bddfbf6f5e839132d542d41eb8c380194048e35656aa4b7b9ea9e557747e4924a90fbd590d5abaea799e5c7493b0f239eb3d27721 languageName: node linkType: hard -"postcss-discard-comments@npm:^5.1.2": - version: 5.1.2 - resolution: "postcss-discard-comments@npm:5.1.2" +"postcss-focus-visible@npm:^10.0.1": + version: 10.0.1 + resolution: "postcss-focus-visible@npm:10.0.1" + dependencies: + postcss-selector-parser: ^7.0.0 peerDependencies: - postcss: ^8.2.15 - checksum: abfd064ebc27aeaf5037643dd51ffaff74d1fa4db56b0523d073ace4248cbb64ffd9787bd6924b0983a9d0bd0e9bf9f10d73b120e50391dc236e0d26c812fa2a + postcss: ^8.4 + checksum: 47c038ccf139bad6a4c12cf59c5ac78acbac96ae0517ae08d5db676680d585ae7943e22328bd0d31876d6bacc24e4b717b5f809d26218d76989f7b9a44369793 languageName: node linkType: hard -"postcss-discard-duplicates@npm:^5.1.0": - version: 5.1.0 - resolution: "postcss-discard-duplicates@npm:5.1.0" +"postcss-focus-within@npm:^9.0.1": + version: 9.0.1 + resolution: "postcss-focus-within@npm:9.0.1" + dependencies: + postcss-selector-parser: ^7.0.0 peerDependencies: - postcss: ^8.2.15 - checksum: 88d6964201b1f4ed6bf7a32cefe68e86258bb6e42316ca01d9b32bdb18e7887d02594f89f4a2711d01b51ea6e3fcca8c54be18a59770fe5f4521c61d3eb6ca35 + postcss: ^8.4 + checksum: ca953bf566605c6519f5318a5a4886f8f0698798ba96d505c287cc0397d90a80246de948af354592a680615667e553c3fb67e88d9f55bdf630dab67b0fc0ceaa languageName: node linkType: hard -"postcss-discard-empty@npm:^5.1.1": - version: 5.1.1 - resolution: "postcss-discard-empty@npm:5.1.1" +"postcss-font-variant@npm:^5.0.0": + version: 5.0.0 + resolution: "postcss-font-variant@npm:5.0.0" peerDependencies: - postcss: ^8.2.15 - checksum: 970adb12fae5c214c0768236ad9a821552626e77dedbf24a8213d19cc2c4a531a757cd3b8cdd3fc22fb1742471b8692a1db5efe436a71236dec12b1318ee8ff4 + postcss: ^8.1.0 + checksum: a19286589261c2bc3e20470486e1ee3b4daf34271c5020167f30856c9b30c26f23264307cb97a184d503814e1b8c5d8a1f9f64a14fd4fd9551c173dca9424695 languageName: node linkType: hard -"postcss-discard-overridden@npm:^5.1.0": - version: 5.1.0 - resolution: "postcss-discard-overridden@npm:5.1.0" +"postcss-gap-properties@npm:^6.0.0": + version: 6.0.0 + resolution: "postcss-gap-properties@npm:6.0.0" peerDependencies: - postcss: ^8.2.15 - checksum: d64d4a545aa2c81b22542895cfcddc787d24119f294d35d29b0599a1c818b3cc51f4ee80b80f5a0a09db282453dd5ac49f104c2117cc09112d0ac9b40b499a41 + postcss: ^8.4 + checksum: 8fa8a208fe254ddfcb0442072a6232576efa1fc3deea917be6d3a0c25dfcb855cc6806572e42a098aa0276a5ad3917f19b269409f5ce1f22d233c0072d72f823 languageName: node linkType: hard -"postcss-discard-unused@npm:^5.1.0": - version: 5.1.0 - resolution: "postcss-discard-unused@npm:5.1.0" +"postcss-image-set-function@npm:^7.0.0": + version: 7.0.0 + resolution: "postcss-image-set-function@npm:7.0.0" dependencies: - postcss-selector-parser: ^6.0.5 + "@csstools/utilities": ^2.0.0 + postcss-value-parser: ^4.2.0 peerDependencies: - postcss: ^8.2.15 - checksum: 5c09403a342a065033f5f22cefe6b402c76c2dc0aac31a736a2062d82c2a09f0ff2525b3df3a0c6f4e0ffc7a0392efd44bfe7f9d018e4cae30d15b818b216622 + postcss: ^8.4 + checksum: 328946f3f258c230ac50f2f54dc43ac89f21b1afe42e2828fa20bfd19692a1198e439becabe9dfb64de50932c6ef987a8b2b5ea9398ae7ca813afb4f7e595be7 languageName: node linkType: hard @@ -9764,6 +11103,21 @@ __metadata: languageName: node linkType: hard +"postcss-lab-function@npm:^7.0.10": + version: 7.0.10 + resolution: "postcss-lab-function@npm:7.0.10" + dependencies: + "@csstools/css-color-parser": ^3.0.10 + "@csstools/css-parser-algorithms": ^3.0.5 + "@csstools/css-tokenizer": ^3.0.4 + "@csstools/postcss-progressive-custom-properties": ^4.1.0 + "@csstools/utilities": ^2.0.0 + peerDependencies: + postcss: ^8.4 + checksum: bd3fb9350a72147d474bf5a5e924ff911ac16b8218ab7d5a8e06c158409a79e6817b6dc54533c62c4983024a91c706d9128d883369a0bdec58b650f4c5a4a7cf + languageName: node + linkType: hard + "postcss-load-config@npm:^4.0.2": version: 4.0.2 resolution: "postcss-load-config@npm:4.0.2" @@ -9782,136 +11136,147 @@ __metadata: languageName: node linkType: hard -"postcss-loader@npm:^7.0.0": - version: 7.3.3 - resolution: "postcss-loader@npm:7.3.3" +"postcss-loader@npm:^7.3.4": + version: 7.3.4 + resolution: "postcss-loader@npm:7.3.4" dependencies: - cosmiconfig: ^8.2.0 - jiti: ^1.18.2 - semver: ^7.3.8 + cosmiconfig: ^8.3.5 + jiti: ^1.20.0 + semver: ^7.5.4 peerDependencies: postcss: ^7.0.0 || ^8.0.1 webpack: ^5.0.0 - checksum: c724044d6ae56334535c26bb4efc9c151431d44d60bc8300157c760747281a242757d8dab32db72738434531175b38a408cb0b270bb96207c07584dcfcd899ff + checksum: f109eb266580eb296441a1ae057f93629b9b79ad962bdd3fc134417180431606a5419b6f5848c31e6d92c818e71fe96e4335a85cc5332c2f7b14e2869951e5b3 languageName: node linkType: hard -"postcss-merge-idents@npm:^5.1.1": - version: 5.1.1 - resolution: "postcss-merge-idents@npm:5.1.1" +"postcss-logical@npm:^8.1.0": + version: 8.1.0 + resolution: "postcss-logical@npm:8.1.0" + dependencies: + postcss-value-parser: ^4.2.0 + peerDependencies: + postcss: ^8.4 + checksum: 7db1e8c9f9c1ec9dc8cef56830ac3686766629cc7e28c0494b6e0f3699979f18c11225a39c37210cf81be4491adaa6bdbc394429d7e050f2d03e5845ef6608f9 + languageName: node + linkType: hard + +"postcss-merge-idents@npm:^6.0.3": + version: 6.0.3 + resolution: "postcss-merge-idents@npm:6.0.3" dependencies: - cssnano-utils: ^3.1.0 + cssnano-utils: ^4.0.2 postcss-value-parser: ^4.2.0 peerDependencies: - postcss: ^8.2.15 - checksum: ed8a673617ea6ae3e15d69558063cb1a5eeee01732f78cdc0196ab910324abc30828724ab8dfc4cda27e8c0077542e25688470f829819a2604625a673387ec72 + postcss: ^8.4.31 + checksum: b45780d6d103b8e45a580032747ee6e1842f81863672341a6b4961397e243ca896217bf1f3ee732376a766207d5f610ba8924cf08cf6d5bbd4b093133fd05d70 languageName: node linkType: hard -"postcss-merge-longhand@npm:^5.1.7": - version: 5.1.7 - resolution: "postcss-merge-longhand@npm:5.1.7" +"postcss-merge-longhand@npm:^6.0.5": + version: 6.0.5 + resolution: "postcss-merge-longhand@npm:6.0.5" dependencies: postcss-value-parser: ^4.2.0 - stylehacks: ^5.1.1 + stylehacks: ^6.1.1 peerDependencies: - postcss: ^8.2.15 - checksum: 81c3fc809f001b9b71a940148e242bdd6e2d77713d1bfffa15eb25c1f06f6648d5e57cb21645746d020a2a55ff31e1740d2b27900442913a9d53d8a01fb37e1b + postcss: ^8.4.31 + checksum: 9ae5acf47dc0c1f494684ae55672d55bba7f5ee11c9c0f266aabd7c798e9f7394c6096363cd95685fd21ef088740389121a317772cf523ca22c915009bca2617 languageName: node linkType: hard -"postcss-merge-rules@npm:^5.1.4": - version: 5.1.4 - resolution: "postcss-merge-rules@npm:5.1.4" +"postcss-merge-rules@npm:^6.1.1": + version: 6.1.1 + resolution: "postcss-merge-rules@npm:6.1.1" dependencies: - browserslist: ^4.21.4 + browserslist: ^4.23.0 caniuse-api: ^3.0.0 - cssnano-utils: ^3.1.0 - postcss-selector-parser: ^6.0.5 + cssnano-utils: ^4.0.2 + postcss-selector-parser: ^6.0.16 peerDependencies: - postcss: ^8.2.15 - checksum: 8ab6a569babe6cb412d6612adee74f053cea7edb91fa013398515ab36754b1fec830d68782ed8cdfb44cffdc6b78c79eab157bff650f428aa4460d3f3857447e + postcss: ^8.4.31 + checksum: 43f60a1c88806491cf752ae7871676de0e7a2a9d6d2fc6bc894068cc35a910a63d30f7c7d79545e0926c8b3a9ec583e5e8357203c40b5bad5ff58133b0c900f6 languageName: node linkType: hard -"postcss-minify-font-values@npm:^5.1.0": - version: 5.1.0 - resolution: "postcss-minify-font-values@npm:5.1.0" +"postcss-minify-font-values@npm:^6.1.0": + version: 6.1.0 + resolution: "postcss-minify-font-values@npm:6.1.0" dependencies: postcss-value-parser: ^4.2.0 peerDependencies: - postcss: ^8.2.15 - checksum: 35e858fa41efa05acdeb28f1c76579c409fdc7eabb1744c3bd76e895bb9fea341a016746362a67609688ab2471f587202b9a3e14ea28ad677754d663a2777ece + postcss: ^8.4.31 + checksum: 985e4dd2f89220a4442a822aad7dff016ab58a9dbb7bbca9d01c2d07d5a1e7d8c02e1c6e836abb4c9b4e825b4b80d99ee1f5899e74bf0d969095037738e6e452 languageName: node linkType: hard -"postcss-minify-gradients@npm:^5.1.1": - version: 5.1.1 - resolution: "postcss-minify-gradients@npm:5.1.1" +"postcss-minify-gradients@npm:^6.0.3": + version: 6.0.3 + resolution: "postcss-minify-gradients@npm:6.0.3" dependencies: - colord: ^2.9.1 - cssnano-utils: ^3.1.0 + colord: ^2.9.3 + cssnano-utils: ^4.0.2 postcss-value-parser: ^4.2.0 peerDependencies: - postcss: ^8.2.15 - checksum: 27354072a07c5e6dab36731103b94ca2354d4ed3c5bc6aacfdf2ede5a55fa324679d8fee5450800bc50888dbb5e9ed67569c0012040c2be128143d0cebb36d67 + postcss: ^8.4.31 + checksum: 89b95088c3830f829f6d4636d1be4d4f13300bf9f1577c48c25169c81e11ec0026760b9abb32112b95d2c622f09d3b737f4d2975a7842927ccb567e1002ef7b3 languageName: node linkType: hard -"postcss-minify-params@npm:^5.1.4": - version: 5.1.4 - resolution: "postcss-minify-params@npm:5.1.4" +"postcss-minify-params@npm:^6.1.0": + version: 6.1.0 + resolution: "postcss-minify-params@npm:6.1.0" dependencies: - browserslist: ^4.21.4 - cssnano-utils: ^3.1.0 + browserslist: ^4.23.0 + cssnano-utils: ^4.0.2 postcss-value-parser: ^4.2.0 peerDependencies: - postcss: ^8.2.15 - checksum: bd63e2cc89edcf357bb5c2a16035f6d02ef676b8cede4213b2bddd42626b3d428403849188f95576fc9f03e43ebd73a29bf61d33a581be9a510b13b7f7f100d5 + postcss: ^8.4.31 + checksum: 1e1cc3057d9bcc532c70e40628e96e3aea0081d8072dffe983a270a8cd59c03ac585e57d036b70e43d4ee725f274a05a6a8efac5a715f448284e115c13f82a46 languageName: node linkType: hard -"postcss-minify-selectors@npm:^5.2.1": - version: 5.2.1 - resolution: "postcss-minify-selectors@npm:5.2.1" +"postcss-minify-selectors@npm:^6.0.4": + version: 6.0.4 + resolution: "postcss-minify-selectors@npm:6.0.4" dependencies: - postcss-selector-parser: ^6.0.5 + postcss-selector-parser: ^6.0.16 peerDependencies: - postcss: ^8.2.15 - checksum: 6fdbc84f99a60d56b43df8930707da397775e4c36062a106aea2fd2ac81b5e24e584a1892f4baa4469fa495cb87d1422560eaa8f6c9d500f9f0b691a5f95bab5 + postcss: ^8.4.31 + checksum: 150221a84422ca7627c67ee691ee51e0fe2c3583c8108801e9fc93d3be8b538c2eb04fcfdc908270d7eeaeaf01594a20b81311690a873efccb8a23aeafe1c354 languageName: node linkType: hard -"postcss-modules-extract-imports@npm:^3.0.0": - version: 3.0.0 - resolution: "postcss-modules-extract-imports@npm:3.0.0" +"postcss-modules-extract-imports@npm:^3.1.0": + version: 3.1.0 + resolution: "postcss-modules-extract-imports@npm:3.1.0" peerDependencies: postcss: ^8.1.0 - checksum: 4b65f2f1382d89c4bc3c0a1bdc5942f52f3cb19c110c57bd591ffab3a5fee03fcf831604168205b0c1b631a3dce2255c70b61aaae3ef39d69cd7eb450c2552d2 + checksum: b9192e0f4fb3d19431558be6f8af7ca45fc92baaad9b2778d1732a5880cd25c3df2074ce5484ae491e224f0d21345ffc2d419bd51c25b019af76d7a7af88c17f languageName: node linkType: hard -"postcss-modules-local-by-default@npm:^4.0.3": - version: 4.0.3 - resolution: "postcss-modules-local-by-default@npm:4.0.3" +"postcss-modules-local-by-default@npm:^4.0.5": + version: 4.2.0 + resolution: "postcss-modules-local-by-default@npm:4.2.0" dependencies: icss-utils: ^5.0.0 - postcss-selector-parser: ^6.0.2 + postcss-selector-parser: ^7.0.0 postcss-value-parser: ^4.1.0 peerDependencies: postcss: ^8.1.0 - checksum: 2f8083687f3d6067885f8863dd32dbbb4f779cfcc7e52c17abede9311d84faf6d3ed8760e7c54c6380281732ae1f78e5e56a28baf3c271b33f450a11c9e30485 + checksum: 720d145453f82ad5f1c1d0ff7386d64722f0812808e4132e573c1a49909745e109fcce3792a0b0cb18770dbeb3d9741867e81c698dc8353a18bc664b7d6d9533 languageName: node linkType: hard -"postcss-modules-scope@npm:^3.0.0": - version: 3.0.0 - resolution: "postcss-modules-scope@npm:3.0.0" +"postcss-modules-scope@npm:^3.2.0": + version: 3.2.1 + resolution: "postcss-modules-scope@npm:3.2.1" dependencies: - postcss-selector-parser: ^6.0.4 + postcss-selector-parser: ^7.0.0 peerDependencies: postcss: ^8.1.0 - checksum: 330b9398dbd44c992c92b0dc612c0626135e2cc840fee41841eb61247a6cfed95af2bd6f67ead9dd9d0bb41f5b0367129d93c6e434fa3e9c58ade391d9a5a138 + checksum: 085f65863bb7d8bf08209a979ceb22b2b07bb466574e0e698d34aaad832d614957bb05f2418348a14e4035f65e23b2be2951369d26ea429dd5762c6a020f0f7c languageName: node linkType: hard @@ -9937,162 +11302,309 @@ __metadata: languageName: node linkType: hard -"postcss-normalize-charset@npm:^5.1.0": - version: 5.1.0 - resolution: "postcss-normalize-charset@npm:5.1.0" +"postcss-nesting@npm:^13.0.2": + version: 13.0.2 + resolution: "postcss-nesting@npm:13.0.2" + dependencies: + "@csstools/selector-resolve-nested": ^3.1.0 + "@csstools/selector-specificity": ^5.0.0 + postcss-selector-parser: ^7.0.0 peerDependencies: - postcss: ^8.2.15 - checksum: e79d92971fc05b8b3c9b72f3535a574e077d13c69bef68156a0965f397fdf157de670da72b797f57b0e3bac8f38155b5dd1735ecab143b9cc4032d72138193b4 + postcss: ^8.4 + checksum: fce488a2e77d9a8183a4e014caf047e41cb2422c07de1d49a092734fc90feeb8ced21090e3e284cfb2956afdba73e4a3547065ede228b209003bac5e1de62f0a languageName: node linkType: hard -"postcss-normalize-display-values@npm:^5.1.0": - version: 5.1.0 - resolution: "postcss-normalize-display-values@npm:5.1.0" +"postcss-normalize-charset@npm:^6.0.2": + version: 6.0.2 + resolution: "postcss-normalize-charset@npm:6.0.2" + peerDependencies: + postcss: ^8.4.31 + checksum: 5b8aeb17d61578a8656571cd5d5eefa8d4ee7126a99a41fdd322078002a06f2ae96f649197b9c01067a5f3e38a2e4b03e0e3fda5a0ec9e3d7ad056211ce86156 + languageName: node + linkType: hard + +"postcss-normalize-display-values@npm:^6.0.2": + version: 6.0.2 + resolution: "postcss-normalize-display-values@npm:6.0.2" dependencies: postcss-value-parser: ^4.2.0 peerDependencies: - postcss: ^8.2.15 - checksum: b6eb7b9b02c3bdd62bbc54e01e2b59733d73a1c156905d238e178762962efe0c6f5104544da39f32cade8a4fb40f10ff54b63a8ebfbdff51e8780afb9fbdcf86 + postcss: ^8.4.31 + checksum: da30a9394b0e4a269ccad8d240693a6cd564bcc60e24db67caee00f70ddfbc070ad76faed64c32e6eec9ed02e92565488b7879d4fd6c40d877c290eadbb0bb28 languageName: node linkType: hard -"postcss-normalize-positions@npm:^5.1.1": - version: 5.1.1 - resolution: "postcss-normalize-positions@npm:5.1.1" +"postcss-normalize-positions@npm:^6.0.2": + version: 6.0.2 + resolution: "postcss-normalize-positions@npm:6.0.2" dependencies: postcss-value-parser: ^4.2.0 peerDependencies: - postcss: ^8.2.15 - checksum: d9afc233729c496463c7b1cdd06732469f401deb387484c3a2422125b46ec10b4af794c101f8c023af56f01970b72b535e88373b9058ecccbbf88db81662b3c4 + postcss: ^8.4.31 + checksum: 44fb77583fae4d71b76e38226cf770570876bcf5af6940dc9aeac7a7e2252896b361e0249044766cff8dad445f925378f06a005d6541597573c20e599a62b516 languageName: node linkType: hard -"postcss-normalize-repeat-style@npm:^5.1.1": - version: 5.1.1 - resolution: "postcss-normalize-repeat-style@npm:5.1.1" +"postcss-normalize-repeat-style@npm:^6.0.2": + version: 6.0.2 + resolution: "postcss-normalize-repeat-style@npm:6.0.2" dependencies: postcss-value-parser: ^4.2.0 peerDependencies: - postcss: ^8.2.15 - checksum: 2c6ad2b0ae10a1fda156b948c34f78c8f1e185513593de4d7e2480973586675520edfec427645fa168c337b0a6b3ceca26f92b96149741ca98a9806dad30d534 + postcss: ^8.4.31 + checksum: bebdac63bec6777ead3e265fc12527b261cf8d0da1b7f0abb12bda86fd53b7058e4afe392210ac74dac012e413bb1c2a46a1138c89f82b8bf70b81711f620f8c languageName: node linkType: hard -"postcss-normalize-string@npm:^5.1.0": - version: 5.1.0 - resolution: "postcss-normalize-string@npm:5.1.0" +"postcss-normalize-string@npm:^6.0.2": + version: 6.0.2 + resolution: "postcss-normalize-string@npm:6.0.2" dependencies: postcss-value-parser: ^4.2.0 peerDependencies: - postcss: ^8.2.15 - checksum: 6e549c6e5b2831e34c7bdd46d8419e2278f6af1d5eef6d26884a37c162844e60339340c57e5e06058cdbe32f27fc6258eef233e811ed2f71168ef2229c236ada + postcss: ^8.4.31 + checksum: 5e8e253c528b542accafc142846fb33643c342a787c86e5b68c6287c7d8f63c5ae7d4d3fc28e3daf80821cc26a91add135e58bdd62ff9c735fca65d994898c7d languageName: node linkType: hard -"postcss-normalize-timing-functions@npm:^5.1.0": - version: 5.1.0 - resolution: "postcss-normalize-timing-functions@npm:5.1.0" +"postcss-normalize-timing-functions@npm:^6.0.2": + version: 6.0.2 + resolution: "postcss-normalize-timing-functions@npm:6.0.2" dependencies: postcss-value-parser: ^4.2.0 peerDependencies: - postcss: ^8.2.15 - checksum: da550f50e90b0b23e17b67449a7d1efd1aa68288e66d4aa7614ca6f5cc012896be1972b7168eee673d27da36504faccf7b9f835c0f7e81243f966a42c8c030aa + postcss: ^8.4.31 + checksum: 1970f5aad04be11f99d51c59e27debb6fd7b49d0fa4a8879062b42c82113f8e520a284448727add3b54de85deefb8bd5fe554f618406586e9ad8fc9d060609f1 languageName: node linkType: hard -"postcss-normalize-unicode@npm:^5.1.1": - version: 5.1.1 - resolution: "postcss-normalize-unicode@npm:5.1.1" +"postcss-normalize-unicode@npm:^6.1.0": + version: 6.1.0 + resolution: "postcss-normalize-unicode@npm:6.1.0" dependencies: - browserslist: ^4.21.4 + browserslist: ^4.23.0 postcss-value-parser: ^4.2.0 peerDependencies: - postcss: ^8.2.15 - checksum: 4c24d26cc9f4b19a9397db4e71dd600dab690f1de8e14a3809e2aa1452dbc3791c208c38a6316bbc142f29e934fdf02858e68c94038c06174d78a4937e0f273c + postcss: ^8.4.31 + checksum: 69ef35d06242061f0c504c128b83752e0f8daa30ebb26734de7d090460910be0b2efd8b17b1d64c3c85b95831a041faad9ad0aaba80e239406a79cfad3d63568 languageName: node linkType: hard -"postcss-normalize-url@npm:^5.1.0": - version: 5.1.0 - resolution: "postcss-normalize-url@npm:5.1.0" +"postcss-normalize-url@npm:^6.0.2": + version: 6.0.2 + resolution: "postcss-normalize-url@npm:6.0.2" dependencies: - normalize-url: ^6.0.1 postcss-value-parser: ^4.2.0 peerDependencies: - postcss: ^8.2.15 - checksum: 3bd4b3246d6600230bc827d1760b24cb3101827ec97570e3016cbe04dc0dd28f4dbe763245d1b9d476e182c843008fbea80823061f1d2219b96f0d5c724a24c0 + postcss: ^8.4.31 + checksum: bef51a18bbfee4fbf0381fec3c91e6c0dace36fca053bbd5f228e653d2732b6df3985525d79c4f7fc89f840ed07eb6d226e9d7503ecdc6f16d6d80cacae9df33 languageName: node linkType: hard -"postcss-normalize-whitespace@npm:^5.1.1": - version: 5.1.1 - resolution: "postcss-normalize-whitespace@npm:5.1.1" +"postcss-normalize-whitespace@npm:^6.0.2": + version: 6.0.2 + resolution: "postcss-normalize-whitespace@npm:6.0.2" dependencies: postcss-value-parser: ^4.2.0 peerDependencies: - postcss: ^8.2.15 - checksum: 12d8fb6d1c1cba208cc08c1830959b7d7ad447c3f5581873f7e185f99a9a4230c43d3af21ca12c818e4690a5085a95b01635b762ad4a7bef69d642609b4c0e19 + postcss: ^8.4.31 + checksum: 6081eb3a4b305749eec02c00a95c2d236336a77ee636bb1d939f18d5dfa5ba82b7cf7fa072e83f9133d0bc984276596af3fe468bdd67c742ce69e9c63dbc218d languageName: node linkType: hard -"postcss-ordered-values@npm:^5.1.3": - version: 5.1.3 - resolution: "postcss-ordered-values@npm:5.1.3" +"postcss-opacity-percentage@npm:^3.0.0": + version: 3.0.0 + resolution: "postcss-opacity-percentage@npm:3.0.0" + peerDependencies: + postcss: ^8.4 + checksum: dc813113f05f91f1c87ab3c125911f9e5989d1f3fc7cc5586a165901a63c0d02077d134df844391ea5624088680c6b3cee75bc33b8efdcaf340a91046e47e4e1 + languageName: node + linkType: hard + +"postcss-ordered-values@npm:^6.0.2": + version: 6.0.2 + resolution: "postcss-ordered-values@npm:6.0.2" dependencies: - cssnano-utils: ^3.1.0 + cssnano-utils: ^4.0.2 postcss-value-parser: ^4.2.0 peerDependencies: - postcss: ^8.2.15 - checksum: 6f3ca85b6ceffc68aadaf319d9ee4c5ac16d93195bf8cba2d1559b631555ad61941461cda6d3909faab86e52389846b2b36345cff8f0c3f4eb345b1b8efadcf9 + postcss: ^8.4.31 + checksum: c3d96177b4ffa43754e835e30c40043cc75ab1e95eb6c55ac8723eb48c13a12e986250e63d96619bbbd1a098876a1c0c1b3b7a8e1de1108a009cf7aa0beac834 languageName: node linkType: hard -"postcss-reduce-idents@npm:^5.2.0": - version: 5.2.0 - resolution: "postcss-reduce-idents@npm:5.2.0" +"postcss-overflow-shorthand@npm:^6.0.0": + version: 6.0.0 + resolution: "postcss-overflow-shorthand@npm:6.0.0" dependencies: postcss-value-parser: ^4.2.0 peerDependencies: - postcss: ^8.2.15 - checksum: f0d644c86e160dd36ee4dd924ab7d6feacac867c87702e2f98f96b409430a62de4fec2dfc3c8731bda4e14196e29a752b4558942f0af2a3e6cd7f1f4b173db8e + postcss: ^8.4 + checksum: 80f07e0beb97b7ac5dac590802591fc93392b0d7a9678e17998b4d34ee0cca637665232c7ea88b3a4342192bc9a2a4f5c757ad86b837a5fd59d083d37cc7da16 languageName: node linkType: hard -"postcss-reduce-initial@npm:^5.1.2": - version: 5.1.2 - resolution: "postcss-reduce-initial@npm:5.1.2" +"postcss-page-break@npm:^3.0.4": + version: 3.0.4 + resolution: "postcss-page-break@npm:3.0.4" + peerDependencies: + postcss: ^8 + checksum: a7d08c945fc691f62c77ac701e64722218b14ec5c8fc1972b8af9c21553492d40808cf95e61b9697b1dacaf7e6180636876d7fee314f079e6c9e39ac1b1edc6f + languageName: node + linkType: hard + +"postcss-place@npm:^10.0.0": + version: 10.0.0 + resolution: "postcss-place@npm:10.0.0" + dependencies: + postcss-value-parser: ^4.2.0 + peerDependencies: + postcss: ^8.4 + checksum: 738cd0dc2412cf573bcfb2f7dce8e1cd21887f61c8808f55114f08fb8fbf03715e957fdd8859241eecebe400a5202771f513610b04e0f17c7742f6a5ea3bafb3 + languageName: node + linkType: hard + +"postcss-preset-env@npm:^10.2.1": + version: 10.2.4 + resolution: "postcss-preset-env@npm:10.2.4" + dependencies: + "@csstools/postcss-cascade-layers": ^5.0.2 + "@csstools/postcss-color-function": ^4.0.10 + "@csstools/postcss-color-mix-function": ^3.0.10 + "@csstools/postcss-color-mix-variadic-function-arguments": ^1.0.0 + "@csstools/postcss-content-alt-text": ^2.0.6 + "@csstools/postcss-exponential-functions": ^2.0.9 + "@csstools/postcss-font-format-keywords": ^4.0.0 + "@csstools/postcss-gamut-mapping": ^2.0.10 + "@csstools/postcss-gradients-interpolation-method": ^5.0.10 + "@csstools/postcss-hwb-function": ^4.0.10 + "@csstools/postcss-ic-unit": ^4.0.2 + "@csstools/postcss-initial": ^2.0.1 + "@csstools/postcss-is-pseudo-class": ^5.0.3 + "@csstools/postcss-light-dark-function": ^2.0.9 + "@csstools/postcss-logical-float-and-clear": ^3.0.0 + "@csstools/postcss-logical-overflow": ^2.0.0 + "@csstools/postcss-logical-overscroll-behavior": ^2.0.0 + "@csstools/postcss-logical-resize": ^3.0.0 + "@csstools/postcss-logical-viewport-units": ^3.0.4 + "@csstools/postcss-media-minmax": ^2.0.9 + "@csstools/postcss-media-queries-aspect-ratio-number-values": ^3.0.5 + "@csstools/postcss-nested-calc": ^4.0.0 + "@csstools/postcss-normalize-display-values": ^4.0.0 + "@csstools/postcss-oklab-function": ^4.0.10 + "@csstools/postcss-progressive-custom-properties": ^4.1.0 + "@csstools/postcss-random-function": ^2.0.1 + "@csstools/postcss-relative-color-syntax": ^3.0.10 + "@csstools/postcss-scope-pseudo-class": ^4.0.1 + "@csstools/postcss-sign-functions": ^1.1.4 + "@csstools/postcss-stepped-value-functions": ^4.0.9 + "@csstools/postcss-text-decoration-shorthand": ^4.0.2 + "@csstools/postcss-trigonometric-functions": ^4.0.9 + "@csstools/postcss-unset-value": ^4.0.0 + autoprefixer: ^10.4.21 + browserslist: ^4.25.0 + css-blank-pseudo: ^7.0.1 + css-has-pseudo: ^7.0.2 + css-prefers-color-scheme: ^10.0.0 + cssdb: ^8.3.0 + postcss-attribute-case-insensitive: ^7.0.1 + postcss-clamp: ^4.1.0 + postcss-color-functional-notation: ^7.0.10 + postcss-color-hex-alpha: ^10.0.0 + postcss-color-rebeccapurple: ^10.0.0 + postcss-custom-media: ^11.0.6 + postcss-custom-properties: ^14.0.6 + postcss-custom-selectors: ^8.0.5 + postcss-dir-pseudo-class: ^9.0.1 + postcss-double-position-gradients: ^6.0.2 + postcss-focus-visible: ^10.0.1 + postcss-focus-within: ^9.0.1 + postcss-font-variant: ^5.0.0 + postcss-gap-properties: ^6.0.0 + postcss-image-set-function: ^7.0.0 + postcss-lab-function: ^7.0.10 + postcss-logical: ^8.1.0 + postcss-nesting: ^13.0.2 + postcss-opacity-percentage: ^3.0.0 + postcss-overflow-shorthand: ^6.0.0 + postcss-page-break: ^3.0.4 + postcss-place: ^10.0.0 + postcss-pseudo-class-any-link: ^10.0.1 + postcss-replace-overflow-wrap: ^4.0.0 + postcss-selector-not: ^8.0.1 + peerDependencies: + postcss: ^8.4 + checksum: e662cbb506b425771acb68b8d2eb34fecee22288e7067627fc952d5975a6c5ce39141c51a3719eb6007b1553d31ebd676725ed68d41ef8a72196b38efe0c5a05 + languageName: node + linkType: hard + +"postcss-pseudo-class-any-link@npm:^10.0.1": + version: 10.0.1 + resolution: "postcss-pseudo-class-any-link@npm:10.0.1" + dependencies: + postcss-selector-parser: ^7.0.0 + peerDependencies: + postcss: ^8.4 + checksum: 376525d1a6fa223d908deb884b93d5cb76f4fa7431c090a8ada63e5ee9657bec7bf8e23eff1c36264c051c5a653928e38392165a862b7c5bf5e39e9364383fce + languageName: node + linkType: hard + +"postcss-reduce-idents@npm:^6.0.3": + version: 6.0.3 + resolution: "postcss-reduce-idents@npm:6.0.3" + dependencies: + postcss-value-parser: ^4.2.0 + peerDependencies: + postcss: ^8.4.31 + checksum: 1feff316838f947386c908f50807cf1b9589fd09b8e8df633a01f2640af5492833cc892448938ceba10ab96826c44767b8f2e1569d587579423f2db81202f7c7 + languageName: node + linkType: hard + +"postcss-reduce-initial@npm:^6.1.0": + version: 6.1.0 + resolution: "postcss-reduce-initial@npm:6.1.0" dependencies: - browserslist: ^4.21.4 + browserslist: ^4.23.0 caniuse-api: ^3.0.0 peerDependencies: - postcss: ^8.2.15 - checksum: 55db697f85231a81f1969d54c894e4773912d9ddb914f9b03d2e73abc4030f2e3bef4d7465756d0c1acfcc2c2d69974bfb50a972ab27546a7d68b5a4fc90282b + postcss: ^8.4.31 + checksum: 39e4034ffbf62a041b66944c5cebc4b17f656e76b97568f7f6230b0b886479e5c75b02ae4ba48c472cb0bde47489f9ed1fe6110ae8cff0d7b7165f53c2d64a12 languageName: node linkType: hard -"postcss-reduce-transforms@npm:^5.1.0": - version: 5.1.0 - resolution: "postcss-reduce-transforms@npm:5.1.0" +"postcss-reduce-transforms@npm:^6.0.2": + version: 6.0.2 + resolution: "postcss-reduce-transforms@npm:6.0.2" dependencies: postcss-value-parser: ^4.2.0 peerDependencies: - postcss: ^8.2.15 - checksum: 0c6af2cba20e3ff63eb9ad045e634ddfb9c3e5c0e614c020db2a02f3aa20632318c4ede9e0c995f9225d9a101e673de91c0a6e10bb2fa5da6d6c75d15a55882f + postcss: ^8.4.31 + checksum: c424cc554eb5d253b7687b64925a13fc16759f058795d223854f5a20d9bca641b5f25d0559d03287e63f07a4629c24ac78156adcf604483fcad3c51721da0a08 + languageName: node + linkType: hard + +"postcss-replace-overflow-wrap@npm:^4.0.0": + version: 4.0.0 + resolution: "postcss-replace-overflow-wrap@npm:4.0.0" + peerDependencies: + postcss: ^8.0.3 + checksum: 3ffe20b300a4c377a11c588b142740d8557e03c707474c45234c934190ac374750ddc92c7906c373471d273a20504a429c2062c21fdcaff830fb28e0a81ac1dc languageName: node linkType: hard -"postcss-selector-parser@npm:^6.0.2, postcss-selector-parser@npm:^6.0.4, postcss-selector-parser@npm:^6.0.5, postcss-selector-parser@npm:^6.0.9": - version: 6.0.13 - resolution: "postcss-selector-parser@npm:6.0.13" +"postcss-selector-not@npm:^8.0.1": + version: 8.0.1 + resolution: "postcss-selector-not@npm:8.0.1" dependencies: - cssesc: ^3.0.0 - util-deprecate: ^1.0.2 - checksum: f89163338a1ce3b8ece8e9055cd5a3165e79a15e1c408e18de5ad8f87796b61ec2d48a2902d179ae0c4b5de10fccd3a325a4e660596549b040bc5ad1b465f096 + postcss-selector-parser: ^7.0.0 + peerDependencies: + postcss: ^8.4 + checksum: 28c1f7863ac85016ecd695304ee1eb21b1128eacba333d6d4540fd93691c58ff6329ac323b6a640f2da918e95c7b58e8f534c8b6e2ed016f6e31cdfdc743edbc languageName: node linkType: hard -"postcss-selector-parser@npm:^6.1.1, postcss-selector-parser@npm:^6.1.2": +"postcss-selector-parser@npm:^6.0.11, postcss-selector-parser@npm:^6.0.16, postcss-selector-parser@npm:^6.1.1, postcss-selector-parser@npm:^6.1.2": version: 6.1.2 resolution: "postcss-selector-parser@npm:6.1.2" dependencies: @@ -10102,37 +11614,47 @@ __metadata: languageName: node linkType: hard -"postcss-sort-media-queries@npm:^4.2.1": - version: 4.4.1 - resolution: "postcss-sort-media-queries@npm:4.4.1" +"postcss-selector-parser@npm:^7.0.0": + version: 7.1.0 + resolution: "postcss-selector-parser@npm:7.1.0" + dependencies: + cssesc: ^3.0.0 + util-deprecate: ^1.0.2 + checksum: 1300e7871dd60a5132ee5462cc6e94edd4f3df28462b2495ca9ff025bd83768a908e892a18fde62cae63ff63524641baa6d58c64120f04fe6884b916663ce737 + languageName: node + linkType: hard + +"postcss-sort-media-queries@npm:^5.2.0": + version: 5.2.0 + resolution: "postcss-sort-media-queries@npm:5.2.0" dependencies: - sort-css-media-queries: 2.1.0 + sort-css-media-queries: 2.2.0 peerDependencies: - postcss: ^8.4.16 - checksum: 70b42e479bb1d15d8628678eefefd547d309e33e64262fe437630fe62d8e4b3adcae7f2b48ef8da9d3173576d4af109a9ffa9514573db1281deef324f5ea166f + postcss: ^8.4.23 + checksum: d4a976a64b53234762cc35c06ce97c1684bd7a64ead17e84c2047676c7307945be7c005235e6aac7c4620e1f835d6ba1a7dcf018ab7fe0a47657c62c96ad9f35 languageName: node linkType: hard -"postcss-svgo@npm:^5.1.0": - version: 5.1.0 - resolution: "postcss-svgo@npm:5.1.0" +"postcss-svgo@npm:^6.0.3": + version: 6.0.3 + resolution: "postcss-svgo@npm:6.0.3" dependencies: postcss-value-parser: ^4.2.0 - svgo: ^2.7.0 + svgo: ^3.2.0 peerDependencies: - postcss: ^8.2.15 - checksum: d86eb5213d9f700cf5efe3073799b485fb7cacae0c731db3d7749c9c2b1c9bc85e95e0baeca439d699ff32ea24815fc916c4071b08f67ed8219df229ce1129bd + postcss: ^8.4.31 + checksum: 1a7d1c8dea555884a7791e28ec2c22ea92331731067584ff5a23042a0e615f88fefde04e1140f11c262a728ef9fab6851423b40b9c47f9ae05353bd3c0ff051a languageName: node linkType: hard -"postcss-unique-selectors@npm:^5.1.1": - version: 5.1.1 - resolution: "postcss-unique-selectors@npm:5.1.1" +"postcss-unique-selectors@npm:^6.0.4": + version: 6.0.4 + resolution: "postcss-unique-selectors@npm:6.0.4" dependencies: - postcss-selector-parser: ^6.0.5 + postcss-selector-parser: ^6.0.16 peerDependencies: - postcss: ^8.2.15 - checksum: 637e7b786e8558265775c30400c54b6b3b24d4748923f4a39f16a65fd0e394f564ccc9f0a1d3c0e770618a7637a7502ea1d0d79f731d429cb202255253c23278 + postcss: ^8.4.31 + checksum: b09df9943b4e858e88b30f3d279ce867a0490df806f1f947d286b0a4e95ba923f1229c385e5bf365f4f124f1edccda41ec18ccad4ba8798d829279d6dc971203 languageName: node linkType: hard @@ -10143,16 +11665,16 @@ __metadata: languageName: node linkType: hard -"postcss-zindex@npm:^5.1.0": - version: 5.1.0 - resolution: "postcss-zindex@npm:5.1.0" +"postcss-zindex@npm:^6.0.2": + version: 6.0.2 + resolution: "postcss-zindex@npm:6.0.2" peerDependencies: - postcss: ^8.2.15 - checksum: 8581e0ee552622489dcb9fb9609a3ccc261a67a229ba91a70bd138fe102a2d04cedb14642b82b673d4cac7b559ef32574f2dafde2ff7816eecac024d231c5ead + postcss: ^8.4.31 + checksum: 394119e47b0fb098dc53d1bcf71b5500ab29605fe106526b2e81290bff179174ee00a82a4d4be5a42d4ef4138e8a3d6aabeef3b06cf7cb15b851848c8585d53b languageName: node linkType: hard -"postcss@npm:^8.3.11, postcss@npm:^8.4.14, postcss@npm:^8.4.17, postcss@npm:^8.4.21, postcss@npm:^8.4.47": +"postcss@npm:^8.4.21, postcss@npm:^8.4.24, postcss@npm:^8.4.33, postcss@npm:^8.4.47, postcss@npm:^8.5.4": version: 8.5.6 resolution: "postcss@npm:8.5.6" dependencies: @@ -10170,18 +11692,13 @@ __metadata: languageName: node linkType: hard -"prepend-http@npm:^2.0.0": - version: 2.0.0 - resolution: "prepend-http@npm:2.0.0" - checksum: 7694a9525405447662c1ffd352fcb41b6410c705b739b6f4e3a3e21cf5fdede8377890088e8934436b8b17ba55365a615f153960f30877bf0d0392f9e93503ea - languageName: node - linkType: hard - "prettier-plugin-tailwindcss@npm:^0.6.0": - version: 0.6.13 - resolution: "prettier-plugin-tailwindcss@npm:0.6.13" + version: 0.6.14 + resolution: "prettier-plugin-tailwindcss@npm:0.6.14" peerDependencies: "@ianvs/prettier-plugin-sort-imports": "*" + "@prettier/plugin-hermes": "*" + "@prettier/plugin-oxc": "*" "@prettier/plugin-pug": "*" "@shopify/prettier-plugin-liquid": "*" "@trivago/prettier-plugin-sort-imports": "*" @@ -10201,6 +11718,10 @@ __metadata: peerDependenciesMeta: "@ianvs/prettier-plugin-sort-imports": optional: true + "@prettier/plugin-hermes": + optional: true + "@prettier/plugin-oxc": + optional: true "@prettier/plugin-pug": optional: true "@shopify/prettier-plugin-liquid": @@ -10231,7 +11752,7 @@ __metadata: optional: true prettier-plugin-svelte: optional: true - checksum: 243ba6ca057c3e3a3a6be289151ada6adc8c35827a376efe702f724e9e41e5924200e31b8ee657fdb7841d4b46afcff001a329ca28403632856c7b51117b66d5 + checksum: 2196fbebe8a4192fa142aa4ff3d72e6b0c88b79bfce70e3416e67b22a4cbc2c9cf403f0fcc4b3e97a349ff82efa3b0c49547d5fe4ad9ade624fe506e02b51661 languageName: node linkType: hard @@ -10261,7 +11782,7 @@ __metadata: languageName: node linkType: hard -"prism-react-renderer@npm:^1.0.1, prism-react-renderer@npm:^1.3.5": +"prism-react-renderer@npm:^1.3.5": version: 1.3.5 resolution: "prism-react-renderer@npm:1.3.5" peerDependencies: @@ -10270,10 +11791,29 @@ __metadata: languageName: node linkType: hard -"prismjs@npm:^1.28.0": - version: 1.29.0 - resolution: "prismjs@npm:1.29.0" - checksum: 007a8869d4456ff8049dc59404e32d5666a07d99c3b0e30a18bd3b7676dfa07d1daae9d0f407f20983865fd8da56de91d09cb08e6aa61f5bc420a27c0beeaf93 +"prism-react-renderer@npm:^2.3.0, prism-react-renderer@npm:^2.4.0": + version: 2.4.1 + resolution: "prism-react-renderer@npm:2.4.1" + dependencies: + "@types/prismjs": ^1.26.0 + clsx: ^2.0.0 + peerDependencies: + react: ">=16.0.0" + checksum: ddd5490a1335629addde9535db7872f0aee8dbce048818dd6e4c3972c779780af13d669c12d3f2fbb54c5b22d1578e50945099ef1a24dd445f33774e87d85e6e + languageName: node + linkType: hard + +"prismjs@npm:^1.29.0": + version: 1.30.0 + resolution: "prismjs@npm:1.30.0" + checksum: a68eddd4c5f1c506badb5434b0b28a7cc2479ed1df91bc4218e6833c7971ef40c50ec481ea49749ac964256acb78d8b66a6bd11554938e8998e46c18b5f9a580 + languageName: node + linkType: hard + +"proc-log@npm:^5.0.0": + version: 5.0.0 + resolution: "proc-log@npm:5.0.0" + checksum: c78b26ecef6d5cce4a7489a1e9923d7b4b1679028c8654aef0463b27f4a90b0946cd598f55799da602895c52feb085ec76381d007ab8dcceebd40b89c2f9dfe0 languageName: node linkType: hard @@ -10294,15 +11834,6 @@ __metadata: languageName: node linkType: hard -"promise@npm:^7.1.1": - version: 7.3.1 - resolution: "promise@npm:7.3.1" - dependencies: - asap: ~2.0.3 - checksum: 475bb069130179fbd27ed2ab45f26d8862376a137a57314cf53310bdd85cc986a826fd585829be97ebc0aaf10e9d8e68be1bfe5a4a0364144b1f9eedfa940cf1 - languageName: node - linkType: hard - "prompts@npm:^2.4.2": version: 2.4.2 resolution: "prompts@npm:2.4.2" @@ -10313,7 +11844,7 @@ __metadata: languageName: node linkType: hard -"prop-types@npm:^15.0.0, prop-types@npm:^15.5.8, prop-types@npm:^15.6.2, prop-types@npm:^15.7.2": +"prop-types@npm:^15.0.0, prop-types@npm:^15.6.2, prop-types@npm:^15.7.2": version: 15.8.1 resolution: "prop-types@npm:15.8.1" dependencies: @@ -10324,19 +11855,24 @@ __metadata: languageName: node linkType: hard -"property-information@npm:^5.0.0, property-information@npm:^5.3.0": - version: 5.6.0 - resolution: "property-information@npm:5.6.0" - dependencies: - xtend: ^4.0.0 - checksum: fcf87c6542e59a8bbe31ca0b3255a4a63ac1059b01b04469680288998bcfa97f341ca989566adbb63975f4d85339030b82320c324a511532d390910d1c583893 +"property-information@npm:^6.0.0": + version: 6.5.0 + resolution: "property-information@npm:6.5.0" + checksum: 6e55664e2f64083b715011e5bafaa1e694faf36986c235b0907e95d09259cc37c38382e3cc94a4c3f56366e05336443db12c8a0f0968a8c0a1b1416eebfc8f53 languageName: node linkType: hard -"property-information@npm:^6.0.0": - version: 6.3.0 - resolution: "property-information@npm:6.3.0" - checksum: bf0a15dec097fd4324a42163cabd96b90819e48ef0d8d98756ef0420b2c579bf33646fe0b6e04aa9e79f5a2b5b5860ef11655a79cd8969d8eda58df23c4f96c9 +"property-information@npm:^7.0.0": + version: 7.1.0 + resolution: "property-information@npm:7.1.0" + checksum: 3875161d204bac89d75181f6d3ebc3ecaeb2699b4e2ecfcf5452201d7cdd275168c6742d7ff8cec5ab0c342fae72369ac705e1f8e9680a9acd911692e80dfb88 + languageName: node + linkType: hard + +"proto-list@npm:~1.2.1": + version: 1.2.4 + resolution: "proto-list@npm:1.2.4" + checksum: 4d4826e1713cbfa0f15124ab0ae494c91b597a3c458670c9714c36e8baddf5a6aad22842776f2f5b137f259c8533e741771445eb8df82e861eea37a6eaba03f7 languageName: node linkType: hard @@ -10350,52 +11886,28 @@ __metadata: languageName: node linkType: hard -"pump@npm:^3.0.0": - version: 3.0.0 - resolution: "pump@npm:3.0.0" - dependencies: - end-of-stream: ^1.1.0 - once: ^1.3.1 - checksum: e42e9229fba14732593a718b04cb5e1cfef8254544870997e0ecd9732b189a48e1256e4e5478148ecb47c8511dca2b09eae56b4d0aad8009e6fac8072923cfc9 - languageName: node - linkType: hard - -"punycode@npm:^1.3.2": - version: 1.4.1 - resolution: "punycode@npm:1.4.1" - checksum: fa6e698cb53db45e4628559e557ddaf554103d2a96a1d62892c8f4032cd3bc8871796cae9eabc1bc700e2b6677611521ce5bb1d9a27700086039965d0cf34518 - languageName: node - linkType: hard - "punycode@npm:^2.1.0": - version: 2.3.0 - resolution: "punycode@npm:2.3.0" - checksum: 39f760e09a2a3bbfe8f5287cf733ecdad69d6af2fe6f97ca95f24b8921858b91e9ea3c9eeec6e08cede96181b3bb33f95c6ffd8c77e63986508aa2e8159fa200 + version: 2.3.1 + resolution: "punycode@npm:2.3.1" + checksum: bb0a0ceedca4c3c57a9b981b90601579058903c62be23c5e8e843d2c2d4148a3ecf029d5133486fb0e1822b098ba8bba09e89d6b21742d02fa26bda6441a6fb2 languageName: node linkType: hard -"pupa@npm:^2.1.1": - version: 2.1.1 - resolution: "pupa@npm:2.1.1" +"pupa@npm:^3.1.0": + version: 3.1.0 + resolution: "pupa@npm:3.1.0" dependencies: - escape-goat: ^2.0.0 - checksum: 49529e50372ffdb0cccf0efa0f3b3cb0a2c77805d0d9cc2725bd2a0f6bb414631e61c93a38561b26be1259550b7bb6c2cb92315aa09c8bf93f3bdcb49f2b2fb7 - languageName: node - linkType: hard - -"pure-color@npm:^1.2.0": - version: 1.3.0 - resolution: "pure-color@npm:1.3.0" - checksum: 646d8bed6e6eab89affdd5e2c11f607a85b631a7fb03c061dfa658eb4dc4806881a15feed2ac5fd8c0bad8c00c632c640d5b1cb8b9a972e6e947393a1329371b + escape-goat: ^4.0.0 + checksum: 0e4f4ab6bbdce600fa6d23b1833f1af57b2641246ff4cbe10f9d66e4e5479b0de2864a88d5bd629eef59524eda3c6680726acd7f3f873d9ed46b7f095d0bb5f6 languageName: node linkType: hard -"qs@npm:6.11.0": - version: 6.11.0 - resolution: "qs@npm:6.11.0" +"qs@npm:6.13.0": + version: 6.13.0 + resolution: "qs@npm:6.13.0" dependencies: - side-channel: ^1.0.4 - checksum: 6e1f29dd5385f7488ec74ac7b6c92f4d09a90408882d0c208414a34dd33badc1a621019d4c799a3df15ab9b1d0292f97c1dd71dc7c045e69f81a8064e5af7297 + side-channel: ^1.0.6 + checksum: e9404dc0fc2849245107108ce9ec2766cde3be1b271de0bf1021d049dc5b98d1a2901e67b431ac5509f865420a7ed80b7acb3980099fe1c118a1c5d2e1432ad8 languageName: node linkType: hard @@ -10406,12 +11918,10 @@ __metadata: languageName: node linkType: hard -"queue@npm:6.0.2": - version: 6.0.2 - resolution: "queue@npm:6.0.2" - dependencies: - inherits: ~2.0.3 - checksum: ebc23639248e4fe40a789f713c20548e513e053b3dc4924b6cb0ad741e3f264dcff948225c8737834dd4f9ec286dbc06a1a7c13858ea382d9379f4303bcc0916 +"quick-lru@npm:^5.1.1": + version: 5.1.1 + resolution: "quick-lru@npm:5.1.1" + checksum: a516faa25574be7947969883e6068dbe4aa19e8ef8e8e0fd96cddd6d36485e9106d85c0041a27153286b0770b381328f4072aa40d3b18a19f5f7d2b78b94b5ed languageName: node linkType: hard @@ -10438,93 +11948,41 @@ __metadata: languageName: node linkType: hard -"raw-body@npm:2.5.1": - version: 2.5.1 - resolution: "raw-body@npm:2.5.1" +"raw-body@npm:2.5.2": + version: 2.5.2 + resolution: "raw-body@npm:2.5.2" dependencies: bytes: 3.1.2 http-errors: 2.0.0 iconv-lite: 0.4.24 unpipe: 1.0.0 - checksum: 5362adff1575d691bb3f75998803a0ffed8c64eabeaa06e54b4ada25a0cd1b2ae7f4f5ec46565d1bec337e08b5ac90c76eaa0758de6f72a633f025d754dec29e + checksum: ba1583c8d8a48e8fbb7a873fdbb2df66ea4ff83775421bfe21ee120140949ab048200668c47d9ae3880012f6e217052690628cf679ddfbd82c9fc9358d574676 languageName: node linkType: hard -"rc@npm:1.2.8, rc@npm:^1.2.8": +"rc@npm:1.2.8": version: 1.2.8 resolution: "rc@npm:1.2.8" dependencies: deep-extend: ^0.6.0 - ini: ~1.3.0 - minimist: ^1.2.0 - strip-json-comments: ~2.0.1 - bin: - rc: ./cli.js - checksum: 2e26e052f8be2abd64e6d1dabfbd7be03f80ec18ccbc49562d31f617d0015fbdbcf0f9eed30346ea6ab789e0fdfe4337f033f8016efdbee0df5354751842080e - languageName: node - linkType: hard - -"react-base16-styling@npm:^0.6.0": - version: 0.6.0 - resolution: "react-base16-styling@npm:0.6.0" - dependencies: - base16: ^1.0.0 - lodash.curry: ^4.0.1 - lodash.flow: ^3.3.0 - pure-color: ^1.2.0 - checksum: 00a12dddafc8a9025cca933b0dcb65fca41c81fa176d1fc3a6a9d0242127042e2c0a604f4c724a3254dd2c6aeb5ef55095522ff22f5462e419641c1341a658e4 - languageName: node - linkType: hard - -"react-dev-utils@npm:^12.0.1": - version: 12.0.1 - resolution: "react-dev-utils@npm:12.0.1" - dependencies: - "@babel/code-frame": ^7.16.0 - address: ^1.1.2 - browserslist: ^4.18.1 - chalk: ^4.1.2 - cross-spawn: ^7.0.3 - detect-port-alt: ^1.1.6 - escape-string-regexp: ^4.0.0 - filesize: ^8.0.6 - find-up: ^5.0.0 - fork-ts-checker-webpack-plugin: ^6.5.0 - global-modules: ^2.0.0 - globby: ^11.0.4 - gzip-size: ^6.0.0 - immer: ^9.0.7 - is-root: ^2.1.0 - loader-utils: ^3.2.0 - open: ^8.4.0 - pkg-up: ^3.1.0 - prompts: ^2.4.2 - react-error-overlay: ^6.0.11 - recursive-readdir: ^2.2.2 - shell-quote: ^1.7.3 - strip-ansi: ^6.0.1 - text-table: ^0.2.0 - checksum: 2c6917e47f03d9595044770b0f883a61c6b660fcaa97b8ba459a1d57c9cca9aa374cd51296b22d461ff5e432105dbe6f04732dab128e52729c79239e1c23ab56 + ini: ~1.3.0 + minimist: ^1.2.0 + strip-json-comments: ~2.0.1 + bin: + rc: ./cli.js + checksum: 2e26e052f8be2abd64e6d1dabfbd7be03f80ec18ccbc49562d31f617d0015fbdbcf0f9eed30346ea6ab789e0fdfe4337f033f8016efdbee0df5354751842080e languageName: node linkType: hard -"react-dom@npm:^17.0.2": - version: 17.0.2 - resolution: "react-dom@npm:17.0.2" +"react-dom@npm:^18.0.0": + version: 18.3.1 + resolution: "react-dom@npm:18.3.1" dependencies: loose-envify: ^1.1.0 - object-assign: ^4.1.1 - scheduler: ^0.20.2 + scheduler: ^0.23.2 peerDependencies: - react: 17.0.2 - checksum: 1c1eaa3bca7c7228d24b70932e3d7c99e70d1d04e13bb0843bbf321582bc25d7961d6b8a6978a58a598af2af496d1cedcfb1bf65f6b0960a0a8161cb8dab743c - languageName: node - linkType: hard - -"react-error-overlay@npm:^6.0.11": - version: 6.0.11 - resolution: "react-error-overlay@npm:6.0.11" - checksum: ce7b44c38fadba9cedd7c095cf39192e632daeccf1d0747292ed524f17dcb056d16bc197ddee5723f9dd888f0b9b19c3b486c430319e30504289b9296f2d2c42 + react: ^18.3.1 + checksum: 298954ecd8f78288dcaece05e88b570014d8f6dce5db6f66e6ee91448debeb59dcd31561dddb354eee47e6c1bb234669459060deb238ed0213497146e555a0b9 languageName: node linkType: hard @@ -10535,9 +11993,9 @@ __metadata: languageName: node linkType: hard -"react-helmet-async@npm:*, react-helmet-async@npm:^1.3.0": +"react-helmet-async@npm:@slorber/react-helmet-async@1.3.0": version: 1.3.0 - resolution: "react-helmet-async@npm:1.3.0" + resolution: "@slorber/react-helmet-async@npm:1.3.0" dependencies: "@babel/runtime": ^7.12.5 invariant: ^2.2.4 @@ -10545,9 +12003,9 @@ __metadata: react-fast-compare: ^3.2.0 shallowequal: ^1.1.0 peerDependencies: - react: ^16.6.0 || ^17.0.0 || ^18.0.0 - react-dom: ^16.6.0 || ^17.0.0 || ^18.0.0 - checksum: 7ca7e47f8af14ea186688b512a87ab912bf6041312b297f92516341b140b3f0f8aedf5a44d226d99e69ed067b0cc106e38aeb9c9b738ffcc63d10721c844db90 + react: ^16.6.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 + react-dom: ^16.6.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 + checksum: 2bd080035aa4145761cc08caa2a64f1d8e867ddda71967936b1325f84c5bc7161ac77c1095818952bc5bb09c78ffbd594e7d0508d54255c5bfbc15e3769ef538 languageName: node linkType: hard @@ -10559,46 +12017,32 @@ __metadata: linkType: hard "react-is@npm:^18.0.0": - version: 18.2.0 - resolution: "react-is@npm:18.2.0" - checksum: e72d0ba81b5922759e4aff17e0252bd29988f9642ed817f56b25a3e217e13eea8a7f2322af99a06edb779da12d5d636e9fda473d620df9a3da0df2a74141d53e + version: 18.3.1 + resolution: "react-is@npm:18.3.1" + checksum: e20fe84c86ff172fc8d898251b7cc2c43645d108bf96d0b8edf39b98f9a2cae97b40520ee7ed8ee0085ccc94736c4886294456033304151c3f94978cec03df21 languageName: node linkType: hard -"react-json-view@npm:^1.21.3": - version: 1.21.3 - resolution: "react-json-view@npm:1.21.3" - dependencies: - flux: ^4.0.1 - react-base16-styling: ^0.6.0 - react-lifecycles-compat: ^3.0.4 - react-textarea-autosize: ^8.3.2 +"react-json-view-lite@npm:^2.3.0": + version: 2.4.1 + resolution: "react-json-view-lite@npm:2.4.1" peerDependencies: - react: ^17.0.0 || ^16.3.0 || ^15.5.4 - react-dom: ^17.0.0 || ^16.3.0 || ^15.5.4 - checksum: 5718bcd9210ad5b06eb9469cf8b9b44be9498845a7702e621343618e8251f26357e6e1c865532cf170db6165df1cb30202787e057309d8848c220bc600ec0d1a - languageName: node - linkType: hard - -"react-lifecycles-compat@npm:^3.0.4": - version: 3.0.4 - resolution: "react-lifecycles-compat@npm:3.0.4" - checksum: a904b0fc0a8eeb15a148c9feb7bc17cec7ef96e71188280061fc340043fd6d8ee3ff233381f0e8f95c1cf926210b2c4a31f38182c8f35ac55057e453d6df204f + react: ^18.0.0 || ^19.0.0 + checksum: 0b7397e190c67410dc07b45aae78bc675638ca5e48da3e7c041860556d4257eaf8424f76819d9591fceedd86c15d99829e723b412e224bc354c7eff61b3bf755 languageName: node linkType: hard -"react-live@npm:2.2.3": - version: 2.2.3 - resolution: "react-live@npm:2.2.3" +"react-live@npm:^4.1.6": + version: 4.1.8 + resolution: "react-live@npm:4.1.8" dependencies: - buble: 0.19.6 - core-js: ^2.4.1 - dom-iterator: ^1.0.0 - prism-react-renderer: ^1.0.1 - prop-types: ^15.5.8 - react-simple-code-editor: ^0.10.0 - unescape: ^1.0.1 - checksum: 2fbba62ac0647e18be7664a8e483d7bfede8c206e173e36042ff5dadbfd0359ae7d54d479dc1c25631cf531f99c03932749311ee6fd2a9d417ec18e5d63e6ec9 + prism-react-renderer: ^2.4.0 + sucrase: ^3.35.0 + use-editable: ^2.3.3 + peerDependencies: + react: ">=18.0.0" + react-dom: ">=18.0.0" + checksum: f5d44f7a8dea44eb1ed26a9c4b5f6c7c70031bd210946753c1250e31e2272bd4a1e6b8c10371ced4fa782c563a7c546526f8c3ceb1dbda833c814569cc67b140 languageName: node linkType: hard @@ -10614,6 +12058,17 @@ __metadata: languageName: node linkType: hard +"react-loadable@npm:@docusaurus/react-loadable@6.0.0": + version: 6.0.0 + resolution: "@docusaurus/react-loadable@npm:6.0.0" + dependencies: + "@types/react": "*" + peerDependencies: + react: "*" + checksum: 4c32061b2fc10689d5d8ba11ead71b69e4c8a55fcfeafb551a6747b1a7b496c4f2d8dbb5d023f5cafc2a9aea9d14582bdb324d11e6f9b8c3049d45b74439203f + languageName: node + linkType: hard + "react-markdown@npm:^8.0.5": version: 8.0.7 resolution: "react-markdown@npm:8.0.7" @@ -10659,7 +12114,7 @@ __metadata: languageName: node linkType: hard -"react-router-dom@npm:^5.3.3": +"react-router-dom@npm:^5.3.4": version: 5.3.4 resolution: "react-router-dom@npm:5.3.4" dependencies: @@ -10676,7 +12131,7 @@ __metadata: languageName: node linkType: hard -"react-router@npm:5.3.4, react-router@npm:^5.3.3": +"react-router@npm:5.3.4, react-router@npm:^5.3.4": version: 5.3.4 resolution: "react-router@npm:5.3.4" dependencies: @@ -10695,36 +12150,12 @@ __metadata: languageName: node linkType: hard -"react-simple-code-editor@npm:^0.10.0": - version: 0.10.0 - resolution: "react-simple-code-editor@npm:0.10.0" - peerDependencies: - react: ^16.0.0 - react-dom: ^16.0.0 - checksum: d9f448c5d1ba1b630ad6d9d775b5fa651ad1144eb5850fed3831b97d9da6da1daced37301c09946ff3a586f1f0f488f314cc81b744a1b60a343f30517c0767e9 - languageName: node - linkType: hard - -"react-textarea-autosize@npm:^8.3.2": - version: 8.5.3 - resolution: "react-textarea-autosize@npm:8.5.3" - dependencies: - "@babel/runtime": ^7.20.13 - use-composed-ref: ^1.3.0 - use-latest: ^1.2.1 - peerDependencies: - react: ^16.8.0 || ^17.0.0 || ^18.0.0 - checksum: b317c3763f37a89621bbafd0e6e2d068e7876790a5ae77f497adfd6ba9334ceea138c8a0b7d907bae0f79c765cb24e8b2ca2b8033b4144c0bce28571a3658921 - languageName: node - linkType: hard - -"react@npm:^17.0.2": - version: 17.0.2 - resolution: "react@npm:17.0.2" +"react@npm:^18.0.0": + version: 18.3.1 + resolution: "react@npm:18.3.1" dependencies: loose-envify: ^1.1.0 - object-assign: ^4.1.1 - checksum: b254cc17ce3011788330f7bbf383ab653c6848902d7936a87b09d835d091e3f295f7e9dd1597c6daac5dc80f90e778c8230218ba8ad599f74adcc11e33b9d61b + checksum: a27bcfa8ff7c15a1e50244ad0d0c1cb2ad4375eeffefd266a64889beea6f6b64c4966c9b37d14ee32d6c9fcd5aa6ba183b6988167ab4d127d13e7cb5b386a376 languageName: node linkType: hard @@ -10752,7 +12183,7 @@ __metadata: languageName: node linkType: hard -"readable-stream@npm:^3.0.6, readable-stream@npm:^3.6.0": +"readable-stream@npm:^3.0.6": version: 3.6.2 resolution: "readable-stream@npm:3.6.2" dependencies: @@ -10772,37 +12203,60 @@ __metadata: languageName: node linkType: hard -"reading-time@npm:^1.5.0": - version: 1.5.0 - resolution: "reading-time@npm:1.5.0" - checksum: e27bc5a70ba0f4ac337896b18531b914d38f4bee67cbad48029d0c11dd0a7a847b2a6bba895ab7ce2ad3e7ecb86912bdc477d8fa2d48405a3deda964be54d09b +"recma-build-jsx@npm:^1.0.0": + version: 1.0.0 + resolution: "recma-build-jsx@npm:1.0.0" + dependencies: + "@types/estree": ^1.0.0 + estree-util-build-jsx: ^3.0.0 + vfile: ^6.0.0 + checksum: ba82fe08efdf5ecd178ab76a08a4acac792a41d9f38aea99f93cb3d9e577ba8952620c547e730ba6717c13efa08fdb3dfe893bccfa9717f5a81d3fb2ab20c572 languageName: node linkType: hard -"rechoir@npm:^0.6.2": - version: 0.6.2 - resolution: "rechoir@npm:0.6.2" +"recma-jsx@npm:^1.0.0": + version: 1.0.0 + resolution: "recma-jsx@npm:1.0.0" dependencies: - resolve: ^1.1.6 - checksum: fe76bf9c21875ac16e235defedd7cbd34f333c02a92546142b7911a0f7c7059d2e16f441fe6fb9ae203f459c05a31b2bcf26202896d89e390eda7514d5d2702b + acorn-jsx: ^5.0.0 + estree-util-to-js: ^2.0.0 + recma-parse: ^1.0.0 + recma-stringify: ^1.0.0 + unified: ^11.0.0 + checksum: bc7e3f744e82c9826ddf6fdf8933351b59f0663409a51abe0f3179380584b732f981c16e15c653e60c1e1cc366d4eb9b38e37832a241ec2247062997846e7eef languageName: node linkType: hard -"recursive-readdir@npm:^2.2.2": - version: 2.2.3 - resolution: "recursive-readdir@npm:2.2.3" +"recma-parse@npm:^1.0.0": + version: 1.0.0 + resolution: "recma-parse@npm:1.0.0" dependencies: - minimatch: ^3.0.5 - checksum: 88ec96e276237290607edc0872b4f9842837b95cfde0cdbb1e00ba9623dfdf3514d44cdd14496ab60a0c2dd180a6ef8a3f1c34599e6cf2273afac9b72a6fb2b5 + "@types/estree": ^1.0.0 + esast-util-from-js: ^2.0.0 + unified: ^11.0.0 + vfile: ^6.0.0 + checksum: 676b2097a63ba444985a61af51c2628a546a2537a9ca036ed2249a627fb096f3373139765388b60164e6f5a50c819146a3660351e3f993a360ef107f2ab1c6f8 + languageName: node + linkType: hard + +"recma-stringify@npm:^1.0.0": + version: 1.0.0 + resolution: "recma-stringify@npm:1.0.0" + dependencies: + "@types/estree": ^1.0.0 + estree-util-to-js: ^2.0.0 + unified: ^11.0.0 + vfile: ^6.0.0 + checksum: 3a4f80fe0f6bc11fefa71782dfedb43c28b42518dea450cd1b1591057d9d570f83c85d645bf5ed6da2e47de15a021172c076a8ff4675799855d9f9436cec3c82 languageName: node linkType: hard -"regenerate-unicode-properties@npm:^10.1.0": - version: 10.1.1 - resolution: "regenerate-unicode-properties@npm:10.1.1" +"regenerate-unicode-properties@npm:^10.2.0": + version: 10.2.0 + resolution: "regenerate-unicode-properties@npm:10.2.0" dependencies: regenerate: ^1.4.2 - checksum: b80958ef40f125275824c2c47d5081dfaefebd80bff26c76761e9236767c748a4a95a69c053fe29d2df881177f2ca85df4a71fe70a82360388b31159ef19adcf + checksum: d5c5fc13f8b8d7e16e791637a4bfef741f8d70e267d51845ee7d5404a32fa14c75b181c4efba33e4bff8b0000a2f13e9773593713dfe5b66597df4259275ce63 languageName: node linkType: hard @@ -10822,23 +12276,7 @@ __metadata: languageName: node linkType: hard -"regenerator-runtime@npm:^0.14.0": - version: 0.14.0 - resolution: "regenerator-runtime@npm:0.14.0" - checksum: 1c977ad82a82a4412e4f639d65d22be376d3ebdd30da2c003eeafdaaacd03fc00c2320f18120007ee700900979284fc78a9f00da7fb593f6e6eeebc673fba9a3 - languageName: node - linkType: hard - -"regenerator-transform@npm:^0.15.2": - version: 0.15.2 - resolution: "regenerator-transform@npm:0.15.2" - dependencies: - "@babel/runtime": ^7.8.4 - checksum: 20b6f9377d65954980fe044cfdd160de98df415b4bff38fbade67b3337efaf078308c4fed943067cd759827cc8cfeca9cb28ccda1f08333b85d6a2acbd022c27 - languageName: node - linkType: hard - -"regexpu-core@npm:^4.2.0, regexpu-core@npm:^4.5.4": +"regexpu-core@npm:^4.5.4": version: 4.8.0 resolution: "regexpu-core@npm:4.8.0" dependencies: @@ -10852,35 +12290,35 @@ __metadata: languageName: node linkType: hard -"regexpu-core@npm:^5.3.1": - version: 5.3.2 - resolution: "regexpu-core@npm:5.3.2" +"regexpu-core@npm:^6.2.0": + version: 6.2.0 + resolution: "regexpu-core@npm:6.2.0" dependencies: - "@babel/regjsgen": ^0.8.0 regenerate: ^1.4.2 - regenerate-unicode-properties: ^10.1.0 - regjsparser: ^0.9.1 + regenerate-unicode-properties: ^10.2.0 + regjsgen: ^0.8.0 + regjsparser: ^0.12.0 unicode-match-property-ecmascript: ^2.0.0 unicode-match-property-value-ecmascript: ^2.1.0 - checksum: 95bb97088419f5396e07769b7de96f995f58137ad75fac5811fb5fe53737766dfff35d66a0ee66babb1eb55386ef981feaef392f9df6d671f3c124812ba24da2 + checksum: 67d3c4a3f6c99bc80b5d690074a27e6f675be1c1739f8a9acf028fbc36f1a468472574ea65e331e217995198ba4404d7878f3cb3739a73552dd3c70d3fb7f8e6 languageName: node linkType: hard -"registry-auth-token@npm:^4.0.0": - version: 4.2.2 - resolution: "registry-auth-token@npm:4.2.2" +"registry-auth-token@npm:^5.0.1": + version: 5.1.0 + resolution: "registry-auth-token@npm:5.1.0" dependencies: - rc: 1.2.8 - checksum: c5030198546ecfdcbcb0722cbc3e260c4f5f174d8d07bdfedd4620e79bfdf17a2db735aa230d600bd388fce6edd26c0a9ed2eb7e9b4641ec15213a28a806688b + "@pnpm/npm-conf": ^2.1.0 + checksum: 620c897167e2e0e9308b9cdd0288f70d651d9ec554348c39a96d398bb91d444e8cb4b3c0dc1e19d4a8f1c10ade85163baf606e5c09959baa31179bdfb1f7434e languageName: node linkType: hard -"registry-url@npm:^5.0.0": - version: 5.1.0 - resolution: "registry-url@npm:5.1.0" +"registry-url@npm:^6.0.0": + version: 6.0.1 + resolution: "registry-url@npm:6.0.1" dependencies: - rc: ^1.2.8 - checksum: bcea86c84a0dbb66467b53187fadebfea79017cddfb4a45cf27530d7275e49082fe9f44301976eb0164c438e395684bcf3dae4819b36ff9d1640d8cc60c73df9 + rc: 1.2.8 + checksum: 33712aa1b489aab7aba2191c1cdadfdd71f5bf166d4792d81744a6be332c160bd7d9273af8269d8a01284b9562f14a5b31b7abcf7ad9306c44887ecff51c89ab languageName: node linkType: hard @@ -10891,6 +12329,24 @@ __metadata: languageName: node linkType: hard +"regjsgen@npm:^0.8.0": + version: 0.8.0 + resolution: "regjsgen@npm:0.8.0" + checksum: a1d925ff14a4b2be774e45775ee6b33b256f89c42d480e6d85152d2133f18bd3d6af662161b226fa57466f7efec367eaf7ccd2a58c0ec2a1306667ba2ad07b0d + languageName: node + linkType: hard + +"regjsparser@npm:^0.12.0": + version: 0.12.0 + resolution: "regjsparser@npm:0.12.0" + dependencies: + jsesc: ~3.0.2 + bin: + regjsparser: bin/parser + checksum: 094b55b0ab3e1fd58f8ce5132a1d44dab08d91f7b0eea4132b0157b303ebb8ded20a9cbd893d25402d2aeddb23fac1f428ab4947b295d6fa51dd1c334a9e76f0 + languageName: node + linkType: hard + "regjsparser@npm:^0.7.0": version: 0.7.0 resolution: "regjsparser@npm:0.7.0" @@ -10902,14 +12358,25 @@ __metadata: languageName: node linkType: hard -"regjsparser@npm:^0.9.1": - version: 0.9.1 - resolution: "regjsparser@npm:0.9.1" +"rehype-raw@npm:^7.0.0": + version: 7.0.0 + resolution: "rehype-raw@npm:7.0.0" + dependencies: + "@types/hast": ^3.0.0 + hast-util-raw: ^9.0.0 + vfile: ^6.0.0 + checksum: f9e28dcbf4c6c7d91a97c10a840310f18ef3268aa45abb3e0428b6b191ff3c4fa8f753b910d768588a2dac5c7da7e557b4ddc3f1b6cd252e8d20cb62d60c65ed + languageName: node + linkType: hard + +"rehype-recma@npm:^1.0.0": + version: 1.0.0 + resolution: "rehype-recma@npm:1.0.0" dependencies: - jsesc: ~0.5.0 - bin: - regjsparser: bin/parser - checksum: 5e1b76afe8f1d03c3beaf9e0d935dd467589c3625f6d65fb8ffa14f224d783a0fed4bf49c2c1b8211043ef92b6117313419edf055a098ed8342e340586741afc + "@types/estree": ^1.0.0 + "@types/hast": ^3.0.0 + hast-util-to-estree: ^3.0.0 + checksum: d3d544ad4a18485ec6b03a194b40473f96e2169c63d6a8ee3ce9af5e87b946c308fb9549b53e010c7dd39740337e387bb1a8856ce1b47f3e957b696f1d5b2d0c languageName: node linkType: hard @@ -10920,61 +12387,64 @@ __metadata: languageName: node linkType: hard -"remark-emoji@npm:^2.2.0": - version: 2.2.0 - resolution: "remark-emoji@npm:2.2.0" +"remark-directive@npm:^3.0.0": + version: 3.0.1 + resolution: "remark-directive@npm:3.0.1" dependencies: - emoticon: ^3.2.0 - node-emoji: ^1.10.0 - unist-util-visit: ^2.0.3 - checksum: 638d4be72eb4110a447f389d4b8c454921f188c0acabf1b6579f3ddaa301ee91010173d6eebd975ea622ae3de7ed4531c0315a4ffd4f9653d80c599ef9ec21a8 + "@types/mdast": ^4.0.0 + mdast-util-directive: ^3.0.0 + micromark-extension-directive: ^3.0.0 + unified: ^11.0.0 + checksum: e7f273199fbb1c6946863ca3f8293791ee8fa997e373cd20da67d02fdb6a534c728212a93eaf3c9354b6c4416a56ae83098b35554e1e4ed7dca770c9baf69455 languageName: node linkType: hard -"remark-footnotes@npm:2.0.0": - version: 2.0.0 - resolution: "remark-footnotes@npm:2.0.0" - checksum: f2f87ffd6fe25892373c7164d6584a7cb03ab0ea4f186af493a73df519e24b72998a556e7f16cb996f18426cdb80556b95ff252769e252cf3ccba0fd2ca20621 +"remark-emoji@npm:^4.0.0": + version: 4.0.1 + resolution: "remark-emoji@npm:4.0.1" + dependencies: + "@types/mdast": ^4.0.2 + emoticon: ^4.0.1 + mdast-util-find-and-replace: ^3.0.1 + node-emoji: ^2.1.0 + unified: ^11.0.4 + checksum: 2c02d8c0b694535a9f0c4fe39180cb89a8fbd07eb873c94842c34dfde566b8a6703df9d28fe175a8c28584f96252121de722862baa756f2d875f2f1a4352c1f4 languageName: node linkType: hard -"remark-mdx@npm:1.6.22": - version: 1.6.22 - resolution: "remark-mdx@npm:1.6.22" +"remark-frontmatter@npm:^5.0.0": + version: 5.0.0 + resolution: "remark-frontmatter@npm:5.0.0" dependencies: - "@babel/core": 7.12.9 - "@babel/helper-plugin-utils": 7.10.4 - "@babel/plugin-proposal-object-rest-spread": 7.12.1 - "@babel/plugin-syntax-jsx": 7.12.1 - "@mdx-js/util": 1.6.22 - is-alphabetical: 1.0.4 - remark-parse: 8.0.3 - unified: 9.2.0 - checksum: 45e62f8a821c37261f94448d54f295de1c5c393f762ff96cd4d4b730715037fafeb6c89ef94adf6a10a09edfa72104afe1431b93b5ae5e40ce2a7677e133c3d9 + "@types/mdast": ^4.0.0 + mdast-util-frontmatter: ^2.0.0 + micromark-extension-frontmatter: ^2.0.0 + unified: ^11.0.0 + checksum: b36e11d528d1d0172489c74ce7961bb6073f7272e71ea1349f765fc79c4246a758aef949174d371a088c48e458af776fcfbb3b043c49cd1120ca8239aeafe16a languageName: node linkType: hard -"remark-parse@npm:8.0.3": - version: 8.0.3 - resolution: "remark-parse@npm:8.0.3" - dependencies: - ccount: ^1.0.0 - collapse-white-space: ^1.0.2 - is-alphabetical: ^1.0.0 - is-decimal: ^1.0.0 - is-whitespace-character: ^1.0.0 - is-word-character: ^1.0.0 - markdown-escapes: ^1.0.0 - parse-entities: ^2.0.0 - repeat-string: ^1.5.4 - state-toggle: ^1.0.0 - trim: 0.0.1 - trim-trailing-lines: ^1.0.0 - unherit: ^1.0.4 - unist-util-remove-position: ^2.0.0 - vfile-location: ^3.0.0 - xtend: ^4.0.1 - checksum: 2dfea250e7606ddfc9e223b9f41e0b115c5c701be4bd35181beaadd46ee59816bc00aadc6085a420f8df00b991ada73b590ea7fd34ace14557de4a0a41805be5 +"remark-gfm@npm:^4.0.0": + version: 4.0.1 + resolution: "remark-gfm@npm:4.0.1" + dependencies: + "@types/mdast": ^4.0.0 + mdast-util-gfm: ^3.0.0 + micromark-extension-gfm: ^3.0.0 + remark-parse: ^11.0.0 + remark-stringify: ^11.0.0 + unified: ^11.0.0 + checksum: b278f51c4496f15ad868b72bf2eb2066c23a0892b5885544d3a4c233c964d44e51a0efe22d3fb33db4fbac92aefd51bb33453b8e73077b041a12b8269a02c17d + languageName: node + linkType: hard + +"remark-mdx@npm:^3.0.0": + version: 3.1.0 + resolution: "remark-mdx@npm:3.1.0" + dependencies: + mdast-util-mdx: ^3.0.0 + micromark-extension-mdxjs: ^3.0.0 + checksum: ac631296b3f87f46c03b51e8b1e7c90b854361da57ec5d0fddc410c63400fcffae216f2cee3af946407fc88e60bfc5765ba8acabe8e91afc0b7c824db77df152 languageName: node linkType: hard @@ -10989,6 +12459,18 @@ __metadata: languageName: node linkType: hard +"remark-parse@npm:^11.0.0": + version: 11.0.0 + resolution: "remark-parse@npm:11.0.0" + dependencies: + "@types/mdast": ^4.0.0 + mdast-util-from-markdown: ^2.0.0 + micromark-util-types: ^2.0.0 + unified: ^11.0.0 + checksum: d83d245290fa84bb04fb3e78111f09c74f7417e7c012a64dd8dc04fccc3699036d828fbd8eeec8944f774b6c30cc1d925c98f8c46495ebcee7c595496342ab7f + languageName: node + linkType: hard + "remark-rehype@npm:^10.0.0": version: 10.1.0 resolution: "remark-rehype@npm:10.1.0" @@ -11001,12 +12483,27 @@ __metadata: languageName: node linkType: hard -"remark-squeeze-paragraphs@npm:4.0.0": - version: 4.0.0 - resolution: "remark-squeeze-paragraphs@npm:4.0.0" +"remark-rehype@npm:^11.0.0": + version: 11.1.2 + resolution: "remark-rehype@npm:11.1.2" + dependencies: + "@types/hast": ^3.0.0 + "@types/mdast": ^4.0.0 + mdast-util-to-hast: ^13.0.0 + unified: ^11.0.0 + vfile: ^6.0.0 + checksum: 6eab55cb3464ec01d8e002cc9fe02ae57f48162899693fd53b5ba553ac8699dae7b55fce9df7131a5981313b19b495d6fbfa98a9d6bd243e7485591364d9b5b3 + languageName: node + linkType: hard + +"remark-stringify@npm:^11.0.0": + version: 11.0.0 + resolution: "remark-stringify@npm:11.0.0" dependencies: - mdast-squeeze-paragraphs: ^4.0.0 - checksum: 2071eb74d0ecfefb152c4932690a9fd950c3f9f798a676f1378a16db051da68fb20bf288688cc153ba5019dded35408ff45a31dfe9686eaa7a9f1df9edbb6c81 + "@types/mdast": ^4.0.0 + mdast-util-to-markdown: ^2.0.0 + unified: ^11.0.0 + checksum: 59e07460eb629d6c3b3c0f438b0b236e7e6858fd5ab770303078f5a556ec00354d9c7fb9ef6d5f745a4617ac7da1ab618b170fbb4dac120e183fecd9cc86bce6 languageName: node linkType: hard @@ -11023,7 +12520,7 @@ __metadata: languageName: node linkType: hard -"repeat-string@npm:^1.5.4": +"repeat-string@npm:^1.0.0": version: 1.6.1 resolution: "repeat-string@npm:1.6.1" checksum: 1b809fc6db97decdc68f5b12c4d1a671c8e3f65ec4a40c238bc5200e44e85bcc52a54f78268ab9c29fcf5fe4f1343e805420056d1f30fa9a9ee4c2d93e3cc6c0 @@ -11051,6 +12548,13 @@ __metadata: languageName: node linkType: hard +"resolve-alpn@npm:^1.2.0": + version: 1.2.1 + resolution: "resolve-alpn@npm:1.2.1" + checksum: f558071fcb2c60b04054c99aebd572a2af97ef64128d59bef7ab73bd50d896a222a056de40ffc545b633d99b304c259ea9d0c06830d5c867c34f0bfa60b8eae0 + languageName: node + linkType: hard + "resolve-from@npm:^4.0.0": version: 4.0.0 resolution: "resolve-from@npm:4.0.0" @@ -11065,20 +12569,7 @@ __metadata: languageName: node linkType: hard -"resolve@npm:^1.1.6, resolve@npm:^1.1.7, resolve@npm:^1.14.2, resolve@npm:^1.3.2": - version: 1.22.6 - resolution: "resolve@npm:1.22.6" - dependencies: - is-core-module: ^2.13.0 - path-parse: ^1.0.7 - supports-preserve-symlinks-flag: ^1.0.0 - bin: - resolve: bin/resolve - checksum: d13bf66d4e2ee30d291491f16f2fa44edd4e0cefb85d53249dd6f93e70b2b8c20ec62f01b18662e3cd40e50a7528f18c4087a99490048992a3bb954cf3201a5b - languageName: node - linkType: hard - -"resolve@npm:^1.22.8": +"resolve@npm:^1.1.7, resolve@npm:^1.22.10, resolve@npm:^1.22.8": version: 1.22.10 resolution: "resolve@npm:1.22.10" dependencies: @@ -11091,20 +12582,7 @@ __metadata: languageName: node linkType: hard -"resolve@patch:resolve@^1.1.6#~builtin, resolve@patch:resolve@^1.1.7#~builtin, resolve@patch:resolve@^1.14.2#~builtin, resolve@patch:resolve@^1.3.2#~builtin": - version: 1.22.6 - resolution: "resolve@patch:resolve@npm%3A1.22.6#~builtin::version=1.22.6&hash=c3c19d" - dependencies: - is-core-module: ^2.13.0 - path-parse: ^1.0.7 - supports-preserve-symlinks-flag: ^1.0.0 - bin: - resolve: bin/resolve - checksum: 9d3b3c67aefd12cecbe5f10ca4d1f51ea190891096497c43f301b086883b426466918c3a64f1bbf1788fabb52b579d58809614006c5d0b49186702b3b8fb746a - languageName: node - linkType: hard - -"resolve@patch:resolve@^1.22.8#~builtin": +"resolve@patch:resolve@^1.1.7#~builtin, resolve@patch:resolve@^1.22.10#~builtin, resolve@patch:resolve@^1.22.8#~builtin": version: 1.22.10 resolution: "resolve@patch:resolve@npm%3A1.22.10#~builtin::version=1.22.10&hash=c3c19d" dependencies: @@ -11117,12 +12595,12 @@ __metadata: languageName: node linkType: hard -"responselike@npm:^1.0.2": - version: 1.0.2 - resolution: "responselike@npm:1.0.2" +"responselike@npm:^3.0.0": + version: 3.0.0 + resolution: "responselike@npm:3.0.0" dependencies: - lowercase-keys: ^1.0.0 - checksum: 2e9e70f1dcca3da621a80ce71f2f9a9cad12c047145c6ece20df22f0743f051cf7c73505e109814915f23f9e34fb0d358e22827723ee3d56b623533cab8eafcd + lowercase-keys: ^3.0.0 + checksum: e0cc9be30df4f415d6d83cdede3c5c887cd4a73e7cc1708bcaab1d50a28d15acb68460ac5b02bcc55a42f3d493729c8856427dcf6e57e6e128ad05cba4cfb95e languageName: node linkType: hard @@ -11151,16 +12629,16 @@ __metadata: linkType: hard "reusify@npm:^1.0.4": - version: 1.0.4 - resolution: "reusify@npm:1.0.4" - checksum: c3076ebcc22a6bc252cb0b9c77561795256c22b757f40c0d8110b1300723f15ec0fc8685e8d4ea6d7666f36c79ccc793b1939c748bf36f18f542744a4e379fcc + version: 1.1.0 + resolution: "reusify@npm:1.1.0" + checksum: 64cb3142ac5e9ad689aca289585cb41d22521f4571f73e9488af39f6b1bd62f0cbb3d65e2ecc768ec6494052523f473f1eb4b55c3e9014b3590c17fc6a03e22a languageName: node linkType: hard "rfdc@npm:^1.3.0": - version: 1.3.0 - resolution: "rfdc@npm:1.3.0" - checksum: fb2ba8512e43519983b4c61bd3fa77c0f410eff6bae68b08614437bc3f35f91362215f7b4a73cbda6f67330b5746ce07db5dd9850ad3edc91271ad6deea0df32 + version: 1.4.1 + resolution: "rfdc@npm:1.4.1" + checksum: 3b05bd55062c1d78aaabfcea43840cdf7e12099968f368e9a4c3936beb744adb41cbdb315eac6d4d8c6623005d6f87fdf16d8a10e1ff3722e84afea7281c8d13 languageName: node linkType: hard @@ -11175,24 +12653,17 @@ __metadata: languageName: node linkType: hard -"rtl-detect@npm:^1.0.4": - version: 1.0.4 - resolution: "rtl-detect@npm:1.0.4" - checksum: d562535baa0db62f57f0a1d4676297bff72fd6b94e88f0f0900d5c3e810ab512c5c4cadffd3e05fbe8d9c74310c919afa3ea8c1001c244e5555e8eef12d02d6f - languageName: node - linkType: hard - -"rtlcss@npm:^3.5.0": - version: 3.5.0 - resolution: "rtlcss@npm:3.5.0" +"rtlcss@npm:^4.1.0": + version: 4.3.0 + resolution: "rtlcss@npm:4.3.0" dependencies: - find-up: ^5.0.0 + escalade: ^3.1.1 picocolors: ^1.0.0 - postcss: ^8.3.11 + postcss: ^8.4.21 strip-json-comments: ^3.1.1 bin: rtlcss: bin/rtlcss.js - checksum: a3763cad2cb58ce1b950de155097c3c294e7aefc8bf328b58d0cc8d5efb88bf800865edc158a78ace6d1f7f99fea6fd66fb4a354d859b172dadd3dab3e0027b3 + checksum: b2e78d01cb15ca7da374681f52d29ea71306166788872242a78ad36afdc4b53e78ee6e33b761744353121b01f65a7209b165b253d2715d313f8f282d4ded62bb languageName: node linkType: hard @@ -11205,15 +12676,6 @@ __metadata: languageName: node linkType: hard -"rxjs@npm:^7.5.4": - version: 7.8.1 - resolution: "rxjs@npm:7.8.1" - dependencies: - tslib: ^2.1.0 - checksum: de4b53db1063e618ec2eca0f7965d9137cabe98cf6be9272efe6c86b47c17b987383df8574861bcced18ebd590764125a901d5506082be84a8b8e364bf05f119 - languageName: node - linkType: hard - "sade@npm:^1.7.3": version: 1.8.1 resolution: "sade@npm:1.8.1" @@ -11223,13 +12685,6 @@ __metadata: languageName: node linkType: hard -"safe-buffer@npm:5.1.2, safe-buffer@npm:~5.1.0, safe-buffer@npm:~5.1.1": - version: 5.1.2 - resolution: "safe-buffer@npm:5.1.2" - checksum: f2f1f7943ca44a594893a852894055cf619c1fbcb611237fc39e461ae751187e7baf4dc391a72125e0ac4fb2d8c5c0b3c71529622e6a58f46b960211e704903c - languageName: node - linkType: hard - "safe-buffer@npm:5.2.1, safe-buffer@npm:>=5.1.0, safe-buffer@npm:^5.1.0, safe-buffer@npm:~5.2.0": version: 5.2.1 resolution: "safe-buffer@npm:5.2.1" @@ -11237,6 +12692,13 @@ __metadata: languageName: node linkType: hard +"safe-buffer@npm:~5.1.0, safe-buffer@npm:~5.1.1": + version: 5.1.2 + resolution: "safe-buffer@npm:5.1.2" + checksum: f2f1f7943ca44a594893a852894055cf619c1fbcb611237fc39e461ae751187e7baf4dc391a72125e0ac4fb2d8c5c0b3c71529622e6a58f46b960211e704903c + languageName: node + linkType: hard + "safer-buffer@npm:>= 2.1.2 < 3, safer-buffer@npm:>= 2.1.2 < 3.0.0": version: 2.1.2 resolution: "safer-buffer@npm:2.1.2" @@ -11245,45 +12707,29 @@ __metadata: linkType: hard "sax@npm:^1.2.4": - version: 1.3.0 - resolution: "sax@npm:1.3.0" - checksum: 238ab3a9ba8c8f8aaf1c5ea9120386391f6ee0af52f1a6a40bbb6df78241dd05d782f2359d614ac6aae08c4c4125208b456548a6cf68625aa4fe178486e63ecd + version: 1.4.1 + resolution: "sax@npm:1.4.1" + checksum: 3ad64df16b743f0f2eb7c38ced9692a6d924f1cd07bbe45c39576c2cf50de8290d9d04e7b2228f924c7d05fecc4ec5cf651423278e0c7b63d260c387ef3af84a languageName: node linkType: hard -"scheduler@npm:^0.20.2": - version: 0.20.2 - resolution: "scheduler@npm:0.20.2" +"scheduler@npm:^0.23.2": + version: 0.23.2 + resolution: "scheduler@npm:0.23.2" dependencies: loose-envify: ^1.1.0 - object-assign: ^4.1.1 - checksum: c4b35cf967c8f0d3e65753252d0f260271f81a81e427241295c5a7b783abf4ea9e905f22f815ab66676f5313be0a25f47be582254db8f9241b259213e999b8fc + checksum: 3e82d1f419e240ef6219d794ff29c7ee415fbdc19e038f680a10c067108e06284f1847450a210b29bbaf97b9d8a97ced5f624c31c681248ac84c80d56ad5a2c4 languageName: node linkType: hard -"schema-utils@npm:2.7.0": - version: 2.7.0 - resolution: "schema-utils@npm:2.7.0" - dependencies: - "@types/json-schema": ^7.0.4 - ajv: ^6.12.2 - ajv-keywords: ^3.4.1 - checksum: 8889325b0ee1ae6a8f5d6aaa855c71e136ebbb7fd731b01a9d3ec8225dcb245f644c47c50104db4c741983b528cdff8558570021257d4d397ec6aaecd9172a8e - languageName: node - linkType: hard - -"schema-utils@npm:^2.6.5": - version: 2.7.1 - resolution: "schema-utils@npm:2.7.1" - dependencies: - "@types/json-schema": ^7.0.5 - ajv: ^6.12.4 - ajv-keywords: ^3.5.2 - checksum: 32c62fc9e28edd101e1bd83453a4216eb9bd875cc4d3775e4452b541908fa8f61a7bbac8ffde57484f01d7096279d3ba0337078e85a918ecbeb72872fb09fb2b +"schema-dts@npm:^1.1.2": + version: 1.1.5 + resolution: "schema-dts@npm:1.1.5" + checksum: afca7df65a9d714d4aee367f9ea0e8a5a6f62e212457f240c90ded1ab954499a0e0a21bad097ffc810f03e2ea384985b2c2e08c2eb1cf0ec1780fc15b8b16d3f languageName: node linkType: hard -"schema-utils@npm:^3.0.0, schema-utils@npm:^3.1.1, schema-utils@npm:^3.2.0": +"schema-utils@npm:^3.0.0": version: 3.3.0 resolution: "schema-utils@npm:3.3.0" dependencies: @@ -11294,15 +12740,15 @@ __metadata: languageName: node linkType: hard -"schema-utils@npm:^4.0.0": - version: 4.2.0 - resolution: "schema-utils@npm:4.2.0" +"schema-utils@npm:^4.0.0, schema-utils@npm:^4.0.1, schema-utils@npm:^4.3.0, schema-utils@npm:^4.3.2": + version: 4.3.2 + resolution: "schema-utils@npm:4.3.2" dependencies: "@types/json-schema": ^7.0.9 ajv: ^8.9.0 ajv-formats: ^2.1.1 ajv-keywords: ^5.1.0 - checksum: 26a0463d47683258106e6652e9aeb0823bf0b85843039e068b57da1892f7ae6b6b1094d48e9ed5ba5cbe9f7166469d880858b9d91abe8bd249421eb813850cde + checksum: d798b341ffa1371f8471629e8861af3aa99e8e15b89da2c0db28c5a80a02ee8c6ffc7daefbe28a2b8c1bc8e3f3e02d028775145d7ab3d9d1a413a9651a835466 languageName: node linkType: hard @@ -11324,33 +12770,25 @@ __metadata: linkType: hard "selfsigned@npm:^2.1.1": - version: 2.1.1 - resolution: "selfsigned@npm:2.1.1" + version: 2.4.1 + resolution: "selfsigned@npm:2.4.1" dependencies: + "@types/node-forge": ^1.3.0 node-forge: ^1 - checksum: aa9ce2150a54838978d5c0aee54d7ebe77649a32e4e690eb91775f71fdff773874a4fbafd0ac73d8ec3b702ff8a395c604df4f8e8868528f36fd6c15076fb43a + checksum: 38b91c56f1d7949c0b77f9bbe4545b19518475cae15e7d7f0043f87b1626710b011ce89879a88969651f650a19d213bb15b7d5b4c2877df9eeeff7ba8f8b9bfa languageName: node linkType: hard -"semver-diff@npm:^3.1.1": - version: 3.1.1 - resolution: "semver-diff@npm:3.1.1" +"semver-diff@npm:^4.0.0": + version: 4.0.0 + resolution: "semver-diff@npm:4.0.0" dependencies: - semver: ^6.3.0 - checksum: 8bbe5a5d7add2d5e51b72314a9215cd294d71f41cdc2bf6bd59ee76411f3610b576172896f1d191d0d7294cb9f2f847438d2ee158adacc0c224dca79052812fe - languageName: node - linkType: hard - -"semver@npm:^5.4.1": - version: 5.7.2 - resolution: "semver@npm:5.7.2" - bin: - semver: bin/semver - checksum: fb4ab5e0dd1c22ce0c937ea390b4a822147a9c53dbd2a9a0132f12fe382902beef4fbf12cf51bb955248d8d15874ce8cd89532569756384f994309825f10b686 + semver: ^7.3.5 + checksum: 4a958d6f76c7e7858268e1e2cf936712542441c9e003e561b574167279eee0a9bd55cc7eae1bfb31d3e7ad06a9fc370e7dd412fcfefec8c0daf1ce5aea623559 languageName: node linkType: hard -"semver@npm:^6.0.0, semver@npm:^6.2.0, semver@npm:^6.3.0, semver@npm:^6.3.1": +"semver@npm:^6.3.1": version: 6.3.1 resolution: "semver@npm:6.3.1" bin: @@ -11359,20 +12797,18 @@ __metadata: languageName: node linkType: hard -"semver@npm:^7.3.2, semver@npm:^7.3.4, semver@npm:^7.3.5, semver@npm:^7.3.7, semver@npm:^7.3.8": - version: 7.5.4 - resolution: "semver@npm:7.5.4" - dependencies: - lru-cache: ^6.0.0 +"semver@npm:^7.3.5, semver@npm:^7.3.7, semver@npm:^7.5.4": + version: 7.7.2 + resolution: "semver@npm:7.7.2" bin: semver: bin/semver.js - checksum: 12d8ad952fa353b0995bf180cdac205a4068b759a140e5d3c608317098b3575ac2f1e09182206bf2eb26120e1c0ed8fb92c48c592f6099680de56bb071423ca3 + checksum: dd94ba8f1cbc903d8eeb4dd8bf19f46b3deb14262b6717d0de3c804b594058ae785ef2e4b46c5c3b58733c99c83339068203002f9e37cfe44f7e2cc5e3d2f621 languageName: node linkType: hard -"send@npm:0.18.0": - version: 0.18.0 - resolution: "send@npm:0.18.0" +"send@npm:0.19.0": + version: 0.19.0 + resolution: "send@npm:0.19.0" dependencies: debug: 2.6.9 depd: 2.0.0 @@ -11387,32 +12823,31 @@ __metadata: on-finished: 2.4.1 range-parser: ~1.2.1 statuses: 2.0.1 - checksum: 74fc07ebb58566b87b078ec63e5a3e41ecd987e4272ba67b7467e86c6ad51bc6b0b0154133b6d8b08a2ddda360464f71382f7ef864700f34844a76c8027817a8 + checksum: 5ae11bd900c1c2575525e2aa622e856804e2f96a09281ec1e39610d089f53aa69e13fd8db84b52f001d0318cf4bb0b3b904ad532fc4c0014eb90d32db0cff55f languageName: node linkType: hard -"serialize-javascript@npm:^6.0.0, serialize-javascript@npm:^6.0.1": - version: 6.0.1 - resolution: "serialize-javascript@npm:6.0.1" +"serialize-javascript@npm:^6.0.0, serialize-javascript@npm:^6.0.1, serialize-javascript@npm:^6.0.2": + version: 6.0.2 + resolution: "serialize-javascript@npm:6.0.2" dependencies: randombytes: ^2.1.0 - checksum: 3c4f4cb61d0893b988415bdb67243637333f3f574e9e9cc9a006a2ced0b390b0b3b44aef8d51c951272a9002ec50885eefdc0298891bc27eb2fe7510ea87dc4f + checksum: c4839c6206c1d143c0f80763997a361310305751171dd95e4b57efee69b8f6edd8960a0b7fbfc45042aadff98b206d55428aee0dc276efe54f100899c7fa8ab7 languageName: node linkType: hard -"serve-handler@npm:^6.1.3": - version: 6.1.5 - resolution: "serve-handler@npm:6.1.5" +"serve-handler@npm:^6.1.6": + version: 6.1.6 + resolution: "serve-handler@npm:6.1.6" dependencies: bytes: 3.0.0 content-disposition: 0.5.2 - fast-url-parser: 1.1.3 mime-types: 2.1.18 minimatch: 3.1.2 path-is-inside: 1.0.2 - path-to-regexp: 2.2.1 + path-to-regexp: 3.3.0 range-parser: 1.2.0 - checksum: 7a98ca9cbf8692583b6cde4deb3941cff900fa38bf16adbfccccd8430209bab781e21d9a1f61c9c03e226f9f67689893bbce25941368f3ddaf985fc3858b49dc + checksum: eb26201e699ac4694fb16f9aaf932330f6b1159e9d9496261baa23caf1e81322afcfd2b5f5f2b306b133298c03a8395a3c13b56fde5d70b331014b3a5ab7217f languageName: node linkType: hard @@ -11431,29 +12866,29 @@ __metadata: languageName: node linkType: hard -"serve-static@npm:1.15.0": - version: 1.15.0 - resolution: "serve-static@npm:1.15.0" +"serve-static@npm:1.16.2": + version: 1.16.2 + resolution: "serve-static@npm:1.16.2" dependencies: - encodeurl: ~1.0.2 + encodeurl: ~2.0.0 escape-html: ~1.0.3 parseurl: ~1.3.3 - send: 0.18.0 - checksum: af57fc13be40d90a12562e98c0b7855cf6e8bd4c107fe9a45c212bf023058d54a1871b1c89511c3958f70626fff47faeb795f5d83f8cf88514dbaeb2b724464d - languageName: node - linkType: hard - -"set-blocking@npm:^2.0.0": - version: 2.0.0 - resolution: "set-blocking@npm:2.0.0" - checksum: 6e65a05f7cf7ebdf8b7c75b101e18c0b7e3dff4940d480efed8aad3a36a4005140b660fa1d804cb8bce911cac290441dc728084a30504d3516ac2ff7ad607b02 + send: 0.19.0 + checksum: dffc52feb4cc5c68e66d0c7f3c1824d4e989f71050aefc9bd5f822a42c54c9b814f595fc5f2b717f4c7cc05396145f3e90422af31186a93f76cf15f707019759 languageName: node linkType: hard -"setimmediate@npm:^1.0.5": - version: 1.0.5 - resolution: "setimmediate@npm:1.0.5" - checksum: c9a6f2c5b51a2dabdc0247db9c46460152ffc62ee139f3157440bd48e7c59425093f42719ac1d7931f054f153e2d26cf37dfeb8da17a794a58198a2705e527fd +"set-function-length@npm:^1.2.2": + version: 1.2.2 + resolution: "set-function-length@npm:1.2.2" + dependencies: + define-data-property: ^1.1.4 + es-errors: ^1.3.0 + function-bind: ^1.1.2 + get-intrinsic: ^1.2.4 + gopd: ^1.0.1 + has-property-descriptors: ^1.0.2 + checksum: a8248bdacdf84cb0fab4637774d9fb3c7a8e6089866d04c817583ff48e14149c87044ce683d7f50759a8c50fb87c7a7e173535b06169c87ef76f5fb276dfff72 languageName: node linkType: hard @@ -11503,34 +12938,58 @@ __metadata: languageName: node linkType: hard -"shell-quote@npm:^1.7.3, shell-quote@npm:^1.8.1": - version: 1.8.1 - resolution: "shell-quote@npm:1.8.1" - checksum: 5f01201f4ef504d4c6a9d0d283fa17075f6770bfbe4c5850b074974c68062f37929ca61700d95ad2ac8822e14e8c4b990ca0e6e9272e64befd74ce5e19f0736b +"shell-quote@npm:^1.8.1": + version: 1.8.3 + resolution: "shell-quote@npm:1.8.3" + checksum: 550dd84e677f8915eb013d43689c80bb114860649ec5298eb978f40b8f3d4bc4ccb072b82c094eb3548dc587144bb3965a8676f0d685c1cf4c40b5dc27166242 languageName: node linkType: hard -"shelljs@npm:^0.8.5": - version: 0.8.5 - resolution: "shelljs@npm:0.8.5" +"side-channel-list@npm:^1.0.0": + version: 1.0.0 + resolution: "side-channel-list@npm:1.0.0" dependencies: - glob: ^7.0.0 - interpret: ^1.0.0 - rechoir: ^0.6.2 - bin: - shjs: bin/shjs - checksum: 7babc46f732a98f4c054ec1f048b55b9149b98aa2da32f6cf9844c434b43c6251efebd6eec120937bd0999e13811ebd45efe17410edb3ca938f82f9381302748 + es-errors: ^1.3.0 + object-inspect: ^1.13.3 + checksum: 603b928997abd21c5a5f02ae6b9cc36b72e3176ad6827fab0417ead74580cc4fb4d5c7d0a8a2ff4ead34d0f9e35701ed7a41853dac8a6d1a664fcce1a044f86f languageName: node linkType: hard -"side-channel@npm:^1.0.4": - version: 1.0.4 - resolution: "side-channel@npm:1.0.4" +"side-channel-map@npm:^1.0.1": + version: 1.0.1 + resolution: "side-channel-map@npm:1.0.1" + dependencies: + call-bound: ^1.0.2 + es-errors: ^1.3.0 + get-intrinsic: ^1.2.5 + object-inspect: ^1.13.3 + checksum: 42501371cdf71f4ccbbc9c9e2eb00aaaab80a4c1c429d5e8da713fd4d39ef3b8d4a4b37ed4f275798a65260a551a7131fd87fe67e922dba4ac18586d6aab8b06 + languageName: node + linkType: hard + +"side-channel-weakmap@npm:^1.0.2": + version: 1.0.2 + resolution: "side-channel-weakmap@npm:1.0.2" + dependencies: + call-bound: ^1.0.2 + es-errors: ^1.3.0 + get-intrinsic: ^1.2.5 + object-inspect: ^1.13.3 + side-channel-map: ^1.0.1 + checksum: a815c89bc78c5723c714ea1a77c938377ea710af20d4fb886d362b0d1f8ac73a17816a5f6640f354017d7e292a43da9c5e876c22145bac00b76cfb3468001736 + languageName: node + linkType: hard + +"side-channel@npm:^1.0.6": + version: 1.1.0 + resolution: "side-channel@npm:1.1.0" dependencies: - call-bind: ^1.0.0 - get-intrinsic: ^1.0.2 - object-inspect: ^1.9.0 - checksum: 351e41b947079c10bd0858364f32bb3a7379514c399edb64ab3dce683933483fc63fb5e4efe0a15a2e8a7e3c436b6a91736ddb8d8c6591b0460a24bb4a1ee245 + es-errors: ^1.3.0 + object-inspect: ^1.13.3 + side-channel-list: ^1.0.0 + side-channel-map: ^1.0.1 + side-channel-weakmap: ^1.0.2 + checksum: bf73d6d6682034603eb8e99c63b50155017ed78a522d27c2acec0388a792c3ede3238b878b953a08157093b85d05797217d270b7666ba1f111345fbe933380ff languageName: node linkType: hard @@ -11549,13 +13008,13 @@ __metadata: linkType: hard "sirv@npm:^2.0.3": - version: 2.0.3 - resolution: "sirv@npm:2.0.3" + version: 2.0.4 + resolution: "sirv@npm:2.0.4" dependencies: - "@polka/url": ^1.0.0-next.20 - mrmime: ^1.0.0 + "@polka/url": ^1.0.0-next.24 + mrmime: ^2.0.0 totalist: ^3.0.0 - checksum: e2dfd4c97735a6ad6d842d0eec2cd9e3919ff0e46f0d228248c5753ad4b70b832711e77e1259c031c439cdb08303cc54d923685c92b0e890145cc733af7c5568 + checksum: 6853384a51d6ee9377dd657e2b257e0e98b29abbfbfa6333e105197f0f100c8c56a4520b47028b04ab1833cf2312526206f38fcd4f891c6df453f40da1a15a57 languageName: node linkType: hard @@ -11567,8 +13026,8 @@ __metadata: linkType: hard "sitemap@npm:^7.1.1": - version: 7.1.1 - resolution: "sitemap@npm:7.1.1" + version: 7.1.2 + resolution: "sitemap@npm:7.1.2" dependencies: "@types/node": ^17.0.5 "@types/sax": ^1.2.1 @@ -11576,7 +13035,16 @@ __metadata: sax: ^1.2.4 bin: sitemap: dist/cli.js - checksum: 87a6d21b0d4a33b8c611d3bb8543d02b813c0ebfce014213ef31849b5c1439005644f19ad1593ec89815f6101355f468c9a02c251d09aa03f6fddd17e23c4be4 + checksum: c6d8e1f06091fdc643f6ed3c13e92215ed1dcbc3bdaf42f50f468a6dc4c6080bd25ffb5f59beb12b4b63f590ad63ab6c285e788d0fade4c811e58bb56a10c6cd + languageName: node + linkType: hard + +"skin-tone@npm:^2.0.0": + version: 2.0.0 + resolution: "skin-tone@npm:2.0.0" + dependencies: + unicode-emoji-modifier-base: ^1.0.0 + checksum: 19de157586b8019cacc55eb25d9d640f00fc02415761f3e41a4527142970fd4e7f6af0333bc90e879858766c20a976107bb386ffd4c812289c01d51f2c8d182c languageName: node linkType: hard @@ -11611,6 +13079,16 @@ __metadata: languageName: node linkType: hard +"snake-case@npm:^3.0.4": + version: 3.0.4 + resolution: "snake-case@npm:3.0.4" + dependencies: + dot-case: ^3.0.4 + tslib: ^2.0.3 + checksum: 0a7a79900bbb36f8aaa922cf111702a3647ac6165736d5dc96d3ef367efc50465cac70c53cd172c382b022dac72ec91710608e5393de71f76d7142e6fd80e8a3 + languageName: node + linkType: hard + "sockjs@npm:^0.3.24": version: 0.3.24 resolution: "sockjs@npm:0.3.24" @@ -11622,35 +13100,35 @@ __metadata: languageName: node linkType: hard -"socks-proxy-agent@npm:^7.0.0": - version: 7.0.0 - resolution: "socks-proxy-agent@npm:7.0.0" +"socks-proxy-agent@npm:^8.0.3": + version: 8.0.5 + resolution: "socks-proxy-agent@npm:8.0.5" dependencies: - agent-base: ^6.0.2 - debug: ^4.3.3 - socks: ^2.6.2 - checksum: 720554370154cbc979e2e9ce6a6ec6ced205d02757d8f5d93fe95adae454fc187a5cbfc6b022afab850a5ce9b4c7d73e0f98e381879cf45f66317a4895953846 + agent-base: ^7.1.2 + debug: ^4.3.4 + socks: ^2.8.3 + checksum: b4fbcdb7ad2d6eec445926e255a1fb95c975db0020543fbac8dfa6c47aecc6b3b619b7fb9c60a3f82c9b2969912a5e7e174a056ae4d98cb5322f3524d6036e1d languageName: node linkType: hard -"socks@npm:^2.6.2": - version: 2.7.1 - resolution: "socks@npm:2.7.1" +"socks@npm:^2.8.3": + version: 2.8.6 + resolution: "socks@npm:2.8.6" dependencies: - ip: ^2.0.0 + ip-address: ^9.0.5 smart-buffer: ^4.2.0 - checksum: 259d9e3e8e1c9809a7f5c32238c3d4d2a36b39b83851d0f573bfde5f21c4b1288417ce1af06af1452569cd1eb0841169afd4998f0e04ba04656f6b7f0e46d748 + checksum: 3d2a696d42d94b05b2a7e797b9291483d6768b23300b015353f34f8046cce35f23fe59300a38a77a9f0dee4274dd6c333afbdef628cf48f3df171bfb86c2d21c languageName: node linkType: hard -"sort-css-media-queries@npm:2.1.0": - version: 2.1.0 - resolution: "sort-css-media-queries@npm:2.1.0" - checksum: 25cb8f08b148a2ed83d0bc1cf20ddb888d3dee2a3c986896099a21b28b999d5cca3e46a9ef64381bb36fca0fc820471713f2e8af2729ecc6e108ab2b3b315ea9 +"sort-css-media-queries@npm:2.2.0": + version: 2.2.0 + resolution: "sort-css-media-queries@npm:2.2.0" + checksum: c090c9a27be40f3e50f5f9bc9d85a8af0e2c5152565eca34bdb028d952749bce169bc5abef21a5a385ca6221a0869640c9faf58f082ac46de9085ebdb506291f languageName: node linkType: hard -"source-map-js@npm:^1.2.1": +"source-map-js@npm:^1.0.1, source-map-js@npm:^1.2.1": version: 1.2.1 resolution: "source-map-js@npm:1.2.1" checksum: 4eb0cd997cdf228bc253bcaff9340afeb706176e64868ecd20efbe6efea931465f43955612346d6b7318789e5265bdc419bc7669c1cebe3db0eb255f57efa76b @@ -11667,20 +13145,20 @@ __metadata: languageName: node linkType: hard -"source-map@npm:^0.5.0": - version: 0.5.7 - resolution: "source-map@npm:0.5.7" - checksum: 5dc2043b93d2f194142c7f38f74a24670cd7a0063acdaf4bf01d2964b402257ae843c2a8fa822ad5b71013b5fcafa55af7421383da919752f22ff488bc553f4d - languageName: node - linkType: hard - -"source-map@npm:^0.6.0, source-map@npm:^0.6.1, source-map@npm:~0.6.0": +"source-map@npm:^0.6.0, source-map@npm:~0.6.0": version: 0.6.1 resolution: "source-map@npm:0.6.1" checksum: 59ce8640cf3f3124f64ac289012c2b8bd377c238e316fb323ea22fbfe83da07d81e000071d7242cad7a23cd91c7de98e4df8830ec3f133cb6133a5f6e9f67bc2 languageName: node linkType: hard +"source-map@npm:^0.7.0": + version: 0.7.4 + resolution: "source-map@npm:0.7.4" + checksum: 01cc5a74b1f0e1d626a58d36ad6898ea820567e87f18dfc9d24a9843a351aaa2ec09b87422589906d6ff1deed29693e176194dc88bcae7c9a852dc74b311dbf5 + languageName: node + linkType: hard + "sourcemap-codec@npm:^1.4.8": version: 1.4.8 resolution: "sourcemap-codec@npm:1.4.8" @@ -11688,13 +13166,6 @@ __metadata: languageName: node linkType: hard -"space-separated-tokens@npm:^1.0.0": - version: 1.1.5 - resolution: "space-separated-tokens@npm:1.1.5" - checksum: 8ef68f1cfa8ccad316b7f8d0df0919d0f1f6d32101e8faeee34ea3a923ce8509c1ad562f57388585ee4951e92d27afa211ed0a077d3d5995b5ba9180331be708 - languageName: node - linkType: hard - "space-separated-tokens@npm:^2.0.0": version: 2.0.2 resolution: "space-separated-tokens@npm:2.0.2" @@ -11729,6 +13200,13 @@ __metadata: languageName: node linkType: hard +"sprintf-js@npm:^1.1.3": + version: 1.1.3 + resolution: "sprintf-js@npm:1.1.3" + checksum: a3fdac7b49643875b70864a9d9b469d87a40dfeaf5d34d9d0c5b1cda5fd7d065531fcb43c76357d62254c57184a7b151954156563a4d6a747015cfb41021cad0 + languageName: node + linkType: hard + "sprintf-js@npm:~1.0.2": version: 1.0.3 resolution: "sprintf-js@npm:1.0.3" @@ -11736,26 +13214,19 @@ __metadata: languageName: node linkType: hard -"ssri@npm:^10.0.0": - version: 10.0.5 - resolution: "ssri@npm:10.0.5" - dependencies: - minipass: ^7.0.3 - checksum: 0a31b65f21872dea1ed3f7c200d7bc1c1b91c15e419deca14f282508ba917cbb342c08a6814c7f68ca4ca4116dd1a85da2bbf39227480e50125a1ceffeecb750 - languageName: node - linkType: hard - -"stable@npm:^0.1.8": - version: 0.1.8 - resolution: "stable@npm:0.1.8" - checksum: 2ff482bb100285d16dd75cd8f7c60ab652570e8952c0bfa91828a2b5f646a0ff533f14596ea4eabd48bb7f4aeea408dce8f8515812b975d958a4cc4fa6b9dfeb +"srcset@npm:^4.0.0": + version: 4.0.0 + resolution: "srcset@npm:4.0.0" + checksum: aceb898c9281101ef43bfbf96bf04dfae828e1bf942a45df6fad74ae9f8f0a425f4bca1480e0d22879beb40dd2bc6947e0e1e5f4d307a714666196164bc5769d languageName: node linkType: hard -"state-toggle@npm:^1.0.0": - version: 1.0.3 - resolution: "state-toggle@npm:1.0.3" - checksum: 17398af928413e8d8b866cf0c81fd1b1348bb7d65d8983126ff6ff2317a80d6ee023484fba0c54d8169f5aa544f125434a650ae3a71eddc935cae307d4692b4f +"ssri@npm:^12.0.0": + version: 12.0.0 + resolution: "ssri@npm:12.0.0" + dependencies: + minipass: ^7.0.3 + checksum: ef4b6b0ae47b4a69896f5f1c4375f953b9435388c053c36d27998bc3d73e046969ccde61ab659e679142971a0b08e50478a1228f62edb994105b280f17900c98 languageName: node linkType: hard @@ -11773,10 +13244,10 @@ __metadata: languageName: node linkType: hard -"std-env@npm:^3.0.1": - version: 3.4.3 - resolution: "std-env@npm:3.4.3" - checksum: bef186fb2baddda31911234b1e58fa18f181eb6930616aaec3b54f6d5db65f2da5daaa5f3b326b98445a7d50ca81d6fe8809ab4ebab85ecbe4a802f1b40921bf +"std-env@npm:^3.7.0": + version: 3.9.0 + resolution: "std-env@npm:3.9.0" + checksum: d40126e4a650f6e5456711e6c297420352a376ef99a9599e8224d2d8f2ff2b91a954f3264fcef888d94fce5c9ae14992c5569761c95556fc87248ce4602ed212 languageName: node linkType: hard @@ -11787,7 +13258,7 @@ __metadata: languageName: node linkType: hard -"string-width-cjs@npm:string-width@^4.2.0, string-width@npm:^1.0.2 || 2 || 3 || 4, string-width@npm:^4.0.0, string-width@npm:^4.1.0, string-width@npm:^4.2.0, string-width@npm:^4.2.2, string-width@npm:^4.2.3": +"string-width-cjs@npm:string-width@^4.2.0, string-width@npm:^4.1.0, string-width@npm:^4.2.0": version: 4.2.3 resolution: "string-width@npm:4.2.3" dependencies: @@ -11827,6 +13298,16 @@ __metadata: languageName: node linkType: hard +"stringify-entities@npm:^4.0.0": + version: 4.0.4 + resolution: "stringify-entities@npm:4.0.4" + dependencies: + character-entities-html4: ^2.0.0 + character-entities-legacy: ^3.0.0 + checksum: ac1344ef211eacf6cf0a0a8feaf96f9c36083835b406560d2c6ff5a87406a41b13f2f0b4c570a3b391f465121c4fd6822b863ffb197e8c0601a64097862cc5b5 + languageName: node + linkType: hard + "stringify-object@npm:^3.3.0": version: 3.3.0 resolution: "stringify-object@npm:3.3.0" @@ -11900,12 +13381,12 @@ __metadata: languageName: node linkType: hard -"style-to-object@npm:0.3.0, style-to-object@npm:^0.3.0": - version: 0.3.0 - resolution: "style-to-object@npm:0.3.0" +"style-to-js@npm:^1.0.0": + version: 1.1.17 + resolution: "style-to-js@npm:1.1.17" dependencies: - inline-style-parser: 0.1.1 - checksum: 4d7084015207f2a606dfc10c29cb5ba569f2fe8005551df7396110dd694d6ff650f2debafa95bd5d147dfb4ca50f57868e2a7f91bf5d11ef734fe7ccbd7abf59 + style-to-object: 1.0.9 + checksum: cdf92a0a42383fcc535972b7ec73395b53e370e5eaa345faf4d360f7918789cd73a20a79eef6d764b6441ff2e532a42ad5830ab87fec60a9dfc177fa438a6876 languageName: node linkType: hard @@ -11918,24 +13399,33 @@ __metadata: languageName: node linkType: hard +"style-to-object@npm:1.0.9": + version: 1.0.9 + resolution: "style-to-object@npm:1.0.9" + dependencies: + inline-style-parser: 0.2.4 + checksum: a89e229161a56c53e28d1b91dcdc902f482f577db8b13741d3f056df7df0fbff4ecb44e06e32960f11c3a477b26f056e889a223bef6bc72b162935c5e4828145 + languageName: node + linkType: hard + "style-to-object@npm:^0.4.0": - version: 0.4.2 - resolution: "style-to-object@npm:0.4.2" + version: 0.4.4 + resolution: "style-to-object@npm:0.4.4" dependencies: inline-style-parser: 0.1.1 - checksum: 314a80bcfadde41c2b9c8d717a4b1f2220954561040c2c7740496715da5cb95f99920a8eeefe2d4a862149875f352a12eda9bbef5816d7e0a71910da00d1521f + checksum: 41656c06f93ac0a7ac260ebc2f9d09a8bd74b8ec1836f358cc58e169235835a3a356977891d2ebbd76f0e08a53616929069199f9cce543214d3dc98346e19c9a languageName: node linkType: hard -"stylehacks@npm:^5.1.1": - version: 5.1.1 - resolution: "stylehacks@npm:5.1.1" +"stylehacks@npm:^6.1.1": + version: 6.1.1 + resolution: "stylehacks@npm:6.1.1" dependencies: - browserslist: ^4.21.4 - postcss-selector-parser: ^6.0.4 + browserslist: ^4.23.0 + postcss-selector-parser: ^6.0.16 peerDependencies: - postcss: ^8.2.15 - checksum: 11175366ef52de65bf06cefba0ddc9db286dc3a1451fd2989e74c6ea47091a02329a4bf6ce10b1a36950056927b6bbbe47c5ab3a1f4c7032df932d010fbde5a2 + postcss: ^8.4.31 + checksum: 7bef69822280a23817caa43969de76d77ba34042e9f1f7baaeda8f22b1d8c20f1f839ad028552c169e158e387830f176feccd0324b07ef6ec657cba1dd0b2466 languageName: node linkType: hard @@ -11998,20 +13488,20 @@ __metadata: languageName: node linkType: hard -"svgo@npm:^2.7.0, svgo@npm:^2.8.0": - version: 2.8.0 - resolution: "svgo@npm:2.8.0" +"svgo@npm:^3.0.2, svgo@npm:^3.2.0": + version: 3.3.2 + resolution: "svgo@npm:3.3.2" dependencies: "@trysound/sax": 0.2.0 commander: ^7.2.0 - css-select: ^4.1.3 - css-tree: ^1.1.3 - csso: ^4.2.0 + css-select: ^5.1.0 + css-tree: ^2.3.1 + css-what: ^6.1.0 + csso: ^5.0.5 picocolors: ^1.0.0 - stable: ^0.1.8 bin: - svgo: bin/svgo - checksum: b92f71a8541468ffd0b81b8cdb36b1e242eea320bf3c1a9b2c8809945853e9d8c80c19744267eb91cabf06ae9d5fff3592d677df85a31be4ed59ff78534fa420 + svgo: ./bin/svgo + checksum: a3f8aad597dec13ab24e679c4c218147048dc1414fe04e99447c5f42a6e077b33d712d306df84674b5253b98c9b84dfbfb41fdd08552443b04946e43d03e054e languageName: node linkType: hard @@ -12057,43 +13547,36 @@ __metadata: languageName: node linkType: hard -"tapable@npm:^1.0.0": - version: 1.1.3 - resolution: "tapable@npm:1.1.3" - checksum: 53ff4e7c3900051c38cc4faab428ebfd7e6ad0841af5a7ac6d5f3045c5b50e88497bfa8295b4b3fbcadd94993c9e358868b78b9fb249a76cb8b018ac8dccafd7 - languageName: node - linkType: hard - -"tapable@npm:^2.0.0, tapable@npm:^2.1.1, tapable@npm:^2.2.0": - version: 2.2.1 - resolution: "tapable@npm:2.2.1" - checksum: 3b7a1b4d86fa940aad46d9e73d1e8739335efd4c48322cb37d073eb6f80f5281889bf0320c6d8ffcfa1a0dd5bfdbd0f9d037e252ef972aca595330538aac4d51 +"tapable@npm:^2.0.0, tapable@npm:^2.1.1, tapable@npm:^2.2.0, tapable@npm:^2.2.1": + version: 2.2.2 + resolution: "tapable@npm:2.2.2" + checksum: 781b3666f4454eb506fd2bcd985c1994f2b93884ea88a7a2a5be956cad8337b31128a7591e771f7aab8e247993b2a0887d360a2d4f54382902ed89994c102740 languageName: node linkType: hard -"tar@npm:^6.1.11, tar@npm:^6.1.2": - version: 6.2.0 - resolution: "tar@npm:6.2.0" +"tar@npm:^7.4.3": + version: 7.4.3 + resolution: "tar@npm:7.4.3" dependencies: - chownr: ^2.0.0 - fs-minipass: ^2.0.0 - minipass: ^5.0.0 - minizlib: ^2.1.1 - mkdirp: ^1.0.3 - yallist: ^4.0.0 - checksum: db4d9fe74a2082c3a5016630092c54c8375ff3b280186938cfd104f2e089c4fd9bad58688ef6be9cf186a889671bf355c7cda38f09bbf60604b281715ca57f5c + "@isaacs/fs-minipass": ^4.0.0 + chownr: ^3.0.0 + minipass: ^7.1.2 + minizlib: ^3.0.1 + mkdirp: ^3.0.1 + yallist: ^5.0.0 + checksum: 8485350c0688331c94493031f417df069b778aadb25598abdad51862e007c39d1dd5310702c7be4a6784731a174799d8885d2fde0484269aea205b724d7b2ffa languageName: node linkType: hard -"terser-webpack-plugin@npm:^5.3.3, terser-webpack-plugin@npm:^5.3.7": - version: 5.3.9 - resolution: "terser-webpack-plugin@npm:5.3.9" +"terser-webpack-plugin@npm:^5.3.11, terser-webpack-plugin@npm:^5.3.9": + version: 5.3.14 + resolution: "terser-webpack-plugin@npm:5.3.14" dependencies: - "@jridgewell/trace-mapping": ^0.3.17 + "@jridgewell/trace-mapping": ^0.3.25 jest-worker: ^27.4.5 - schema-utils: ^3.1.1 - serialize-javascript: ^6.0.1 - terser: ^5.16.8 + schema-utils: ^4.3.0 + serialize-javascript: ^6.0.2 + terser: ^5.31.1 peerDependencies: webpack: ^5.1.0 peerDependenciesMeta: @@ -12103,21 +13586,21 @@ __metadata: optional: true uglify-js: optional: true - checksum: 41705713d6f9cb83287936b21e27c658891c78c4392159f5148b5623f0e8c48559869779619b058382a4c9758e7820ea034695e57dc7c474b4962b79f553bc5f + checksum: 13a1e67f1675a473b18d25cb0ce65c3f0a19b5e9a93213a99ea61dc4ca996ea93aa17a221965b526f5788d242836a8249ad00538fbb322e25cb69076eb55feab languageName: node linkType: hard -"terser@npm:^5.10.0, terser@npm:^5.16.8": - version: 5.21.0 - resolution: "terser@npm:5.21.0" +"terser@npm:^5.10.0, terser@npm:^5.15.1, terser@npm:^5.31.1": + version: 5.43.1 + resolution: "terser@npm:5.43.1" dependencies: "@jridgewell/source-map": ^0.3.3 - acorn: ^8.8.2 + acorn: ^8.14.0 commander: ^2.20.0 source-map-support: ~0.5.20 bin: terser: bin/terser - checksum: 130f1567af1ffa4ddb067651bb284a01b45b5c83e82b3a072a5ff94b0b00ac35090f89c8714631a4a45972f65187bc149fc7144380611f437e1e3d9e174b136b + checksum: 1d51747f4540a0842139c2f2617e88d68a26da42d7571cda8955e1bd8febac6e60bc514c258781334e1724aeeccfbd511473eb9d8d831435e4e5fad1ce7f6e8b languageName: node linkType: hard @@ -12154,9 +13637,9 @@ __metadata: linkType: hard "tiny-invariant@npm:^1.0.2": - version: 1.3.1 - resolution: "tiny-invariant@npm:1.3.1" - checksum: 872dbd1ff20a21303a2fd20ce3a15602cfa7fcf9b228bd694a52e2938224313b5385a1078cb667ed7375d1612194feaca81c4ecbe93121ca1baebe344de4f84c + version: 1.3.3 + resolution: "tiny-invariant@npm:1.3.3" + checksum: 5e185c8cc2266967984ce3b352a4e57cb89dad5a8abb0dea21468a6ecaa67cd5bb47a3b7a85d08041008644af4f667fb8b6575ba38ba5fb00b3b5068306e59fe languageName: node linkType: hard @@ -12167,17 +13650,20 @@ __metadata: languageName: node linkType: hard -"to-fast-properties@npm:^2.0.0": - version: 2.0.0 - resolution: "to-fast-properties@npm:2.0.0" - checksum: be2de62fe58ead94e3e592680052683b1ec986c72d589e7b21e5697f8744cdbf48c266fa72f6c15932894c10187b5f54573a3bcf7da0bfd964d5caf23d436168 +"tinyglobby@npm:^0.2.12": + version: 0.2.14 + resolution: "tinyglobby@npm:0.2.14" + dependencies: + fdir: ^6.4.4 + picomatch: ^4.0.2 + checksum: 261e986e3f2062dec3a582303bad2ce31b4634b9348648b46828c000d464b012cf474e38f503312367d4117c3f2f18611992738fca684040758bba44c24de522 languageName: node linkType: hard -"to-readable-stream@npm:^1.0.0": - version: 1.0.0 - resolution: "to-readable-stream@npm:1.0.0" - checksum: 2bd7778490b6214a2c40276065dd88949f4cf7037ce3964c76838b8cb212893aeb9cceaaf4352a4c486e3336214c350270f3263e1ce7a0c38863a715a4d9aeb5 +"tinypool@npm:^1.0.2": + version: 1.1.1 + resolution: "tinypool@npm:1.1.1" + checksum: 0258abe108df8be395a2cbdc8b4390c94908850250530f7bea83a129fa33d49a8c93246f76bf81cd458534abd81322f4d4cb3a40690254f8d9044ff449f328a8 languageName: node linkType: hard @@ -12204,13 +13690,6 @@ __metadata: languageName: node linkType: hard -"tr46@npm:~0.0.3": - version: 0.0.3 - resolution: "tr46@npm:0.0.3" - checksum: 726321c5eaf41b5002e17ffbd1fb7245999a073e8979085dacd47c4b4e8068ff5777142fc6726d6ca1fd2ff16921b48788b87225cbc57c72636f6efa8efbffe3 - languageName: node - linkType: hard - "trim-lines@npm:^3.0.0": version: 3.0.1 resolution: "trim-lines@npm:3.0.1" @@ -12218,31 +13697,10 @@ __metadata: languageName: node linkType: hard -"trim-trailing-lines@npm:^1.0.0": - version: 1.1.4 - resolution: "trim-trailing-lines@npm:1.1.4" - checksum: 5d39d21c0d4b258667012fcd784f73129e148ea1c213b1851d8904f80499fc91df6710c94c7dd49a486a32da2b9cb86020dda79f285a9a2586cfa622f80490c2 - languageName: node - linkType: hard - -"trim@npm:0.0.1": - version: 0.0.1 - resolution: "trim@npm:0.0.1" - checksum: 2b4646dff99a222e8e1526edd4e3a43bbd925af0b8e837c340455d250157e7deefaa4da49bb891ab841e5c27b1afc5e9e32d4b57afb875d2dfcabf4e319b8f7f - languageName: node - linkType: hard - -"trough@npm:^1.0.0": - version: 1.0.5 - resolution: "trough@npm:1.0.5" - checksum: d6c8564903ed00e5258bab92134b020724dbbe83148dc72e4bf6306c03ed8843efa1bcc773fa62410dd89161ecb067432dd5916501793508a9506cacbc408e25 - languageName: node - linkType: hard - "trough@npm:^2.0.0": - version: 2.1.0 - resolution: "trough@npm:2.1.0" - checksum: a577bb561c2b401cc0e1d9e188fcfcdf63b09b151ff56a668da12197fe97cac15e3d77d5b51f426ccfd94255744a9118e9e9935afe81a3644fa1be9783c82886 + version: 2.2.0 + resolution: "trough@npm:2.2.0" + checksum: 6097df63169aca1f9b08c263b1b501a9b878387f46e161dde93f6d0bba7febba93c95f876a293c5ea370f6cb03bcb687b2488c8955c3cfb66c2c0161ea8c00f6 languageName: node linkType: hard @@ -12260,10 +13718,10 @@ __metadata: languageName: node linkType: hard -"tslib@npm:^2.0.3, tslib@npm:^2.1.0, tslib@npm:^2.4.0": - version: 2.6.2 - resolution: "tslib@npm:2.6.2" - checksum: 329ea56123005922f39642318e3d1f0f8265d1e7fcb92c633e0809521da75eeaca28d2cf96d7248229deb40e5c19adf408259f4b9640afd20d13aecc1430f3ad +"tslib@npm:^2.0.3, tslib@npm:^2.4.0, tslib@npm:^2.6.0": + version: 2.8.1 + resolution: "tslib@npm:2.8.1" + checksum: e4aba30e632b8c8902b47587fd13345e2827fa639e7c3121074d5ee0880723282411a8838f830b55100cbe4517672f84a2472667d355b81e8af165a55dc6203a languageName: node linkType: hard @@ -12294,14 +13752,21 @@ __metadata: languageName: node linkType: hard -"type-fest@npm:^1.0.2": +"type-fest@npm:^0.21.3": + version: 0.21.3 + resolution: "type-fest@npm:0.21.3" + checksum: e6b32a3b3877f04339bae01c193b273c62ba7bfc9e325b8703c4ee1b32dc8fe4ef5dfa54bf78265e069f7667d058e360ae0f37be5af9f153b22382cd55a9afe0 + languageName: node + linkType: hard + +"type-fest@npm:^1.0.1, type-fest@npm:^1.0.2": version: 1.4.0 resolution: "type-fest@npm:1.4.0" checksum: b011c3388665b097ae6a109a437a04d6f61d81b7357f74cbcb02246f2f5bd72b888ae33631b99871388122ba0a87f4ff1c94078e7119ff22c70e52c0ff828201 languageName: node linkType: hard -"type-fest@npm:^2.5.0": +"type-fest@npm:^2.13.0, type-fest@npm:^2.5.0": version: 2.19.0 resolution: "type-fest@npm:2.19.0" checksum: a4ef07ece297c9fba78fc1bd6d85dff4472fe043ede98bd4710d2615d15776902b595abf62bd78339ed6278f021235fb28a96361f8be86ed754f778973a0d278 @@ -12347,36 +13812,31 @@ __metadata: languageName: node linkType: hard -"ua-parser-js@npm:^1.0.35": - version: 1.0.36 - resolution: "ua-parser-js@npm:1.0.36" - checksum: 5b2c8a5e3443dfbba7624421805de946457c26ae167cb2275781a2729d1518f7067c9d5c74c3b0acac4b9ff3278cae4eace08ca6eecb63848bc3b2f6a63cc975 +"undici-types@npm:~7.8.0": + version: 7.8.0 + resolution: "undici-types@npm:7.8.0" + checksum: 59521a5b9b50e72cb838a29466b3557b4eacbc191a83f4df5a2f7b156bc8263072b145dc4bb8ec41da7d56a7e9b178892458da02af769243d57f801a50ac5751 languageName: node linkType: hard -"unescape@npm:^1.0.1": - version: 1.0.1 - resolution: "unescape@npm:1.0.1" - dependencies: - extend-shallow: ^2.0.1 - checksum: 0d89b0f55e08a2843e635f1ccf8472a35b367c41d9a8014dd7de5cc3af710a6e988a950b86b6229e143147ade21772f2d72054bc846f4972eb448df472b856ec +"undici@npm:^7.12.0": + version: 7.12.0 + resolution: "undici@npm:7.12.0" + checksum: dec61384d1d2c610f381debfe6b61bb4720720f36b8a5669ffd216d4e956fa283cb1fd9717ea44bc16b9e8a576ed237a67c40f00b0eba9df46cad01c5945abd8 languageName: node linkType: hard -"unherit@npm:^1.0.4": - version: 1.1.3 - resolution: "unherit@npm:1.1.3" - dependencies: - inherits: ^2.0.0 - xtend: ^4.0.0 - checksum: fd7922f84fc0bfb7c4df6d1f5a50b5b94a0218e3cda98a54dbbd209226ddd4072d742d3df44d0e295ab08d5ccfd304a1e193dfe31a86d2a91b7cb9fdac093194 +"unicode-canonical-property-names-ecmascript@npm:^2.0.0": + version: 2.0.1 + resolution: "unicode-canonical-property-names-ecmascript@npm:2.0.1" + checksum: 3c3dabdb1d22aef4904399f9e810d0b71c0b12b3815169d96fac97e56d5642840c6071cf709adcace2252bc6bb80242396c2ec74b37224eb015c5f7aca40bad7 languageName: node linkType: hard -"unicode-canonical-property-names-ecmascript@npm:^2.0.0": - version: 2.0.0 - resolution: "unicode-canonical-property-names-ecmascript@npm:2.0.0" - checksum: 39be078afd014c14dcd957a7a46a60061bc37c4508ba146517f85f60361acf4c7539552645ece25de840e17e293baa5556268d091ca6762747fdd0c705001a45 +"unicode-emoji-modifier-base@npm:^1.0.0": + version: 1.0.0 + resolution: "unicode-emoji-modifier-base@npm:1.0.0" + checksum: 6e1521d35fa69493207eb8b41f8edb95985d8b3faf07c01d820a1830b5e8403e20002563e2f84683e8e962a49beccae789f0879356bf92a4ec7a4dd8e2d16fdb languageName: node linkType: hard @@ -12391,9 +13851,9 @@ __metadata: linkType: hard "unicode-match-property-value-ecmascript@npm:^2.0.0, unicode-match-property-value-ecmascript@npm:^2.1.0": - version: 2.1.0 - resolution: "unicode-match-property-value-ecmascript@npm:2.1.0" - checksum: 8d6f5f586b9ce1ed0e84a37df6b42fdba1317a05b5df0c249962bd5da89528771e2d149837cad11aa26bcb84c35355cb9f58a10c3d41fa3b899181ece6c85220 + version: 2.2.0 + resolution: "unicode-match-property-value-ecmascript@npm:2.2.0" + checksum: 9e3151e1d0bc6be35c4cef105e317c04090364173e8462005b5cde08a1e7c858b6586486cfebac39dc2c6c8c9ee24afb245de6d527604866edfa454fe2a35fae languageName: node linkType: hard @@ -12404,20 +13864,6 @@ __metadata: languageName: node linkType: hard -"unified@npm:9.2.0": - version: 9.2.0 - resolution: "unified@npm:9.2.0" - dependencies: - bail: ^1.0.0 - extend: ^3.0.0 - is-buffer: ^2.0.0 - is-plain-obj: ^2.0.0 - trough: ^1.0.0 - vfile: ^4.0.0 - checksum: 0cac4ae119893fbd49d309b4db48595e4d4e9f0a2dc1dde4d0074059f9a46012a2905f37c1346715e583f30c970bc8078db8462675411d39ff5036ae18b4fb8a - languageName: node - linkType: hard - "unified@npm:^10.0.0": version: 10.1.2 resolution: "unified@npm:10.1.2" @@ -12433,58 +13879,45 @@ __metadata: languageName: node linkType: hard -"unified@npm:^9.2.2": - version: 9.2.2 - resolution: "unified@npm:9.2.2" +"unified@npm:^11.0.0, unified@npm:^11.0.3, unified@npm:^11.0.4": + version: 11.0.5 + resolution: "unified@npm:11.0.5" dependencies: - bail: ^1.0.0 + "@types/unist": ^3.0.0 + bail: ^2.0.0 + devlop: ^1.0.0 extend: ^3.0.0 - is-buffer: ^2.0.0 - is-plain-obj: ^2.0.0 - trough: ^1.0.0 - vfile: ^4.0.0 - checksum: 7c24461be7de4145939739ce50d18227c5fbdf9b3bc5a29dabb1ce26dd3e8bd4a1c385865f6f825f3b49230953ee8b591f23beab3bb3643e3e9dc37aa8a089d5 + is-plain-obj: ^4.0.0 + trough: ^2.0.0 + vfile: ^6.0.0 + checksum: b3bf7fd6f568cc261e074dae21188483b0f2a8ab858d62e6e85b75b96cc655f59532906ae3c64d56a9b257408722d71f1d4135292b3d7ee02907c8b592fb3cf0 languageName: node linkType: hard -"unique-filename@npm:^3.0.0": - version: 3.0.0 - resolution: "unique-filename@npm:3.0.0" +"unique-filename@npm:^4.0.0": + version: 4.0.0 + resolution: "unique-filename@npm:4.0.0" dependencies: - unique-slug: ^4.0.0 - checksum: 8e2f59b356cb2e54aab14ff98a51ac6c45781d15ceaab6d4f1c2228b780193dc70fae4463ce9e1df4479cb9d3304d7c2043a3fb905bdeca71cc7e8ce27e063df + unique-slug: ^5.0.0 + checksum: 6a62094fcac286b9ec39edbd1f8f64ff92383baa430af303dfed1ffda5e47a08a6b316408554abfddd9730c78b6106bef4ca4d02c1231a735ddd56ced77573df languageName: node linkType: hard -"unique-slug@npm:^4.0.0": - version: 4.0.0 - resolution: "unique-slug@npm:4.0.0" +"unique-slug@npm:^5.0.0": + version: 5.0.0 + resolution: "unique-slug@npm:5.0.0" dependencies: imurmurhash: ^0.1.4 - checksum: 0884b58365af59f89739e6f71e3feacb5b1b41f2df2d842d0757933620e6de08eff347d27e9d499b43c40476cbaf7988638d3acb2ffbcb9d35fd035591adfd15 + checksum: 222d0322bc7bbf6e45c08967863212398313ef73423f4125e075f893a02405a5ffdbaaf150f7dd1e99f8861348a486dd079186d27c5f2c60e465b7dcbb1d3e5b languageName: node linkType: hard -"unique-string@npm:^2.0.0": - version: 2.0.0 - resolution: "unique-string@npm:2.0.0" +"unique-string@npm:^3.0.0": + version: 3.0.0 + resolution: "unique-string@npm:3.0.0" dependencies: - crypto-random-string: ^2.0.0 - checksum: ef68f639136bcfe040cf7e3cd7a8dff076a665288122855148a6f7134092e6ed33bf83a7f3a9185e46c98dddc445a0da6ac25612afa1a7c38b8b654d6c02498e - languageName: node - linkType: hard - -"unist-builder@npm:2.0.3, unist-builder@npm:^2.0.0": - version: 2.0.3 - resolution: "unist-builder@npm:2.0.3" - checksum: e946fdf77dbfc320feaece137ce4959ae2da6614abd1623bd39512dc741a9d5f313eb2ba79f8887d941365dccddec7fef4e953827475e392bf49b45336f597f6 - languageName: node - linkType: hard - -"unist-util-generated@npm:^1.0.0": - version: 1.1.6 - resolution: "unist-util-generated@npm:1.1.6" - checksum: 86239ff88a08800d52198f2f0e15911f05bab2dad17cef95550f7c2728f15ebb0344694fcc3101d05762d88adaf86cb85aa7a3300fedabd0b6d7d00b41cdcb7f + crypto-random-string: ^4.0.0 + checksum: 1a1e2e7d02eab1bb10f720475da735e1990c8a5ff34edd1a3b6bc31590cb4210b7a1233d779360cc622ce11c211e43afa1628dd658f35d3e6a89964b622940df languageName: node linkType: hard @@ -12495,13 +13928,6 @@ __metadata: languageName: node linkType: hard -"unist-util-is@npm:^4.0.0": - version: 4.1.0 - resolution: "unist-util-is@npm:4.1.0" - checksum: 726484cd2adc9be75a939aeedd48720f88294899c2e4a3143da413ae593f2b28037570730d5cf5fd910ff41f3bc1501e3d636b6814c478d71126581ef695f7ea - languageName: node - linkType: hard - "unist-util-is@npm:^5.0.0": version: 5.2.1 resolution: "unist-util-is@npm:5.2.1" @@ -12511,46 +13937,39 @@ __metadata: languageName: node linkType: hard -"unist-util-position@npm:^3.0.0": - version: 3.1.0 - resolution: "unist-util-position@npm:3.1.0" - checksum: 10b3952e32a1ffabbecad41c3946237f7059f5bb6436796da05531a285f50b97e4f37cfc2f7164676d041063f40fe1ad92fbb8ca38d3ae8747328ebe738d738f - languageName: node - linkType: hard - -"unist-util-position@npm:^4.0.0": - version: 4.0.4 - resolution: "unist-util-position@npm:4.0.4" +"unist-util-is@npm:^6.0.0": + version: 6.0.0 + resolution: "unist-util-is@npm:6.0.0" dependencies: - "@types/unist": ^2.0.0 - checksum: e7487b6cec9365299695e3379ded270a1717074fa11fd2407c9b934fb08db6fe1d9077ddeaf877ecf1813665f8ccded5171693d3d9a7a01a125ec5cdd5e88691 + "@types/unist": ^3.0.0 + checksum: f630a925126594af9993b091cf807b86811371e465b5049a6283e08537d3e6ba0f7e248e1e7dab52cfe33f9002606acef093441137181b327f6fe504884b20e2 languageName: node linkType: hard -"unist-util-remove-position@npm:^2.0.0": - version: 2.0.1 - resolution: "unist-util-remove-position@npm:2.0.1" +"unist-util-position-from-estree@npm:^2.0.0": + version: 2.0.0 + resolution: "unist-util-position-from-estree@npm:2.0.0" dependencies: - unist-util-visit: ^2.0.0 - checksum: 4149294969f1a78a367b5d03eb0a138aa8320a39e1b15686647a2bec5945af3df27f2936a1e9752ecbb4a82dc23bd86f7e5a0ee048e5eeaedc2deb9237872795 + "@types/unist": ^3.0.0 + checksum: d3b3048a5727c2367f64ef6dcc5b20c4717215ef8b1372ff9a7c426297c5d1e5776409938acd01531213e2cd2543218d16e73f9f862f318e9496e2c73bb18354 languageName: node linkType: hard -"unist-util-remove@npm:^2.0.0": - version: 2.1.0 - resolution: "unist-util-remove@npm:2.1.0" +"unist-util-position@npm:^4.0.0": + version: 4.0.4 + resolution: "unist-util-position@npm:4.0.4" dependencies: - unist-util-is: ^4.0.0 - checksum: 99e54f3ea0523f8cf957579a6e84e5b58427bffab929cc7f6aa5119581f929db683dd4691ea5483df0c272f486dda9dbd04f4ab74dca6cae1f3ebe8e4261a4d9 + "@types/unist": ^2.0.0 + checksum: e7487b6cec9365299695e3379ded270a1717074fa11fd2407c9b934fb08db6fe1d9077ddeaf877ecf1813665f8ccded5171693d3d9a7a01a125ec5cdd5e88691 languageName: node linkType: hard -"unist-util-stringify-position@npm:^2.0.0": - version: 2.0.3 - resolution: "unist-util-stringify-position@npm:2.0.3" +"unist-util-position@npm:^5.0.0": + version: 5.0.0 + resolution: "unist-util-position@npm:5.0.0" dependencies: - "@types/unist": ^2.0.2 - checksum: f755cadc959f9074fe999578a1a242761296705a7fe87f333a37c00044de74ab4b184b3812989a57d4cd12211f0b14ad397b327c3a594c7af84361b1c25a7f09 + "@types/unist": ^3.0.0 + checksum: f89b27989b19f07878de9579cd8db2aa0194c8360db69e2c99bd2124a480d79c08f04b73a64daf01a8fb3af7cba65ff4b45a0b978ca243226084ad5f5d441dde languageName: node linkType: hard @@ -12563,13 +13982,12 @@ __metadata: languageName: node linkType: hard -"unist-util-visit-parents@npm:^3.0.0": - version: 3.1.1 - resolution: "unist-util-visit-parents@npm:3.1.1" +"unist-util-stringify-position@npm:^4.0.0": + version: 4.0.0 + resolution: "unist-util-stringify-position@npm:4.0.0" dependencies: - "@types/unist": ^2.0.0 - unist-util-is: ^4.0.0 - checksum: 1170e397dff88fab01e76d5154981666eb0291019d2462cff7a2961a3e76d3533b42eaa16b5b7e2d41ad42a5ea7d112301458283d255993e660511387bf67bc3 + "@types/unist": ^3.0.0 + checksum: e2e7aee4b92ddb64d314b4ac89eef7a46e4c829cbd3ee4aee516d100772b490eb6b4974f653ba0717a0071ca6ea0770bf22b0a2ea62c65fcba1d071285e96324 languageName: node linkType: hard @@ -12583,14 +14001,13 @@ __metadata: languageName: node linkType: hard -"unist-util-visit@npm:2.0.3, unist-util-visit@npm:^2.0.0, unist-util-visit@npm:^2.0.3": - version: 2.0.3 - resolution: "unist-util-visit@npm:2.0.3" +"unist-util-visit-parents@npm:^6.0.0": + version: 6.0.1 + resolution: "unist-util-visit-parents@npm:6.0.1" dependencies: - "@types/unist": ^2.0.0 - unist-util-is: ^4.0.0 - unist-util-visit-parents: ^3.0.0 - checksum: 1fe19d500e212128f96d8c3cfa3312846e586b797748a1fd195fe6479f06bc90a6f6904deb08eefc00dd58e83a1c8a32fb8677252d2273ad7a5e624525b69b8f + "@types/unist": ^3.0.0 + unist-util-is: ^6.0.0 + checksum: 08927647c579f63b91aafcbec9966dc4a7d0af1e5e26fc69f4e3e6a01215084835a2321b06f3cbe7bf7914a852830fc1439f0fc3d7153d8804ac3ef851ddfa20 languageName: node linkType: hard @@ -12605,10 +14022,21 @@ __metadata: languageName: node linkType: hard +"unist-util-visit@npm:^5.0.0": + version: 5.0.0 + resolution: "unist-util-visit@npm:5.0.0" + dependencies: + "@types/unist": ^3.0.0 + unist-util-is: ^6.0.0 + unist-util-visit-parents: ^6.0.0 + checksum: 9ec42e618e7e5d0202f3c191cd30791b51641285732767ee2e6bcd035931032e3c1b29093f4d7fd0c79175bbc1f26f24f26ee49770d32be76f8730a652a857e6 + languageName: node + linkType: hard + "universalify@npm:^2.0.0": - version: 2.0.0 - resolution: "universalify@npm:2.0.0" - checksum: 2406a4edf4a8830aa6813278bab1f953a8e40f2f63a37873ffa9a3bc8f9745d06cc8e88f3572cb899b7e509013f7f6fcc3e37e8a6d914167a5381d8440518c44 + version: 2.0.1 + resolution: "universalify@npm:2.0.1" + checksum: ecd8469fe0db28e7de9e5289d32bd1b6ba8f7183db34f3bfc4ca53c49891c2d6aa05f3fb3936a81285a905cc509fb641a0c3fc131ec786167eff41236ae32e60 languageName: node linkType: hard @@ -12619,21 +14047,7 @@ __metadata: languageName: node linkType: hard -"update-browserslist-db@npm:^1.0.13": - version: 1.0.13 - resolution: "update-browserslist-db@npm:1.0.13" - dependencies: - escalade: ^3.1.1 - picocolors: ^1.0.0 - peerDependencies: - browserslist: ">= 4.21.0" - bin: - update-browserslist-db: cli.js - checksum: 1e47d80182ab6e4ad35396ad8b61008ae2a1330221175d0abd37689658bdb61af9b705bfc41057fd16682474d79944fb2d86767c5ed5ae34b6276b9bed353322 - languageName: node - linkType: hard - -"update-browserslist-db@npm:^1.1.1": +"update-browserslist-db@npm:^1.1.3": version: 1.1.3 resolution: "update-browserslist-db@npm:1.1.3" dependencies: @@ -12647,25 +14061,25 @@ __metadata: languageName: node linkType: hard -"update-notifier@npm:^5.1.0": - version: 5.1.0 - resolution: "update-notifier@npm:5.1.0" - dependencies: - boxen: ^5.0.0 - chalk: ^4.1.0 - configstore: ^5.0.1 - has-yarn: ^2.1.0 - import-lazy: ^2.1.0 - is-ci: ^2.0.0 +"update-notifier@npm:^6.0.2": + version: 6.0.2 + resolution: "update-notifier@npm:6.0.2" + dependencies: + boxen: ^7.0.0 + chalk: ^5.0.1 + configstore: ^6.0.0 + has-yarn: ^3.0.0 + import-lazy: ^4.0.0 + is-ci: ^3.0.1 is-installed-globally: ^0.4.0 - is-npm: ^5.0.0 - is-yarn-global: ^0.3.0 - latest-version: ^5.1.0 - pupa: ^2.1.1 - semver: ^7.3.4 - semver-diff: ^3.1.1 - xdg-basedir: ^4.0.0 - checksum: 461e5e5b002419296d3868ee2abe0f9ab3e1846d9db642936d0c46f838872ec56069eddfe662c45ce1af0a8d6d5026353728de2e0a95ab2e3546a22ea077caf1 + is-npm: ^6.0.0 + is-yarn-global: ^0.4.0 + latest-version: ^7.0.0 + pupa: ^3.1.0 + semver: ^7.3.7 + semver-diff: ^4.0.0 + xdg-basedir: ^5.1.0 + checksum: 4bae7b3eca7b2068b6b87dde88c9dad24831fa913a5b83ecb39a7e4702c93e8b05fd9bcac5f1a005178f6e5dc859e0b3817ddda833d2a7ab92c6485e078b3cc8 languageName: node linkType: hard @@ -12695,56 +14109,12 @@ __metadata: languageName: node linkType: hard -"url-parse-lax@npm:^3.0.0": - version: 3.0.0 - resolution: "url-parse-lax@npm:3.0.0" - dependencies: - prepend-http: ^2.0.0 - checksum: 1040e357750451173132228036aff1fd04abbd43eac1fb3e4fca7495a078bcb8d33cb765fe71ad7e473d9c94d98fd67adca63bd2716c815a2da066198dd37217 - languageName: node - linkType: hard - -"use-composed-ref@npm:^1.3.0": - version: 1.3.0 - resolution: "use-composed-ref@npm:1.3.0" - peerDependencies: - react: ^16.8.0 || ^17.0.0 || ^18.0.0 - checksum: f771cbadfdc91e03b7ab9eb32d0fc0cc647755711801bf507e891ad38c4bbc5f02b2509acadf9c965ec9c5f2f642fd33bdfdfb17b0873c4ad0a9b1f5e5e724bf - languageName: node - linkType: hard - -"use-isomorphic-layout-effect@npm:^1.1.1": - version: 1.1.2 - resolution: "use-isomorphic-layout-effect@npm:1.1.2" - peerDependencies: - react: ^16.8.0 || ^17.0.0 || ^18.0.0 - peerDependenciesMeta: - "@types/react": - optional: true - checksum: a6532f7fc9ae222c3725ff0308aaf1f1ddbd3c00d685ef9eee6714fd0684de5cb9741b432fbf51e61a784e2955424864f7ea9f99734a02f237b17ad3e18ea5cb - languageName: node - linkType: hard - -"use-latest@npm:^1.2.1": - version: 1.2.1 - resolution: "use-latest@npm:1.2.1" - dependencies: - use-isomorphic-layout-effect: ^1.1.1 - peerDependencies: - react: ^16.8.0 || ^17.0.0 || ^18.0.0 - peerDependenciesMeta: - "@types/react": - optional: true - checksum: ed3f2ddddf6f21825e2ede4c2e0f0db8dcce5129802b69d1f0575fc1b42380436e8c76a6cd885d4e9aa8e292e60fb8b959c955f33c6a9123b83814a1a1875367 - languageName: node - linkType: hard - -"use-sync-external-store@npm:^1.2.0": - version: 1.2.0 - resolution: "use-sync-external-store@npm:1.2.0" +"use-editable@npm:^2.3.3": + version: 2.3.3 + resolution: "use-editable@npm:2.3.3" peerDependencies: - react: ^16.8.0 || ^17.0.0 || ^18.0.0 - checksum: 5c639e0f8da3521d605f59ce5be9e094ca772bd44a4ce7322b055a6f58eeed8dda3c94cabd90c7a41fb6fa852210092008afe48f7038792fd47501f33299116a + react: ">= 16.8.0" + checksum: cc63f474dc097242522361fbabf824b307e13fbe64a382a21a5e5e36d34bc64098b8a00467142ff9ba71bf35168d3ce3a1768435d87e2239b0311af18f758709 languageName: node linkType: hard @@ -12763,9 +14133,9 @@ __metadata: linkType: hard "utility-types@npm:^3.10.0": - version: 3.10.0 - resolution: "utility-types@npm:3.10.0" - checksum: 8f274415c6196ab62883b8bd98c9d2f8829b58016e4269aaa1ebd84184ac5dda7dc2ca45800c0d5e0e0650966ba063bf9a412aaeaea6850ca4440a391283d5c8 + version: 3.11.0 + resolution: "utility-types@npm:3.11.0" + checksum: 35a4866927bbea5d037726744028d05c6e37772ded2aabaca21480ce9380185436aef586ead525e327c7f3c640b1a3287769a12ef269c7b165a2ddd50ea6ad61 languageName: node linkType: hard @@ -12813,20 +14183,13 @@ __metadata: languageName: node linkType: hard -"vfile-location@npm:^3.0.0, vfile-location@npm:^3.2.0": - version: 3.2.0 - resolution: "vfile-location@npm:3.2.0" - checksum: 9bb3df6d0be31b5dd2d8da0170c27b7045c64493a8ba7b6ff7af8596c524fc8896924b8dd85ae12d201eead2709217a0fbc44927b7264f4bbf0aa8027a78be9c - languageName: node - linkType: hard - -"vfile-message@npm:^2.0.0": - version: 2.0.4 - resolution: "vfile-message@npm:2.0.4" +"vfile-location@npm:^5.0.0": + version: 5.0.3 + resolution: "vfile-location@npm:5.0.3" dependencies: - "@types/unist": ^2.0.0 - unist-util-stringify-position: ^2.0.0 - checksum: 1bade499790f46ca5aba04bdce07a1e37c2636a8872e05cf32c26becc912826710b7eb063d30c5754fdfaeedc8a7658e78df10b3bc535c844890ec8a184f5643 + "@types/unist": ^3.0.0 + vfile: ^6.0.0 + checksum: bfb3821b6981b6e9aa369bed67a40090b800562064ea312e84437762562df3225a0ca922695389cc0ef1e115f19476c363f53e3ed44dec17c50678b7670b5f2b languageName: node linkType: hard @@ -12840,15 +14203,13 @@ __metadata: languageName: node linkType: hard -"vfile@npm:^4.0.0": - version: 4.2.1 - resolution: "vfile@npm:4.2.1" +"vfile-message@npm:^4.0.0": + version: 4.0.2 + resolution: "vfile-message@npm:4.0.2" dependencies: - "@types/unist": ^2.0.0 - is-buffer: ^2.0.0 - unist-util-stringify-position: ^2.0.0 - vfile-message: ^2.0.0 - checksum: ee5726e10d170472cde778fc22e0f7499caa096eb85babea5d0ce0941455b721037ee1c9e6ae506ca2803250acd313d0f464328ead0b55cfe7cb6315f1b462d6 + "@types/unist": ^3.0.0 + unist-util-stringify-position: ^4.0.0 + checksum: 964e7e119f4c0e0270fc269119c41c96da20afa01acb7c9809a88365c8e0c64aa692fafbd952669382b978002ecd7ad31ef4446d85e8a22cdb62f6df20186c2d languageName: node linkType: hard @@ -12864,35 +14225,23 @@ __metadata: languageName: node linkType: hard -"vlq@npm:^1.0.0": - version: 1.0.1 - resolution: "vlq@npm:1.0.1" - checksum: 67ab6dd35c787eaa02c0ff1a869dd07a230db08722fb6014adaaf432634808ddb070765f70958b47997e438c331790cfcf20902411b0d6453f1a2a5923522f55 - languageName: node - linkType: hard - -"wait-on@npm:^6.0.1": - version: 6.0.1 - resolution: "wait-on@npm:6.0.1" +"vfile@npm:^6.0.0, vfile@npm:^6.0.1": + version: 6.0.3 + resolution: "vfile@npm:6.0.3" dependencies: - axios: ^0.25.0 - joi: ^17.6.0 - lodash: ^4.17.21 - minimist: ^1.2.5 - rxjs: ^7.5.4 - bin: - wait-on: bin/wait-on - checksum: e4d62aa4145d99fe34747ccf7506d4b4d6e60dd677c0eb18a51e316d38116ace2d194e4b22a9eb7b767b0282f39878ddcc4ae9440dcb0c005c9150668747cf5b + "@types/unist": ^3.0.0 + vfile-message: ^4.0.0 + checksum: 152b6729be1af70df723efb65c1a1170fd483d41086557da3651eea69a1dd1f0c22ea4344834d56d30734b9185bcab63e22edc81d3f0e9bed8aa4660d61080af languageName: node linkType: hard -"watchpack@npm:^2.4.0": - version: 2.4.0 - resolution: "watchpack@npm:2.4.0" +"watchpack@npm:^2.4.1": + version: 2.4.4 + resolution: "watchpack@npm:2.4.4" dependencies: glob-to-regexp: ^0.4.1 graceful-fs: ^4.1.2 - checksum: 23d4bc58634dbe13b86093e01c6a68d8096028b664ab7139d58f0c37d962d549a940e98f2f201cecdabd6f9c340338dc73ef8bf094a2249ef582f35183d1a131 + checksum: 469514a04bcdd7ea77d4b3c62d1f087eafbce64cbc728c89355d5710ee01311533456122da7c585d3654d5bfcf09e6085db1a6eb274c4762a18e370526d17561 languageName: node linkType: hard @@ -12905,50 +14254,38 @@ __metadata: languageName: node linkType: hard -"web-namespaces@npm:^1.0.0": - version: 1.1.4 - resolution: "web-namespaces@npm:1.1.4" - checksum: 5149842ccbfbc56fe4f8758957b3f8c8616a281874a5bb84aa1b305e4436a9bad853d21c629a7b8f174902449e1489c7a6c724fccf60965077c5636bd8aed42b - languageName: node - linkType: hard - -"webidl-conversions@npm:^3.0.0": - version: 3.0.1 - resolution: "webidl-conversions@npm:3.0.1" - checksum: c92a0a6ab95314bde9c32e1d0a6dfac83b578f8fa5f21e675bc2706ed6981bc26b7eb7e6a1fab158e5ce4adf9caa4a0aee49a52505d4d13c7be545f15021b17c +"web-namespaces@npm:^2.0.0": + version: 2.0.1 + resolution: "web-namespaces@npm:2.0.1" + checksum: b6d9f02f1a43d0ef0848a812d89c83801d5bbad57d8bb61f02eb6d7eb794c3736f6cc2e1191664bb26136594c8218ac609f4069722c6f56d9fc2d808fa9271c6 languageName: node linkType: hard -"webpack-bundle-analyzer@npm:^4.5.0": - version: 4.9.1 - resolution: "webpack-bundle-analyzer@npm:4.9.1" +"webpack-bundle-analyzer@npm:^4.10.2": + version: 4.10.2 + resolution: "webpack-bundle-analyzer@npm:4.10.2" dependencies: "@discoveryjs/json-ext": 0.5.7 acorn: ^8.0.4 acorn-walk: ^8.0.0 commander: ^7.2.0 + debounce: ^1.2.1 escape-string-regexp: ^4.0.0 gzip-size: ^6.0.0 - is-plain-object: ^5.0.0 - lodash.debounce: ^4.0.8 - lodash.escape: ^4.0.1 - lodash.flatten: ^4.4.0 - lodash.invokemap: ^4.6.0 - lodash.pullall: ^4.2.0 - lodash.uniqby: ^4.7.0 + html-escaper: ^2.0.2 opener: ^1.5.2 picocolors: ^1.0.0 sirv: ^2.0.3 ws: ^7.3.1 bin: webpack-bundle-analyzer: lib/bin/analyzer.js - checksum: 7e891c28d5a903242893e55ecc714fa01d7ad6bedade143235c07091b235915349812fa048968462781d59187507962f38b6c61ed7d25fb836ba0ac0ee919a39 + checksum: 4f0275e7d87bb6203a618ca5d2d4953943979d986fa2b91be1bf1ad0bcd22bec13398803273d11699f9fbcf106896311208a72d63fe5f8a47b687a226e598dc1 languageName: node linkType: hard -"webpack-dev-middleware@npm:^5.3.1": - version: 5.3.3 - resolution: "webpack-dev-middleware@npm:5.3.3" +"webpack-dev-middleware@npm:^5.3.4": + version: 5.3.4 + resolution: "webpack-dev-middleware@npm:5.3.4" dependencies: colorette: ^2.0.10 memfs: ^3.4.3 @@ -12957,13 +14294,13 @@ __metadata: schema-utils: ^4.0.0 peerDependencies: webpack: ^4.0.0 || ^5.0.0 - checksum: dd332cc6da61222c43d25e5a2155e23147b777ff32fdf1f1a0a8777020c072fbcef7756360ce2a13939c3f534c06b4992a4d659318c4a7fe2c0530b52a8a6621 + checksum: 90cf3e27d0714c1a745454a1794f491b7076434939340605b9ee8718ba2b85385b120939754e9fdbd6569811e749dee53eec319e0d600e70e0b0baffd8e3fb13 languageName: node linkType: hard -"webpack-dev-server@npm:^4.9.3": - version: 4.15.1 - resolution: "webpack-dev-server@npm:4.15.1" +"webpack-dev-server@npm:^4.15.2": + version: 4.15.2 + resolution: "webpack-dev-server@npm:4.15.2" dependencies: "@types/bonjour": ^3.5.9 "@types/connect-history-api-fallback": ^1.3.5 @@ -12993,7 +14330,7 @@ __metadata: serve-index: ^1.9.1 sockjs: ^0.3.24 spdy: ^4.0.2 - webpack-dev-middleware: ^5.3.1 + webpack-dev-middleware: ^5.3.4 ws: ^8.13.0 peerDependencies: webpack: ^4.37.0 || ^5.0.0 @@ -13004,75 +14341,92 @@ __metadata: optional: true bin: webpack-dev-server: bin/webpack-dev-server.js - checksum: cd0063b068d2b938fd76c412d555374186ac2fa84bbae098265212ed50a5c15d6f03aa12a5a310c544a242943eb58c0bfde4c296d5c36765c182f53799e1bc71 + checksum: 123507129cb4d55fdc5fabdd177574f31133605748372bb11353307b7a583ef25c6fd27b6addf56bf070ba44c88d5da861771c2ec55f52405082ec9efd01f039 languageName: node linkType: hard -"webpack-merge@npm:^5.8.0": - version: 5.9.0 - resolution: "webpack-merge@npm:5.9.0" +"webpack-merge@npm:^5.9.0": + version: 5.10.0 + resolution: "webpack-merge@npm:5.10.0" dependencies: clone-deep: ^4.0.1 + flat: ^5.0.2 wildcard: ^2.0.0 - checksum: 64fe2c23aacc5f19684452a0e84ec02c46b990423aee6fcc5c18d7d471155bd14e9a6adb02bd3656eb3e0ac2532c8e97d69412ad14c97eeafe32fa6d10050872 + checksum: 1fe8bf5309add7298e1ac72fb3f2090e1dfa80c48c7e79fa48aa60b5961332c7d0d61efa8851acb805e6b91a4584537a347bc106e05e9aec87fa4f7088c62f2f + languageName: node + linkType: hard + +"webpack-merge@npm:^6.0.1": + version: 6.0.1 + resolution: "webpack-merge@npm:6.0.1" + dependencies: + clone-deep: ^4.0.1 + flat: ^5.0.2 + wildcard: ^2.0.1 + checksum: e8a604c686b944605a1c57cc7b75e886ab902dc5ffdd15259a092c5c2dd5f58868fe39f995ea4bad4f189e38843b061c4ae1eb22822d7169813f4adab571dc3d languageName: node linkType: hard -"webpack-sources@npm:^3.2.2, webpack-sources@npm:^3.2.3": - version: 3.2.3 - resolution: "webpack-sources@npm:3.2.3" - checksum: 989e401b9fe3536529e2a99dac8c1bdc50e3a0a2c8669cbafad31271eadd994bc9405f88a3039cd2e29db5e6d9d0926ceb7a1a4e7409ece021fe79c37d9c4607 +"webpack-sources@npm:^3.3.3": + version: 3.3.3 + resolution: "webpack-sources@npm:3.3.3" + checksum: 243d438ec4dfe805cca20fa66d111114b1f277b8ecfa95bb6ee0a6c7d996aee682539952028c2b203a6c170e6ef56f71ecf3e366e90bf1cb58b0ae982176b651 languageName: node linkType: hard -"webpack@npm:^5.73.0": - version: 5.88.2 - resolution: "webpack@npm:5.88.2" +"webpack@npm:^5.88.1, webpack@npm:^5.95.0": + version: 5.100.2 + resolution: "webpack@npm:5.100.2" dependencies: - "@types/eslint-scope": ^3.7.3 - "@types/estree": ^1.0.0 - "@webassemblyjs/ast": ^1.11.5 - "@webassemblyjs/wasm-edit": ^1.11.5 - "@webassemblyjs/wasm-parser": ^1.11.5 - acorn: ^8.7.1 - acorn-import-assertions: ^1.9.0 - browserslist: ^4.14.5 + "@types/eslint-scope": ^3.7.7 + "@types/estree": ^1.0.8 + "@types/json-schema": ^7.0.15 + "@webassemblyjs/ast": ^1.14.1 + "@webassemblyjs/wasm-edit": ^1.14.1 + "@webassemblyjs/wasm-parser": ^1.14.1 + acorn: ^8.15.0 + acorn-import-phases: ^1.0.3 + browserslist: ^4.24.0 chrome-trace-event: ^1.0.2 - enhanced-resolve: ^5.15.0 + enhanced-resolve: ^5.17.2 es-module-lexer: ^1.2.1 eslint-scope: 5.1.1 events: ^3.2.0 glob-to-regexp: ^0.4.1 - graceful-fs: ^4.2.9 + graceful-fs: ^4.2.11 json-parse-even-better-errors: ^2.3.1 loader-runner: ^4.2.0 mime-types: ^2.1.27 neo-async: ^2.6.2 - schema-utils: ^3.2.0 + schema-utils: ^4.3.2 tapable: ^2.1.1 - terser-webpack-plugin: ^5.3.7 - watchpack: ^2.4.0 - webpack-sources: ^3.2.3 + terser-webpack-plugin: ^5.3.11 + watchpack: ^2.4.1 + webpack-sources: ^3.3.3 peerDependenciesMeta: webpack-cli: optional: true bin: webpack: bin/webpack.js - checksum: 79476a782da31a21f6dd38fbbd06b68da93baf6a62f0d08ca99222367f3b8668f5a1f2086b7bb78e23172e31fa6df6fa7ab09b25e827866c4fc4dc2b30443ce2 + checksum: 78003fe8948ab6c5192b9fbabdef9c4f572229b7da9c950b4e9f4625d2907a7c1a3c2b77b507f1eab5c33d29964802d24826230a17dd3d34b1a73612693f4172 languageName: node linkType: hard -"webpackbar@npm:^5.0.2": - version: 5.0.2 - resolution: "webpackbar@npm:5.0.2" +"webpackbar@npm:^6.0.1": + version: 6.0.1 + resolution: "webpackbar@npm:6.0.1" dependencies: - chalk: ^4.1.0 - consola: ^2.15.3 + ansi-escapes: ^4.3.2 + chalk: ^4.1.2 + consola: ^3.2.3 + figures: ^3.2.0 + markdown-table: ^2.0.0 pretty-time: ^1.1.0 - std-env: ^3.0.1 + std-env: ^3.7.0 + wrap-ansi: ^7.0.0 peerDependencies: webpack: 3 || 4 || 5 - checksum: 214a734b1d4d391eb8271ed1b11085f0efe6831e93f641229b292abfd6fea871422dce121612511c17ae8047522be6d65c1a2666cabb396c79549816a3612338 + checksum: e9ba314452486230668ab34aea7c3494866dbe29e327e9201551a839000ee7e878d8a47b8977acb76ec9443b4257dfcdb05bae9bbc27ffb21793d2bed7907687 languageName: node linkType: hard @@ -13094,28 +14448,23 @@ __metadata: languageName: node linkType: hard -"whatwg-url@npm:^5.0.0": - version: 5.0.0 - resolution: "whatwg-url@npm:5.0.0" +"whatwg-encoding@npm:^3.1.1": + version: 3.1.1 + resolution: "whatwg-encoding@npm:3.1.1" dependencies: - tr46: ~0.0.3 - webidl-conversions: ^3.0.0 - checksum: b8daed4ad3356cc4899048a15b2c143a9aed0dfae1f611ebd55073310c7b910f522ad75d727346ad64203d7e6c79ef25eafd465f4d12775ca44b90fa82ed9e2c + iconv-lite: 0.6.3 + checksum: f75a61422421d991e4aec775645705beaf99a16a88294d68404866f65e92441698a4f5b9fa11dd609017b132d7b286c3c1534e2de5b3e800333856325b549e3c languageName: node linkType: hard -"which@npm:^1.3.1": - version: 1.3.1 - resolution: "which@npm:1.3.1" - dependencies: - isexe: ^2.0.0 - bin: - which: ./bin/which - checksum: f2e185c6242244b8426c9df1510e86629192d93c1a986a7d2a591f2c24869e7ffd03d6dac07ca863b2e4c06f59a4cc9916c585b72ee9fa1aa609d0124df15e04 +"whatwg-mimetype@npm:^4.0.0": + version: 4.0.0 + resolution: "whatwg-mimetype@npm:4.0.0" + checksum: f97edd4b4ee7e46a379f3fb0e745de29fe8b839307cc774300fd49059fcdd560d38cb8fe21eae5575b8f39b022f23477cc66e40b0355c2851ce84760339cef30 languageName: node linkType: hard -"which@npm:^2.0.1, which@npm:^2.0.2": +"which@npm:^2.0.1": version: 2.0.2 resolution: "which@npm:2.0.2" dependencies: @@ -13126,21 +14475,14 @@ __metadata: languageName: node linkType: hard -"wide-align@npm:^1.1.5": - version: 1.1.5 - resolution: "wide-align@npm:1.1.5" - dependencies: - string-width: ^1.0.2 || 2 || 3 || 4 - checksum: d5fc37cd561f9daee3c80e03b92ed3e84d80dde3365a8767263d03dacfc8fa06b065ffe1df00d8c2a09f731482fcacae745abfbb478d4af36d0a891fad4834d3 - languageName: node - linkType: hard - -"widest-line@npm:^3.1.0": - version: 3.1.0 - resolution: "widest-line@npm:3.1.0" +"which@npm:^5.0.0": + version: 5.0.0 + resolution: "which@npm:5.0.0" dependencies: - string-width: ^4.0.0 - checksum: 03db6c9d0af9329c37d74378ff1d91972b12553c7d72a6f4e8525fe61563fa7adb0b9d6e8d546b7e059688712ea874edd5ded475999abdeedf708de9849310e0 + isexe: ^3.1.1 + bin: + node-which: bin/which.js + checksum: 6ec99e89ba32c7e748b8a3144e64bfc74aa63e2b2eacbb61a0060ad0b961eb1a632b08fb1de067ed59b002cec3e21de18299216ebf2325ef0f78e0f121e14e90 languageName: node linkType: hard @@ -13153,13 +14495,20 @@ __metadata: languageName: node linkType: hard -"wildcard@npm:^2.0.0": +"wildcard@npm:^2.0.0, wildcard@npm:^2.0.1": version: 2.0.1 resolution: "wildcard@npm:2.0.1" checksum: e0c60a12a219e4b12065d1199802d81c27b841ed6ad6d9d28240980c73ceec6f856771d575af367cbec2982d9ae7838759168b551776577f155044f5a5ba843c languageName: node linkType: hard +"word-wrap@npm:^1.2.5": + version: 1.2.5 + resolution: "word-wrap@npm:1.2.5" + checksum: f93ba3586fc181f94afdaff3a6fef27920b4b6d9eaefed0f428f8e07adea2a7f54a5f2830ce59406c8416f033f86902b91eb824072354645eea687dff3691ccb + languageName: node + linkType: hard + "wrap-ansi-cjs@npm:wrap-ansi@^7.0.0, wrap-ansi@npm:^7.0.0": version: 7.0.0 resolution: "wrap-ansi@npm:7.0.0" @@ -13189,7 +14538,7 @@ __metadata: languageName: node linkType: hard -"write-file-atomic@npm:^3.0.0": +"write-file-atomic@npm:^3.0.3": version: 3.0.3 resolution: "write-file-atomic@npm:3.0.3" dependencies: @@ -13202,8 +14551,8 @@ __metadata: linkType: hard "ws@npm:^7.3.1": - version: 7.5.9 - resolution: "ws@npm:7.5.9" + version: 7.5.10 + resolution: "ws@npm:7.5.10" peerDependencies: bufferutil: ^4.0.1 utf-8-validate: ^5.0.2 @@ -13212,13 +14561,13 @@ __metadata: optional: true utf-8-validate: optional: true - checksum: c3c100a181b731f40b7f2fddf004aa023f79d64f489706a28bc23ff88e87f6a64b3c6651fbec3a84a53960b75159574d7a7385709847a62ddb7ad6af76f49138 + checksum: f9bb062abf54cc8f02d94ca86dcd349c3945d63851f5d07a3a61c2fcb755b15a88e943a63cf580cbdb5b74436d67ef6b67f745b8f7c0814e411379138e1863cb languageName: node linkType: hard "ws@npm:^8.13.0": - version: 8.14.2 - resolution: "ws@npm:8.14.2" + version: 8.18.3 + resolution: "ws@npm:8.18.3" peerDependencies: bufferutil: ^4.0.1 utf-8-validate: ">=5.0.2" @@ -13227,14 +14576,14 @@ __metadata: optional: true utf-8-validate: optional: true - checksum: 3ca0dad26e8cc6515ff392b622a1467430814c463b3368b0258e33696b1d4bed7510bc7030f7b72838b9fdeb8dbd8839cbf808367d6aae2e1d668ce741d4308b + checksum: d64ef1631227bd0c5fe21b3eb3646c9c91229402fb963d12d87b49af0a1ef757277083af23a5f85742bae1e520feddfb434cb882ea59249b15673c16dc3f36e0 languageName: node linkType: hard -"xdg-basedir@npm:^4.0.0": - version: 4.0.0 - resolution: "xdg-basedir@npm:4.0.0" - checksum: 0073d5b59a37224ed3a5ac0dd2ec1d36f09c49f0afd769008a6e9cd3cd666bd6317bd1c7ce2eab47e1de285a286bad11a9b038196413cd753b79770361855f3c +"xdg-basedir@npm:^5.0.1, xdg-basedir@npm:^5.1.0": + version: 5.1.0 + resolution: "xdg-basedir@npm:5.1.0" + checksum: b60e8a2c663ccb1dac77c2d913f3b96de48dafbfa083657171d3d50e10820b8a04bb4edfe9f00808c8c20e5f5355e1927bea9029f03136e29265cb98291e1fea languageName: node linkType: hard @@ -13249,13 +14598,6 @@ __metadata: languageName: node linkType: hard -"xtend@npm:^4.0.0, xtend@npm:^4.0.1": - version: 4.0.2 - resolution: "xtend@npm:4.0.2" - checksum: ac5dfa738b21f6e7f0dd6e65e1b3155036d68104e67e5d5d1bde74892e327d7e5636a076f625599dc394330a731861e87343ff184b0047fef1360a7ec0a5a36a - languageName: node - linkType: hard - "yallist@npm:^3.0.2": version: 3.1.1 resolution: "yallist@npm:3.1.1" @@ -13270,6 +14612,13 @@ __metadata: languageName: node linkType: hard +"yallist@npm:^5.0.0": + version: 5.0.0 + resolution: "yallist@npm:5.0.0" + checksum: eba51182400b9f35b017daa7f419f434424410691bbc5de4f4240cc830fdef906b504424992700dc047f16b4d99100a6f8b8b11175c193f38008e9c96322b6a5 + languageName: node + linkType: hard + "yaml@npm:2.3.1": version: 2.3.1 resolution: "yaml@npm:2.3.1" @@ -13277,19 +14626,12 @@ __metadata: languageName: node linkType: hard -"yaml@npm:^1.10.0, yaml@npm:^1.10.2, yaml@npm:^1.7.2": - version: 1.10.2 - resolution: "yaml@npm:1.10.2" - checksum: ce4ada136e8a78a0b08dc10b4b900936912d15de59905b2bf415b4d33c63df1d555d23acb2a41b23cf9fb5da41c256441afca3d6509de7247daa062fd2c5ea5f - languageName: node - linkType: hard - "yaml@npm:^2.3.4": - version: 2.7.0 - resolution: "yaml@npm:2.7.0" + version: 2.8.0 + resolution: "yaml@npm:2.8.0" bin: yaml: bin.mjs - checksum: 6e8b2f9b9d1b18b10274d58eb3a47ec223d9a93245a890dcb34d62865f7e744747190a9b9177d5f0ef4ea2e44ad2c0214993deb42e0800766203ac46f00a12dd + checksum: 66f103ca5a2f02dac0526895cc7ae7626d91aa8c43aad6fdcff15edf68b1199be4012140b390063877913441aaa5288fdf57eca30e06268a8282dd741525e626 languageName: node linkType: hard @@ -13300,9 +14642,16 @@ __metadata: languageName: node linkType: hard -"zwitch@npm:^1.0.0": - version: 1.0.5 - resolution: "zwitch@npm:1.0.5" - checksum: 28a1bebacab3bc60150b6b0a2ba1db2ad033f068e81f05e4892ec0ea13ae63f5d140a1d692062ac0657840c8da076f35b94433b5f1c329d7803b247de80f064a +"yocto-queue@npm:^1.0.0": + version: 1.2.1 + resolution: "yocto-queue@npm:1.2.1" + checksum: 0843d6c2c0558e5c06e98edf9c17942f25c769e21b519303a5c2adefd5b738c9b2054204dc856ac0cd9d134b1bc27d928ce84fd23c9e2423b7e013d5a6f50577 + languageName: node + linkType: hard + +"zwitch@npm:^2.0.0": + version: 2.0.4 + resolution: "zwitch@npm:2.0.4" + checksum: f22ec5fc2d5f02c423c93d35cdfa83573a3a3bd98c66b927c368ea4d0e7252a500df2a90a6b45522be536a96a73404393c958e945fdba95e6832c200791702b6 languageName: node linkType: hard